feat(deploy): 首次提交

core/traefik/certs/certificate-dev-cm.yaml

@@ -0,0 +1,27 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dev-cm-crt
+  namespace: kube-system
+spec:
+  secretName: dev-cm-crt
+  issuerRef:
+    name: dnspod
+    kind: ClusterIssuer
+    group: cert-manager.io
+  dnsNames:
+  - "dev.cm"
+  - "*.dev.cm"
+  - "*.node.dev.cm"
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: TLSStore
+metadata:
+  name: default
+  namespace: kube-system
+spec:
+  certificates:
+  - secretName: dev-cm-crt
+  defaultCertificate:
+    secretName: dev-cm-crt

core/traefik/certs/certificate-fillcode-com.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fillcode-com-crt
+  namespace: kube-system
+spec:
+  secretName: fillcode-com-crt
+  issuerRef:
+    name: dnspod
+    kind: ClusterIssuer
+    group: cert-manager.io
+  dnsNames:
+  - "fillcode.com"
+  - "*.fillcode.com"

core/traefik/helmchartconfig.yaml

@@ -0,0 +1,53 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+          - matchExpressions:
+            - key: svccontroller.k3s.cattle.io/enablelb
+              operator: In
+              values:
+              - "true"
+    tolerations:
+    - key: "node-role.kubernetes.io/master"
+      operator: "Exists"
+      effect: "NoSchedule"
+    deployment:
+      kind: DaemonSet
+      dnsPolicy: None
+      dnsConfig:
+        nameservers:
+        - 169.254.20.10
+        - 10.43.0.10
+    hostNetwork: true
+    service:
+      spec:
+        externalTrafficPolicy: Local
+    ports:
+      web:
+        forwardedHeaders:
+          insecure: true
+        proxyProtocol:
+          insecure: true
+      websecure:
+        forwardedHeaders:
+          insecure: true
+        proxyProtocol:
+          insecure: true
+        http3:
+          enabled: false
+      ssh:
+        port: 8022
+        expose: true
+        exposedPort: 22
+        
+    updateStrategy:
+      rollingUpdate:
+        maxUnavailable: 1
+        maxSurge: 0

core/traefik/ingressroute-https-only.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: https-only
+  namespace: kube-system
+spec:
+  entryPoints:
+    - web
+  routes:
+    - kind: Rule
+      match: PathPrefix(`/`)
+      priority: 1
+      middlewares:
+        - name: https-only
+      services:
+        - kind: TraefikService
+          name: noop@internal

core/traefik/ingressroute-internal.yaml

@@ -0,0 +1,29 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gateway
+  namespace: kube-system
+spec:
+  entryPoints:
+  - websecure
+  routes:
+    - kind: Rule
+      match: Host(`gateway.dev.cm`)
+      services:
+      - kind: TraefikService
+        name: dashboard@internal
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gateway-api
+  namespace: kube-system
+spec:
+  entryPoints:
+  - websecure
+  routes:
+    - kind: Rule
+      match: Host(`gateway.dev.cm`) && PathPrefix(`/api`)
+      services:
+      - kind: TraefikService
+        name: api@internal

core/traefik/middleware/middleware-compress.yaml

@@ -0,0 +1,7 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: compress
+  namespace: kube-system
+spec:
+  compress: {}

core/traefik/middleware/middleware-https-only.yaml

@@ -0,0 +1,9 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: https-only
+  namespace: kube-system
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true