feat(ansible): add K3s installation playbooks and configuration templates

apps/infra/data/cloudnative-pg/helmchart.yaml

@@ -19,7 +19,7 @@ spec:
                   values:
                     - "cn-sh"
     tolerations:
-      - key: "node-role.kubernetes.io/control-plane"
+      - key: "node-role.kubernetes.io/master"
         operator: "Exists"
         effect: "NoSchedule"
     image:

apps/infra/devops/cert-manager/helmchart-dnspod.yaml

@@ -30,6 +30,6 @@ spec:
                   values:
                     - "cn-sh"
     tolerations:
-      - key: "node-role.kubernetes.io/control-plane"
+      - key: "node-role.kubernetes.io/master"
         operator: "Exists"
         effect: "NoSchedule"

apps/infra/devops/cert-manager/helmchart.yaml

@@ -21,7 +21,7 @@ spec:
                   values:
                     - "cn-sh"
     tolerations:
-      - key: "node-role.kubernetes.io/control-plane"
+      - key: "node-role.kubernetes.io/master"
         operator: "Exists"
         effect: "NoSchedule"
     webhook:
@@ -35,7 +35,7 @@ spec:
                     values:
                       - "cn-sh"
       tolerations:
-        - key: "node-role.kubernetes.io/control-plane"
+        - key: "node-role.kubernetes.io/master"
           operator: "Exists"
           effect: "NoSchedule"
     cainjector:
@@ -49,7 +49,7 @@ spec:
                     values:
                       - "cn-sh"
       tolerations:
-        - key: "node-role.kubernetes.io/control-plane"
+        - key: "node-role.kubernetes.io/master"
           operator: "Exists"
           effect: "NoSchedule"
     # 在删除证书时同时删除secret

apps/infra/devops/velero/helmchart.yaml

@@ -26,6 +26,10 @@ spec:
                   operator: In
                   values:
                     - homea  
+    kubectl:
+      image:
+        repository: alpine/k8s
+        tag: "1.34.0"
     deployNodeAgent: true
     snapshotsEnabled: false
     configuration:

apps/infra/gitops/flux/clusterrolebinding.yaml

@@ -0,0 +1,29 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dev-cm-flux-web-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flux-web-admin
+subjects:
+  - kind: Group
+    name: dev.cm:owners
+    apiGroup: rbac.authorization.k8s.io
+  - kind: Group
+    name: dev.cm:admins
+    apiGroup: rbac.authorization.k8s.io
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dev-cm-flux-web-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flux-web-user
+subjects:
+  - kind: Group
+    name: dev.cm
+    apiGroup: rbac.authorization.k8s.io

apps/infra/gitops/flux/flux-instance.yaml

@@ -10,7 +10,6 @@ spec:
     artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"
   components:
     - source-controller
-    - source-watcher
     - kustomize-controller
     - helm-controller
     - notification-controller
@@ -22,4 +21,21 @@ spec:
     domain: "cluster.local"
   storage:
     class: "local-path"
-    size: "10Gi"
+    size: "10Gi"
+  kustomize:
+    patches:
+      - target:
+          kind: Deployment
+        patch: |
+          - op: add
+            path: /spec/template/spec/affinity
+            value:
+              nodeAffinity:
+                preferredDuringSchedulingIgnoredDuringExecution:
+                  - weight: 1
+                    preference:
+                      matchExpressions:
+                        - key: kubernetes.io/hostname
+                          operator: In
+                          values:
+                            - homea

apps/infra/gitops/flux/helmchart.yaml

@@ -8,6 +8,16 @@ spec:
   targetNamespace: infra-gitops
   version: 0.40.0
   valuesContent: |-
+    affinity:
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - homea  
     installCRDs: true
     web:
       config: