feat(k3s): 密码切换为密钥 & 相关服务升级

.env.sample

@@ -1,20 +0,0 @@
-# 华为云OBS S3凭据 (velero备份 + CNPG WAL归档)
-S3_ACCESS_KEY_ID=placeholder
-S3_ACCESS_SECRET_KEY=placeholder
-
-# DNSPod API凭据 (cert-manager ACME DNS验证)
-DNSPOD_SECRET_ID=placeholder
-DNSPOD_SECRET_KEY=placeholder
-
-# Gitea Actions Runner Token（Gitea 启动后在 admin → Runners 生成，参见 flux/README.md “部署后手工步骤”）
-GITEA_ACTIONS_TOKEN=placeholder
-
-# Flux Operator Web OIDC 凭据（Gitea 启动后创建 OAuth2 应用获取，Redirect URI: https://cd.dev.cm/oauth2/callback）
-FLUX_WEB_OIDC_CLIENT_ID=placeholder
-FLUX_WEB_OIDC_CLIENT_SECRET=placeholder
-
-# Infra Net 凭据
-NET_MAXMIND_LICENSE_KEY=placeholder
-NET_CROWDSEC_BOUNCER_API_KEY=placeholder
-NET_TURNSTILE_SITE_KEY=placeholder
-NET_TURNSTILE_SECRET_KEY=placeholder

.gitignore

@@ -2,12 +2,6 @@
 logs
 *.log
 
-# Secrets
-.env
-flux-git-auth
-flux-git-auth.pub
-known_hosts
-
 # Editor directories and files
 .vscode/*
 !.vscode/extensions.json

README.md

@@ -4,6 +4,6 @@
 
 参见 [ansible/README.md](ansible/README.md)
 
-#### 应用相关
+#### apps 相关应用
 
-参见 [flux/README.md](flux/README.md)
+参见 [apps/README.md](apps/README.md)

ansible/README.md

@@ -103,6 +103,8 @@ kubectl get nodes
 | 变量 | 必须 | 说明 |
 |------|------|------|
 | `TAILSCALE_AUTH_KEY` | ✅ | Tailscale Auth Key |
+| `K3S_TOKEN` | 单独添加节点时 | 集群 Token (完整安装时自动获取) |
+| `K3S_SERVER_URL` | 单独添加节点时 | API Server 地址 (完整安装时自动设置) |
 | `SSH_PASSWORD` | 首次安装 | SSH 密码 |
 | `SSH_PUBKEY` | - | SSH 公钥 (默认 ~/.ssh/id_rsa.pub) |
 

ansible/inventory/group_vars/all.yml

@@ -12,8 +12,7 @@ ha_server_url: "{{ lookup('env', 'HA_SERVER_URL') | default('', true) }}"
 # ============================================
 # K3s Server URL (优先使用 HA_SERVER_URL，否则动态使用 init 节点地址)
 k3s_server_url: "{{ ha_server_url if (ha_server_url | length > 0) else '' }}"
-k3s_version: "v1.35.6+k3s1"
-tailscale_version: "1.96.4"
+k3s_version: "v1.34.2+k3s1"
 
 # ETCD 配置
 etcd_snapshot_retention: 1
@@ -45,3 +44,4 @@ registry_mirrors:
     - "k8s.m.daocloud.io"
   quay.io:
     - "quay.m.daocloud.io"
+

ansible/inventory/hosts.yml

@@ -56,6 +56,7 @@ all:
           ansible_host: tchk.node.dev.cm
           node_hostname: tchk
           node_region: cn-hk
+          enable_lb: true
         tthk:
           ansible_host: tthk.node.dev.cm
           node_hostname: tthk
@@ -82,7 +83,6 @@ all:
           ansible_host: hwsg.node.dev.cm
           node_hostname: hwsg
           node_region: sg-sg
-          enable_lb: true
           netfilter_mode: nodivert
         hwa:
           ansible_host: hwa.node.dev.cm
@@ -90,6 +90,14 @@ all:
           node_region: cn-sh
           use_mirror: true
           netfilter_mode: nodivert
+        clawhk:
+          ansible_host: clawhk.node.dev.cm
+          node_hostname: clawhk
+          node_region: cn-hk
+        clawjp:
+          ansible_host: clawjp.node.dev.cm
+          node_hostname: clawjp
+          node_region: jp-tyo
         orajpa:
           ansible_host: orajpa.node.dev.cm
           node_hostname: orajpa
@@ -108,6 +116,11 @@ all:
           node_hostname: homea
           node_region: cn-sh
           use_mirror: true
+        homeb:
+          ansible_host: homeb
+          node_hostname: homeb
+          node_region: cn-sh
+          use_mirror: true
 
     # 节点分组
     k3s_cluster:

ansible/playbooks/site.yml

@@ -167,37 +167,3 @@
           {{ nodes.stdout }}
           ══════════════════════════════════════════════════════════════
       when: cluster_init | default(false)
-
-# ============================================
-# K3s 卸载 (需显式指定: --tags uninstall)
-# ============================================
-- name: Uninstall K3s agents
-  hosts: agents
-  gather_facts: false
-  tags: [uninstall, never]
-  tasks:
-    - name: Check agent uninstall script
-      ansible.builtin.stat:
-        path: /usr/local/bin/k3s-agent-uninstall.sh
-      register: agent_uninstall_script
-
-    - name: Run k3s-agent-uninstall.sh
-      ansible.builtin.command: /usr/local/bin/k3s-agent-uninstall.sh
-      when: agent_uninstall_script.stat.exists
-      changed_when: true
-
-- name: Uninstall K3s masters
-  hosts: masters
-  gather_facts: false
-  serial: 1
-  tags: [uninstall, never]
-  tasks:
-    - name: Check server uninstall script
-      ansible.builtin.stat:
-        path: /usr/local/bin/k3s-uninstall.sh
-      register: server_uninstall_script
-
-    - name: Run k3s-uninstall.sh
-      ansible.builtin.command: /usr/local/bin/k3s-uninstall.sh
-      when: server_uninstall_script.stat.exists
-      changed_when: true

ansible/roles/common/tasks/main.yml

@@ -37,20 +37,6 @@
   failed_when: false
   changed_when: false
 
-- name: Check current Tailscale version
-  ansible.builtin.shell: tailscale version | head -1
-  register: common_tailscale_version
-  failed_when: false
-  changed_when: false
-  when: common_tailscale_check.rc == 0
-
-- name: Set Tailscale install flag
-  ansible.builtin.set_fact:
-    tailscale_needs_install: "{{
-      common_tailscale_check.rc != 0 or
-      (common_tailscale_version.stdout | default('') is not search(tailscale_version))
-    }}"
-
 - name: Download Tailscale install script
   ansible.builtin.get_url:
     url: https://tailscale.com/install.sh
@@ -58,20 +44,11 @@
     mode: "0755"
   when: common_tailscale_check.rc != 0
 
-- name: Install Tailscale via install script
+- name: Install Tailscale
   ansible.builtin.command: /tmp/tailscale-install.sh
   when: common_tailscale_check.rc != 0
   changed_when: true
 
-- name: Install specific Tailscale version
-  ansible.builtin.apt:
-    name:
-      - "tailscale={{ tailscale_version }}"
-      - "tailscaled={{ tailscale_version }}"
-    state: present
-    allow_downgrade: true
-  when: tailscale_needs_install
-
 - name: Remove Tailscale install script
   ansible.builtin.file:
     path: /tmp/tailscale-install.sh

ansible/roles/k3s/tasks/main.yml

@@ -17,15 +17,6 @@
     path: /usr/local/bin/k3s
   register: k3s_binary
 
-# 检查当前K3s版本
-- name: Check current K3s version
-  ansible.builtin.command:
-    cmd: /usr/local/bin/k3s --version
-  register: k3s_current_version
-  failed_when: false
-  changed_when: false
-  when: k3s_binary.stat.exists
-
 # 部署配置文件（注册变更状态）
 - name: Deploy K3s server config
   ansible.builtin.template:
@@ -51,16 +42,9 @@
   when: use_mirror | default(false)
 
 # 判断是否需要安装/重启
-# 使用 -e force_reinstall=true 可强制重新安装
 - name: Set K3s installation flag
   ansible.builtin.set_fact:
-    k3s_needs_install: "{{ 
-      not k3s_binary.stat.exists or 
-      (force_reinstall | default(false) | bool) or 
-      (k3s_server_config.changed | default(false)) or 
-      (k3s_agent_config.changed | default(false)) or
-      (k3s_binary.stat.exists and k3s_current_version.stdout is defined and k3s_version not in k3s_current_version.stdout)
-    }}"
+    k3s_needs_install: "{{ not k3s_binary.stat.exists or (k3s_server_config.changed | default(false)) or (k3s_agent_config.changed | default(false)) }}"
 
 # 设置安装变量
 - name: Set K3s install variables
@@ -110,7 +94,7 @@
 - name: Wait for K3s server ready
   ansible.builtin.wait_for:
     path: /var/lib/rancher/k3s/server/node-token
-    timeout: 300
+    timeout: 120
   when: "'masters' in group_names"
 
 # 保存 kubeconfig (仅 cluster-init)

apps/README.md

@@ -0,0 +1,29 @@
+### apps
+
+集群服务helm部署的应用，包含一些基础服务和一些业务服务
+
+### 调试集群内服务方法 运行此命令
+
+```shell
+kubectl run -i --tty --rm --restart=Never \
+    --overrides='{"apiVersion": "v1", "spec": {"nodeSelector": {"kubernetes.io/hostname": "homea"}}}' \
+    --image=nicolaka/netshoot:latest \
+    debug -- sh
+```
+
+### 密钥相关
+
+可以将helm部署中使用到的密钥放到k8s的secret中
+然后使用reflector将secret中的密钥同步到其他namespace中
+
+```shell
+kubectl -n infra-data create secret generic s3-devcm-hw \
+    --from-literal=ACCESS_KEY_ID=xxxxx \
+    --from-literal=ACCESS_SECRET_KEY=xxxxx
+    
+kubectl -n infra-data annotate secret s3-devcm-hw \
+    reflector.v1.k8s.emberstack.com/reflection-allowed=true \
+    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces=infra-devops,apps \
+    reflector.v1.k8s.emberstack.com/reflection-auto-enabled=true --overwrite
+    
+```

apps/apps/fillcode/helmchart-whoami.yaml

@@ -1,21 +1,14 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: fillcode-whoami
   namespace: apps
 spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: whoami
-      version: 6.0.0
-      sourceRef:
-        kind: HelmRepository
-        name: cowboysysop
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://cowboysysop.github.io/charts/
+  chart: whoami
+  targetNamespace: apps
+  version: 5.1.2
+  valuesContent: |-
     ingress:
       enabled: true
       ingressClassName: nginx
@@ -27,3 +20,5 @@ spec:
         - host: whoami.fillcode.com
           paths:
             - /
+    
+

