feat(gitops): migrate resources to infra-gitops namespace and update Helm chart versions

apps/infra/gitops/flux/flux-instance.yaml

@@ -0,0 +1,25 @@
+apiVersion: fluxcd.controlplane.io/v1
+kind: FluxInstance
+metadata:
+  name: flux
+  namespace: infra-gitops
+spec:
+  distribution:
+    version: "2.x"
+    registry: "ghcr.io/fluxcd"
+    artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"
+  components:
+    - source-controller
+    - source-watcher
+    - kustomize-controller
+    - helm-controller
+    - notification-controller
+  cluster:
+    type: kubernetes
+    size: small
+    multitenant: false
+    networkPolicy: true
+    domain: "cluster.local"
+  storage:
+    class: "local-path"
+    size: "10Gi"

apps/infra/gitops/flux/helmchart.yaml

@@ -0,0 +1,34 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: flux-operator
+  namespace: infra-gitops
+spec:
+  chart: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator
+  targetNamespace: infra-gitops
+  version: 0.40.0
+  valuesContent: |-
+    installCRDs: true
+    web:
+      config:
+        baseURL: https://cd.dev.cm
+        authentication:
+          type: OAuth2
+          oauth2:
+            provider: OIDC
+            issuerURL: https://git.dev.cm
+            clientID: "94b1ec99-55c4-4621-89c3-f49d8b7d5603"
+            clientSecret: "gto_5fmpkf6h7zohbpesnxfuvjvppinunayv7mfcyo2wmuzqtuj3ig2a"
+      networkPolicy:
+        create: false
+      ingress:
+        enabled: true
+        className: nginx
+        hosts:
+          - host: cd.dev.cm
+            paths:
+              - path: /
+                pathType: Prefix
+
+
+

apps/infra/gitops/flux/networkpolicy.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-flux-operator
+  namespace: infra-gitops
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: flux-operator
+  ingress:
+    - from:
+        - podSelector: {}
+        - ipBlock:
+            cidr: 100.0.0.0/8
+      ports:
+        - port: 9080
+          protocol: TCP
+  egress:
+    - {}
+  policyTypes:
+    - Ingress
+    - Egress

apps/infra/gitops/gitea/configmap-actions-dind.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-actions-dind-config
+  namespace: infra-gitops
+data:
+  daemon.json: |-
+    {
+      "mtu": 1280
+    }

apps/infra/gitops/gitea/configmap-templates.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-custom-templates
+  namespace: infra-gitops
+data:
+  home.tmpl: |-
+    {{template "base/head" .}}
+    <div class="page-content home">
+            <div class="ui stackable middle very relaxed page grid">
+                    <div class="sixteen wide center aligned centered column">
+                            <div>
+                                    <img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
+                            </div>
+                            <div class="hero">
+                                    <h1 class="ui icon header title">
+                                            {{AppName}}
+                                    </h1>
+                                    <h2><a href="https://dev.cm">Dev.cm</a> - Git {{ctx.Locale.Tr "repository"}}</h2>
+                            </div>
+                    </div>
+            </div>
+    </div>
+    {{template "base/footer" .}}
+
+  extra_links.tmpl: |-
+    <a class="item" href="https://dev.cm" target="_blank">{{if eq ctx.Locale.Lang "zh-CN"}}博客{{else}}Blog{{end}}</a>
+    <a class="item extra-links-end" href="https://fillcode.com" target="_blank">Fillcode</a>
+    <style>
+      .extra-links-end ~ a { display:none !important; }
+    </style>

apps/infra/gitops/gitea/helmchart-actions.yaml

@@ -0,0 +1,46 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: gitea-actions
+  namespace: infra-gitops
+spec:
+  repo: https://dl.gitea.com/charts
+  chart: actions
+  targetNamespace: infra-gitops
+  version: 0.0.2
+  valuesContent: |-
+    enabled: true
+    statefulset:
+      nodeSelector:
+        dev-cm-runner/enabled: "true"
+      actRunner:
+        config: |
+          log:
+            level: info
+          cache:
+            enabled: true
+          container:
+            require_docker: true
+            docker_timeout: 300s
+            # 使用bridge网络模式，解决新建任务临时网络mtu与主机不一致的问题   
+            network: bridge 
+      dind:
+        # 挂载dind docker配置文件，解决mtu带来的网络问题
+        extraVolumeMounts:
+          - name: dind-config-volume
+            mountPath: /etc/docker/daemon.json
+            subPath: daemon.json
+      extraVolumes:
+        - name: dind-config-volume
+          configMap:
+            name: gitea-actions-dind-config
+      persistence:
+        size: 10Gi
+    giteaRootURL: http://gitea-http.infra-gitops.svc.cluster.local:3000
+    existingSecret: gitea-actions
+    existingSecretKey: token
+      
+    
+
+
+

