jenkins

deploy/k8s/config.example.yaml

@@ -1,5 +1,5 @@
 # 后端配置文件模板。
-# Jenkins 会用 APP_NAME 渲染本文件，并通过 ConfigMap/初始化容器写入共享配置 PVC。
+# Jenkins 会渲染本文件并通过 Secret/初始化容器写入节点共享目录。
 # 容器内运行用户为 UID/GID 1000，初始化向导会把运行时配置写回本文件。
 #
 # 说明：
@@ -40,7 +40,7 @@ data:
 admin:
   router_prefix: ""
   jwt:
-    signing_key: ""
+    signing_key: '${KRA_JWT_SIGNING_KEY}'
     expires_time: 604800s
     buffer_time: 86400s
     issuer: ${APP_NAME}

deploy/k8s/kra.yaml

@@ -7,7 +7,6 @@
 #   KRA_BACKEND_NODEPORT  node port for the backend debug service
 #   KRA_MYSQL_IMAGE       mysql server image
 #   KRA_REDIS_IMAGE       redis server image
-#   KRA_SHARED_STORAGE_CLASS RWX storage class for config and uploads
 #   KRA_BACKEND_IMAGE     backend image built by Jenkins
 #   KRA_FRONTEND_IMAGE    frontend image built by Jenkins
 #   BIN_NAME              backend binary name inside the image
@@ -39,6 +38,7 @@ spec:
         app.kubernetes.io/name: ${KRA_APP}-mysql
         app.kubernetes.io/part-of: ${KRA_APP}
     spec:
+      automountServiceAccountToken: false
       containers:
         - name: mysql
           image: ${KRA_MYSQL_IMAGE}
@@ -129,6 +129,7 @@ spec:
         app.kubernetes.io/name: ${KRA_APP}-redis
         app.kubernetes.io/part-of: ${KRA_APP}
     spec:
+      automountServiceAccountToken: false
       initContainers:
         - name: prepare-redis-storage
           image: ${KRA_REDIS_IMAGE}
@@ -142,12 +143,17 @@ spec:
           volumeMounts:
             - name: redis-data
               mountPath: /data
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: kubernetes.io/hostname
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: ${KRA_APP}-mysql
       containers:
         - name: redis
           image: ${KRA_REDIS_IMAGE}
           imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsNonRoot: true
           ports:
             - name: redis
               containerPort: 6379
@@ -206,13 +212,14 @@ spec:
       securityContext:
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch
+      automountServiceAccountToken: false
       initContainers:
         - name: initialize-shared-storage
           image: ${KRA_BACKEND_IMAGE}
           imagePullPolicy: Always
           securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
+            runAsUser: 0
+            runAsGroup: 0
           command: ["sh", "-c"]
           args:
             - >-
@@ -220,6 +227,7 @@ spec:
               if [ ! -f /data/conf/config.yaml ]; then
                 cp /bootstrap/config.yaml /data/conf/config.yaml;
               fi;
+              chown 1000:1000 /data/conf /data/conf/config.yaml /app/uploads;
               chmod u+rwX,g+rwX /data/conf /data/conf/config.yaml /app/uploads
           volumeMounts:
             - name: config
@@ -229,11 +237,17 @@ spec:
             - name: config-template
               mountPath: /bootstrap
               readOnly: true
-      # /data/conf 由初始化容器从 ConfigMap 初始化到共享 PVC，
+      # /data/conf 由初始化容器从 Secret 初始化到节点共享目录，
       # 目录必须可写：初始化向导会把数据库连接写回该文件。
       imagePullSecrets:
         - name: harbor-registry
       affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: kubernetes.io/hostname
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: ${KRA_APP}-mysql
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
             - weight: 100
@@ -287,43 +301,22 @@ spec:
               cpu: 500m
               memory: 1Gi
       volumes:
+        # 当前是单节点集群；required podAffinity 保证所有后端副本落在
+        # MySQL 所在节点，从而共享同一组 hostPath 目录。它不是真正的 RWX。
+        # 扩展到多节点前，必须换成 PVC + 真正的共享存储（如 NFS/CephFS）。
         - name: config
-          persistentVolumeClaim:
-            claimName: ${KRA_APP}-config
+          hostPath:
+            path: /var/lib/${KRA_APP}/conf
+            type: DirectoryOrCreate
         - name: uploads
-          persistentVolumeClaim:
-            claimName: ${KRA_APP}-uploads
+          hostPath:
+            path: /var/lib/${KRA_APP}/uploads
+            type: DirectoryOrCreate
         - name: config-template
-          configMap:
+          secret:
             name: ${KRA_APP}-config-template
 ---
 apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ${KRA_APP}-config
-  namespace: ${KRA_NAMESPACE}
-spec:
-  storageClassName: ${KRA_SHARED_STORAGE_CLASS}
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ${KRA_APP}-uploads
-  namespace: ${KRA_NAMESPACE}
-spec:
-  storageClassName: ${KRA_SHARED_STORAGE_CLASS}
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 20Gi
----
-apiVersion: v1
 kind: Service
 metadata:
   name: ${KRA_APP}-backend
@@ -379,6 +372,7 @@ spec:
         app.kubernetes.io/name: ${KRA_APP}-frontend
         app.kubernetes.io/part-of: ${KRA_APP}
     spec:
+      automountServiceAccountToken: false
       imagePullSecrets:
         - name: harbor-registry
       affinity: