fix: cleanup k8s configs, add deploy.sh, remove hardcoded secrets

- Add one-click deploy script (k8s/deploy.sh) for test + prod
- Add startupProbe to backend (60x10s = 10min grace for ML model loading)
- Add configmap.yaml and secret.yaml (envsubst from backend/.env)
- Fix image URLs: add registry.plfai.cn prefix
- Fix frontend: API base URL relative (/api/v1), login-required mode
- Remove hardcoded localhost references from frontend
- Clean broken kustomize overlays
- Add nodeAffinity for backend→k8smaster, frontend→plf-cvm/k8smaster
- Remove dead ReplicaSets and stale pods during deploy

.gitignore

@@ -41,3 +41,4 @@ mineru_mvp/output/
 
 # Claude Code personal config
 settings.json
+backend/.env

backend/Dockerfile

@@ -23,7 +23,8 @@ RUN uv venv /opt/venv && \
         "networkx>=3.0" \
         "python-dotenv>=1.0.0" \
         "requests>=2.31.0" \
-        "beautifulsoup4>=4.12.0"
+        "beautifulsoup4>=4.12.0" \
+        "python-jose[cryptography]>=3.3.0"
 
 # ===== Stage 2: Runtime =====
 FROM python:3.12-slim

frontend/src/app/api.ts

@@ -4,7 +4,7 @@
  * All functions return the `data` field; throw ApiError on code !== 0
  */
 
-const BASE = 'http://localhost:8000/api/v1';
+const BASE = '/api/v1';
 
 export class ApiError extends Error {
   code: number;

frontend/src/app/auth.ts

@@ -13,9 +13,7 @@ export async function initKeycloak(): Promise<boolean> {
 
   try {
     const authenticated = await keycloak.init({
-      onLoad: 'check-sso',
+      onLoad: 'login-required',
-      silentCheckSsoRedirectUri:
-        window.location.origin + '/silent-check-sso.html',
       pkceMethod: 'S256',
     });
     _initialized = true;

frontend/src/app/components/layout/Header.tsx

@@ -163,7 +163,7 @@ export function Header() {
           className="inline-block w-2 h-2 rounded-full"
           style={{ background: allOk ? 'var(--green)' : 'var(--red)' }}
         />
-        <span style={{ color: 'var(--text-3)', fontSize: 12 }}>API: localhost:8000</span>
+        <span style={{ color: 'var(--text-3)', fontSize: 12 }}>API: /api/v1</span>
       </div>
     </header>
   );

frontend/src/app/components/pages/QAChat.tsx

@@ -79,7 +79,7 @@ export function QAChat() {
       setMessages(prev => [...prev, {
         id: `err${Date.now()}`,
         role: 'ai',
-        content: `⚠️ 请求失败：${msg}\n\n请确认：\n1. 后端服务已启动（localhost:8000）\n2. 知识图谱已有数据（请先上传并索引文档）\n3. DeepSeek API Key 已配置`,
+        content: `⚠️ 请求失败：${msg}\n\n请确认：\n1. 后端服务已启动\n2. 知识图谱已有数据（请先上传并索引文档）\n3. DeepSeek API Key 已配置`,
         timestamp: new Date().toISOString(),
       }]);
     } finally {

k8s/base/backend-deployment.yaml

@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
         - name: backend
-          image: graphrag-backend:latest
+          image: registry.plfai.cn/graphrag-backend:latest
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000
@@ -41,17 +41,25 @@ spec:
             limits:
               memory: "2Gi"
               cpu: "1000m"
+          startupProbe:
+            httpGet:
+              path: /api/v1/health
+              port: 8000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            failureThreshold: 60
           livenessProbe:
             httpGet:
               path: /api/v1/health
               port: 8000
-            initialDelaySeconds: 20
+            initialDelaySeconds: 0
             periodSeconds: 30
+            failureThreshold: 3
           readinessProbe:
             httpGet:
               path: /api/v1/health
               port: 8000
-            initialDelaySeconds: 10
+            initialDelaySeconds: 0
             periodSeconds: 10
       volumes:
         - name: backend-data

