update

2025-05-15 10:32:14 +08:00
parent 56c79a02a8
commit ce4165e36b
93 changed files with 18779 additions and 481 deletions
--- a/65-202504-湖南二级监管/doris-deploy/doris-be-configmap.yaml
+++ b/65-202504-湖南二级监管/doris-deploy/doris-be-configmap.yaml
@@ -0,0 +1,82 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: doris-cluster-be-conf
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: be
+data:
+  be.conf: >
+    CUR_DATE=`date +%Y%m%d-%H%M%S`
+    
+    # Log dir
+    LOG_DIR="${DORIS_HOME}/log/"
+    
+    # For jdk 8
+    JAVA_OPTS="-Dfile.encoding=UTF-8 -Xmx2048m -DlogPath=$LOG_DIR/jni.log -Xloggc:$LOG_DIR/be.gc.log.$CUR_DATE -XX:+UseGCLogFileRotation -XX:NumberOfGCLogFiles=10 -XX:GCLogFileSize=50M -Djavax.security.auth.useSubjectCredsOnly=false -Dsun.security.krb5.debug=true -Dsun.java.command=DorisBE -XX:-CriticalJNINatives"
+    
+    # Set your own JAVA_HOME
+    # JAVA_HOME=/path/to/jdk/
+    
+    # https://github.com/apache/doris/blob/master/docs/zh-CN/community/developer-guide/debug-tool.md#jemalloc-heap-profile
+    # https://jemalloc.net/jemalloc.3.html jemalloc 内存分配器设置参数
+    JEMALLOC_CONF="percpu_arena:percpu,background_thread:true,metadata_thp:auto,muzzy_decay_ms:15000,dirty_decay_ms:15000,oversize_threshold:0,prof:false,lg_prof_interval:32,lg_prof_sample:19,prof_gdump:false,prof_accum:false,prof_leak:false,prof_final:false"
+    JEMALLOC_PROF_PRFIX=""
+    
+    # ports for admin, web, heartbeat service
+    be_port = 9060
+    webserver_port = 8040
+    heartbeat_service_port = 9050
+    brpc_port = 8060
+    arrow_flight_sql_port = -1
+    
+    # HTTPS configures
+    enable_https = false
+    # path of certificate in PEM format.
+    #ssl_certificate_path = "$DORIS_HOME/conf/cert.pem"
+    # path of private key in PEM format.
+    #ssl_private_key_path = "$DORIS_HOME/conf/key.pem"
+    
+    # Choose one if there are more than one ip except loopback address.
+    # Note that there should at most one ip match this list.
+    # If no ip match this rule, will choose one randomly.
+    # use CIDR format, e.g. 10.10.10.0/24 or IP format, e.g. 10.10.10.1
+    # Default value is empty.
+    # priority_networks = 10.10.10.0/24;192.168.0.0/16
+    
+    # data root path, separate by ';'
+    # You can specify the storage type for each root path, HDD (cold data) or SSD (hot data)
+    # eg:
+    # storage_root_path = /home/disk1/doris;/home/disk2/doris;/home/disk2/doris
+    # storage_root_path = /home/disk1/doris,medium:SSD;/home/disk2/doris,medium:SSD;/home/disk2/doris,medium:HDD
+    # /home/disk2/doris,medium:HDD(default)
+    #
+    # you also can specify the properties by setting '<property>:<value>', separate by ','
+    # property 'medium' has a higher priority than the extension of path
+    #
+    # Default value is ${DORIS_HOME}/storage, you should create it by hand.
+    # storage_root_path = ${DORIS_HOME}/storage
+    
+    # Default dirs to put jdbc drivers,default value is ${DORIS_HOME}/jdbc_drivers
+    # jdbc_drivers_dir = ${DORIS_HOME}/jdbc_drivers
+    
+    # Advanced configurations
+    # INFO, WARNING, ERROR, FATAL
+    sys_log_level = INFO
+    # sys_log_roll_mode = SIZE-MB-1024
+    # sys_log_roll_num = 10
+    # sys_log_verbose_modules = *
+    # log_buffer_level = -1
+    
+    # aws sdk log level
+    #    Off = 0,
+    #    Fatal = 1,
+    #    Error = 2,
+    #    Warn = 3,
+    #    Info = 4,
+    #    Debug = 5,
+    #    Trace = 6
+    # Default to turn off aws sdk log, because aws sdk errors that need to be cared will be output through Doris logs
+    #aws_log_level=0
+    ## If you are not running in aws cloud, you can disable EC2 metadata
+    #AWS_EC2_METADATA_DISABLED=false
--- a/65-202504-湖南二级监管/doris-deploy/doris-be-internal-service.yaml
+++ b/65-202504-湖南二级监管/doris-deploy/doris-be-internal-service.yaml
@@ -0,0 +1,17 @@
+kind: Service
+apiVersion: v1
+metadata:
+  namespace: zyly
+  name: doris-cluster-be-internal
+  labels:
+    app.kubernetes.io/component: doris-cluster-be-internal
+spec:
+  ports:
+    - name: heartbeat-port
+      protocol: TCP
+      port: 9050
+      targetPort: 9050
+  selector:
+    app.kubernetes.io/component: doris-cluster-be
+  clusterIP: None
+  type: ClusterIP
--- a/65-202504-湖南二级监管/doris-deploy/doris-be-service.yaml
+++ b/65-202504-湖南二级监管/doris-deploy/doris-be-service.yaml
@@ -0,0 +1,32 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: doris-cluster-be-service
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: doris-cluster-be
+spec:
+  ports:
+    - name: be-port
+      protocol: TCP
+      port: 9060
+      targetPort: 9060
+      nodePort: 32189
+    - name: webserver-port
+      protocol: TCP
+      port: 8040
+      targetPort: 8040
+      nodePort: 31624
+    - name: heartbeat-port
+      protocol: TCP
+      port: 9050
+      targetPort: 9050
+      nodePort: 31625
+    - name: brpc-port
+      protocol: TCP
+      port: 8060
+      targetPort: 8060
+      nodePort: 31627
+  selector:
+    app.kubernetes.io/component: doris-cluster-be
+  type: NodePort
--- a/65-202504-湖南二级监管/doris-deploy/doris-be-statusfulset.yaml
+++ b/65-202504-湖南二级监管/doris-deploy/doris-be-statusfulset.yaml
@@ -0,0 +1,208 @@
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  name: doris-cluster-be
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: doris-cluster-be
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: doris-cluster-be
+  template:
+    metadata:
+      name: doris-cluster-be
+      labels:
+        app.kubernetes.io/component: doris-cluster-be
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      volumes:
+        - name: podinfo
+          downwardAPI:
+            items:
+              - path: labels
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.labels
+              - path: annotations
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.annotations
+            defaultMode: 420
+        - name: doris-cluster-be-conf
+          configMap:
+            name: doris-cluster-be-conf
+            defaultMode: 420
+        - name: be-storage
+          persistentVolumeClaim:
+              #            claimName: meta
+              claimName: doris-be-storage-pvc
+        - name: be-log
+          persistentVolumeClaim:
+            #            claimName: meta
+            claimName: doris-fe-log-pvc
+      initContainers:
+        - name: default-init
+          image: 'hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/alpine:1.0.0'
+          command:
+            - /bin/sh
+          args:
+            - '-c'
+            - sysctl -w vm.max_map_count=2000000 && swapoff -a
+          resources:
+            limits:
+              cpu: '2'
+              memory: 2Gi
+            requests:
+              cpu: '1'
+              memory: 1Gi
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            privileged: true
+      containers:
+        - name: be
+          image: 'hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/doris.be-amd64:2.1.6'
+          command:
+            - /opt/apache-doris/be_entrypoint.sh
+          args:
+            - $(ENV_FE_ADDR)
+          ports:
+            - name: be-port
+              containerPort: 9060
+              protocol: TCP
+            - name: webserver-port
+              containerPort: 8040
+              protocol: TCP
+            - name: heartbeat-port
+              containerPort: 9050
+              protocol: TCP
+            - name: brpc-port
+              containerPort: 8060
+              protocol: TCP
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.name
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: status.podIP
+            - name: HOST_IP
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: status.hostIP
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: CONFIGMAP_MOUNT_PATH
+              value: /etc/doris
+            - name: USER
+              value: root
+            - name: DORIS_ROOT
+              value: /opt/apache-doris
+            - name: ENV_FE_ADDR
+              value: doris-cluster-fe-service
+            - name: FE_QUERY_PORT
+              value: '9030'
+          resources:
+            limits:
+              cpu: '2'
+              memory: 2Gi
+            requests:
+              cpu: '1'
+              memory: 1Gi
+          volumeMounts:
+            - name: podinfo
+              mountPath: /etc/podinfo
+            - name: be-storage
+              mountPath: /opt/apache-doris/be/storage
+            - name: be-log
+              mountPath: /opt/apache-doris/be/log
+            - name: doris-cluster-be-conf
+              mountPath: /etc/doris
+          livenessProbe:
+            tcpSocket:
+              port: 9050
+            initialDelaySeconds: 80
+            timeoutSeconds: 180
+            periodSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 8040
+              scheme: HTTP
+            timeoutSeconds: 1
+            periodSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          startupProbe:
+            tcpSocket:
+              port: 9050
+            timeoutSeconds: 1
+            periodSeconds: 5
+            successThreshold: 1
+            failureThreshold: 60
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - /opt/apache-doris/be_prestop.sh
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: IfNotPresent
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      dnsPolicy: ClusterFirst
+      securityContext: {}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/component
+                      operator: In
+                      values:
+                        - doris-cluster-be
+                topologyKey: kubernetes.io/hostname
+      schedulerName: default-scheduler
+#  volumeClaimTemplates:
+#    - kind: PersistentVolumeClaim
+#      apiVersion: v1
+#      metadata:
+#        name: be-storage
+#      spec:
+#        accessModes:
+#          - ReadWriteOnce
+#        resources:
+#          requests:
+#            storage: '10'
+#        storageClassName: nfs-prod-distribute
+#        volumeMode: Filesystem
+#    - kind: PersistentVolumeClaim
+#      apiVersion: v1
+#      metadata:
+#        name: be-log
+#      spec:
+#        accessModes:
+#          - ReadWriteOnce
+#        resources:
+#          requests:
+#            storage: '10'
+#        storageClassName: nfs-prod-distribute
+#        volumeMode: Filesystem
+  serviceName: doris-cluster-be-internal
+  podManagementPolicy: Parallel
--- a/65-202504-湖南二级监管/doris-deploy/doris-fe-configmap.yaml
+++ b/65-202504-湖南二级监管/doris-deploy/doris-fe-configmap.yaml
@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: doris-cluster-fe-conf
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: fe
+data:
+  fe.conf: |
+    #####################################################################
+    ## The uppercase properties are read and exported by bin/start_fe.sh.
+    ## To see all Frontend configurations,
+    ## see fe/src/org/apache/doris/common/Config.java
+    #####################################################################
+    
+    CUR_DATE=`date +%Y%m%d-%H%M%S`
+    
+    # Log dir
+    LOG_DIR = ${DORIS_HOME}/log
+    
+    # For jdk 8
+    JAVA_OPTS="-Dfile.encoding=UTF-8 -Djavax.security.auth.useSubjectCredsOnly=false -Xss4m -Xmx8192m -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:+PrintGCDateStamps -XX:+PrintGCDetails -Xloggc:$LOG_DIR/log/fe.gc.log.$CUR_DATE -XX:+UseGCLogFileRotation -XX:NumberOfGCLogFiles=10 -XX:GCLogFileSize=50M -Dlog4j2.formatMsgNoLookups=true"
+        
+    # Set your own JAVA_HOME
+    # JAVA_HOME=/path/to/jdk/
+    
+    ##
+    ## the lowercase properties are read by main program.
+    ##
+    
+    # store metadata, must be created before start FE.
+    # Default value is ${DORIS_HOME}/doris-meta
+    # meta_dir = ${DORIS_HOME}/doris-meta
+    
+    # Default dirs to put jdbc drivers,default value is ${DORIS_HOME}/jdbc_drivers
+    # jdbc_drivers_dir = ${DORIS_HOME}/jdbc_drivers
+    
+    http_port = 8030
+    rpc_port = 9020
+    query_port = 9030
+    edit_log_port = 9010
+    arrow_flight_sql_port = -1
+    
+    # Choose one if there are more than one ip except loopback address.
+    # Note that there should at most one ip match this list.
+    # If no ip match this rule, will choose one randomly.
+    # use CIDR format, e.g. 10.10.10.0/24 or IP format, e.g. 10.10.10.1
+    # Default value is empty.
