Merge pull request #2716 from pikasTech/feat/superapi-k8s-cicd

feat: 接入 SuperAPI L2/L3 自动交付

config/platform-db/postgres-nc01.yaml

@@ -131,6 +131,11 @@ postgres:
         user: superapi
         address: 10.42.0.0/16
         method: scram-sha-256
+      - type: hostssl
+        database: superapi_development
+        user: superapi_development
+        address: 10.42.0.0/16
+        method: scram-sha-256
       - type: hostssl
         database: pikaoa
         user: pikaoa
@@ -227,6 +232,20 @@ secrets:
           SUPERAPI_DB_NAME: superapi
         randomHex:
           SUPERAPI_DB_PASSWORD: 32
+    - name: superapi-development-nc01-db-credentials
+      sourceRef: platform-db/superapi-development-nc01-db.env
+      type: env
+      requiredKeys:
+        - SUPERAPI_DEVELOPMENT_DB_USER
+        - SUPERAPI_DEVELOPMENT_DB_PASSWORD
+        - SUPERAPI_DEVELOPMENT_DB_NAME
+      createIfMissing:
+        enabled: true
+        values:
+          SUPERAPI_DEVELOPMENT_DB_USER: superapi_development
+          SUPERAPI_DEVELOPMENT_DB_NAME: superapi_development
+        randomHex:
+          SUPERAPI_DEVELOPMENT_DB_PASSWORD: 32
     - name: pikaoa-nc01-db-credentials
       sourceRef: platform-db/pikaoa-db.env
       type: env
@@ -352,6 +371,15 @@ objects:
         createdb: false
         createrole: false
         superuser: false
+    - name: superapi_development
+      passwordRef:
+        sourceRef: platform-db/superapi-development-nc01-db.env
+        key: SUPERAPI_DEVELOPMENT_DB_PASSWORD
+      login: true
+      attributes:
+        createdb: false
+        createrole: false
+        superuser: false
     - name: pikaoa
       passwordRef:
         sourceRef: platform-db/pikaoa-db.env
@@ -427,6 +455,11 @@ objects:
       encoding: UTF8
       locale: C.UTF-8
       extensions: []
+    - name: superapi_development
+      owner: superapi_development
+      encoding: UTF8
+      locale: C.UTF-8
+      extensions: []
     - name: pikaoa
       owner: pikaoa
       encoding: UTF8
@@ -529,8 +562,23 @@ exports:
         key: DATABASE_URL
         mode: update-or-insert
       consumers:
-        - scope: superapi
-          secret: superapi-runtime
+        - scope: superapi-production
+          secret: superapi-production-runtime
+          key: DATABASE_URL
+    - name: superapi-development-nc01-database-url
+      sourceSecretRef: platform-db/superapi-development-nc01-db.env
+      render:
+        envKey: DATABASE_URL
+        format: postgresql://$(SUPERAPI_DEVELOPMENT_DB_USER):$(SUPERAPI_DEVELOPMENT_DB_PASSWORD)@$(PGHOST):5432/$(SUPERAPI_DEVELOPMENT_DB_NAME)?sslmode=require
+        variables:
+          PGHOST: 10.42.0.1
+      writeToSecretSource:
+        sourceRef: platform-infra/superapi-development.env
+        key: DATABASE_URL
+        mode: update-or-insert
+      consumers:
+        - scope: superapi-development
+          secret: superapi-development-runtime
           key: DATABASE_URL
     - name: pikaoa-database-url
       sourceSecretRef: platform-db/pikaoa-db.env

