fix: cleanup k8s configs, add deploy.sh, remove hardcoded secrets

- Add one-click deploy script (k8s/deploy.sh) for test + prod
- Add startupProbe to backend (60x10s = 10min grace for ML model loading)
- Add configmap.yaml and secret.yaml (envsubst from backend/.env)
- Fix image URLs: add registry.plfai.cn prefix
- Fix frontend: API base URL relative (/api/v1), login-required mode
- Remove hardcoded localhost references from frontend
- Clean broken kustomize overlays
- Add nodeAffinity for backend→k8smaster, frontend→plf-cvm/k8smaster
- Remove dead ReplicaSets and stale pods during deploy

k8s/base/backend-deployment.yaml

@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
         - name: backend
-          image: graphrag-backend:latest
+          image: registry.plfai.cn/graphrag-backend:latest
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000
@@ -41,17 +41,25 @@ spec:
             limits:
               memory: "2Gi"
               cpu: "1000m"
+          startupProbe:
+            httpGet:
+              path: /api/v1/health
+              port: 8000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            failureThreshold: 60
           livenessProbe:
             httpGet:
               path: /api/v1/health
               port: 8000
-            initialDelaySeconds: 20
+            initialDelaySeconds: 0
             periodSeconds: 30
+            failureThreshold: 3
           readinessProbe:
             httpGet:
               path: /api/v1/health
               port: 8000
-            initialDelaySeconds: 10
+            initialDelaySeconds: 0
             periodSeconds: 10
       volumes:
         - name: backend-data

k8s/base/configmap.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: graphrag-config
+data:
+  DEEPSEEK_BASE_URL: "https://api.deepseek.com"
+  MINERU_PIPELINE: "/app/mineru_mvp/pipeline.py"
+  MINERU_PYTHON: "/opt/venv/bin/python"
+  KEYCLOAK_SERVER_URL: "https://keycloak.plfai.cn"
+  KEYCLOAK_REALM: "plfai"
+  KEYCLOAK_CLIENT_ID: "graphrag-backend"
+  KEYCLOAK_AUDIENCE: "account"

k8s/base/frontend-deployment.yaml

@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
         - name: frontend
-          image: graphrag-frontend:latest
+          image: registry.plfai.cn/graphrag-frontend:latest
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

k8s/base/kustomization.yaml

@@ -7,3 +7,5 @@ resources:
   - frontend-deployment.yaml
   - frontend-service.yaml
   - persistent-volume-claims.yaml
+  - configmap.yaml
+  - secret.yaml

k8s/base/persistent-volume-claims.yaml

@@ -5,6 +5,7 @@ metadata:
 spec:
   accessModes:
     - ReadWriteOnce
+  storageClassName: local-path
   resources:
     requests:
       storage: 10Gi
@@ -16,6 +17,7 @@ metadata:
 spec:
   accessModes:
     - ReadWriteOnce
+  storageClassName: local-path
   resources:
     requests:
       storage: 5Gi

k8s/base/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: graphrag-secrets
+type: Opaque
+stringData:
+  DEEPSEEK_API_KEY: "${DEEPSEEK_API_KEY}"
+  MINERU_API_TOKEN: "${MINERU_API_TOKEN}"
+  KEYCLOAK_CLIENT_SECRET: "${KEYCLOAK_CLIENT_SECRET}"