From 205ee0ba4f8293b52de569ff46abf3f78ef0122f Mon Sep 17 00:00:00 2001
From: zeaslity <ice@qq.com>
Date: Wed, 1 Jul 2026 16:30:30 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E4=BB=A3=E7=A0=81=E6=B8=85?=
 =?UTF-8?q?=E7=90=86=E5=B7=A5=E5=85=B7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore                                    |    3 +
 .idea/workspace.xml                           |   74 +-
 1-2025年/58-202503-新DEMO环境/批量指令.sh     |    5 +-
 .../260629-证书升级/real-nginx-proxy.conf     |   98 ++
 .../2-节点驱逐-完整解决方案.md                | 1034 +++++++++++++++++
 997-项目VPN虚拟机/3-ubuntu2204虚拟机模板.sh   |   13 +
 .../f-nginx暴露/真实nginx-reverse-proxy.conf  |    2 +
 .../故障恢复脚本/删除状态不为Running的Pod.sh  |    2 +-
 998-常用脚本/更新脚本/cmii-clean母脚本.sh     |   40 +
 9 files changed, 1217 insertions(+), 54 deletions(-)
 create mode 100644 .gitignore
 create mode 100644 71-202601-XA监管平台/260629-证书升级/real-nginx-proxy.conf
 create mode 100644 85-20260617-江西环境整理/2-节点驱逐-完整解决方案.md
 create mode 100644 998-常用脚本/更新脚本/cmii-clean母脚本.sh

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..5335bcd
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+/.idea/
+/.fastRequest/
+/.vscode/
diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index 57632e9..8ff70f5 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -4,61 +4,13 @@
     <option name="autoReloadType" value="SELECTIVE" />
   </component>
   <component name="ChangeListManager">
-    <list default="true" id="5b79c488-edbc-40fd-80a0-510f37a69556" name="Changes" comment="">
-      <change afterPath="$PROJECT_DIR$/0-archived/41-202410-珠海横琴/260616-漏洞修复.md" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/70-202511-XA低空平台/real-nginx-proxy.conf" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/2.3.4-b版本/2.3.3-b新增微服务/cmii-uas-airespace.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/2.3.4-b版本/2.3.3-b新增微服务/cmii-uas-foundation.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/2.3.4-b版本/2.3.3-b新增微服务/cmii-uas-la-defense.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/2.3.4-b版本/2.3.3-b新增微服务/cmii-uas-parser-worker.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/2.3.4-b版本/2.3.4-b-upgrade.sql" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/2.3.4-b版本/image.txt" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/2.3.4-b版本/动态密钥.txt" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/260629-证书升级/xadcity.com.key" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/260629-证书升级/xadcity.com.pem" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/71-202601-XA监管平台/反向代理/haikang-reverse-proxy.conf" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/75-202603-重庆二级平台/4-nginx代理/gaode-reverse-proxy.conf" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/TCP暴露面.txt" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/k8s-app/cmii-nginx-cm.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/k8s-app/cmii-uav-platform-uas.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/k8s-app/cmii-uav-platform-uasms.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/k8s-app/k8s-ingress-13014.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/公网暴露/real-nginx-proxy.conf" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/服务暴露面.txt" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/视频流媒体/all-configmap.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/视频流媒体/cmii-live-helper-deployment.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/视频流媒体/cmii-live-op-deployment.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/视频流媒体/cmii-live-proxy-deployment.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/视频流媒体/media-suite-deployment.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/视频流媒体/nginx-proxy.conf" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/视频流媒体/pvc.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/视频流媒体/替换模板.txt" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/视频流媒体/镜像列表.txt" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/镜像/监管2.3-arm.txt" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/81-202604-深圳龙华监管/镜像/视频流媒体.txt" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/84-202605-北京三河测试/sense_adapter_v2.3.0_init_mysql.sql" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/85-20260617-江西环境整理/0-资源草稿.md" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/85-20260617-江西环境整理/1-节点驱逐.md" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/85-20260617-江西环境整理/江西移动-老平台.doc" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/85-20260617-江西环境整理/江西移动二期通感平台.doc" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/997-项目VPN虚拟机/rmdc-cluster/40-50-rke-cluster.yml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/997-项目VPN虚拟机/rmdc-cluster/rmdc-cluster-bootstrap.json" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/999-部署模板/中间件版本-260615.txt" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/.idea/shelf/Uncommitted_changes_before_Update_at_2025_05_15_10_33_[Changes]/shelved.patch" beforeDir="false" />
-      <change beforePath="$PROJECT_DIR$/.idea/shelf/Uncommitted_changes_before_Update_at_2025_05_15_10_33__Changes_.xml" beforeDir="false" />
-      <change beforePath="$PROJECT_DIR$/.idea/sqldialects.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/sqldialects.xml" afterDir="false" />
+    <list default="true" id="5b79c488-edbc-40fd-80a0-510f37a69556" name="Changes" comment="大量更新">
+      <change afterPath="$PROJECT_DIR$/998-常用脚本/更新脚本/cmii-clean母脚本.sh" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/0-archived/26-开发高可用集群/批量命令.sh" beforeDir="false" afterPath="$PROJECT_DIR$/0-archived/26-开发高可用集群/批量命令.sh" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/1-2025年/54-202501-深圳规自-ARM/部署yaml/ts2mp4.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/1-2025年/54-202501-深圳规自-ARM/部署yaml/ts2mp4.yaml" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/1-2025年/58-202503-新DEMO环境/批量指令.sh" beforeDir="false" afterPath="$PROJECT_DIR$/1-2025年/58-202503-新DEMO环境/批量指令.sh" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/71-202601-XA监管平台/1-批量脚本.sh" beforeDir="false" afterPath="$PROJECT_DIR$/71-202601-XA监管平台/1-批量脚本.sh" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/997-项目VPN虚拟机/3-ubuntu2204虚拟机模板.sh" beforeDir="false" afterPath="$PROJECT_DIR$/997-项目VPN虚拟机/3-ubuntu2204虚拟机模板.sh" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/998-常用脚本/f-nginx暴露/真实nginx-reverse-proxy.conf" beforeDir="false" afterPath="$PROJECT_DIR$/998-常用脚本/f-nginx暴露/真实nginx-reverse-proxy.conf" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/998-常用脚本/故障恢复脚本/删除状态不为Running的Pod.sh" beforeDir="false" afterPath="$PROJECT_DIR$/998-常用脚本/故障恢复脚本/删除状态不为Running的Pod.sh" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/999-数据库脚本/a_rmdc-db-operator.sh" beforeDir="false" afterPath="$PROJECT_DIR$/999-数据库脚本/a_rmdc-db-operator.sh" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/999-部署模板/202604-监管模板/cmii-nginx-cm.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/999-部署模板/202604-监管模板/cmii-nginx-cm.yaml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/999-部署模板/202604-监管模板/cmii-uas-gateway.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/999-部署模板/202604-监管模板/cmii-uas-gateway.yaml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/999-部署模板/202604-飞服模板/镜像包.txt" beforeDir="false" afterPath="$PROJECT_DIR$/999-部署模板/202604-飞服模板/镜像包.txt" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/999-部署模板/关键参数说明.txt" beforeDir="false" afterPath="$PROJECT_DIR$/999-部署模板/关键参数说明.txt" afterDir="false" />
     </list>
     <option name="SHOW_DIALOG" value="false" />
     <option name="HIGHLIGHT_CONFLICTS" value="true" />
@@ -126,11 +78,29 @@
       <workItem from="1782699586146" duration="3663000" />
       <workItem from="1782720549494" duration="4240000" />
       <workItem from="1782790589954" duration="285000" />
