feat(k3s): 密码切换为密钥 & 相关服务升级

apps/infra/devops/cert-manager/clusterissuer-dnspod.yaml

@@ -0,0 +1,26 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cert-manager-webhook-dnspod
+  labels:
+    app: cert-manager-webhook-dnspod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: cert-manager-webhook-dnspod-letsencrypt
+    solvers:
+      - dns01:
+          cnameStrategy: Follow
+          webhook:
+            groupName: cert.dev.cm
+            solverName: dnspod
+            config:
+              ttl: 600
+              secretIdRef:
+                name: dnspod-secret
+                key: secretId
+              secretKeyRef:
+                name: dnspod-secret
+                key: secretKey

apps/infra/devops/cert-manager/helmchart-dnspod.yaml

@@ -9,17 +9,6 @@ spec:
   targetNamespace: infra-devops
   version: 1.4.5
   valuesContent: |-
-    namespace: infra-devops
-    certManager:
-      namespace: infra-devops
-    groupName: cert.dev.cm
-    clusterIssuer:
-      # 此处需在部署后修改clusterIssuer 添加在dns01下
-      # cnameStrategy: Follow
-      staging: false
-      email: [email protected]
-      secretId: AKIDzmKdvDSfonogKip55pIVR6h7ScjaBWcg
-      secretKey: zudDdtytkPr8HI9oKeniSxIRPCmCe0CD
     affinity:
       nodeAffinity:
         requiredDuringSchedulingIgnoredDuringExecution:
@@ -29,7 +18,12 @@ spec:
                   operator: In
                   values:
                     - "cn-sh"
-    tolerations:
-      - key: "node-role.kubernetes.io/master"
-        operator: "Exists"
-        effect: "NoSchedule"
+    image:
+      tag: "1.5.2"
+    namespace: infra-devops
+    certManager:
+      namespace: infra-devops
+    groupName: cert.dev.cm
+    # 此处关闭 选择手动创建 以支持cnameStrategy
+    clusterIssuer:
+      enabled: false

apps/infra/devops/cert-manager/helmchart.yaml

@@ -1,5 +1,3 @@
-# 需要提前安装crds
-# kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.18.2/cert-manager.crds.yaml
 apiVersion: helm.cattle.io/v1
 kind: HelmChart
 metadata:
@@ -9,7 +7,7 @@ spec:
   repo: https://charts.jetstack.io
   chart: cert-manager
   targetNamespace: infra-devops
-  version: v1.19.2
+  version: v1.19.3
   valuesContent: |-
     affinity:
       nodeAffinity:
@@ -20,10 +18,6 @@ spec:
                   operator: In
                   values:
                     - "cn-sh"
-    tolerations:
-      - key: "node-role.kubernetes.io/master"
-        operator: "Exists"
-        effect: "NoSchedule"
     webhook:
       affinity:
         nodeAffinity:
@@ -34,10 +28,6 @@ spec:
                     operator: In
                     values:
                       - "cn-sh"
-      tolerations:
-        - key: "node-role.kubernetes.io/master"
-          operator: "Exists"
-          effect: "NoSchedule"
     cainjector:
       affinity:
         nodeAffinity:
@@ -48,14 +38,13 @@ spec:
                     operator: In
                     values:
                       - "cn-sh"
-      tolerations:
-        - key: "node-role.kubernetes.io/master"
-          operator: "Exists"
-          effect: "NoSchedule"
+    crds:
+      enabled: true
+      keep: true
     # 在删除证书时同时删除secret
     enableCertificateOwnerRef: true
     prometheus:
-      enabled: true
+      enabled: false
       servicemonitor:
         enabled: true
         interval: 300s