fix(deploy): 补齐集群备份兼容与切换前门禁

阿里云 OSS 的 S3 兼容层要求 virtual-hosted addressing，且 boto3 需要使用 Signature V2。本提交为 Barman 的归档、备份、保留与恢复统一挂载 AWS 配置，并将实际 WAL 归档和近期全备设为切换硬门禁。

同时补充 CNPG/etcdutl 固定版本安装、显式主库切换、三节点逐台停机、OSS 快照下载校验与远端临时 Secret 清理。已通过 ShellCheck、Kustomize、服务端 dry-run、迁移测试、发布脚本测试、敏感信息扫描及生产 precutover 验收。

deploy/kubernetes/production/database.yaml

@@ -1,3 +1,17 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: easyai-barman-aws-config
+  labels:
+    app.kubernetes.io/part-of: easyai-ai-gateway
+data:
+  config: |
+    [default]
+    region = oss-cn-shanghai
+    s3 =
+      addressing_style = virtual
+      signature_version = s3
+---
 apiVersion: barmancloud.cnpg.io/v1
 kind: ObjectStore
 metadata:
@@ -8,7 +22,7 @@ spec:
   retentionPolicy: 14d
   configuration:
     destinationPath: s3://wangbo0808/easyai-ai-gateway/production/postgresql
-    endpointURL: https://oss-cn-shanghai.aliyuncs.com
+    endpointURL: https://s3.oss-cn-shanghai.aliyuncs.com
     s3Credentials:
       accessKeyId:
         name: easyai-oss-backup
@@ -17,13 +31,23 @@ spec:
         name: easyai-oss-backup
         key: ACCESS_SECRET_KEY
     wal:
+      archiveAdditionalCommandArgs:
+        - --addressing-style=virtual
       compression: gzip
       maxParallel: 2
+      restoreAdditionalCommandArgs:
+        - --addressing-style=virtual
     data:
+      additionalCommandArgs:
+        - --addressing-style=virtual
       compression: gzip
       jobs: 2
+      restoreAdditionalCommandArgs:
+        - --addressing-style=virtual
   instanceSidecarConfiguration:
     env:
+      - name: AWS_CONFIG_FILE
+        value: /projected/barman-aws/config
       - name: AWS_DEFAULT_REGION
         value: oss-cn-shanghai
       - name: AWS_REQUEST_CHECKSUM_CALCULATION
@@ -88,6 +112,14 @@ spec:
       wal_keep_size: 1GB
   monitoring:
     enablePodMonitor: false
+  projectedVolumeTemplate:
+    defaultMode: 0444
+    sources:
+      - configMap:
+          name: easyai-barman-aws-config
+          items:
+            - key: config
+              path: barman-aws/config
   plugins:
     - name: barman-cloud.cloudnative-pg.io
       isWALArchiver: true