+    # priority_networks = 10.10.10.0/24;192.168.0.0/16
+    
+    # Advanced configurations
+    # log_roll_size_mb = 1024
+    # INFO, WARN, ERROR, FATAL
+    sys_log_level = INFO
+    # NORMAL, BRIEF, ASYNC,FE 日志的输出模式，其中 NORMAL 为默认的输出模式，日志同步输出且包含位置信息。ASYNC 默认是日志异步输出且包含位置信息。 BRIEF 模式是日志异步输出但不包含位置信息。三种日志输出模式的性能依次递增
+    sys_log_mode = ASYNC
+    # sys_log_roll_num = 10
+    # sys_log_verbose_modules = org.apache.doris
+    # audit_log_dir = $LOG_DIR
+    # audit_log_modules = slow_query, query
+    # audit_log_roll_num = 10
+    # meta_delay_toleration_second = 10
+    # qe_max_connection = 1024
+    # qe_query_timeout_second = 300
+    # qe_slow_log_ms = 5000
+    #Fully Qualified Domain Name，完全限定域名,开启后各节点之间通信基于FQDN
+    enable_fqdn_mode = true
--- a/65-202504-湖南二级监管/doris-deploy/doris-fe-internal-service.yaml
+++ b/65-202504-湖南二级监管/doris-deploy/doris-fe-internal-service.yaml
@@ -0,0 +1,17 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: doris-cluster-fe-internal
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: doris-cluster-fe
+spec:
+  ports:
+    - name: query-port
+      protocol: TCP
+      port: 9030
+      targetPort: 9030
+  selector:
+    app.kubernetes.io/component: doris-cluster-fe
+  clusterIP: None
+  type: ClusterIP
--- a/65-202504-湖南二级监管/doris-deploy/doris-fe-service.yaml
+++ b/65-202504-湖南二级监管/doris-deploy/doris-fe-service.yaml
@@ -0,0 +1,32 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: doris-cluster-fe-service
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: doris-cluster-fe
+spec:
+  ports:
+    - name: http-port
+      protocol: TCP
+      port: 8030
+      targetPort: 8030
+      nodePort: 31620
+    - name: rpc-port
+      protocol: TCP
+      port: 9020
+      targetPort: 9020
+      nodePort: 31621
+    - name: query-port
+      protocol: TCP
+      port: 9030
+      targetPort: 9030
+      nodePort: 31622
+    - name: edit-log-port
+      protocol: TCP
+      port: 9010
+      targetPort: 9010
+      nodePort: 31623
+  selector:
+    app.kubernetes.io/component: doris-cluster-fe
+  type: NodePort
--- a/65-202504-湖南二级监管/doris-deploy/doris-fe-statusfulset.yaml
+++ b/65-202504-湖南二级监管/doris-deploy/doris-fe-statusfulset.yaml
@@ -0,0 +1,190 @@
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  name: doris-cluster-fe
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: doris-cluster-fe
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: doris-cluster-fe
+  template:
+    metadata:
+      name: doris-cluster-fe
+      labels:
+        app.kubernetes.io/component: doris-cluster-fe
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      volumes:
+        - name: meta
+          persistentVolumeClaim:
+#            claimName: meta
+            claimName: doris-fe-meta-pvc
+        - name: log
+          persistentVolumeClaim:
+    #            claimName: meta
+            claimName: doris-fe-log-pvc
+        - name: podinfo
+          downwardAPI:
+            items:
+              - path: labels
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.labels
+              - path: annotations
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.annotations
+            defaultMode: 420
+        - name: doris-cluster-fe-conf
+          configMap:
+            name: doris-cluster-fe-conf
+            defaultMode: 420
+      containers:
+        - name: doris-cluster-fe
+          image: 'hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/doris.fe-amd64:2.1.6'
+          command:
+            - /opt/apache-doris/fe_entrypoint.sh
+          args:
+            - $(ENV_FE_ADDR)
+          ports:
+            - name: http-port
+              containerPort: 8030
+              protocol: TCP
+            - name: rpc-port
+              containerPort: 9020
+              protocol: TCP
+            - name: query-port
+              containerPort: 9030
+              protocol: TCP
+            - name: edit-log-port
+              containerPort: 9010
+              protocol: TCP
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.name
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: status.podIP
+            - name: HOST_IP
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: status.hostIP
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: CONFIGMAP_MOUNT_PATH
+              value: /etc/doris
+            - name: USER
+              value: root
+            - name: DORIS_ROOT
+              value: /opt/apache-doris
+            - name: ENV_FE_ADDR
+              value: doris-cluster-fe-service
+            - name: FE_QUERY_PORT
+              value: '9030'
+            - name: ELECT_NUMBER
+              value: '3'
+          resources:
+            limits:
+              cpu: '2'
+              memory: 2Gi
+            requests:
+              cpu: '1'
+              memory: 1Gi
+          volumeMounts:
+            - name: podinfo
+              mountPath: /etc/podinfo
+            - name: log
+              mountPath: /opt/apache-doris/fe/log
+            - name: meta
+              mountPath: /opt/apache-doris/fe/doris-meta
+            - name: doris-cluster-fe-conf
+              mountPath: /etc/doris
+          livenessProbe:
+            tcpSocket:
+              port: 9030
+            initialDelaySeconds: 80
+            timeoutSeconds: 180
+            periodSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 8030
+              scheme: HTTP
+            timeoutSeconds: 1
+            periodSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          startupProbe:
+            tcpSocket:
+              port: 9030
+            timeoutSeconds: 1
+            periodSeconds: 5
+            successThreshold: 1
+            failureThreshold: 60
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - /opt/apache-doris/fe_prestop.sh
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: IfNotPresent
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      dnsPolicy: ClusterFirst
+      securityContext: {}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/component
+                      operator: In
+                      values:
+                        - doris-cluster-fe
+                topologyKey: kubernetes.io/hostname
+      schedulerName: default-scheduler
+#  volumeClaimTemplates:
+#    - kind: PersistentVolumeClaim
+#      apiVersion: v1
+#      metadata:
+#        name: meta
+#      spec:
+#        accessModes:
+#          - ReadWriteOnce
+#        resources:
+#          requests:
+#            storage: 10G
+#        storageClassName: hcms-efs-class
+#        volumeMode: Filesystem
+#    - kind: PersistentVolumeClaim
+#      apiVersion: v1
+#      metadata:
+#        name: log
+#      spec:
+#        accessModes:
+#          - ReadWriteOnce
+#        resources:
+#          requests:
+#            storage: '10'
+#        storageClassName: hcms-efs-class
+#        volumeMode: Filesystem
+  serviceName: doris-cluster-fe-internal
+  podManagementPolicy: Parallel
--- a/65-202504-湖南二级监管/doris-deploy/doris-pvc.yaml
+++ b/65-202504-湖南二级监管/doris-deploy/doris-pvc.yaml
@@ -0,0 +1,60 @@
+---
+# pvc.yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doris-fe-meta-pvc
+  namespace: zyly
+spec:
+  storageClassName: hcms-efs-class
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doris-fe-log-pvc
+  namespace: zyly
+spec:
+  storageClassName: hcms-efs-class
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doris-be-storage-pvc
+  namespace: zyly
+spec:
+  storageClassName: hcms-efs-class
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 180Gi  # 根据实际存储需求调整
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doris-be-log-pvc
+  namespace: zyly
+spec:
+  storageClassName: hcms-efs-class
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
--- a/65-202504-湖南二级监管/doris-simple-k8s-失败/doris-deployment-dev.yaml
+++ b/65-202504-湖南二级监管/doris-simple-k8s-失败/doris-deployment-dev.yaml
@@ -0,0 +1,151 @@
+# doris-fe-app.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: doris-fe-app
+  namespace: uavcloud-devflight
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: doris-fe-app
+  template:
+    metadata:
+      labels:
+        app: doris-fe-app
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      containers:
+        - name: doris-fe-app
+          image: harbor.cdcyy.com.cn/cmii/doris.fe-amd64:2.1.6
+          env:
+            - name: FE_SERVERS
+              value: "fe1:doris-fe-service:9010"  # 使用Service名称进行服务发现
+            - name: FE_ID
+              value: "1"
+          ports:
+            - containerPort: 8030
+            - containerPort: 9030
+            - containerPort: 9010  # 添加内部通信端口
+          volumeMounts:
+            - name: fe-meta
+              mountPath: /opt/apache-doris/fe/doris-meta
+            - name: fe-log
+              mountPath: /opt/apache-doris/fe/log
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 2Gi
+              cpu: "1"
+      volumes:
+        - name: fe-meta
+          persistentVolumeClaim:
+            claimName: doris-fe-meta-pvc
+        - name: fe-log
+          persistentVolumeClaim:
+            claimName: doris-fe-log-pvc
+
+---
+# doris-fe-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: doris-fe-service
+  namespace: uavcloud-devflight
+spec:
+  selector:
+    app: doris-fe-app
+  ports:
+    - name: http
+      port: 8030
+      targetPort: 8030
+    - name: query
+      port: 9030
+      targetPort: 9030
+    - name: edit
+      port: 9010  # 暴露FE内部通信端口
+      targetPort: 9010
+
+---
+# doris-be-app.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: doris-be-app
+  namespace: uavcloud-devflight
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: doris-be-app
+  template:
+    metadata:
+      labels:
+        app: doris-be-app
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+#      initContainers:
+#        - name: wait-for-fe
+#          image: harbor.cdcyy.com.cn/cmii/busybox:latest
+#          command: ['sh', '-c', 'until nc -z doris-fe-service 9010; do echo waiting for fe; sleep 2; done;']
+#          resources:
+#            limits:
+#              memory: 2Gi
+#              cpu: "2"
+#            requests:
+#              memory: 200Mi
+#              cpu: 200m
+      containers:
+        - name: doris-be-app
+          image: harbor.cdcyy.com.cn/cmii/doris.be-amd64:2.1.6
+          env:
+            - name: FE_SERVERS
+              value: "fe1:doris-fe-service:9010"
+            - name: BE_ADDR
+              value: "doris-be-service:9050"  # 使用Service名称
+          ports:
+            - containerPort: 8040
+            - containerPort: 9050  # 添加BE通信端口
+          volumeMounts:
+            - name: doris-be-storage
+              mountPath: /opt/apache-doris/be/storage
+            - name: doris-be-log
+              mountPath: /opt/apache-doris/be/log
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 2Gi
+              cpu: "1"
+      volumes:
+        - name: doris-be-storage
+          persistentVolumeClaim:
+            claimName: doris-be-storage-pvc
+        - name: doris-be-log
+          persistentVolumeClaim:
+            claimName: doris-be-log-pvc
+
+---
+# doris-be-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: doris-be-service
+  namespace: uavcloud-devflight
+spec:
+  selector:
+    app: doris-be-app
+  ports:
+    - name: http
+      port: 8040
+      targetPort: 8040
+    - name: be-port
+      port: 9050  # 暴露BE通信端口
+      targetPort: 9050
+
+
--- a/65-202504-湖南二级监管/doris-simple-k8s-失败/doris-deployment.yaml
+++ b/65-202504-湖南二级监管/doris-simple-k8s-失败/doris-deployment.yaml
@@ -0,0 +1,151 @@
+# doris-fe-app.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: doris-fe-app
+  namespace: zyly
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: doris-fe-app
+  template:
+    metadata:
+      labels:
+        app: doris-fe-app
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      containers:
+        - name: doris-fe-app
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/doris.fe-amd64:2.1.6
+          env:
+            - name: FE_SERVERS
+              value: "doris-fe-service:9010"  # 使用Service名称进行服务发现
+            - name: FE_ID
+              value: "1"
+          ports:
+            - containerPort: 8030
+            - containerPort: 9030
+            - containerPort: 9010  # 添加内部通信端口
+          volumeMounts:
+            - name: fe-meta
+              mountPath: /opt/apache-doris/fe/doris-meta
+            - name: fe-log
+              mountPath: /opt/apache-doris/fe/log
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 2Gi
+              cpu: "1"
+      volumes:
+        - name: fe-meta
+          persistentVolumeClaim:
+            claimName: doris-fe-meta-pvc
+        - name: fe-log
+          persistentVolumeClaim:
+            claimName: doris-fe-log-pvc
+
+---
+# doris-fe-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: doris-fe-service
+  namespace: zyly
+spec:
+  selector:
+    app: doris-fe-app
+  ports:
+    - name: http
+      port: 8030
+      targetPort: 8030
+    - name: query
+      port: 9030
+      targetPort: 9030
+    - name: edit
+      port: 9010  # 暴露FE内部通信端口
+      targetPort: 9010
+
+---
+# doris-be-app.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: doris-be-app
+  namespace: zyly
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: doris-be-app
+  template:
+    metadata:
+      labels:
+        app: doris-be-app
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+#      initContainers:
+#        - name: wait-for-fe
+#          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/busybox:latest
+#          command: ['sh', '-c', 'until nc -z doris-fe-service 9010; do echo waiting for fe; sleep 2; done;']
+#          resources:
+#            limits:
+#              memory: 2Gi
+#              cpu: "2"
+#            requests:
+#              memory: 200Mi
+#              cpu: 200m
+      containers:
+        - name: doris-be-app
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/doris.be-amd64:2.1.6
+          env:
+            - name: FE_SERVERS
+              value: "doris-fe-service:9010"
+            - name: BE_ADDR
+              value: "doris-be-service:9050"  # 使用Service名称
+          ports:
+            - containerPort: 8040
+            - containerPort: 9050  # 添加BE通信端口
+          volumeMounts:
+            - name: doris-be-storage
+              mountPath: /opt/apache-doris/be/storage
+            - name: doris-be-log
+              mountPath: /opt/apache-doris/be/log
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 2Gi
+              cpu: "1"
+      volumes:
+        - name: doris-be-storage
+          persistentVolumeClaim:
+            claimName: doris-be-storage-pvc
+        - name: doris-be-log
+          persistentVolumeClaim:
+            claimName: doris-be-log-pvc
+
+---
+# doris-be-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: doris-be-service
+  namespace: zyly
+spec:
+  selector:
+    app: doris-be-app
+  ports:
+    - name: http
+      port: 8040
+      targetPort: 8040
+    - name: be-port
+      port: 9050  # 暴露BE通信端口
+      targetPort: 9050
+
+
--- a/65-202504-湖南二级监管/doris-simple-k8s-失败/doris-pvc.yaml
+++ b/65-202504-湖南二级监管/doris-simple-k8s-失败/doris-pvc.yaml
@@ -0,0 +1,60 @@
+---
+# pvc.yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doris-fe-meta-pvc
+  namespace: uavcloud-devflight
+spec:
+  storageClassName: nfs-prod-distribute
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doris-fe-log-pvc
+  namespace: uavcloud-devflight
+spec:
+  storageClassName: nfs-prod-distribute
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doris-be-storage-pvc
+  namespace: uavcloud-devflight
+spec:
+  storageClassName: nfs-prod-distribute
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 180Gi  # 根据实际存储需求调整
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: doris-be-log-pvc
+  namespace: uavcloud-devflight
+spec:
+  storageClassName: nfs-prod-distribute
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
--- a/65-202504-湖南二级监管/doris部署-operator/doris-configmap.yaml
+++ b/65-202504-湖南二级监管/doris部署-operator/doris-configmap.yaml
@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fe-configmap
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: fe
+data:
+  fe.conf: |
+    CUR_DATE=`date +%Y%m%d-%H%M%S`
+ 
+    # the output dir of stderr and stdout
+    LOG_DIR = ${DORIS_HOME}/log
+ 
+    JAVA_OPTS="-Djavax.security.auth.useSubjectCredsOnly=false -Xss4m -Xmx8192m -XX:+UseMembar -XX:SurvivorRatio=8 -XX:MaxTenuringThreshold=7 -XX:+PrintGCDateStamps -XX:+PrintGCDetails -XX:+UseConcMarkSweepGC -XX:+UseParNewGC -XX:+CMSClassUnloadingEnabled -XX:-CMSParallelRemarkEnabled -XX:CMSInitiatingOccupancyFraction=80 -XX:SoftRefLRUPolicyMSPerMB=0 -Xloggc:$DORIS_HOME/log/fe.gc.log.$CUR_DATE"
+ 
+    # For jdk 9+, this JAVA_OPTS will be used as default JVM options
+    JAVA_OPTS_FOR_JDK_9="-Djavax.security.auth.useSubjectCredsOnly=false -Xss4m -Xmx8192m -XX:SurvivorRatio=8 -XX:MaxTenuringThreshold=7 -XX:+CMSClassUnloadingEnabled -XX:-CMSParallelRemarkEnabled -XX:CMSInitiatingOccupancyFraction=80 -XX:SoftRefLRUPolicyMSPerMB=0 -Xlog:gc*:$DORIS_HOME/log/fe.gc.log.$CUR_DATE:time"
+ 
+    # INFO, WARN, ERROR, FATAL
+    sys_log_level = INFO
+ 
+    # NORMAL, BRIEF, ASYNC
+    sys_log_mode = NORMAL
+ 
+    # Default dirs to put jdbc drivers,default value is ${DORIS_HOME}/jdbc_drivers
+    # jdbc_drivers_dir = ${DORIS_HOME}/jdbc_drivers
+ 
+    http_port = 8030
+    arrow_flight_sql_port = 9090
+    rpc_port = 9020
+    query_port = 9030
+    edit_log_port = 9010
+    
+    enable_fqdn_mode = true
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: be-configmap
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: be
+data:
+  be.conf: |
+    CUR_DATE=`date +%Y%m%d-%H%M%S`
+ 
+    PPROF_TMPDIR="$DORIS_HOME/log/"
+ 
+    JAVA_OPTS="-Xmx1024m -DlogPath=$DORIS_HOME/log/jni.log -Xloggc:$DORIS_HOME/log/be.gc.log.$CUR_DATE -Djavax.security.auth.useSubjectCredsOnly=false -Dsun.java.command=DorisBE -XX:-CriticalJNINatives -DJDBC_MIN_POOL=1 -DJDBC_MAX_POOL=100 -DJDBC_MAX_IDLE_TIME=300000 -DJDBC_MAX_WAIT_TIME=5000"
+ 
+    # For jdk 9+, this JAVA_OPTS will be used as default JVM options
+    JAVA_OPTS_FOR_JDK_9="-Xmx1024m -DlogPath=$DORIS_HOME/log/jni.log -Xlog:gc:$DORIS_HOME/log/be.gc.log.$CUR_DATE -Djavax.security.auth.useSubjectCredsOnly=false -Dsun.java.command=DorisBE -XX:-CriticalJNINatives -DJDBC_MIN_POOL=1 -DJDBC_MAX_POOL=100 -DJDBC_MAX_IDLE_TIME=300000 -DJDBC_MAX_WAIT_TIME=5000"
+ 
+    # since 1.2, the JAVA_HOME need to be set to run BE process.