-      <workItem from="1782790906317" duration="68000" />
+      <workItem from="1782790906317" duration="175000" />
+      <workItem from="1782800347262" duration="1413000" />
+      <workItem from="1782813019054" duration="2507000" />
+      <workItem from="1782874240779" duration="1849000" />
+      <workItem from="1782885333690" duration="2058000" />
+      <workItem from="1782893101973" duration="1358000" />
     </task>
+    <task id="LOCAL-00001" summary="大量更新">
+      <option name="closed" value="true" />
+      <created>1782791068556</created>
+      <option name="number" value="00001" />
+      <option name="presentableId" value="LOCAL-00001" />
+      <option name="project" value="LOCAL" />
+      <updated>1782791068556</updated>
+    </task>
+    <option name="localTasksCounter" value="2" />
     <servers />
   </component>
   <component name="TypeScriptGeneratedFilesManager">
     <option name="version" value="3" />
   </component>
+  <component name="VcsManagerConfiguration">
+    <MESSAGE value="大量更新" />
+    <option name="LAST_COMMIT_MESSAGE" value="大量更新" />
+  </component>
 </project>
\ No newline at end of file
diff --git a/1-2025年/58-202503-新DEMO环境/批量指令.sh b/1-2025年/58-202503-新DEMO环境/批量指令.sh
index af5696c..0c98c44 100644
--- a/1-2025年/58-202503-新DEMO环境/批量指令.sh
+++ b/1-2025年/58-202503-新DEMO环境/批量指令.sh
@@ -28,5 +28,8 @@ ssh root@192.168.40.50 <<< 'scyd@lab1234'
 
 192.168.40.58
 192.168.40.64
+192.168.40.60
 root
-SuperCyy@123
\ No newline at end of file
+SuperCyy@123
+
+boge14@Good
\ No newline at end of file
diff --git a/71-202601-XA监管平台/260629-证书升级/real-nginx-proxy.conf b/71-202601-XA监管平台/260629-证书升级/real-nginx-proxy.conf
new file mode 100644
index 0000000..b7584b6
--- /dev/null
+++ b/71-202601-XA监管平台/260629-证书升级/real-nginx-proxy.conf
@@ -0,0 +1,98 @@
+upstream  proxy_server {
+    ip_hash;
+    server 10.22.57.8:30500;
+    server 10.22.57.5:30500;
+    server 10.22.57.6:30500;
+    server 10.22.57.7:30500;
+}
+
+server {
+  http2 on;
+  listen 443 ssl;
+  server_name airtraffic.xadcity.com;
+
+  ssl_session_timeout 1d;
+    ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
+    ssl_session_tickets off;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+  ssl_certificate    /etc/nginx/conf.d/ssl_key/x.xadcity.com.cert.pem;
+    ssl_certificate_key    /etc/nginx/conf.d/ssl_key/x.xadcity.com.key.pem;
+
+  location / {
+      proxy_pass http://proxy_server;
+      client_max_body_size 5120m;
+      client_body_buffer_size 5120m;
+      client_body_timeout 6000s;
+      proxy_send_timeout 10000s;
+      proxy_read_timeout 10000s;
+      proxy_connect_timeout 600s;
+      proxy_max_temp_file_size 5120m;
+      proxy_request_buffering on;
+      proxy_buffering off;
+      proxy_buffer_size 4k;
+      proxy_buffers 4 12k;
+      proxy_set_header Host fake-domain.xa-dcity-uas-260116.io;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+
+  location /_AMapService/v4/map/styles {
+          set $args "$args&jscode=cf66cea95bdcdfcf8048456b36f357a1";
+          proxy_pass https://webapi.amap.com/v4/ap/styles;
+  }
+
+  location /_AMapService/ {
+      set $args "$args&jscode=cf66cea95bdcdfcf8048456b36f357a1";
+      proxy_pass https://restapi.amap.com/;
+  }
+
+  location /rtc/v1/ {
+        add_header Access-Control-Allow-Headers X-Requested-With;
+        add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
+        proxy_pass http://127.0.0.1:30985/rtc/v1/;
+  }
+
+  location ~ ^/\w*/actuator/ {
+      return 403;
+  }
+
+  location /live-play/flv/ {
+    proxy_pass http://192.168.10.1:7088/;
+  }
+  location /live-play/hls/ {
+    proxy_pass http://192.168.10.1:7088/zlm/hls/;
+  }
+  location /live-play/webrtc {
+    proxy_pass http://192.168.10.1:7088/index/api/webrtc;
+  }
+  location /live-play/whip {
+    proxy_pass http://192.168.10.1:7088/index/api/whip;
+  }
+  location /live-replay/hls-by-time-range/ {
+    proxy_pass http://192.168.10.1:8088/api/v2/storage/hls-by-time-range/;
+  }
+  location /live-replay/fetch_file/ {
+    proxy_pass http://192.168.10.1:8088/api/v2/storage/fetch_file/;
+  }
+  location /live-replay/hls-downloader {
+    proxy_pass http://192.168.10.1:7080/hls-downloader;
+ }
+
+  location /player {
+    proxy_pass http://144.7.88.50:8081/player;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    #WebSocket 超时设置
+    proxy_read_timeout 3600s;
+    proxy_send_timeout 3600s;
+  }
+}
\ No newline at end of file
diff --git a/85-20260617-江西环境整理/2-节点驱逐-完整解决方案.md b/85-20260617-江西环境整理/2-节点驱逐-完整解决方案.md
new file mode 100644
index 0000000..d34ccb2
--- /dev/null
+++ b/85-20260617-江西环境整理/2-节点驱逐-完整解决方案.md
@@ -0,0 +1,1034 @@
+# 节点驱逐 - 完整解决方案
+
+## 一、环境概览
+
+### 集群节点信息
+
+| 节点 IP       | 角色                          | 操作系统                                | 状态   | 处理方式               |
+|---------------|-------------------------------|-----------------------------------------|--------|------------------------|
+| 10.20.1.130   | controlplane, etcd, worker    | openEuler 20.03 (LTS-SP3)              | 保留   | master 节点不动        |
+| 10.20.1.133   | worker                        | openEuler 20.03 (LTS-SP3)              | 保留   | 中间件调度目标         |
+| 10.20.1.134   | worker                        | openEuler 20.03 (LTS-SP3)              | 保留   | 中间件调度目标 (mysql) |
+| 10.20.1.141   | worker                        | BigCloud Enterprise Linux For Euler     | 保留   | 中间件调度目标         |
+| **10.20.1.142** | worker                      | BigCloud Enterprise Linux For Euler     | **清退** | 一个月后清退           |
+| **10.20.1.144** | worker                      | BigCloud Enterprise Linux For Euler     | **清退** | 一个月后清退           |
+| **10.20.1.145** | worker                      | BigCloud Enterprise Linux For Euler     | **清退** | 一个月后清退           |
+
+### 需求拆解
+
+1. **清退节点**：10.20.1.142、10.20.1.144、10.20.1.145（一个月后执行）
+2. **jxyd 命名空间 Deployment**：生命周期与被清退节点一致 → 即**直接删除**
+3. **jxyd 命名空间中间件**：需保留，迁移调度到 10.20.1.133、10.20.1.134、10.20.1.141
+4. **资源调整**：超标 Deployment 统一降配 + 同步调整 JVM 参数
+
+---
+
+## 二、操作流程总览
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│  Phase 1: 信息采集与备份（立即执行）                            │
+│  - 导出所有 deployment/statefulset 信息                        │
+│  - 记录当前 Pod 分布                                           │
+│  - 备份所有 YAML                                               │
+├─────────────────────────────────────────────────────────────────┤
+│  Phase 2: 资源调整（立即执行）                                  │
+│  - 扫描 jxyd 业务 deployment 的资源配置（不扫描中间件）         │
+│  - 将超标资源统一降配                                          │
+│  - 同步修改 CUST_JAVA_OPTS 环境变量                            │
+├─────────────────────────────────────────────────────────────────┤
+│  Phase 3: 中间件及业务迁移（立即执行）                          │
+│  - 给保留节点及待清退节点打 label                              │
+│  - 调度中间件至保留节点，调度业务 Deployment 至待清退节点       │
+│  - 验证迁移及调度在对应节点上正常运行                           │
+├─────────────────────────────────────────────────────────────────┤
+│  Phase 4: 节点清退（一个月后执行）                              │
+│  - 删除 jxyd 命名空间中的业务 deployment                       │
+│  - cordon + drain 节点                                         │
+│  - 从集群中移除节点                                            │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 三、Phase 1：信息采集与备份
+
+### 1.1 备份脚本 `phase1_backup.sh`
+
+```bash
+#!/bin/bash
+# ============================================================
+# Phase 1: 信息采集与备份
+# 在 master 节点 (10.20.1.130) 上执行
+# ============================================================
+
+BACKUP_DIR="/root/wdd/backup_260617/$(date +%Y%m%d_%H%M%S)"
+NAMESPACE="jxyd"
+mkdir -p "${BACKUP_DIR}"
+
+echo "=========================================="
+echo "  Phase 1: 信息采集与备份"
+echo "  备份目录: ${BACKUP_DIR}"
+echo "=========================================="
+
+# 1. 导出节点信息
+echo "[1/6] 导出节点信息..."
