jenkins

deploy/k8s/kra.yaml

@@ -7,6 +7,7 @@
 #   KRA_BACKEND_NODEPORT  node port for the backend debug service
 #   KRA_MYSQL_IMAGE       mysql server image
 #   KRA_REDIS_IMAGE       redis server image
+#   KRA_SHARED_STORAGE_CLASS RWX storage class for config and uploads
 #   KRA_BACKEND_IMAGE     backend image built by Jenkins
 #   KRA_FRONTEND_IMAGE    frontend image built by Jenkins
 #   BIN_NAME              backend binary name inside the image
@@ -84,6 +85,20 @@ spec:
 ---
 apiVersion: v1
 kind: Service
+metadata:
+  name: ${KRA_APP}-mysql
+  namespace: ${KRA_NAMESPACE}
+spec:
+  clusterIP: None
+  selector:
+    app.kubernetes.io/name: ${KRA_APP}-mysql
+  ports:
+    - name: mysql
+      port: 3306
+      targetPort: mysql
+---
+apiVersion: v1
+kind: Service
 metadata:
   name: ${KRA_APP}-redis
   namespace: ${KRA_NAMESPACE}
@@ -114,10 +129,25 @@ spec:
         app.kubernetes.io/name: ${KRA_APP}-redis
         app.kubernetes.io/part-of: ${KRA_APP}
     spec:
+      initContainers:
+        - name: prepare-redis-storage
+          image: ${KRA_REDIS_IMAGE}
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+          command: ["sh", "-c"]
+          args:
+            - chown -R redis:redis /data
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
       containers:
         - name: redis
           image: ${KRA_REDIS_IMAGE}
           imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsNonRoot: true
           ports:
             - name: redis
               containerPort: 6379
@@ -173,7 +203,33 @@ spec:
         app.kubernetes.io/name: ${KRA_APP}-backend
         app.kubernetes.io/part-of: ${KRA_APP}
     spec:
-      # /data/conf 由部署人员预先放置 config.yaml（见 deploy/k8s/config.example.yaml），
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        - name: initialize-shared-storage
+          image: ${KRA_BACKEND_IMAGE}
+          imagePullPolicy: Always
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+          command: ["sh", "-c"]
+          args:
+            - >-
+              mkdir -p /data/conf /app/uploads;
+              if [ ! -f /data/conf/config.yaml ]; then
+                cp /bootstrap/config.yaml /data/conf/config.yaml;
+              fi;
+              chmod u+rwX,g+rwX /data/conf /data/conf/config.yaml /app/uploads
+          volumeMounts:
+            - name: config
+              mountPath: /data/conf
+            - name: uploads
+              mountPath: /app/uploads
+            - name: config-template
+              mountPath: /bootstrap
+              readOnly: true
+      # /data/conf 由初始化容器从 ConfigMap 初始化到共享 PVC，
       # 目录必须可写：初始化向导会把数据库连接写回该文件。
       imagePullSecrets:
         - name: harbor-registry
@@ -198,16 +254,12 @@ spec:
           env:
             # 数据库连接不在这里注入：应用启动时未配置数据库会进入 bootstrap 模式，
             # 首页出现"前往初始化"，由 /init/initdb 建表、写入种子数据并持久化连接配置。
-            # 只注入 JWT 签名密钥；Redis 地址已在下方 config.yaml 中指定。
-            - name: KRA_ADMIN_JWT_SIGNING_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ${KRA_APP}-runtime
-                  key: jwt-signing-key
+            # JWT 签名密钥由 /data/conf/config.yaml 唯一管理，避免环境变量覆盖管理页面的配置变更；
+            # Redis 地址已在下方 config.yaml 中指定。
             - name: KRA_ADMIN_SYSTEM_USE_REDIS
               value: "true"
           volumeMounts:
-            - name: conf
+            - name: config
               mountPath: /data/conf
             - name: uploads
               mountPath: /app/uploads
@@ -235,12 +287,41 @@ spec:
               cpu: 500m
               memory: 1Gi
       volumes:
-        - name: conf
-          hostPath:
-            path: /var/lib/${KRA_APP}/conf
-            type: DirectoryOrCreate
+        - name: config
+          persistentVolumeClaim:
+            claimName: ${KRA_APP}-config
         - name: uploads
-          emptyDir: {}
+          persistentVolumeClaim:
+            claimName: ${KRA_APP}-uploads
+        - name: config-template
+          configMap:
+            name: ${KRA_APP}-config-template
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ${KRA_APP}-config
+  namespace: ${KRA_NAMESPACE}
+spec:
+  storageClassName: ${KRA_SHARED_STORAGE_CLASS}
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ${KRA_APP}-uploads
+  namespace: ${KRA_NAMESPACE}
+spec:
+  storageClassName: ${KRA_SHARED_STORAGE_CLASS}
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 20Gi
 ---
 apiVersion: v1
 kind: Service