From 9e37d4a0347b597e889d3231ec6e6339a8abdc1e Mon Sep 17 00:00:00 2001
From: "z.zhang" <andy_azhen@163.com>
Date: Thu, 22 Oct 2026 23:24:31 +0800
Subject: [PATCH] =?UTF-8?q?deploy(k8s):=20=E9=95=9C=E5=83=8F=E5=8D=87?=
 =?UTF-8?q?=E7=BA=A7=2020261022-0001=20=E5=B9=B6=E5=90=AF=E7=94=A8?=
 =?UTF-8?q?=E6=8E=88=E6=9D=83=E7=A0=81=E6=A8=A1=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packaging/k8s/deployment.yaml | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/packaging/k8s/deployment.yaml b/packaging/k8s/deployment.yaml
index fc62b0a..39356a1 100644
--- a/packaging/k8s/deployment.yaml
+++ b/packaging/k8s/deployment.yaml
@@ -5,7 +5,10 @@
 #   2. securityContext.fsGroup=10001 与镜像内 aps 用户同组 —— 否则挂载卷属 root，
 #      容器内 aps(10001) 无法写入，表现为「创建项目失败/接口 500」
 #   3. APS_WEB_DEMO_SEED=1：每个租户首次打开工作区时自动播种一套演示项目
-#      （不需要演示数据时改为 "0"）
+#      （不需要演示数据时改为 "0"）\r
+#   4. 授权码模式（20261022-0001 起内置）：APS_LICENSE_PROVIDER=codes，\r
+#      每个授权码 = 一个用户身份，项目/会话/数据按码隔离；内置超管码\r
+#      aps@Z@Agent@Admin，可在「应用设置 → 用户与授权」面板发放/管理普通授权码
 # ============================================================
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -42,7 +45,7 @@ spec:
         fsGroupChangePolicy: OnRootMismatch # 仅根属主不匹配时递归改组，避免每次全量 chown
       containers:
         - name: aps-agent
-          image: aps-agent:REPLACE_WITH_TAG
+          image: swr.cn-north-4.myhuaweicloud.com/juyuan/dev/jms-mes/aps-agent:20261022-0001
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -56,9 +59,23 @@ spec:
               value: "1"
             - name: APS_PORT
               value: "8000"
+            # ---- 授权码认证（codes）：每个授权码 = 一个用户，数据按码隔离 ----
+            - name: APS_LICENSE_PROVIDER
+              value: "codes"
+            - name: APS_LICENSE_CLIENTS
+              value: "web,desktop"
+            # 签码密钥由 Secret 注入；optional 缺省时仅影响新码签发校验
+            - name: APS_LICENSE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: aps-agent-secrets
+                  key: license-secret
+                  optional: true
+            # APS_LICENSE_TENANT_UUID 不设置时默认为 platform 租户
             # ---- JMS 认证（地址由现场 ConfigMap 注入，密钥由 Secret 注入）----
+            # 注意：JMS 与授权码并存时 JMS 优先；现场如需 JMS 登录把 APS_AUTH_PROVIDER 改回 "jms"
             - name: APS_AUTH_PROVIDER
-              value: "jms"
+              value: "unconfigured"
             - name: JMS_AUTH_BASE_URL
               valueFrom:
                 configMapKeyRef: