From 3b670386609e664011809411f1cd282f5a82dce1 Mon Sep 17 00:00:00 2001
From: wangbo <wangbolhr@163.com>
Date: Fri, 31 Jul 2026 00:41:56 +0800
Subject: [PATCH] =?UTF-8?q?fix(acceptance):=20=E7=A7=BB=E9=99=A4=E7=94=9F?=
 =?UTF-8?q?=E4=BA=A7=E9=AA=8C=E6=94=B6=E6=8C=81=E4=B9=85=E7=AE=A1=E7=90=86?=
 =?UTF-8?q?=E9=9A=A7=E9=81=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

管理 API 改为通过短 SSH 在宁波节点调用内部 api-ningbo-edge Service，避免长期端口转发与大量集群控制连接竞争导致 SSH 握手限流。Token 和请求体以 Base64 传输且不输出。\n\n验证：内部 traffic-mode 端到端返回 200；GNU Bash 3.2；bash -n；shellcheck -x -P .；git diff --check。
---
 scripts/cluster/run-production-acceptance.sh | 60 +++++++++++++++-----
 1 file changed, 46 insertions(+), 14 deletions(-)

diff --git a/scripts/cluster/run-production-acceptance.sh b/scripts/cluster/run-production-acceptance.sh
index 58b9a40..66e5a0c 100755
--- a/scripts/cluster/run-production-acceptance.sh
+++ b/scripts/cluster/run-production-acceptance.sh
@@ -95,6 +95,7 @@ stable_profile=P24
 active_profile=P24
 failure_reason=
 failure_recorded=false
+acceptance_admin_base=
 
 cleanup() {
   local status=$?
@@ -130,21 +131,52 @@ admin_request() {
   local path=$2
   local body=${3:-}
   local output=$4
-  local admin_base=${AI_GATEWAY_ACCEPTANCE_GATEWAYS%%,*}
-  local status
-  if [[ -n $body ]]; then
-    status=$(curl -sS --max-time 30 -o "$output" -w '%{http_code}' \
-      -X "$method" \
-      -H "Authorization: Bearer $AI_GATEWAY_ACCEPTANCE_ADMIN_TOKEN" \
-      -H 'Content-Type: application/json' \
-      --data-binary "$body" \
-      "$admin_base$path")
-  else
-    status=$(curl -sS --max-time 30 -o "$output" -w '%{http_code}' \
-      -X "$method" \
-      -H "Authorization: Bearer $AI_GATEWAY_ACCEPTANCE_ADMIN_TOKEN" \
-      "$admin_base$path")
+  local status response payload token_encoded body_encoded has_body=false
+  local service_ip service_port remote_script remote_command
+  if [[ -z $acceptance_admin_base ]]; then
+    service_ip=$(remote_kubectl get service api-ningbo-edge -n "$namespace" \
+      -o 'jsonpath={.spec.clusterIP}')
+    service_port=$(remote_kubectl get service api-ningbo-edge -n "$namespace" \
+      -o 'jsonpath={.spec.ports[0].port}')
+    [[ $service_ip =~ ^[0-9.]+$ && $service_port =~ ^[0-9]+$ ]] || {
+      echo 'acceptance admin Service has an invalid cluster address' >&2
+      return 1
+    }
+    acceptance_admin_base=http://$service_ip:$service_port
   fi
+  token_encoded=$(printf '%s' "$AI_GATEWAY_ACCEPTANCE_ADMIN_TOKEN" |
+    openssl base64 -A)
+  body_encoded=$(printf '%s' "$body" | openssl base64 -A)
+  [[ -n $body ]] && has_body=true
+  # shellcheck disable=SC2016 # This script is quoted for execution on the remote node.
+  remote_script='
+set -euo pipefail
+admin_base=$1
+method=$2
+path=$3
+token=$(printf "%s" "$4" | base64 -d)
+body=$(printf "%s" "$5" | base64 -d)
+has_body=$6
+if [[ $has_body == true ]]; then
+  curl -sS --max-time 30 -w "\n%{http_code}" -X "$method" \
+    -H "Authorization: Bearer $token" \
+    -H "Content-Type: application/json" \
+    --data-binary "$body" "$admin_base$path"
+else
+  curl -sS --max-time 30 -w "\n%{http_code}" -X "$method" \
+    -H "Authorization: Bearer $token" "$admin_base$path"
+fi
+'
+  printf -v remote_command 'bash -c %q -- %q %q %q %q %q %q' \
+    "$remote_script" "$acceptance_admin_base" "$method" "$path" \
+    "$token_encoded" "$body_encoded" "$has_body"
+  if ! response=$(cluster_ssh "$CLUSTER_NINGBO_HOST" "$remote_command"); then
+    echo "acceptance control API transport failed: method=$method path=$path" >&2
+    return 1
+  fi
+  status=${response##*$'\n'}
+  payload=${response%$'\n'*}
+  printf '%s' "$payload" >"$output"
   [[ $status =~ ^2[0-9][0-9]$ ]] || {
     echo "acceptance control API failed: method=$method path=$path status=$status" >&2
     return 1