apps/apps/fillcode/ingress.yaml

@@ -3,6 +3,7 @@ kind: Ingress
 metadata:
   name: fillcode
   namespace: apps
+  annotations:
 spec:
   ingressClassName: nginx
   rules:
@@ -20,3 +21,4 @@ spec:
     - hosts:
         - fillcode.com
       secretName: fillcode-com-crt
+

apps/apps/halo/helmchart.yaml

@@ -1,31 +1,35 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: halo
   namespace: apps
 spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: halo
-      version: 1.3.2
-      sourceRef:
-        kind: HelmRepository
-        name: halo
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://halo-sigs.github.io/charts/
+  chart: halo
+  targetNamespace: apps
+  version: 1.3.2
+  valuesContent: |-
+    affinity:
+      podAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  cnpg.io/cluster: cnpg17-cluster-hk
+                  role: primary
+              topologyKey: kubernetes.io/hostname
+              namespaceSelector: {} 
     image:
       repository: halohub/halo-pro
-      tag: 2.25.4
+      tag: 2.22.13
     service:
       type: ClusterIP
     ingress:
       enabled: true
       ingressClassName: nginx
       annotations:
-        nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+        nginx.ingress.kubernetes.io/proxy-body-size: "50m"
         nginx.ingress.kubernetes.io/configuration-snippet: |
           proxy_set_header Accept-Encoding "";
           subs_filter_types text/html;
@@ -48,11 +52,14 @@ spec:
       enabled: false
     externalDatabase:
       platform: postgresql
-      host: cnpg17-cluster-rw.infra-data
+      host: cnpg17-cluster-hk-rw.infra-data
       port: 5432
       user: app
       password: from-secret
       database: halo
-      existingSecret: cnpg17-cluster-app
+      existingSecret: cnpg17-cluster-hk-app
     haloUsername: rohow
     haloExternalUrl: https://dev.cm
+
+    
+

apps/apps/halo/ingress-static.yaml

@@ -4,8 +4,8 @@ metadata:
   name: halo-static
   namespace: apps
   annotations:
-    nginx.ingress.kubernetes.io/proxy-buffering: "on"
     nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/proxy-buffering: "on"
     nginx.ingress.kubernetes.io/configuration-snippet: |
       proxy_cache cache;
       proxy_cache_valid 200 302 7d;
@@ -28,6 +28,3 @@ spec:
                 name: halo
                 port:
                   number: 80
-  tls:
-    - hosts:
-        - dev.cm

apps/apps/halo/ingress-www.yaml

@@ -9,9 +9,6 @@ metadata:
       rewrite ^/(.*)$ https://dev.cm/$1 permanent;
 spec:
   ingressClassName: nginx
-  tls:
-    - hosts:
-        - www.dev.cm
   rules:
     - host: www.dev.cm
       http:
@@ -23,3 +20,4 @@ spec:
                 name: halo
                 port:
                   number: 80
+

apps/apps/rustdesk/helmchart.yaml

@@ -1,33 +1,27 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: rustdesk
   namespace: apps
 spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: rustdesk-server
-      version: 0.0.7
-      sourceRef:
-        kind: HelmRepository
-        name: devcm-repo
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://devcm-repo.github.io/helm-charts
+  chart: rustdesk-server
+  targetNamespace: apps
+  version: 0.0.5
+  valuesContent: |-
+    nodeSelector:
+      kubernetes.io/hostname: tcd
+    
     rustdeskServer:
       encryptedOnly: true
       mustLogin: true
       server: desk-server.dev.cm
-      podAnnotations:
-        backup.velero.io/backup-volumes: data
       extraEnvs:
         - name: TZ
           value: "Asia/Shanghai"
         - name: RUSTDESK_API_LANG
           value: "zh-CN"
-
+    
     rustdeskApi:
       server: desk.dev.cm
       ingress:

apps/apps/sinceai/ingress-shop.yaml

@@ -4,6 +4,7 @@ metadata:
   name: sinceai-shop
   namespace: apps
   annotations:
+    # 302 跳转到https://sinceai.taobao.com/
     nginx.ingress.kubernetes.io/configuration-snippet: |
       rewrite ^/(.*)$ https://sinceai.taobao.com/$1? permanent;
 spec:
@@ -23,3 +24,4 @@ spec:
     - hosts:
         - shop.sinceai.com
       secretName: sinceai-com-crt
+

apps/infra/data/cloudnative-pg/cnpg17-cluster-hk.yaml

@@ -0,0 +1,51 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: cnpg17-cluster-hk
+  namespace: infra-data
+spec:
+  affinity:
+    nodeAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - preference:
+            matchExpressions:
+              - key: topology.kubernetes.io/region
+                operator: In
+                values:
+                  - cn-hk
+          weight: 1
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
+  enableSuperuserAccess: true
+  storage:
+    size: 10Gi
+  postgresql:
+    parameters:
+      archive_timeout: 30min
+  backup:
+    retentionPolicy: "7d"
+    barmanObjectStore:
+      destinationPath: s3://devcm/cnpg/
+      endpointURL: https://obs.cn-east-3.myhuaweicloud.com
+      s3Credentials:
+        accessKeyId:
+          name: s3-devcm-hw
+          key: ACCESS_KEY_ID
+        secretAccessKey:
+          name: s3-devcm-hw
+          key: ACCESS_SECRET_KEY
+      wal:
+        compression: gzip
+
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: cnpg17-cluster-hk-backups
+  namespace: infra-data
+spec:
+  schedule: "0 0 0 * * *"
+  immediate: true
+  backupOwnerReference: self
+  cluster:
+    name: cnpg17-cluster-hk

apps/infra/data/cloudnative-pg/cnpg17-cluster-sh.yaml

@@ -0,0 +1,51 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: cnpg17-cluster-sh
+  namespace: infra-data
+spec:
+  affinity:
+    nodeAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - preference:
+            matchExpressions:
+              - key: topology.kubernetes.io/region
+                operator: In
+                values:
+                  - cn-sh
+          weight: 1
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
+  enableSuperuserAccess: true
+  storage:
+    size: 10Gi
+  postgresql:
+    parameters:
+      archive_timeout: 30min
+  backup:
+    retentionPolicy: "7d"
+    barmanObjectStore:
+      destinationPath: s3://devcm/cnpg/
+      endpointURL: https://obs.cn-east-3.myhuaweicloud.com
+      s3Credentials:
+        accessKeyId:
+          name: s3-devcm-hw
+          key: ACCESS_KEY_ID
+        secretAccessKey:
+          name: s3-devcm-hw
+          key: ACCESS_SECRET_KEY
+      wal:
+        compression: gzip
+
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: cnpg17-cluster-sh-backups
+  namespace: infra-data
+spec:
+  schedule: "0 0 0 * * *"
+  immediate: true
+  backupOwnerReference: self
+  cluster:
+    name: cnpg17-cluster-sh

apps/infra/data/cloudnative-pg/helmchart.yaml

@@ -0,0 +1,27 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cloudnative-pg
+  namespace: infra-data
+spec:
+  repo: https://cloudnative-pg.github.io/charts
+  chart: cloudnative-pg
+  targetNamespace: infra-data
+  version: 0.25.0
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: topology.kubernetes.io/region
+                  operator: In
+                  values:
+                    - "cn-sh"
+    tolerations:
+      - key: "node-role.kubernetes.io/control-plane"
+        operator: "Exists"
+        effect: "NoSchedule"
+    image:
+      tag: "1.25.3"
+

apps/infra/data/cloudnative-pg/loadbalancer-sh.yaml

@@ -9,6 +9,6 @@ spec:
     role: primary
   ports:
     - protocol: TCP
-      port: 65431
+      port: 65432
       targetPort: 5432
   type: LoadBalancer

apps/infra/data/namespaces.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: infra-net
+  name: infra-data

apps/infra/data/valkey-cluster/helmchart.yaml

@@ -0,0 +1,21 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: valkey-cluster-sh
+  namespace: infra-data
+spec:
+  chart: oci://registry-1.docker.io/bitnamicharts/valkey-cluster
+  targetNamespace: infra-data
+  version: 3.0.23
+  valuesContent: |-
+    image:
+      repository: bitnamilegacy/valkey-cluster
+    cluster:
+      nodes: 1
+      replicas: 0
+    valkey: 
+      nodeAffinityPreset:
+        type: hard
+        key: topology.kubernetes.io/region
+        values:
+          - cn-sh

apps/infra/devops/cert-manager/clusterissuer-dnspod.yaml

@@ -1,7 +1,7 @@
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
-  name: dnspod
+  name: cert-manager-webhook-dnspod
   labels:
     app: cert-manager-webhook-dnspod
 spec:
@@ -23,4 +23,4 @@ spec:
                 key: secretId
               secretKeyRef:
                 name: dnspod-secret
-                key: secretKey
+                key: secretKey

apps/infra/devops/cert-manager/helmchart-dnspod.yaml

@@ -0,0 +1,29 @@
+# 安装后需要将clusterIssuer的cnameStrategy策略设置为Follow
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cert-manager-webhook-dnspod
+  namespace: infra-devops
+spec:
+  chart: oci://registry-1.docker.io/imroc/cert-manager-webhook-dnspod
+  targetNamespace: infra-devops
+  version: 1.4.5
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: topology.kubernetes.io/region
+                  operator: In
+                  values:
+                    - "cn-sh"
+    image:
+      tag: "1.5.2"
+    namespace: infra-devops
+    certManager:
+      namespace: infra-devops
+    groupName: cert.dev.cm
+    # 此处关闭 选择手动创建 以支持cnameStrategy
+    clusterIssuer:
+      enabled: false

apps/infra/devops/cert-manager/helmchart.yaml

@@ -0,0 +1,51 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cert-manager
+  namespace: infra-devops
+spec:
+  repo: https://charts.jetstack.io
+  chart: cert-manager
+  targetNamespace: infra-devops
+  version: v1.19.3
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: topology.kubernetes.io/region
+                  operator: In
+                  values:
+                    - "cn-sh"
+    webhook:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: topology.kubernetes.io/region
+                    operator: In
+                    values:
+                      - "cn-sh"
+    cainjector:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: topology.kubernetes.io/region
+                    operator: In
+                    values:
+                      - "cn-sh"
+    crds:
+      enabled: true
+      keep: true
+    # 在删除证书时同时删除secret
+    enableCertificateOwnerRef: true
+    prometheus:
+      enabled: false
+      servicemonitor:
+        enabled: true
+        interval: 300s
+        prometheusInstance: kube-prometheus

apps/infra/devops/namespaces.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: infra-devops
+  name: infra-devops

apps/infra/devops/reflector/helmchart.yaml

@@ -0,0 +1,20 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: reflector
+  namespace: infra-devops
+spec:
+  repo: https://emberstack.github.io/helm-charts
+  chart: reflector
+  targetNamespace: infra-devops
+  version: 9.1.45
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: topology.kubernetes.io/region
+                  operator: In
+                  values:
+                    - "cn-sh"

apps/infra/devops/velero/helmchart.yaml

@@ -1,21 +1,31 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: velero
   namespace: infra-devops
 spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: velero
-      version: 12.0.3
-      sourceRef:
-        kind: HelmRepository
-        name: vmware-tanzu
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://vmware-tanzu.github.io/helm-charts
+  chart: velero
+  targetNamespace: infra-devops
+  version: 11.3.2
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: topology.kubernetes.io/region
+                  operator: In
+                  values:
+                    - "cn-sh"
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - homeb  
     # 此处暂时切换关闭upgradeCRDs操作 待官方修复后再开启
     upgradeCRDs: false
     deployNodeAgent: true
@@ -24,7 +34,7 @@ spec:
       backupSyncPeriod: 1h0m0s
       defaultRepoMaintainFrequency: 3h0m0s
       repositoryMaintenanceJob:
-        repositoryConfigData:
+        repositoryConfigData: 
           global:
             keepLatestMaintenanceJobs: 1
       backupStorageLocation:
@@ -43,7 +53,7 @@ spec:
           valueFrom:
             secretKeyRef:
               name: s3-devcm-hw
-              key: ACCESS_KEY_ID
+              key: ACCESS_KEY_ID    
         - name: AWS_SECRET_ACCESS_KEY
           valueFrom:
             secretKeyRef:
@@ -58,4 +68,6 @@ spec:
           - mountPath: /target
             name: plugins
     nodeAgent:
-      enabled: true
+      nodeSelector:
+        backup.velero.io/enable: "true"
+      

apps/infra/gitops/flux/flux-instance.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: infra-gitops
 spec:
   distribution:
-    version: "2.9.2"
+    version: "2.x"
     registry: "ghcr.io/fluxcd"
     artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"
   components:
@@ -22,35 +22,10 @@ spec:
   storage:
     class: "local-path"
     size: "10Gi"
-  sync:
-    kind: GitRepository
-    url: ssh://[email protected]/devcm-repo/k3s.git
-    ref: refs/heads/main
-    path: flux/clusters/dev-cm
-    pullSecret: flux-git-auth
-    name: flux
   kustomize:
     patches:
-      # source-controller 需要良好的国际网络环境，优先调度到网络较好的节点上
       - target:
           kind: Deployment
-          name: (source-controller)
-        patch: |
-          - op: add
-            path: /spec/template/spec/affinity
-            value:
-              nodeAffinity:
-                preferredDuringSchedulingIgnoredDuringExecution:
-                  - weight: 100
-                    preference:
-                      matchExpressions:
-                        - key: kubernetes.io/hostname
-                          operator: In
-                          values:
-                            - tchk
-      - target:
-          kind: Deployment
-          name: (helm-controller|kustomize-controller|notification-controller)
         patch: |
           - op: add
             path: /spec/template/spec/affinity
@@ -63,4 +38,4 @@ spec:
                         - key: kubernetes.io/hostname
                           operator: In
                           values:
-                            - homea
+                            - homea

apps/infra/gitops/flux/helmchart.yaml

@@ -0,0 +1,44 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: flux-operator
+  namespace: infra-gitops
+spec:
+  chart: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator
+  targetNamespace: infra-gitops
+  version: 0.40.0
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - homea  
+    installCRDs: true
+    web:
+      config:
+        baseURL: https://cd.dev.cm
+        authentication:
+          type: OAuth2
+          oauth2:
+            provider: OIDC
+            issuerURL: https://git.dev.cm
+            clientID: "94b1ec99-55c4-4621-89c3-f49d8b7d5603"
+            clientSecret: "gto_5fmpkf6h7zohbpesnxfuvjvppinunayv7mfcyo2wmuzqtuj3ig2a"
+      networkPolicy:
+        create: false
+      ingress:
+        enabled: true
+        className: nginx
+        hosts:
+          - host: cd.dev.cm
+            paths:
+              - path: /
+                pathType: Prefix
+
+
+

apps/infra/gitops/gitea/configmap-actions-dind.yaml

@@ -7,4 +7,4 @@ data:
   daemon.json: |-
     {
       "mtu": 1280
-    }
+    }

apps/infra/gitops/gitea/configmap-templates.yaml

@@ -28,4 +28,4 @@ data:
     <a class="item extra-links-end" href="https://fillcode.com" target="_blank">Fillcode</a>
     <style>
       .extra-links-end ~ a { display:none !important; }
-    </style>
+    </style>

apps/infra/gitops/gitea/helmchart-actions.yaml

@@ -1,27 +1,19 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: gitea-actions
   namespace: infra-gitops
 spec:
-  interval: 30m
-  timeout: 15m
-  dependsOn:
-    - name: gitea
-  chart:
-    spec:
-      chart: actions
-      version: 0.1.1
-      sourceRef:
-        kind: HelmRepository
-        name: gitea
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://dl.gitea.com/charts
+  chart: actions
+  targetNamespace: infra-gitops
+  version: 0.0.2
+  valuesContent: |-
     enabled: true
     statefulset:
-      runner:
-        tag: 2.0.1
+      nodeSelector:
+        dev-cm-runner/enabled: "true"
+      actRunner:
         config: |
           log:
             level: info
@@ -30,10 +22,9 @@ spec:
           container:
             require_docker: true
             docker_timeout: 300s
-            # 使用bridge网络模式，解决新建任务临时网络mtu与主机不一致的问题
-            network: bridge
+            # 使用bridge网络模式，解决新建任务临时网络mtu与主机不一致的问题   
+            network: bridge 
       dind:
-        tag: 29.5.2-dind
         # 挂载dind docker配置文件，解决mtu带来的网络问题
         extraVolumeMounts:
           - name: dind-config-volume
@@ -48,3 +39,8 @@ spec:
     giteaRootURL: http://gitea-http.infra-gitops.svc.cluster.local:3000
     existingSecret: gitea-actions
     existingSecretKey: token
+      
+    
+
+
+

apps/infra/gitops/gitea/helmchart.yaml

@@ -1,27 +1,42 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: gitea
   namespace: infra-gitops
 spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: gitea
-      version: 12.6.0
-      sourceRef:
-        kind: HelmRepository
-        name: gitea
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://dl.gitea.com/charts
+  chart: gitea
+  targetNamespace: infra-gitops
+  version: 12.3.0
+  valuesContent: |-
+    affinity:
+      podAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  cnpg.io/cluster: cnpg17-cluster-sh
+                  role: primary
+                  app.kubernetes.io/name: redis
+                  app.kubernetes.io/component: master
+              topologyKey: kubernetes.io/hostname
+              namespaceSelector: {}
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - homea   
     redis-cluster:
       enabled: false
     postgresql-ha:
       enabled: false
     image:
-      tag: 1.27.0
+      tag: 1.25.3
     ingress:
       enabled: true
       className: nginx
@@ -49,7 +64,7 @@ spec:
           ROOT_URL: https://git.dev.cm/
         database:
           DB_TYPE: postgres
-          HOST: cnpg17-cluster-rw.infra-data:5432
+          HOST: cnpg17-cluster-sh-rw.infra-data:5432
           NAME: gitea
           USER: app
           SSL_MODE: disable
@@ -84,19 +99,19 @@ spec:
         - name: GITEA__DATABASE__PASSWD
           valueFrom:
             secretKeyRef:
-              name: cnpg17-cluster-app
+              name: cnpg17-cluster-sh-app
               key: password
         - name: REDIS_PASSWORD
           valueFrom:
             secretKeyRef:
-              name: valkey-cluster
+              name: valkey-cluster-sh
               key: valkey-password
         - name: GITEA__SESSION__PROVIDER_CONFIG
-          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
+          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
         - name: GITEA__CACHE__HOST
-          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
+          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
         - name: GITEA__QUEUE__CONN_STR
-          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
+          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"    
     valkey-cluster:
       enabled: false
     extraVolumes:
@@ -110,3 +125,6 @@ spec:
       - name: gitea-custom-templates-volume
         subPath: extra_links.tmpl
         mountPath: /data/gitea/templates/custom/extra_links.tmpl
+
+
+

apps/infra/gitops/gitea/loadbalancer-ssh.yaml

@@ -11,4 +11,4 @@ spec:
     - protocol: TCP
       port: 22
       targetPort: 2222
-  type: LoadBalancer
+  type: LoadBalancer

apps/infra/gitops/gitea/networkpolicy.yaml

@@ -13,4 +13,4 @@ spec:
     - {}
   policyTypes:
     - Ingress
-    - Egress
+    - Egress

apps/infra/gitops/namespaces.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: infra-gitops
+  name: infra-gitops

apps/infra/monitor/loki/helmchart-loki.yaml

@@ -1,33 +1,32 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: loki
   namespace: infra-monitor
 spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: loki
-      version: 7.0.0
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://grafana.github.io/helm-charts
+  chart: loki
+  targetNamespace: infra-monitor
+  version: 6.49.0
+  valuesContent: |-
     deploymentMode: SingleBinary
     gateway:
       enabled: false
     lokiCanary:
+      nodeSelector:
+        svccontroller.k3s.cattle.io/enablelb: "true"
       extraArgs:
         # 降低测试日志生成条数
         - -interval=30s
         - -labelname=service_name
         - -labelvalue=loki-canary
     resultsCache:
+      nodeSelector:
+        kubernetes.io/hostname: tce
       allocatedMemory: 1024
     chunksCache:
+      nodeSelector:
+        kubernetes.io/hostname: tce
       allocatedMemory: 1024
     loki:
       auth_enabled: false
@@ -38,21 +37,24 @@ spec:
         max_query_series: 10000
         volume_enabled: true
       storage:
-        type: "filesystem"
+        type: 'filesystem'
       schemaConfig:
         configs:
-          - from: "2024-01-01"
-            store: tsdb
-            index:
-              prefix: loki_index_
-              period: 24h
-            object_store: filesystem
-            schema: v13
+        - from: "2024-01-01"
+          store: tsdb
+          index:
+            prefix: loki_index_
+            period: 24h
+          object_store: filesystem
+          schema: v13
     singleBinary:
       replicas: 1
+      nodeSelector:
+        kubernetes.io/hostname: tce
     read:
       replicas: 0
     backend:
       replicas: 0
     write:
       replicas: 0
+

apps/infra/monitor/loki/helmchart-promtail.yaml

@@ -1,23 +1,15 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: loki-promtail
   namespace: infra-monitor
 spec:
-  interval: 30m
-  timeout: 15m
-  dependsOn:
-    - name: loki
-  chart:
-    spec:
-      chart: promtail
-      version: 6.17.1
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://grafana.github.io/helm-charts
+  chart: promtail
+  targetNamespace: infra-monitor
+  valuesContent: |-
+    nodeSelector:
+      svccontroller.k3s.cattle.io/enablelb: "true"
     configmap:
       enabled: true
     config:
@@ -27,12 +19,10 @@ spec:
       snippets:
         extraRelabelConfigs:
           # 匹配 devcm-log-collecting/enabled 标签 只有为true时才收集日志
-          - source_labels:
-              [__meta_kubernetes_pod_label_devcm_log_collecting_enabled]
+          - source_labels: [__meta_kubernetes_pod_label_devcm_log_collecting_enabled]
             action: keep
             regex: true
           # 匹配 devcm-log-collecting/only-errors标签并只保留stderr流
-          - source_labels:
-              [__meta_kubernetes_pod_label_devcm_log_collecting_only_errors]
+          - source_labels: [__meta_kubernetes_pod_label_devcm_log_collecting_only_errors]
             action: drop
             regex: stdout

apps/infra/monitor/namespaces.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-monitor

apps/infra/monitor/prometheus/helmchart.yaml

@@ -1,25 +1,14 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: prometheus
   namespace: infra-monitor
 spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: kube-prometheus-stack
-      version: 86.3.2
-      sourceRef:
-        kind: HelmRepository
-        name: prometheus-community
-        namespace: infra-gitops
-      interval: 12h
-  install:
-    crds: CreateReplace
-  upgrade:
-    crds: CreateReplace
-  values:
+  repo: https://prometheus-community.github.io/helm-charts
+  chart: kube-prometheus-stack
+  targetNamespace: infra-monitor
+  version: 81.5.0
+  valuesContent: |-
     kubeControllerManager:
       enabled: false
     kubeScheduler:
@@ -29,11 +18,26 @@ spec:
     kubeEtcd:
       enabled: false
 
-    prometheusOperator: {}
-
-    kube-state-metrics: {}
-
+    prometheusOperator:
+      nodeSelector:
+        kubernetes.io/hostname: hwa
+        
+    kube-state-metrics:
+      nodeSelector:
+        kubernetes.io/hostname: hwa
+              
     grafana:
+      affinity:
+        podAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    cnpg.io/cluster: cnpg17-cluster-sh
+                    role: primary
+                topologyKey: kubernetes.io/hostname
+                namespaceSelector: {}
       ingress:
         enabled: true
         ingressClassName: nginx
@@ -50,11 +54,6 @@ spec:
         paths:
           - /
       assertNoLeakedSecrets: false
-      envValueFrom:
-        GF_DATABASE_PASSWORD:
-          secretKeyRef:
-            name: cnpg17-cluster-app
-            key: password
       grafana.ini:
         server:
           root_url: https://monitor.dev.cm/
@@ -66,22 +65,26 @@ spec:
           news_feed_enabled: false
         database:
           type: postgres
-          host: cnpg17-cluster-rw.infra-data:5432
+          host: cnpg17-cluster-sh-rw.infra-data:5432
           name: grafana
           user: app
-          password: $__env{GF_DATABASE_PASSWORD}
+          password: fYyAc4PNKLrvEB0IfkDm1TMR7sZkAcK1DGp4yqG5Y9aSS0UJMCgSiW6hhrsTztLA
       persistence:
         type: pvc
         enabled: true
+        storageClassName: local-path
         accessModes:
           - ReadWriteOnce
         size: 10Gi
-
+        
     prometheus:
       prometheusSpec:
+        nodeSelector:
+          kubernetes.io/hostname: hwa
         storageSpec:
           volumeClaimTemplate:
             spec:
+              storageClassName: local-path
               accessModes:
                 - ReadWriteOnce
               resources:
@@ -99,12 +102,15 @@ spec:
           - monitor.dev.cm
         paths:
           - /prometheus
-
+                
     alertmanager:
       alertmanagerSpec:
-        storage:
+        nodeSelector:
+          kubernetes.io/hostname: hwa
+        storage: 
           volumeClaimTemplate:
             spec:
+              storageClassName: local-path
               accessModes:
                 - ReadWriteOnce
               resources:

apps/infra/net/crowdsec/helmchart.yaml

@@ -1,29 +1,28 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: crowdsec
   namespace: infra-net
 spec:
-  interval: 30m
-  timeout: 15m
-  dependsOn:
-    - name: ingress-nginx
-    - name: loki
-      namespace: infra-monitor
-  chart:
-    spec:
-      chart: crowdsec
-      version: 0.24.0
-      sourceRef:
-        kind: HelmRepository
-        name: crowdsec
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://crowdsecurity.github.io/helm-charts
+  chart: crowdsec
+  targetNamespace: infra-net
+  version: 0.21.1
+  valuesContent: |-
     container_runtime: containerd
     image:
-      tag: v1.7.8
+      tag: v1.7.4
     agent:
+      affinity:
+        podAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: loki
+                topologyKey: kubernetes.io/hostname
+                namespaceSelector: {}
       isDeployment: true
       additionalAcquisition:
         - source: loki
@@ -33,7 +32,7 @@ spec:
           query: |
             {job="infra-net/ingress-nginx"}
           labels:
-            type: nginx
+            type: nginx         
       env:
         - name: COLLECTIONS
           value: "crowdsecurity/base-http-scenarios crowdsecurity/http-dos"
@@ -43,6 +42,16 @@ spec:
         config:
           enabled: false
     appsec:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 1
+              preference:
+                matchExpressions:
+                  - key: topology.kubernetes.io/region
+                    operator: In
+                    values:
+                      - cn-hk
       enabled: false
       acquisitions:
         - source: appsec
@@ -65,6 +74,16 @@ spec:
         - name: COLLECTIONS
           value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs"
     lapi:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 1
+              preference:
+                matchExpressions:
+                  - key: topology.kubernetes.io/region
+                    operator: In
+                    values:
+                      - cn-hk
       resources:
         requests:
           cpu: 150m
@@ -74,22 +93,16 @@ spec:
           enabled: false
         data:
           enabled: false
-      env:
-        - name: DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: cnpg17-cluster-app
-              key: password
     config:
       # api config.yaml配置
       config.yaml.local: |
         db_config:
           type: postgresql
-          host: cnpg17-cluster-rw.infra-data
+          host: cnpg17-cluster-hk-rw.infra-data
           port: 5432
           db_name: crowdsec
           user: app
-          password: ${DB_PASSWORD}
+          password: 4EMiSg9adUSxPAwNWIsHhKd1WZ7lhGuCnNofCFHuU1aQHSho85xeSK6TPcgJ4NU7
           sslmode: require
         api:
           server:
@@ -100,7 +113,7 @@ spec:
                 - "127.0.0.1/32"
                 - "192.168.0.0/16"
                 - "172.16.0.0/12"
-                - "10.0.0.0/8"
+                - "10.0.0.0/8"    
       # api profiles.yaml配置
       profiles.yaml: |
         name: captcha_remediation
@@ -216,3 +229,5 @@ spec:
                     statics:
                       - meta: sub_type
                         value: "req_limit_exceeded"
+            
+

apps/infra/net/namespaces.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: infra-data
+  name: infra-net

apps/infra/net/nginx/configmap-static-update.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# 更新 ConfigMap 中的静态文件
+cat > configmap-static.yaml << 'EOF'
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: static
+  namespace: infra-net
+data:
+EOF
+
+# 直接遍历 static 目录并追加到文件
+for file in static/*; do
+    filename=$(basename "$file")
+    echo "  $filename: |" >> configmap-static.yaml
+    sed 's/^/    /' "$file" >> configmap-static.yaml
+    echo "" >> configmap-static.yaml
+done
+
+echo "ConfigMap updated successfully!"

apps/infra/net/nginx/helmchart.yaml

@@ -1,38 +1,39 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: ingress-nginx
   namespace: infra-net
 spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: ingress-nginx
-      version: 4.13.9
-      sourceRef:
-        kind: HelmRepository
-        name: ingress-nginx
-        namespace: infra-gitops
-      interval: 12h
-  valuesFrom:
-    - kind: Secret
-      name: infra-net-env
-      valuesKey: ingress-nginx-values.yaml
-  values:
+  repo: https://kubernetes.github.io/ingress-nginx
+  chart: ingress-nginx
+  version: 4.13.2
+  targetNamespace: infra-net
+  valuesContent: |-
     fullnameOverride: ingress-nginx
     controller:
       image:
         registry: docker.io
         image: crowdsecurity/controller
-        tag: v1.13.7
+        tag: v1.13.2
         digest: sha256:4575be24781cad35f8e58437db6a3f492df2a3167fed2b6759a6ff0dc3488d56
+      nodeSelector:
+        svccontroller.k3s.cattle.io/enablelb: "true"
+      tolerations:
+        - key: "node-role.kubernetes.io/control-plane"
+          operator: "Exists"
+          effect: "NoSchedule"
       labels:
         devcm-log-collecting/enabled: "true"
       kind: DaemonSet
       hostNetwork: true
       hostPort:
         enabled: true
+      # 添加 DNS 配置
+      dnsPolicy: "None"
+      dnsConfig:
+        nameservers:
+          - "169.254.20.10"
+          - "10.43.0.10"
       service:
         enabled: false
       publishService:
@@ -41,9 +42,6 @@ spec:
       enableAnnotationValidations: false
       config:
         use-forwarded-headers: "true"
-        enable-real-ip: "true"
-        forwarded-for-header: "X-Dev-Cm-Real-IP"
-        proxy-real-ip-cidr: "0.0.0.0/0"
         allow-snippet-annotations: "true"
         annotations-risk-level: Critical
         # 启用http2
@@ -129,6 +127,8 @@ spec:
         # crowdsec插件配置
         plugins: "crowdsec"
         lua-shared-dicts: "crowdsec_cache: 50m"
+      # 启用geoip2模块
+      maxmindLicenseKey: "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"
       extraArgs:
         default-ssl-certificate: "infra-net/dev-cm-crt"
       # crowdsec插件配置
@@ -142,10 +142,7 @@ spec:
             - name: API_URL
               value: "http://crowdsec-service.infra-net.svc.cluster.local:8080"
             - name: API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: infra-net-env
-                  key: NET_CROWDSEC_BOUNCER_API_KEY
+              value: "Y+21CixTaU4dHT88FjenubUTQ3hBtb66dRsh23TmDnw"
             - name: BOUNCER_CONFIG
               value: "/crowdsec/crowdsec-bouncer.conf"
             - name: MODE
@@ -159,15 +156,9 @@ spec:
             - name: CAPTCHA_PROVIDER
               value: "turnstile"
             - name: SITE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: infra-net-env
-                  key: NET_TURNSTILE_SITE_KEY
+              value: "0x4AAAAAAAxJ2RPNWzn2LCc-"
             - name: SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: infra-net-env
-                  key: NET_TURNSTILE_SECRET_KEY
+              value: "0x4AAAAAAAxJ2dwFOaNg5ae3c6wYTmWH0bU"
             - name: CAPTCHA_TEMPLATE_PATH
               value: /etc/nginx/static/captcha.html
           command: ['/bin/sh', '-c']
@@ -205,3 +196,13 @@ spec:
       extraVolumeMounts:
         - name: static
           mountPath: /app/static
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: topology.kubernetes.io/region
+                    operator: In
+                    values:
+                      - "cn-sh"
+                      - "cn-hk"

apps/infra/net/nginx/static/captcha.html

@@ -0,0 +1,302 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta content="width=device-width,initial-scale=1,user-scalable=no,viewport-fit=cover" name="viewport">
+    <title>出于安全原因 请完成验证</title>
+    <script src="{{captcha_frontend_js}}" async defer></script>
+    <style>
+        * {
+            -webkit-box-sizing: border-box;
+            box-sizing: border-box
+        }
+
+        body {
+            padding: 0;
+            margin: 0
+        }
+
+        #error {
+            position: relative;
+            height: 100vh
+        }
+
+        #error .error {
+            position: absolute;
+            left: 50%;
+            top: 50%;
+            -webkit-transform: translate(-50%, -50%);
+            -ms-transform: translate(-50%, -50%);
+            transform: translate(-50%, -50%)
+        }
+
+        #error .error-bg {
+            position: absolute;
+            left: 0;
+            right: 0;
+            top: 0;
+            bottom: 0;
+            overflow: hidden
+        }
+
+        #error .error-bg > div {
+            position: absolute;
+            top: 0;
+            bottom: 0;
+            width: 1px;
+            background-color: #eee
+        }
+
+        #error .error-bg > div:nth-child(1) {
+            left: 20%
+        }
+
+        #error .error-bg > div:nth-child(2) {
+            left: 40%
+        }
+
+        #error .error-bg > div:nth-child(3) {
+            left: 60%
+        }
+
+        #error .error-bg > div:nth-child(4) {
+            left: 80%
+        }
+
+        #error .error-bg > div:after {
+            content: '';
+            position: absolute;
+            top: 0;
+            left: -.5px;
+            -webkit-transform: translateY(-160px);
+            -ms-transform: translateY(-160px);
+            transform: translateY(-160px);
+            height: 160px;
+            width: 2px;
+            background-color: #1cfafe
+        }
+
+        @-webkit-keyframes drop {
+            90% {
+                height: 20px
+            }
+
+            100% {
+                height: 160px;
+                -webkit-transform: translateY(calc(100vh + 160px));
+                transform: translateY(calc(100vh + 160px))
+            }
+        }
+
+        @keyframes drop {
+            90% {
+                height: 20px
+            }
+
+            100% {
+                height: 160px;
+                -webkit-transform: translateY(calc(100vh + 160px));
+                transform: translateY(calc(100vh + 160px))
+            }
+        }
+
+        #error .error-bg > div:nth-child(1):after {
+            -webkit-animation: drop 3s infinite linear;
+            animation: drop 3s infinite linear;
+            -webkit-animation-delay: .2s;
+            animation-delay: .2s
+        }
+
+        #error .error-bg > div:nth-child(2):after {
+            -webkit-animation: drop 2s infinite linear;
+            animation: drop 2s infinite linear;
+            -webkit-animation-delay: .7s;
+            animation-delay: .7s
+        }
+
+        #error .error-bg > div:nth-child(3):after {
+            -webkit-animation: drop 3s infinite linear;
+            animation: drop 3s infinite linear;
+            -webkit-animation-delay: .9s;
+            animation-delay: .9s
+        }
+
+        #error .error-bg > div:nth-child(4):after {
+            -webkit-animation: drop 2s infinite linear;
+            animation: drop 2s infinite linear;
+            -webkit-animation-delay: 1.2s;
+            animation-delay: 1.2s
+        }
+
+        .error {
+            max-width: 520px;
+            width: 100%;
+            padding: 20px;
+            text-align: center
+        }
+
+        .error .error-code {
+            height: 210px;
+            line-height: 210px
+        }
+
+        .error .error-code h1 {
+            font-family: oswald, sans-serif;
+            font-size: 80px;
+            font-weight: 700;
+            margin: 0;
+            text-shadow: 4px 4px 0 #1cfafe
+        }
+
+        .error h2 {
+            font-family: oswald, sans-serif;
+            font-size: 42px;
+            font-weight: 700;
+            margin: 0;
+            text-transform: uppercase;
+            letter-spacing: 1.6px
+        }
+
+        .error p {
+            font-family: lato, sans-serif;
+            color: #000;
+            font-weight: 400;
+            margin-top: 20px;
+            margin-bottom: 25px
+        }
+
+        .error a {
+            font-family: lato, sans-serif;
+            padding: 10px 30px;
+            display: inline-block;
+            color: #000;
+            font-weight: 400;
+            text-transform: uppercase;
+            -webkit-box-shadow: 0 0 0 2px #000, 2px 2px 0 2px #1cfafe;
+            box-shadow: 0 0 0 2px #000, 2px 2px 0 2px #1cfafe;
+            text-decoration: none;
+            -webkit-transition: .2s all;
+            transition: .2s all
+        }
+
+        .error a:not(:first-of-type) {
+            margin-left: 20px
+        }
+
+        .error a:hover {
+            background-color: #1cfafe;
+            -webkit-box-shadow: 0 0 0 0 #000, 0 0 0 2px #1cfafe;
+            box-shadow: 0 0 0 0 #000, 0 0 0 2px #1cfafe
+        }
+
+        .error-social > a {
+            width: 40px;
+            height: 40px;
+            line-height: 40px;
+            padding: 0;
+            margin: 0 5px
+        }
+
+        .error-social > a:hover {
+            background-color: #1cfafe;
+            -webkit-box-shadow: 0 0 0 0 #000, 0 0 0 2px #1cfafe;
+            box-shadow: 0 0 0 0 #000, 0 0 0 2px #1cfafe
+        }
+
+        #captcha-form {
+            position: relative;
+            width: 300px;
+            height: 65px;
+            overflow: hidden;
+            margin: 0 auto 30px;
+            background-color: #fff;
+            -webkit-box-shadow: 0 0 0 2px #000, 2px 2px 0 2px #1cfafe;
+            box-shadow: 0 0 0 2px #000, 2px 2px 0 2px #1cfafe;
+        }
+
+        .loading {
+            position: absolute;
+            top: 0;
+            left: 0;
+            z-index: 1;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            width: 100%;
+            height: 65px;
+            gap: 10px;
+        }
+
+        .loading:has(+ *) {
+            display: none;
+        }
+
+        .loading::before {
+            content: "";
+            width: 20px;
+            height: 20px;
+            border: 2px solid #000;
+            border-right-color: #1cfafe;
+            border-radius: 50%;
+            animation: spin 1s linear infinite;
+        }
+
+        #captcha {
+            position: relative;
+            z-index: 2;
+        }
+
+        @keyframes spin {
+            from {
+                transform: rotate(0deg);
+            }
+            to {
+                transform: rotate(360deg);
+            }
+        }
+
+        @media only screen and (max-width: 480px) {
+            .error .error-code {
+                height: 122px;
+                line-height: 122px
+            }
+
+            .error .error-code h1 {
+                font-size: 60px
+            }
+
+            .error h2 {
+                font-size: 26px
+            }
+        }
+    </style>
+</head>
+<body>
+<div id="error">
+    <div class="error-bg">
+        <div></div>
+        <div></div>
+        <div></div>
+        <div></div>
+    </div>
+    <div class="error">
+        <div class="error-code">
+            <h1>FillCode</h1>
+        </div>
+        <h2>请完成验证</h2>
+        <p>请完成下面验证, 页面将会自动跳转到访问页面。</p>
+        <form id="captcha-form" method="POST">
+            <div id="captcha" class="{{captcha_frontend_key}}" data-sitekey="{{captcha_site_key}}"
+                 data-callback="captchaCallback" data-size="flexible"></div>
+            <div class="loading">验证码加载中, 请稍等...</div>
+        </form>
+        <a href="mailto:[email protected]">联系我们</a>
+    </div>
+</div>
+<script>
+    function captchaCallback() {
+        setTimeout(() => document.querySelector('#captcha-form').submit(), 500)
+    }
+</script>
+</body>
+</html>

apps/infra/net/nginx/static/pwa-cdn.js

@@ -0,0 +1,59 @@
+'use strict'
+
+// 配置
+const pwaCdnConfig = {
+    cdnUrl: 'https://cdn.fillcode.com/',
+    serviceWorkerUrl: '/__static/sw-cdn.js',
+    staticRegex: /\.(js|css|png|jpg|jpeg|gif|svg|webp|woff|woff2|ttf|ico)$/,
+    debug: false,
+}
+
+/**
+ * PWA 初始化函数
+ */
+async function initializePWA() {
+    // 检查支持
+    if (!('serviceWorker' in navigator)) return console.log('PWA-CDN: Service Worker not supported')
+
+    let registration;
+
+    try {
+        // 注册Service Worker - 使用相对路径
+        registration = await navigator.serviceWorker.register(pwaCdnConfig.serviceWorkerUrl, {scope: '/'})
+
+        console.log('PWA-CDN: Service Worker registered')
+    } catch (error) {
+        console.error('PWA-CDN: Failed to register Service Worker:', error)
+    }
+
+    // 发送初始配置
+    const sendConfig = () => {
+        registration.active.postMessage({type: 'CONFIG', config: pwaCdnConfig})
+    }
+
+    // 如果注册失败，直接返回错误
+    if(!registration) return console.error('PWA-CDN: Service Worker registration failed, cannot send config')
+
+    // 更新配置函数
+    window.updatePWACDNConfig = (newConfig) => {
+        Object.assign(pwaCdnConfig, newConfig)
+        sendConfig()
+    }
+
+    // 等待Service Worker激活后发送配置
+    if (registration.active)  sendConfig()
+
+    // 监听Service Worker更新事件
+    registration.addEventListener('updatefound', () => {
+        const newWorker = registration.installing
+
+        newWorker.addEventListener('statechange', () => {
+            if (newWorker.state === 'activated') sendConfig()
+        })
+    })
+}
+
+/**
+ * 启动 PWA-CDN
+ * */
+initializePWA().catch(console.error)

apps/infra/net/nginx/static/sw-cdn.js

@@ -0,0 +1,88 @@
+'use strict'
+
+// Service Worker 配置 - 默认值
+let config = {
+    cdnUrl: 'https://cdn.fillcode.com/',
+    serviceWorkerUrl: '/__static/sw-cdn.js',
+    staticRegex: /(.*\.(css|js|png|jpg|jpeg|gif|svg|webp|ico|woff|woff2|ttf|eot)|avatars[^/]+)$/,
+    debug: false,
+}
+
+// 监听配置更新消息
+self.addEventListener('message', e => {
+    if (e.data.type !== 'CONFIG') return
+
+    config = e.data.config
+
+    if (config.debug) console.log('PWA-CDN: Config updated', config)
+})
+
+// 拦截网络请求
+self.addEventListener('fetch', e => {
+    const url = new URL(e.request.url)
+
+    // 如果请求不是GET方法，直接返回
+    if (e.request.method !== 'GET') return
+
+    // 如果请求的域名不是当前页面的域名
+    if (url.origin !== self.location.origin) return
+
+    // 过滤__static路径下的请求
+    if (url.pathname.startsWith('/__static/')) return
+
+    // 如果请求的路径不匹配静态资源正则表达式，直接返回
+    if (!config.staticRegex.test(url.pathname)) return
+
+    // 判断是否是强制需要同源请求
+    const requiresSameOrigin = ['worker', 'sharedworker', 'serviceworker'].includes(e.request.destination)
+
+    // 如果是强制需要同源请求的资源类型，直接返回
+    if (requiresSameOrigin) return
+
+    // 开始处理静态资源请求
+    e.respondWith(handleStaticResource(e.request, url))
+})
+
+// 处理静态资源请求
+async function handleStaticResource(request, url) {
+    // 生成CDN子路径
+    const hostname = self.location.hostname
+    const cdnPath = hostname.replace(/\./g, '-')
+
+    const targetUrl = config.cdnUrl + cdnPath + url.pathname + url.search
+
+    if (config.debug) console.log('PWA-CDN:', url.href, '->', targetUrl)
+
+    try {
+        // 创建新请求
+        const newRequest = new Request(targetUrl, {
+            ...request,
+            mode: 'cors',
+            redirect: 'error',
+        })
+
+        // 请求目标域名，浏览器会自动处理缓存
+        const response = await fetch(newRequest)
+
+        // 检查响应状态
+        if (!response.ok) throw new Error('PWA-CDN: Non-2xx response detected')
+
+        return response
+    } catch (error) {
+        if (config.debug) console.warn('PWA-CDN: Fallback to original request for', url.href, error)
+
+        // 失败时回退到原始请求
+        return fetch(request)
+    }
+}
+
+// Service Worker 生命周期
+self.addEventListener('install', () => {
+    if (config.debug) console.log('PWA-CDN: Service Worker installing')
+    self.skipWaiting().catch(console.error)
+})
+
+self.addEventListener('activate', () => {
+    if (config.debug) console.log('PWA-CDN: Service Worker activated')
+    self.clients.claim().catch(console.error)
+})