+kubectl get nodes -o wide --show-labels > "${BACKUP_DIR}/nodes_info.txt"
+
+# 2. 导出 jxyd 命名空间所有资源
+echo "[2/6] 导出 jxyd 命名空间所有资源 YAML..."
+kubectl get all -n ${NAMESPACE} -o yaml > "${BACKUP_DIR}/all_resources.yaml"
+
+# 3. 单独导出每个 deployment
+echo "[3/6] 导出每个 Deployment YAML..."
+mkdir -p "${BACKUP_DIR}/deployments"
+for dep in $(kubectl get deployments -n ${NAMESPACE} -o jsonpath='{.items[*].metadata.name}'); do
+    kubectl get deployment "${dep}" -n ${NAMESPACE} -o yaml > "${BACKUP_DIR}/deployments/${dep}.yaml"
+    echo "  已备份 deployment: ${dep}"
+done
+
+# 4. 单独导出每个 statefulset（中间件通常用 statefulset）
+echo "[4/6] 导出每个 StatefulSet YAML..."
+mkdir -p "${BACKUP_DIR}/statefulsets"
+for sts in $(kubectl get statefulsets -n ${NAMESPACE} -o jsonpath='{.items[*].metadata.name}' 2>/dev/null); do
+    kubectl get statefulset "${sts}" -n ${NAMESPACE} -o yaml > "${BACKUP_DIR}/statefulsets/${sts}.yaml"
+    echo "  已备份 statefulset: ${sts}"
+done
+
+# 5. 导出 ConfigMap 和 Secret
+echo "[5/6] 导出 ConfigMap 和 Secret..."
+mkdir -p "${BACKUP_DIR}/configmaps" "${BACKUP_DIR}/secrets"
+for cm in $(kubectl get configmaps -n ${NAMESPACE} -o jsonpath='{.items[*].metadata.name}'); do
+    kubectl get configmap "${cm}" -n ${NAMESPACE} -o yaml > "${BACKUP_DIR}/configmaps/${cm}.yaml"
+done
+for sec in $(kubectl get secrets -n ${NAMESPACE} -o jsonpath='{.items[*].metadata.name}'); do
+    kubectl get secret "${sec}" -n ${NAMESPACE} -o yaml > "${BACKUP_DIR}/secrets/${sec}.yaml"
+done
+
+# 6. 导出 Pod 分布信息（关键：记录哪些 Pod 在待清退节点上）
+echo "[6/6] 导出 Pod 分布信息..."
+echo "=== 所有 Pod 的节点分布 ===" > "${BACKUP_DIR}/pod_distribution.txt"
+kubectl get pods -n ${NAMESPACE} -o wide >> "${BACKUP_DIR}/pod_distribution.txt"
+
+echo ""
+echo "--- 待清退节点上的 Pod ---" >> "${BACKUP_DIR}/pod_distribution.txt"
+for NODE in 10.20.1.142 10.20.1.144 10.20.1.145; do
+    echo "" >> "${BACKUP_DIR}/pod_distribution.txt"
+    echo "=== 节点 ${NODE} 上的 Pod ===" >> "${BACKUP_DIR}/pod_distribution.txt"
+    kubectl get pods -n ${NAMESPACE} -o wide --field-selector spec.nodeName=${NODE} >> "${BACKUP_DIR}/pod_distribution.txt"
+done
+
+# 7. 导出 Service 和 Ingress
+mkdir -p "${BACKUP_DIR}/services" "${BACKUP_DIR}/ingresses"
+for svc in $(kubectl get svc -n ${NAMESPACE} -o jsonpath='{.items[*].metadata.name}'); do
+    kubectl get svc "${svc}" -n ${NAMESPACE} -o yaml > "${BACKUP_DIR}/services/${svc}.yaml"
+done
+for ing in $(kubectl get ingress -n ${NAMESPACE} -o jsonpath='{.items[*].metadata.name}' 2>/dev/null); do
+    kubectl get ingress "${ing}" -n ${NAMESPACE} -o yaml > "${BACKUP_DIR}/ingresses/${ing}.yaml"
+done
+
+# 8. 生成资源使用汇总
+echo ""
+echo "=== 资源使用汇总 ===" | tee "${BACKUP_DIR}/resource_summary.txt"
+kubectl top nodes 2>/dev/null | tee -a "${BACKUP_DIR}/resource_summary.txt"
+echo "" | tee -a "${BACKUP_DIR}/resource_summary.txt"
+kubectl top pods -n ${NAMESPACE} 2>/dev/null | tee -a "${BACKUP_DIR}/resource_summary.txt"
+
+echo ""
+echo "=========================================="
+echo "  备份完成！目录: ${BACKUP_DIR}"
+echo "=========================================="
+```
+
+---
+
+## 四、Phase 2：资源检查与调整
+
+### 2.1 Python 脚本 `phase2_resource_adjust.py`
+
+此脚本会：
+- 扫描 jxyd 命名空间下所有 Deployment（中间件不存在资源限制，且只在 StatefulSet，因此阶段二不考虑中间件）
+- 检测哪些容器的资源超标（超过 limits cpu:2 / memory:2Gi）
+- 对超标的 Deployment 自动执行 `kubectl patch` 降配
+- 同步修改 `CUST_JAVA_OPTS` 环境变量
+
+```python
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+Phase 2: 资源检查与调整
+功能：
+  1. 扫描 jxyd 命名空间下所有 Deployment 的资源配置
+  2. 识别超标资源（超过 limits cpu:2 / memory:2Gi）
+  3. 自动 patch 降配 + 修改 CUST_JAVA_OPTS
+  4. 生成变更报告
+
+使用方式：
+  python3 phase2_resource_adjust.py --dry-run     # 仅预览，不执行变更
+  python3 phase2_resource_adjust.py --apply        # 执行变更
+"""
+
+import json
+import subprocess
+import sys
+import re
+import argparse
+from datetime import datetime
+
+
+# ============================================================
+# 配置区
+# ============================================================
+NAMESPACE = "jxyd"
+
+# 目标资源规格
+TARGET_RESOURCES = {
+    "limits": {"cpu": "2", "memory": "2Gi"},
+    "requests": {"cpu": "1", "memory": "500Mi"}
+}
+
+# 目标 JVM 参数
+TARGET_JAVA_OPTS = "-Xms500m -Xmx2000m -Dlog4j2.formatMsgNoLookups=true"
+
+# ============================================================
+# 工具函数
+# ============================================================
+
+def run_kubectl(args, capture=True):
+    """执行 kubectl 命令"""
+    cmd = ["kubectl"] + args
+    result = subprocess.run(cmd, capture_output=capture, text=True)
+    if result.returncode != 0:
+        print(f"  [错误] 命令失败: {' '.join(cmd)}")
+        print(f"  stderr: {result.stderr}")
+        return None
+    return result.stdout
+
+
+def parse_memory(mem_str):
+    """将内存字符串转换为字节数"""
+    if not mem_str:
+        return 0
+    mem_str = str(mem_str)
+    units = {
+        'Ki': 1024, 'Mi': 1024**2, 'Gi': 1024**3, 'Ti': 1024**4,
+        'K': 1000, 'M': 1000**2, 'G': 1000**3, 'T': 1000**4,
+        'k': 1000, 'm': 0.001  # millibytes (unusual but valid)
+    }
+    for suffix, multiplier in sorted(units.items(), key=lambda x: -len(x[0])):
+        if mem_str.endswith(suffix):
+            try:
+                return float(mem_str[:-len(suffix)]) * multiplier
+            except ValueError:
+                return 0
+    try:
+        return float(mem_str)  # 纯数字，单位为字节
+    except ValueError:
+        return 0
+
+
+def parse_cpu(cpu_str):
+    """将 CPU 字符串转换为核心数（float）"""
+    if not cpu_str:
+        return 0.0
+    cpu_str = str(cpu_str)
+    if cpu_str.endswith('m'):
+        return float(cpu_str[:-1]) / 1000.0
+    return float(cpu_str)
+
+
+def is_resource_over_limit(resources):
+    """检查资源是否超标"""
+    limits = resources.get("limits", {})
+    cpu_limit = limits.get("cpu", "0")
+    mem_limit = limits.get("memory", "0")
+    
+    cpu_over = parse_cpu(cpu_limit) > parse_cpu(TARGET_RESOURCES["limits"]["cpu"])
+    mem_over = parse_memory(mem_limit) > parse_memory(TARGET_RESOURCES["limits"]["memory"])
+    
+    return cpu_over or mem_over
+
+
+# ============================================================
+# 主逻辑
+# ============================================================
+
+def get_deployments():
+    """获取所有 Deployment 信息"""
+    output = run_kubectl([
+        "get", "deployments", "-n", NAMESPACE,
+        "-o", "json"
+    ])
+    if not output:
+        return []
+    data = json.loads(output)
+    return data.get("items", [])
+
+
+def analyze_and_patch(workloads, kind, dry_run=True):
+    """分析并 patch 超标资源，若副本数为 0 则直接删除"""
+    report = {
+        "business": [],
+        "patched": [],
+        "skipped": [],
+        "errors": [],
+        "deleted": []
+    }
+    
+    for wl in workloads:
+        name = wl["metadata"]["name"]
+        replicas = wl["spec"].get("replicas", 1)
+        
+        if replicas == 0:
+            print(f"\n  [删除] {kind}/{name} (副本数为 0)")
+            if dry_run:
+                print("    [DRY-RUN] 跳过删除")
+                report["skipped"].append({"name": name, "reason": "replicas=0"})
+            else:
+                result = run_kubectl([
+                    "delete", kind.lower(), name,
+                    "-n", NAMESPACE
+                ])
+                if result is not None:
+                    print("    [成功] 已删除")
+                    report["deleted"].append(name)
+                else:
+                    print("    [失败] 删除失败")
+                    report["errors"].append({"name": name, "reason": "delete failed"})
+            continue
+            
+        spec = wl["spec"]["template"]["spec"]
+        containers = spec.get("containers", [])
+        
+        category = "business"
+        
+        for idx, container in enumerate(containers):
+            container_name = container.get("name", f"container-{idx}")
+            resources = container.get("resources", {})
+            limits = resources.get("limits", {})
+            requests = resources.get("requests", {})
+            
+            # 提取当前 JAVA_OPTS
+            current_java_opts = ""
+            env_list = container.get("env", [])
+            for env in env_list:
+                if env.get("name") == "CUST_JAVA_OPTS":
+                    current_java_opts = env.get("value", "")
+                    break
+            
+            item = {
+                "name": name,
+                "kind": kind,
+                "container": container_name,
+                "container_index": idx,
+                "category": category,
+                "current_limits_cpu": limits.get("cpu", "未设置"),
+                "current_limits_memory": limits.get("memory", "未设置"),
+                "current_requests_cpu": requests.get("cpu", "未设置"),
+                "current_requests_memory": requests.get("memory", "未设置"),
+                "current_java_opts": current_java_opts,
+                "over_limit": is_resource_over_limit(resources),
+            }
+            
+            report[category].append(item)
+            
+            # 只调整超标的
+            if item["over_limit"]:
+                print(f"\n  [超标] {kind}/{name} (容器: {container_name})")
+                print(f"    当前: limits={{cpu:{limits.get('cpu', 'N/A')}, memory:{limits.get('memory', 'N/A')}}}")
+                print(f"    目标: limits={{cpu:{TARGET_RESOURCES['limits']['cpu']}, memory:{TARGET_RESOURCES['limits']['memory']}}}")
+                
+                if dry_run:
+                    print(f"    [DRY-RUN] 跳过 patch")
+                    report["skipped"].append(item)
+                else:
+                    # 构造 patch JSON
+                    patch = {
+                        "spec": {
+                            "template": {
+                                "spec": {
+                                    "containers": []
+                                }
+                            }
+                        }
+                    }
+                    
+                    # 构建容器 patch（需要按索引）
+                    container_patch = {
+                        "name": container_name,
+                        "resources": TARGET_RESOURCES
+                    }
+                    
+                    # 同步修改 CUST_JAVA_OPTS（如果存在该 env）
+                    if current_java_opts:
+                        # 使用 kubectl set env 更简洁，这里用 strategic merge patch
+                        new_env = []
+                        for env in env_list:
+                            if env.get("name") == "CUST_JAVA_OPTS":
+                                new_env.append({
+                                    "name": "CUST_JAVA_OPTS",
+                                    "value": TARGET_JAVA_OPTS
+                                })
+                            else:
+                                new_env.append(env)
+                        container_patch["env"] = new_env
+                    
+                    patch["spec"]["template"]["spec"]["containers"] = [container_patch]
+                    
+                    patch_json = json.dumps(patch)
+                    
+                    result = run_kubectl([
+                        "patch", kind.lower(), name,
+                        "-n", NAMESPACE,
+                        "--type", "strategic",
+                        "-p", patch_json
+                    ])
+                    
+                    if result is not None:
+                        print(f"    [成功] 已 patch {kind}/{name}")
+                        report["patched"].append(item)
+                    else:
+                        print(f"    [失败] patch {kind}/{name} 失败")
+                        report["errors"].append(item)
+            else:
+                # 未超标但可能也需要同步 JAVA_OPTS
+                if current_java_opts and current_java_opts != TARGET_JAVA_OPTS:
+                    print(f"\n  [JAVA_OPTS 不一致] {kind}/{name} (容器: {container_name})")
+                    print(f"    当前: {current_java_opts}")
+                    print(f"    目标: {TARGET_JAVA_OPTS}")
+                    
+                    if not dry_run:
+                        result = run_kubectl([
+                            "set", "env",
+                            f"{kind.lower()}/{name}",
+                            "-n", NAMESPACE,
+                            f"CUST_JAVA_OPTS={TARGET_JAVA_OPTS}",
+                            "-c", container_name
+                        ])
+                        if result is not None:
+                            print(f"    [成功] 已更新 JAVA_OPTS")
+                        else:
+                            print(f"    [失败] 更新 JAVA_OPTS 失败")
+    
+    return report
+
+
+def print_summary(report, kind):
+    """打印汇总报告"""
+    print(f"\n{'='*60}")
+    print(f"  {kind} 资源扫描报告")
+    print(f"{'='*60}")
+    
+    print(f"\n  🚀 业务 Deployment ({len(report['business'])} 个容器):")
+    for item in report["business"]:
+        over = "⚠️ 超标" if item["over_limit"] else "✅ 正常"
+        print(f"    - {item['name']}/{item['container']}: "
+              f"limits(cpu={item['current_limits_cpu']}, mem={item['current_limits_memory']}) "
+              f"requests(cpu={item['current_requests_cpu']}, mem={item['current_requests_memory']}) "
+              f"{over}")
+    
+    if report.get("deleted"):
+        print(f"\n  🗑️ 已删除 (副本数为0): {len(report['deleted'])} 个")
+    if report["patched"]:
+        print(f"\n  🔧 已 Patch: {len(report['patched'])} 个")
+    if report["skipped"]:
+        print(f"  ⏭️  跳过 (DRY-RUN): {len(report['skipped'])} 个")
+    if report["errors"]:
+        print(f"  ❌ 失败: {len(report['errors'])} 个")
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Phase 2: jxyd 命名空间资源检查与调整")
+    group = parser.add_mutually_exclusive_group(required=True)
+    group.add_argument("--dry-run", action="store_true", help="仅预览，不执行变更")
+    group.add_argument("--apply", action="store_true", help="执行变更")
+    args = parser.parse_args()
+    
+    dry_run = args.dry_run
+    
+    print(f"\n{'#'*60}")
+    print(f"  Phase 2: 资源检查与调整")
+    print(f"  命名空间: {NAMESPACE}")
+    print(f"  模式: {'DRY-RUN（仅预览）' if dry_run else '⚡ APPLY（执行变更）'}")
+    print(f"  时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
+    print(f"{'#'*60}")
+    
+    if not dry_run:
+        confirm = input("\n  ⚠️  确认要执行资源调整吗？(yes/no): ")
+        if confirm.lower() != "yes":
+            print("  已取消。")
+            return
+    
+    # 扫描 Deployment (业务)
+    print(f"\n{'='*60}")
+    print("  扫描 Deployment...")
