Rebrand: Sentry -> Cairn OBS
Full rebrand across cosmetic branding, code identifiers, and infrastructure/data-plane naming, using the supplied Cairn OBS logo package. Cosmetic: favicon/logo swap (also closes a stale license-audit finding -- the old favicon was SvelteKit's unreplaced scaffold logo), new centered welcome landing page, larger/legible sidebar logo, page titles, CLAUDE.md/README/docs prose. Code identifiers: Go module path github.com/sentry/sentry -> github.com/cairnobs/cairnobs across all 13 modules and ~91 files (protoc regenerated); Rust crates sentry-agent/sentry-parser/sentry-search -> cairnobs-*; CLI sentryctl -> cairnobsctl; Terraform provider fully renamed (sentry_dashboard etc. -> cairnobs_dashboard, provider type, env vars); every session/auth cookie name; agent config paths and Windows service identity. Deliberately preserved: the gRPC wire protocol's protobuf packages (sentry.logs.v1, sentry.agent.v1) and their Go import directory (proto/sentry/...) -- renaming the wire-level package would break every currently-deployed agent binary (confirmed two real hosts, including mail.inbuxa.com, are actively streaming through this exact contract) until rebuilt and redeployed in lockstep with an ingest cutover. Only the Go module path wrapping the generated code changes. Infrastructure: every docker-compose container name (root and three component-level compose files); the Helm chart (directory, Chart.yaml, named-template helpers, all templates, values.yaml image repos); Kubernetes Operator (CRD group sentry.io -> cairnobs.io, both CRD YAML files, Go identifiers, RBAC markers); the coupled enterprise/tenantcrd package. Caught and fixed real path-coupling bugs along the way: the Helm chart's search/ingest volume mounts and the dev-only-credential detection constant vs. docker-compose.yml's literal values had to move together or a security warning would have silently stopped firing. Data plane: Postgres database sentry_metadata -> cairnobs_metadata and role sentry -> cairnobs; ClickHouse database sentry -> cairnobs; Kafka topic sentry.logs.raw -> cairnobs.logs.raw and its consumer groups. Source-level defaults, docker-compose.yml, and every migrate.sh/ provision script default updated together; already-applied migration files left untouched per this repo's immutable-migration convention. Verified at every layer: all 13 Go modules build/vet/test clean, both Rust workspaces (agent, search) build/clippy/test clean, npm run check/ build clean, docker compose config validates on all four compose files. Live-verified against a real docker stack multiple times through this work, including a final fresh-volume run confirming the actual renamed Postgres database/role, ClickHouse database, and Kafka topic all work end to end with a real login and query, zero console errors.
This commit is contained in:
@@ -0,0 +1,181 @@
|
||||
// Command cairnobsctl is Cairn OBS's control CLI. Six subcommands now
|
||||
// (ping, query, dashboards, alerts) clearly justify splitting dispatch
|
||||
// across files -- see cli/README.md's "revisit once there's a real
|
||||
// command tree" note -- while keeping the same hand-rolled switch on
|
||||
// os.Args, no CLI framework, per that same README.