+    # JAVA_HOME=/path/to/jdk/
+ 
+    # https://github.com/apache/doris/blob/master/docs/zh-CN/community/developer-guide/debug-tool.md#jemalloc-heap-profile
+    # https://jemalloc.net/jemalloc.3.html
+    JEMALLOC_CONF="percpu_arena:percpu,background_thread:true,metadata_thp:auto,muzzy_decay_ms:15000,dirty_decay_ms:15000,oversize_threshold:0,lg_tcache_max:20,prof:false,lg_prof_interval:32,lg_prof_sample:19,prof_gdump:false,prof_accum:false,prof_leak:false,prof_final:false"
+    JEMALLOC_PROF_PRFIX=""
+ 
+    # INFO, WARNING, ERROR, FATAL
+    sys_log_level = INFO
+ 
+    # ports for admin, web, heartbeat service
+    be_port = 9060
+    webserver_port = 8040
+    heartbeat_service_port = 9050
+    arrow_flight_sql_port = 39091
+    brpc_port = 8060
--- a/65-202504-湖南二级监管/doris部署-operator/doris-deployment-pv.yaml
+++ b/65-202504-湖南二级监管/doris部署-operator/doris-deployment-pv.yaml
@@ -0,0 +1,94 @@
+apiVersion: doris.selectdb.com/v1
+kind: DorisCluster
+metadata:
+  labels:
+    app.kubernetes.io/name: doriscluster
+  name: doriscluster-helm
+  namespace: zyly
+spec:
+  feSpec:
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: uavcloud.env
+                  operator: In
+                  values:
+                    - doris
+    replicas: 3
+    image: 172.16.100.55:8033/cmii/doris.fe-ubuntu:2.1.6
+    limits:
+      cpu: 8
+      memory: 16Gi
+    requests:
+      cpu: 2
+      memory: 6Gi
+    configMapInfo:
+      # use kubectl create configmap fe-configmap --from-file=fe.conf
+      configMapName: fe-configmap
+      resolveKey: fe.conf
+    persistentVolumes:
+    - mountPath: /opt/apache-doris/fe/doris-meta
+      name: doris-fe-2000g
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: doris-nfs-sc-56
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2000Gi
+    - mountPath: /opt/apache-doris/fe/jdbc_drivers
+      name: doriscluster-storage-fe-jdbc-drivers
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: doris-nfs-sc-58
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 100Gi
+  beSpec:
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: uavcloud.env
+                  operator: In
+                  values:
+                    - doris
+    replicas: 3
+    image: 172.16.100.55:8033/cmii/doris.be-ubuntu:2.1.6
+    limits:
+      cpu: 8
+      memory: 24Gi
+    requests:
+      cpu: 2
+      memory: 6Gi
+    configMapInfo:
+      # use kubectl create configmap be-configmap --from-file=be.conf
+      configMapName: be-configmap
+      resolveKey: be.conf
+    persistentVolumes:
+    - mountPath: /opt/apache-doris/be/storage
+      name: doris-1-9000g-pvc
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: doris-nfs-sc-57
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 9000Gi
+    - mountPath: /opt/apache-doris/be/jdbc_drivers
+      name: doriscluster-storage-be-jdbc-drivers
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: doris-nfs-sc-58
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1000Gi
--- a/65-202504-湖南二级监管/doris部署-operator/doris-deplyment.yaml
+++ b/65-202504-湖南二级监管/doris部署-operator/doris-deplyment.yaml
@@ -0,0 +1,119 @@
+apiVersion: doris.selectdb.com/v1
+kind: DorisCluster
+metadata:
+  labels:
+    app.kubernetes.io/name: doriscluster
+  name: doriscluster-helm
+  namespace: zyly
+spec:
+  feSpec:
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: doris-deploy
+                  operator: In
+                  values:
+                    - "true"
+    replicas: 1
+    image: 172.16.100.55:8033/cmii/doris.fe-ubuntu:2.1.6
+    limits:
+      cpu: 8
+      memory: 16Gi
+    requests:
+      cpu: 2
+      memory: 6Gi
+    configMapInfo:
+      # use kubectl create configmap fe-configmap --from-file=fe.conf
+      configMapName: fe-configmap
+      resolveKey: fe.conf
+    nodeSelector:
+      uavcloud.env: demo
+    persistentVolumes:
+    - mountPath: /opt/apache-doris/fe/doris-meta
+      name: doriscluster-storage0
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: doris-static-storage
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          # notice: if the storage size less 5G, fe will not start normal.
+          requests:
+            storage: 500Gi
+    - mountPath: /opt/apache-doris/fe/jdbc_drivers
+      name: doriscluster-storage-fe-jdbc-drivers
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: cmlc-nfs-storage
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 10Gi
+  beSpec:
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: doris-deploy
+                  operator: In
+                  values:
+                    - "true"
+    replicas: 3
+    image: 172.16.100.55:8033/cmii/doris.be-ubuntu:2.1.6
+    limits:
+      cpu: 8
+      memory: 24Gi
+    requests:
+      cpu: 2
+      memory: 6Gi
+    configMapInfo:
+      # use kubectl create configmap be-configmap --from-file=be.conf
+      configMapName: be-configmap
+      resolveKey: be.conf
+    nodeSelector:
+      uavcloud.env: demo
+    persistentVolumes:
+    - mountPath: /opt/apache-doris/be/storage
+      name: doriscluster-storage1
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: doris-static-storage
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 9000Gi
+    - mountPath: /opt/apache-doris/be/storage
+      name: doriscluster-storage2
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: doris-static-storage
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 9000Gi
+    - mountPath: /opt/apache-doris/be/log
+      name: doriscluster-storage3
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: doris-static-storage
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 9000Gi
+    - mountPath: /opt/apache-doris/be/jdbc_drivers
+      name: doriscluster-storage-be-jdbc-drivers
+      persistentVolumeClaimSpec:
+        # when use specific storageclass, the storageClassName should reConfig, example as annotation.
+        storageClassName: cmlc-nfs-storage
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 10Gi
--- a/65-202504-湖南二级监管/doris部署-operator/doris-kind.yaml
+++ b/65-202504-湖南二级监管/doris部署-operator/doris-kind.yaml
--- a/65-202504-湖南二级监管/doris部署-operator/doris-operator.yaml
+++ b/65-202504-湖南二级监管/doris部署-operator/doris-operator.yaml
@@ -0,0 +1,340 @@
+# Source: doris-operator/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: serviceaccount
+    app.kubernetes.io/instance: controller-doris-operator-sa
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: doris-operator
+    app.kubernetes.io/part-of: doris-operator
+    app.kubernetes.io/managed-by: Helm
+  name: doris-operator
+  namespace: zyly
+---
+# Source: doris-operator/templates/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: doris-operator
+rules:
+  - apiGroups:
+      - apps
+    resources:
+      - statefulsets
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - statefulsets/status
+    verbs:
+      - get
+  - apiGroups:
+      - autoscaling
+    resources:
+      - horizontalpodautoscalers
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccounts
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - doris.selectdb.com
+    resources:
+      - dorisclusters
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - doris.selectdb.com
+    resources:
+      - dorisclusters/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - doris.selectdb.com
+    resources:
+      - dorisclusters/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - clusterrolebindings
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - rolebindings
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+# Source: doris-operator/templates/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/instance: doris-operator-rolebinding
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: doris-operator
+    app.kubernetes.io/part-of: doris-operator
+    app.kubernetes.io/managed-by: Helm
+  name: doris-operator-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: doris-operator
+subjects:
+  - kind: ServiceAccount
+    name: doris-operator
+    namespace: zyly
+---
+# Source: doris-operator/templates/leader-election-role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/name: role
+    app.kubernetes.io/instance: leader-election-role
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: doris-operator
+    app.kubernetes.io/part-of: doris-operator
+    app.kubernetes.io/managed-by: Helm
+  name: leader-election-role
+  namespace: zyly
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+---
+# Source: doris-operator/templates/leader-election-role-binding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: rolebinding
+    app.kubernetes.io/instance: leader-election-rolebinding
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: doris-operator
+    app.kubernetes.io/part-of: doris-operator
+    app.kubernetes.io/managed-by: Helm
+  name: leader-election-rolebinding
+  namespace: zyly
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: leader-election-role
+subjects:
+  - kind: ServiceAccount
+    name: doris-operator
+    namespace: zyly
+---
+# Source: doris-operator/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: doris-operator
+  namespace: zyly
+  labels:
+    control-plane: doris-operator
+    app.kubernetes.io/name: deployment
+    app.kubernetes.io/instance: doris-operator
+    app.kubernetes.io/component: doris-operator
+    app.kubernetes.io/created-by: doris-operator
+    app.kubernetes.io/part-of: doris-operator
+spec:
+  selector:
+    matchLabels:
+      control-plane: doris-operator
+  replicas: 1
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: doris-operator
+      labels:
+        control-plane: doris-operator
+    spec:
+      # TODO(user): Uncomment the following code to configure the nodeAffinity expression
+      # according to the platforms which are supported by your solution.
+      # It is considered best practice to support multiple architectures. You can
+      # build your manager image using the makefile target docker-buildx.
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+             - matchExpressions:
+               - key: doris-deploy
+                 operator: In
+                 values:
+                   - "true"
+      securityContext:
+        runAsNonRoot: true
+        # TODO(user): For common cases that do not require escalating privileges
+        # it is recommended to ensure that all your Pods/Containers are restrictive.
+        # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+        # Please uncomment the following code if your project does NOT have to work on old Kubernetes
+        # versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
+        # seccompProfile:
+        #   type: RuntimeDefault
+      containers:
+        - command:
+            - /dorisoperator
+          args:
+            - --leader-elect
+          image: 172.16.100.55:8033/cmii/doris.k8s-operator:1.3.1
+          name: dorisoperator
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - "ALL"
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          # TODO(user): Configure the resources accordingly based on the project requirements.
+          # More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+          resources:
+            requests:
+              cpu: 2
+              memory: 4Gi
+            limits:
+              cpu: 2
+              memory: 4Gi
+      serviceAccountName: doris-operator
+      terminationGracePeriodSeconds: 10
+
--- a/65-202504-湖南二级监管/hunan-cluster.yaml
+++ b/65-202504-湖南二级监管/hunan-cluster.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+clusters:
+  - name: clusterIpByhncm
+    cluster:
+      server: https://36.137.146.187:6443
+      insecure-skip-tls-verify: true
+  - name: clusterDNSByhncm
+    cluster:
+      server: https://apiserver.cluster.local:6443
+      certificate-authority-data: >-
+        LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM3RENDQWRTZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQ0FYRFRJME1EY3lOREUyTXpJeE0xb1lEekl4TWpRd056QXhNVFl6TWpFeldqQVZNUk13RVFZRApWUVFERXdwcmRXSmxjbTVsZEdWek1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCjA0a3gyZFRpTHpCQWZPU2FjVkV5dmlIOE1GNTZBYmlzZnY1cXFOUVVlUk84ekFrVWx1NENqRHkzRDhTVVJiVnoKTmFKUXMwc3RNU00zd09mNDFFbGVZREF0amR3ZXpNZDZDdXlaYkhPQnRteE9heGdTdWlid2hqSGcwTTZzRndiTQplNzJVYy8rcGY2R3dqaDdXc0N0bk02ZG1hZ0FmVzhicGJOMWNIRERIblRJbzlIbEhBNURFUE1GYkk3VGkyQ0hZCjl6UE01MlpZazR1M2RuWDRPQWI3K0hXUjdidEFLYzFIdWxreEhqOHZnNXN1bmtGSjhia1BGYmRQY3BmSmhPREYKSjljcVllUXpYWGpXSmZvUFBGZFNlMDAvc2NXYlNSYjlRa1Z3QXl5VTRKcVl3UU9CUDIxNm9Sd3FUTUJjTkk4WQpQRHgwY0paVjliVXpEazNtdVN4eFF3SURBUUFCbzBVd1F6QU9CZ05WSFE4QkFmOEVCQU1DQXFRd0VnWURWUjBUCkFRSC9CQWd3QmdFQi93SUJBREFkQmdOVkhRNEVGZ1FVcFAyalRRQU1JanIrQ1QxTkwxZXkxT2J1UWtZd0RRWUoKS29aSWh2Y05BUUVMQlFBRGdnRUJBSGhRM3NkSzV6WitSV0YxWWgvQklxMHE3NXpMcm1BdEFoNWxxL01sTFgvcApuTjhZYm9QZk4wdG84ekxtbnNCcHFDby9nOXozUENyS3lFbkkwNVBwYkkveHk4MW0xUXdrcEVMUWJPTVFXbk9JCnpRZmJhTktXVFJiR2pYWGtPMWVkMVZmV0YyN2p4amhlSW1kWWZQQjQxYkVjMGh4bnRNazB0NXdxZ3M2ZFVwdUMKQk9vVUhqOUxVUDIwZ0VqUmhEbnZPMGNERmU5SGd4Z1E2QTJnUDcraW8rbUx6M0xlWDR4a2ZRcXM1YWtEQVVocwpvTXBKUUlmZnRjZzRiWjR6dWZRT0hVaDM2QVBWSVI1NTkreUp5V1FhdlRyVUFQTjFPNG1kaTlOVEN2bXp3K3RnCmZaMVNtc3B2SFVDU1ZXM1BxQ3ZQaXNXeWFYd3dMUjRORThDZjIycXRVZXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+users:
+  - name: userByhncm
+    user:
+      client-certificate-data: >-
+        LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJekNDQWd1Z0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJMU1EUXlOVEEyTURnek9Gb1hEVE13TURReU5EQTJNRGd6T0Zvd1N6RVRNQkVHQTFVRQpDaE1LYzNsemRHVnRPbXRqY3pFME1ESUdBMVVFQXhNcllXUmhaVE0xWkdRME56WXhOREpsTlRrelpETTBaRE5rCk1tTmhOR0ZoTkRJdE1qSXhOREl3TWpBMk16Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0MKZ2dFQkFONFRzRFBBTWJnNk4wY2l4Q002YjhmeHpUeFBWaG9LL2REemxVeXlqZEpnQ2hLNFpLVzhqR3paa3p1SQo0d0NxWmx1cVBBeGNoY0xnS1hjVnJZSFF6OWhoT2NRL2hHK3c4Y2Znck16MFlGckpDRlhXU2NTN3lJbTJGNHk2CkFWenlTbVAzMktTdVRzL0xGZlJYam5sclNVSjJyeWFaWlhBUENRMXJaT3BQRnZiQTA5VzY1WTJLMHJFZ25tYUQKVng4SUFGUXVtQS82NUpqQ2NmK0pLS0p4cTlnU2l4RHFZTXF5MGxianU3cVNVeFhUaFR3MGsvYjdmM1d4U0phTgp3RnU0ckE1czhPYTRhTjd3STAxWmllNmMvS2dxbUVkVDIxclFvMTFRUCs3OFdmcGc4bDIvOFd1WVZiY0pWTmZwClEzMlplWmJwZFUrZ2pnVC92YkY2bWpmdEJNRUNBd0VBQWFOSU1FWXdEZ1lEVlIwUEFRSC9CQVFEQWdXZ01CTUcKQTFVZEpRUU1NQW9HQ0NzR0FRVUZCd01DTUI4R0ExVWRJd1FZTUJhQUZLVDlvMDBBRENJNi9nazlUUzlYc3RUbQo3a0pHTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCdFcrOStNeWQ0b0FIdDBYK203ckdlR01paXVhbXhoM3RlCjc2YUtnemRDUDU0cS8yd3hmZHZlRmhyT1Roamw4bkpSZzJMUGRFSjR2ek5WWW9lMDc1L3hjbDRFQ3Y5dUUrM2UKSkFzSjBjSlEzMmlmRGZvRmovNE52djZSN2J1bXpwOGlKK0UxOXBmZ3ZXeDFzcHNqYXgzOVBqTUtseWhqSGp6YwpIOXpLeXV1QXkyMG10c0c1RW5mcnlSb2pqS0NGd0xNK0dnT21rYlRVRGczZk9jSXFQT3pYdVd4OHFzaTB0dk1oCkJyUXhRMVlWVkN4UlBLOW4rYzNHVmdCZE5ZdTRJSVFURmdBNURhUTZ4WXZzamo4eXpIbTdOYTJwMTZ2ODFnVlEKOEJxdHBOQWQwZlBQUDdjZ0xucUNaNGExalFxQld1UlExclhyNFgzK1R4NVp1azNsNEVlRgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+      client-key-data: >-
+        LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBM2hPd004QXh1RG8zUnlMRUl6cHZ4L0hOUEU5V0dncjkwUE9WVExLTjBtQUtFcmhrCnBieU1iTm1UTzRqakFLcG1XNm84REZ5Rnd1QXBkeFd0Z2REUDJHRTV4RCtFYjdEeHgrQ3N6UFJnV3NrSVZkWkoKeEx2SWliWVhqTG9CWFBKS1kvZllwSzVPejhzVjlGZU9lV3RKUW5hdkpwbGxjQThKRFd0azZrOFc5c0RUMWJybApqWXJTc1NDZVpvTlhId2dBVkM2WUQvcmttTUp4LzRrb29uR3IyQktMRU9wZ3lyTFNWdU83dXBKVEZkT0ZQRFNUCjl2dC9kYkZJbG8zQVc3aXNEbXp3NXJobzN2QWpUVm1KN3B6OHFDcVlSMVBiV3RDalhWQS83dnhaK21EeVhiL3gKYTVoVnR3bFUxK2xEZlpsNWx1bDFUNkNPQlArOXNYcWFOKzBFd1FJREFRQUJBb0lCQUdWQkF0REZxNlc4M1dGUQp4NjdzUVBVZ0daeUs2ODRaL3RvYmhaSWZ3eXdOWCtwaktuaXF2RGdSQitGWUszQXRRVmhBQ1ByMTRJTVc0N0VKCk1FQUZMZzhSWFY1T081c1ZTVmdCNTZmWE1HdVVSM21qcDZUTW5jVzBRWTZIYklHdGN4K2JiS3JCVXV2SlEreFIKVTRPbTJCTTJ1K3RVZTN5WlRsNVEvZ1ViSkhSQ1l6a0JtUVZUd29JeGRTb0VaV1RUNHhBa2E4anBMajgxV2pZdQpXdTIyWW9qNEZLYmtpNExsNzhEdzRYVHg5S0RLN1ArcGZINk0xQ1ZBanRuTWI3Qmo0NkJML3dhREFHWCs4YU5ECnNOcExGSDQ2SEQ3ZGR6L3g5TDc0ODdYVG4yMC9kVm9pMkh5SUlaZWt6ZTZUZzlLNk42SEpIejVMQ1kxUmRHOXEKa3pxU2w4RUNnWUVBL2RFSVZlWWtTVXU1YVlaSitTQmQ5bkphWGFKSGc5UTIwQ09nYlNyRG5pdHJkbDFzMG5XcApUL2UvWmhzRmpBV1ZiT3RTeWI4K0hEdVA2NlZ0UkVSUXBMZjUvVDFDUDF5S2Z6a0I2KzlBM3lJRW5URWdEZU9HClJuRzF6a1poUXZ4Z29ESldVS1FTVEtheXFEVkpFTXllOUlRY0d6SitmRElaYjVuSnk2a2V2UmtDZ1lFQTMvekIKMCsraUtxaTc1bVVxdXcwU2NOeHRiZnZabEF4aXhXaW9IZHpRZTd4WHU4NlB2YTRRbXlIYXZ4SSs0TzRxWkZaWQpBa3lRYmM2WWpQbk5tYTgyMmlTOGNyUE5WZHFUMXN2VFh2NWJwNDdZKzNiQ0xGelZOU0ppbzZJNFpwVnJ4cFBDCnhqSzgvbUhlemRqMHM5NEVRZjNIc29ReURJc1duQlQ1aDMvT1Vla0NnWUFrWHNLeUJHTm91VmdkUGVmMXNlU2sKL3VmaUNQSDBld0ZMdS84dUJYVzRnWUpKbU1PU09OZ0ZKSHdodG5lS0EvYlFmN3dDT3N3OG9YQlRGUVplUk9mRgpZck9JelRGa0FPKzdvVUNjUFZGdlorRi9ZTjIxLzhkcTZycGhqNFk2WWcyNmh0d0ZmQzAvSEpmM01JT0N5Nzl2ClRFcjJ2cnFQTTJLZnNrclBTekdqYVFLQmdRRFNWV0lXaVFMNW1EWEtwdG0zaVJEMkZxaFVEWnBGNGxPbUdSODEKMjdPVFhrdnN1bzVVaW01aG55cnhIa3Nab2MwQkordkJUUENiak5QSUhwUXBhMVhSQjRwSEUvMFFVQTlnTjBzbgoreWRLYzJQaXo2U0xVQ21PbWRtUzI3U204RTJpemdLclo5Mzk2eDMwbzNVMnFwZkkrRzFjZjdNWUFFeWRDVDFCCk5vMGljUUtCZ1FDY2dueEtzYVowZzF2VHYyOXRyZHBUcS9UVWVKek1jSlU3WEp0Z0p2OXJMamFqN2lhb01UeTIKY2xSVkRjVzN5OUhualN0Rk9GN0gxVlBLZEFvaUlWdWs5TjlLalk3VkRUWmdPY0QwU3NKd1lMOUl2SEFIT3ArZAozUVpZV3VBQnBlaFlqK2svQm0xWjVyVUg5S05uQ24zRVJ0RHNCTGJYRUEvemlONnFEZnpSSnc9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
+contexts:
+  - name: cxtIPByhncm
+    context:
+      cluster: clusterIpByhncm
+      user: userByhncm
+  - name: cxtDNSByhncm
+    context:
+      cluster: clusterDNSByhncm
+      user: userByhncm
+current-context: cxtIPByhncm
--- a/65-202504-湖南二级监管/yaml/cmii-uav-watchdog-test.yaml
+++ b/65-202504-湖南二级监管/yaml/cmii-uav-watchdog-test.yaml
@@ -0,0 +1,174 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cmii-uav-watchdog
+  namespace: zyly
+  labels:
+    cmii.type: backend
+    cmii.app: cmii-uav-watchdog
+    octopus/control: backend-app-1.0.0
+    app.kubernetes.io/managed-by: octopus
+    app.kubernetes.io/app-version: 6.2.0
+spec:
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      cmii.type: backend
+      cmii.app: cmii-uav-watchdog
+  template:
+    metadata:
+      labels:
+        cmii.type: backend
+        cmii.app: cmii-uav-watchdog
+    spec:
+      affinity: {}
+      imagePullSecrets:
+        - name: harborsecret
+      containers:
+        - name: cmii-uav-watchdog
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/cmii-uav-watchdog:2025-04-10-15-24-03
+          imagePullPolicy: Always
+          env:
+            - name: K8S_NAMESPACE
+              value: zyly
+            - name: APPLICATION_NAME
+              value: cmii-uav-watchdog
+            - name: CUST_JAVA_OPTS
+              value: "-Xms200m -Xmx1500m -Dlog4j2.formatMsgNoLookups=true"
+            - name: NACOS_REGISTRY
+              value: "helm-nacos:8848"
+            - name: NACOS_DISCOVERY_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: NACOS_DISCOVERY_PORT
+              value: "8080"
+            - name: BIZ_CONFIG_GROUP
+              value: 6.2.0
+            - name: SYS_CONFIG_GROUP
+              value: 6.2.0
+            - name: IMAGE_VERSION
+              value: 6.2.0
+            - name: NACOS_USERNAME
+              value: "developer"
+            - name: NACOS_PASSWORD
+              value: "Deve@9128201"
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: NODE_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.hostIP
+            - name: LIMIT_CPU
+              valueFrom:
+                resourceFieldRef:
+                  containerName: cmii-uav-watchdog
+                  resource: limits.cpu
+            - name: LIMIT_MEMORY
+              valueFrom:
+                resourceFieldRef:
+                  containerName: cmii-uav-watchdog
+                  resource: limits.memory
+            - name: REQUEST_CPU
+              valueFrom:
+                resourceFieldRef:
+                  containerName: cmii-uav-watchdog
+                  resource: requests.cpu
+            - name: REQUEST_MEMORY
+              valueFrom:
+                resourceFieldRef:
+                  containerName: cmii-uav-watchdog
+                  resource: requests.memory
+          ports:
+            - name: pod-port
+              containerPort: 8080
+              protocol: TCP
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 200Mi
+              cpu: 200m
+          volumeMounts:
+            - name: nfs-backend-log-volume
+              mountPath: /cmii/cmii-uav-watchdog/
+              readOnly: false
+              subPath: zyly/cmii-uav-watchdog
+            - name: mysql-data
+              mountPath: /bitnami/mysql
+            - name: cmii-uav-watchdog-conf
+              mountPath: /cmii/cmii-uav-watchdog/config.yaml
+              subPath: config.yaml
+      volumes:
+        - name: mysql-data
+          persistentVolumeClaim:
+            claimName: helm-mysql
+        - name: nfs-backend-log-volume
+          persistentVolumeClaim:
+            claimName: nfs-backend-log-pvc
+        - name: cmii-uav-watchdog-conf
+          configMap:
+            name: cmii-uav-watchdog-configmap
+            items:
+              - key: config.yaml
+                path: config.yaml
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cmii-uav-watchdog
+  namespace: zyly
+  labels:
+    cmii.type: backend
+    cmii.app: cmii-uav-watchdog
+    octopus/control: backend-app-1.0.0
+    app.kubernetes.io/managed-by: octopus
+    app.kubernetes.io/app-version: 6.2.0
+spec:
+  type: NodePort
+  selector:
+    cmii.type: backend
+    cmii.app: cmii-uav-watchdog
+  ports:
+    - name: backend-tcp
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: cmii-uav-watchdog-configmap
+  namespace: zyly
+data:
+  config.yaml: |-
+    server:
+      port: "8080"  # 服务器端口
+    
+    tier_one_auth:
+      tier_one_secret: "NK537TIWSUOFIS7SYCUJ6A7FPOGFVM3UH67TJRX3IYQAHKZXK2X7SBAA6JOXZVSV3U6K5YZUX7Q6TWOPK6YCRU6MIML33ZJFBN55I2Q"  # TOTP密钥
+      time_offset_allowed: 30  # 允许的时间偏移（秒）
+    
+    watchdog_center:
+      url: "https://watchdog-center.example.com"  # 一级授权中心地址
+    
+    project:
+      project_namespace: "zyly"  # 项目命名空间
+    
+    tier_two_auth:
+      tier_two_secret: "your_tier_two_secret_here"  # 二级授权密钥
--- a/65-202504-湖南二级监管/yaml/cmii-uavms-pyfusion.yaml
+++ b/65-202504-湖南二级监管/yaml/cmii-uavms-pyfusion.yaml
@@ -0,0 +1,138 @@
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: pyfusion-configmap
+  namespace: zyly
+data:
+  config.yaml: |-
+    mqtt:
+      broker: "helm-emqxs"
+      port: 1883
+      username: "cmlc"
+      password: "odD8#Ve7.B"
+
+    topics:
+      mqtt_topic: "bridge/DP74b4ef9fb4aaf269/device_data/FU_PAM/+"
+      sensor_topic: "fromcheck/DP74b4ef9fb4aaf269/device_data/FU_PAM/+"
+---
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: cmii-uavms-pyfusion
+  namespace: zyly
+  labels:
+    app.kubernetes.io/app-version: 6.2.0
+    app.kubernetes.io/managed-by: octopus-control
+    cmii.app: cmii-uavms-pyfusion
+    cmii.type: backend
+    octopus/control: backend-app-1.0.0
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      cmii.app: cmii-uavms-pyfusion
+      cmii.type: backend
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        cmii.app: cmii-uavms-pyfusion
+        cmii.type: backend
+    spec:
+      volumes:
+        - name: nfs-backend-log-volume
+          persistentVolumeClaim:
+            claimName: nfs-backend-log-pvc
+        - name: pyfusion-conf
+          configMap:
+            name: pyfusion-configmap
+            items:
+              - key: config.yaml
+                path: config.yaml
+      containers:
+        - name: cmii-uavms-pyfusion
+          image: 'hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/cmii-uavms-pyfusion:6.3.3'
+          ports:
+            - name: pod-port
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: VERSION
+              value: 6.2.0
+            - name: NACOS_SYSTEM_CONFIG_NAME
+              value: cmii-backend-system
+            - name: NACOS_SERVICE_CONFIG_NAME
+              value: cmii-uavms-pyfusion
+            - name: NACOS_SERVER_ADDRESS
+              value: 'helm-nacos:8848'
+            - name: K8S_NAMESPACE
+              value: zyly
+            - name: APPLICATION_NAME
+              value: cmii-uavms-pyfusion
+            - name: NACOS_DISCOVERY_PORT
+              value: '8080'
+            - name: BIZ_CONFIG_GROUP
+              value: 6.2.0
+            - name: SYS_CONFIG_GROUP
+              value: 6.2.0
+            - name: IMAGE_VERSION
+              value: 6.2.0
+          resources:
+            limits:
+              cpu: '2'
+              memory: 3Gi
+            requests:
+              cpu: 200m
+              memory: 500Mi
+          volumeMounts:
+            - name: nfs-backend-log-volume
+              mountPath: /cmii/logs
+              subPath: zyly/cmii-uavms-pyfusion
+            - name: pyfusion-conf
+              mountPath: /app/config.yaml
+              subPath: config.yaml
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: Always
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      dnsPolicy: ClusterFirst
+      securityContext: { }
+      imagePullSecrets:
+        - name: harborsecret
+      affinity: { }
+      schedulerName: default-scheduler
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 25%
+  revisionHistoryLimit: 10
+  progressDeadlineSeconds: 600
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: cmii-uavms-pyfusion
+  namespace: zyly
+  labels:
+    app.kubernetes.io/app-version: 6.2.0
+    app.kubernetes.io/managed-by: octopus-control
+    cmii.app: cmii-uavms-pyfusion
+    cmii.type: backend
+    octopus/control: backend-app-1.0.0
+spec:
+  ports:
+    - name: backend-tcp
+      protocol: TCP
+      port: 8080
+      targetPort: 8080
+  selector:
+    cmii.app: cmii-uavms-pyfusion
+    cmii.type: backend
+  type: ClusterIP
+  sessionAffinity: None
+
+
+
--- a/65-202504-湖南二级监管/yaml/harbor-secret.yaml
+++ b/65-202504-湖南二级监管/yaml/harbor-secret.yaml
@@ -0,0 +1,9 @@
+kind: Secret
+apiVersion: v1
+metadata:
+  name: harborsecret
+  namespace: zyly
+data:
+  .dockerconfigjson: >-
+   ewogICAgICAgICJhdXRocyI6IHsKICAgICAgICAgICAgICAgICJobmNtLWZjNzY2Zjg0LmVjaXMuY2hhbmdzaGEtMi5jbWVjbG91ZC5jbiI6IHsKICAgICAgICAgICAgICAgICAgICAgICAgImF1dGgiOiAiZW5sc2VUcFdNbko1VTNSeVFHNW5VSE56IgogICAgICAgICAgICAgICAgfQogICAgICAgIH0KfQ==
+type: kubernetes.io/dockerconfigjson
--- a/65-202504-湖南二级监管/yaml/helm-minio.yaml
+++ b/65-202504-湖南二级监管/yaml/helm-minio.yaml
@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  namespace: zyly
+  name: helm-minio
+spec:
+  serviceName: helm-minio-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: helm-minio
+  template:
+    metadata:
+      labels:
+        app: helm-minio
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      containers:
+        - name: minio
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/minio:RELEASE.2023-06-02T23-17-26Z
+          command: ["/bin/sh", "-c"]
+          args:
+            - minio server /data --console-address ":9001"
+          ports:
+            - containerPort: 9000
+              name: api
+            - containerPort: 9001
+              name: console
+          env:
+            - name: MINIO_ACCESS_KEY
+              value: "cmii"
+            - name: MINIO_SECRET_KEY
+              value: "B#923fC7mk"
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 200Mi
+              cpu: 200m
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: helm-minio
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-minio-service
+  namespace: zyly
+spec:
+  selector:
+    app: helm-minio
+  ports:
+    - name: api
+      port: 9000
+      targetPort: 9000
+    - name: console
+      port: 9001
+      targetPort: 9001
+  clusterIP: None
--- a/65-202504-湖南二级监管/yaml/k8s-backend.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-backend.yaml
--- a/65-202504-湖南二级监管/yaml/k8s-configmap.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-configmap.yaml
@@ -0,0 +1,644 @@
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-renyike
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "renyike",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-pangu
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-emergency
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "emergency",
+      AppClientId: "APP_aGsTAY1uMZrpKdfk"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-traffic
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "traffic",
+      AppClientId: "APP_Jc8i2wOQ1t73QEJS"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-visualization
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "visualization",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-classification
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "classification",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-dikongzhixingh5
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "dikongzhixingh5",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-ai-brain
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "ai-brain",
+      AppClientId: "APP_rafnuCAmBESIVYMH"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-logistics
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "logistics",
+      AppClientId: "APP_PvdfRRRBPL8xbIwl"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-jiangsuwenlv
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "jiangsuwenlv",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-hljtt
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "hljtt",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-mianyangbackend
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "mianyangbackend",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-uavmsmanager
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "uavmsmanager",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-cmsportal
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "cmsportal",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-uasms
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "uasms",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-uas
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "uas",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-smauth
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "smauth",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-eventsh5
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "eventsh5",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-awareness
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "awareness",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-detection
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "detection",
+      AppClientId: "APP_FDHW2VLVDWPnnOCy"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-oms
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "oms",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-security
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "security",
+      AppClientId: "APP_JUSEMc7afyWXxvE7"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-qingdao
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "qingdao",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-hyper
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "hyper",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-secenter
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "secenter",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-supervisionh5
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "supervisionh5",
+      AppClientId: "APP_qqSu82THfexI8PLM"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-multiterminal
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "multiterminal",
+      AppClientId: "APP_PvdfRRRBPL8xbIwl"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-securityh5
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "securityh5",
+      AppClientId: "APP_N3ImO0Ubfu9peRHD"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-seniclive
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "seniclive",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-share
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "share",
+      AppClientId: "APP_4lVSVI0ZGxTssir8"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-dispatchh5
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "dispatchh5",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-base
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "base",
+      AppClientId: "APP_9LY41OaKSqk2btY0"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-mws
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "mws",
+      AppClientId: "APP_uKniXPELlRERBBwK"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-splice
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "splice",
+      AppClientId: "APP_zE0M3sTRXrCIJS8Y"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-threedsimulation
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "threedsimulation",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-flight-control
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "flight-control",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-supervision
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "supervision",
+      AppClientId: "APP_qqSu82THfexI8PLM"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-media
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "media",
+      AppClientId: "APP_4AU8lbifESQO4FD6"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-open
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "open",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-pilot2cloud
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "pilot2cloud",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-blockchain
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "blockchain",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-iot
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "iot",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-armypeople
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "armypeople",
+      AppClientId: "APP_UIegse6Lfou9pO1U"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-qinghaitourism
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "qinghaitourism",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-scanner
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "scanner",
+      AppClientId: "empty"
+    }
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: tenant-prefix-smsecret
+  namespace: zyly
+data:
+  ingress-config.js: |-
+    var __GlobalIngressConfig = {
+      TenantEnvironment: "",
+      CloudHOST: "zyly.hncmict.com",
+      ApplicationShortName: "smsecret",
+      AppClientId: "empty"
+    }
--- a/65-202504-湖南二级监管/yaml/k8s-dashboard.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-dashboard.yaml
@@ -0,0 +1,309 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+    kubernetes.io/cluster-service: "true"
+  name: kubernetes-dashboard
+  namespace: kube-system
+spec:
+  ports:
+    - port: 443
+      targetPort: 8443
+      nodePort: 39999
+  selector:
+    k8s-app: kubernetes-dashboard
+  type: NodePort
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-certs
+  namespace: kube-system
+type: Opaque
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-csrf
+  namespace: kube-system
+type: Opaque
+data:
+  csrf: ""
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-key-holder
+  namespace: kube-system
+type: Opaque
+
+---
+
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-settings
+  namespace: kube-system
+
+---
+
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
+rules:
+  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
+    verbs: ["get", "update", "delete"]
+    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["kubernetes-dashboard-settings"]
+    verbs: ["get", "update"]
+    # Allow Dashboard to get metrics.
+  - apiGroups: [""]
+    resources: ["services"]
+    resourceNames: ["heapster", "dashboard-metrics-scraper"]
+    verbs: ["proxy"]
+  - apiGroups: [""]
+    resources: ["services/proxy"]
+    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
+    verbs: ["get"]
+
+---
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+rules:
+  # Allow Metrics Scraper to get metrics from the Metrics server
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods", "nodes"]
+    verbs: ["get", "list", "watch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubernetes-dashboard
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-dashboard
+    namespace: kube-system
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubernetes-dashboard
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-dashboard
+    namespace: kube-system
+
+---
+
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: kubernetes-dashboard
+  template:
+    metadata:
+      labels:
+        k8s-app: kubernetes-dashboard
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      containers:
+        - name: kubernetes-dashboard
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmiidashboard:v2.0.1
+          ports:
+            - containerPort: 8443
+              protocol: TCP
+          args:
+            - --auto-generate-certificates
+            - --namespace=kube-system
+            # Uncomment the following line to manually specify Kubernetes API server Host
+            # If not specified, Dashboard will attempt to auto discover the API server and connect
+            # to it. Uncomment only if the default does not work.
+            # - --apiserver-host=http://my-address:port
+          volumeMounts:
+            - name: kubernetes-dashboard-certs
+              mountPath: /certs
+              # Create on-disk volume to store exec logs
+            - mountPath: /tmp
+              name: tmp-volume
+          livenessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /
+              port: 8443
+            initialDelaySeconds: 30
+            timeoutSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
+      volumes:
+        - name: kubernetes-dashboard-certs
+          secret:
+            secretName: kubernetes-dashboard-certs
+        - name: tmp-volume
+          emptyDir: {}
+      serviceAccountName: kubernetes-dashboard
+      # Comment the following tolerations if Dashboard must not be deployed on master
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: dashboard-metrics-scraper
+  name: dashboard-metrics-scraper
+  namespace: kube-system
+spec:
+  ports:
+    - port: 8000
+      targetPort: 8000
+  selector:
+    k8s-app: dashboard-metrics-scraper
+
+---
+
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  labels:
+    k8s-app: dashboard-metrics-scraper
+  name: dashboard-metrics-scraper
+  namespace: kube-system
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: dashboard-metrics-scraper
+  template:
+    metadata:
+      labels:
+        k8s-app: dashboard-metrics-scraper
+      annotations:
+        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
+    spec:
+      containers:
+        - name: dashboard-metrics-scraper
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmiimetrics-scraper:v1.0.4
+          ports:
+            - containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              scheme: HTTP
+              path: /
+              port: 8000
+            initialDelaySeconds: 30
+            timeoutSeconds: 30
+          volumeMounts:
+            - mountPath: /tmp
+              name: tmp-volume
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
+      serviceAccountName: kubernetes-dashboard
+      # Comment the following tolerations if Dashboard must not be deployed on master
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+      volumes:
+        - name: tmp-volume
+          emptyDir: {}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: kube-system
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: admin-user
+    namespace: kube-system
--- a/65-202504-湖南二级监管/yaml/k8s-emqx.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-emqx.yaml
@@ -0,0 +1,286 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: helm-emqxs
+  namespace: zyly
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-emqxs-env
+  namespace: zyly
+  labels:
+    cmii.type: middleware
+    cmii.app: helm-emqxs
+    cmii.emqx.architecture: cluster
+    helm.sh/chart: emqx-1.1.0
+    app.kubernetes.io/managed-by: octopus-control
+    app.kubernetes.io/version: uas-2.0
+data:
+  EMQX_CLUSTER__K8S__APISERVER: "https://kubernetes.default.svc.cluster.local:443"
+  EMQX_NAME: "helm-emqxs"
+  EMQX_CLUSTER__DISCOVERY: "k8s"
+  EMQX_CLUSTER__K8S__APP_NAME: "helm-emqxs"
+  EMQX_CLUSTER__K8S__SERVICE_NAME: "helm-emqxs-headless"
+  EMQX_CLUSTER__K8S__ADDRESS_TYPE: "dns"
+  EMQX_CLUSTER__K8S__namespace: "zyly"
+  EMQX_CLUSTER__K8S__SUFFIX: "svc.cluster.local"
+  EMQX_ALLOW_ANONYMOUS: "false"
+  EMQX_ACL_NOMATCH: "deny"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-emqxs-cm
+  namespace: zyly
+  labels:
+    cmii.type: middleware
+    cmii.app: helm-emqxs
+    cmii.emqx.architecture: cluster
+    helm.sh/chart: emqx-1.1.0
+    app.kubernetes.io/managed-by: octopus-control
+    app.kubernetes.io/version: uas-2.0
+data:
+  emqx_auth_mnesia.conf: |-
+    auth.mnesia.password_hash = sha256
+
+    # clientid 认证数据
+    auth.client.1.clientid = admin
+    auth.client.1.password = odD8#Ve7.B
+    auth.client.2.clientid = cmlc
+    auth.client.2.password = odD8#Ve7.B
+
+    ## username 认证数据
+    auth.user.1.username = admin
+    auth.user.1.password = odD8#Ve7.B
+    auth.user.2.username = cmlc
+    auth.user.2.password = odD8#Ve7.B
+
+  acl.conf: |-
+    {allow, {user, "admin"}, pubsub, ["admin/#"]}.
+    {allow, {user, "dashboard"}, subscribe, ["$SYS/#"]}.
+    {allow, {ipaddr, "127.0.0.1"}, pubsub, ["$SYS/#", "#"]}.
+    {deny, all, subscribe, ["$SYS/#", {eq, "#"}]}.
+    {allow, all}.
+
+  loaded_plugins: |-
+    {emqx_auth_mnesia,true}.
+    {emqx_auth_mnesia,true}.
+    {emqx_management, true}.
+    {emqx_recon, true}.
+    {emqx_retainer, false}.
+    {emqx_dashboard, true}.
+    {emqx_telemetry, true}.
+    {emqx_rule_engine, true}.
+    {emqx_bridge_mqtt, false}.
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: helm-emqxs
+  namespace: zyly
+  labels:
+    cmii.type: middleware
+    cmii.app: helm-emqxs
+    cmii.emqx.architecture: cluster
+    helm.sh/chart: emqx-1.1.0
+    app.kubernetes.io/managed-by: octopus-control
+    app.kubernetes.io/version: uas-2.0
+spec:
+  replicas: 1
+  serviceName: helm-emqxs-headless
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      cmii.type: middleware
+      cmii.app: helm-emqxs
+      cmii.emqx.architecture: cluster
+  template:
+    metadata:
+      labels:
+        cmii.type: middleware
+        cmii.app: helm-emqxs
+        cmii.emqx.architecture: cluster
+        helm.sh/chart: emqx-1.1.0
+        app.kubernetes.io/managed-by: octopus-control
+        app.kubernetes.io/version: uas-2.0
+    spec:
+      affinity: {}
+      imagePullSecrets:
+        - name: harborsecret
+      serviceAccountName: helm-emqxs
+      containers:
+        - name: helm-emqxs
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/emqx:5.5.1
+          imagePullPolicy: Always
+          ports:
+            - name: mqtt
+              containerPort: 1883
+            - name: mqttssl
+              containerPort: 8883
+            - name: mgmt
+              containerPort: 8081
+            - name: ws
+              containerPort: 8083
+            - name: wss
+              containerPort: 8084
+            - name: dashboard
+              containerPort: 18083
+            - name: ekka
+              containerPort: 4370
+          envFrom:
+            - configMapRef:
+                name: helm-emqxs-env
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 200Mi
+              cpu: 200m
+          volumeMounts:
+            - name: emqx-data
+              mountPath: "/opt/emqx/data/mnesia"
+              readOnly: false
+            - name: helm-emqxs-cm
+              mountPath: "/opt/emqx/etc/plugins/emqx_auth_mnesia.conf"
+              subPath: emqx_auth_mnesia.conf
+              readOnly: false
+#            - name: helm-emqxs-cm
+#              mountPath: "/opt/emqx/etc/acl.conf"
+#              subPath: "acl.conf"
+#              readOnly: false
+            - name: helm-emqxs-cm
+              mountPath: "/opt/emqx/data/loaded_plugins"
+              subPath: loaded_plugins
+              readOnly: false
+      volumes:
+        - name: emqx-data
+          persistentVolumeClaim:
+            claimName: helm-emqxs
+        - name: helm-emqxs-cm
+          configMap:
+            name: helm-emqxs-cm
+            items:
+              - key: emqx_auth_mnesia.conf
+                path: emqx_auth_mnesia.conf
+              - key: acl.conf
+                path: acl.conf
+              - key: loaded_plugins
+                path: loaded_plugins
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: helm-emqxs
+  namespace: zyly
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - endpoints
+    verbs:
+      - get
+      - watch
+      - list
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: helm-emqxs
+  namespace: zyly
+subjects:
+  - kind: ServiceAccount
+    name: helm-emqxs
+    namespace: zyly
+roleRef:
+  kind: Role
+  name: helm-emqxs
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-emqxs
+  namespace: zyly
+  labels:
+    cmii.type: middleware
+    cmii.app: helm-emqxs
+    cmii.emqx.architecture: cluster
+    helm.sh/chart: emqx-1.1.0
+    app.kubernetes.io/managed-by: octopus-control
+    app.kubernetes.io/version: uas-2.0
+spec:
+  type: NodePort
+  selector:
+    cmii.type: middleware
+    cmii.app: helm-emqxs
+    cmii.emqx.architecture: cluster
+  ports:
+    - port: 1883
+      name: mqtt
+      targetPort: 1883
+      nodePort: 31883
+    - port: 18083
+      name: dashboard
+      targetPort: 18083
+      nodePort: 31085
+    - port: 8083
+      name: mqtt-websocket
+      targetPort: 8083
+      nodePort: 31083
+    - port: 8883
+      name: mqtt-ssl
+      targetPort: 8883
+      nodePort: 31183
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-emqxs-headless
+  namespace: zyly
+  labels:
+    cmii.type: middleware
+    cmii.app: helm-emqxs
+    cmii.emqx.architecture: cluster
+    helm.sh/chart: emqx-1.1.0
+    app.kubernetes.io/managed-by: octopus-control
+    app.kubernetes.io/version: uas-2.0
+spec:
+  type: ClusterIP
+  clusterIP: None
+  selector:
+    cmii.type: middleware
+    cmii.app: helm-emqxs
+    cmii.emqx.architecture: cluster
+  ports:
+    - name: mqtt
+      port: 1883
+      protocol: TCP
+      targetPort: 1883
+    - name: mqttssl
+      port: 8883
+      protocol: TCP
+      targetPort: 8883
+    - name: mgmt
+      port: 8081
+      protocol: TCP
+      targetPort: 8081
+    - name: websocket
+      port: 8083
+      protocol: TCP
+      targetPort: 8083
+    - name: wss
+      port: 8084
+      protocol: TCP
+      targetPort: 8084
+    - name: dashboard
+      port: 18083
+      protocol: TCP
+      targetPort: 18083
+    - name: ekka
+      port: 4370
+      protocol: TCP
+      targetPort: 4370
--- a/65-202504-湖南二级监管/yaml/k8s-frontend.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-frontend.yaml
@@ -0,0 +1,203 @@
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: nginx-cm
+  namespace: zyly
+  labels:
+    cmii.type: frontend
+data:
+  nginx.conf: |
+    server {
+        listen       9528;
+        server_name  localhost;
+        gzip on;
+
+        location / {
+            root   /home/cmii-platform/dist;
+            index  index.html index.htm;
+        }
+
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   html;
+        }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cmii-uav-platform-uasms
+  namespace: zyly
+  labels:
+    cmii.type: frontend
+    cmii.app: cmii-uav-platform-uasms
+    octopus.control: frontend-app-wdd
+    app.kubernetes.io/app-version: uas-2.0
+spec:
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      cmii.type: frontend
+      cmii.app: cmii-uav-platform-uasms
+  template:
+    metadata:
+      labels:
+        cmii.type: frontend
+        cmii.app: cmii-uav-platform-uasms
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      containers:
+        - name: cmii-uav-platform-uasms
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/cmii-uav-platform-uasms:master-2.0-pro-250428
+          imagePullPolicy: Always
+          env:
+            - name: K8S_NAMESPACE
+              value: zyly
+            - name: APPLICATION_NAME
+              value: cmii-uav-platform-uasms
+          ports:
+            - name: platform-9528
+              containerPort: 9528
+              protocol: TCP
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 50Mi
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d/nginx.conf
+              subPath: nginx.conf
+            - name: tenant-prefix
+              subPath: ingress-config.js
+              mountPath: /home/cmii-platform/dist/ingress-config.js
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: nginx-cm
+            items:
+              - key: nginx.conf
+                path: nginx.conf
+        - name: tenant-prefix
+          configMap:
+            name: tenant-prefix-uasms
+            items:
+              - key: ingress-config.js
+                path: ingress-config.js
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cmii-uav-platform-uasms
+  namespace: zyly
+  labels:
+    cmii.type: frontend
+    cmii.app: cmii-uav-platform-uasms
+    octopus.control: frontend-app-wdd
+    app.kubernetes.io/version: uas-2.0
+spec:
+  type: ClusterIP
+  selector:
+    cmii.type: frontend
+    cmii.app: cmii-uav-platform-uasms
+  ports:
+    - name: web-svc-port
+      port: 9528
+      protocol: TCP
+      targetPort: 9528
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cmii-uav-platform-uas
+  namespace: zyly
+  labels:
+    cmii.type: frontend
+    cmii.app: cmii-uav-platform-uas
+    octopus.control: frontend-app-wdd
+    app.kubernetes.io/app-version: uas-2.0
+spec:
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      cmii.type: frontend
+      cmii.app: cmii-uav-platform-uas
+  template:
+    metadata:
+      labels:
+        cmii.type: frontend
+        cmii.app: cmii-uav-platform-uas
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      containers:
+        - name: cmii-uav-platform-uas
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/cmii-uav-platform-uas:master-2.0-pro-250428-uas
+          imagePullPolicy: Always
+          env:
+            - name: K8S_NAMESPACE
+              value: zyly
+            - name: APPLICATION_NAME
+              value: cmii-uav-platform-uas
+          ports:
+            - name: platform-9528
+              containerPort: 9528
+              protocol: TCP
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 50Mi
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d/nginx.conf
+              subPath: nginx.conf
+            - name: tenant-prefix
+              subPath: ingress-config.js
+              mountPath: /home/cmii-platform/dist/ingress-config.js
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: nginx-cm
+            items:
+              - key: nginx.conf
+                path: nginx.conf
+        - name: tenant-prefix
+          configMap:
+            name: tenant-prefix-uas
+            items:
+              - key: ingress-config.js
+                path: ingress-config.js
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cmii-uav-platform-uas
+  namespace: zyly
+  labels:
+    cmii.type: frontend
+    cmii.app: cmii-uav-platform-uas
+    octopus.control: frontend-app-wdd
+    app.kubernetes.io/version: uas-2.0
+spec:
+  type: ClusterIP
+  selector:
+    cmii.type: frontend
+    cmii.app: cmii-uav-platform-uas
+  ports:
+    - name: web-svc-port
+      port: 9528
+      protocol: TCP
+      targetPort: 9528
--- a/65-202504-湖南二级监管/yaml/k8s-ingress.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-ingress.yaml
@@ -0,0 +1,350 @@
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: frontend-applications-ingress
+  namespace: zyly
+  labels:
+    type: frontend
+    octopus.control: all-ingress-config-wdd
+    app.kubernetes.io/managed-by: octopus-control
+    app.kubernetes.io/version: uas-2.0
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /$1
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      rewrite ^(/supervision)$ $1/ redirect;
+      rewrite ^(/supervisionh5)$ $1/ redirect;
+      rewrite ^(/pangu)$ $1/ redirect;
+      rewrite ^(/ai-brain)$ $1/ redirect;
+      rewrite ^(/armypeople)$ $1/ redirect;
+      rewrite ^(/awareness)$ $1/ redirect;
+      rewrite ^(/base)$ $1/ redirect;
+      rewrite ^(/blockchain)$ $1/ redirect;
+      rewrite ^(/classification)$ $1/ redirect;
+      rewrite ^(/cmsportal)$ $1/ redirect;
+      rewrite ^(/detection)$ $1/ redirect;
+      rewrite ^(/dikongzhixingh5)$ $1/ redirect;
+      rewrite ^(/dispatchh5)$ $1/ redirect;
+      rewrite ^(/emergency)$ $1/ redirect;
+      rewrite ^(/eventsh5)$ $1/ redirect;
+      rewrite ^(/flight-control)$ $1/ redirect;
+      rewrite ^(/hljtt)$ $1/ redirect;
+      rewrite ^(/hyper)$ $1/ redirect;
+      rewrite ^(/iot)$ $1/ redirect;
+      rewrite ^(/jiangsuwenlv)$ $1/ redirect;
+      rewrite ^(/logistics)$ $1/ redirect;
+      rewrite ^(/media)$ $1/ redirect;
+      rewrite ^(/mianyangbackend)$ $1/ redirect;
+      rewrite ^(/multiterminal)$ $1/ redirect;
+      rewrite ^(/mws)$ $1/ redirect;
+      rewrite ^(/oms)$ $1/ redirect;
+      rewrite ^(/open)$ $1/ redirect;
+      rewrite ^(/pilot2cloud)$ $1/ redirect;
+      rewrite ^(/qingdao)$ $1/ redirect;
+      rewrite ^(/qinghaitourism)$ $1/ redirect;
+      rewrite ^(/renyike)$ $1/ redirect;
+      rewrite ^(/scanner)$ $1/ redirect;
+      rewrite ^(/security)$ $1/ redirect;
+      rewrite ^(/securityh5)$ $1/ redirect;
+      rewrite ^(/seniclive)$ $1/ redirect;
+      rewrite ^(/share)$ $1/ redirect;
+      rewrite ^(/smauth)$ $1/ redirect;
+      rewrite ^(/smsecret)$ $1/ redirect;
+      rewrite ^(/splice)$ $1/ redirect;
+      rewrite ^(/threedsimulation)$ $1/ redirect;
+      rewrite ^(/traffic)$ $1/ redirect;
+      rewrite ^(/uas)$ $1/ redirect;
+      rewrite ^(/uasms)$ $1/ redirect;
+      rewrite ^(/visualization)$ $1/ redirect;
+      rewrite ^(/uavmsmanager)$ $1/ redirect;
+      rewrite ^(/secenter)$ $1/ redirect;
+spec:
+  rules:
+    - host: zyly.hncmict.com
+      http:
+        paths:
+          - path: /?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform
+              servicePort: 9528
+          - path: /supervision/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-suav-platform-supervision
+              servicePort: 9528
+          - path: /supervisionh5/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-suav-platform-supervisionh5
+              servicePort: 9528
+          - path: /pangu/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform
+              servicePort: 9528
+          - path: /ai-brain/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-ai-brain
+              servicePort: 9528
+          - path: /armypeople/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-armypeople
+              servicePort: 9528
+          - path: /awareness/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-awareness
+              servicePort: 9528
+          - path: /base/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-base
+              servicePort: 9528
+          - path: /blockchain/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-blockchain
+              servicePort: 9528
+          - path: /classification/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-classification
+              servicePort: 9528
+          - path: /cmsportal/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-cms-portal
+              servicePort: 9528
+          - path: /detection/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-detection
+              servicePort: 9528
+          - path: /dikongzhixingh5/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-dikongzhixingh5
+              servicePort: 9528
+          - path: /dispatchh5/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-dispatchh5
+              servicePort: 9528
+          - path: /emergency/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-emergency-rescue
+              servicePort: 9528
+          - path: /eventsh5/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-eventsh5
+              servicePort: 9528
+          - path: /flight-control/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-flight-control
+              servicePort: 9528
+          - path: /hljtt/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-hljtt
+              servicePort: 9528
+          - path: /hyper/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-hyperspectral
+              servicePort: 9528
+          - path: /iot/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-iot-manager
+              servicePort: 9528
+          - path: /jiangsuwenlv/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-jiangsuwenlv
+              servicePort: 9528
+          - path: /logistics/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-logistics
+              servicePort: 9528
+          - path: /media/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-media
+              servicePort: 9528
+          - path: /mianyangbackend/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-mianyangbackend
+              servicePort: 9528
+          - path: /multiterminal/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-multiterminal
+              servicePort: 9528
+          - path: /mws/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-mws
+              servicePort: 9528
+          - path: /oms/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-oms
+              servicePort: 9528
+          - path: /open/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-open
+              servicePort: 9528
+          - path: /pilot2cloud/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-pilot2-to-cloud
+              servicePort: 9528
+          - path: /qingdao/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-qingdao
+              servicePort: 9528
+          - path: /qinghaitourism/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-qinghaitourism
+              servicePort: 9528
+          - path: /renyike/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-renyike
+              servicePort: 9528
+          - path: /scanner/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-scanner
+              servicePort: 9528
+          - path: /security/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-security
+              servicePort: 9528
+          - path: /securityh5/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-securityh5
+              servicePort: 9528
+          - path: /seniclive/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-seniclive
+              servicePort: 9528
+          - path: /share/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-share
+              servicePort: 9528
+          - path: /smauth/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-smauth
+              servicePort: 9528
+          - path: /smsecret/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-smsecret
+              servicePort: 9528
+          - path: /splice/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-splice
+              servicePort: 9528
+          - path: /threedsimulation/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-threedsimulation
+              servicePort: 9528
+          - path: /traffic/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-traffic
+              servicePort: 9528
+          - path: /uas/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-uas
+              servicePort: 9528
+          - path: /uasms/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-uasms
+              servicePort: 9528
+          - path: /visualization/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-platform-visualization
+              servicePort: 9528
+          - path: /uavmsmanager/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uavms-platform-manager
+              servicePort: 9528
+          - path: /secenter/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uavms-platform-security-center
+              servicePort: 9528
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: all-gateways-ingress
+  namespace: zyly
+  labels:
+    type: api-gateway
+    octopus.control: all-ingress-config-1.1.0
+    app.kubernetes.io/managed-by: octopus-control
+    app.kubernetes.io/version: uas-2.0
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /$1
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_set_header upgradePrefix $http_upgrade;
+      proxy_set_header Connection "upgradePrefix";
+spec:
+  rules:
+    - host: zyly.hncmict.com
+      http:
+        paths:
+          - path: /oms/api/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-admin-gateway
+              servicePort: 8080
+          - path: /open/api/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-open-gateway
+              servicePort: 8080
+          - path: /api/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uav-gateway
+              servicePort: 8080
+          - path: /uas/api/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-uas-gateway
+              servicePort: 8080
+          - path: /converge/?(.*)
+            pathType: ImplementationSpecific
+            backend:
+              serviceName: cmii-sky-converge
+              servicePort: 8080
--- a/65-202504-湖南二级监管/yaml/k8s-mongo.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-mongo.yaml
@@ -0,0 +1,84 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-mongo
+  namespace: zyly
+  labels:
+    cmii.app: helm-mongo
+    cmii.type: middleware
+    helm.sh/chart: mongo-1.1.0
+    app.kubernetes.io/managed-by: octopus-control
+    app.kubernetes.io/version: uas-2.0
+spec:
+  type: ClusterIP
+  selector:
+    cmii.app: helm-mongo
+    cmii.type: middleware
+  ports:
+    - port: 27017
+      name: server-27017
+      targetPort: 27017
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: helm-mongo
+  namespace: zyly
+  labels:
+    cmii.app: helm-mongo
+    cmii.type: middleware
+    helm.sh/chart: mongo-1.1.0
+    app.kubernetes.io/managed-by: octopus-control
+    app.kubernetes.io/version: uas-2.0
+spec:
+  serviceName: helm-mongo
+  replicas: 1
+  selector:
+    matchLabels:
+      cmii.app: helm-mongo
+      cmii.type: middleware
+  template:
+    metadata:
+      labels:
+        cmii.app: helm-mongo
+        cmii.type: middleware
+        helm.sh/chart: mongo-1.1.0
+        app.kubernetes.io/managed-by: octopus-control
+        app.kubernetes.io/version: uas-2.0
+      annotations:
+        pod.alpha.kubernetes.io/initialized: "true"
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      affinity: {}
+      containers:
+        - name: helm-mongo
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/mongo:5.0
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 200Mi
+              cpu: 200m
+          ports:
+            - containerPort: 27017
+              name: mongo27017
+              protocol: TCP
+          env:
+            - name: MONGO_INITDB_ROOT_USERNAME
+              value: cmlc
+            - name: MONGO_INITDB_ROOT_PASSWORD
+              value: REdPza8#oVlt
+          volumeMounts:
+            - name: mongo-data
+              mountPath: /data/db
+              readOnly: false
+              subPath: default/helm-mongo/data/db
+      volumes:
+        - name: mongo-data
+          persistentVolumeClaim:
+            claimName: helm-mongo
+
+---
--- a/65-202504-湖南二级监管/yaml/k8s-mysql.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-mysql.yaml
@@ -0,0 +1,418 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: helm-mysql
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: mysql-db
+    octopus.control: mysql-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+  annotations: {}
+secrets:
+  - name: helm-mysql
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: helm-mysql
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: mysql-db
+    octopus.control: mysql-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+type: Opaque
+data:
+  mysql-root-password: "UXpmWFFoZDNiUQ=="
+  mysql-password: "S0F0cm5PckFKNw=="
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-mysql
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: mysql-db
+    octopus.control: mysql-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+    app.kubernetes.io/component: primary
+data:
+  my.cnf: |-
+    
+    [mysqld]
+    port=3306
+    basedir=/opt/bitnami/mysql
+    datadir=/bitnami/mysql/data
+    pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
+    socket=/opt/bitnami/mysql/tmp/mysql.sock
+    log-error=/bitnami/mysql/data/error.log
+    general_log_file = /bitnami/mysql/data/general.log
+    slow_query_log_file = /bitnami/mysql/data/slow.log
+    innodb_data_file_path = ibdata1:512M:autoextend
+    innodb_buffer_pool_size = 512M
+    innodb_buffer_pool_instances = 2
+    innodb_log_file_size = 512M
+    innodb_log_files_in_group = 4
+    innodb_log_files_in_group = 4
+    log-bin = /bitnami/mysql/data/mysql-bin
+    max_binlog_size=1G
+    transaction_isolation = REPEATABLE-READ
+    default_storage_engine = innodb
+    character-set-server = utf8mb4
+    collation-server=utf8mb4_bin
+    binlog_format = ROW
+    binlog_rows_query_log_events=on
+    binlog_cache_size=4M
+    binlog_expire_logs_seconds  = 1296000
+    max_binlog_cache_size=2G
+    gtid_mode = on
+    enforce_gtid_consistency = 1
+    sync_binlog = 1
+    innodb_flush_log_at_trx_commit = 1
+    innodb_flush_method = O_DIRECT
+    log_slave_updates=1
+    relay_log_recovery = 1
+    relay-log-purge = 1
+    default_time_zone = '+08:00'
+    lower_case_table_names=1
+    log_bin_trust_function_creators=1
+    group_concat_max_len=67108864
+    innodb_io_capacity = 4000
+    innodb_io_capacity_max = 8000
+    innodb_flush_sync = 0
+    innodb_flush_neighbors = 0
+    innodb_write_io_threads = 8
+    innodb_read_io_threads = 8
+    innodb_purge_threads = 4
+    innodb_page_cleaners = 4
+    innodb_open_files = 65535
+    innodb_max_dirty_pages_pct = 50
+    innodb_lru_scan_depth = 4000
+    innodb_checksum_algorithm = crc32