+    print(f"{'='*60}")
+    deployments = get_deployments()
+    dep_report = analyze_and_patch(deployments, "Deployment", dry_run)
+    print_summary(dep_report, "Deployment")
+    
+    # 生成变更日志
+    log_file = f"/root/wdd/backup_260617/phase2_report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.json"
+    log_data = {
+        "timestamp": datetime.now().isoformat(),
+        "mode": "dry-run" if dry_run else "apply",
+        "deployment_report": {
+            "business_count": len(dep_report["business"]),
+            "patched_count": len(dep_report["patched"]),
+            "error_count": len(dep_report["errors"]),
+        }
+    }
+    
+    try:
+        with open(log_file, 'w') as f:
+            json.dump(log_data, f, indent=2, ensure_ascii=False)
+        print(f"\n  📄 报告已保存到: {log_file}")
+    except Exception as e:
+        print(f"\n  [警告] 无法保存报告文件: {e}")
+    
+    print(f"\n{'#'*60}")
+    print(f"  Phase 2 完成!")
+    print(f"{'#'*60}")
+
+
+if __name__ == "__main__":
+    main()
+```
+
+---
+
+## 五、Phase 3：中间件迁移
+
+### 3.1 给保留节点打 Label
+
+```bash
+#!/bin/bash
+# ============================================================
+# Phase 3.1: 给保留节点打 Label
+# ============================================================
+
+echo "=== 给保留节点打 label: jxyd-middleware=true ==="
+
+# 保留节点
+kubectl label node 10.20.1.133 jxyd-middleware=true --overwrite
+kubectl label node 10.20.1.134 jxyd-middleware=true --overwrite
+kubectl label node 10.20.1.141 jxyd-middleware=true --overwrite
+
+echo ""
+echo ""
+echo "=== 给待清退节点打 label: jxyd-business=true ==="
+# 待清退节点（将业务部署到这些节点）
+kubectl label node 10.20.1.142 jxyd-business=true --overwrite
+kubectl label node 10.20.1.144 jxyd-business=true --overwrite
+kubectl label node 10.20.1.145 jxyd-business=true --overwrite
+
+echo ""
+echo "=== 验证 label ==="
+kubectl get nodes -l jxyd-middleware=true -o wide
+kubectl get nodes -l jxyd-business=true -o wide
+```
+
+### 3.2 调度与迁移脚本 `phase3_migrate_workloads.py`
+
+```python
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+Phase 3: 工作负载迁移与调度
+功能：
+  1. 识别 jxyd 命名空间下的中间件 StatefulSet 与 业务 Deployment
+  2. 为中间件添加 nodeSelector，调度到保留节点（过滤包含 hostPath 的中间件）
+  3. 为业务 Deployment 添加 nodeSelector，调度到待清退节点
+  4. 验证调度和迁移结果
+
+使用方式：
+  python3 phase3_migrate_workloads.py --list             # 列出迁移计划
+  python3 phase3_migrate_workloads.py --dry-run           # 预览变更
+  python3 phase3_migrate_workloads.py --apply             # 执行迁移
+  python3 phase3_migrate_workloads.py --verify            # 验证迁移结果
+"""
+
+import json
+import subprocess
+import sys
+import argparse
+from datetime import datetime
+
+
+NAMESPACE = "jxyd"
+
+# 目标节点 label
+TARGET_NODE_SELECTOR = {"jxyd-middleware": "true"}
+BUSINESS_NODE_SELECTOR = {"jxyd-business": "true"}
+
+# 中间件关键词
+MIDDLEWARE_KEYWORDS = [
+    "mysql", "redis", "rabbitmq", "kafka", "zookeeper", "elasticsearch",
+    "nacos", "minio", "mongo", "postgres", "nginx",
+    "sentinel", "rocketmq", "emqx", "mqtt", "influxdb", "grafana",
+    "prometheus", "xxl-job", "seata"
+]
+
+# 待清退节点
+EVICT_NODES = ["10.20.1.142", "10.20.1.144", "10.20.1.145"]
+
+
+def run_kubectl(args):
+    cmd = ["kubectl"] + args
+    result = subprocess.run(cmd, capture_output=True, text=True)
+    if result.returncode != 0:
+        print(f"  [错误] {' '.join(cmd)}: {result.stderr.strip()}")
+        return None
+    return result.stdout
+
+
+def is_middleware(name):
+    name_lower = name.lower()
+    return any(kw in name_lower for kw in MIDDLEWARE_KEYWORDS)
+
+
+def get_workloads(kind):
+    output = run_kubectl(["get", kind, "-n", NAMESPACE, "-o", "json"])
+    if not output:
+        return []
+    return json.loads(output).get("items", [])
+
+
+def list_workloads():
+    """列出工作负载迁移与调度计划"""
+    print(f"\n{'='*60}")
+    print(f"  jxyd 命名空间 - 迁移与调度计划")
+    print(f"{'='*60}")
+    
+    # StatefulSet (中间件)
+    sts_workloads = get_workloads("statefulsets")
+    mw_list = [w for w in sts_workloads if is_middleware(w["metadata"]["name"])]
+    print(f"\n  📦 中间件 StatefulSet (调度到保留节点，{len(mw_list)} 个):")
+    for w in mw_list:
+        name = w["metadata"]["name"]
+        replicas = w["spec"].get("replicas", 1)
+        node_selector = w["spec"]["template"]["spec"].get("nodeSelector", {})
+        volumes = w["spec"]["template"]["spec"].get("volumes", [])
+        has_host_path = any("hostPath" in v for v in volumes)
+        host_path_flag = "[含 hostPath，不可迁移]" if has_host_path else ""
+        print(f"    ✅ {name}  (replicas={replicas}, nodeSelector={node_selector}) {host_path_flag}")
+
+    # Deployment (业务)
+    dep_workloads = get_workloads("deployments")
+    print(f"\n  🚀 业务 Deployment (调度到待清退节点，{len(dep_workloads)} 个):")
+    for w in dep_workloads:
+        name = w["metadata"]["name"]
+        replicas = w["spec"].get("replicas", 1)
+        node_selector = w["spec"]["template"]["spec"].get("nodeSelector", {})
+        if replicas == 0:
+            print(f"    - {name}  (replicas=0, 忽略调度)")
+        else:
+            print(f"    ✅ {name}  (replicas={replicas}, nodeSelector={node_selector})")
+    
+    print(f"\n  💡 提示: 若状态不准确可人工审核配置。")