apps/infra/net/tailscale/helmchart.yaml

@@ -1,23 +1,18 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
 metadata:
   name: tailscale-derp-hk
   namespace: infra-net
 spec:
-  interval: 30m
-  timeout: 15m
-  chart:
-    spec:
-      chart: tailscale-derp
-      version: 0.0.10
-      sourceRef:
-        kind: HelmRepository
-        name: devcm-repo
-        namespace: infra-gitops
-      interval: 12h
-  values:
+  repo: https://devcm-repo.github.io/helm-charts
+  chart: tailscale-derp
+  version: 0.0.9
+  targetNamespace: infra-net
+  valuesContent: |-
+    nodeSelector:
+      kubernetes.io/hostname: tchk
     image:
-      tag: v1.94.1
+      tag: v1.90.8
     hostNetwork: true
     extraVolumes:
       - name: cert-volume
@@ -32,7 +27,7 @@ spec:
       - name: cert-volume
         mountPath: /certs
     derp:
-      hostname: "tchk.node.dev.cm"
+      hostname: 'tchk.node.dev.cm'
       verify_clients: true
       http_port: -1
       https_port: 30443

apps/kube/README.md

@@ -0,0 +1,4 @@
+### path core中服务的节点亲和性 使他们只运行在master节点上
+```shell
+kubectl patch -n kube-system deployment coredns --patch-file=apps/kube/patch-affinity.yaml
+```

apps/kube/coredns/nodelocaldns.yaml

@@ -120,6 +120,16 @@ spec:
         prometheus.io/port: "9253"
         prometheus.io/scrape: "true"
     spec:
+      # master节点不启用
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: NotIn
+                    values:
+                      - "true"
       priorityClassName: system-node-critical
       serviceAccountName: node-local-dns
       hostNetwork: true

apps/kube/patch-affinity.yaml

@@ -0,0 +1,12 @@
+spec:
+  template:
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: In
+                    values:
+                      - "true"

flux/README.md

@@ -1,142 +0,0 @@
-# Flux GitOps
-
-## 目录结构
-
-```
-flux/
-├── clusters/
-│   ├── base/                            # 基础集群编排，仅部署 infrastructure
-│   │   ├── kustomization.yaml           # infrastructure 资源列表
-│   │   ├── sources.yaml                 # infrastructure HelmRepository 源
-│   │   ├── kube-system.yaml             # CoreDNS / NodeLocalDNS
-│   │   ├── infra-devops.yaml            # cert-manager / reflector / velero
-│   │   ├── infra-data.yaml              # CNPG / Valkey
-│   │   ├── infra-monitor.yaml           # Loki / Prometheus (+ post: Promtail)
-│   │   ├── infra-net.yaml               # Nginx / CrowdSec / Tailscale
-│   │   └── infra-gitops.yaml            # Gitea (+ post: Gitea Actions / Flux Web)
-│   └── dev-cm/                          # dev-cm 集群 overlay，额外部署 apps
-│       ├── kustomization.yaml           # 引入 base，并追加 apps / app 依赖层
-│       ├── apps-sources.yaml            # app HelmRepository 源
-│       ├── apps-secrets.yaml            # apps namespace 与 app 专属 Secret
-│       ├── apps.yaml                    # Halo / RustDesk / Fillcode / SinceAI
-│       └── apps-post.yaml               # CDN Ingress（依赖 apps）
-├── infrastructure/
-│   ├── sources/                         # 所有 HelmRepository 定义
-│   ├── kube-system/                     # CoreDNS 自定义 + NodeLocalDNS
-│   ├── infra-devops/                    # cert-manager, webhook-dnspod, reflector, velero
-│   │   └── post/                        # ClusterIssuer + cert-manager ServiceMonitor values
-│   ├── infra-data/                      # CNPG operator, Barman, Valkey
-│   │   ├── post-1/                      # PG Cluster / ObjectStore / databases / LB
-│   │   └── post-2/                      # Reflector secret annotations
-│   ├── infra-net/                       # ingress-nginx, CrowdSec, Tailscale DERP, 证书
-│   ├── infra-monitor/                   # Loki, Prometheus+Grafana
-│   │   └── post/                        # Promtail（依赖 infra-net，打破循环）
-│   └── infra-gitops/                    # Gitea
-│       └── post/                        # Gitea Actions + flux-operator Web（OIDC/Ingress）
-└── apps/
-    ├── sources/                         # app HelmRepository 定义
-    ├── secrets/                         # apps namespace 与 app 专属 Secret
-    ├── post/                            # CDN Ingress（依赖 apps，且引用部分 infra 服务）
-    ├── helmrelease-halo.yaml            # Halo
-    ├── helmrelease-rustdesk.yaml        # RustDesk
-    └── ...                              # app 证书与 Ingress
-```
-
-## 前置准备
-
-需要提前生成git访问凭证
-
-```shell
-ssh-keygen -t ed25519 -C "flux" -f ./flux-git-auth -N ""
-
-ssh-keyscan github.com > ./known_hosts
-
-kubectl -n infra-gitops create secret generic flux-git-auth \
- --from-file=identity=./flux-git-auth \
- --from-file=identity.pub=./flux-git-auth.pub \
- --from-file=known_hosts=./known_hosts
-```
-
-然后将 `flux-git-auth.pub` 文件内容添加到远端仓库中
-
-应用flux实例 后续将自动开启部署流程
-
-```shell
-kubectl apply -f flux/flux-instance.yaml
-```
-
-## 部署顺序
-
-```
-sources → secrets → kube-system → infra-devops → infra-data → infra-data-post-1 → infra-data-post-2
-       → infra-monitor → infra-net → infra-devops-post
-       → infra-monitor-post (Promtail)
-       → infra-gitops
-       → apps-sources → apps-secrets → apps
-       → apps-post (CDN Ingress)
-       → infra-gitops-post (suspend=true，需手工凭据)
-```
-
-`clusters/base` 只包含到 `infra-gitops-post` 为止的 infrastructure 部署；`apps-sources`、`apps-secrets`、`apps`、`apps-post` 只在 `clusters/dev-cm` 中声明。Kustomization 间通过 `dependsOn` + `wait: true` 串行等待，避免顺序错乱。
-
-## 部署后手工步骤（infra-gitops-post）
-
-`infra-gitops-post` 在 base 层硬编码 `spec.suspend: true` 默认暂停，因为它依赖两类只能在 Gitea 启动后获取的凭据：
-
-1. **Flux Operator Web 的 OIDC 客户端**
-2. **Gitea Actions Runner Token**
-
-凭据就绪、`flux-env` Secret 重新注入后，可以先用 `flux resume kustomization infra-gitops-post -n infra-gitops` 手工放行。
-
-注意：**手工 `resume` 只会修改集群里的 live 对象，不会改 Git 中的期望状态。** 由于 base 层仍然声明了 `spec.suspend: true`，当上层 `Kustomization` 重新协调（如 30 分钟周期、Git 变更、手工 reconcile）时，它会再次把 `infra-gitops-post` 改回暂停。
-
-如果希望恢复后保持开启，需要把 Git 中的期望状态也改掉，例如在环境 overlay（如 `clusters/dev-cm/infra-gitops-post.yaml`）中覆盖：
-
-```yaml
-spec:
-  suspend: false
-```
-
-步骤：
-
-1. 浏览器访问 `https://git.dev.cm`，首个注册账号自动成为 admin。
-2. **创建 OAuth2 应用**：
-   - Site Administration → Integrations → Applications → Create OAuth2 Application
-   - Redirect URI: `https://cd.dev.cm/oauth2/callback`
-   - 记录 Client ID 与 Client Secret。
-3. **生成 Runner Token**：
-   - Site Administration → Actions → Runners → Create new Runner → 复制 registration token。
-4. 更新 `.env`：
-
-   ```
-   FLUX_WEB_OIDC_CLIENT_ID=<step 2 client id>
-   FLUX_WEB_OIDC_CLIENT_SECRET=<step 2 client secret>
-   GITEA_ACTIONS_TOKEN=<step 3 token>
-   ```
-
-5. 重新注入 `flux-env` Secret 并协调：
-
-   ```bash
-   kubectl -n infra-gitops create secret generic flux-env \
-     --from-env-file=.env \
-     --dry-run=client -o yaml | kubectl apply -f -
-
-   flux reconcile kustomization secrets -n infra-gitops
-   flux resume kustomization infra-gitops-post -n infra-gitops
-   flux reconcile kustomization infra-gitops-post -n infra-gitops --with-source
-   ```
-
-6. 验证：
-
-   ```bash
-   kubectl -n infra-gitops get helmrelease gitea-actions
-   kubectl -n infra-gitops get deploy flux-operator -o yaml | grep -A2 args   # 看到 --web-*
-   curl -I https://cd.dev.cm                                                    # 走 Gitea OIDC
-   ```
-
-## 为何拆出 \*-post 层？
-
-- **`infra-devops-post`**：cert-manager 首次安装时不能依赖 `ServiceMonitor` CRD；post 层只在监控栈就绪后下发 `ClusterIssuer` 与可选 values ConfigMap，避免多个 Kustomization 共同管理同一个 HelmRelease。
-- **`infra-monitor-post` (Promtail)**：Promtail 依赖至少一个带 `devcm-log-collecting/enabled` 标签的 Pod（ingress-nginx）；而 `infra-net` 又依赖 `infra-monitor` 的 CRD。Promtail 放到 post 层并 `dependsOn: infra-net`，打破循环。
-- **`apps-post` (CDN Ingress)**：CDN Ingress 会引用 `apps`、`infra-gitops`、`infra-monitor` 中的服务，因此不属于 base；只在 `dev-cm` 中声明，并依赖对应服务层。
-- **`infra-gitops-post` (Gitea Actions + Flux Web)**：凭据必须在 Gitea 启动后手工创建；放在 post 层并默认 suspend，避免阻塞 bootstrap。

