From a5dd7f36f5727878b1cf76c132ceb0d439677547 Mon Sep 17 00:00:00 2001
From: wangbo <wangbolhr@163.com>
Date: Tue, 4 Aug 2026 20:49:04 +0800
Subject: [PATCH] =?UTF-8?q?fix(release):=20=E8=A1=A5=E9=BD=90=E9=A6=99?=
 =?UTF-8?q?=E6=B8=AF=20Worker=20=E6=9D=83=E9=99=90=E4=B8=8E=E7=B2=BE?=
 =?UTF-8?q?=E7=A1=AE=E5=9B=9E=E6=BB=9A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

生产容量控制器原 Role 仅允许访问宁波 Worker，香港 Worker 启用后导致 reconciliation 返回 403。补齐香港 Deployment 及 scale 子资源权限。

同时将失败发布的 Deployment 恢复从合并式 apply 改为基于资源版本的精确 replace，并优先删除发布前不存在的站点，避免新增环境变量残留导致回滚卡死。

验证：bash -n、ShellCheck、cluster release helper、manual release 与差异检查均通过。
---
 .../easyai-ai-gateway-cluster-release         | 32 +++++++++++++++----
 .../production/service-account-rbac.yaml      |  4 +--
 tests/release/cluster-release-helper-test.sh  | 10 ++++++
 3 files changed, 38 insertions(+), 8 deletions(-)

diff --git a/deploy/kubernetes/easyai-ai-gateway-cluster-release b/deploy/kubernetes/easyai-ai-gateway-cluster-release
index 2d5421d..f2b9bf6 100755
--- a/deploy/kubernetes/easyai-ai-gateway-cluster-release
+++ b/deploy/kubernetes/easyai-ai-gateway-cluster-release
@@ -375,22 +375,42 @@ snapshot_application_deployments() {
 
 restore_application_deployments() {
   local snapshot=$1
-  local deployment
+  local deployment deployment_json resource_version
   [[ -s $snapshot ]] || return 1
-  "${kubectl[@]}" apply -f "$snapshot" >/dev/null
+
+  # Remove deployments that did not exist before the release first. This keeps
+  # a newly introduced site from affecting the restored controller while its
+  # previous environment is still being reinstated.
   for deployment in \
     easyai-api-ningbo easyai-api-hongkong \
     easyai-worker-ningbo easyai-worker-hongkong \
     easyai-capacity-controller easyai-web-ningbo easyai-web-hongkong; do
-    if jq -e --arg name "$deployment" \
+    if ! jq -e --arg name "$deployment" \
       'any(.items[]; .metadata.name == $name)' "$snapshot" >/dev/null; then
-      "${kubectl[@]}" rollout status "deployment/$deployment" \
-        -n "$NAMESPACE" --timeout=300s || true
-    else
       "${kubectl[@]}" delete deployment "$deployment" -n "$NAMESPACE" \
         --ignore-not-found=true --wait=true >/dev/null || true
     fi
   done
+
+  # kubectl apply merges list fields and would retain env entries added by a
+  # failed rollout. Replace each existing Deployment with the captured spec so
+  # the recovery is exact while preserving the live resource identity.
+  while IFS= read -r deployment_json; do
+    deployment=$(jq -r '.metadata.name' <<<"$deployment_json")
+    if resource_version=$("${kubectl[@]}" get deployment "$deployment" \
+      -n "$NAMESPACE" -o jsonpath='{.metadata.resourceVersion}' 2>/dev/null); then
+      jq --arg resourceVersion "$resource_version" \
+        '.metadata.resourceVersion = $resourceVersion' <<<"$deployment_json" |
+        "${kubectl[@]}" replace -f - >/dev/null
+    else
+      "${kubectl[@]}" create -f - <<<"$deployment_json" >/dev/null
+    fi
+  done < <(jq -c '.items[]' "$snapshot")
+
+  while IFS= read -r deployment; do
+    "${kubectl[@]}" rollout status "deployment/$deployment" \
+      -n "$NAMESPACE" --timeout=300s || true
+  done < <(jq -r '.items[].metadata.name' "$snapshot")
 }
 
 rollout_worker_site() {
diff --git a/deploy/kubernetes/production/service-account-rbac.yaml b/deploy/kubernetes/production/service-account-rbac.yaml
index 7430eac..c8da50d 100644
--- a/deploy/kubernetes/production/service-account-rbac.yaml
+++ b/deploy/kubernetes/production/service-account-rbac.yaml
@@ -48,11 +48,11 @@ metadata:
 rules:
   - apiGroups: ["apps"]
     resources: ["deployments"]
-    resourceNames: ["easyai-worker-ningbo"]
+    resourceNames: ["easyai-worker-ningbo", "easyai-worker-hongkong"]
     verbs: ["get"]
   - apiGroups: ["apps"]
     resources: ["deployments/scale"]
-    resourceNames: ["easyai-worker-ningbo"]
+    resourceNames: ["easyai-worker-ningbo", "easyai-worker-hongkong"]
     verbs: ["get", "update", "patch"]
   - apiGroups: [""]
     resources: ["pods"]
diff --git a/tests/release/cluster-release-helper-test.sh b/tests/release/cluster-release-helper-test.sh
index ac9c465..0167a25 100755
--- a/tests/release/cluster-release-helper-test.sh
+++ b/tests/release/cluster-release-helper-test.sh
@@ -102,6 +102,16 @@ fi
 grep -Fq 'AI_GATEWAY_WORKER_REPLICAS_HONGKONG=1' \
   "$root/deploy/kubernetes/easyai-ai-gateway-cluster-release.conf.example"
 grep -Fq "hongkong) replicas=\$AI_GATEWAY_WORKER_REPLICAS_HONGKONG" "$helper"
+grep -Fq "\"\${kubectl[@]}\" replace -f -" "$helper"
+if grep -Fq "\"\${kubectl[@]}\" apply -f \"\$snapshot\"" "$helper"; then
+  echo 'deployment rollback still uses merge semantics instead of exact restore' >&2
+  exit 1
+fi
+if [[ $(grep -Fc 'resourceNames: ["easyai-worker-ningbo", "easyai-worker-hongkong"]' \
+  "$root/deploy/kubernetes/production/service-account-rbac.yaml") -ne 2 ]]; then
+  echo 'capacity controller RBAC does not cover both Worker deployments' >&2
+  exit 1
+fi
 
 hongkong_strategy=$(deployment_strategy easyai-worker-hongkong)
 grep -Fq '  replicas: 1' <<<"$hongkong_strategy"