From c4b425b0795cc659d94e7a8ab72df90e24a1aa43 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Thu, 10 Sep 2026 08:39:22 +0000 Subject: [PATCH] =?UTF-8?q?feat(flux):=20=E5=88=86=E9=98=B6=E6=AE=B5?= =?UTF-8?q?=E6=8E=A5=E7=AE=A1=20External=20Secrets?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- clusters/homelab/README.md | 7 ++-- clusters/homelab/apps/external-secrets.yaml | 14 ++++++++ clusters/homelab/kustomization.yaml | 1 + docs/homelab-gitops-redesign.md | 9 +++--- platform/external-secrets/README.md | 20 ++++++++++++ platform/external-secrets/helmrelease.yaml | 32 +++++++++++++++++++ platform/external-secrets/helmrepository.yaml | 8 +++++ platform/external-secrets/kustomization.yaml | 14 ++++++++ 8 files changed, 97 insertions(+), 8 deletions(-) create mode 100644 clusters/homelab/apps/external-secrets.yaml create mode 100644 platform/external-secrets/README.md create mode 100644 platform/external-secrets/helmrelease.yaml create mode 100644 platform/external-secrets/helmrepository.yaml create mode 100644 platform/external-secrets/kustomization.yaml diff --git a/clusters/homelab/README.md b/clusters/homelab/README.md index e2e5407..4add4e3 100644 --- a/clusters/homelab/README.md +++ b/clusters/homelab/README.md @@ -43,6 +43,7 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations - `http-echo` 的专用测试 ConfigMap 已在 `prune: true` 生效后重新纳管，并由下一 revision 自动删除； - `http-echo` 保持 `prune: true`，root 保持 `prune: false`； -- `gitea-actions` 已由 Flux HelmRelease 接管且首次 reconcile 未触发 runner rollout； -- 下一个接管对象是现有 `gitea` Helm release，先固定 chart `12.5.3` 并分两阶段完成 - 零变化 adoption，再通过独立 PR 升级 Gitea。 +- `gitea-actions` 与 `gitea` 已由 Flux HelmRelease 接管，Gitea 已升级到 `1.27.3`； +- 当前接管对象是 External Secrets Operator：先固定现有 chart `2.8.0` 并以 + `suspend: true` 登记，确认零变化后再独立激活； +- root Kustomization 与所有 brownfield 子 Kustomization 继续保持 `prune: false`。 diff --git a/clusters/homelab/apps/external-secrets.yaml b/clusters/homelab/apps/external-secrets.yaml new file mode 100644 index 0000000..d25ecf1 --- /dev/null +++ b/clusters/homelab/apps/external-secrets.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: external-secrets + namespace: flux-system +spec: + interval: 10m + path: ./platform/external-secrets + prune: false + sourceRef: + kind: GitRepository + name: flux-system + timeout: 3m + wait: false diff --git a/clusters/homelab/kustomization.yaml b/clusters/homelab/kustomization.yaml index d6205d0..7ea1f06 100644 --- a/clusters/homelab/kustomization.yaml +++ b/clusters/homelab/kustomization.yaml @@ -3,6 +3,7 @@ kind: Kustomization resources: - flux-system - namespaces/gitops-canary.yaml + - apps/external-secrets.yaml - apps/gitea.yaml - apps/gitea-actions.yaml - apps/http-echo.yaml diff --git a/docs/homelab-gitops-redesign.md b/docs/homelab-gitops-redesign.md index be0d1b6..815b636 100644 --- a/docs/homelab-gitops-redesign.md +++ b/docs/homelab-gitops-redesign.md @@ -213,11 +213,10 @@ offline break-glass path. ESO-generated Secrets are projections, not backups. 