feat(deploy): 增加三节点 K3s 高可用迁移能力

新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。

新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。

所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。

验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。

deploy/kubernetes/production/application-config.yaml

@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: easyai-ai-gateway-config
+  labels:
+    app.kubernetes.io/part-of: easyai-ai-gateway
+data:
+  APP_ENV: production
+  HTTP_ADDR: ":8088"
+  IDENTITY_MODE: hybrid
+  IDENTITY_SECRET_STORE: kubernetes
+  IDENTITY_KUBERNETES_NAMESPACE: easyai
+  IDENTITY_KUBERNETES_SECRET_NAME: easyai-gateway-security-events
+  IDENTITY_SECURITY_EVENTS_HEARTBEAT_INTERVAL_SECONDS: "60"
+  IDENTITY_SECURITY_EVENTS_STALE_AFTER_SECONDS: "180"
+  IDENTITY_SECURITY_EVENTS_CLOCK_SKEW_SECONDS: "60"
+  SERVER_MAIN_BASE_URL: http://10.77.0.1:3000
+  TASK_PROGRESS_CALLBACK_ENABLED: "true"
+  TASK_PROGRESS_CALLBACK_URL: http://10.77.0.1:3000/internal/platform/task-progress-callbacks
+  TASK_PROGRESS_CALLBACK_TIMEOUT_MS: "5000"
+  TASK_PROGRESS_CALLBACK_MAX_ATTEMPTS: "10"
+  AI_GATEWAY_TASK_CLEANUP_ENABLED: "false"
+  AI_GATEWAY_TASK_RETENTION_DAYS: "30"
+  AI_GATEWAY_TASK_ANALYSIS_RETENTION_DAYS: "7"
+  AI_GATEWAY_TASK_CLEANUP_INTERVAL_SECONDS: "300"
+  AI_GATEWAY_TASK_CLEANUP_BATCH_SIZE: "1000"
+  CORS_ALLOWED_ORIGIN: https://ai.51easyai.com
+  AI_GATEWAY_PUBLIC_BASE_URL: https://ai.51easyai.com
+  AI_GATEWAY_WEB_BASE_URL: https://ai.51easyai.com
+  AI_GATEWAY_GENERATED_STORAGE_DIR: /app/data/static/generated
+  AI_GATEWAY_UPLOADED_STORAGE_DIR: /app/data/static/uploaded
+  AI_GATEWAY_LOCAL_TEMP_ASSET_TTL_HOURS: "24"
+  AI_GATEWAY_LOCAL_RESULT_TTL_HOURS: "24"
+  AI_GATEWAY_LOCAL_RESULT_MIN_FREE_BYTES: "10737418240"
+  AI_GATEWAY_LOCAL_RESULT_MAX_BYTES: "268435456"
+  AI_GATEWAY_LOCAL_RESULT_MAX_TASK_BYTES: "536870912"
+  AI_GATEWAY_ASYNC_QUEUE_WORKER_ENABLED: "true"
+  AI_GATEWAY_ASYNC_WORKER_HARD_LIMIT: "2048"
+  AI_GATEWAY_ASYNC_WORKER_REFRESH_INTERVAL_SECONDS: "5"

deploy/kubernetes/production/application.yaml

@@ -0,0 +1,439 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: easyai-api-ningbo
+  labels:
+    app.kubernetes.io/name: easyai-api
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: easyai-api
+      easyai.io/site: ningbo
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: easyai-api
+        app.kubernetes.io/component: api
+        app.kubernetes.io/part-of: easyai-ai-gateway
+        easyai.io/site: ningbo
+    spec:
+      serviceAccountName: easyai-ai-gateway
+      terminationGracePeriodSeconds: 90
+      nodeSelector:
+        easyai.io/site: ningbo
+        easyai.io/workload: "true"
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: api
+          image: easyai-api
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: easyai-ai-gateway-config
+            - secretRef:
+                name: easyai-ai-gateway-runtime
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          ports:
+            - name: http
+              containerPort: 8088
+          readinessProbe:
+            httpGet:
+              path: /api/v1/readyz
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /api/v1/healthz
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "sleep 10"]
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: application-data
+              mountPath: /app/data
+            - name: temporary-files
+              mountPath: /tmp
+      volumes:
+        - name: application-data
+          emptyDir:
+            sizeLimit: 5Gi
+        - name: temporary-files
+          emptyDir:
+            sizeLimit: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: easyai-api-hongkong
+  labels:
+    app.kubernetes.io/name: easyai-api
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: easyai-api
+      easyai.io/site: hongkong
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: easyai-api
+        app.kubernetes.io/component: api
+        app.kubernetes.io/part-of: easyai-ai-gateway
+        easyai.io/site: hongkong
+    spec:
+      serviceAccountName: easyai-ai-gateway
+      terminationGracePeriodSeconds: 90
+      nodeSelector:
+        easyai.io/site: hongkong
+        easyai.io/workload: "true"
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: api
+          image: easyai-api
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: easyai-ai-gateway-config
+            - secretRef:
+                name: easyai-ai-gateway-runtime
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          ports:
+            - name: http
+              containerPort: 8088
+          readinessProbe:
+            httpGet:
+              path: /api/v1/readyz
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /api/v1/healthz
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "sleep 10"]
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: application-data
+              mountPath: /app/data
+            - name: temporary-files
+              mountPath: /tmp
+      volumes:
+        - name: application-data
+          emptyDir:
+            sizeLimit: 5Gi
+        - name: temporary-files
+          emptyDir:
+            sizeLimit: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: easyai-web-ningbo
+  labels:
+    app.kubernetes.io/name: easyai-web
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: easyai-web
+      easyai.io/site: ningbo
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: easyai-web
+        app.kubernetes.io/component: web
+        app.kubernetes.io/part-of: easyai-ai-gateway
+        easyai.io/site: ningbo
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      nodeSelector:
+        easyai.io/site: ningbo
+        easyai.io/workload: "true"
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+        fsGroup: 101
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: web
+          image: easyai-web
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+              add: ["NET_BIND_SERVICE"]
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: nginx-cache
+              mountPath: /var/cache/nginx
+            - name: nginx-run
+              mountPath: /var/run
+      volumes:
+        - name: nginx-cache
+          emptyDir:
+            sizeLimit: 128Mi
+        - name: nginx-run
+          emptyDir:
+            sizeLimit: 16Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: easyai-web-hongkong
+  labels:
+    app.kubernetes.io/name: easyai-web
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: easyai-web
+      easyai.io/site: hongkong
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: easyai-web
+        app.kubernetes.io/component: web
+        app.kubernetes.io/part-of: easyai-ai-gateway
+        easyai.io/site: hongkong
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      nodeSelector:
+        easyai.io/site: hongkong
+        easyai.io/workload: "true"
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+        fsGroup: 101
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: web
+          image: easyai-web
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+              add: ["NET_BIND_SERVICE"]
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: nginx-cache
+              mountPath: /var/cache/nginx
+            - name: nginx-run
+              mountPath: /var/run
+      volumes:
+        - name: nginx-cache
+          emptyDir:
+            sizeLimit: 128Mi
+        - name: nginx-run
+          emptyDir:
+            sizeLimit: 16Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: api
+  labels:
+    app.kubernetes.io/name: easyai-api
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-api
+  ports:
+    - name: http
+      port: 8088
+      targetPort: http
+      nodePort: 30088
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: web
+  labels:
+    app.kubernetes.io/name: easyai-web
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-web
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      nodePort: 30178
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: easyai-api
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: easyai-api
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: easyai-web
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: easyai-web

