fix: 隔离 Ayatori 数据库接入声明并修正 Instance 作用域

2026-09-27 17:56:33 +00:00
parent 7da5bc1181
commit 84a1e9e37f
16 changed files with 169 additions and 105 deletions
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: homelab-postgresql-prod-admin
+  namespace: ayatori-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: homelab-postgresql-prod-admin
+    kind: SecretStore
+  target:
+    name: homelab-postgresql-prod-admin
+    creationPolicy: Owner
+  data:
+  - secretKey: username
+    remoteRef:
+      key: infra/postgresql/ayatori/prod
+      property: username
+  - secretKey: password
+    remoteRef:
+      key: infra/postgresql/ayatori/prod
+      property: password
@@ -0,0 +1,2 @@
+# 仅交付本环境管理凭据；由控制面部署流程绑定专用 ESO 身份。
+path "kv/data/infra/postgresql/ayatori/prod" { capabilities = ["read"] }
@@ -0,0 +1,13 @@
+apiVersion: database.ayatori.ddupan.top/v1alpha1
+kind: PostgreSQLInstance
+metadata:
+  name: homelab-prod
+spec:
+  endpoint:
+    host: pg-prod.ad.ddupan.top
+    hostaddr: 192.168.10.2
+    port: 5432
+    database: postgres
+    sslMode: verify-full
+  adminCredentialRef:
+    name: homelab-postgresql-prod-admin
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../common
+  - instance.yaml
+  - admin-credentials.yaml