From 7ecb775667f1d18432be135b31196e8484a0e95c Mon Sep 17 00:00:00 2001
From: panshuxiao <panshuxiao@mail.ustc.edu.cn>
Date: Mon, 8 Dec 2025 14:04:09 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9crd=20yaml=E6=96=87=E4=BB=B6?=
 =?UTF-8?q?=E4=BD=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/application.yaml             | 52 +++++++++++++
 .../mengningsoftware-docs-ci-cd-crd.yaml      | 73 ++++---------------
 2 files changed, 68 insertions(+), 57 deletions(-)
 create mode 100644 .gitea/workflows/application.yaml

diff --git a/.gitea/workflows/application.yaml b/.gitea/workflows/application.yaml
new file mode 100644
index 0000000..3c308e1
--- /dev/null
+++ b/.gitea/workflows/application.yaml
@@ -0,0 +1,52 @@
+apiVersion: application.devstar.cn/v1
+kind: Application
+metadata:
+  name: mengningsoftware
+  namespace: web-servers
+  labels:
+    app.kubernetes.io/component: web-server
+    app.kubernetes.io/managed-by: devstar
+    app.kubernetes.io/name: mengningsoftware
+spec:
+  environment:
+    NGINX_VERSION: "1.24.0"
+  expose: true
+  networkPolicy:
+    gateway:
+      enabled: true
+      hosts:
+        - "mengning.com.cn"
+      ports:
+        - name: http
+          number: 80
+          protocol: HTTP
+        - name: https
+          number: 443
+          protocol: HTTPS
+      tls:
+        - hosts:
+            - "mengning.com.cn"
+          minProtocolVersion: "TLSv1_2"
+          mode: SIMPLE
+          secretName: mengningsoftware-tls
+          secretNamespace: istio-system
+  replicas: 2
+  resources:
+    cpu: "500m"
+    memory: "512Mi"
+  service:
+    enabled: true
+    type: ClusterIP
+    ports:
+      - name: http
+        port: 80
+        protocol: TCP
+        targetPort: http
+  template:
+    type: stateless
+    image: ${DOCKER_REGISTRY_ADDRESS}/${DOCKER_REPOSITORY_ARTIFACT}:latest
+    ports:
+      - name: http
+        port: 80
+        protocol: TCP
+
diff --git a/.gitea/workflows/mengningsoftware-docs-ci-cd-crd.yaml b/.gitea/workflows/mengningsoftware-docs-ci-cd-crd.yaml
index 7ec3cb8..8ba845c 100644
--- a/.gitea/workflows/mengningsoftware-docs-ci-cd-crd.yaml
+++ b/.gitea/workflows/mengningsoftware-docs-ci-cd-crd.yaml
@@ -46,6 +46,8 @@ jobs:
         env:
           DOCKER_REGISTRY_ADDRESS: ${{ vars.DOCKER_REGISTRY_ADDRESS }}
           DOCKER_REPOSITORY_ARTIFACT: ${{ vars.DOCKER_REPOSITORY_ARTIFACT }}
+          TLS_CERTIFICATE: ${{ secrets.TLS_CERTIFICATE }}
+          TLS_PRIVATE_KEY: ${{ secrets.TLS_PRIVATE_KEY }}
         run: |
           curl -LO https://mirrors.ustc.edu.cn/kubernetes/core%3A/stable%3A/v1.28/deb/amd64/kubectl_1.28.0-1.1_amd64.deb
           sudo dpkg -i kubectl_1.28.0-1.1_amd64.deb
@@ -54,63 +56,20 @@ jobs:
           kubectl config set-context remote-context --cluster=remote-cluster --user=token-user
           kubectl config use-context remote-context
 
-          # 生成与当前集群中 mengningsoftware Application 一致的 CRD YAML，只更新镜像地址
-          cat > /tmp/application-crd.yaml <<EOF
-          apiVersion: application.devstar.cn/v1
-          kind: Application
-          metadata:
-            name: mengningsoftware
-            namespace: web-servers
-            labels:
-              app.kubernetes.io/component: web-server
-              app.kubernetes.io/managed-by: devstar
-              app.kubernetes.io/name: mengningsoftware
-          spec:
-            environment:
-              NGINX_VERSION: "1.24.0"
-            expose: true
-            networkPolicy:
-              gateway:
-                enabled: true
-                hosts:
-                  - "mengning.com.cn"
-                ports:
-                  - name: http
-                    number: 80
-                    protocol: HTTP
-                  - name: https
-                    number: 443
-                    protocol: HTTPS
-                tls:
-                  - hosts:
-                      - "mengning.com.cn"
-                    minProtocolVersion: "TLSv1_2"
-                    mode: SIMPLE
-                    certificate: |-
-                      -----BEGIN CERTIFICATE----- MIIG6TCCBNGgAwIBAgIQC5URiblBtMr1WphKEQbK8jANBgkqhkiG9w0BAQsFADBb MQswCQYDVQQGEwJDTjElMCMGA1UEChMcVHJ1c3RBc2lhIFRlY2hub2xvZ2llcywg SW5jLjElMCMGA1UEAxMcVHJ1c3RBc2lhIERWIFRMUyBSU0EgQ0EgMjAyNTAeFw0y NTExMTgwMDAwMDBaFw0yNjAyMTUyMzU5NTlaMBoxGDAWBgNVBAMTD21lbmduaW5n LmNvbS5jbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALAsI5JrSXJL xVAbSwNJ+cCyy8P2B+qmZ2mzrF3odKVFKa6MCgp1G1m0ER2sLwH6cjEq7VbHuf2n h9p/r1z9AQtobwepfqbZAiYEWI8hJzLaaDqqFBiWy08M29eQMGcDntYIxiU5YY0c r2enEPTO0aC1U5+dPOxiUEX/Helo6v0u4M9w5M/i5iYHoKaPGTwZHqdc39Ar4kbV ntcj9hUiwzTavCJnEKr/WSNASTxV+CaIaxfmuSqYI33YodLdwspD2Rs8v5kKVfRZ 3974gnKdxIutmgtcPfNc9LNcAJ5pfFdd1nNVs5MjB3dYJbQd+ZiAtjnN5lhaDN8c bDbM1IZYMFsCAwEAAaOCAugwggLkMB8GA1UdIwQYMBaAFLQSKKW0wB2fKXFpPNkR lkp1aVDAMB0GA1UdDgQWBBQgmU8NFGXjjVEiqHzR8tAzx7JjQTAvBgNVHREEKDAm gg9tZW5nbmluZy5jb20uY26CE3d3dy5tZW5nbmluZy5jb20uY24wPgYDVR0gBDcw NTAzBgZngQwBAgEwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5j b20vQ1BTMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATB5Bggr BgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNv bTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL1RydXN0 QXNpYURWVExTUlNBQ0EyMDI1LmNydDAMBgNVHRMBAf8EAjAAMIIBgQYKKwYBBAHW eQIEAgSCAXEEggFtAWsAdwCWl2S/VViXrfdDh2g3CEJ36fA61fak8zZuRqQ/D8qp xgAAAZqVQK8bAAAEAwBIMEYCIQDLoeHo0OXPOHQ1dfwCxBB/HoGBF3xpLCBjMEqE ad8hqwIhAOR5cFSqM/suITZKjWiWimyIT6TQ85MNeNkSKgBfRuWAAHcAZBHEbKQS 7KeJHKICLgC8q08oB9QeNSer6v7VA8l9zfAAAAGalUCvFQAABAMASDBGAiEAoZQ+ ouNAkLXxWgz7w/93cs/CD9x9bUdkoYMI+MFk6l8CIQDSmYFGXVGEFLoz+BUbYXOi Rmj0IxK+6vCmrzR9usgRAAB3AEmcm2neHXzs/DbezYdkprhbrwqHgBnRVVL76esp 3fjDAAABmpVArysAAAQDAEgwRgIhAJNOWk2Sw1mDiuPRaebLxldZUIx4z2zYEsdw 9CDpczpCAiEAtzN7sCiwUgsrD3zirT0xh8rLFY8hHlT9cBnHT2s7ZNMwDQYJKoZI hvcNAQELBQADggIBAK75qGfHY9N8yHabhucoiWT6LoHYYwh2r78OfxGX0GZBrmzX