feat(k3s): 密码切换为密钥 & 相关服务升级

apps/infra/devops/cert-manager/clusterissuer-dnspod.yaml

@@ -0,0 +1,26 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cert-manager-webhook-dnspod
+  labels:
+    app: cert-manager-webhook-dnspod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: cert-manager-webhook-dnspod-letsencrypt
+    solvers:
+      - dns01:
+          cnameStrategy: Follow
+          webhook:
+            groupName: cert.dev.cm
+            solverName: dnspod
+            config:
+              ttl: 600
+              secretIdRef:
+                name: dnspod-secret
+                key: secretId
+              secretKeyRef:
+                name: dnspod-secret
+                key: secretKey

apps/infra/devops/cert-manager/helmchart-dnspod.yaml

@@ -9,17 +9,6 @@ spec:
   targetNamespace: infra-devops
   version: 1.4.5
   valuesContent: |-
-    namespace: infra-devops
-    certManager:
-      namespace: infra-devops
-    groupName: cert.dev.cm
-    clusterIssuer:
-      # 此处需在部署后修改clusterIssuer 添加在dns01下
-      # cnameStrategy: Follow
-      staging: false
-      email: [email protected]
-      secretId: AKIDzmKdvDSfonogKip55pIVR6h7ScjaBWcg
-      secretKey: zudDdtytkPr8HI9oKeniSxIRPCmCe0CD
     affinity:
       nodeAffinity:
         requiredDuringSchedulingIgnoredDuringExecution:
@@ -29,7 +18,12 @@ spec:
                   operator: In
                   values:
                     - "cn-sh"
-    tolerations:
-      - key: "node-role.kubernetes.io/master"
-        operator: "Exists"
-        effect: "NoSchedule"
+    image:
+      tag: "1.5.2"
+    namespace: infra-devops
+    certManager:
+      namespace: infra-devops
+    groupName: cert.dev.cm
+    # 此处关闭 选择手动创建 以支持cnameStrategy
+    clusterIssuer:
+      enabled: false

apps/infra/devops/cert-manager/helmchart.yaml

@@ -1,5 +1,3 @@
-# 需要提前安装crds
-# kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.18.2/cert-manager.crds.yaml
 apiVersion: helm.cattle.io/v1
 kind: HelmChart
 metadata:
@@ -9,7 +7,7 @@ spec:
   repo: https://charts.jetstack.io
   chart: cert-manager
   targetNamespace: infra-devops
-  version: v1.19.2
+  version: v1.19.3
   valuesContent: |-
     affinity:
       nodeAffinity:
@@ -20,10 +18,6 @@ spec:
                   operator: In
                   values:
                     - "cn-sh"
-    tolerations:
-      - key: "node-role.kubernetes.io/master"
-        operator: "Exists"
-        effect: "NoSchedule"
     webhook:
       affinity:
         nodeAffinity:
@@ -34,10 +28,6 @@ spec:
                     operator: In
                     values:
                       - "cn-sh"
-      tolerations:
-        - key: "node-role.kubernetes.io/master"
-          operator: "Exists"
-          effect: "NoSchedule"
     cainjector:
       affinity:
         nodeAffinity:
@@ -48,14 +38,13 @@ spec:
                     operator: In
                     values:
                       - "cn-sh"
-      tolerations:
-        - key: "node-role.kubernetes.io/master"
-          operator: "Exists"
-          effect: "NoSchedule"
+    crds:
+      enabled: true
+      keep: true
     # 在删除证书时同时删除secret
     enableCertificateOwnerRef: true
     prometheus:
-      enabled: true
+      enabled: false
       servicemonitor:
         enabled: true
         interval: 300s

apps/infra/devops/reflector/helmchart.yaml

@@ -18,11 +18,3 @@ spec:
                   operator: In
                   values:
                     - "cn-sh"
-        preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 1
-            preference:
-              matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values:
-                    - tce

apps/infra/devops/velero/helmchart.yaml

@@ -25,11 +25,9 @@ spec:
                 - key: kubernetes.io/hostname
                   operator: In
                   values:
-                    - homea  
-    kubectl:
-      image:
-        repository: alpine/k8s
-        tag: "1.34.0"
+                    - homeb  
+    # 此处暂时切换关闭upgradeCRDs操作 待官方修复后再开启
+    upgradeCRDs: false
     deployNodeAgent: true
     snapshotsEnabled: false
     configuration:
@@ -50,13 +48,19 @@ spec:
             s3ForcePathStyle: false
             s3Url: https://obs.cn-east-3.myhuaweicloud.com
             checksumAlgorithm: ""
+      extraEnvVars:
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              name: s3-devcm-hw
+              key: ACCESS_KEY_ID    
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: s3-devcm-hw
+              key: ACCESS_SECRET_KEY
     credentials:
-      useSecret: true
-      secretContents:
-        cloud: |
-          [default]
-          aws_access_key_id = A9RI5BC15F3L9EI8T51T
-          aws_secret_access_key = ky1n3OlNNu7wjgctVjCqb03HWxjZucRGhvcEBp51
+      useSecret: false
     initContainers:
       - name: velero-plugin-for-aws
         image: velero/velero-plugin-for-aws:v1.13.0