config/platform-infra/gitea.yaml

@@ -644,6 +644,98 @@ sourceAuthority:
         naming: gitea-actions-immutable-source
         prefix: refs/unidesk/snapshots/gitea-actions/pikaoa-release-nc01
       legacyGitMirror: null
+    - key: superapi-development-nc01
+      targetId: NC01
+      credentialOverride:
+        github:
+          transport: https-token
+          sourceRef: pikainc-selfmedia-gh-token.txt
+          sourceKey: GH_TOKEN
+          format: raw-token
+          requiredFor:
+            - upstream-mirror
+            - mirror-sync
+            - managed-repository-fetch
+            - github-head-observe
+            - github-hooks-list
+            - github-hooks-reconcile
+          permissions:
+            contents: read
+            metadata: read
+            webhooks: read-write
+          gitFetchCredential:
+            apiVersion: unidesk.ai/v1
+            kind: GitFetchCredential
+            authMode: github-https-token
+            host: github.com
+            secretRef:
+              namespace: devops-infra
+              name: gitea-github-sync-secrets
+              key: github-token-pikainc-superapi
+      upstream:
+        repository: pikainc/superapi
+        cloneUrl: https://github.com/pikainc/superapi.git
+        branch: master
+        visibility: private
+      gitea:
+        owner: mirrors
+        name: pikainc-superapi
+        mirrorMode: controlled-push
+        publicRead: false
+        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git
+      gitops:
+        branch: unidesk-host-gitops
+        flushDisposition: gitea-writeback
+      snapshot:
+        naming: gitea-actions-immutable-source
+        prefix: refs/unidesk/snapshots/gitea-actions/superapi-master-nc01
+      legacyGitMirror: null
+    - key: superapi-production-nc01
+      targetId: NC01
+      credentialOverride:
+        github:
+          transport: https-token
+          sourceRef: pikainc-selfmedia-gh-token.txt
+          sourceKey: GH_TOKEN
+          format: raw-token
+          requiredFor:
+            - upstream-mirror
+            - mirror-sync
+            - managed-repository-fetch
+            - github-head-observe
+            - github-hooks-list
+            - github-hooks-reconcile
+          permissions:
+            contents: read
+            metadata: read
+            webhooks: read-write
+          gitFetchCredential:
+            apiVersion: unidesk.ai/v1
+            kind: GitFetchCredential
+            authMode: github-https-token
+            host: github.com
+            secretRef:
+              namespace: devops-infra
+              name: gitea-github-sync-secrets
+              key: github-token-pikainc-superapi-release
+      upstream:
+        repository: pikainc/superapi
+        cloneUrl: https://github.com/pikainc/superapi.git
+        branch: release
+        visibility: private
+      gitea:
+        owner: mirrors
+        name: pikainc-superapi
+        mirrorMode: controlled-push
+        publicRead: false
+        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git
+      gitops:
+        branch: unidesk-host-gitops
+        flushDisposition: gitea-writeback
+      snapshot:
+        naming: gitea-actions-immutable-source
+        prefix: refs/unidesk/snapshots/gitea-actions/superapi-release-nc01
+      legacyGitMirror: null
 
 targets:
   - id: JD01

config/platform-infra/pipelines-as-code.yaml

@@ -353,6 +353,35 @@ repositories:
       runtime_service_port: "8080"
       health_path: /healthz
       health_url: http://pikaoa-web.pikaoa-dev.svc.cluster.local:8080/healthz
+  - id: superapi-development-nc01
+    name: superapi-development-nc01
+    namespace: devops-infra
+    providerType: gitea
+    url: https://gitea.hwpod.com/mirrors/pikainc-superapi
+    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git
+    owner: mirrors
+    repo: pikainc-superapi
+    secretName: pac-gitea-superapi-development-nc01
+    tokenKey: token
+    webhookSecretKey: webhook.secret
+    concurrencyLimit: 1
+    params:
+      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git
+      source_branch: master
+      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/superapi-master-nc01
+      node: NC01
+      image_repository: 127.0.0.1:5000/superapi/superapi
+      pipeline_name: superapi-development-nc01-pac
+      pipeline_run_prefix: superapi-development-nc01
+      service_account: superapi-development-nc01-tekton-runner
+      pipeline_timeout: 900s
+      workspace_pvc_size: 4Gi
+      runtime_namespace: superapi-development
+      runtime_deployment: superapi-gateway
+      runtime_service: superapi-gateway
+      runtime_service_port: "8080"
+      health_path: /health
+      health_url: http://superapi-gateway.superapi-development.svc.cluster.local:8080/health
 consumers:
   - extends: templates.consumers.agentrunV02
     variables:
@@ -834,6 +863,66 @@ consumers:
         hostNetwork: true
         dnsPolicy: ClusterFirstWithHostNet
         fsGroup: 1000
+  - id: superapi-development-nc01
+    repositoryRef: superapi-development-nc01
+    node: NC01
+    lane: superapi-development
+    namespace: devops-infra
+    pipeline: superapi-development-nc01-pac
+    pipelineRunPrefix: superapi-development-nc01
+    argoNamespace: argocd
+    argoApplication: superapi-development-nc01
+    deliveryObservation:
+      runtimeEvidence: required
+    closeoutGitOpsMirrorFlush: false
+    argoBootstrap:
+      project: default
+      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
+      targetRevision: unidesk-host-gitops
+      path: deploy/gitops/platform-infra/superapi-development-nc01
+      destinationNamespace: superapi-development
+      automated: true
+      repositoryCredential:
+        secretName: argocd-repo-superapi-development-nc01
+        username: unidesk-admin
+    runnerServiceAccount:
+      name: superapi-development-nc01-tekton-runner
+      automountServiceAccountToken: false
+      roleBindingName: superapi-development-nc01-tekton-runner
+  - id: superapi-production-nc01
+    repositoryRef: superapi-development-nc01
+    node: NC01
+    lane: superapi-production
+    namespace: devops-infra
+    pipeline: superapi-production-nc01-pac
+    pipelineRunPrefix: superapi-production-nc01
+    argoNamespace: argocd
+    argoApplication: superapi-production-nc01
+    deliveryObservation:
+      runtimeEvidence: required
+    closeoutGitOpsMirrorFlush: false
+    params:
+      source_branch: release
+      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/superapi-release-nc01
+      pipeline_name: superapi-production-nc01-pac
+      pipeline_run_prefix: superapi-production-nc01
+      service_account: superapi-production-nc01-tekton-runner
+      runtime_namespace: superapi-production
+      health_url: http://superapi-gateway.superapi-production.svc.cluster.local:8080/health
+    argoBootstrap:
+      project: default
+      repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git
+      targetRevision: unidesk-host-gitops
+      path: deploy/gitops/platform-infra/superapi-production-nc01
+      destinationNamespace: superapi-production
+      automated: true
+      repositoryCredential:
+        secretName: argocd-repo-superapi-production-nc01
+        username: unidesk-admin
+    runnerServiceAccount:
+      name: superapi-production-nc01-tekton-runner
+      automountServiceAccountToken: false
+      roleBindingName: superapi-production-nc01-tekton-runner
 templates:
   repositories:
     agentrunV02:

config/platform-infra/public-edge.yaml

@@ -151,3 +151,11 @@ targets:
         configRef: /root/superapi/config/superapi.yaml
         path: publicExposure
         sourceCommit: 04caa95a3fd984f81ce9144948b1cc879df04f68
+      - id: superapi-development
+        configRef: /root/superapi/config/superapi.yaml
+        path: deployment.targets.l2.publicExposure
+        sourceCommit: ed9dada3ebe61a4d1d376b3e8d8a52f419b83366
+      - id: superapi-production
+        configRef: /root/superapi/config/superapi.yaml
+        path: deployment.targets.l3.publicExposure
+        sourceCommit: ed9dada3ebe61a4d1d376b3e8d8a52f419b83366

config/secrets-distribution.yaml

@@ -144,6 +144,18 @@ sources:
           PIKAOA_SESSION_SECRET:
             bytes: 32
             prefix: poa_
+    - sourceRef: platform-infra/superapi.env
+      type: env
+      requiredKeys:
+        - DATABASE_URL
+      createIfMissing:
+        enabled: false
+    - sourceRef: platform-infra/superapi-development.env
+      type: env
+      requiredKeys:
+        - DATABASE_URL
+      createIfMissing:
+        enabled: false
     - sourceRef: hwlab/jd01-v03-opencode.env
       type: env
       requiredKeys:
@@ -317,6 +329,32 @@ targets:
         - pikaoa-api
       timeoutSeconds: 180
       pollIntervalSeconds: 5
+  - id: superapi-development-nc01
+    route: NC01:k3s
+    namespace: superapi-development
+    scope: superapi-development
+    enabled: true
+    consumerRollout:
+      deployments:
+        - superapi-gateway
+        - superapi-api
+        - superapi-worker
+        - superapi-web
+      timeoutSeconds: 180
+      pollIntervalSeconds: 5
+  - id: superapi-production-nc01
+    route: NC01:k3s
+    namespace: superapi-production
+    scope: superapi-production
+    enabled: true
+    consumerRollout:
+      deployments:
+        - superapi-gateway
+        - superapi-api
+        - superapi-worker
+        - superapi-web
+      timeoutSeconds: 180
+      pollIntervalSeconds: 5
   - id: temporal-nc01
     route: NC01:k3s
     namespace: temporal
@@ -393,6 +431,34 @@ kubernetesSecrets:
       - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
         sourceKey: contents
         targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD
+  - name: superapi-development-runtime
+    targetId: superapi-development-nc01
+    secretName: superapi-development-runtime
+    type: Opaque
+    data:
+      - sourceRef: platform-infra/superapi-development.env
+        sourceKey: DATABASE_URL
+        targetKey: DATABASE_URL
+      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
+        sourceKey: contents
+        targetKey: ADMIN_PASSWORD
+      - sourceRef: ~/.codex/auth.json.pika
+        sourceKey: contents
+        targetKey: BOOTSTRAP_AUTH_JSON
+  - name: superapi-production-runtime
+    targetId: superapi-production-nc01
+    secretName: superapi-production-runtime
+    type: Opaque
+    data:
+      - sourceRef: platform-infra/superapi.env
+        sourceKey: DATABASE_URL
+        targetKey: DATABASE_URL
+      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
+        sourceKey: contents
+        targetKey: ADMIN_PASSWORD
+      - sourceRef: ~/.codex/auth.json.pika
+        sourceKey: contents
+        targetKey: BOOTSTRAP_AUTH_JSON
   - name: selfmedia-access
     targetId: selfmedia-nc01
     secretName: selfmedia-access

config/unidesk-cli.yaml

@@ -34,6 +34,12 @@ github:
         sourceRef: pikainc-selfmedia-gh-token.txt
         sourceKey: GH_TOKEN
         format: raw-token
+      - repository: pikainc/superapi
+        priority: before-env
+        root: /root/.unidesk/.env
+        sourceRef: pikainc-selfmedia-gh-token.txt
+        sourceKey: GH_TOKEN
+        format: raw-token
   prMerge:
     unknownRetry:
       maxAttempts: 5