+
+
+def migrate_workloads(dry_run=True):
+    """执行工作负载的迁移与调度"""
+    print(f"\n{'='*60}")
+    print(f"  工作负载调度 - {'DRY-RUN' if dry_run else 'APPLY'}")
+    print(f"{'='*60}")
+    
+    patched = 0
+    errors = 0
+    
+    def apply_patch(kind, w, target_ns, is_middleware_check=False):
+        nonlocal patched, errors
+        name = w["metadata"]["name"]
+        replicas = w["spec"].get("replicas", 1)
+        current_ns = w["spec"]["template"]["spec"].get("nodeSelector", {})
+        
+        if replicas == 0:
+            return  # 忽略副本数为 0 的
+            
+        if is_middleware_check:
+            volumes = w["spec"]["template"]["spec"].get("volumes", [])
+            has_host_path = any("hostPath" in v for v in volumes)
+            if has_host_path:
+                print(f"  [跳过] {kind}/{name} 包含 hostPath 挂载，不能进行迁移")
+                return
+                
+        # 检查是否已包含所有的目标 selector
+        if all(current_ns.get(k) == v for k, v in target_ns.items()):
+            print(f"  [跳过] {kind}/{name} 已满足 nodeSelector 目标")
+            return
+            
+        print(f"  [调度] {kind}/{name}")
+        print(f"    当前 nodeSelector: {current_ns}")
+        print(f"    目标 nodeSelector: {target_ns}")
+        
+        if dry_run:
+            print(f"    [DRY-RUN] 跳过")
+            return
+            
+        merged_selector = {**current_ns, **target_ns}
+        patch = {"spec": {"template": {"spec": {"nodeSelector": merged_selector}}}}
+        result = run_kubectl([
+            "patch", kind, name, "-n", NAMESPACE, "--type", "strategic", "-p", json.dumps(patch)
+        ])
+        
+        if result is not None:
+            print(f"    [成功] 已 patch")
+            patched += 1
+        else:
+            print(f"    [失败]")
+            errors += 1
+
+    # 处理中间件
+    sts_workloads = get_workloads("statefulsets")
+    for w in [w for w in sts_workloads if is_middleware(w["metadata"]["name"])]:
+        apply_patch("statefulset", w, TARGET_NODE_SELECTOR, True)
+        
+    # 处理业务
+    dep_workloads = get_workloads("deployments")
+    for w in dep_workloads:
+        apply_patch("deployment", w, BUSINESS_NODE_SELECTOR, False)
+        
+    print(f"\n  汇总: 已调度 {patched} 个, 失败 {errors} 个")
+
+
+def verify_migration():
+    """验证迁移及调度结果"""
+    print(f"\n{'='*60}")
+    print(f"  调度结果验证")
+    print(f"{'='*60}")
+    
+    issues = []
+    
+    def check_workloads(kind, workloads, target_label_key, target_nodes_list, is_middleware_check=False):
+        for w in workloads:
+            name = w["metadata"]["name"]
+            replicas = w["spec"].get("replicas", 1)
+            if replicas == 0:
+                continue
+                
+            ns = w["spec"]["template"]["spec"].get("nodeSelector", {})
+            if is_middleware_check:
+                volumes = w["spec"]["template"]["spec"].get("volumes", [])
+                if any("hostPath" in v for v in volumes):
+                    continue
+                    
+            if ns.get(target_label_key) != "true":
+                issues.append(f"  ⚠️  {kind}/{name} 未设置 {target_label_key} nodeSelector")
+                
+            pods_output = run_kubectl(["get", "pods", "-n", NAMESPACE, "-l", f"app={name}", "-o", "json"])
+            if not pods_output or json.loads(pods_output).get("items", []) == []:
+                pods_output = run_kubectl(["get", "pods", "-n", NAMESPACE, "-o", "json"])
+                if pods_output:
+                    all_pods = [p for p in json.loads(pods_output).get("items", []) if p["metadata"]["name"].startswith(name)]
+                else:
+                    all_pods = []
+            else:
+                all_pods = json.loads(pods_output).get("items", [])
+                
+            for pod in all_pods:
+                pod_name = pod["metadata"]["name"]
+                node = pod["spec"].get("nodeName", "unknown")
+                phase = pod["status"].get("phase", "Unknown")
+                
+                # Check target nodes
+                if target_nodes_list is not None and node not in target_nodes_list:
+                    issues.append(f"  ⚠️  Pod {pod_name} 调度异常，当前节点 {node}，应在目标节点集合 {target_nodes_list} 中")
+                # Exclude nodes
+                elif target_nodes_list is None and node in EVICT_NODES:
+                    issues.append(f"  ⚠️  Pod {pod_name} 仍在待清退节点 {node} 上")
+                else:
+                    print(f"  ✅ {pod_name} -> 节点 {node} (状态: {phase})")
+
+    # 1. 中间件需在保留节点上（非待清退节点）
+    sts_workloads = get_workloads("statefulsets")
+    mw_list = [w for w in sts_workloads if is_middleware(w["metadata"]["name"])]
+    check_workloads("statefulset", mw_list, "jxyd-middleware", None, True)
+    
+    # 2. 业务需在待清退节点上
+    dep_workloads = get_workloads("deployments")
+    check_workloads("deployment", dep_workloads, "jxyd-business", EVICT_NODES, False)
+
+    if issues:
+        print(f"\n  ⚠️  发现 {len(issues)} 个问题:")
+        for issue in issues:
+            print(issue)
+    else:
+        print(f"\n  ✅ 所有的工作负载已成功调度到对应的目标节点!")
