feat(init): 仓库重新初始化

apps/devops/cert-manager/helmchart-dnspod.yaml

@@ -0,0 +1,35 @@
+# 安装后需要将clusterIssuer的cnameStrategy策略设置为Follow
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cert-manager-webhook-dnspod
+  namespace: infra-devops
+spec:
+  chart: oci://registry-1.docker.io/imroc/cert-manager-webhook-dnspod
+  targetNamespace: infra-devops
+  version: 1.4.5
+  valuesContent: |-
+    namespace: infra-devops
+    certManager:
+      namespace: infra-devops
+    groupName: cert.dev.cm
+    clusterIssuer:
+      # 此处需在部署后修改clusterIssuer
+      # cnameStrategy: Follow
+      staging: false
+      email: [email protected]
+      secretId: AKIDzmKdvDSfonogKip55pIVR6h7ScjaBWcg
+      secretKey: zudDdtytkPr8HI9oKeniSxIRPCmCe0CD
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: node-role.kubernetes.io/master
+                  operator: In
+                  values:
+                    - "true"
+    tolerations:
+      - key: "node-role.kubernetes.io/master"
+        operator: "Exists"
+        effect: "NoSchedule"

apps/devops/cert-manager/helmchart.yaml

@@ -0,0 +1,54 @@
+# 需要提前安装crds
+# kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.4/cert-manager.crds.yaml
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cert-manager
+  namespace: infra-devops
+spec:
+  repo: https://charts.jetstack.io
+  chart: cert-manager
+  targetNamespace: infra-devops
+  version: v1.14.4
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: node-role.kubernetes.io/master
+                  operator: In
+                  values:
+                    - "true"
+    tolerations:
+      - key: "node-role.kubernetes.io/master"
+        operator: "Exists"
+        effect: "NoSchedule"
+    webhook:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/master
+                    operator: In
+                    values:
+                      - "true"
+      tolerations:
+        - key: "node-role.kubernetes.io/master"
+          operator: "Exists"
+          effect: "NoSchedule"
+    cainjector:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/master
+                    operator: In
+                    values:
+                      - "true"
+      tolerations:
+        - key: "node-role.kubernetes.io/master"
+          operator: "Exists"
+          effect: "NoSchedule"

apps/devops/gitea/configmap-custom.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-custom-templates
+  namespace: infra-devops
+data:
+  home.tmpl: |-
+    {{template "base/head" .}}
+    <div class="page-content home">
+            <div class="ui stackable middle very relaxed page grid">
+                    <div class="sixteen wide center aligned centered column">
+                            <div>
+                                    <img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
+                            </div>
+                            <div class="hero">
+                                    <h1 class="ui icon header title">
+                                            {{AppName}}
+                                    </h1>
+                                    <h2><a href="https://git.dev.cm">dev.cm</a> - Git 仓库</h2>
+                            </div>
+                    </div>
+            </div>
+    </div>
+    {{template "base/footer" .}}
+
+  extra_links.tmpl: |-
+    <a class="item" href="https://ci.dev.cm" target="_blank">CI</a>

apps/devops/gitea/helmchart.yaml

@@ -0,0 +1,91 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: gitea
+  namespace: infra-devops
+spec:
+  repo: https://dl.gitea.com/charts
+  chart: gitea
+  targetNamespace: infra-devops
+  version: 10.1.4
+  valuesContent: |-
+    affinity:
+      podAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  cnpg.io/cluster: cnpg-cluster-sh
+                  role: primary
+                  app.kubernetes.io/name: redis
+                  app.kubernetes.io/component: master
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - preference:
+              matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - homea
+            weight: 1
+    redis-cluster:
+      enabled: false
+    postgresql-ha:
+      enabled: false
+    image:
+      tag: 1.22.0
+    gitea:
+      config:
+        APP_NAME: Git.dev.cm
+        RUN_MODE: prod
+        server:
+          DOMAIN: git.dev.cm
+          ROOT_URL: https://git.dev.cm/
+        database:
+          DB_TYPE: postgres
+          HOST: cnpg-cluster-sh-rw.infra-data:5432
+          NAME: gitea
+          USER: app
+          PASSWD: 6UeWq0EEQaP47eMjAt3hmmquGY3e6bqDanCeSKWDmLtLCuMe1TH0UGTKuaw2LfIO
+          SSL_MODE: disable
+        session:
+          PROVIDER: redis
+          PROVIDER_CONFIG: redis://:[email protected]:6379/0
+        cache:
+          ADAPTER: redis
+          HOST: redis://:[email protected]:6379/0?pool_size=100&idle_timeout=180s
+        queue:
+          TYPE: redis
+          CONN_STR: redis://:[email protected]:6379/0
+        repository:
+          DEFAULT_REPO_UNITS: repo.code,repo.releases,repo.issues,repo.pulls
+        service:
+          DISABLE_REGISTRATION: true
+          NO_REPLY_ADDRESS: noreply.dev.cm
+        picture:
+          GRAVATAR_SOURCE: https://cravatar.cn/avatar/
+        i18n:
+          LANGS: zh-CN,en-US
+          NAMES: 简体中文,English
+        other:
+          SHOW_FOOTER_VERSION: false
+        log:
+          LEVEL: Info
+    extraVolumes:
+      - name: gitea-custom-templates-volume
+        configMap:
+          name: gitea-custom-templates
+          items:
+            - key: home.tmpl
+              path: home.tmpl
+            - key: extra_links.tmpl
+              path: custom/extra_links.tmpl
+    extraContainerVolumeMounts:
+      - name: gitea-custom-templates-volume
+        readOnly: true
+        mountPath: /data/gitea/templates
+
+
+

apps/devops/gitea/ingress-http.yaml

@@ -0,0 +1,51 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-http
+  namespace: infra-devops
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: git.dev.cm
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: gitea-http
+                port:
+                  number: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-http-static
+  namespace: infra-devops
+  annotations:
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/proxy-buffering: "on"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_cache cache;
+      proxy_cache_valid 200 302 1d;
+      proxy_cache_valid 404 10m;
+      proxy_cache_valid any 1h;
+      proxy_cache_use_stale error timeout updating http_404 http_500 http_502 http_503 http_504;
+      proxy_cache_bypass $http_x_purge;
+      proxy_ignore_headers Cache-Control;
+      add_header X-Cache-Status $upstream_cache_status;
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: git.dev.cm
+      http:
+        paths:
+          - path: /(assets|avatars)/.*
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: gitea-http
+                port:
+                  number: 3000

apps/devops/gitea/loadbalancer-ssh.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-ssh-lb
+  namespace: infra-devops
+spec:
+  selector:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/instance: gitea
+  ports:
+    - protocol: TCP
+      port: 22
+      targetPort: 2222
+  type: LoadBalancer

apps/devops/namespaces.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-devops