fix(deploy): 补齐集群备份兼容与切换前门禁

阿里云 OSS 的 S3 兼容层要求 virtual-hosted addressing，且 boto3 需要使用 Signature V2。本提交为 Barman 的归档、备份、保留与恢复统一挂载 AWS 配置，并将实际 WAL 归档和近期全备设为切换硬门禁。

同时补充 CNPG/etcdutl 固定版本安装、显式主库切换、三节点逐台停机、OSS 快照下载校验与远端临时 Secret 清理。已通过 ShellCheck、Kustomize、服务端 dry-run、迁移测试、发布脚本测试、敏感信息扫描及生产 precutover 验收。

scripts/cluster/restore-backup-drill.sh

@@ -40,7 +40,7 @@ SELECT 'sample=' || md5(COALESCE(string_agg(id::text, ',' ORDER BY id),''))
  FROM (SELECT id FROM gateway_tasks ORDER BY id LIMIT 100) rows;
 SQL
 source_snapshot=$($kubectl exec -i -n easyai "$source_primary" -c postgres -- \
-  psql -X -v ON_ERROR_STOP=1 -U easyai -d easyai_ai_gateway <"$acceptance_sql")
+  psql -X -v ON_ERROR_STOP=1 -U postgres -d easyai_ai_gateway <"$acceptance_sql")
 
 cat <<EOF | $kubectl apply -f - >/dev/null
 apiVersion: postgresql.cnpg.io/v1
@@ -83,19 +83,27 @@ spec:
     limits:
       cpu: "2"
       memory: 3Gi
+  projectedVolumeTemplate:
+    defaultMode: 0444
+    sources:
+      - configMap:
+          name: easyai-barman-aws-config
+          items:
+            - key: config
+              path: barman-aws/config
 EOF
 
 $kubectl wait --for=condition=Ready "cluster/$restore_cluster" -n easyai --timeout=1200s
 restore_primary=$($kubectl get cluster "$restore_cluster" -n easyai -o jsonpath='{.status.currentPrimary}')
 restored_snapshot=$($kubectl exec -i -n easyai "$restore_primary" -c postgres -- \
-  psql -X -v ON_ERROR_STOP=1 -U easyai -d easyai_ai_gateway <"$acceptance_sql")
+  psql -X -v ON_ERROR_STOP=1 -U postgres -d easyai_ai_gateway <"$acceptance_sql")
 [[ $restored_snapshot == "$source_snapshot" ]] || {
   diff -u <(printf '%s\n' "$source_snapshot") <(printf '%s\n' "$restored_snapshot")
   exit 1
 }
 $kubectl exec -n easyai "$restore_primary" -c postgres -- \
-  psql -X -v ON_ERROR_STOP=1 -U easyai -d easyai_ai_gateway -At -c \
-  "SELECT current_user || ':' || current_database();" | grep -qx 'easyai:easyai_ai_gateway'
+  psql -X -v ON_ERROR_STOP=1 -U postgres -d easyai_ai_gateway -At -c \
+  "SELECT current_database();" | grep -qx 'easyai_ai_gateway'
 cleanup
 trap - EXIT HUP INT TERM
 rm -f -- "$acceptance_sql"