feat(flux): flux

flux/infrastructure/secrets/dnspod-secret.yaml

@@ -0,0 +1,11 @@
+# cert-manager DNSPod webhook凭据
+# 变量来源: flux-env Secret (通过postBuild.substituteFrom注入)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: dnspod-secret
+  namespace: infra-devops
+type: Opaque
+stringData:
+  secretId: "${DNSPOD_SECRET_ID}"
+  secretKey: "${DNSPOD_SECRET_KEY}"

flux/infrastructure/secrets/gitea-actions.yaml

@@ -0,0 +1,10 @@
+# Gitea Actions Runner Token
+# 变量来源: flux-env Secret (通过postBuild.substituteFrom注入)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-actions
+  namespace: infra-gitops
+type: Opaque
+stringData:
+  token: "${GITEA_ACTIONS_TOKEN}"

flux/infrastructure/secrets/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespaces.yaml
+  - s3-devcm-hw.yaml
+  - dnspod-secret.yaml
+  - gitea-actions.yaml

flux/infrastructure/secrets/namespaces.yaml

@@ -0,0 +1,16 @@
+# 确保密钥目标命名空间已存在
+# 与各infra层的namespace.yaml幂等
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-devops
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-data
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-gitops

flux/infrastructure/secrets/s3-devcm-hw.yaml

@@ -0,0 +1,23 @@
+# S3凭据 (华为云OBS)
+# 用途: velero备份 + CNPG barman WAL归档
+# 变量来源: flux-env Secret (通过postBuild.substituteFrom注入)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-devcm-hw
+  namespace: infra-devops
+type: Opaque
+stringData:
+  ACCESS_KEY_ID: "${S3_ACCESS_KEY_ID}"
+  ACCESS_SECRET_KEY: "${S3_ACCESS_SECRET_KEY}"
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-devcm-hw
+  namespace: infra-data
+type: Opaque
+stringData:
+  ACCESS_KEY_ID: "${S3_ACCESS_KEY_ID}"
+  ACCESS_SECRET_KEY: "${S3_ACCESS_SECRET_KEY}"