From 26f3b3fb0a2644e9888fffdeb3a9a78b279708ef Mon Sep 17 00:00:00 2001
From: wangbo <wangbolhr@163.com>
Date: Fri, 31 Jul 2026 19:47:51 +0800
Subject: [PATCH] =?UTF-8?q?fix(acceptance):=20=E6=B6=88=E9=99=A4=20bootstr?=
 =?UTF-8?q?ap=20=E4=BA=A7=E7=89=A9=E7=AB=9E=E6=80=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

bootstrap 主容器完成后 Kubernetes 不允许继续 exec，导致无法取回只存在容器文件系统中的私密运行参数。使用共享 emptyDir 与限时导出 sidecar，在主容器退出码为零后复制 0600 产物并立即删除 Pod。\n\n验证：bash -n；ShellCheck；本地 CNPG 环境 32 身份 bootstrap、sidecar 导出和 runtime Schema 校验通过。
---
 scripts/acceptance/local-cluster.sh | 38 ++++++++++++++++++++++++++---
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/scripts/acceptance/local-cluster.sh b/scripts/acceptance/local-cluster.sh
index d9d037d..6af731b 100755
--- a/scripts/acceptance/local-cluster.sh
+++ b/scripts/acceptance/local-cluster.sh
@@ -387,7 +387,11 @@ metadata:
   labels:
     easyai.io/environment: local-acceptance
 spec:
+  activeDeadlineSeconds: 600
   restartPolicy: Never
+  securityContext:
+    fsGroup: 10001
+    fsGroupChangePolicy: OnRootMismatch
   containers:
     - name: bootstrap
       image: $api_image
@@ -408,16 +412,42 @@ spec:
         - --identity-shards
         - "32"
         - --output
-        - /tmp/runtime.json
+        - /runtime/runtime.json
       envFrom:
         - secretRef:
             name: easyai-ai-gateway-runtime
+      volumeMounts:
+        - name: runtime
+          mountPath: /runtime
+    - name: runtime-export
+      image: $api_image
+      command: ["/bin/sh", "-ec", "sleep 600"]
+      volumeMounts:
+        - name: runtime
+          mountPath: /runtime
+          readOnly: true
+  volumes:
+    - name: runtime
+      emptyDir: {}
 EOF
-  kubectl --context "$context" -n "$namespace" wait \
-    --for=jsonpath='{.status.phase}'=Succeeded pod/easyai-local-bootstrap --timeout=5m >/dev/null
+  local bootstrap_exit='' deadline=$((SECONDS + 300))
+  while ((SECONDS < deadline)); do
+    bootstrap_exit=$(kubectl --context "$context" -n "$namespace" get \
+      pod/easyai-local-bootstrap -o json |
+      jq -r '.status.containerStatuses[]? | select(.name == "bootstrap") |
+        if .state.terminated then (.state.terminated.exitCode | tostring) else empty end')
+    [[ -z $bootstrap_exit ]] || break
+    sleep 1
+  done
+  if [[ $bootstrap_exit != 0 ]]; then
+    echo "local acceptance bootstrap failed or timed out: exit_code=${bootstrap_exit:-unknown}" >&2
+    kubectl --context "$context" -n "$namespace" logs \
+      pod/easyai-local-bootstrap -c bootstrap >&2 || true
+    exit 1
+  fi
   umask 077
   kubectl --context "$context" -n "$namespace" cp \
-    easyai-local-bootstrap:/tmp/runtime.json "$runtime_file" >/dev/null
+    -c runtime-export easyai-local-bootstrap:/runtime/runtime.json "$runtime_file" >/dev/null
   chmod 0600 "$runtime_file"
   kubectl --context "$context" -n "$namespace" delete pod easyai-local-bootstrap \
     --wait=true >/dev/null