fix(deploy): 使用站点专属 NodePort

HostPort 被命名空间 PodSecurity baseline 拒绝，因此恢复无特权 Pod 配置，并为宁波、香港的 API/Web 增加只选择本站 Pod 的专属 NodePort Service。双 NGINX 和验收脚本按站点使用 31088/31089 与 31178/31179，避免主机本地访问共享 NodePort 时随机命中不可达的跨站 Pod。\n\n验证：kubectl kustomize、服务端 dry-run、bash -n、ShellCheck、无 hostPort/hostIP、git diff --check。

deploy/kubernetes/easyai-ai-gateway-cluster-release

@@ -64,14 +64,24 @@ wait_for_url() {
 verify_site() {
   local site=$1
   local address
+  local api_port
+  local web_port
   case $site in
-    hongkong) address=10.77.0.2 ;;
+    hongkong)
-    ningbo) address=10.77.0.1 ;;
+      address=10.77.0.2
+      api_port=31089
+      web_port=31179
+      ;;
+    ningbo)
+      address=10.77.0.1
+      api_port=31088
+      web_port=31178
+      ;;
     *) return 1 ;;
   esac
-  wait_for_url "$site API health" "http://$address:31088/api/v1/healthz" easyai-ai-gateway
+  wait_for_url "$site API health" "http://$address:$api_port/api/v1/healthz" easyai-ai-gateway
-  wait_for_url "$site API readiness" "http://$address:31088/api/v1/readyz" '"ok":true'
+  wait_for_url "$site API readiness" "http://$address:$api_port/api/v1/readyz" '"ok":true'
-  wait_for_url "$site Web" "http://$address:31178/" 'EasyAI AI Gateway'
+  wait_for_url "$site Web" "http://$address:$web_port/" 'EasyAI AI Gateway'
 }
 
 rollout_site() {

deploy/kubernetes/production/application.yaml

@@ -59,8 +59,6 @@ spec:
           ports:
             - name: http
               containerPort: 8088
-              hostIP: 10.77.0.1
-              hostPort: 31088
           readinessProbe:
             httpGet:
               path: /api/v1/readyz
@@ -167,8 +165,6 @@ spec:
           ports:
             - name: http
               containerPort: 8088
-              hostIP: 10.77.0.2
-              hostPort: 31088
           readinessProbe:
             httpGet:
               path: /api/v1/readyz
@@ -261,8 +257,6 @@ spec:
           ports:
             - name: http
               containerPort: 80
-              hostIP: 10.77.0.1
-              hostPort: 31178
           readinessProbe:
             httpGet:
               path: /
@@ -352,8 +346,6 @@ spec:
           ports:
             - name: http
               containerPort: 80
-              hostIP: 10.77.0.2
-              hostPort: 31178
           readinessProbe:
             httpGet:
               path: /
@@ -434,6 +426,90 @@ spec:
       targetPort: http
       nodePort: 30178
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-ningbo-edge
+  labels:
+    app.kubernetes.io/name: easyai-api
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: ningbo
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-api
+    easyai.io/site: ningbo
+  ports:
+    - name: http
+      port: 8088
+      targetPort: http
+      nodePort: 31088
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-hongkong-edge
+  labels:
+    app.kubernetes.io/name: easyai-api
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: hongkong
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-api
+    easyai.io/site: hongkong
+  ports:
+    - name: http
+      port: 8088
+      targetPort: http
+      nodePort: 31089
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: web-ningbo-edge
+  labels:
+    app.kubernetes.io/name: easyai-web
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: ningbo
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-web
+    easyai.io/site: ningbo
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      nodePort: 31178
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: web-hongkong-edge
+  labels:
+    app.kubernetes.io/name: easyai-web
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: hongkong
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-web
+    easyai.io/site: hongkong
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      nodePort: 31179
+---
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:

deploy/nginx/ai.51easyai.com-cluster.conf

@@ -2,14 +2,14 @@ upstream easyai_gateway_api {
   least_conn;
   keepalive 64;
   server 10.77.0.1:31088 max_fails=2 fail_timeout=5s;
-  server 10.77.0.2:31088 max_fails=2 fail_timeout=5s;
+  server 10.77.0.2:31089 max_fails=2 fail_timeout=5s;
 }
 
 upstream easyai_gateway_web {
   least_conn;
   keepalive 32;
   server 10.77.0.1:31178 max_fails=2 fail_timeout=5s;
-  server 10.77.0.2:31178 max_fails=2 fail_timeout=5s;
+  server 10.77.0.2:31179 max_fails=2 fail_timeout=5s;
 }
 
 server {

scripts/cluster/migrate-production.sh

@@ -329,13 +329,14 @@ echo '[cutover] starting both application sites with River workers frozen'
 AI_GATEWAY_ACTIVATE_WORKERS=false \
   "$script_dir/bootstrap-platform.sh" activate "$release_manifest"
 
-for site_ip in 10.77.0.1 10.77.0.2; do
+for site_endpoint in 10.77.0.1:31088:31178 10.77.0.2:31089:31179; do
+  IFS=: read -r site_ip api_port web_port <<<"$site_endpoint"
   cluster_ssh "$CLUSTER_NINGBO_HOST" \
-    "curl -fsS --max-time 10 http://$site_ip:31088/api/v1/healthz >/dev/null"
+    "curl -fsS --max-time 10 http://$site_ip:$api_port/api/v1/healthz >/dev/null"
   cluster_ssh "$CLUSTER_NINGBO_HOST" \
-    "curl -fsS --max-time 10 http://$site_ip:31088/api/v1/readyz | grep -q '\"ok\":true'"
+    "curl -fsS --max-time 10 http://$site_ip:$api_port/api/v1/readyz | grep -q '\"ok\":true'"
   cluster_ssh "$CLUSTER_NINGBO_HOST" \
-    "curl -fsS --max-time 10 http://$site_ip:31178/ | grep -q 'EasyAI AI Gateway'"
+    "curl -fsS --max-time 10 http://$site_ip:$web_port/ | grep -q 'EasyAI AI Gateway'"
 done
 
 "$script_dir/install-nginx-edges.sh" activate

scripts/cluster/run-cross-node-file-e2e.sh

@@ -32,7 +32,7 @@ k3s kubectl set env deployment/easyai-api-ningbo -n easyai \
   AI_GATEWAY_ASYNC_QUEUE_WORKER_ENABLED=false >/dev/null
 k3s kubectl rollout status deployment/easyai-api-ningbo -n easyai --timeout=300s
 curl -fsS http://10.77.0.1:31088/api/v1/readyz | grep -q '"ok":true'
-curl -fsS http://10.77.0.2:31088/api/v1/readyz | grep -q '"ok":true'
+curl -fsS http://10.77.0.2:31089/api/v1/readyz | grep -q '"ok":true'
 REMOTE
 
 credentials_file=$(mktemp "$cluster_root/.local-secrets/cluster/e2e.XXXXXX")