xfCFaML5gGqg/juCVOZSVo8rxnLw7Lhynb8ZyrmcSGftgIznqVP7G+TiXFNTsr+V AafwIq9YtQWRlRmS4Me6zpSW7/2mxfTbuvMau1PdOHNyu6MYA7t8gDKxijMtu7mN mFTMxGVdCjr3RxDeFiqSIbON3rKhceQTMGSa7yxSeFwoCfSnxWfrl8dBQI49QlgH GArOKMisTxbkNn+R5z/sOXbDIlyTXHW4FT6Xkrj3avdzkNkNJtAEbrkvhnDELpOh fBXCdrBWHeqvjDCAdlMYXxTxg2OWmbtyIzNdNCcmPY+A1azpnSo+sTh7gMG6Ue9b MZG8ar+eAfs6sFm7o09ijSJ0II1Fc6LqTtOnN91ma3cMlxsDlxNnTIpXAWwTOO2i hSdw3DBVJA6VEV4khc3FD0ixj1m2URt5eoRMyNyjlSctldmFFUnEJBhZjIiqHrzk 5dY4TIgZVyHN7DL6J88+IqTtntGsnombuaolhTVCPE99wFwneergf0nL7FYvv1gG A2rPpsS+pa7cjxCw1WqNXwt2VWHpdrrw7Wu+GzQae8XvLgHBFDW9JTGrBTAotSH9 b98gFY5Ps9bGF3zNzLsDr4p62mxQp2NOV044H5273QGU6C+j2gRu/HYlhJ9j -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFnjCCBIagAwIBAgIQCSYyO0lk42hGFRLe8aXVLDANBgkqhkiG9w0BAQsFADBh MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH MjAeFw0yNTAxMDgwMDAwMDBaFw0zNTAxMDcyMzU5NTlaMFsxCzAJBgNVBAYTAkNO MSUwIwYDVQQKExxUcnVzdEFzaWEgVGVjaG5vbG9naWVzLCBJbmMuMSUwIwYDVQQD ExxUcnVzdEFzaWEgRFYgVExTIFJTQSBDQSAyMDI1MIICIjANBgkqhkiG9w0BAQEF AAOCAg8AMIICCgKCAgEA0fuEmuBIsN6ZZVq+gRobMorOGIilTCIfQrxNpR8FUZ9R /GfbiekbiIKphQXEZ7N1uBnn6tXUuZ32zl6jPkZpHzN/Bmgk1BWSIzVc0npMzrWq /hrbk5+KddXJdsNpeG1+Q8lc8uVMBrztnxaPb7Rh7yQCsMrcO4hgVaqLJWkVvEfW ULtoCHQnNaj4IroG6VxQf1oArQ8bPbwpI02lieSahRa78FQuXdoGVeQcrkhtVjZs ON98vq5fPWZX2LFv7e5J6P9IHbzvOl8yyQjv+2/IOwhNSkaXX3bI+//bqF9XW/p7 +gsUmHiK5YsvLjmXcvDmoDEGrXMzgX31Zl2nJ+umpRbLjwP8rxYIUsKoEwEdFoto Aid59UEBJyw/GibwXQ5xTyKD/N6C8SFkr1+myOo4oe1UB+YgvRu6qSxIABo5kYdX FodLP4IgoVJdeUFs1Usa6bxYEO6EgMf5lCWt9hGZszvXYZwvyZGq3ogNXM7eKyi2 20WzJXYMmi9TYFq2Fa95aZe4wki6YhDhhOO1g0sjITGVaB73G+JOCI9yJhv6+REN D40ZpboUHE8JNgMVWbG1isAMVCXqiADgXtuC+tmJWPEH9cR6OuJLEpwOzPfgAbnn 2MRu7Tsdr8jPjTPbD0FxblX1ydW3RG30vwLF5lkTTRkHG9epMgpPMdYP7nY/08MC AwEAAaOCAVYwggFSMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLQSKKW0 wB2fKXFpPNkRlkp1aVDAMB8GA1UdIwQYMBaAFE4iVCAYlebjbuYP+vq5Eu0GF485 MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw dgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2Vy dC5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9E aWdpQ2VydEdsb2JhbFJvb3RHMi5jcnQwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDov L2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDARBgNV HSAECjAIMAYGBFUdIAAwDQYJKoZIhvcNAQELBQADggEBAJ4a3svh316GY2+Z7EYx mBIsOwjJSnyoEfzx2T699ctLLrvuzS79Mg3pPjxSLlUgyM8UzrFc5tgVU3dZ1sFQ I4RM+ysJdvIAX/7Yx1QbooVdKhkdi9X7QN7yVkjqwM3fY3WfQkRTzhIkM7mYIQbR r+y2Vkju61BLqh7OCRpPMiudjEpP1kEtRyGs2g0aQpEIqKBzxgitCXSayO1hoO6/ 71ts801OzYlqYW9OQQQ2GCJyFbD6XHDjdpn+bWUxTKWaMY0qedSCbHE3Kl2QEF0C ynZ7SbC03yR+gKZQDeTXrNP1kk5Qhe7jSXgw+nhbspe0q/M1ZcNCz+sPxeOwdCcC gJE= -----END CERTIFICATE-----
-                    privateKey: |-
