feat(k3s): 密码切换为密钥 & 相关服务升级

apps/infra/data/cloudnative-pg/helmchart.yaml

@@ -19,7 +19,7 @@ spec:
                   values:
                     - "cn-sh"
     tolerations:
-      - key: "node-role.kubernetes.io/master"
+      - key: "node-role.kubernetes.io/control-plane"
         operator: "Exists"
         effect: "NoSchedule"
     image:

apps/infra/data/redis/helmchart-sh.yaml

@@ -1,28 +0,0 @@
-apiVersion: helm.cattle.io/v1
-kind: HelmChart
-metadata:
-  name: redis-cluster-sh
-  namespace: infra-data
-spec:
-  chart: oci://registry-1.docker.io/bitnamicharts/redis
-  targetNamespace: infra-data
-  version: 20.7.0
-  valuesContent: |-
-    global:
-      redis:
-        password: ribiPwYQNU6GWxCYR0Nj
-    master:
-      nodeAffinityPreset:
-        type: soft
-        key: topology.kubernetes.io/region
-        values:
-          - cn-sh
-    replica:
-      replicaCount: 0
-      nodeAffinityPreset:
-        type: soft
-        key: topology.kubernetes.io/region
-        values:
-          - cn-sh   
-
-

apps/infra/data/valkey-cluster/helmchart.yaml

@@ -0,0 +1,21 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: valkey-cluster-sh
+  namespace: infra-data
+spec:
+  chart: oci://registry-1.docker.io/bitnamicharts/valkey-cluster
+  targetNamespace: infra-data
+  version: 3.0.23
+  valuesContent: |-
+    image:
+      repository: bitnamilegacy/valkey-cluster
+    cluster:
+      nodes: 1
+      replicas: 0
+    valkey: 
+      nodeAffinityPreset:
+        type: hard
+        key: topology.kubernetes.io/region
+        values:
+          - cn-sh

apps/infra/devops/cert-manager/clusterissuer-dnspod.yaml

@@ -0,0 +1,26 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cert-manager-webhook-dnspod
+  labels:
+    app: cert-manager-webhook-dnspod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: cert-manager-webhook-dnspod-letsencrypt
+    solvers:
+      - dns01:
+          cnameStrategy: Follow
+          webhook:
+            groupName: cert.dev.cm
+            solverName: dnspod
+            config:
+              ttl: 600
+              secretIdRef:
+                name: dnspod-secret
+                key: secretId
+              secretKeyRef:
+                name: dnspod-secret
+                key: secretKey

apps/infra/devops/cert-manager/helmchart-dnspod.yaml

@@ -9,17 +9,6 @@ spec:
   targetNamespace: infra-devops
   version: 1.4.5
   valuesContent: |-
-    namespace: infra-devops
-    certManager:
-      namespace: infra-devops
-    groupName: cert.dev.cm
-    clusterIssuer:
-      # 此处需在部署后修改clusterIssuer 添加在dns01下
-      # cnameStrategy: Follow
-      staging: false
-      email: [email protected]
-      secretId: AKIDzmKdvDSfonogKip55pIVR6h7ScjaBWcg
-      secretKey: zudDdtytkPr8HI9oKeniSxIRPCmCe0CD
     affinity:
       nodeAffinity:
         requiredDuringSchedulingIgnoredDuringExecution:
@@ -29,7 +18,12 @@ spec:
                   operator: In
                   values:
                     - "cn-sh"
-    tolerations:
-      - key: "node-role.kubernetes.io/master"
-        operator: "Exists"
-        effect: "NoSchedule"
+    image:
+      tag: "1.5.2"
+    namespace: infra-devops
+    certManager:
+      namespace: infra-devops
+    groupName: cert.dev.cm
+    # 此处关闭 选择手动创建 以支持cnameStrategy
+    clusterIssuer:
+      enabled: false

apps/infra/devops/cert-manager/helmchart.yaml

@@ -1,5 +1,3 @@
-# 需要提前安装crds
-# kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.18.2/cert-manager.crds.yaml
 apiVersion: helm.cattle.io/v1
 kind: HelmChart
 metadata:
@@ -9,7 +7,7 @@ spec:
   repo: https://charts.jetstack.io
   chart: cert-manager
   targetNamespace: infra-devops
-  version: v1.19.2
+  version: v1.19.3
   valuesContent: |-
     affinity:
       nodeAffinity:
@@ -20,10 +18,6 @@ spec:
                   operator: In
                   values:
                     - "cn-sh"
-    tolerations:
-      - key: "node-role.kubernetes.io/master"
-        operator: "Exists"
-        effect: "NoSchedule"
     webhook:
       affinity:
         nodeAffinity:
@@ -34,10 +28,6 @@ spec:
                     operator: In
                     values:
                       - "cn-sh"
-      tolerations:
-        - key: "node-role.kubernetes.io/master"
-          operator: "Exists"
-          effect: "NoSchedule"
     cainjector:
       affinity:
         nodeAffinity:
@@ -48,14 +38,13 @@ spec:
                     operator: In
                     values:
                       - "cn-sh"
-      tolerations:
-        - key: "node-role.kubernetes.io/master"
-          operator: "Exists"
-          effect: "NoSchedule"
+    crds:
+      enabled: true
+      keep: true
     # 在删除证书时同时删除secret
     enableCertificateOwnerRef: true
     prometheus:
-      enabled: true
+      enabled: false
       servicemonitor:
         enabled: true
         interval: 300s