k8s/base/configmap.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: graphrag-config
+data:
+  DEEPSEEK_BASE_URL: "https://api.deepseek.com"
+  MINERU_PIPELINE: "/app/mineru_mvp/pipeline.py"
+  MINERU_PYTHON: "/opt/venv/bin/python"
+  KEYCLOAK_SERVER_URL: "https://keycloak.plfai.cn"
+  KEYCLOAK_REALM: "plfai"
+  KEYCLOAK_CLIENT_ID: "graphrag-backend"
+  KEYCLOAK_AUDIENCE: "account"

k8s/base/frontend-deployment.yaml

@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
         - name: frontend
-          image: graphrag-frontend:latest
+          image: registry.plfai.cn/graphrag-frontend:latest
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

k8s/base/kustomization.yaml

@@ -7,3 +7,5 @@ resources:
   - frontend-deployment.yaml
   - frontend-service.yaml
   - persistent-volume-claims.yaml
+  - configmap.yaml
+  - secret.yaml

k8s/base/persistent-volume-claims.yaml

@@ -5,6 +5,7 @@ metadata:
 spec:
   accessModes:
     - ReadWriteOnce
+  storageClassName: local-path
   resources:
     requests:
       storage: 10Gi
@@ -16,6 +17,7 @@ metadata:
 spec:
   accessModes:
     - ReadWriteOnce
+  storageClassName: local-path
   resources:
     requests:
       storage: 5Gi

k8s/base/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: graphrag-secrets
+type: Opaque
+stringData:
+  DEEPSEEK_API_KEY: "${DEEPSEEK_API_KEY}"
+  MINERU_API_TOKEN: "${MINERU_API_TOKEN}"
+  KEYCLOAK_CLIENT_SECRET: "${KEYCLOAK_CLIENT_SECRET}"

