feat(gitops): 添加 http-echo canary

CHANGELOG.md

@@ -33,6 +33,7 @@ What changed in this homelab, when, and why. Newest first.
 | k3s | 在本机逐级从 `v1.33.6+k3s1` 升级到 `v1.33.13+k3s2`、`v1.34.11+k3s1`、`v1.35.8+k3s1`，最终到 `v1.36.4+k3s1`；每一级均建立 SQLite/server 冷备份并验证节点、工作负载、PVC、Gateway、DNS 与 Gitea。k3s 每次重启都会覆盖 CoreDNS 的手工 `serve_stale`，已按 `platform/k3s/Corefile.desired` 恢复 |
 | GitOps | Flux `v2.9.5` 的四个核心 controller 已上线；集群内只读 Gitea source 与 `prune: false` 的 root Kustomization 均在合并 revision `aaa54a1` 上 Ready，完成了首个 pull reconciliation 闭环 |
 | cleanup | 已把 `bao-acme` HTTP-01 solver 改到 Envoy Gateway 的明文 listener，并删除不再承载流量的 Contour namespace、provisioner、RBAC、GatewayClass 和全部 `projectcontour.io` CRD；Envoy Gateway、证书、DNS 与 Gitea 复查正常 |
+| GitOps canary | 加入由 Flux 部署到独立 `gitops-canary` namespace 的 `http-echo` Deployment 和 Service；历史 Contour HTTPRoute 明确排除在 Kustomization 之外，初始保持 `prune: false` |
 
 `Carried forward`: re-verify OpenBao/ESO recovery and remaining Secret inventory;
 configure an off-site Git mirror; plan the Gitea upgrade beyond 1.25.5;

apps/http-echo/README.md

@@ -1,22 +1,24 @@
-# HTTP Echo (Gateway API workload)
+# HTTP Echo（Flux GitOps canary）
 
-**Purpose**
-- Preserve a tiny HTTP echo `Deployment + Service` as a future GitOps canary.
-- The current `HTTPRoute` still references the retired `contour-gateway`; do not
-  apply this folder until it is migrated and reviewed against Envoy Gateway.
+这是 Flux 首个低风险工作负载，用于验证 PR 合并后的自动部署、健康检查和漂移修复。
+Flux 将它部署到独立的 `gitops-canary` namespace。
 
-**Resources**
-| File | Description |
+| 文件 | 说明 |
 | --- | --- |
-| `deployment.yaml` | Two replicas of `hashicorp/http-echo` returning `hello from contour gateway`. |
-| `service.yaml` | ClusterIP service on port 80 targeted by the route. |
-| `httproute.yaml` | Gateway API `HTTPRoute` that targets `contour-gateway` and the `http-echo` service. |
+| `deployment.yaml` | 两个 `hashicorp/http-echo` 副本。 |
+| `service.yaml` | 只在集群内可达的 ClusterIP Service。 |
+| `kustomization.yaml` | Flux 实际构建入口，只包含 Deployment 和 Service。 |
+| `httproute.yaml` | 保留的历史 Contour 示例，**不在 Kustomization 中，不会部署**。 |
 
-**How to verify**
+## 验证
 
-Migration and verification are intentionally deferred. Update `parentRefs` to the
-reviewed Envoy Gateway and choose a hostname covered by its listener before apply.
+合并 canary PR 后不手动 apply。等待 Flux 自动创建资源：
 
-**Notes**
-- This README records the old test intent; the retired Contour manifests are
-  available only in legacy Git history.
+```bash
+sudo k3s kubectl -n flux-system get kustomization http-echo
+sudo k3s kubectl -n gitops-canary get deployment,service,pod
+```
+
+初始 `prune: false`。验证自动部署后，可以手动把 Deployment replicas 改成 1，
+确认 Flux 恢复为 Git 中的 2。删除行为应使用单独的无业务 ConfigMap 和 PR 测试，
+验证完成前不得为此路径启用 prune。

apps/http-echo/deployment.yaml

@@ -19,6 +19,6 @@ spec:
         - name: http-echo
           image: hashicorp/http-echo:0.2.3
           args:
-            - '-text=hello from contour gateway'
+            - '-text=hello from flux gitops canary'
           ports:
             - containerPort: 5678

apps/http-echo/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - service.yaml

clusters/homelab/apps/http-echo.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: http-echo
+  namespace: flux-system
+spec:
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: http-echo
+      namespace: gitops-canary
+  interval: 10m
+  path: ./apps/http-echo
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  targetNamespace: gitops-canary
+  timeout: 3m
+  wait: true

clusters/homelab/kustomization.yaml

@@ -2,3 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - flux-system
+  - namespaces/gitops-canary.yaml
+  - apps/http-echo.yaml

clusters/homelab/namespaces/gitops-canary.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitops-canary