From 762fefacac2e0d691776e05768f028641858f259 Mon Sep 17 00:00:00 2001
From: simple321vip <simple321@vip.qq.com>
Date: Fri, 10 Jul 2026 11:06:06 +0800
Subject: [PATCH] feat: add k8s example

---
 example/configmap-dev-template.yaml  | 28 ++++++++++++++++++++++
 example/configmap-prod-template.yaml | 36 ++++++++++++++++++++++++++++
 example/secret-dev-template.yaml     | 27 +++++++++++++++++++++
 example/secret-prod-template.yaml    | 30 +++++++++++++++++++++++
 4 files changed, 121 insertions(+)
 create mode 100644 example/configmap-dev-template.yaml
 create mode 100644 example/configmap-prod-template.yaml
 create mode 100644 example/secret-dev-template.yaml
 create mode 100644 example/secret-prod-template.yaml

diff --git a/example/configmap-dev-template.yaml b/example/configmap-dev-template.yaml
new file mode 100644
index 0000000..becd8ec
--- /dev/null
+++ b/example/configmap-dev-template.yaml
@@ -0,0 +1,28 @@
+# ============================================================
+# ConfigMap 模板 — violin-auth dev 环境（K8s 测试）
+# ============================================================
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: violin-auth-config
+  namespace: violin-dev
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: config
+    environment: dev
+data:
+  SPRING_PROFILES_ACTIVE: "dev"
+
+  DB_HOST: "violin-postgres-dev"
+  DB_PORT: "5432"
+  DB_NAME: "violin_dev"
+  DB_USER: "postgres"
+
+  AUTHENTIK_ISSUER: "https://auth.violin-work.online"
+  AUTHENTIK_REDIRECT_URI: "https://dev.violin-home.cn/auth/callback"
+  AUTHENTIK_SCOPE: "openid profile email"
+
+  VIOLIN_CORS_ALLOWED_ORIGINS: "https://dev.violin-home.cn,https://*.violin-work.online,http://localhost:5173"
+
+  VIOLIN_SNOWFLAKE_WORKER_ID: "1"
\ No newline at end of file
diff --git a/example/configmap-prod-template.yaml b/example/configmap-prod-template.yaml
new file mode 100644
index 0000000..c49b321
--- /dev/null
+++ b/example/configmap-prod-template.yaml
@@ -0,0 +1,36 @@
+# ============================================================
+# ConfigMap 模板 — violin-auth 生产环境（非敏感配置）
+# ============================================================
+# 使用方式：
+#   kubectl apply -f example/configmap-template.yaml
+#
+# 说明：
+#   - 非敏感参数放这里，可 commit 进 Git
+#   - 敏感凭据（密码 / secret）走 secret-template.yaml，绝不 commit 真实值
+#   - KubeSphere UI 可直接导入此文件
+# ============================================================
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: violin-auth-config
+  namespace: violin-prod
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: config
+    environment: production
+data:
+  SPRING_PROFILES_ACTIVE: "prod"
+
+  DB_HOST: "violin-postgres"
+  DB_PORT: "5432"
+  DB_NAME: "violin"
+  DB_USER: "postgres"
+
+  AUTHENTIK_ISSUER: "https://auth.violin-work.online"
+  AUTHENTIK_REDIRECT_URI: "https://www.violin-home.cn/auth/callback"
+  AUTHENTIK_SCOPE: "openid profile email"
+
+  VIOLIN_CORS_ALLOWED_ORIGINS: "https://www.violin-home.cn,https://*.violin-work.online"
+
+  VIOLIN_SNOWFLAKE_WORKER_ID: "1"
\ No newline at end of file
diff --git a/example/secret-dev-template.yaml b/example/secret-dev-template.yaml
new file mode 100644
index 0000000..812e091
--- /dev/null
+++ b/example/secret-dev-template.yaml
@@ -0,0 +1,27 @@
+# ============================================================
+# Secret 模板 — violin-auth dev 环境（K8s 测试）
+# ============================================================
+# ⚠️ 真实凭据通过 KubeSphere UI 或 CI/CD 注入，不要 commit 真实值
+# dev 环境凭据可以和 prod 区分开（推荐），也可以共用（不推荐）
+# ============================================================
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: violin-auth-secret
+  namespace: violin-dev
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: secret
+    environment: dev
+type: Opaque
+stringData:
+  # ---- 数据库 ----
+  DB_PASSWORD: "CHANGE_ME_DEV_POSTGRES_PASSWORD"
+
+  # ---- JWT ----
+  VIOLIN_JWT_SECRET: "CHANGE_ME_DEV_JWT_SECRET_MIN_32_BYTES"
+
+  # ---- Authentik OIDC（dev application）----
+  AUTHENTIK_CLIENT_ID: "CHANGE_ME_DEV_AUTHENTIK_CLIENT_ID"
+  AUTHENTIK_CLIENT_SECRET: "CHANGE_ME_DEV_AUTHENTIK_CLIENT_SECRET"
\ No newline at end of file
diff --git a/example/secret-prod-template.yaml b/example/secret-prod-template.yaml
new file mode 100644
index 0000000..73a9a7a
--- /dev/null
+++ b/example/secret-prod-template.yaml
@@ -0,0 +1,30 @@
+# ============================================================
+# Secret 模板 — violin-auth 生产环境（敏感凭据）
+# ============================================================
+# ⚠️  重要：
+#   - 本文件是 TEMPLATE，真实凭据值必须通过以下方式注入：
+#     1. KubeSphere 控制台 → 配置存储 → Secret → 创建（界面填写真实值）
+#     2. 或 CI/CD 流水线中通过 Drone Secret / sealed-secrets 动态注入
+#   - 绝不要把 stringData 里的占位符替换成真实值后 commit
+# ============================================================
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: violin-auth-secret
+  namespace: violin-prod
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: secret
+    environment: production
+type: Opaque
+stringData:
+  # ---- 数据库 ----
+  DB_PASSWORD: "CHANGE_ME_POSTGRES_PASSWORD"
+
+  # ---- JWT ----
+  VIOLIN_JWT_SECRET: "CHANGE_ME_JWT_SECRET_MIN_32_BYTES"
+
+  # ---- Authentik OIDC ----
+  AUTHENTIK_CLIENT_ID: "CHANGE_ME_AUTHENTIK_CLIENT_ID"
+  AUTHENTIK_CLIENT_SECRET: "CHANGE_ME_AUTHENTIK_CLIENT_SECRET"
\ No newline at end of file