apps/infra/devops/reflector/helmchart.yaml

@@ -18,11 +18,3 @@ spec:
                   operator: In
                   values:
                     - "cn-sh"
-        preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 1
-            preference:
-              matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values:
-                    - tce

apps/infra/devops/velero/helmchart.yaml

@@ -25,11 +25,9 @@ spec:
                 - key: kubernetes.io/hostname
                   operator: In
                   values:
-                    - homea  
-    kubectl:
-      image:
-        repository: alpine/k8s
-        tag: "1.34.0"
+                    - homeb  
+    # 此处暂时切换关闭upgradeCRDs操作 待官方修复后再开启
+    upgradeCRDs: false
     deployNodeAgent: true
     snapshotsEnabled: false
     configuration:
@@ -50,13 +48,19 @@ spec:
             s3ForcePathStyle: false
             s3Url: https://obs.cn-east-3.myhuaweicloud.com
             checksumAlgorithm: ""
+      extraEnvVars:
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              name: s3-devcm-hw
+              key: ACCESS_KEY_ID    
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: s3-devcm-hw
+              key: ACCESS_SECRET_KEY
     credentials:
-      useSecret: true
-      secretContents:
-        cloud: |
-          [default]
-          aws_access_key_id = A9RI5BC15F3L9EI8T51T
-          aws_secret_access_key = ky1n3OlNNu7wjgctVjCqb03HWxjZucRGhvcEBp51
+      useSecret: false
     initContainers:
       - name: velero-plugin-for-aws
         image: velero/velero-plugin-for-aws:v1.13.0

apps/infra/gitops/gitea/helmchart.yaml

@@ -67,17 +67,13 @@ spec:
           HOST: cnpg17-cluster-sh-rw.infra-data:5432
           NAME: gitea
           USER: app
-          PASSWD: HueUoQx05DM0ICBPu1GrmBvBXE6NO3poKE6yPqokPv3dPpWvWRLAr3RXSpaL3AZd
           SSL_MODE: disable
         session:
           PROVIDER: redis
-          PROVIDER_CONFIG: redis://:[email protected]:6379/0
         cache:
           ADAPTER: redis
-          HOST: redis://:[email protected]:6379/0?pool_size=100&idle_timeout=180s
         queue:
           TYPE: redis
-          CONN_STR: redis://:[email protected]:6379/0
         repository:
           DEFAULT_REPO_UNITS: repo.code,repo.releases,repo.issues,repo.pulls
         actions:
@@ -99,6 +95,23 @@ spec:
         ui:
           THEMES: gitea-auto, gitea-light, gitea-dark, github-auto, github-light, github-dark, github-soft-dark
           DEFAULT_THEME: github-auto
+      additionalConfigFromEnvs:
+        - name: GITEA__DATABASE__PASSWD
+          valueFrom:
+            secretKeyRef:
+              name: cnpg17-cluster-sh-app
+              key: password
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: valkey-cluster-sh
+              key: valkey-password
+        - name: GITEA__SESSION__PROVIDER_CONFIG
+          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
+        - name: GITEA__CACHE__HOST
+          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
+        - name: GITEA__QUEUE__CONN_STR
+          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"    
     valkey-cluster:
       enabled: false
     extraVolumes:

apps/infra/monitor/prometheus/helmchart.yaml

@@ -54,6 +54,11 @@ spec:
         paths:
           - /
       assertNoLeakedSecrets: false
+      envValueFrom:
+        GF_DATABASE_PASSWORD:
+          secretKeyRef:
+            name: cnpg17-cluster-sh-app
+            key: password
       grafana.ini:
         server:
           root_url: https://monitor.dev.cm/
@@ -68,7 +73,7 @@ spec:
           host: cnpg17-cluster-sh-rw.infra-data:5432
           name: grafana
           user: app
-          password: HueUoQx05DM0ICBPu1GrmBvBXE6NO3poKE6yPqokPv3dPpWvWRLAr3RXSpaL3AZd
+          password: $__env{GF_DATABASE_PASSWORD}
       persistence:
         type: pvc
         enabled: true

apps/infra/net/crowdsec/helmchart.yaml

@@ -93,6 +93,12 @@ spec:
           enabled: false
         data:
           enabled: false
+      env:
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: cnpg17-cluster-hk-app
+              key: password
     config:
       # api config.yaml配置
       config.yaml.local: |
@@ -102,7 +108,7 @@ spec:
           port: 5432
           db_name: crowdsec
           user: app
-          password: FybaFtf6NV5jnxhj5bOPpHbO6KypZeHiyiskgAWkM5nioW2j82HtCf6GnW9xVKjE
+          password: ${DB_PASSWORD}
           sslmode: require
         api:
           server:

apps/infra/net/nginx/helmchart.yaml

@@ -19,7 +19,7 @@ spec:
       nodeSelector:
         svccontroller.k3s.cattle.io/enablelb: "true"
       tolerations:
-        - key: "node-role.kubernetes.io/master"
+        - key: "node-role.kubernetes.io/control-plane"
           operator: "Exists"
           effect: "NoSchedule"
       labels:

apps/infra/net/tailscale/helmchart.yaml

@@ -12,7 +12,7 @@ spec:
     nodeSelector:
       kubernetes.io/hostname: tchk
     image:
-      tag: v1.90.8
+      tag: v1.94.1
     hostNetwork: true
     extraVolumes:
       - name: cert-volume