feat: add k8s example

2026-07-10 11:06:06 +08:00
parent 16af9c5f4d
commit 762fefacac
4 changed files with 121 additions and 0 deletions
@@ -0,0 +1,28 @@
+# ============================================================
+# ConfigMap 模板 — violin-auth dev 环境（K8s 测试）
+# ============================================================
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: violin-auth-config
+  namespace: violin-dev
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: config
+    environment: dev
+data:
+  SPRING_PROFILES_ACTIVE: "dev"
+
+  DB_HOST: "violin-postgres-dev"
+  DB_PORT: "5432"
+  DB_NAME: "violin_dev"
+  DB_USER: "postgres"
+
+  AUTHENTIK_ISSUER: "https://auth.violin-work.online"
+  AUTHENTIK_REDIRECT_URI: "https://dev.violin-home.cn/auth/callback"
+  AUTHENTIK_SCOPE: "openid profile email"
+
+  VIOLIN_CORS_ALLOWED_ORIGINS: "https://dev.violin-home.cn,https://*.violin-work.online,http://localhost:5173"
+
+  VIOLIN_SNOWFLAKE_WORKER_ID: "1"
@@ -0,0 +1,36 @@
+# ============================================================
+# ConfigMap 模板 — violin-auth 生产环境（非敏感配置）
+# ============================================================
+# 使用方式：
+#   kubectl apply -f example/configmap-template.yaml
+#
+# 说明：
+#   - 非敏感参数放这里，可 commit 进 Git
+#   - 敏感凭据（密码 / secret）走 secret-template.yaml，绝不 commit 真实值
+#   - KubeSphere UI 可直接导入此文件
+# ============================================================
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: violin-auth-config
+  namespace: violin-prod
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: config
+    environment: production
+data:
+  SPRING_PROFILES_ACTIVE: "prod"
+
+  DB_HOST: "violin-postgres"
+  DB_PORT: "5432"
+  DB_NAME: "violin"
+  DB_USER: "postgres"
+
+  AUTHENTIK_ISSUER: "https://auth.violin-work.online"
+  AUTHENTIK_REDIRECT_URI: "https://www.violin-home.cn/auth/callback"
+  AUTHENTIK_SCOPE: "openid profile email"
+
+  VIOLIN_CORS_ALLOWED_ORIGINS: "https://www.violin-home.cn,https://*.violin-work.online"
+
+  VIOLIN_SNOWFLAKE_WORKER_ID: "1"
@@ -0,0 +1,27 @@
+# ============================================================
+# Secret 模板 — violin-auth dev 环境（K8s 测试）
+# ============================================================
+# ⚠️ 真实凭据通过 KubeSphere UI 或 CI/CD 注入，不要 commit 真实值
+# dev 环境凭据可以和 prod 区分开（推荐），也可以共用（不推荐）
+# ============================================================
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: violin-auth-secret
+  namespace: violin-dev
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: secret
+    environment: dev
+type: Opaque
+stringData:
+  # ---- 数据库 ----
+  DB_PASSWORD: "CHANGE_ME_DEV_POSTGRES_PASSWORD"
+
+  # ---- JWT ----
+  VIOLIN_JWT_SECRET: "CHANGE_ME_DEV_JWT_SECRET_MIN_32_BYTES"
+
+  # ---- Authentik OIDC（dev application）----
+  AUTHENTIK_CLIENT_ID: "CHANGE_ME_DEV_AUTHENTIK_CLIENT_ID"
+  AUTHENTIK_CLIENT_SECRET: "CHANGE_ME_DEV_AUTHENTIK_CLIENT_SECRET"
@@ -0,0 +1,30 @@
+# ============================================================
+# Secret 模板 — violin-auth 生产环境（敏感凭据）
+# ============================================================
+# ⚠️  重要：
+#   - 本文件是 TEMPLATE，真实凭据值必须通过以下方式注入：
+#     1. KubeSphere 控制台 → 配置存储 → Secret → 创建（界面填写真实值）
+#     2. 或 CI/CD 流水线中通过 Drone Secret / sealed-secrets 动态注入
+#   - 绝不要把 stringData 里的占位符替换成真实值后 commit
+# ============================================================
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: violin-auth-secret
+  namespace: violin-prod
+  labels:
+    app.kubernetes.io/name: violin-auth
+    app.kubernetes.io/component: secret
+    environment: production
+type: Opaque
+stringData:
+  # ---- 数据库 ----
+  DB_PASSWORD: "CHANGE_ME_POSTGRES_PASSWORD"
+
+  # ---- JWT ----
+  VIOLIN_JWT_SECRET: "CHANGE_ME_JWT_SECRET_MIN_32_BYTES"
+
+  # ---- Authentik OIDC ----
+  AUTHENTIK_CLIENT_ID: "CHANGE_ME_AUTHENTIK_CLIENT_ID"
+  AUTHENTIK_CLIENT_SECRET: "CHANGE_ME_AUTHENTIK_CLIENT_SECRET"