chore: 统一本地服务器与远程仓库源码

- 合并 main 与 master 历史并以服务器结构为基线
- 保留迁移、数据保留、AWS 账单与部署安全能力
- 建立 SDD 规格和 CI 验证闭环

deploy/kubernetes/deployment.yaml

@@ -34,13 +34,27 @@ spec:
         app.kubernetes.io/name: aiops
         app.kubernetes.io/component: app
     spec:
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
+      # 不使用 hostNetwork，避免 Pod 直接共享节点网络命名空间。 // Logan.Li
+      dnsPolicy: ClusterFirst
       enableServiceLinks: false
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
       # 首次部署时在 PVC 中预创建库文件，避免 subPath 挂载成目录 // Logan.Li
       initContainers:
         - name: init-local-db
           image: busybox:1.36
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
           command:
             - sh
             - -c
@@ -51,8 +65,9 @@ spec:
               if [ -f /vol/data/redka/redka.db ] && [ ! -f /vol/redka.db ]; then
                 cp /vol/data/redka/redka.db /vol/redka.db
               fi
-              [ -f /vol/sqlite3.db ] || install -m 644 /dev/null /vol/sqlite3.db
-              [ -f /vol/redka.db ] || install -m 644 /dev/null /vol/redka.db
+              [ -f /vol/sqlite3.db ] || install -m 660 /dev/null /vol/sqlite3.db
+              [ -f /vol/redka.db ] || install -m 660 /dev/null /vol/redka.db
+              chown 10001:10001 /vol/sqlite3.db /vol/redka.db
           volumeMounts:
             - name: data
               mountPath: /vol
@@ -72,22 +87,28 @@ spec:
             - name: MODE
               value: local
             - name: JWT_SECRET
-              value: "aiops-jwt-secret-key-2026"
-            # --- 集群模式（mode=release）时启用 ---
+              valueFrom:
+                secretKeyRef:
+                  name: aiops-secret
+                  key: jwt-secret
+            # --- 集群模式（mode=release）时通过 Secret 引用数据库凭据。 // Logan.Li
             # - name: DATABASE_DRIVER
             #   value: "mysql"
             # - name: DATABASE_HOST
-            #   value: "10.10.10.75"
+            #   value: "mysql"
             # - name: DATABASE_USER
-            #   value: "root"
+            #   value: "aiops"
             # - name: DATABASE_PASSWORD
-            #   value: "aiops_root_2026"
+            #   valueFrom:
+            #     secretKeyRef:
+            #       name: aiops-secret
+            #       key: mysql-password
             # - name: DATABASE_DBNAME
             #   value: "aiops"
             # - name: REDIS_DRIVER
             #   value: "redis"
             # - name: REDIS_HOST
-            #   value: "10.10.10.75"
+            #   value: "redis"
 
           volumeMounts:
             - name: config
@@ -104,6 +125,16 @@ spec:
               mountPath: /app/redka.db
               subPath: redka.db
 
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
+
           readinessProbe:
             httpGet:
               path: /version
@@ -130,7 +161,8 @@ spec:
           configMap:
             name: aiops-config
         - name: uploads
-          emptyDir: {}
+          persistentVolumeClaim:
+            claimName: aiops-uploads
         - name: data
           persistentVolumeClaim:
             claimName: aiops-data
@@ -153,3 +185,46 @@ spec:
       targetPort: 8080
       nodePort: 30080
       protocol: TCP
+---
+# 限制集群内 MySQL/Redis 仅接受 AIOps Pod 连接。 // Logan.Li
+# AIOps 需要接收集群外 Agent 的上报；在确定 Ingress 与 Agent 出口 CIDR 前，
+# 不对应用 Pod 启用默认拒绝策略，以免阻断运维采集链路。 // Logan.Li
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: mysql-ingress-from-aiops-only
+  namespace: devops
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: mysql
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: aiops
+      ports:
+        - protocol: TCP
+          port: 3306
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: redis-ingress-from-aiops-only
+  namespace: devops
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: redis
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: aiops
+      ports:
+        - protocol: TCP
+          port: 6379