-                      -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAsCwjkmtJckvFUBtLA0n5wLLLw/YH6qZnabOsXeh0pUUprowK CnUbWbQRHawvAfpyMSrtVse5/aeH2n+vXP0BC2hvB6l+ptkCJgRYjyEnMtpoOqoU GJbLTwzb15AwZwOe1gjGJTlhjRyvZ6cQ9M7RoLVTn5087GJQRf8d6Wjq/S7gz3Dk z+LmJgegpo8ZPBkep1zf0CviRtWe1yP2FSLDNNq8ImcQqv9ZI0BJPFX4JohrF+a5 Kpgjfdih0t3CykPZGzy/mQpV9Fnf3viCcp3Ei62aC1w981z0s1wAnml8V13Wc1Wz kyMHd1gltB35mIC2Oc3mWFoM3xxsNszUhlgwWwIDAQABAoIBAQCYa4fXPUWNQqsS 1JpA3TbdFpQfFfThelkMZawij2SkPMOERZrGU213XchVMMx23LUBfw9avnBXWiO6 0i/ptue5dABj06xFNImcVLQ+GUPtxnLZFp9OauC5ovltdk26QrKgoXS1bgDNctz7 Q9rywyEw9tDDzumP5rtm5AOAFwsAQqZcB3pmQl0+agR5BQE6NWUhwkfgUeZzaZ8C Z5IpbYJSfrGMVqzGJwe3FN+5wJDXuHu0o9xS0B/D7x3Cy6l/aF4oWiYXicxmm1d+ js6vExgDRKPTDq4k0a07vr1ph3THmBEcSzCQxKBxDDvAGhMKX/7hYs8J0qZRR3QE Zn8uw47BAoGBAOri5zNgY2X1TY85LDYdV61T8Ex2MLjyl6eB/dXyF4h+dsHI/II/ KB4Jc4dBk/FpiCBdH96Qf+uGNuvJ1/GXkaZKWtDC6xR7uD6M48C2JRSDCsYH/qSz fzNZVm6wJLHW1ka6isHjGp+ntxI+JLb6ejsj4OQt0N1OFKfwkVWBojI7AoGBAMAC I0+gLKQMfAUo/NuskPJMUyddmmKmI0EHhqSLs3TBkutVIW2EcYGIa+nrjOWMQbYH yiHEdwwWLPPLjN/6wu7HCeWeTgMvqZuIcHLzmFGW1Iqcb9jUqjxCWaaJG7MNJ/to 7n/pe/WO5C/DZ7r96IhBAQVp/o8wKyBLHX8YDvhhAoGAPqnCHIa+fdjvlCIglV9G oMsf9IYjgXPW2a1oVsd7V8LFU/WWx/ipbzn+RDtOiL0qv9eYRPwv5FmuFUGIBr/0 73QuvjsCFDjdcnKL4EG3qr07BpHjcXUhnkVbNbRwVbGHAN+LXSaFV8qaoJdLnDU+ nsB3ouhGLIREJnmbjEBFUTkCgYAKUxMbAP3lhFZW4LFYDptsq/X8s+fNTimvIXx3 9JsduBryVI2LmgeQc4l59pSI81XFN/4CetH78GVSZquYj59Tv5gkpLKFMVbpahjB 1Z9nI7kiCu9otWbB/r9bWRwIMLjpp+bLMf7cYWabuuIlB+otCXHInL53bJulDOT1 JJIJgQKBgQCo03WqkCLibNYe8r+wksgMliYA7ZxNali1qm6l+aPdrDYefaocFMvV +/lNFRkqpU1dBa3qFQKcnhxW4ioUhTBJPUOVffJFZ0koagMhIeYEl4mF2m6erNZf iwS0V/RO2rxE7te7PkC7oh9JCSz6nFPXye/+lmy7Y7HUhxoK4YhYOA== -----END RSA PRIVATE KEY-----
-                    secretName: mengningsoftware-tls
-            replicas: 2
-            resources:
-              cpu: "500m"
-              memory: "512Mi"
-            service:
-              enabled: true
-              type: ClusterIP
-              ports:
-                - name: http
-                  port: 80
-                  protocol: TCP
-                  targetPort: http
-            template:
-              type: stateless
-              image: ${DOCKER_REGISTRY_ADDRESS}/${DOCKER_REPOSITORY_ARTIFACT}:latest
-              ports:
-                - name: http
-                  port: 80
-                  protocol: TCP
-          EOF
+          # 创建或更新 TLS Secret（在 istio-system 命名空间）
+          # Secret 名称: mengningsoftware-tls
+          echo "$TLS_CERTIFICATE" > /tmp/tls.crt
+          echo "$TLS_PRIVATE_KEY" > /tmp/tls.key
+          kubectl create secret tls mengningsoftware-tls \
+            --cert=/tmp/tls.crt \
+            --key=/tmp/tls.key \
+            -n istio-system \
+            --dry-run=client -o yaml | kubectl apply -f -
+          rm -f /tmp/tls.crt /tmp/tls.key
+
+          # 替换 Application YAML 中的镜像地址变量并应用
+          sed "s|\${DOCKER_REGISTRY_ADDRESS}|${DOCKER_REGISTRY_ADDRESS}|g; s|\${DOCKER_REPOSITORY_ARTIFACT}|${DOCKER_REPOSITORY_ARTIFACT}|g" \
+            .gitea/workflows/application.yaml > /tmp/application-crd.yaml
 
           # 删除旧的 Application CRD（如果存在，忽略错误）
           kubectl delete application mengningsoftware -n web-servers --ignore-not-found=true || true