[codex] Add digest-safe k3s update-center assets (#326)

* Add digest-safe k3s update-center assets

* Harden k3s update-center assets

* Trim k3s env secret names safely

deploy/k3s/chart/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: metapi
+description: Minimal metapi chart for digest-aware k3s update-center setups
+type: application
+version: 0.1.0
+appVersion: "1.2.3"

deploy/k3s/chart/templates/_helpers.tpl

@@ -0,0 +1,27 @@
+{{- define "metapi.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "metapi.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := include "metapi.name" . -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "metapi.envSecretName" -}}
+{{- printf "%s-env" (include "metapi.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "metapi.labels" -}}
+app.kubernetes.io/name: {{ include "metapi.name" . }}
+helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}

deploy/k3s/chart/templates/deployment.yaml

@@ -0,0 +1,59 @@
+{{- if and .Values.persistence.hostPath (gt (int .Values.replicaCount) 1) -}}
+{{- fail "deploy/k3s/chart uses node-local hostPath storage; keep replicaCount at 1 or switch persistence.hostPath to shared storage before scaling" -}}
+{{- end }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "metapi.fullname" . }}
+  labels:
+    {{- include "metapi.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: {{ .Values.deployment.strategy.maxSurge }}
+      maxUnavailable: {{ .Values.deployment.strategy.maxUnavailable }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "metapi.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "metapi.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      annotations:
+        metapi/image-tag: {{ .Values.image.tag | quote }}
+        metapi/image-digest: {{ .Values.image.digest | quote }}
+        checksum/env-secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum | quote }}
+    spec:
+      containers:
+        - name: metapi
+          image: "{{ .Values.image.repository }}{{ if .Values.image.digest }}@{{ .Values.image.digest }}{{ else }}:{{ .Values.image.tag }}{{ end }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          envFrom:
+            - secretRef:
+                name: {{ include "metapi.envSecretName" . }}
+          ports:
+            - name: http
+              containerPort: 4000
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 20
+          volumeMounts:
+            - name: metapi-data
+              mountPath: /app/data
+      volumes:
+        - name: metapi-data
+          hostPath:
+            path: {{ .Values.persistence.hostPath }}
+            type: DirectoryOrCreate

deploy/k3s/chart/templates/secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "metapi.envSecretName" . }}
+  labels:
+    {{- include "metapi.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  AUTH_TOKEN: {{ required "env.authToken is required" .Values.env.authToken | quote }}
+  PROXY_TOKEN: {{ required "env.proxyToken is required" .Values.env.proxyToken | quote }}
+  DB_TYPE: {{ .Values.env.dbType | quote }}
+  {{- if eq (lower (toString .Values.env.dbType)) "sqlite" }}
+  DB_URL: {{ default "./data/hub.db" .Values.env.dbUrl | quote }}
+  {{- else }}
+  DB_URL: {{ required "env.dbUrl is required when env.dbType is mysql/postgres" .Values.env.dbUrl | quote }}
+  {{- end }}
+  DB_SSL: {{ .Values.env.dbSsl | quote }}
+  DATA_DIR: {{ .Values.env.dataDir | quote }}
+  PORT: {{ .Values.env.port | quote }}
+  TZ: {{ .Values.env.tz | quote }}
+  CHECKIN_CRON: {{ .Values.env.checkinCron | quote }}
+  BALANCE_REFRESH_CRON: {{ .Values.env.balanceRefreshCron | quote }}
+  DEPLOY_HELPER_TOKEN: {{ .Values.env.deployHelperToken | quote }}

deploy/k3s/chart/templates/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "metapi.fullname" . }}
+  labels:
+    {{- include "metapi.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    app.kubernetes.io/name: {{ include "metapi.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+      {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) .Values.service.nodePort }}
+      nodePort: {{ .Values.service.nodePort }}
+      {{- end }}

deploy/k3s/chart/values.yaml

@@ -0,0 +1,33 @@
+replicaCount: 1
+
+image:
+  repository: 1467078763/metapi
+  tag: latest
+  digest: ""
+  pullPolicy: Always
+
+service:
+  type: NodePort
+  port: 4000
+  nodePort: 30400
+
+deployment:
+  strategy:
+    maxSurge: 1
+    maxUnavailable: 0
+
+persistence:
+  hostPath: /opt/1panel/docker/compose/metapihub/data
+
+env:
+  authToken: ""
+  proxyToken: ""
+  dbType: postgres
+  dbUrl: ""
+  dbSsl: "false"
+  dataDir: /app/data
+  port: "4000"
+  tz: Asia/Shanghai
+  checkinCron: "0 8 * * *"
+  balanceRefreshCron: "0 * * * *"
+  deployHelperToken: ""