apps/infra/gitops/gitea/helmchart.yaml

@@ -0,0 +1,117 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: gitea
+  namespace: infra-gitops
+spec:
+  repo: https://dl.gitea.com/charts
+  chart: gitea
+  targetNamespace: infra-gitops
+  version: 12.3.0
+  valuesContent: |-
+    affinity:
+      podAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  cnpg.io/cluster: cnpg17-cluster-sh
+                  role: primary
+                  app.kubernetes.io/name: redis
+                  app.kubernetes.io/component: master
+              topologyKey: kubernetes.io/hostname
+              namespaceSelector: {}
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - homea   
+    redis-cluster:
+      enabled: false
+    postgresql-ha:
+      enabled: false
+    image:
+      tag: 1.25.3
+    ingress:
+      enabled: true
+      className: nginx
+      annotations:
+        nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+        nginx.ingress.kubernetes.io/configuration-snippet: |
+          proxy_set_header Accept-Encoding "";
+          subs_filter_types text/html;
+          subs_filter '<(script|img|link)([^>]*) (src|href)="/' '<$1$2 $3="https://cdn.fillcode.com/git-dev-cm/' ri;
+          subs_filter 'url\(\/' 'url(https://cdn.fillcode.com/git-dev-cm/' ri;
+          subs_filter '<head>' '<head><script src="/__static/pwa-cdn.js"></script>' ri;
+      hosts:
+        - host: git.dev.cm
+          paths:
+            - path: /
+              pathType: Prefix
+    gitea:
+      podAnnotations:
+        backup.velero.io/backup-volumes: data
+      config:
+        APP_NAME: Git Dev.cm
+        RUN_MODE: prod
+        server:
+          DOMAIN: git.dev.cm
+          ROOT_URL: https://git.dev.cm/
+        database:
+          DB_TYPE: postgres
+          HOST: cnpg17-cluster-sh-rw.infra-data:5432
+          NAME: gitea
+          USER: app
+          PASSWD: HueUoQx05DM0ICBPu1GrmBvBXE6NO3poKE6yPqokPv3dPpWvWRLAr3RXSpaL3AZd
+          SSL_MODE: disable
+        session:
+          PROVIDER: redis
+          PROVIDER_CONFIG: redis://:[email protected]:6379/0
+        cache:
+          ADAPTER: redis
+          HOST: redis://:[email protected]:6379/0?pool_size=100&idle_timeout=180s
+        queue:
+          TYPE: redis
+          CONN_STR: redis://:[email protected]:6379/0
+        repository:
+          DEFAULT_REPO_UNITS: repo.code,repo.releases,repo.issues,repo.pulls
+        actions:
+          ENABLED: true
+          DEFAULT_ACTIONS_URL: github
+        service:
+          DISABLE_REGISTRATION: true
+          NO_REPLY_ADDRESS: noreply.dev.cm
+        picture:
+          GRAVATAR_SOURCE: https://cravatar.cn/avatar/
+        i18n:
+          LANGS: zh-CN,en-US
+          NAMES: 简体中文,English
+        other:
+          SHOW_FOOTER_VERSION: false
+          SHOW_FOOTER_POWERED_BY: false
+        log:
+          LEVEL: Info
+        ui:
+          THEMES: gitea-auto, gitea-light, gitea-dark, github-auto, github-light, github-dark, github-soft-dark
+          DEFAULT_THEME: github-auto
+    valkey-cluster:
+      enabled: false
+    extraVolumes:
+      - name: gitea-custom-templates-volume
+        configMap:
+          name: gitea-custom-templates
+    extraContainerVolumeMounts:
+      - name: gitea-custom-templates-volume
+        subPath: home.tmpl
+        mountPath: /data/gitea/templates/home.tmpl
+      - name: gitea-custom-templates-volume
+        subPath: extra_links.tmpl
+        mountPath: /data/gitea/templates/custom/extra_links.tmpl
+
+
+

apps/infra/gitops/gitea/ingress-static.yaml

@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-static
+  namespace: infra-gitops
+  annotations:
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/proxy-buffering: "on"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_cache cache;
+      proxy_cache_valid 200 302 7d;
+      proxy_cache_valid 404 10m;
+      proxy_cache_valid any 1h;
+      proxy_cache_use_stale error timeout updating http_404 http_500 http_502 http_503 http_504;
+      proxy_cache_bypass $http_x_purge;
+      proxy_ignore_headers Cache-Control;
+      add_header X-Cache-Status $upstream_cache_status;
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: git.dev.cm
+      http:
+        paths:
+          - path: /(.*\.(css|js|png|jpg|jpeg|gif|svg|webp|ico|woff|woff2|ttf|eot)|avatars/[^/]+)$
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: gitea-http
+                port:
+                  number: 3000

apps/infra/gitops/gitea/loadbalancer-ssh.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-ssh-lb
+  namespace: infra-gitops
+spec:
+  selector:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/instance: gitea
+  ports:
+    - protocol: TCP
+      port: 22
+      targetPort: 2222
+  type: LoadBalancer

apps/infra/gitops/gitea/networkpolicy.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-gitea
+  namespace: infra-gitops
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  ingress:
+    - from:
+        - podSelector: {}
+        - ipBlock:
+            cidr: 100.0.0.0/8
+      ports:
+        - port: 3000
+          protocol: TCP
+        - port: 2222
+          protocol: TCP
+  egress:
+    - {}
+  policyTypes:
+    - Ingress
+    - Egress

apps/infra/gitops/namespaces.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-gitops