flux/apps/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - certificate-fillcode-com.yaml
-  - certificate-sinceai-com.yaml
-  - helmrelease-halo.yaml
-  - ingress-fillcode.yaml
-  - ingress-halo-www.yaml
-  - ingress-halo-static.yaml
-  - ingress-sinceai-shop.yaml
-  - helmrelease-whoami.yaml
-  - helmrelease-rustdesk.yaml

flux/apps/post/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ingress-cdn.yaml

flux/apps/secrets/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespaces.yaml

flux/apps/sources/helm-repositories.yaml

@@ -1,21 +0,0 @@
-# whoami
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cowboysysop
-  namespace: infra-gitops
-spec:
-  interval: 168h
-  timeout: 5m
-  url: https://cowboysysop.github.io/charts/
----
-# halo
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: halo
-  namespace: infra-gitops
-spec:
-  interval: 168h
-  timeout: 5m
-  url: https://halo-sigs.github.io/charts/

flux/apps/sources/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - helm-repositories.yaml

flux/clusters/base/infra-data.yaml

@@ -1,58 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-data
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-data
-  prune: true
-  force: true
-  wait: true
-  dependsOn:
-    - name: infra-devops
-
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-data-post-1
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-data/post-1
-  prune: true
-  force: true
-  wait: true
-  dependsOn:
-    - name: infra-data
-
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-data-post-2
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-data/post-2
-  prune: true
-  force: true
-  wait: true
-  dependsOn:
-    - name: infra-data-post-1

flux/clusters/base/infra-devops.yaml

@@ -1,38 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-devops
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-devops
-  prune: true
-  wait: true
-  dependsOn:
-    - name: sources
-    - name: secrets
-
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-devops-post
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-devops/post
-  prune: true
-  force: true
-  wait: true
-  dependsOn:
-    - name: infra-monitor

flux/clusters/base/infra-gitops.yaml

@@ -1,45 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-gitops
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-gitops
-  prune: true
-  wait: true
-  dependsOn:
-    - name: infra-data-post-2
-    - name: infra-monitor
-
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-gitops-post
-  namespace: infra-gitops
-spec:
-  # 默认暂停：post 层依赖 Gitea 启动后才能获取的 OIDC / Runner Token 凭据。
-  # 凭据就绪并写入 flux-env Secret 后，使用 `flux resume kustomization infra-gitops-post -n infra-gitops` 放行。
-  suspend: true
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-gitops/post
-  prune: true
-  wait: true
-  dependsOn:
-    - name: infra-gitops
-    - name: infra-net
-  postBuild:
-    substituteFrom:
-      - kind: Secret
-        name: flux-env

flux/clusters/base/infra-monitor.yaml

@@ -1,39 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-monitor
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-monitor
-  prune: true
-  force: true
-  wait: true
-  dependsOn:
-    - name: infra-data-post-2
-
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-monitor-post
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-monitor/post
-  prune: true
-  force: true
-  wait: true
-  dependsOn:
-    - name: infra-monitor
-    - name: infra-net

flux/clusters/base/infra-net.yaml

@@ -1,20 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-net
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/infra-net
-  prune: true
-  wait: true
-  dependsOn:
-    - name: kube-system
-    - name: infra-devops
-    - name: infra-devops-post
-    - name: infra-monitor

flux/clusters/base/kube-system.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: kube-system
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/kube-system
-  prune: false
-  wait: true

flux/clusters/base/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sources.yaml
-  - secrets.yaml
-  - kube-system.yaml
-  - infra-devops.yaml
-  - infra-data.yaml
-  - infra-net.yaml
-  - infra-monitor.yaml
-  - infra-gitops.yaml

flux/clusters/base/secrets.yaml

@@ -1,23 +0,0 @@
-# 密钥管理层 - 通过postBuild从flux-env Secret注入变量
-# 所有环境流程一致: kubectl create secret generic flux-env -n infra-gitops --from-env-file=.env
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: secrets
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/secrets
-  prune: false
-  wait: true
-  dependsOn:
-    - name: sources
-  postBuild:
-    substituteFrom:
-      - kind: Secret
-        name: flux-env

flux/clusters/base/sources.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: sources
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/infrastructure/sources
-  prune: true
-  wait: true

flux/clusters/dev-cm/apps-post.yaml

@@ -1,20 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: apps-post
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/apps/post
-  prune: true
-  wait: true
-  dependsOn:
-    - name: infra-net
-    - name: infra-gitops
-    - name: infra-monitor
-    - name: apps

flux/clusters/dev-cm/apps-secrets.yaml

@@ -1,21 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: apps-secrets
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/apps/secrets
-  prune: false
-  wait: true
-  dependsOn:
-    - name: apps-sources
-  postBuild:
-    substituteFrom:
-      - kind: Secret
-        name: flux-env

flux/clusters/dev-cm/apps-sources.yaml

@@ -1,17 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: apps-sources
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/apps/sources
-  prune: true
-  wait: true
-  dependsOn:
-    - name: sources

flux/clusters/dev-cm/apps.yaml

@@ -1,56 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: apps
-  namespace: infra-gitops
-spec:
-  interval: 30m
-  timeout: 15m
-  retryInterval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: flux
-  path: ./flux/apps
-  prune: true
-  dependsOn:
-    - name: apps-sources
-    - name: apps-secrets
-    - name: infra-data-post-2
-    - name: infra-net
-  patches:
-    - target:
-        kind: HelmRelease
-        name: halo
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: halo
-        spec:
-          values:
-            externalDatabase:
-              host: cnpg17-cluster-hk-rw.infra-data
-              existingSecret: cnpg17-cluster-hk-app
-            affinity:
-              podAffinity:
-                preferredDuringSchedulingIgnoredDuringExecution:
-                  - weight: 100
-                    podAffinityTerm:
-                      labelSelector:
-                        matchLabels:
-                          cnpg.io/cluster: cnpg17-cluster-hk
-                          role: primary
-                      topologyKey: kubernetes.io/hostname
-                      namespaceSelector: {}
-    - target:
-        kind: HelmRelease
-        name: rustdesk
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: rustdesk
-        spec:
-          values:
-            nodeSelector:
-              kubernetes.io/hostname: tcd

flux/clusters/dev-cm/infra-data/patch.yaml

@@ -1,69 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-data
-spec:
-  patches:
-    - target:
-        kind: HelmRelease
-        name: cloudnative-pg
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: cloudnative-pg
-        spec:
-          values:
-            affinity:
-              nodeAffinity:
-                requiredDuringSchedulingIgnoredDuringExecution:
-                  nodeSelectorTerms:
-                    - matchExpressions:
-                        - key: topology.kubernetes.io/region
-                          operator: In
-                          values:
-                            - "cn-sh"
-            tolerations:
-              - key: "node-role.kubernetes.io/control-plane"
-                operator: "Exists"
-                effect: "NoSchedule"
-    - target:
-        kind: HelmRelease
-        name: cloudnative-pg-plugin-barman
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: cloudnative-pg-plugin-barman
-        spec:
-          values:
-            affinity:
-              nodeAffinity:
-                requiredDuringSchedulingIgnoredDuringExecution:
-                  nodeSelectorTerms:
-                    - matchExpressions:
-                        - key: topology.kubernetes.io/region
-                          operator: In
-                          values:
-                            - "cn-sh"
-            tolerations:
-              - key: "node-role.kubernetes.io/control-plane"
-                operator: "Exists"
-                effect: "NoSchedule"
-    - target:
-        kind: HelmRelease
-        name: valkey-cluster
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: valkey-cluster
-        spec:
-          values:
-            fullnameOverride: valkey-cluster-sh
-            valkey:
-              nodeAffinityPreset:
-                type: hard
-                key: topology.kubernetes.io/region
-                values:
-                  - cn-sh

flux/clusters/dev-cm/infra-data/post-1/cnpg17-cluster-hk.yaml

@@ -1,42 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: cnpg17-cluster-hk
-  namespace: infra-data
-spec:
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
-  enableSuperuserAccess: true
-  enablePDB: false
-  instances: 1
-  storage:
-    size: 10Gi
-  postgresql:
-    parameters:
-      archive_timeout: 30min
-  env:
-    - name: AWS_REQUEST_CHECKSUM_CALCULATION
-      value: when_required
-    - name: AWS_RESPONSE_CHECKSUM_VALIDATION
-      value: when_required
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: cnpg17-objectstore-hw
-        serverName: cnpg17-cluster-hk
-
----
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg17-cluster-hk-backups
-  namespace: infra-data
-spec:
-  schedule: "0 0 0 * * *"
-  immediate: true
-  backupOwnerReference: self
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io
-  cluster:
-    name: cnpg17-cluster-hk

flux/clusters/dev-cm/infra-data/post-1/cnpg17-cluster-sh.yaml

@@ -1,42 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: cnpg17-cluster-sh
-  namespace: infra-data
-spec:
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
-  enableSuperuserAccess: true
-  enablePDB: false
-  instances: 1
-  storage:
-    size: 10Gi
-  postgresql:
-    parameters:
-      archive_timeout: 30min
-  env:
-    - name: AWS_REQUEST_CHECKSUM_CALCULATION
-      value: when_required
-    - name: AWS_RESPONSE_CHECKSUM_VALIDATION
-      value: when_required
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: cnpg17-objectstore-hw
-        serverName: cnpg17-cluster-sh
-
----
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: cnpg17-cluster-sh-backups
-  namespace: infra-data
-spec:
-  schedule: "0 0 0 * * *"
-  immediate: true
-  backupOwnerReference: self
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io
-  cluster:
-    name: cnpg17-cluster-sh

flux/clusters/dev-cm/infra-data/post-1/cnpg17-objectstore-hw.yaml

@@ -1,20 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: cnpg17-objectstore-hw
-  namespace: infra-data
-spec:
-  retentionPolicy: "7d"
-  configuration:
-    destinationPath: s3://devcm/cnpg/
-    endpointURL: https://obs.cn-east-3.myhuaweicloud.com
-    s3Credentials:
-      accessKeyId:
-        name: s3-devcm-hw
-        key: ACCESS_KEY_ID
-      secretAccessKey:
-        name: s3-devcm-hw
-        key: ACCESS_SECRET_KEY
-    wal:
-      compression: gzip
-      maxParallel: 8

flux/clusters/dev-cm/infra-data/post-1/databases.yaml

@@ -1,43 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: cnpg17-cluster-sh-gitea
-  namespace: infra-data
-spec:
-  name: gitea
-  owner: app
-  cluster:
-    name: cnpg17-cluster-sh
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: cnpg17-cluster-sh-grafana
-  namespace: infra-data
-spec:
-  name: grafana
-  owner: app
-  cluster:
-    name: cnpg17-cluster-sh
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: cnpg17-cluster-hk-halo
-  namespace: infra-data
-spec:
-  name: halo
-  owner: app
-  cluster:
-    name: cnpg17-cluster-hk
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: cnpg17-cluster-hk-crowdsec
-  namespace: infra-data
-spec:
-  name: crowdsec
-  owner: app
-  cluster:
-    name: cnpg17-cluster-hk

