test: flux local cluster setup with infra-devops post

flux/infrastructure/infra-devops/clusterissuer-dnspod.yaml

@@ -0,0 +1,26 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: dnspod
+  labels:
+    app: cert-manager-webhook-dnspod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: cert-manager-webhook-dnspod-letsencrypt
+    solvers:
+      - dns01:
+          cnameStrategy: Follow
+          webhook:
+            groupName: cert.dev.cm
+            solverName: dnspod
+            config:
+              ttl: 600
+              secretIdRef:
+                name: dnspod-secret
+                key: secretId
+              secretKeyRef:
+                name: dnspod-secret
+                key: secretKey

flux/infrastructure/infra-devops/helmrelease-cert-manager-webhook-dnspod.yaml

@@ -0,0 +1,29 @@
+# 安装后需要将clusterIssuer的cnameStrategy策略设置为Follow
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager-webhook-dnspod
+  namespace: infra-devops
+spec:
+  interval: 30m
+  dependsOn:
+    - name: cert-manager
+  chart:
+    spec:
+      chart: cert-manager-webhook-dnspod
+      version: 1.4.5
+      sourceRef:
+        kind: HelmRepository
+        name: imroc
+        namespace: infra-gitops
+      interval: 12h
+  values:
+    image:
+      tag: "1.5.2"
+    namespace: infra-devops
+    certManager:
+      namespace: infra-devops
+    groupName: cert.dev.cm
+    # 此处关闭 选择手动创建 以支持cnameStrategy
+    clusterIssuer:
+      enabled: false

flux/infrastructure/infra-devops/helmrelease-cert-manager.yaml

@@ -0,0 +1,31 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: infra-devops
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cert-manager
+      version: v1.19.3
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+        namespace: infra-gitops
+      interval: 12h
+  install:
+    crds: CreateReplace
+  upgrade:
+    crds: CreateReplace
+  # 首次install时servicemonitor=false(CRD尚不存在)
+  # infra-monitor层部署后通过SSA patch开启
+  values:
+    crds:
+      enabled: true
+      keep: true
+    enableCertificateOwnerRef: true
+    prometheus:
+      enabled: true
+      servicemonitor:
+        enabled: false

flux/infrastructure/infra-devops/helmrelease-reflector.yaml

@@ -0,0 +1,17 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: reflector
+  namespace: infra-devops
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: reflector
+      version: 9.1.45
+      sourceRef:
+        kind: HelmRepository
+        name: emberstack
+        namespace: infra-gitops
+      interval: 12h
+  values: {}

flux/infrastructure/infra-devops/helmrelease-velero.yaml

@@ -0,0 +1,60 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: velero
+  namespace: infra-devops
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: velero
+      version: 11.3.2
+      sourceRef:
+        kind: HelmRepository
+        name: vmware-tanzu
+        namespace: infra-gitops
+      interval: 12h
+  values:
+    # 此处暂时切换关闭upgradeCRDs操作 待官方修复后再开启
+    upgradeCRDs: false
+    deployNodeAgent: true
+    snapshotsEnabled: false
+    configuration:
+      backupSyncPeriod: 1h0m0s
+      defaultRepoMaintainFrequency: 3h0m0s
+      repositoryMaintenanceJob:
+        repositoryConfigData:
+          global:
+            keepLatestMaintenanceJobs: 1
+      backupStorageLocation:
+        - name: devcm-hw
+          default: true
+          provider: aws
+          bucket: devcm
+          prefix: velero
+          config:
+            region: cn-east-3
+            s3ForcePathStyle: false
+            s3Url: https://obs.cn-east-3.myhuaweicloud.com
+            checksumAlgorithm: ""
+      extraEnvVars:
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              name: s3-devcm-hw
+              key: ACCESS_KEY_ID
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: s3-devcm-hw
+              key: ACCESS_SECRET_KEY
+    credentials:
+      useSecret: false
+    initContainers:
+      - name: velero-plugin-for-aws
+        image: velero/velero-plugin-for-aws:v1.13.0
+        volumeMounts:
+          - mountPath: /target
+            name: plugins
+    nodeAgent:
+      # 控制面板不启用 lb节点不启用

flux/infrastructure/infra-devops/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helmrelease-cert-manager.yaml
+  - helmrelease-cert-manager-webhook-dnspod.yaml
+  - clusterissuer-dnspod.yaml
+  - helmrelease-reflector.yaml
+  - helmrelease-velero.yaml

flux/infrastructure/infra-devops/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-devops

flux/infrastructure/infra-devops/post/helmrelease-cert-manager-patch.yaml

@@ -0,0 +1,17 @@
+# 在prometheus-stack部署后 通过SSA patch cert-manager开启ServiceMonitor
+# cert-manager初始安装时servicemonitor.enabled=false(CRD尚不存在)
+# infra-monitor层部署时CRD已就绪 此patch合并到已有HelmRelease
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: infra-devops
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+spec:
+  values:
+    prometheus:
+      servicemonitor:
+        enabled: true
+        interval: 300s
+        prometheusInstance: kube-prometheus

flux/infrastructure/infra-devops/post/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrelease-cert-manager-patch.yaml