diff --git a/.gitea/workflows/sync-consul.yml b/.gitea/workflows/sync-consul.yml index e50f68d..033c946 100644 --- a/.gitea/workflows/sync-consul.yml +++ b/.gitea/workflows/sync-consul.yml @@ -38,7 +38,9 @@ jobs: ls -la /etc/rancher/k3s/ /root/.kube/ 2>/dev/null || true exit 1 fi - export RESTART_APIS=1 + # 暂时关闭改配置后自动重启 API + # export RESTART_APIS=1 + export RESTART_APIS=0 REPO="${{ gitea.repository }}" SHA="${{ gitea.sha }}" diff --git a/README.md b/README.md index 76f6fb8..9b7b6e4 100644 --- a/README.md +++ b/README.md @@ -89,13 +89,20 @@ Consul **不要**走公网 Ingress；集群内业务仍用 `consul.test.svc:8500 ## 密钥来源 -| 占位符 | Secret（在目标 NAMESPACE 内） | -|--------|------------------------------| -| `${MYSQL_ROOT_PASSWORD}` | `prod-credentials` | -| `${REDIS_PASSWORD}` | `prod-credentials` | -| `${RABBITMQ_DEFAULT_PASS}` | `prod-credentials` | -| `${ELASTIC_PASSWORD}` | `prod-credentials` | -| `${JWT_SECRET_KEY}` | `jwt-secret` 或 `prod-credentials` | +| 占位符 | Secret（在目标 NAMESPACE 内 `prod-credentials`） | +|--------|--------------------------------------------------| +| `${MYSQL_ROOT_PASSWORD}` | MYSQL_ROOT_PASSWORD | +| `${REDIS_PASSWORD}` | REDIS_PASSWORD | +| `${RABBITMQ_DEFAULT_PASS}` | RABBITMQ_DEFAULT_PASS | +| `${ELASTIC_PASSWORD}` | ELASTIC_PASSWORD | +| `${JWT_SECRET_KEY}` | JWT_SECRET_KEY（或单独 `jwt-secret`） | +| `${COS_SECRET_ID}` / `${COS_SECRET_KEY}` | COS_* | +| `${FEISHU_WEBHOOK}` | FEISHU_WEBHOOK | +| `${WECHAT_MP_*}` | WECHAT_MP_APP_ID / SECRET / TOKEN | +| `${OMS_TRACK_*}` | OMS_TRACK_APP_KEY / SECRET | +| `${LAZADA_*}` `${SHOPEE_*}` `${TIKTOK_*}` `${TEMU_*}` | 对应平台密钥 | + +同步后 **默认不再** `rollout restart`（已暂时关闭）；需要时手动 restart 或恢复脚本里注释块。 ## 注意 diff --git a/idwms/admin.json b/idwms/admin.json index 28da580..0bd91d6 100644 --- a/idwms/admin.json +++ b/idwms/admin.json @@ -2,16 +2,19 @@ "App": { "Urls": [ "http://*:5281" + ], + "CorsOrigins": [ + "https://app.test.ideship.com" ] }, "AllowedHosts": "*", "ConnectionStrings": { - "Default": "server=mysql.test.svc.cluster.local;database=fake_simple_admin;uid=dev;pwd=itd!@#123;charset=utf8mb4;", - "Rbac": "server=mysql.test.svc.cluster.local;database=fake_simple_admin;uid=dev;pwd=itd!@#123;charset=utf8mb4;" + "Default": "server=mysql.test.svc.cluster.local;database=fake_simple_admin;uid=dev;pwd=${MYSQL_ROOT_PASSWORD};charset=utf8mb4;", + "Rbac": "server=mysql.test.svc.cluster.local;database=fake_simple_admin;uid=dev;pwd=${MYSQL_ROOT_PASSWORD};charset=utf8mb4;" }, "Redis": { "Host": "redis.test.svc.cluster.local:6379", - "Password": "itd!@#123", + "Password": "${REDIS_PASSWORD}", "MaxPoolSize": 1000, "Database": 0, "Prefix": "" @@ -22,7 +25,7 @@ "HostName": "rabbitmq.test.svc.cluster.local", "Port": 5672, "UserName": "rabbit", - "Password": "itd!@#123", + "Password": "${RABBITMQ_DEFAULT_PASS}", "DispatchConsumersAsync": true } }, @@ -39,9 +42,9 @@ }, "WeChat": { "Mp": { - "AppId": "wxd5141ba46c856e1f", - "Secret": "379f51a89419dc36fbb9167feef6f89a", - "Token": "c6ca74013df823c0e1da0feaaaf8bf66", + "AppId": "${WECHAT_MP_APP_ID}", + "Secret": "${WECHAT_MP_SECRET}", + "Token": "${WECHAT_MP_TOKEN}", "EncodingAesKey": "", "OAuthRedirectBase": "https://app.test.ideship.com" } @@ -55,8 +58,8 @@ "TrackService": { "Enabled": true, "BaseUrl": "https://api.test.ideship.com/track", - "AppKey": "W2606001", - "AppSecret": "ziK8UzlQ39m3kdL346XEBg8nljY8os52", + "AppKey": "${OMS_TRACK_APP_KEY}", + "AppSecret": "${OMS_TRACK_APP_SECRET}", "TimeoutSeconds": 30 }, "Itfx": { @@ -66,28 +69,28 @@ "PlatformShop": { "FrontendBaseUrl": "https://app.test.ideship.com", "Lazada": { - "AppKey": "123631", - "AppSecret": "7vBz2EaD6rIupeGEfwrgkabsTNsXt2ix", + "AppKey": "${LAZADA_APP_KEY}", + "AppSecret": "${LAZADA_APP_SECRET}", "AuthorizeUrl": "https://auth.lazada.com/oauth/authorize", "AccessTokenUrl": "https://auth.lazada.com/rest" }, "Shopee": { - "PartnerId": 2004112, - "PartnerKey": "2f385d7ea38b087d5d71f7292e06a09c9f19022ca6c3f60ec0110a8214ef7d65", + "PartnerId": ${SHOPEE_PARTNER_ID}, + "PartnerKey": "${SHOPEE_PARTNER_KEY}", "HostUrl": "https://openplatform.shopee.cn", "HostAuthUrl": "https://partner.shopeemobile.com" }, "Tiktok": { - "AppKey": "6hc64lc6vl312", - "AppSecret": "5a691a96ee6d844534769bab5c21de1f848fb678", + "AppKey": "${TIKTOK_APP_KEY}", + "AppSecret": "${TIKTOK_APP_SECRET}", "HostAuth": "https://auth.tiktok-shops.com", "HostApi": "https://open-api.tiktokglobalshop.com" }, "Temu": { - "AppKey": "4ebbc9190ae410443d65b4c2faca981f", - "AppSecret": "4782d2d827276688bf4758bed55dbdd4bbe79a79", + "AppKey": "${TEMU_APP_KEY}", + "AppSecret": "${TEMU_APP_SECRET}", "HostAuthUrl": "https://openapi-b-us.temu.com/openapi/router" } } } -} \ No newline at end of file +} diff --git a/idwms/common.json b/idwms/common.json index 4280165..e5a61f1 100644 --- a/idwms/common.json +++ b/idwms/common.json @@ -1,7 +1,7 @@ { "App": { "CorsOrigins": [ - "https://test.ideship.com" + "https://app.test.ideship.com" ] }, "Serilog": { @@ -42,7 +42,7 @@ ] }, "FeiShuNotice": { - "Webhook": "https://open.feishu.cn/open-apis/bot/v2/hook/94e24bce-619d-4b3b-936c-e206353ce802", + "Webhook": "${FEISHU_WEBHOOK}", "BatchSize": 10, "BatchIntervalSeconds": 10, "EnableFeiShuExceptionSubscribe": true, @@ -52,7 +52,7 @@ "MaxLength": 3000 }, "JwtSettings": { - "SecretKey": "YourSuperSecretKeyThatIsAtLeast32CharactersLong!", + "SecretKey": "${JWT_SECRET_KEY}", "Issuer": "SimpleAdmin", "Audience": "SimpleAdminClient", "ExpiryInMinutes": 600, @@ -61,8 +61,8 @@ "FileStorage": { "Provider": "Cos", "Cos": { - "SecretId": "AKIDdOxIOGuKVSAetteBTbZLtCG6i5D6k9JE", - "SecretKey": "kEWbWDPPAhz2qQq4FF5kBOXTAcpnkY8U", + "SecretId": "${COS_SECRET_ID}", + "SecretKey": "${COS_SECRET_KEY}", "Region": "ap-guangzhou", "Bucket": "ideship-1308574410", "BaseUrl": "https://cos.ideship.com", @@ -76,8 +76,8 @@ "SignUrlsByDefault": true, "DefaultSignedUrlExpiresSeconds": 900, "TencentCos": { - "SecretId": "AKIDdOxIOGuKVSAetteBTbZLtCG6i5D6k9JE", - "SecretKey": "kEWbWDPPAhz2qQq4FF5kBOXTAcpnkY8U", + "SecretId": "${COS_SECRET_ID}", + "SecretKey": "${COS_SECRET_KEY}", "Region": "ap-guangzhou", "Bucket": "ideship-1308574410", "BaseUrl": "https://cos.ideship.com", @@ -85,4 +85,4 @@ "SignUrls": true } } -} \ No newline at end of file +} diff --git a/idwms/itfxapi.json b/idwms/itfxapi.json index bd54a89..6e4e6be 100644 --- a/idwms/itfxapi.json +++ b/idwms/itfxapi.json @@ -19,11 +19,11 @@ "KeyPrefix": "itfx" }, "ConnectionStrings": { - "Default": "server=mysql.test.svc.cluster.local;database=interface_forward;uid=dev;pwd=itd!@#123;charset=utf8mb4;" + "Default": "server=mysql.test.svc.cluster.local;database=interface_forward;uid=dev;pwd=${MYSQL_ROOT_PASSWORD};charset=utf8mb4;" }, "Redis": { "Host": "redis.test.svc.cluster.local:6379", - "Password": "itd!@#123", + "Password": "${REDIS_PASSWORD}", "MaxPoolSize": 1000, "Database": 0, "Prefix": "" @@ -34,7 +34,7 @@ "HostName": "rabbitmq.test.svc.cluster.local", "Port": 5672, "UserName": "rabbit", - "Password": "itd!@#123", + "Password": "${RABBITMQ_DEFAULT_PASS}", "DispatchConsumersAsync": true } } @@ -42,7 +42,7 @@ "ElasticSearch": { "NodeUrls": [ "http://es.test.svc.cluster.local:9200" ], "LoginName": "elastic", - "Password": "itd!@#123", + "Password": "${ELASTIC_PASSWORD}", "ShowLogInfo": false, "IndexPrefix": "" } diff --git a/idwms/trackapi.json b/idwms/trackapi.json index 33e9d3b..0349fa0 100644 --- a/idwms/trackapi.json +++ b/idwms/trackapi.json @@ -15,11 +15,11 @@ "TrackPullTaskMinuteInterval": 5 }, "ConnectionStrings": { - "Default": "server=mysql.test.svc.cluster.local;database=track_center;uid=dev;pwd=itd!@#123;charset=utf8mb4;" + "Default": "server=mysql.test.svc.cluster.local;database=track_center;uid=dev;pwd=${MYSQL_ROOT_PASSWORD};charset=utf8mb4;" }, "Redis": { "Host": "redis.test.svc.cluster.local:6379", - "Password": "itd!@#123", + "Password": "${REDIS_PASSWORD}", "MaxPoolSize": 1000, "Database": 1, "Prefix": "" @@ -30,7 +30,7 @@ "HostName": "rabbitmq.test.svc.cluster.local", "Port": 5672, "UserName": "rabbit", - "Password": "itd!@#123", + "Password": "${RABBITMQ_DEFAULT_PASS}", "DispatchConsumersAsync": true } } @@ -38,7 +38,7 @@ "ElasticSearch": { "NodeUrls": [ "http://es.test.svc.cluster.local:9200" ], "LoginName": "elastic", - "Password": "itd!@#123", + "Password": "${ELASTIC_PASSWORD}", "ShowLogInfo": false, "IndexPrefix": "" }, diff --git a/scripts/sync-to-consul.sh b/scripts/sync-to-consul.sh index 8bc4d11..2d6ec6d 100644 --- a/scripts/sync-to-consul.sh +++ b/scripts/sync-to-consul.sh @@ -138,14 +138,45 @@ load_secret REDIS_PASSWORD prod-credentials REDIS_PASSWORD load_secret RABBITMQ_DEFAULT_PASS prod-credentials RABBITMQ_DEFAULT_PASS load_secret ELASTIC_PASSWORD prod-credentials ELASTIC_PASSWORD load_secret JWT_SECRET_KEY jwt-secret JWT_SECRET_KEY -# 兼容：JWT 也放在 prod-credentials load_secret JWT_SECRET_KEY prod-credentials JWT_SECRET_KEY +load_secret COS_SECRET_ID prod-credentials COS_SECRET_ID +load_secret COS_SECRET_KEY prod-credentials COS_SECRET_KEY +load_secret FEISHU_WEBHOOK prod-credentials FEISHU_WEBHOOK +load_secret WECHAT_MP_APP_ID prod-credentials WECHAT_MP_APP_ID +load_secret WECHAT_MP_SECRET prod-credentials WECHAT_MP_SECRET +load_secret WECHAT_MP_TOKEN prod-credentials WECHAT_MP_TOKEN +load_secret OMS_TRACK_APP_KEY prod-credentials OMS_TRACK_APP_KEY +load_secret OMS_TRACK_APP_SECRET prod-credentials OMS_TRACK_APP_SECRET +load_secret LAZADA_APP_KEY prod-credentials LAZADA_APP_KEY +load_secret LAZADA_APP_SECRET prod-credentials LAZADA_APP_SECRET +load_secret SHOPEE_PARTNER_ID prod-credentials SHOPEE_PARTNER_ID +load_secret SHOPEE_PARTNER_KEY prod-credentials SHOPEE_PARTNER_KEY +load_secret TIKTOK_APP_KEY prod-credentials TIKTOK_APP_KEY +load_secret TIKTOK_APP_SECRET prod-credentials TIKTOK_APP_SECRET +load_secret TEMU_APP_KEY prod-credentials TEMU_APP_KEY +load_secret TEMU_APP_SECRET prod-credentials TEMU_APP_SECRET : "${MYSQL_ROOT_PASSWORD:?缺少 MYSQL_ROOT_PASSWORD（env 或 secret/${NS}/prod-credentials）}" : "${REDIS_PASSWORD:?缺少 REDIS_PASSWORD}" : "${RABBITMQ_DEFAULT_PASS:?缺少 RABBITMQ_DEFAULT_PASS}" : "${ELASTIC_PASSWORD:?缺少 ELASTIC_PASSWORD}" : "${JWT_SECRET_KEY:?缺少 JWT_SECRET_KEY（请创建 secret/jwt-secret 或写入 prod-credentials）}" +: "${COS_SECRET_ID:?缺少 COS_SECRET_ID}" +: "${COS_SECRET_KEY:?缺少 COS_SECRET_KEY}" +: "${FEISHU_WEBHOOK:?缺少 FEISHU_WEBHOOK}" +: "${WECHAT_MP_APP_ID:?缺少 WECHAT_MP_APP_ID}" +: "${WECHAT_MP_SECRET:?缺少 WECHAT_MP_SECRET}" +: "${WECHAT_MP_TOKEN:?缺少 WECHAT_MP_TOKEN}" +: "${OMS_TRACK_APP_KEY:?缺少 OMS_TRACK_APP_KEY}" +: "${OMS_TRACK_APP_SECRET:?缺少 OMS_TRACK_APP_SECRET}" +: "${LAZADA_APP_KEY:?缺少 LAZADA_APP_KEY}" +: "${LAZADA_APP_SECRET:?缺少 LAZADA_APP_SECRET}" +: "${SHOPEE_PARTNER_ID:?缺少 SHOPEE_PARTNER_ID}" +: "${SHOPEE_PARTNER_KEY:?缺少 SHOPEE_PARTNER_KEY}" +: "${TIKTOK_APP_KEY:?缺少 TIKTOK_APP_KEY}" +: "${TIKTOK_APP_SECRET:?缺少 TIKTOK_APP_SECRET}" +: "${TEMU_APP_KEY:?缺少 TEMU_APP_KEY}" +: "${TEMU_APP_SECRET:?缺少 TEMU_APP_SECRET}" # Consul：prod 用 ClusterIP（runner 在簇内）；test 用内网 NodePort（见 consul-ci / TEST_CONSUL_HTTP_ADDR） if [[ -z "$CONSUL_HTTP_ADDR" ]]; then @@ -208,8 +239,15 @@ for name in "${TARGETS[@]}"; do [[ -f "$src" ]] || { echo "FAIL: 无 ${src}"; exit 1; } # 仅替换已知占位符，避免 JSON 里其它 $ 被误伤 - export MYSQL_ROOT_PASSWORD REDIS_PASSWORD RABBITMQ_DEFAULT_PASS ELASTIC_PASSWORD JWT_SECRET_KEY - envsubst '${MYSQL_ROOT_PASSWORD} ${REDIS_PASSWORD} ${RABBITMQ_DEFAULT_PASS} ${ELASTIC_PASSWORD} ${JWT_SECRET_KEY}' \ + export MYSQL_ROOT_PASSWORD REDIS_PASSWORD RABBITMQ_DEFAULT_PASS ELASTIC_PASSWORD JWT_SECRET_KEY \ + COS_SECRET_ID COS_SECRET_KEY FEISHU_WEBHOOK \ + WECHAT_MP_APP_ID WECHAT_MP_SECRET WECHAT_MP_TOKEN \ + OMS_TRACK_APP_KEY OMS_TRACK_APP_SECRET \ + LAZADA_APP_KEY LAZADA_APP_SECRET \ + SHOPEE_PARTNER_ID SHOPEE_PARTNER_KEY \ + TIKTOK_APP_KEY TIKTOK_APP_SECRET \ + TEMU_APP_KEY TEMU_APP_SECRET + envsubst '${MYSQL_ROOT_PASSWORD} ${REDIS_PASSWORD} ${RABBITMQ_DEFAULT_PASS} ${ELASTIC_PASSWORD} ${JWT_SECRET_KEY} ${COS_SECRET_ID} ${COS_SECRET_KEY} ${FEISHU_WEBHOOK} ${WECHAT_MP_APP_ID} ${WECHAT_MP_SECRET} ${WECHAT_MP_TOKEN} ${OMS_TRACK_APP_KEY} ${OMS_TRACK_APP_SECRET} ${LAZADA_APP_KEY} ${LAZADA_APP_SECRET} ${SHOPEE_PARTNER_ID} ${SHOPEE_PARTNER_KEY} ${TIKTOK_APP_KEY} ${TIKTOK_APP_SECRET} ${TEMU_APP_KEY} ${TEMU_APP_SECRET}' \ <"$src" >"${TMP}/${name}.json" # 禁止未替换的占位符漏网（注释里的 ${...} 也会拦） @@ -236,19 +274,22 @@ for name in "${TARGETS[@]}"; do esac done +# 暂时关闭：改配置后自动 rollout restart API（需要时把下面取消注释，或 CI 设 RESTART_APIS=1） +# if [[ "$RESTART_APIS" == "1" ]]; then +# readarray -t RESTART_SET < <(printf '%s\n' "${RESTART_SET[@]}" | sort -u) +# echo "==> rollout restart: ${RESTART_SET[*]}" +# for d in "${RESTART_SET[@]}"; do +# [[ -n "$d" ]] || continue +# if kubectl -n "$NS" get "deploy/${d}" >/dev/null 2>&1; then +# kubectl -n "$NS" rollout restart "deploy/${d}" +# kubectl -n "$NS" rollout status "deploy/${d}" --timeout=180s || true +# else +# echo "SKIP deploy/${d}（不存在）" +# fi +# done +# fi if [[ "$RESTART_APIS" == "1" ]]; then - # 去重 - readarray -t RESTART_SET < <(printf '%s\n' "${RESTART_SET[@]}" | sort -u) - echo "==> rollout restart: ${RESTART_SET[*]}" - for d in "${RESTART_SET[@]}"; do - [[ -n "$d" ]] || continue - if kubectl -n "$NS" get "deploy/${d}" >/dev/null 2>&1; then - kubectl -n "$NS" rollout restart "deploy/${d}" - kubectl -n "$NS" rollout status "deploy/${d}" --timeout=180s || true - else - echo "SKIP deploy/${d}（不存在）" - fi - done + echo "==> SKIP rollout restart（已暂时关闭；RESTART_APIS=1 被忽略）" fi echo "DONE"