feat(flux): 分阶段接管 cert-manager

2026-09-10 09:15:26 +00:00
parent 039ed46c8e
commit 2a1d1e095e
7 changed files with 94 additions and 3 deletions
@@ -51,6 +51,19 @@ the only challenge that can issue a wildcard.

 ## Deploy

+### Flux 接管状态
+
+现有 release 为 chart/app `v1.21.0`。Git 中固定同一版本，并用
+`suspend: true` 的 HelmRelease 分阶段接管：第一阶段只让 Flux 登记 source、values
+与 release 对象，不执行 Helm upgrade。确认 chart artifact、渲染结果和 live workload
+均未变化后，再通过独立 PR 解除暂停。
+
+Issuer 与 Certificate 清单随本目录的 Kustomization 由 Flux 管理；现有 Cloudflare
+token Secret 只被引用，本次接管不改变其所有权。删除保护期间保持 `prune: false`，且
+CRD 同时启用 chart 的 `crds.keep` 与 Flux Helm action 的 `CreateReplace`。
+
+以下命令保留为 break-glass 手工恢复流程；正常变更应提交 Git：
+
 ```bash
 helm repo add jetstack https://charts.jetstack.io && helm repo update jetstack
 helm upgrade --install cert-manager jetstack/cert-manager --version v1.21.0 \
@@ -0,0 +1,35 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  # 第一阶段只登记现有 release；合并后确认 source 和渲染结果，再单独解除暂停。
+  suspend: true
+  chart:
+    spec:
+      chart: cert-manager
+      interval: 1h
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+      version: v1.21.0
+  driftDetection:
+    mode: enabled
+  install:
+    crds: CreateReplace
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  interval: 30m
+  releaseName: cert-manager
+  targetNamespace: cert-manager
+  timeout: 10m
+  upgrade:
+    crds: CreateReplace
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  valuesFrom:
+    - kind: ConfigMap
+      name: cert-manager-values
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: jetstack
+  namespace: cert-manager
+spec:
+  interval: 1h
+  url: https://charts.jetstack.io
@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    reconcile.fluxcd.io/watch: Enabled
+configMapGenerator:
+  - name: cert-manager-values
+    namespace: cert-manager
+    files:
+      - values.yaml=values.yaml
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - clusterissuer-letsencrypt.yaml
+  - clusterissuer-bao-acme.yaml
+  - certificate-wildcard-ad.yaml
+  - certificate-auth-ddupan.yaml
+  - certificate-git-ddupan.yaml