k8s/deploy.sh

@@ -0,0 +1,182 @@
+#!/bin/bash
+# GraphRAG Studio — 一键部署脚本 (test + prod 双环境)
+# 用法: bash k8s/deploy.sh
+# 前提: k3s 集群已运行, docker 可用, registry.plfai.cn 可推送
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+REGISTRY="registry.plfai.cn"
+BACKEND_IMAGE="${REGISTRY}/graphrag-backend"
+FRONTEND_IMAGE="${REGISTRY}/graphrag-frontend"
+KUBECTL="k3s kubectl"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+log()  { echo -e "${BLUE}[$(date +%H:%M:%S)]${NC} $1"; }
+ok()   { echo -e "${GREEN}[OK]${NC} $1"; }
+err()  { echo -e "${RED}[ERR]${NC} $1"; exit 1; }
+
+# ──────────────── 加载密钥 ────────────────
+if [ -f "$PROJECT_DIR/backend/.env" ]; then
+  set -a; source "$PROJECT_DIR/backend/.env"; set +a
+else
+  err "请先创建 backend/.env（参考 backend/.env.example）"
+fi
+
+if [ -z "$DEEPSEEK_API_KEY" ] || [ "$DEEPSEEK_API_KEY" = "sk-your-key-here" ]; then
+  err "请在 backend/.env 中填入 DEEPSEEK_API_KEY"
+fi
+
+# ──────────────── 1. 构建镜像 ────────────────
+log "Building backend image..."
+cd "$PROJECT_DIR"
+docker build --network host -f backend/Dockerfile -t "${BACKEND_IMAGE}:latest" . || err "backend build"
+docker tag "${BACKEND_IMAGE}:latest" "${BACKEND_IMAGE}:v1"
+ok "Backend built"
+
+log "Building frontend image..."
+docker build --network host -f frontend/Dockerfile -t "${FRONTEND_IMAGE}:latest" . || err "frontend build"
+docker tag "${FRONTEND_IMAGE}:latest" "${FRONTEND_IMAGE}:v1"
+ok "Frontend built"
+
+# ──────────────── 2. 推送镜像 ────────────────
+log "Pushing images to registry..."
+docker push "${BACKEND_IMAGE}:latest" "${BACKEND_IMAGE}:v1" >/dev/null 2>&1
+docker push "${FRONTEND_IMAGE}:latest" "${FRONTEND_IMAGE}:v1" >/dev/null 2>&1
+ok "Images pushed"
+
+# ──────────────── 3. 导入 containerd ────────────────
+log "Importing into containerd..."
+docker save "${BACKEND_IMAGE}:v1" | k3s ctr images import - >/dev/null 2>&1
+docker save "${FRONTEND_IMAGE}:v1" | k3s ctr images import - >/dev/null 2>&1
+ok "Containerd loaded"
+
+# ──────────────── 4. 部署 Kubernetes ────────────────
+deploy_env() {
+  local NS="$1" label="$2"
+
+  log "Deploying ${label} (ns: ${NS})..."
+
+  # 创建 namespace
+  $KUBECTL create namespace "$NS" --dry-run=client -o yaml | $KUBECTL apply -f - 2>/dev/null
+
+  # apply ConfigMap
+  $KUBECTL apply -n "$NS" -f "$SCRIPT_DIR/base/configmap.yaml" 2>/dev/null
+
+  # envsubst 注入密钥 → apply Secret
+  envsubst < "$SCRIPT_DIR/base/secret.yaml" | $KUBECTL apply -n "$NS" -f - 2>/dev/null
+
+  # apply 其余 base 资源
+  for f in "$SCRIPT_DIR/base"/*.yaml; do
+    case "$(basename "$f")" in
+      kustomization.yaml|configmap.yaml|secret.yaml) continue ;;
+      *) $KUBECTL apply -n "$NS" -f "$f" 2>/dev/null ;;
+    esac
+  done
+
+  # 修正镜像 tag
+  $KUBECTL set image deployment/backend "backend=${BACKEND_IMAGE}:v1" -n "$NS" 2>/dev/null
+  $KUBECTL set image deployment/frontend "frontend=${FRONTEND_IMAGE}:v1" -n "$NS" 2>/dev/null
+
+  # 修正 backend command（镜像 CMD 可能为 sleep）
+  $KUBECTL patch deployment backend -n "$NS" --type json -p '[
+    {"op":"add","path":"/spec/template/spec/containers/0/command","value":["/opt/venv/bin/python","-m","uvicorn","main:app","--host","0.0.0.0","--port","8000"]}
+  ]' 2>/dev/null
+
+  # 节点亲和性
+  $KUBECTL patch deployment backend -n "$NS" --type merge -p \
+    '{"spec":{"template":{"spec":{"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"kubernetes.io/hostname","operator":"In","values":["k8smaster"]}]}]}}}}}}}' 2>/dev/null
+
+  $KUBECTL patch deployment frontend -n "$NS" --type merge -p \
+    '{"spec":{"template":{"spec":{"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"kubernetes.io/hostname","operator":"In","values":["plf-cvm-worker","k8smaster"]}]}]}}}}}}}' 2>/dev/null
+
+  ok "${label} deployed"
+}
+
+deploy_env "graphrag-test" "TEST"
+deploy_env "graphrag-prod" "PROD"
+
+# ──────────────── 5. 等待就绪 ────────────────
+log "Waiting for pods..."
+for ns in graphrag-test graphrag-prod; do
+  $KUBECTL wait --for=condition=ready pod -l component=backend  -n "$ns" --timeout=360s 2>/dev/null && ok "${ns} backend ready"  || log "  ${ns} backend still starting"
+  $KUBECTL wait --for=condition=ready pod -l component=frontend -n "$ns" --timeout=60s  2>/dev/null && ok "${ns} frontend ready" || log "  ${ns} frontend still starting"
+done
+
+# ──────────────── 6. 配置 nginx ────────────────
+log "Setting up nginx..."
+
+setup_nginx() {
+  local domain="$1" frontend_ip="$2" backend_ip="$3"
+  cat > "/etc/nginx/conf.d/${domain}.conf" << NGINX
+server {
+    listen 443 ssl;
+    server_name ${domain};
+    ssl_certificate     /etc/letsencrypt/live/plfai.cn/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/plfai.cn/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    location /api/ {
+        proxy_pass http://${backend_ip}:8000;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_read_timeout 120s;
+        proxy_buffering off;
+    }
+
+    location / {
+        proxy_pass http://${frontend_ip}:80;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+server {
+    listen 80;
+    server_name ${domain};
+    return 301 https://\$server_name\$request_uri;
+}
+NGINX
+  ok "nginx: ${domain}"
+}
+
+TEST_FE=$($KUBECTL get svc frontend -n graphrag-test -o jsonpath='{.spec.clusterIP}')
+TEST_BE=$($KUBECTL get svc backend  -n graphrag-test -o jsonpath='{.spec.clusterIP}')
+PROD_FE=$($KUBECTL get svc frontend -n graphrag-prod -o jsonpath='{.spec.clusterIP}')
+PROD_BE=$($KUBECTL get svc backend  -n graphrag-prod -o jsonpath='{.spec.clusterIP}')
+
+setup_nginx "test-graphrag.plfai.cn"          "$TEST_FE" "$TEST_BE"
+setup_nginx "test-graphrag-backend.plfai.cn"  "$TEST_BE" "$TEST_BE"
+setup_nginx "graphrag.plfai.cn"               "$PROD_FE" "$PROD_BE"
+setup_nginx "graphrag-backend.plfai.cn"       "$PROD_BE" "$PROD_BE"
+
+nginx -t >/dev/null 2>&1 && nginx -s reload >/dev/null 2>&1
+ok "nginx reloaded"
+
+# ──────────────── 7. 验证 ────────────────
+echo ""
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}  GraphRAG Studio 部署完成${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo ""
+echo "Test: https://test-graphrag.plfai.cn"
+echo "Prod: https://graphrag.plfai.cn"
+echo ""
+
+for url in \
+  "https://test-graphrag.plfai.cn" \
+  "https://graphrag.plfai.cn" \
+  "https://test-graphrag-backend.plfai.cn/api/v1/health" \
+  "https://graphrag-backend.plfai.cn/api/v1/health"; do
+  code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 5 "$url" 2>/dev/null || echo "ERR")
+  echo "  $url → HTTP $code"
+done
+echo ""
+echo -e "${GREEN}Done.${NC}"

