diff --git a/pkg/core/deployer/providers/k8s-secret/k8s_secret.go b/pkg/core/deployer/providers/k8s-secret/k8s_secret.go
index b70e81d4a..93e23f75c 100644
--- a/pkg/core/deployer/providers/k8s-secret/k8s_secret.go
+++ b/pkg/core/deployer/providers/k8s-secret/k8s_secret.go
@@ -7,13 +7,13 @@ import (
 	"strings"
 
 	k8score "k8s.io/api/core/v1"
-	k8serrors "k8s.io/apimachinery/pkg/api/errors"
-	k8smeta "k8s.io/apimachinery/pkg/apis/meta/v1"
-	k8stypedcore "k8s.io/client-go/kubernetes/typed/core/v1"
+	k8serrs "k8s.io/apimachinery/pkg/api/errors"
+	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
 
 	"github.com/certimate-go/certimate/pkg/core/deployer"
+	typedcore "github.com/certimate-go/certimate/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1"
 	xcert "github.com/certimate-go/certimate/pkg/utils/cert"
 )
 
@@ -111,18 +111,18 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*dep
 	}
 
 	// 获取 Secret 实例，如果不存在则创建
-	secretPayload, err = client.Secrets(d.config.Namespace).Get(ctx, d.config.SecretName, k8smeta.GetOptions{})
+	secretPayload, err = client.Secrets(d.config.Namespace).Get(ctx, d.config.SecretName, meta.GetOptions{})
 	if err != nil {
-		if !k8serrors.IsNotFound(err) {
+		if !k8serrs.IsNotFound(err) {
 			return nil, fmt.Errorf("failed to get kubernetes secret: %w", err)
 		}
 
 		secretPayload = &k8score.Secret{
-			TypeMeta: k8smeta.TypeMeta{
+			TypeMeta: meta.TypeMeta{
 				Kind:       "Secret",
 				APIVersion: "v1",
 			},
-			ObjectMeta: k8smeta.ObjectMeta{
+			ObjectMeta: meta.ObjectMeta{
 				Name:        d.config.SecretName,
 				Annotations: secretAnnotations,
 				Labels:      secretLabels,
@@ -133,7 +133,7 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*dep
 		secretPayload.Data[d.config.SecretDataKeyForCrt] = []byte(certPEM)
 		secretPayload.Data[d.config.SecretDataKeyForKey] = []byte(privkeyPEM)
 
-		secretPayload, err = client.Secrets(d.config.Namespace).Create(ctx, secretPayload, k8smeta.CreateOptions{})
+		secretPayload, err = client.Secrets(d.config.Namespace).Create(ctx, secretPayload, meta.CreateOptions{})
 		d.logger.Debug("kubernetes operate 'Secrets.Create'", slog.String("namespace", d.config.Namespace), slog.Any("secret", secretPayload))
 		if err != nil {
 			return nil, fmt.Errorf("failed to create kubernetes secret: %w", err)
@@ -163,7 +163,7 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*dep
 	}
 	secretPayload.Data[d.config.SecretDataKeyForCrt] = []byte(certPEM)
 	secretPayload.Data[d.config.SecretDataKeyForKey] = []byte(privkeyPEM)
-	secretPayload, err = client.Secrets(d.config.Namespace).Update(ctx, secretPayload, k8smeta.UpdateOptions{})
+	secretPayload, err = client.Secrets(d.config.Namespace).Update(ctx, secretPayload, meta.UpdateOptions{})
 	d.logger.Debug("kubernetes operate 'Secrets.Update'", slog.String("namespace", d.config.Namespace), slog.Any("secret", secretPayload))
 	if err != nil {
 		return nil, fmt.Errorf("failed to update kubernetes secret: %w", err)
@@ -172,7 +172,7 @@ func (d *Deployer) Deploy(ctx context.Context, certPEM, privkeyPEM string) (*dep
 	return &deployer.DeployResult{}, nil
 }
 
-func createK8sClient(kubeConfig string) (*k8stypedcore.CoreV1Client, error) {
+func createK8sClient(kubeConfig string) (*typedcore.CoreV1Client, error) {
 	var config *rest.Config
 	var err error
 	if kubeConfig == "" {
@@ -188,7 +188,7 @@ func createK8sClient(kubeConfig string) (*k8stypedcore.CoreV1Client, error) {
 		return nil, err
 	}
 
-	client, err := k8stypedcore.NewForConfig(config)
+	client, err := typedcore.NewForConfig(config)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1/core_client.go b/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1/core_client.go
new file mode 100644
index 000000000..f79485ea1
--- /dev/null
+++ b/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1/core_client.go
@@ -0,0 +1,60 @@
+package v1
+
+import (
+	http "net/http"
+
+	corev1 "k8s.io/api/core/v1"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+	rest "k8s.io/client-go/rest"
+)
+
+type CoreV1Interface interface {
+	RESTClient() rest.Interface
+	SecretsGetter
+}
+
+type CoreV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *CoreV1Client) Secrets(namespace string) SecretInterface {
+	return newSecrets(c, namespace)
+}
+
+func NewForConfig(c *rest.Config) (*CoreV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*CoreV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &CoreV1Client{client}, nil
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := corev1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/api"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+func (c *CoreV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1/generated_expansion.go b/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1/generated_expansion.go
new file mode 100644
index 000000000..6e04b689a
--- /dev/null
+++ b/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1/generated_expansion.go
@@ -0,0 +1,7 @@
+package v1
+
+import (
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+)
+
+type SecretExpansion = typedcorev1.SecretExpansion
diff --git a/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1/secret.go b/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1/secret.go
new file mode 100644
index 000000000..0cf99b4b9
--- /dev/null
+++ b/pkg/sdk3rd-trimmed/k8s.io/client-go/kubernetes/typed/core/v1/secret.go
@@ -0,0 +1,31 @@
+package v1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+)
+
+type SecretsGetter = typedcorev1.SecretsGetter
+
+type SecretInterface = typedcorev1.SecretInterface
+
+type secrets struct {
+	*gentype.ClientWithListAndApply[*corev1.Secret, *corev1.SecretList, *applyconfigurationscorev1.SecretApplyConfiguration]
+}
+
+func newSecrets(c *CoreV1Client, namespace string) *secrets {
+	return &secrets{
+		gentype.NewClientWithListAndApply[*corev1.Secret, *corev1.SecretList, *applyconfigurationscorev1.SecretApplyConfiguration](
+			"secrets",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *corev1.Secret { return &corev1.Secret{} },
+			func() *corev1.SecretList { return &corev1.SecretList{} },
+			gentype.PrefersProtobuf[*corev1.Secret](),
+		),
+	}
+}