From 3ba6026e12d85954248399310433a22f18dbebbb Mon Sep 17 00:00:00 2001
From: wangbo <wangbolhr@163.com>
Date: Fri, 31 Jul 2026 19:32:28 +0800
Subject: [PATCH] =?UTF-8?q?fix(acceptance):=20=E5=AE=89=E5=85=A8=E6=9A=82?=
 =?UTF-8?q?=E5=AD=98=E8=84=B1=E6=95=8F=E5=BF=AB=E7=85=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ConfigMap 投影文件是符号链接，而快照导入器必须拒绝链接输入。新增 initContainer 将只读投影复制为 emptyDir 中的 0600 普通文件，保留防链接安全门禁并让本地导入可执行。\n\n验证：bash -n；ShellCheck；本地 CNPG 双实例实际快照导入通过。
---
 scripts/acceptance/local-cluster.sh | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/scripts/acceptance/local-cluster.sh b/scripts/acceptance/local-cluster.sh
index a28fc60..d9d037d 100755
--- a/scripts/acceptance/local-cluster.sh
+++ b/scripts/acceptance/local-cluster.sh
@@ -293,6 +293,22 @@ spec:
   template:
     spec:
       restartPolicy: Never
+      securityContext:
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        - name: stage-snapshot
+          image: $api_image
+          command:
+            - /bin/sh
+            - -ec
+            - umask 077; cp /snapshot-source/snapshot.json /snapshot/snapshot.json
+          volumeMounts:
+            - name: snapshot-source
+              mountPath: /snapshot-source
+              readOnly: true
+            - name: snapshot
+              mountPath: /snapshot
       containers:
         - name: import
           image: $api_image
@@ -311,9 +327,11 @@ spec:
               mountPath: /snapshot
               readOnly: true
       volumes:
-        - name: snapshot
+        - name: snapshot-source
           configMap:
             name: easyai-acceptance-snapshot
+        - name: snapshot
+          emptyDir: {}
 EOF
   kubectl --context "$context" -n "$namespace" wait \
     --for=condition=complete job/easyai-local-snapshot-import --timeout=5m >/dev/null