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"strings"
|
||||
"text/tabwriter"
|
||||
)
|
||||
|
||||
const (
|
||||
defaultAPIURL = "http://localhost:8080"
|
||||
defaultAlertingURL = "http://localhost:8081"
|
||||
)
|
||||
|
||||
func main() {
|
||||
os.Exit(run(os.Args[1:], os.Stdout, os.Stderr))
|
||||
}
|
||||
|
||||
func run(args []string, stdout, stderr io.Writer) int {
|
||||
if len(args) == 0 {
|
||||
usage(stderr)
|
||||
return 1
|
||||
}
|
||||
|
||||
switch args[0] {
|
||||
case "ping":
|
||||
return cmdPing(args[1:], stdout, stderr)
|
||||
case "query":
|
||||
return cmdQuery(args[1:], stdout, stderr)
|
||||
case "dashboards":
|
||||
return cmdDashboards(args[1:], stdout, stderr)
|
||||
case "alerts":
|
||||
return cmdAlerts(args[1:], stdout, stderr)
|
||||
case "agents":
|
||||
return cmdAgents(args[1:], stdout, stderr)
|
||||
case "users":
|
||||
return cmdUsers(args[1:], os.Stdin, stdout, stderr)
|
||||
case "-h", "--help", "help":
|
||||
usage(stdout)
|
||||
return 0
|
||||
default:
|
||||
fmt.Fprintf(stderr, "cairnobsctl: unknown command %q\n", args[0])
|
||||
usage(stderr)
|
||||
return 1
|
||||
}
|
||||
}
|
||||
|
||||
func usage(w io.Writer) {
|
||||
fmt.Fprintln(w, `cairnobsctl: Cairn OBS control CLI
|
||||
|
||||
Usage:
|
||||
cairnobsctl ping [--api <url>]
|
||||
cairnobsctl query "<query>" [--api <url>] [--language sql|spl] [--json]
|
||||
cairnobsctl dashboards list|get <id>|apply <file> [--api <url>]
|
||||
cairnobsctl dashboards permissions list <dashboard-id> [--api <url>]
|
||||
cairnobsctl dashboards permissions grant <dashboard-id> <user-id> viewer|editor [--api <url>]
|
||||
cairnobsctl dashboards permissions revoke <dashboard-id> <user-id> [--api <url>]
|
||||
cairnobsctl alerts list|get <id>|apply <file> [--alerting-api <url>]
|
||||
cairnobsctl agents list|get <host> [--api <url>]
|
||||
cairnobsctl agents config get <host>|clear <host> [--api <url>]
|
||||
cairnobsctl agents config set <host> [--batch-max-size N] [--batch-flush-interval-ms N]
|
||||
[--heartbeat-enabled true|false] [--heartbeat-interval-ms N]
|
||||
[--journald-unit UNIT] [--api <url>]
|
||||
cairnobsctl agents restart <host> [--yes] [--api <url>]
|
||||
cairnobsctl users login <username> [--password <pw>] [--api <url>]
|
||||
cairnobsctl users list [--api <url>]
|
||||
cairnobsctl users create <username> [--password <pw>] [--role viewer|editor|admin|owner] [--api <url>]
|
||||
cairnobsctl users delete <id> [--api <url>]
|
||||
cairnobsctl users reset-password <id> [--password <pw>] [--api <url>]
|
||||
|
||||
Commands:
|
||||
ping Checks that the api service is reachable via GET /healthz.
|
||||
query Runs a query (pipe syntax or SQL) against POST /query and
|
||||
prints the result as a table, or as JSON with --json. Quote
|
||||
the query in your shell -- pipe syntax uses "|", which your
|
||||
shell will otherwise interpret itself.
|
||||
dashboards list/get/apply against api's dashboard CRUD endpoints.
|
||||
"apply <file>" imports a dashboard exported via the web
|
||||
UI's Export JSON button or GET /dashboards/{id}/export --
|
||||
the same JSON shape both places, Terraform-friendly.
|
||||
"permissions" grants/revokes/lists per-resource dashboard
|
||||
access (a Phase 4, enterprise-api-only feature -- a 501 on
|
||||
plain api means no enterprise permission service is wired
|
||||
in on this deployment, not a client error). A grant only
|
||||
ever raises someone to viewer or editor on one dashboard;
|
||||
Admin/Owner already have tenant-wide access.
|
||||
alerts list/get/apply against alerting's rule CRUD endpoints.
|
||||
"apply <file>" creates a rule from a JSON file with the
|
||||
same shape POST /rules accepts.
|
||||
agents Agent inventory, remote config, and lifecycle commands
|
||||
(see /docs/agent-management-design.md). "config set" reads
|
||||
the agent's current effective config first and PUTs back
|
||||
the complete merged override -- only the fields you pass
|
||||
change, everything else carries forward unchanged, same
|
||||
as the web UI's edit form. "restart" briefly interrupts
|
||||
log collection on that host and prompts for confirmation
|
||||
unless --yes is given.