k8s/overlays/prod/kustomization.yaml

@@ -1,34 +1,11 @@
+# prod 环境 overlay — 仅供参考
+# 实际部署使用项目根目录的 k8s/deploy.sh（支持从 backend/.env 读密钥）
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 namespace: graphrag-prod
-
 namePrefix: prod-
 
 resources:
   - ../../base
   - namespace.yaml
-
-configMapGenerator:
-  - name: graphrag-config
-    behavior: replace
-    literals:
-      - DEEPSEEK_BASE_URL=https://api.deepseek.com
-      - MINERU_PIPELINE=/app/mineru_mvp/pipeline.py
-      - MINERU_PYTHON=/opt/venv/bin/python
-      - KEYCLOAK_SERVER_URL=https://keycloak.plfai.cn
-      - KEYCLOAK_REALM=plfai
-      - KEYCLOAK_CLIENT_ID=graphrag-backend
-      - KEYCLOAK_AUDIENCE=account
-
-secretGenerator:
-  - name: graphrag-secrets
-    behavior: replace
-    literals:
-      - DEEPSEEK_API_KEY=sk-prod-placeholder
-      - MINERU_API_TOKEN=prod-placeholder
-      - KEYCLOAK_CLIENT_SECRET=prod-placeholder
-
-patches:
-  - path: ingress.yaml
-  - path: replicas-patch.yaml

k8s/overlays/test/kustomization.yaml

@@ -1,33 +1,11 @@
+# test 环境 overlay — 仅供参考
+# 实际部署使用项目根目录的 k8s/deploy.sh（支持从 backend/.env 读密钥）
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 namespace: graphrag-test
-
 namePrefix: test-
 
 resources:
   - ../../base
   - namespace.yaml
-
-configMapGenerator:
-  - name: graphrag-config
-    behavior: replace
-    literals:
-      - DEEPSEEK_BASE_URL=https://api.deepseek.com
-      - MINERU_PIPELINE=/app/mineru_mvp/pipeline.py
-      - MINERU_PYTHON=/opt/venv/bin/python
-      - KEYCLOAK_SERVER_URL=https://keycloak.plfai.cn
-      - KEYCLOAK_REALM=plfai
-      - KEYCLOAK_CLIENT_ID=graphrag-backend
-      - KEYCLOAK_AUDIENCE=account
-
-secretGenerator:
-  - name: graphrag-secrets
-    behavior: replace
-    literals:
-      - DEEPSEEK_API_KEY=sk-test-placeholder
-      - MINERU_API_TOKEN=test-placeholder
-      - KEYCLOAK_CLIENT_SECRET=test-placeholder
-
-patches:
-  - path: ingress.yaml