fix(deploy): 稳定边缘到站点的固定入口

主机本地访问跨站点 NodePort 时 kube-proxy 会随机选择不可达的对端 Pod，导致约四分之一请求被拒绝。为两地应用绑定仅位于 WireGuard 地址的 HostPort 31088/31178，双 NGINX 和集群验收改用该固定入口；原 NodePort 30088/30178 继续保留。端口处于现有公网 DROP、wg0 私网放行范围。\n\n验证：kubectl kustomize、服务端 dry-run、bash -n、ShellCheck、Secret 与 digest 静态检查、git diff --check。

deploy/kubernetes/easyai-ai-gateway-cluster-release

@@ -69,9 +69,9 @@ verify_site() {
     ningbo) address=10.77.0.1 ;;
     *) return 1 ;;
   esac
-  wait_for_url "$site API health" "http://$address:30088/api/v1/healthz" easyai-ai-gateway
-  wait_for_url "$site API readiness" "http://$address:30088/api/v1/readyz" '"ok":true'
-  wait_for_url "$site Web" "http://$address:30178/" 'EasyAI AI Gateway'
+  wait_for_url "$site API health" "http://$address:31088/api/v1/healthz" easyai-ai-gateway
+  wait_for_url "$site API readiness" "http://$address:31088/api/v1/readyz" '"ok":true'
+  wait_for_url "$site Web" "http://$address:31178/" 'EasyAI AI Gateway'
 }
 
 rollout_site() {

deploy/kubernetes/production/application.yaml

@@ -59,6 +59,8 @@ spec:
           ports:
             - name: http
               containerPort: 8088
+              hostIP: 10.77.0.1
+              hostPort: 31088
           readinessProbe:
             httpGet:
               path: /api/v1/readyz
@@ -165,6 +167,8 @@ spec:
           ports:
             - name: http
               containerPort: 8088
+              hostIP: 10.77.0.2
+              hostPort: 31088
           readinessProbe:
             httpGet:
               path: /api/v1/readyz
@@ -257,6 +261,8 @@ spec:
           ports:
             - name: http
               containerPort: 80
+              hostIP: 10.77.0.1
+              hostPort: 31178
           readinessProbe:
             httpGet:
               path: /
@@ -346,6 +352,8 @@ spec:
           ports:
             - name: http
               containerPort: 80
+              hostIP: 10.77.0.2
+              hostPort: 31178
           readinessProbe:
             httpGet:
               path: /

deploy/nginx/ai.51easyai.com-cluster.conf

@@ -1,15 +1,15 @@
 upstream easyai_gateway_api {
   least_conn;
   keepalive 64;
-  server 10.77.0.1:30088 max_fails=2 fail_timeout=5s;
-  server 10.77.0.2:30088 max_fails=2 fail_timeout=5s;
+  server 10.77.0.1:31088 max_fails=2 fail_timeout=5s;
+  server 10.77.0.2:31088 max_fails=2 fail_timeout=5s;
 }
 
 upstream easyai_gateway_web {
   least_conn;
   keepalive 32;
-  server 10.77.0.1:30178 max_fails=2 fail_timeout=5s;
-  server 10.77.0.2:30178 max_fails=2 fail_timeout=5s;
+  server 10.77.0.1:31178 max_fails=2 fail_timeout=5s;
+  server 10.77.0.2:31178 max_fails=2 fail_timeout=5s;
 }
 
 server {

deploy/nginx/cluster-acceptance-origin-ningbo.conf

@@ -19,6 +19,6 @@ server {
     proxy_read_timeout 3600s;
     proxy_request_buffering off;
     proxy_buffering off;
-    proxy_pass http://10.77.0.1:30088;
+    proxy_pass http://10.77.0.1:31088;
   }
 }

scripts/cluster/migrate-production.sh

@@ -331,11 +331,11 @@ AI_GATEWAY_ACTIVATE_WORKERS=false \
 
 for site_ip in 10.77.0.1 10.77.0.2; do
   cluster_ssh "$CLUSTER_NINGBO_HOST" \
-    "curl -fsS --max-time 10 http://$site_ip:30088/api/v1/healthz >/dev/null"
+    "curl -fsS --max-time 10 http://$site_ip:31088/api/v1/healthz >/dev/null"
   cluster_ssh "$CLUSTER_NINGBO_HOST" \
-    "curl -fsS --max-time 10 http://$site_ip:30088/api/v1/readyz | grep -q '\"ok\":true'"
+    "curl -fsS --max-time 10 http://$site_ip:31088/api/v1/readyz | grep -q '\"ok\":true'"
   cluster_ssh "$CLUSTER_NINGBO_HOST" \
-    "curl -fsS --max-time 10 http://$site_ip:30178/ | grep -q 'EasyAI AI Gateway'"
+    "curl -fsS --max-time 10 http://$site_ip:31178/ | grep -q 'EasyAI AI Gateway'"
 done
 
 "$script_dir/install-nginx-edges.sh" activate

scripts/cluster/run-cross-node-file-e2e.sh

@@ -31,8 +31,8 @@ k3s kubectl rollout status deployment/easyai-api-hongkong -n easyai --timeout=30
 k3s kubectl set env deployment/easyai-api-ningbo -n easyai \
   AI_GATEWAY_ASYNC_QUEUE_WORKER_ENABLED=false >/dev/null
 k3s kubectl rollout status deployment/easyai-api-ningbo -n easyai --timeout=300s
-curl -fsS http://10.77.0.1:30088/api/v1/readyz | grep -q '"ok":true'
-curl -fsS http://10.77.0.2:30088/api/v1/readyz | grep -q '"ok":true'
+curl -fsS http://10.77.0.1:31088/api/v1/readyz | grep -q '"ok":true'
+curl -fsS http://10.77.0.2:31088/api/v1/readyz | grep -q '"ok":true'
 REMOTE
 
 credentials_file=$(mktemp "$cluster_root/.local-secrets/cluster/e2e.XXXXXX")