Klarity: GitOps-дашборд для Kubernetes только на чтение

flowchart TD
    classDef clientCls   fill:#0c2140,stroke:#60a5fa,stroke-width:2px,color:#93c5fd
    classDef mwareCls    fill:#1a1040,stroke:#818cf8,stroke-width:2px,color:#c4b5fd
    classDef handlerCls  fill:#160830,stroke:#a78bfa,stroke-width:1.5px,color:#ddd6fe
    classDef realtimeCls fill:#08192e,stroke:#38bdf8,stroke-width:1.5px,color:#7dd3fc
    classDef authCls     fill:#1a0825,stroke:#e879f9,stroke-width:2px,color:#f5d0fe
    classDef kcmCls      fill:#041820,stroke:#22d3ee,stroke-width:3px,color:#a5f3fc
    classDef k8sCls      fill:#021c10,stroke:#4ade80,stroke-width:2px,color:#86efac

    subgraph L1["🌐  Layer 1 — Browser Client"]
        direction LR
        C1["React 18 · TypeScript · Vite\nTailwind CSS · Lucide Icons"]:::clientCls
        C2["TanStack Query v5\nZustand (persist + JWT rehydrate)"]:::clientCls
        C3["xterm.js Terminal\nMonaco YAML Viewer · Recharts"]:::clientCls
    end

    subgraph L2["🛡️  Layer 2 — Middleware Pipeline"]
        direction LR
        MW1["🔐 Auth Middleware\nJWT · OIDC · K8s Token · None"]:::mwareCls
        MW2["📋 Audit Middleware\n2 000-event in-memory ring buffer"]:::mwareCls
        MW3["🔀 CORS  ·  🗜 Gzip\nRequest logging · Panic recovery"]:::mwareCls
    end

    subgraph L3["📦  Layer 3 — Resource Handlers  (~150 routes)"]
        direction LR
        H1["Workloads\nPod · Deployment\nStatefulSet · DaemonSet\nJob · CronJob · ReplicaSet"]:::handlerCls
        H2["Networking\nService · Ingress\nNetworkPolicy\nEndpoints · IngressClass"]:::handlerCls
        H3["Storage\nPersistentVolume · PVC\nStorageClass · CSI\nVolumeAttachment"]:::handlerCls
        H4["Config & Access\nConfigMap · Secret\nServiceAccount\nRBAC Roles & Bindings"]:::handlerCls
        H5["GitOps\nArgoCD Apps · AppSets\nFlux Kustomizations\nHelmReleases · GitRepos"]:::handlerCls
        H6["Operations\nGlobal Search  Ctrl+K\nAudit · Events · Health Report\nTop Consumers · Port-Forward"]:::handlerCls
    end

    subgraph L3B["⚡  Layer 3 — Real-time Layer  (WebSocket + SPDY)"]
        direction LR
        RT1["Log Streaming\nWebSocket · Severity filter\nKeyword search · Download\nAuto-scroll toggle"]:::realtimeCls
        RT2["Web Terminal\nkubectl exec via xterm.js\nConnecting · Reconnecting\nError state recovery"]:::realtimeCls
        RT3["Port-Forward Proxy\nSPDY tunnel via K8s API\nHTTP reverse proxy\nAny pod port in browser"]:::realtimeCls
    end

    subgraph AUTH["🔑  Auth Module"]
        direction TB
        A1["JWT Engine\n8h access token  ·  7d refresh\nRevocation support"]:::authCls
        A2["OIDC / OAuth2\nGoogle · GitHub · GitLab · Okta\nAzure AD · Keycloak · Auth0 · Dex"]:::authCls
        A3["Internal User Store\nK8s Secret  ·  bcrypt cost-12\n3 roles  ·  5-attempt lockout"]:::authCls
    end

    KCM["☸️  Kubernetes Client Manager\nclient-go  ·  dynamic client  ·  discovery API  ·  metrics.k8s.io\nCalls GET /apis on startup — auto-discovers 62+ resource types + all installed CRDs"]:::kcmCls

    subgraph L4["☸️  Layer 4 — Kubernetes Cluster"]
        direction LR
        K1["API Server\n62+ built-in resource types\n+ all installed CRDs"]:::k8sCls
        K2["metrics-server\nCPU · Memory\nper node and pod"]:::k8sCls
        K3["ArgoCD CRDs\nApplications · AppSets\nProjects  —  auto-detected"]:::k8sCls
        K4["Flux CD CRDs\nKustomizations · HelmReleases\nGitRepos  —  auto-detected"]:::k8sCls
    end

    L1  -->|"REST  /api/v1/*"| L2
    L1  -->|"WebSocket  /ws/logs  ·  /ws/exec"| L3B
    L2  -->|"authenticated request"| L3
    L2  <-->|"validate · issue · revoke"| AUTH
    L3  -->|"resource queries"| KCM
    L3B -->|"streams · exec · tunnel"| KCM
    KCM -->|"ServiceAccount token  (in-cluster)\nor  ~/.kube/config  (local)"| K1
    K1  --- K2 & K3 & K4

# Создать Secret с несколькими файлами kubeconfig
kubectl create secret generic multi-cluster \
  --from-file=production=~/.kube/prod.yaml \
  --from-file=staging=~/.kube/staging.yaml \
  -n klarity

# Указать в Helm
helm upgrade klarity klarity/klarity \
  --namespace klarity \
  --set existingMultiClusterSecret=multi-cluster

# Установить metrics-server
kubectl apply -f \
  https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

# Для kind / minikube — патч для небезопасного TLS
kubectl patch deployment metrics-server -n kube-system \
  --type='json' \
  -p='[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'

klarity/
├── cmd/server/              # Точка входа приложения (main.go)
├── internal/
│   ├── api/
│   │   ├── handlers/        # 24 файла HTTP-обработчиков — по одному на группу ресурсов
│   │   ├── middleware/      # Auth, журналирование аудита, CORS, gzip
│   │   └── routes.go        # Все ~150 регистраций маршрутов
│   ├── assets/              # Встроенная сборка React (go:embed)
│   ├── auth/                # Хранилище пользователей, хеширование bcrypt, подпись/проверка JWT
│   ├── config/              # Загрузчик конфигурации Viper
│   └── k8s/                 # Менеджер Kubernetes-клиента + обнаружение
├── web/                     # Фронтенд React 18 (TypeScript + Vite)
│   └── src/
│       ├── components/      # Компоновка, общий UI, ActivityPanel, Terminal
│       ├── pages/           # 40+ страниц — по одной на тип ресурса
│       ├── lib/             # API-клиент, менеджер WebSocket, утилиты
│       └── store/           # Zustand-хранилища (auth, settings, activities)
├── helm/klarity/            # Helm-чарт (values.yaml + 10 шаблонов)
├── deploy/manifests/        # Чистый YAML + Kustomize overlay
├── docs/                    # Документация по архитектуре, развёртыванию, управлению пользователями
├── scripts/                 # Вспомогательные скрипты развёртывания
├── website/                 # Лендинг GitHub Pages
└── .github/workflows/       # CI · Release · GitHub Actions для Pages

# Fork → Clone → Branch → Change → Test → PR
git checkout -b feature/amazing-feature
make test && make lint
git push origin feature/amazing-feature
# Откройте Pull Request на GitHub

Copyright 2026 Klarity Contributors

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0