flux/clusters/dev-cm/infra-data/post-1/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - cnpg17-objectstore-hw.yaml
-  - cnpg17-cluster-hk.yaml
-  - cnpg17-cluster-sh.yaml
-  - databases.yaml
-  - loadbalancer-hk.yaml
-  - loadbalancer-sh.yaml

flux/clusters/dev-cm/infra-data/post-1/patch.yaml

@@ -1,59 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-data-post-1
-spec:
-  path: ./flux/clusters/dev-cm/infra-data/post-1
-  patches:
-    - target:
-        kind: Cluster
-        name: cnpg17-cluster-hk
-      patch: |
-        apiVersion: postgresql.cnpg.io/v1
-        kind: Cluster
-        metadata:
-          name: cnpg17-cluster-hk
-        spec:
-          affinity:
-            nodeAffinity:
-              requiredDuringSchedulingIgnoredDuringExecution:
-                nodeSelectorTerms:
-                  - matchExpressions:
-                      - key: topology.kubernetes.io/region
-                        operator: In
-                        values:
-                          - "cn-hk"
-              preferredDuringSchedulingIgnoredDuringExecution:
-                - weight: 1
-                  preference:
-                    matchExpressions:
-                      - key: kubernetes.io/hostname
-                        operator: In
-                        values:
-                          - alihka
-    - target:
-        kind: Cluster
-        name: cnpg17-cluster-sh
-      patch: |
-        apiVersion: postgresql.cnpg.io/v1
-        kind: Cluster
-        metadata:
-          name: cnpg17-cluster-sh
-        spec:
-          affinity:
-            nodeAffinity:
-              requiredDuringSchedulingIgnoredDuringExecution:
-                nodeSelectorTerms:
-                  - matchExpressions:
-                      - key: topology.kubernetes.io/region
-                        operator: In
-                        values:
-                          - "cn-sh"
-              preferredDuringSchedulingIgnoredDuringExecution:
-                - weight: 1
-                  preference:
-                    matchExpressions:
-                      - key: kubernetes.io/hostname
-                        operator: In
-                        values:
-                          - homea

flux/clusters/dev-cm/infra-data/post-2/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - reflector-secret-annotations.yaml

flux/clusters/dev-cm/infra-data/post-2/patch.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-data-post-2
-spec:
-  path: ./flux/clusters/dev-cm/infra-data/post-2

flux/clusters/dev-cm/infra-data/post-2/reflector-secret-annotations.yaml

@@ -1,38 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cnpg17-cluster-hk-app
-  namespace: infra-data
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
-    kustomize.toolkit.fluxcd.io/ssa: Merge
-    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "apps,infra-net"
-    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-    reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "apps,infra-net"
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cnpg17-cluster-sh-app
-  namespace: infra-data
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
-    kustomize.toolkit.fluxcd.io/ssa: Merge
-    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "apps,infra-gitops,infra-monitor"
-    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-    reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "apps,infra-gitops,infra-monitor"
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: valkey-cluster-sh
-  namespace: infra-data
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
-    kustomize.toolkit.fluxcd.io/ssa: Merge
-    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "apps,infra-gitops"
-    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-    reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "apps,infra-gitops"

flux/clusters/dev-cm/infra-devops.yaml

@@ -1,124 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-devops
-spec:
-  patches:
-    - target:
-        kind: HelmRelease
-        name: cert-manager
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: cert-manager
-        spec:
-          values:
-            affinity:
-              nodeAffinity:
-                requiredDuringSchedulingIgnoredDuringExecution:
-                  nodeSelectorTerms:
-                    - matchExpressions:
-                        - key: topology.kubernetes.io/region
-                          operator: In
-                          values:
-                            - "cn-sh"
-            webhook:
-              affinity:
-                nodeAffinity:
-                  requiredDuringSchedulingIgnoredDuringExecution:
-                    nodeSelectorTerms:
-                      - matchExpressions:
-                          - key: topology.kubernetes.io/region
-                            operator: In
-                            values:
-                              - "cn-sh"
-            cainjector:
-              affinity:
-                nodeAffinity:
-                  requiredDuringSchedulingIgnoredDuringExecution:
-                    nodeSelectorTerms:
-                      - matchExpressions:
-                          - key: topology.kubernetes.io/region
-                            operator: In
-                            values:
-                              - "cn-sh"
-    - target:
-        kind: HelmRelease
-        name: cert-manager-webhook-dnspod
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: cert-manager-webhook-dnspod
-        spec:
-          values:
-            affinity:
-              nodeAffinity:
-                requiredDuringSchedulingIgnoredDuringExecution:
-                  nodeSelectorTerms:
-                    - matchExpressions:
-                        - key: topology.kubernetes.io/region
-                          operator: In
-                          values:
-                            - "cn-sh"
-    - target:
-        kind: HelmRelease
-        name: reflector
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: reflector
-        spec:
-          values:
-            affinity:
-              nodeAffinity:
-                requiredDuringSchedulingIgnoredDuringExecution:
-                  nodeSelectorTerms:
-                    - matchExpressions:
-                        - key: topology.kubernetes.io/region
-                          operator: In
-                          values:
-                            - "cn-sh"
-    - target:
-        kind: HelmRelease
-        name: velero
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: velero
-        spec:
-          values:
-            affinity:
-              nodeAffinity:
-                requiredDuringSchedulingIgnoredDuringExecution:
-                  nodeSelectorTerms:
-                    - matchExpressions:
-                        - key: topology.kubernetes.io/region
-                          operator: In
-                          values:
-                            - "cn-sh"
-                preferredDuringSchedulingIgnoredDuringExecution:
-                  - weight: 1
-                    preference:
-                      matchExpressions:
-                        - key: kubernetes.io/hostname
-                          operator: In
-                          values:
-                            - homeb
-            nodeAgent:
-              affinity:
-                nodeAffinity:
-                  requiredDuringSchedulingIgnoredDuringExecution:
-                    nodeSelectorTerms:
-                      - matchExpressions:
-                          - key: node-role.kubernetes.io/control-plane
-                            operator: NotIn
-                            values:
-                              - "true"
-                          - key: svccontroller.k3s.cattle.io/enablelb
-                            operator: NotIn
-                            values:
-                              - "true"

flux/clusters/dev-cm/infra-gitops-post.yaml

@@ -1,20 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-gitops-post
-spec:
-  suspend: false
-  patches:
-    - target:
-        kind: HelmRelease
-        name: gitea-actions
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: gitea-actions
-        spec:
-          values:
-            statefulset:
-              nodeSelector:
-                dev-cm-runner/enabled: "true"

flux/clusters/dev-cm/infra-gitops.yaml

@@ -1,59 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-gitops
-spec:
-  patches:
-    - target:
-        kind: HelmRelease
-        name: gitea
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: gitea
-        spec:
-          values:
-            gitea:
-              config:
-                database:
-                  HOST: cnpg17-cluster-sh-rw.infra-data:5432
-              additionalConfigFromEnvs:
-                - name: GITEA__DATABASE__PASSWD
-                  valueFrom:
-                    secretKeyRef:
-                      name: cnpg17-cluster-sh-app
-                      key: password
-                - name: REDIS_PASSWORD
-                  valueFrom:
-                    secretKeyRef:
-                      name: valkey-cluster-sh
-                      key: valkey-password
-                - name: GITEA__SESSION__PROVIDER_CONFIG
-                  value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
-                - name: GITEA__CACHE__HOST
-                  value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
-                - name: GITEA__QUEUE__CONN_STR
-                  value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
-            affinity:
-              podAffinity:
-                preferredDuringSchedulingIgnoredDuringExecution:
-                  - weight: 100
-                    podAffinityTerm:
-                      labelSelector:
-                        matchLabels:
-                          cnpg.io/cluster: cnpg17-cluster-sh
-                          role: primary
-                          app.kubernetes.io/name: redis
-                          app.kubernetes.io/component: master
-                      topologyKey: kubernetes.io/hostname
-                      namespaceSelector: {}
-              nodeAffinity:
-                preferredDuringSchedulingIgnoredDuringExecution:
-                  - weight: 1
-                    preference:
-                      matchExpressions:
-                        - key: kubernetes.io/hostname
-                          operator: In
-                          values:
-                            - homea

flux/clusters/dev-cm/infra-monitor-post.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-monitor-post
-spec:
-  patches:
-    - target:
-        kind: HelmRelease
-        name: loki-promtail
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: loki-promtail
-        spec:
-          values:
-            nodeSelector:
-              svccontroller.k3s.cattle.io/enablelb: "true"

flux/clusters/dev-cm/infra-monitor.yaml

@@ -1,94 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: infra-monitor
-spec:
-  patches:
-    - target:
-        kind: HelmRelease
-        name: loki
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: loki
-        spec:
-          values:
-            lokiCanary:
-              nodeSelector:
-                svccontroller.k3s.cattle.io/enablelb: "true"
-            resultsCache:
-              nodeSelector:
-                kubernetes.io/hostname: tce
-            chunksCache:
-              nodeSelector:
-                kubernetes.io/hostname: tce
-            singleBinary:
-              nodeSelector:
-                kubernetes.io/hostname: tce
-    - target:
-        kind: HelmRelease
-        name: loki-promtail
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: loki-promtail
-        spec:
-          values:
-            nodeSelector:
-              svccontroller.k3s.cattle.io/enablelb: "true"
-    - target:
-        kind: HelmRelease
-        name: prometheus
-      patch: |
-        apiVersion: helm.toolkit.fluxcd.io/v2
-        kind: HelmRelease
-        metadata:
-          name: prometheus
-        spec:
-          values:
-            prometheusOperator:
-              nodeSelector:
-                kubernetes.io/hostname: hwa
-            kube-state-metrics:
-              nodeSelector:
-                kubernetes.io/hostname: hwa
-            grafana:
-              envValueFrom:
-                GF_DATABASE_PASSWORD:
-                  secretKeyRef:
-                    name: cnpg17-cluster-sh-app
-                    key: password
-              grafana.ini:
-                database:
-                  host: cnpg17-cluster-sh-rw.infra-data:5432
-              affinity:
-                podAffinity:
-                  preferredDuringSchedulingIgnoredDuringExecution:
-                    - weight: 100
-                      podAffinityTerm:
-                        labelSelector:
-                          matchLabels:
-                            cnpg.io/cluster: cnpg17-cluster-sh
-                            role: primary
-                        topologyKey: kubernetes.io/hostname
-                        namespaceSelector: {}
-              persistence:
-                storageClassName: local-path
-            prometheus:
-              prometheusSpec:
-                nodeSelector:
-                  kubernetes.io/hostname: hwa
-                storageSpec:
-                  volumeClaimTemplate:
-                    spec:
-                      storageClassName: local-path
-            alertmanager:
-              alertmanagerSpec:
-                nodeSelector:
-                  kubernetes.io/hostname: hwa
-                storage:
-                  volumeClaimTemplate:
-                    spec:
-                      storageClassName: local-path