From 39a8fd2ce0555b5df4a2fe494e23232bc5f183b9 Mon Sep 17 00:00:00 2001
From: wangbo <wangbolhr@163.com>
Date: Wed, 29 Jul 2026 02:25:43 +0800
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=E7=A7=BB=E9=99=A4=E6=BF=80?=
 =?UTF-8?q?=E6=B4=BB=E9=98=B6=E6=AE=B5=E5=A4=96=E7=BD=91=E4=BE=9D=E8=B5=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

正式激活时不再从 GitHub 下载并重装已健康运行的 cert-manager、CloudNativePG 和 Barman Operator；Operator 安装继续保留在 prepare 阶段。激活阶段只渲染、校验并启动已锁定 digest 的应用清单，避免维护窗口受外网波动影响。\n\n验证：bash -n、ShellCheck、git diff --check。
---
 scripts/cluster/bootstrap-platform.sh | 44 ++++++++++++++++-----------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/scripts/cluster/bootstrap-platform.sh b/scripts/cluster/bootstrap-platform.sh
index 74542b5..4e8d65f 100755
--- a/scripts/cluster/bootstrap-platform.sh
+++ b/scripts/cluster/bootstrap-platform.sh
@@ -57,15 +57,17 @@ operator_checksums=(
   e0c5ff41bf5b01c0775bf225929b8423d543cd23e9742e4274fe7de8499cf93a
   d2e71e7b06822448f1a421f05781846cfdb9cc621e7ef32eef5e20c5133213b0
 )
-for index in 0 1 2; do
-  operator=${operators[$index]}
-  curl -fsSL "${operator_urls[$index]}" -o "$working_directory/$operator"
-  actual_checksum=$(shasum -a 256 "$working_directory/$operator" | awk '{print $1}')
-  [[ $actual_checksum == "${operator_checksums[$index]}" ]] || {
-    echo "operator manifest checksum mismatch: $operator" >&2
-    exit 1
-  }
-done
+if [[ $mode == prepare ]]; then
+  for index in 0 1 2; do
+    operator=${operators[$index]}
+    curl -fsSL "${operator_urls[$index]}" -o "$working_directory/$operator"
+    actual_checksum=$(shasum -a 256 "$working_directory/$operator" | awk '{print $1}')
+    [[ $actual_checksum == "${operator_checksums[$index]}" ]] || {
+      echo "operator manifest checksum mismatch: $operator" >&2
+      exit 1
+    }
+  done
+fi
 
 cp -R "$cluster_root/deploy/kubernetes/production" "$working_directory/production"
 api_digest=${api_image##*@}
@@ -126,7 +128,11 @@ stringData:
 EOF
 chmod 0600 "$working_directory/bootstrap-secrets.yaml"
 
-for file in cert-manager.yaml cnpg.yaml barman.yaml easyai-production.yaml bootstrap-secrets.yaml; do
+platform_files=(easyai-production.yaml bootstrap-secrets.yaml)
+if [[ $mode == prepare ]]; then
+  platform_files=(cert-manager.yaml cnpg.yaml barman.yaml "${platform_files[@]}")
+fi
+for file in "${platform_files[@]}"; do
   cluster_scp "$working_directory/$file" "$CLUSTER_NINGBO_HOST:/root/$file"
 done
 
@@ -151,14 +157,16 @@ cleanup_bootstrap_files() {
 }
 trap cleanup_bootstrap_files EXIT HUP INT TERM
 
-$kubectl apply --server-side --force-conflicts -f /root/cert-manager.yaml >/dev/null
-$kubectl rollout status deployment/cert-manager -n cert-manager --timeout=180s
-$kubectl rollout status deployment/cert-manager-webhook -n cert-manager --timeout=180s
-$kubectl rollout status deployment/cert-manager-cainjector -n cert-manager --timeout=180s
-$kubectl apply --server-side --force-conflicts -f /root/cnpg.yaml >/dev/null
-$kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=600s
-$kubectl apply --server-side --force-conflicts -f /root/barman.yaml >/dev/null
-$kubectl rollout status deployment/barman-cloud -n cnpg-system --timeout=600s
+if [[ $mode == prepare ]]; then
+  $kubectl apply --server-side --force-conflicts -f /root/cert-manager.yaml >/dev/null
+  $kubectl rollout status deployment/cert-manager -n cert-manager --timeout=180s
+  $kubectl rollout status deployment/cert-manager-webhook -n cert-manager --timeout=180s
+  $kubectl rollout status deployment/cert-manager-cainjector -n cert-manager --timeout=180s
+  $kubectl apply --server-side --force-conflicts -f /root/cnpg.yaml >/dev/null
+  $kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=600s
+  $kubectl apply --server-side --force-conflicts -f /root/barman.yaml >/dev/null
+  $kubectl rollout status deployment/barman-cloud -n cnpg-system --timeout=600s
+fi
 
 $kubectl create namespace easyai --dry-run=client -o yaml | $kubectl apply -f - >/dev/null
 $kubectl apply -f /root/bootstrap-secrets.yaml >/dev/null