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Phase 3: 工作负载迁移与调度")
+    group = parser.add_mutually_exclusive_group(required=True)
+    group.add_argument("--list", action="store_true", help="列出迁移计划")
+    group.add_argument("--dry-run", action="store_true", help="预览变更")
+    group.add_argument("--apply", action="store_true", help="执行迁移")
+    group.add_argument("--verify", action="store_true", help="验证迁移结果")
+    args = parser.parse_args()
+    
+    if args.list:
+        list_workloads()
+    elif args.dry_run:
+        migrate_workloads(dry_run=True)
+    elif args.apply:
+        confirm = input("  ⚠️  确认要执行迁移和调度吗？(yes/no): ")
+        if confirm.lower() == "yes":
+            migrate_workloads(dry_run=False)
+        else:
+            print("  已取消。")
+    elif args.verify:
+        verify_migration()
+
+
+if __name__ == "__main__":
+    main()
+```
+
+---
+
+## 六、Phase 4：节点清退（一个月后执行）
+
+### 4.1 清退脚本 `phase4_evict_nodes.sh`
+
+```bash
+#!/bin/bash
+# ============================================================
+# Phase 4: 节点清退（一个月后执行）
+# 
+# ⚠️  此脚本将执行不可逆操作，请确认：
+#   1. Phase 2 资源调整已完成
+#   2. Phase 3 中间件迁移已完成并验证
+#   3. 已获得相关审批
+# ============================================================
+
+set -e
+
+NAMESPACE="jxyd"
+EVICT_NODES=("10.20.1.142" "10.20.1.144" "10.20.1.145")
+LOG_DIR="/root/wdd/backup_260617/phase4_$(date +%Y%m%d_%H%M%S)"
+mkdir -p "${LOG_DIR}"
+
+echo "=========================================="
+echo "  Phase 4: 节点清退"
+echo "  时间: $(date '+%Y-%m-%d %H:%M:%S')"
+echo "  日志: ${LOG_DIR}"
+echo "=========================================="
+
+# ============================================================
+# Step 1: 最终确认
+# ============================================================
+echo ""
+echo "⚠️  即将执行以下操作："
+echo "  1. 删除 ${NAMESPACE} 命名空间中的业务 Deployment"
+echo "  2. Cordon 节点: ${EVICT_NODES[*]}"
+echo "  3. Drain 节点: ${EVICT_NODES[*]}"
+echo "  4. 从集群中删除节点: ${EVICT_NODES[*]}"
+echo ""
+read -p "确认执行？(输入 YES 继续): " CONFIRM
+if [ "${CONFIRM}" != "YES" ]; then
+    echo "已取消。"
+    exit 0
+fi
+
+# ============================================================
+# Step 2: 最终备份
+# ============================================================
+echo ""
+echo "=== Step 2: 最终备份 ==="
+kubectl get all -n ${NAMESPACE} -o yaml > "${LOG_DIR}/final_backup_all.yaml"
+kubectl get pods -n ${NAMESPACE} -o wide > "${LOG_DIR}/final_pod_distribution.txt"
+echo "  备份完成"
+
+# ============================================================
+# Step 3: 删除 jxyd 业务 Deployment
+# （说明：中间件仅存在于 StatefulSet，因此所有的 Deployment 均为业务）
+# ============================================================
+echo ""
+echo "=== Step 3: 删除 jxyd 业务 Deployment ==="
+
+# 获取所有 deployment
+ALL_DEPS=$(kubectl get deployments -n ${NAMESPACE} -o jsonpath='{.items[*].metadata.name}')
+
+for dep in ${ALL_DEPS}; do
+    echo "  [删除-业务] ${dep}"
+    kubectl delete deployment "${dep}" -n ${NAMESPACE} --grace-period=30 2>&1 | tee -a "${LOG_DIR}/delete_deployments.log"
+done
+
+# ============================================================
+# Step 4: Cordon 节点（标记不可调度）
+# ============================================================
+echo ""
+echo "=== Step 4: Cordon 节点 ==="
+for NODE in "${EVICT_NODES[@]}"; do
+    echo "  Cordon ${NODE}..."
+    kubectl cordon "${NODE}" 2>&1 | tee -a "${LOG_DIR}/cordon.log"
+done
+
+echo ""
+kubectl get nodes -o wide | tee "${LOG_DIR}/nodes_after_cordon.txt"
+
+# ============================================================
+# Step 5: Drain 节点（驱逐所有 Pod）
+# ============================================================
+echo ""
+echo "=== Step 5: Drain 节点 ==="
+for NODE in "${EVICT_NODES[@]}"; do
+    echo "  Drain ${NODE}..."
+    kubectl drain "${NODE}" \
+        --ignore-daemonsets \
+        --delete-emptydir-data \
+        --force \
+        --grace-period=60 \
+        --timeout=300s \
+        2>&1 | tee -a "${LOG_DIR}/drain_${NODE}.log"
+    
+    echo "  等待 30 秒让 Pod 完成迁移..."
+    sleep 30
+done
+
+# ============================================================
+# Step 6: 验证 Pod 已全部迁走
+# ============================================================
+echo ""
+echo "=== Step 6: 验证 Pod 迁移情况 ==="
+for NODE in "${EVICT_NODES[@]}"; do
+    REMAINING=$(kubectl get pods --all-namespaces --field-selector spec.nodeName=${NODE} --no-headers 2>/dev/null | grep -v "kube-system" | wc -l)
+    if [ "${REMAINING}" -gt 0 ]; then
+        echo "  ⚠️  节点 ${NODE} 上仍有 ${REMAINING} 个非系统 Pod:"
+        kubectl get pods --all-namespaces --field-selector spec.nodeName=${NODE} -o wide | grep -v "kube-system"
+    else
+        echo "  ✅ 节点 ${NODE} 上的用户 Pod 已全部迁走"
+    fi
+done
+
+# ============================================================
+# Step 7: 从集群中删除节点
+# ============================================================
+echo ""
+echo "=== Step 7: 从集群中删除节点 ==="
+read -p "确认从集群中删除节点？(输入 YES 继续): " CONFIRM2
+if [ "${CONFIRM2}" == "YES" ]; then
+    for NODE in "${EVICT_NODES[@]}"; do
+        echo "  删除节点 ${NODE}..."
+        kubectl delete node "${NODE}" 2>&1 | tee -a "${LOG_DIR}/delete_nodes.log"
+    done
+else
+    echo "  跳过节点删除。可稍后手动执行: kubectl delete node <node>"
+fi
+
+# ============================================================
+# Step 8: 最终验证
+# ============================================================
+echo ""
+echo "=== Step 8: 最终验证 ==="
+echo "--- 集群节点状态 ---"
+kubectl get nodes -o wide | tee "${LOG_DIR}/nodes_final.txt"
+echo ""
+echo "--- jxyd 命名空间 Pod 状态 ---"
+kubectl get pods -n ${NAMESPACE} -o wide | tee "${LOG_DIR}/pods_final.txt"
+
+echo ""
+echo "=========================================="
+echo "  Phase 4 完成！"
+echo "  日志目录: ${LOG_DIR}"
+echo "=========================================="
+```
+
+---
+
+## 七、快速命令参考
+
+### 如果需要手动单独操作
+
+```bash
+# ============================================================
+# 常用单条命令（按需执行）
+# ============================================================
+
+# 1. 查看 jxyd 下所有 deployment 的资源配置
+kubectl get deploy -n jxyd -o custom-columns=\