deploy/kubernetes/production/database.yaml

@@ -0,0 +1,113 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: easyai-postgres-oss
+  labels:
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  retentionPolicy: 14d
+  configuration:
+    destinationPath: s3://wangbo0808/easyai-ai-gateway/production/postgresql
+    endpointURL: https://oss-cn-shanghai.aliyuncs.com
+    s3Credentials:
+      accessKeyId:
+        name: easyai-oss-backup
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: easyai-oss-backup
+        key: ACCESS_SECRET_KEY
+    wal:
+      compression: gzip
+      maxParallel: 2
+    data:
+      compression: gzip
+      jobs: 2
+  instanceSidecarConfiguration:
+    env:
+      - name: AWS_DEFAULT_REGION
+        value: oss-cn-shanghai
+      - name: AWS_REQUEST_CHECKSUM_CALCULATION
+        value: when_required
+      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
+        value: when_required
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: easyai-postgres
+  labels:
+    app.kubernetes.io/name: easyai-postgres
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  instances: 2
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.4-standard-trixie@sha256:4587df73024408f5b2be9b4dd6ba2ccee8c9e5dc0c9a87c274c292291cc8a68c
+  imagePullPolicy: IfNotPresent
+  primaryUpdateStrategy: unsupervised
+  primaryUpdateMethod: switchover
+  failoverDelay: 0
+  switchoverDelay: 60
+  stopDelay: 90
+  smartShutdownTimeout: 30
+  bootstrap:
+    initdb:
+      database: easyai_ai_gateway
+      owner: easyai
+      secret:
+        name: easyai-postgres-app
+      postInitSQL:
+        - CREATE EXTENSION IF NOT EXISTS pgcrypto;
+  storage:
+    storageClass: local-path
+    size: 20Gi
+  walStorage:
+    storageClass: local-path
+    size: 5Gi
+  affinity:
+    enablePodAntiAffinity: true
+    podAntiAffinityType: required
+    topologyKey: easyai.io/site
+    nodeSelector:
+      easyai.io/database: "true"
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+    limits:
+      cpu: "2"
+      memory: 3Gi
+  postgresql:
+    synchronous:
+      method: any
+      number: 1
+      dataDurability: preferred
+    parameters:
+      archive_timeout: 60s
+      max_connections: "200"
+      shared_buffers: 512MB
+      wal_compression: "on"
+      wal_keep_size: 1GB
+  monitoring:
+    enablePodMonitor: false
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: easyai-postgres-oss
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: easyai-postgres-daily
+  labels:
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  # Six-field cron, UTC: 18:30 UTC is 02:30 Asia/Shanghai.
+  schedule: "0 30 18 * * *"
+  backupOwnerReference: self
+  cluster:
+    name: easyai-postgres
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io
+  immediate: false
+  suspend: false

deploy/kubernetes/production/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: easyai
+resources:
+  - namespace.yaml
+  - service-account-rbac.yaml
+  - application-config.yaml
+  - application.yaml
+  - database.yaml
+  - network-policy.yaml
+images:
+  # Deployment tooling must replace both sentinel digests with release-manifest
+  # digests before server-side apply.
+  - name: easyai-api
+    newName: registry.cn-shanghai.aliyuncs.com/easyaigc/ai-gateway
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+  - name: easyai-web
+    newName: registry.cn-shanghai.aliyuncs.com/easyaigc/ai-gateway-web
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000

deploy/kubernetes/production/namespace.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: easyai
+  labels:
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted

deploy/kubernetes/production/network-policy.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: easyai-application-ingress
+spec:
+  podSelector:
+    matchExpressions:
+      - key: app.kubernetes.io/name
+        operator: In
+        values: [easyai-api, easyai-web]
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: easyai
+        - ipBlock:
+            cidr: 10.77.0.0/24
+      ports:
+        - protocol: TCP
+          port: 8088
+        - protocol: TCP
+          port: 80

deploy/kubernetes/production/service-account-rbac.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: easyai-ai-gateway
+  labels:
+    app.kubernetes.io/part-of: easyai-ai-gateway
+automountServiceAccountToken: true
+imagePullSecrets:
+  - name: easyai-registry
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: easyai-gateway-security-events
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: ["easyai-gateway-security-events"]
+    verbs: ["get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: easyai-gateway-security-events
+subjects:
+  - kind: ServiceAccount
+    name: easyai-ai-gateway
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: easyai-gateway-security-events