feat(apps/prod/publisher): add delivery-config ConfigMap and bump image tags (#1752)

This pull request introduces support for injecting a delivery
configuration file into the publisher deployments for both production
and staging environments. The main changes include adding a `ConfigMap`
for delivery configuration, updating deployment manifests to mount this
config, and updating application configuration to reference the new file
and mirror names.

**ConfigMap and Deployment Updates:**

* Added a `configMapGenerator` for `delivery-config` in
`kustomization.yaml`, which sources the configuration from
`config.json`. This allows for centralized management of delivery config
data.
* Updated both `release-prod-mirror.yaml` and
`release-staging-mirror.yaml` to mount the `delivery-config` ConfigMap
as a volume at `/etc/config/delivery-config.yaml`, ensuring the
application can read its delivery configuration at runtime.
[[1]](diffhunk://#diff-a743ba791ced94bd1be5ae9178788eda89579a42e5deb14e63c98148185bbf44R42-R53)
[[2]](diffhunk://#diff-6b8d2314aa062e2bcd25495e358ca973d789ea7113fb0f9e539d0e41913e32bcR44-R55)
* Updated the image tag for publisher deployments to a newer version in
both production and staging manifests.
[[1]](diffhunk://#diff-a743ba791ced94bd1be5ae9178788eda89579a42e5deb14e63c98148185bbf44L28-R28)
[[2]](diffhunk://#diff-6b8d2314aa062e2bcd25495e358ca973d789ea7113fb0f9e539d0e41913e32bcL28-R28)

**Application Configuration Updates:**

* Modified both production and staging external secrets configuration
files to reference the new delivery config file path in the `tiup`
service section.
[[1]](diffhunk://#diff-c25037403eaf37c2a6e5cb413a64753299d6021a7f61cac12508325ecc6042b0R26-R28)
[[2]](diffhunk://#diff-97f2467e2edadfe8bc005756c9e68c8f0b8867a0c7b51cd35349c36f043534beR26-R28)
* Added explicit `mirror_name` values for both environments in the
`tiup` options, improving clarity and environment-specific
configuration.
[[1]](diffhunk://#diff-c25037403eaf37c2a6e5cb413a64753299d6021a7f61cac12508325ecc6042b0R38)
[[2]](diffhunk://#diff-97f2467e2edadfe8bc005756c9e68c8f0b8867a0c7b51cd35349c36f043534beR38)

Author: wuhuizuo

apps/prod2/publisher/kustomization.yaml

@@ -4,5 +4,4 @@ namespace: publisher
 resources:
   - namespace.yaml
   - pre.yaml
-  - release-prod-mirror.yaml
-  - release-staging-mirror.yaml
+  - releases.yaml

apps/prod2/publisher/pre/config.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: publisher-packages-config
+spec:
+  targetNamespace: publisher
+  interval: 5m0s
+  sourceRef:
+    kind: GitRepository
+    name: artifacts
+    namespace: flux-system
+  path: ./packages
+  prune: true

apps/prod2/publisher/pre/external-secrets/publisher-config-prod.yaml

@@ -23,6 +23,9 @@ spec:
             addr: "redis-master:6379"
             db: 0
             password: {{ .redis_password }}
+          services:
+            tiup:
+              delivery_config_file: "/etc/config/delivery.yaml" # should load from config map
         worker.yaml: |
           tiup:
             kafka:
@@ -32,6 +35,7 @@ spec:
               consumer_group: publisher-prod-tiup
 
             options:
+              mirror_name: prod
               mirror_url: {{ .tiup_mirror_url}}
               lark_webhook_url: {{ .lark_webhook_url }}
               nightly_interval: 12h

apps/prod2/publisher/pre/external-secrets/publisher-config-staging.yaml

@@ -23,6 +23,9 @@ spec:
             addr: "redis-master:6379"
             db: 0
             password: {{ .redis_password }}
+          services:
+            tiup:
+              delivery_config_file: "/etc/config/delivery.yaml" # should load from config map
         worker.yaml: |
           tiup:
             kafka:
@@ -32,6 +35,7 @@ spec:
               consumer_group: publisher-staging-tiup
 
             options:
+              mirror_name: staging
               mirror_url: {{ .tiup_mirror_url}}
               lark_webhook_url: {{ .lark_webhook_url }}
               nightly_interval: 12h

apps/prod2/publisher/pre/kustomization.yaml

@@ -2,6 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: publisher
 resources:
+  # Please do not change the order of these resources.
   - redis
   - kafka
+  - config.yaml
   - external-secrets

apps/prod2/publisher/releases.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: publisher-releases
+spec:
+  dependsOn:
+    - name: publisher-pre
+  targetNamespace: publisher
+  interval: 5m0s
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  path: ./apps/prod2/publisher/releases
+  prune: true

apps/prod2/publisher/releases/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - prod-mirror.yaml
+  - staging-mirror.yaml

…prod2/publisher/release-prod-mirror.yaml …rod2/publisher/releases/prod-mirror.yamlapps/prod2/publisher/release-prod-mirror.yaml renamed to apps/prod2/publisher/releases/prod-mirror.yaml apps/prod2/publisher/release-prod-mirror.yaml renamed to apps/prod2/publisher/releases/prod-mirror.yaml

@@ -25,7 +25,7 @@ spec:
     # Additional volumes on the output Deployment definition.
     image:
       # renovate: datasource=docker depName=ghcr.io/pingcap-qe/ee-apps/publisher versioning=semver
-      tag: v2025.11.2-1-g43046ac
+      tag: v2025.11.30-2-gde42167
     servers:
       publisher:
         config:
@@ -39,11 +39,17 @@ spec:
       - name: tiup-credentials
         secret:
           secretName: tiup-credentials-prod
+      - name: packages-config
+        configMap:
+          name: packages-config
     volumeMounts:
       - name: tiup-credentials
         subPath: private.json
         mountPath: /root/.tiup/keys/private.json
         readOnly: true
+      - name: packages-config
+        mountPath: /etc/config
+        readOnly: true
     ingress:
       enabled: true
       className: "nginx"

…d2/publisher/release-staging-mirror.yaml …2/publisher/releases/staging-mirror.yamlapps/prod2/publisher/release-staging-mirror.yaml renamed to apps/prod2/publisher/releases/staging-mirror.yaml apps/prod2/publisher/release-staging-mirror.yaml renamed to apps/prod2/publisher/releases/staging-mirror.yaml

@@ -25,7 +25,7 @@ spec:
     # Additional volumes on the output Deployment definition.
     image:
       # renovate: datasource=docker depName=ghcr.io/pingcap-qe/ee-apps/publisher versioning=semver
-      tag: v2025.11.2-1-g43046ac
+      tag: v2025.11.30-2-gde42167
     servers:
       publisher:
         config:
@@ -41,11 +41,17 @@ spec:
       - name: tiup-credentials
         secret:
           secretName: tiup-credentials-staging
+      - name: packages-config
+        configMap:
+          name: packages-config
     volumeMounts:
       - name: tiup-credentials
         subPath: private.json
         mountPath: /root/.tiup/keys/private.json
         readOnly: true
+      - name: packages-config
+        mountPath: /etc/config
+        readOnly: true
     ingress:
       enabled: true
       className: "nginx"

clusters/prod2/sources.yaml

@@ -8,3 +8,14 @@ spec:
   ref:
     branch: main
   url: https://github.com/PingCAP-QE/ci.git
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: GitRepository
+metadata:
+  name: artifacts
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: main
+  url: https://github.com/PingCAP-QE/artifacts.git