fix(cluster): 保留深圳原有 UFW 防火墙

移除会与 UFW 冲突的 iptables-persistent 安装，改由 UFW 持久化 WireGuard、kubelet、Flannel 和 NodePort 规则。\n\n预检新增 UFW 已安装且处于 active 的硬门禁，避免包管理器切换防火墙后保留 DROP 默认策略并中断远程接入。\n\n已通过 bash -n、ShellCheck 和差异检查。

docs/operations/k3s-ha-runbook.md

@@ -21,7 +21,8 @@ CloudNativePG；洛杉矶只作为 K3s server/etcd 仲裁节点，并带
 
 本地 `.env.local` 只保存 `AI_GATEWAY_SHENZHEN_HOST` 和 SSH 接入密码，必须保持 `0600` 且
 不得进入 Git。深圳已有宿主机服务时，接入脚本保留其公开端口，只封锁 K3s API、kubelet、
-VXLAN 和除既有 `31058` 外的 NodePort 公网入口。
+VXLAN 和除既有 `31058` 外的 NodePort 公网入口。深圳防火墙继续由原有 UFW 管理，接入脚本
+禁止安装与 UFW 冲突的 `iptables-persistent`；UFW 未安装或未启用时必须在预检阶段停止。
 
 生产上线前的双节点高媒体负载、Worker 强杀和 P24/P28/P32 容量搜索见
 [生产同构验收模式与高媒体压力测试](production-acceptance.md)。

scripts/cluster/add-shenzhen-worker-node.sh

@@ -50,6 +50,8 @@ available_bytes=$(df -B1 --output=avail / | tail -n 1 | tr -d ' ')
 (( available_bytes >= 20 * 1024 * 1024 * 1024 ))
 timedatectl show -p NTPSynchronized --value | grep -Fxq yes
 [[ ! -e /etc/rancher/k3s/config.yaml || -f /etc/rancher/k3s/config.yaml ]]
+command -v ufw >/dev/null
+ufw status | grep -Fqx 'Status: active'
 printf 'shenzhen_worker_preflight=PASS cpu=%s memory_available_mib=%s disk_available_gib=%s\n' \
   "$(nproc)" "$((available_kib / 1024))" "$((available_bytes / 1024 / 1024 / 1024))"
 REMOTE
@@ -230,28 +232,20 @@ node-taint:
   - easyai.io/worker-only=true:NoSchedule
 EOF
 chmod 0600 /etc/rancher/k3s/config.yaml /etc/rancher/k3s/registries.yaml
-export DEBIAN_FRONTEND=noninteractive
-if ! command -v netfilter-persistent >/dev/null 2>&1; then
-  apt-get update -qq
-  apt-get install -y -qq iptables-persistent
-fi
-ensure_rule() {
-  if ! iptables -C INPUT "$@" 2>/dev/null; then iptables -I INPUT 1 "$@"; fi
-}
 public_interface=$(ip -o route get 1.1.1.1 | awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}')
-ensure_rule -i wg0 -s 10.77.0.0/24 -p tcp -m multiport --dports 6443,10250 \
-  -m comment --comment easyai-k3s-private -j ACCEPT
-ensure_rule -i wg0 -s 10.77.0.0/24 -p udp --dport 8472 \
-  -m comment --comment easyai-flannel-private -j ACCEPT
-ensure_rule -i "$public_interface" -p tcp -m multiport --dports 6443,10250 \
-  -m comment --comment easyai-k3s-public-drop -j DROP
-ensure_rule -i "$public_interface" -p udp --dport 8472 \
-  -m comment --comment easyai-flannel-public-drop -j DROP
-ensure_rule -i "$public_interface" -p tcp --dport 30000:31057 \
-  -m comment --comment easyai-nodeport-public-drop-low -j DROP
-ensure_rule -i "$public_interface" -p tcp --dport 31059:32767 \
-  -m comment --comment easyai-nodeport-public-drop-high -j DROP
-netfilter-persistent save >/dev/null
+command -v ufw >/dev/null
+ufw status | grep -Fqx 'Status: active'
+ufw allow in on wg0 from 10.77.0.0/24 to any port 10250 proto tcp comment easyai-kubelet-private >/dev/null
+ufw allow in on wg0 from 10.77.0.0/24 to any port 8472 proto udp comment easyai-flannel-private >/dev/null
+ufw deny in on "$public_interface" to any port 6443 proto tcp comment easyai-k3s-api-public-deny >/dev/null
+ufw deny in on "$public_interface" to any port 10250 proto tcp comment easyai-kubelet-public-deny >/dev/null
+ufw deny in on "$public_interface" to any port 8472 proto udp comment easyai-flannel-public-deny >/dev/null
+for protocol in tcp udp; do
+  ufw deny in on "$public_interface" to any port 30000:31057 proto "$protocol" \
+    comment easyai-nodeport-public-deny-low >/dev/null
+  ufw deny in on "$public_interface" to any port 31059:32767 proto "$protocol" \
+    comment easyai-nodeport-public-deny-high >/dev/null
+done
 install_script=$(mktemp)
 trap 'rm -f -- "$install_script"' EXIT
 curl -fsSL https://get.k3s.io -o "$install_script"