4. **Complete:** the reviewed Gitea Runner and Stage 1 CI are live. Flux deploys `http-echo`; automatic deployment, replica drift repair and scoped deletion were verified. Root prune remains disabled for brownfield safety. -5. **Next:** adopt the existing `gitea-actions` Helm release with the same chart - `0.1.1` and repository values before attempting an upgrade. Its live - StatefulSet and Git both use regular DinD, while Helm's stored release values - still describe the failed rootless attempt. The first Flux reconciliation - must repair this stored-state drift without changing the live Pod spec. +5. **In progress:** Gitea Actions and Gitea are managed by Flux. Adopt External + Secrets Operator next with its existing chart `2.8.0` and repository values; + register the suspended release first, then activate it in a separate PR after + proving the fixed render matches Helm's stored manifest. 6. Move Tunnel origins to Envoy and consolidate split DNS through Blocky. 7. Deploy Backstage read-only with Catalog, Kubernetes, Flux and TechDocs. 8. Reconstruct the OCI root to a zero-change plan and add libvirt drift reports. diff --git a/platform/external-secrets/README.md b/platform/external-secrets/README.md new file mode 100644 index 0000000..6847ff3 --- /dev/null +++ b/platform/external-secrets/README.md @@ -0,0 +1,20 @@ +# External Secrets Operator + +External Secrets Operator（ESO）把 OpenBao `kv/k8s/*` 下的值投影为 Kubernetes +Secret。`ClusterSecretStore/openbao` 使用 `external-secrets` ServiceAccount 的短期 +JWT 登录 OpenBao，不在 Git 中保存长期凭据。 + +## Flux 接管 + +现有 release 是 2026-07-28 手工安装的 chart `external-secrets` `2.8.0`，Helm +revision 1。接管前审计确认：本目录 `values.yaml` 与 Helm stored user values 一致； +用固定 chart 生成的 33,528 行 manifest 与 stored manifest 只有末尾空行差异。 + +接管分两阶段：本阶段以 `suspend: true` 登记 HelmRepository、values ConfigMap 与 +HelmRelease，不执行 Helm action，不应重建三个 controller。合并后确认 source Ready、 +release 仍为 revision 1、三个 Pod UID/重启次数不变，再用独立 PR 移除 `suspend`。 +子 Kustomization 保持 `prune: false`。 + +`clustersecretstore.yaml` 和 `externalsecrets.yaml` 是现有 secret delivery intent， +本阶段故意不把它们加入该 Kustomization，避免在 Helm release 接管时同时扩大 Flux +ownership。Helm 接管稳定后再单独审计、纳管这些对象。 diff --git a/platform/external-secrets/helmrelease.yaml b/platform/external-secrets/helmrelease.yaml new file mode 100644 index 0000000..07311e9 --- /dev/null +++ b/platform/external-secrets/helmrelease.yaml @@ -0,0 +1,32 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: external-secrets + namespace: external-secrets +spec: + suspend: true + chart: + spec: + chart: external-secrets + interval: 1h + sourceRef: + kind: HelmRepository + name: external-secrets + version: 2.8.0 + driftDetection: + mode: enabled + install: + strategy: + name: RetryOnFailure + retryInterval: 5m + interval: 30m + releaseName: external-secrets + targetNamespace: external-secrets + timeout: 10m + upgrade: + strategy: + name: RetryOnFailure + retryInterval: 5m + valuesFrom: + - kind: ConfigMap + name: external-secrets-values diff --git a/platform/external-secrets/helmrepository.yaml b/platform/external-secrets/helmrepository.yaml new file mode 100644 index 0000000..ede0e9d --- /dev/null +++ b/platform/external-secrets/helmrepository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: external-secrets + namespace: external-secrets +spec: + interval: 1h + url: https://charts.external-secrets.io diff --git a/platform/external-secrets/kustomization.yaml b/platform/external-secrets/kustomization.yaml new file mode 100644 index 0000000..076a8bf --- /dev/null +++ b/platform/external-secrets/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +generatorOptions: + disableNameSuffixHash: true + labels: + reconcile.fluxcd.io/watch: Enabled +configMapGenerator: + - name: external-secrets-values + namespace: external-secrets + files: + - values.yaml=values.yaml +resources: + - helmrepository.yaml + - helmrelease.yaml