135 lines
4.6 KiB
YAML
135 lines
4.6 KiB
YAML
# ============================================================
|
||
# APS Agent · Web 端 K8s 部署清单（与现有 PVC aps-agent-server-data 对应）
|
||
# 关键点：
|
||
# 1. 持久卷挂载在 /app/server/data —— 项目/会话/世界状态/导出全部落在这里
|
||
# 2. securityContext.fsGroup=10001 与镜像内 aps 用户同组 —— 否则挂载卷属 root，
|
||
# 容器内 aps(10001) 无法写入，表现为「创建项目失败/接口 500」
|
||
# 3. APS_WEB_DEMO_SEED=1：每个租户首次打开工作区时自动播种一套演示项目
|
||
# （不需要演示数据时改为 "0"）\r
|
||
# 4. 授权码模式（20261022-0001 起内置）：APS_LICENSE_PROVIDER=codes，\r
|
||
# 每个授权码 = 一个用户身份，项目/会话/数据按码隔离；内置超管码\r
|
||
# aps@Z@Agent@Admin，可在「应用设置 → 用户与授权」面板发放/管理普通授权码
|
||
# ============================================================
|
||
apiVersion: v1
|
||
kind: PersistentVolumeClaim
|
||
metadata:
|
||
name: aps-agent-server-data
|
||
namespace: aps
|
||
spec:
|
||
accessModes: ["ReadWriteOnce"]
|
||
resources:
|
||
requests:
|
||
storage: 1000Gi
|
||
---
|
||
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: aps-agent
|
||
namespace: aps
|
||
labels:
|
||
app: aps-agent
|
||
spec:
|
||
replicas: 1
|
||
selector:
|
||
matchLabels:
|
||
app: aps-agent
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app: aps-agent
|
||
spec:
|
||
securityContext:
|
||
runAsUser: 10001
|
||
runAsGroup: 10001
|
||
fsGroup: 10001 # 关键：让挂载卷对 aps 组可写
|
||
fsGroupChangePolicy: OnRootMismatch # 仅根属主不匹配时递归改组，避免每次全量 chown
|
||
containers:
|
||
- name: aps-agent
|
||
image: swr.cn-north-4.myhuaweicloud.com/juyuan/dev/jms-mes/aps-agent:20261022-0003
|
||
imagePullPolicy: IfNotPresent
|
||
ports:
|
||
- name: http
|
||
containerPort: 8000
|
||
env:
|
||
- name: APS_MODE
|
||
value: "web"
|
||
- name: APS_DATA_DIR
|
||
value: /app/server/data
|
||
- name: APS_WEB_DEMO_SEED
|
||
value: "1"
|
||
- name: APS_PORT
|
||
value: "8000"
|
||
# ---- 授权码认证（codes）：每个授权码 = 一个用户，数据按码隔离 ----
|
||
- name: APS_LICENSE_PROVIDER
|
||
value: "codes"
|
||
- name: APS_LICENSE_CLIENTS
|
||
value: "web,desktop"
|
||
# 签码密钥由 Secret 注入；optional 缺省时仅影响新码签发校验
|
||
- name: APS_LICENSE_SECRET
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: aps-agent-secrets
|
||
key: license-secret
|
||
optional: true
|
||
# APS_LICENSE_TENANT_UUID 不设置时默认为 platform 租户
|
||
# ---- JMS 认证（地址由现场 ConfigMap 注入，密钥由 Secret 注入）----
|
||
# 注意：JMS 与授权码并存时 JMS 优先；现场如需 JMS 登录把 APS_AUTH_PROVIDER 改回 "jms"
|
||
- name: APS_AUTH_PROVIDER
|
||
value: "unconfigured"
|
||
- name: JMS_AUTH_BASE_URL
|
||
valueFrom:
|
||
configMapKeyRef:
|
||
name: aps-agent-config
|
||
key: jms-auth-base-url
|
||
- name: JMS_AUTH_TENANT_CODE
|
||
value: ""
|
||
- name: JMS_AUTH_TENANT_NAME
|
||
value: ""
|
||
- name: JMS_AUTH_DEFAULT_ROLE
|
||
value: "planner"
|
||
- name: JMS_AUTH_SESSION_SECRET
|
||
valueFrom:
|
||
secretKeyRef:
|
||
name: aps-agent-secrets
|
||
key: jms-session-secret
|
||
optional: true
|
||
volumeMounts:
|
||
- name: aps-agent-server-data
|
||
mountPath: /app/server/data # 读写：所有运行数据持久化于此
|
||
readinessProbe:
|
||
httpGet:
|
||
path: /api/health
|
||
port: http
|
||
initialDelaySeconds: 10
|
||
periodSeconds: 15
|
||
livenessProbe:
|
||
httpGet:
|
||
path: /api/health
|
||
port: http
|
||
initialDelaySeconds: 30
|
||
periodSeconds: 30
|
||
resources:
|
||
requests:
|
||
cpu: 250m
|
||
memory: 512Mi
|
||
limits:
|
||
cpu: "2"
|
||
memory: 2Gi
|
||
volumes:
|
||
- name: aps-agent-server-data
|
||
persistentVolumeClaim:
|
||
claimName: aps-agent-server-data
|
||
---
|
||
apiVersion: v1
|
||
kind: Service
|
||
metadata:
|
||
name: aps-agent
|
||
namespace: aps
|
||
spec:
|
||
selector:
|
||
app: aps-agent
|
||
ports:
|
||
- name: http
|
||
port: 8000
|
||
targetPort: http
|