用 Kubernetes 与 GitOps 搭建云原生内部开发者平台：从集群到软件供应链的安全闭环

# argocd-appset.yaml — 按集群+环境自动生成 Application
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: frontend-services
  namespace: argocd
spec:
  generators:
    - matrix:
        generators:
          - list:
              elements:
                - cluster: dev
                  url: https://k8s-dev.example.com
                - cluster: staging
                  url: https://k8s-staging.example.com
                - cluster: prod
                  url: https://k8s-prod.example.com
          - git:
              repoURL: https://git.example.com/platform/env-templates
              files:
                - path: "frontend/**/*.yaml"
  template:
    metadata:
      name: '{{cluster}}-frontend-{{path.basename}}'
    spec:
      project: frontend
      source:
        repoURL: https://git.example.com/apps/frontend
        targetRevision: main
        path: '{{path.basename}}'
      destination:
        server: '{{url}}'
        namespace: frontend-{{cluster}}
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true

# 在已安装 ArgoCD 的集群上执行
kubectl apply -f argocd-appset.yaml

# 查看生成的 Applications
argocd app list --project frontend

# CI 中构建并推送镜像后，用 Cosign 签名
export COSIGN_EXPERIMENTAL=1
cosign sign \
  --key cosign.key \
  registry.example.com/frontend:v1.2.3

# 签名记录会存入 OCI registry 的 referrers tag
cosign verify \
  --key cosign.pub \
  registry.example.com/frontend:v1.2.3

# kyverno-verify-image.yaml — 阻止未签名镜像启动
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-frontend-images
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-signature
      match:
        any:
          - resources:
              kinds:
                - Deployment
                - StatefulSet
              namespaces:
                - frontend-dev
                - frontend-staging
                - frontend-prod
      verifyImages:
        - imageReferences:
            - "registry.example.com/frontend/*"
          attestors:
            - entries:
                - keys:
                    public: |-
                      -----BEGIN PUBLIC KEY-----
                      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
                      -----END PUBLIC KEY-----
          attestations:
            - type: https://example.com/provenance
              conditions:
                - all:
                    - key: "{{ ci_pipeline }}"
                      operator: Equals
                      value: "frontend-ci"

# 安装 Kyverno（如果集群尚未安装）
kubectl create namespace kyverno
helm repo add kyverno https://kyverno.github.io/kyverno/
helm repo update
helm install kyverno kyverno/kyverno -n kyverno

# 部署准入策略
kubectl apply -f kyverno-verify-image.yaml

# 测试：部署一个未签名镜像，应被拒绝
kubectl run test-unsigned --image=registry.example.com/frontend:v0.0.1 -n frontend-dev
# 预期输出：Error from server: admission webhook "verify-frontend-images.kyverno.svc" denied the request

# backstage-template.yaml — 创建新前端服务的模板
apiVersion: scaffolder.backstage.io/v1
kind: Template
metadata:
  name: frontend-service
  title: Frontend Service Template
spec:
  owner: platform-team
  type: service
  parameters:
    - title: Service Info
      required:
        - serviceName
        - owner
      properties:
        serviceName:
          title: Service Name
          type: string
          pattern: '^[a-z][a-z0-9-]{4,20}$'
        owner:
          title: Team
          type: string
          ui:field: OwnerPicker
  steps:
    - id: scaffold
      name: Generate Skeleton
      action: fetch:template
      input:
        url: ./skeleton
        values:
          serviceName: '{{parameters.serviceName}}'
          owner: '{{parameters.owner}}'
    - id: publish
      name: Push to Git
      action: publish:gitlab
      input:
        repoUrl: 'gitlab.example.com?owner=apps&repo={{parameters.serviceName}}'
    - id: register
      name: Register in Backstage
      action: catalog:register
      input:
        catalogInfoUrl: 'https://gitlab.example.com/apps/{{parameters.serviceName}}/catalog-info.yaml'
  output:
    links:
      - title: Open Repo
        url: 'https://gitlab.example.com/apps/{{parameters.serviceName}}'