fix(gitops): remove platform kustomization and vault secret dependencies

2026-04-03 12:15:53 +08:00 · 2026-04-03 12:15:53 +08:00 · dfa55bc313
commit dfa55bc313
parent 9efec7c28b
21 changed files with 11 additions and 160 deletions
--- a/apps/core/accounts/pre/externalsecret.yaml
+++ b/apps/core/accounts/pre/externalsecret.yaml
@ -1,15 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: accounts-env
-spec:
-  refreshInterval: 1m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault-platform
-  target:
-    name: accounts-env
-    creationPolicy: Owner
-  dataFrom:
-    - extract:
-        key: core/pre/accounts
--- a/apps/core/accounts/pre/kustomization.yaml
+++ b/apps/core/accounts/pre/kustomization.yaml
@ -3,7 +3,6 @@ kind: Kustomization
 namespace: core-pre
 resources:
  - ../base
-  - externalsecret.yaml
  - ingress.yaml
 configMapGenerator:
  - name: accounts-env-values
--- a/apps/core/accounts/prod/externalsecret.yaml
+++ b/apps/core/accounts/prod/externalsecret.yaml
@ -1,15 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: accounts-env
-spec:
-  refreshInterval: 1m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault-platform
-  target:
-    name: accounts-env
-    creationPolicy: Owner
-  dataFrom:
-    - extract:
-        key: core/prod/accounts
--- a/apps/core/accounts/prod/kustomization.yaml
+++ b/apps/core/accounts/prod/kustomization.yaml
@ -3,7 +3,6 @@ kind: Kustomization
 namespace: core-prod
 resources:
  - ../base
-  - externalsecret.yaml
  - ingress.yaml
 configMapGenerator:
  - name: accounts-env-values
--- a/apps/core/console/pre/externalsecret.yaml
+++ b/apps/core/console/pre/externalsecret.yaml
@ -1,15 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: console-env
-spec:
-  refreshInterval: 1m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault-platform
-  target:
-    name: console-env
-    creationPolicy: Owner
-  dataFrom:
-    - extract:
-        key: core/pre/console
--- a/apps/core/console/pre/kustomization.yaml
+++ b/apps/core/console/pre/kustomization.yaml
@ -3,7 +3,6 @@ kind: Kustomization
 namespace: core-pre
 resources:
  - ../base
-  - externalsecret.yaml
  - ingress.yaml
 configMapGenerator:
  - name: console-env-values
--- a/apps/core/console/prod/externalsecret.yaml
+++ b/apps/core/console/prod/externalsecret.yaml
@ -1,15 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: console-env
-spec:
-  refreshInterval: 1m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault-platform
-  target:
-    name: console-env
-    creationPolicy: Owner
-  dataFrom:
-    - extract:
-        key: core/prod/console
--- a/apps/core/console/prod/kustomization.yaml
+++ b/apps/core/console/prod/kustomization.yaml
@ -3,7 +3,6 @@ kind: Kustomization
 namespace: core-prod
 resources:
  - ../base
-  - externalsecret.yaml
  - ingress.yaml
 configMapGenerator:
  - name: console-env-values
--- a/apps/platform/k3s-platform/values.yaml
+++ b/apps/platform/k3s-platform/values.yaml
@ -83,20 +83,6 @@ components:
    chart:
      name: external-dns
      version: ">=1.14.0 <2.0.0"
-    secret:
-      name: cloudflare-api-token
-      refreshInterval: 1m
-      secretStoreRef:
-        kind: ClusterSecretStore
-        name: vault-platform
-      target:
-        name: cloudflare-api-token
-        creationPolicy: Owner
-      data:
-        secretKey: api-token
-        remoteRef:
-          key: platform/cloudflare
-          property: api-token
    values:
      provider: cloudflare
      policy: sync
@ -113,8 +99,7 @@ components:
              name: cloudflare-api-token
              key: api-token
  externalSecretsStore:
-    enabled: true
-    name: vault-platform
+    enabled: false
    vault:
      server: http://vault.extsvc.svc.cluster.local:8200
      path: secret
@ -126,8 +111,16 @@ components:
          serviceAccountRef:
            name: external-secrets
            namespace: platform
-  vault:
+  sharedTlsSecretSync:
    enabled: true
+    name: postgresql-vultr-tls-sync
+    sourceNamespace: platform
+    sourceSecretName: postgresql-vultr-tls
+    targetNamespace: database
+    targetSecretName: postgresql-vultr-tls
+    refreshSchedule: "*/5 * * * *"
+  vault:
+    enabled: false
    releaseName: vault
    sourceRef:
      kind: HelmRepository
@ -175,7 +168,7 @@ apisixIngress:
      servicePort: 80

 vaultBootstrap:
-  enabled: true
+  enabled: false
  image: hashicorp/vault:1.16.3
  serviceAccountName: vault-bootstrap
  cloudflareSecretName: vault-bootstrap
--- a/databases/postgresql/externalsecret.yaml
+++ b/databases/postgresql/externalsecret.yaml
@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: postgresql-auth
-  namespace: database
-spec:
-  refreshInterval: 1m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault-platform
-  target:
-    name: postgresql-auth
-    creationPolicy: Owner
-  data:
-    - secretKey: POSTGRES_PASSWORD
-      remoteRef:
-        key: kv/postgresql.svc.plus
-        property: POSTGRES_PASSWORD
-    - secretKey: POSTGRES_USER
-      remoteRef:
-        key: kv/postgresql.svc.plus
-        property: POSTGRES_USER
--- a/databases/postgresql/ghcr-pull-externalsecret.yaml
+++ b/databases/postgresql/ghcr-pull-externalsecret.yaml
@ -1,28 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: postgresql-ghcr-pull
-  namespace: database
-spec:
-  refreshInterval: 1m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault-platform
-  target:
-    name: postgresql-ghcr-pull
-    creationPolicy: Owner
-    template:
-      type: kubernetes.io/dockerconfigjson
-      engineVersion: v2
-      data:
-        .dockerconfigjson: |
-          {"auths":{"ghcr.io":{"username":"{{ .username }}","password":"{{ .token }}","auth":"{{ printf "%s:%s" .username .token | b64enc }}"}}}
-  data:
-    - secretKey: username
-      remoteRef:
-        key: kv/postgresql.svc.plus
-        property: GHCR_USERNAME
-    - secretKey: token
-      remoteRef:
-        key: kv/postgresql.svc.plus
-        property: GHCR_TOKEN
--- a/databases/postgresql/kustomization.yaml
+++ b/databases/postgresql/kustomization.yaml
@ -4,9 +4,6 @@ namespace: database
 resources:
  - oci-repository.yaml
  - helmrelease.yaml
-  - externalsecret.yaml
-  - ghcr-pull-externalsecret.yaml
-  - stunnel-externalsecret.yaml
  - stunnel-server-configmap.yaml
  - stunnel-client-configmap.yaml
  - stunnel-server-deployment.yaml
--- a/infra/clusters/pre/accounts-pre-kustomization.yaml
+++ b/infra/clusters/pre/accounts-pre-kustomization.yaml
@ -12,5 +12,4 @@ spec:
    name: platform-config
  path: ./apps/core/accounts/pre
  dependsOn:
-    - name: platform-k3s
    - name: database-stack
--- a/infra/clusters/pre/console-pre-kustomization.yaml
+++ b/infra/clusters/pre/console-pre-kustomization.yaml
@ -12,5 +12,4 @@ spec:
    name: platform-config
  path: ./apps/core/console/pre
  dependsOn:
-    - name: platform-k3s
    - name: accounts-pre
--- a/infra/clusters/prod/accounts-prod-kustomization.yaml
+++ b/infra/clusters/prod/accounts-prod-kustomization.yaml
@ -12,5 +12,4 @@ spec:
    name: platform-config
  path: ./apps/core/accounts/prod
  dependsOn:
-    - name: platform-k3s
    - name: database-stack
--- a/infra/clusters/prod/console-prod-kustomization.yaml
+++ b/infra/clusters/prod/console-prod-kustomization.yaml
@ -12,5 +12,4 @@ spec:
    name: platform-config
  path: ./apps/core/console/prod
  dependsOn:
-    - name: platform-k3s
    - name: accounts-prod
--- a/infra/clusters/prod/database-kustomization.yaml
+++ b/infra/clusters/prod/database-kustomization.yaml
@ -12,5 +12,3 @@ spec:
    kind: GitRepository
    name: platform-config
  path: ./databases/postgresql
-  dependsOn:
-    - name: platform-k3s
--- a/infra/clusters/prod/kustomization.yaml
+++ b/infra/clusters/prod/kustomization.yaml
@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespaces.yaml
-  - platform-kustomization.yaml
  - database-kustomization.yaml
  - observability-kustomization.yaml
  - console-prod-kustomization.yaml
--- a/infra/clusters/prod/observability-kustomization.yaml
+++ b/infra/clusters/prod/observability-kustomization.yaml
@ -12,5 +12,3 @@ spec:
    kind: GitRepository
    name: platform-config
  path: ./apps/monitor/observability-stack
-  dependsOn:
-    - name: platform-k3s
--- a/infra/clusters/prod/platform-kustomization.yaml
+++ b/infra/clusters/prod/platform-kustomization.yaml
@ -1,14 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: platform-k3s
-  namespace: flux-system
-spec:
-  interval: 5m0s
-  prune: true
-  wait: true
-  timeout: 5m0s
-  sourceRef:
-    kind: GitRepository
-    name: platform-config
-  path: ./apps/platform
--- a/infra/clusters/prod/pre-kustomization.yaml
+++ b/infra/clusters/prod/pre-kustomization.yaml
@ -11,5 +11,3 @@ spec:
    kind: GitRepository
    name: platform-config
  path: ./infra/clusters/pre
-  dependsOn:
-    - name: platform-k3s