|
||||
users Local username/password login and user management (see
|
||||
api/localauth -- only meaningful on a deployment with
|
||||
LOCAL_AUTH_ENABLED set; a 404 on any of these means it
|
||||
isn't). "login" is the only command that works with no
|
||||
$CAIRNOBSCTL_TOKEN set yet -- it prints just the raw token
|
||||
to stdout: `+"`export CAIRNOBSCTL_TOKEN=$(cairnobsctl users login admin)`"+`.
|
||||
--password (on any users subcommand) is read from stdin
|
||||
if omitted -- same shell-history/ps caveat as typing a
|
||||
credential in any flag, prefer piping it in.
|
||||
"create"/"list"/"delete"/"reset-password" require an
|
||||
owner-role token (see RegisterRoutes in api/localauth).
|
||||
|
||||
--api defaults to $CAIRNOBSCTL_API_URL, or `+defaultAPIURL+` if unset.
|
||||
--alerting-api defaults to $CAIRNOBSCTL_ALERTING_API_URL, or `+defaultAlertingURL+` if unset.
|
||||
--language overrides auto-detection; omit it for the common case.
|
||||
|
||||
$CAIRNOBSCTL_TOKEN, if set, is sent as "Authorization: Bearer <token>" on
|
||||
every request -- required once a deployment configures enterprise-auth
|
||||
(see /docs/phase-4-rbac-design.md). No flag equivalent, deliberately:
|
||||
unlike --api, a credential shouldn't be typed where shell history or
|
||||
`+"`ps`"+` output can capture it.`)
|
||||
}
|
||||
|
||||
func resolveAPIURL(env func(string) string) string {
|
||||
if v := env("CAIRNOBSCTL_API_URL"); v != "" {
|
||||
return v
|
||||
}
|
||||
return defaultAPIURL
|
||||
}
|
||||
|
||||
func resolveAlertingURL(env func(string) string) string {
|
||||
if v := env("CAIRNOBSCTL_ALERTING_API_URL"); v != "" {
|
||||
return v
|
||||
}
|
||||
return defaultAlertingURL
|
||||
}
|
||||
|
||||
// resolveToken reads the RoleService/human bearer credential cairnobsctl
|
||||
// presents to api/alerting once enterprise-auth enforcement is turned
|
||||
// on (api/internal/authz.RequireRole*) -- empty by default, matching
|
||||
// every other Phase 0-3 client's nil-authorizer no-op behavior.
|
||||
func resolveToken(env func(string) string) string {
|
||||
return env("CAIRNOBSCTL_TOKEN")
|
||||
}
|
||||
|
||||
type errorResponseBody struct {
|
||||
Error string `json:"error"`
|
||||
}
|
||||
|
||||
func printTable(w io.Writer, columns []string, rows [][]any) {
|
||||
tw := tabwriter.NewWriter(w, 0, 4, 2, ' ', 0)
|
||||
fmt.Fprintln(tw, strings.Join(columns, "\t"))
|
||||
for _, row := range rows {
|
||||
cells := make([]string, len(row))
|
||||
for i, v := range row {
|
||||
cells[i] = formatCell(v)
|
||||
}
|
||||
fmt.Fprintln(tw, strings.Join(cells, "\t"))
|
||||
}
|
||||
_ = tw.Flush()
|
||||
fmt.Fprintf(w, "(%d row(s))\n", len(rows))
|
||||
}
|
||||
|
||||
func formatCell(v any) string {
|
||||
switch t := v.(type) {
|
||||
case nil:
|
||||
return ""
|
||||
case map[string]any, []any:
|
||||
b, err := json.Marshal(t)
|
||||
if err != nil {
|
||||
return fmt.Sprintf("%v", t)
|
||||
}
|
||||
return string(b)
|
||||
default:
|
||||
return fmt.Sprintf("%v", t)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user