+NAME:.metadata.name,\
+CPU_LIMIT:.spec.template.spec.containers[0].resources.limits.cpu,\
+MEM_LIMIT:.spec.template.spec.containers[0].resources.limits.memory,\
+CPU_REQ:.spec.template.spec.containers[0].resources.requests.cpu,\
+MEM_REQ:.spec.template.spec.containers[0].resources.requests.memory
+
+# 2. 查看某个 deployment 的完整资源配置
+kubectl get deploy <NAME> -n jxyd -o jsonpath='{.spec.template.spec.containers[0].resources}' | python3 -m json.tool
+
+# 3. 手动 patch 单个 deployment 的资源
+kubectl patch deploy <NAME> -n jxyd --type='strategic' -p '{
+  "spec": {
+    "template": {
+      "spec": {
+        "containers": [{
+          "name": "<CONTAINER_NAME>",
+          "resources": {
+            "limits": {"cpu": "2", "memory": "2Gi"},
+            "requests": {"cpu": "1", "memory": "500Mi"}
+          },
+          "env": [{
+            "name": "CUST_JAVA_OPTS",
+            "value": "-Xms500m -Xmx2000m -Dlog4j2.formatMsgNoLookups=true"
+          }]
+        }]
+      }
+    }
+  }
+}'
+
+# 4. 查看哪些 Pod 在待清退节点上
+for node in 10.20.1.142 10.20.1.144 10.20.1.145; do
+    echo "=== $node ==="
+    kubectl get pods -n jxyd --field-selector spec.nodeName=$node -o wide
+done
+
+# 5. 单独给 StatefulSet 设置 nodeSelector
+kubectl patch statefulset <NAME> -n jxyd --type='strategic' -p '{"spec":{"template":{"spec":{"nodeSelector":{"jxyd-middleware":"true"}}}}}'
+
+# 5.1 单独给业务 Deployment 设置 nodeSelector
+kubectl patch deploy <NAME> -n jxyd --type='strategic' -p '{"spec":{"template":{"spec":{"nodeSelector":{"jxyd-business":"true"}}}}}'
+
+# 6. 快速 cordon（标记不可调度）
+kubectl cordon 10.20.1.142
+kubectl cordon 10.20.1.144
+kubectl cordon 10.20.1.145
+
+# 7. 快速 drain（驱逐 + 清空）
+kubectl drain 10.20.1.142 --ignore-daemonsets --delete-emptydir-data --force --grace-period=60
+kubectl drain 10.20.1.144 --ignore-daemonsets --delete-emptydir-data --force --grace-period=60
+kubectl drain 10.20.1.145 --ignore-daemonsets --delete-emptydir-data --force --grace-period=60
+```
+
+---
+
+## 八、注意事项与风险提示
+
+### ⚠️  关键风险点
+
+| 风险 | 说明 | 应对措施 |
+|------|------|----------|
+| 中间件识别遗漏 | 自动识别依赖关键词，可能漏判 | **先用 `--list` 模式人工审核** |
+| PVC/PV 数据丢失 | StatefulSet 的持久化数据可能绑定在特定节点的 local PV | 提前检查 PV 类型，如为 `local-storage` 需手动迁移数据 |
+| 资源降配影响服务 | CPU/内存缩减可能导致 OOM 或性能下降 | 降配后监控1-2天，关注 Pod 重启情况 |
+| Strategic Merge Patch 覆盖 env | patch containers 时注意 env 的合并策略 | 脚本已处理，但建议 patch 后验证 |
+| Drain 超时 | 存在强制终止 Pod 的风险 | 已设置 `grace-period=60` 和 `timeout=300s` |
+
+### ✅ 执行顺序清单
+
+```
+□ Phase 1: 执行备份脚本，确认备份完整
+□ Phase 2: 先 --dry-run 预览资源调整
+□ Phase 2: --apply 执行资源调整（仅针对 Deployment 业务）
+□ Phase 2: 监控1-2天确认服务稳定
+□ Phase 3: 给保留节点打 label
+□ Phase 3: 先 --list 查看迁移和调度计划（并确认 hostPath）
+□ Phase 3: 人工确认中间件识别结果，如有遗漏则修改 MIDDLEWARE_KEYWORDS
+□ Phase 3: --dry-run 预览迁移与调度
+□ Phase 3: --apply 执行迁移与调度
+□ Phase 3: --verify 验证迁移与调度结果
+□ Phase 3: 监控中间件服务是否正常
+□ ---- 等待一个月 ----
+□ Phase 4: 执行最终清退脚本
+□ Phase 4: 验证集群状态正常
+```
diff --git a/997-项目VPN虚拟机/3-ubuntu2204虚拟机模板.sh b/997-项目VPN虚拟机/3-ubuntu2204虚拟机模板.sh
index 4c4f1e0..c1fac85 100644
--- a/997-项目VPN虚拟机/3-ubuntu2204虚拟机模板.sh
+++ b/997-项目VPN虚拟机/3-ubuntu2204虚拟机模板.sh
@@ -32,6 +32,19 @@ virsh start ubuntu2204-vm
 
 virsh destroy ubuntu2204-vm
 
+python3 vm_manager.py clone-linux \
+  --template ubuntu2204-vm\
+  --name-prefix RMDC-ubuntu2204 \
+  --ip 192.168.11.20 \
+  --prefix 24 \
+  --gateway 192.168.11.1 \
+  --dns 192.168.34.40,223.5.5.5 \
+  --vcpus 4 \
+  --memory 8192 \
+  --data-size 20000G \
+  --autostart
+
+
 python3 vm_manager.py clone-linux \
   --template ubuntu2204-vm\
   --name-prefix ubuntu2204 \
diff --git a/998-常用脚本/f-nginx暴露/真实nginx-reverse-proxy.conf b/998-常用脚本/f-nginx暴露/真实nginx-reverse-proxy.conf
index 4ac635a..0d8ce3a 100644
--- a/998-常用脚本/f-nginx暴露/真实nginx-reverse-proxy.conf
+++ b/998-常用脚本/f-nginx暴露/真实nginx-reverse-proxy.conf
@@ -12,6 +12,8 @@ server {
 
   listen 8088;
   server_name localhost;
+  underscores_in_headers on;
+
   location / {
 
     proxy_pass http://proxy_server;
diff --git a/998-常用脚本/故障恢复脚本/删除状态不为Running的Pod.sh b/998-常用脚本/故障恢复脚本/删除状态不为Running的Pod.sh
index 38aeb2e..3fb9f0f 100644
--- a/998-常用脚本/故障恢复脚本/删除状态不为Running的Pod.sh
+++ b/998-常用脚本/故障恢复脚本/删除状态不为Running的Pod.sh
@@ -10,7 +10,7 @@ chmod +x /usr/local/bin/jq
 
 export name_space_list=(bj-sh-uas-260511)
 
-export name_space_list=(kube-system kubernetes-dashboard ingress-nginx bj-sh-uas-260511)
+export name_space_list=(kube-system kubernetes-dashboard ingress-nginx xayd)
 
 for name_space in ${name_space_list[*]};do
 
diff --git a/998-常用脚本/更新脚本/cmii-clean母脚本.sh b/998-常用脚本/更新脚本/cmii-clean母脚本.sh
new file mode 100644
index 0000000..cf9329c
--- /dev/null
+++ b/998-常用脚本/更新脚本/cmii-clean母脚本.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+set -euo pipefail
+
+TARGET_DIR="${1:-.}"
+RETENTION_DAYS="${2:-0}"   # 0 表示不限时间，直接清理
+
+PATTERNS=(
+  "*.tar.gz" "*.tar.gz.*" "*.tgz"
+  "*.tar.bz2" "*.tbz2"
+  "*.tar.xz" "*.txz"
+  "*.zip" "*.7z" "*.rar"
+  "*.tar"
+  "wget-log*" "wget.log*" "*.wget.log"
+)
+
+cd "$TARGET_DIR" || { echo "无法进入目录: $TARGET_DIR"; exit 1; }
+LOG_FILE="./cleanup_$(date +%Y%m%d).log"
+log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$LOG_FILE"; }
+
+log "开始清理目录: $(pwd)  保留天数: $RETENTION_DAYS"
+TOTAL_COUNT=0; TOTAL_SIZE=0
+
+for pattern in "${PATTERNS[@]}"; do
+  if [ "$RETENTION_DAYS" -gt 0 ]; then
+    mapfile -d '' files < <(find . -maxdepth 1 -type f -name "$pattern" -mtime +"$RETENTION_DAYS" -print0)
+  else
+    mapfile -d '' files < <(find . -maxdepth 1 -type f -name "$pattern" -print0)
+  fi
+  for f in "${files[@]}"; do
+    [ -e "$f" ] || continue
+    size=$(stat -c%s "$f" 2>/dev/null || stat -f%z "$f" 2>/dev/null || echo 0)
+    TOTAL_SIZE=$((TOTAL_SIZE + size)); TOTAL_COUNT=$((TOTAL_COUNT + 1))
+    log "删除: $f (${size} 字节)"
+    rm -f -- "$f"
+  done
+done
+
+HUMAN_SIZE=$(numfmt --to=iec --suffix=B "$TOTAL_SIZE" 2>/dev/null || echo "${TOTAL_SIZE}B")
+log "清理完成，共删除 ${TOTAL_COUNT} 个文件，释放 ${HUMAN_SIZE} 空间"
+find . -maxdepth 1 -type f -name "cleanup_*.log" -mtime +30 -delete
\ No newline at end of file