+    innodb_lock_wait_timeout = 10
+    innodb_rollback_on_timeout = 1
+    innodb_print_all_deadlocks = 1
+    innodb_file_per_table = 1
+    innodb_online_alter_log_max_size = 4G
+    innodb_stats_on_metadata = 0
+    innodb_thread_concurrency = 0
+    innodb_sync_spin_loops = 100
+    innodb_spin_wait_delay = 30
+    lock_wait_timeout = 3600
+    slow_query_log = 1
+    long_query_time = 10
+    log_queries_not_using_indexes =1
+    log_throttle_queries_not_using_indexes = 60
+    min_examined_row_limit = 100
+    log_slow_admin_statements = 1
+    log_slow_slave_statements = 1
+    default_authentication_plugin=mysql_native_password
+    skip-name-resolve=1
+    explicit_defaults_for_timestamp=1
+    plugin_dir=/opt/bitnami/mysql/plugin
+    max_allowed_packet=128M
+    max_connections = 2000
+    max_connect_errors = 1000000
+    table_definition_cache=2000
+    table_open_cache_instances=64
+    tablespace_definition_cache=1024
+    thread_cache_size=256
+    interactive_timeout = 600
+    wait_timeout = 600
+    tmpdir=/opt/bitnami/mysql/tmp
+    max_allowed_packet=32M
+    bind-address=0.0.0.0
+    performance_schema = 1
+    performance_schema_instrument = '%memory%=on'
+    performance_schema_instrument = '%lock%=on'
+    innodb_monitor_enable=ALL
+    
+    [mysql]
+    no-auto-rehash
+    
+    [mysqldump]
+    quick
+    max_allowed_packet = 32M
+    
+    [client]
+    port=3306
+    socket=/opt/bitnami/mysql/tmp/mysql.sock
+    default-character-set=UTF8
+    plugin_dir=/opt/bitnami/mysql/plugin
+    
+    [manager]
+    port=3306
+    socket=/opt/bitnami/mysql/tmp/mysql.sock
+    pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-mysql-init-scripts
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: mysql-db
+    octopus.control: mysql-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+    app.kubernetes.io/component: primary
+data:
+  create_users_grants_core.sql: |-
+    create user zyly@'%' identified by 'Cmii@451315';
+    grant select on *.* to zyly@'%';
+    create user zyly_qc@'%' identified by 'Uh)E_owCyb16';
+    grant all on *.* to zyly_qc@'%';
+    create user k8s_admin@'%' identified by 'fP#UaH6qQ3)8';
+    grant all on *.* to k8s_admin@'%';
+    create user audit_dba@'%' identified by 'PjCzqiBmJaTpgkoYXynH';
+    grant all on *.* to audit_dba@'%';
+    create user db_backup@'%' identified by 'RU5Pu(4FGdT9';
+    GRANT SELECT, RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT, EVENT on *.* to db_backup@'%';
+    create user monitor@'%' identified by 'PL3#nGtrWbf-';
+    grant REPLICATION CLIENT on *.* to monitor@'%';
+    flush privileges;
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: cmii-mysql
+  namespace: zyly
+  labels:
+    app.kubernetes.io/component: primary
+    app.kubernetes.io/managed-by: octopus
+    app.kubernetes.io/name: mysql-db
+    app.kubernetes.io/release: zyly
+    cmii.app: mysql
+    cmii.type: middleware
+    octopus.control: mysql-db-wdd
+spec:
+  ports:
+    - name: mysql
+      protocol: TCP
+      port: 13306
+      targetPort: mysql
+  selector:
+    app.kubernetes.io/component: primary
+    app.kubernetes.io/name: mysql-db
+    app.kubernetes.io/release: zyly
+    cmii.app: mysql
+    cmii.type: middleware
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-mysql-headless
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: mysql-db
+    octopus.control: mysql-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+    cmii.type: middleware
+    cmii.app: mysql
+    app.kubernetes.io/component: primary
+  annotations: {}
+spec:
+  type: ClusterIP
+  clusterIP: None
+  publishNotReadyAddresses: true
+  ports:
+    - name: mysql
+      port: 3306
+      targetPort: mysql
+  selector: 
+    app.kubernetes.io/name: mysql-db
+    app.kubernetes.io/release: zyly
+    cmii.type: middleware
+    cmii.app: mysql
+    app.kubernetes.io/component: primary
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-mysql
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: mysql-db
+    octopus.control: mysql-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+    cmii.type: middleware
+    cmii.app: mysql
+    app.kubernetes.io/component: primary
+  annotations: {}
+spec:
+  type: ClusterIP
+  ports:
+    - name: mysql
+      port: 3306
+      protocol: TCP
+      targetPort: mysql
+  selector:
+    app.kubernetes.io/name: mysql-db
+    app.kubernetes.io/release: zyly
+    cmii.type: middleware
+    cmii.app: mysql
+    app.kubernetes.io/component: primary
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: helm-mysql
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: mysql-db
+    octopus.control: mysql-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+    cmii.type: middleware
+    cmii.app: mysql
+    app.kubernetes.io/component: primary
+spec:
+  replicas: 1
+  selector:
+    matchLabels: 
+      app.kubernetes.io/name: mysql-db
+      app.kubernetes.io/release: zyly
+      cmii.type: middleware
+      cmii.app: mysql
+      app.kubernetes.io/component: primary
+  serviceName: helm-mysql
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        checksum/configuration: 6b60fa0f3a846a6ada8effdc4f823cf8003d42a8c8f630fe8b1b66d3454082dd
+      labels:
+        app.kubernetes.io/name: mysql-db
+        octopus.control: mysql-db-wdd
+        app.kubernetes.io/release: zyly
+        app.kubernetes.io/managed-by: octopus
+        cmii.type: middleware
+        cmii.app: mysql
+        app.kubernetes.io/component: primary
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      serviceAccountName: helm-mysql
+      affinity: {}
+      securityContext:
+        fsGroup: 1001
+      initContainers:
+        - name: change-volume-permissions
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/bitnami-shell:11-debian-11-r136
+          imagePullPolicy: "Always"
+          command:
+            - /bin/bash
+            - -ec
+            - |
+              chown -R 1001:1001 /bitnami/mysql
+          securityContext:
+            runAsUser: 0
+          volumeMounts:
+            - name: mysql-data
+              mountPath: /bitnami/mysql
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 200Mi
+              cpu: 200m
+      containers:
+        - name: mysql
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/mysql:8.1.0-debian-11-r42
+          imagePullPolicy: "IfNotPresent"
+          securityContext:
+            runAsUser: 1001
+          env:
+            - name: BITNAMI_DEBUG
+              value: "true"
+            - name: MYSQL_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: helm-mysql
+                  key: mysql-root-password
+            - name: MYSQL_DATABASE
+              value: "cmii"
+          ports:
+            - name: mysql
+              containerPort: 3306
+          livenessProbe:
+            failureThreshold: 5
+            initialDelaySeconds: 120
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 3
+            exec:
+              command:
+                - /bin/bash
+                - -ec
+                - |
+                  password_aux="${MYSQL_ROOT_PASSWORD:-}"
+                  if [[ -f "${MYSQL_ROOT_PASSWORD_FILE:-}" ]]; then
+                      password_aux=$(cat "$MYSQL_ROOT_PASSWORD_FILE")
+                  fi
+                  mysqladmin status -uroot -p"${password_aux}"
+          readinessProbe:
+            failureThreshold: 5
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 3
+            exec:
+              command:
+                - /bin/bash
+                - -ec
+                - |
+                  password_aux="${MYSQL_ROOT_PASSWORD:-}"
+                  if [[ -f "${MYSQL_ROOT_PASSWORD_FILE:-}" ]]; then
+                      password_aux=$(cat "$MYSQL_ROOT_PASSWORD_FILE")
+                  fi
+                  mysqladmin status -uroot -p"${password_aux}"
+          startupProbe:
+            failureThreshold: 60
+            initialDelaySeconds: 120
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+            exec:
+              command:
+                - /bin/bash
+                - -ec
+                - |
+                  password_aux="${MYSQL_ROOT_PASSWORD:-}"
+                  if [[ -f "${MYSQL_ROOT_PASSWORD_FILE:-}" ]]; then
+                      password_aux=$(cat "$MYSQL_ROOT_PASSWORD_FILE")
+                  fi
+                  mysqladmin status -uroot -p"${password_aux}"
+          resources:
+            limits:
+              memory: 4Gi
+              cpu: "4"
+            requests:
+              memory: 4Gi
+              cpu: "2"
+          volumeMounts:
+            - name: mysql-data
+              mountPath: /bitnami/mysql
+            - name: custom-init-scripts
+              mountPath: /docker-entrypoint-initdb.d
+            - name: config
+              mountPath: /opt/bitnami/mysql/conf/my.cnf
+              subPath: my.cnf
+      volumes:
+        - name: config
+          configMap:
+            name: helm-mysql
+        - name: custom-init-scripts
+          configMap:
+            name: helm-mysql-init-scripts
+        - name: mysql-data
+          persistentVolumeClaim:
+            claimName: helm-mysql
--- a/65-202504-湖南二级监管/yaml/k8s-nacos.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-nacos.yaml
@@ -0,0 +1,136 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-nacos-cm
+  namespace: zyly
+  labels:
+    cmii.app: helm-nacos
+    cmii.type: middleware
+    octopus.control: nacos-wdd
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/version: uas-2.0
+data:
+  mysql.db.name: "cmii_nacos_config"
+  mysql.db.host: "helm-mysql"
+  mysql.port: "3306"
+  mysql.user: "k8s_admin"
+  mysql.password: "fP#UaH6qQ3)8"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-nacos
+  namespace: zyly
+  labels:
+    cmii.app: helm-nacos
+    cmii.type: middleware
+    octopus.control: nacos-wdd
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/version: uas-2.0
+spec:
+  type: ClusterIP
+  selector:
+    cmii.app: helm-nacos
+    cmii.type: middleware
+  ports:
+    - port: 8848
+      name: server
+      targetPort: 8848
+    - port: 9848
+      name: server12
+      targetPort: 9848
+    - port: 9849
+      name: server23
+      targetPort: 9849
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: helm-nacos
+  namespace: zyly
+  labels:
+    cmii.app: helm-nacos
+    cmii.type: middleware
+    octopus.control: nacos-wdd
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/version: uas-2.0
+spec:
+  serviceName: helm-nacos
+  replicas: 1
+  selector:
+    matchLabels:
+      cmii.app: helm-nacos
+      cmii.type: middleware
+  template:
+    metadata:
+      labels:
+        cmii.app: helm-nacos
+        cmii.type: middleware
+        octopus.control: nacos-wdd
+        app.kubernetes.io/managed-by: octopus
+        app.kubernetes.io/version: uas-2.0
+      annotations:
+        pod.alpha.kubernetes.io/initialized: "true"
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      affinity: {}
+      containers:
+        - name: nacos-server
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/nacos-server:v2.1.2
+          ports:
+            - containerPort: 8848
+              name: dashboard
+            - containerPort: 9848
+              name: tcp-9848
+            - containerPort: 9849
+              name: tcp-9849
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 2Gi
+              cpu: "1"
+          env:
+            - name: NACOS_AUTH_ENABLE
+              value: "false"
+            - name: NACOS_REPLICAS
+              value: "1"
+            - name: MYSQL_SERVICE_DB_NAME
+              valueFrom:
+                configMapKeyRef:
+                  name: helm-nacos-cm
+                  key: mysql.db.name
+            - name: MYSQL_SERVICE_PORT
+              valueFrom:
+                configMapKeyRef:
+                  name: helm-nacos-cm
+                  key: mysql.port
+            - name: MYSQL_SERVICE_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: helm-nacos-cm
+                  key: mysql.user
+            - name: MYSQL_SERVICE_PASSWORD
+              valueFrom:
+                configMapKeyRef:
+                  name: helm-nacos-cm
+                  key: mysql.password
+            - name: MYSQL_SERVICE_HOST
+              valueFrom:
+                configMapKeyRef:
+                  name: helm-nacos-cm
+                  key: mysql.db.host
+            - name: NACOS_SERVER_PORT
+              value: "8848"
+            - name: NACOS_APPLICATION_PORT
+              value: "8848"
+            - name: PREFER_HOST_MODE
+              value: "hostname"
+            - name: MODE
+              value: standalone
+            - name: SPRING_DATASOURCE_PLATFORM
+              value: mysql
+---
--- a/65-202504-湖南二级监管/yaml/k8s-nfs-test.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-nfs-test.yaml
@@ -0,0 +1,38 @@
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: test-claim
+  annotations:
+    volume.beta.kubernetes.io/storage-class: "nfs-prod-distribute"   #与nfs-StorageClass.yaml metadata.name保持一致
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-prod-distribute
+  resources:
+    requests:
+      storage: 1Mi
+---
+kind: Pod
+apiVersion: v1
+metadata:
+  name: test-pod
+spec:
+  imagePullSecrets:
+    - name: harborsecret
+  containers:
+    - name: test-pod
+      image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmiibusybox:latest
+      command:
+        - "/bin/sh"
+      args:
+        - "-c"
+        - "touch /mnt/NFS-CREATE-SUCCESS && exit 0 || exit 1"   #创建一个SUCCESS文件后退出
+      volumeMounts:
+        - name: nfs-pvc
+          mountPath: "/mnt"
+  restartPolicy: "Never"
+  volumes:
+    - name: nfs-pvc
+      persistentVolumeClaim:
+        claimName: test-claim  #与PVC名称保持一致
--- a/65-202504-湖南二级监管/yaml/k8s-nfs.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-nfs.yaml
@@ -0,0 +1,114 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nfs-client-provisioner
+  # replace with namespace where provisioner is deployed
+  namespace: kube-system        #根据实际环境设定namespace,下面类同
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: nfs-client-provisioner-runner
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "update", "patch"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: run-nfs-client-provisioner
+subjects:
+  - kind: ServiceAccount
+    name: nfs-client-provisioner
+    # replace with namespace where provisioner is deployed
+    namespace: kube-system
+roleRef:
+  kind: ClusterRole
+#  name: nfs-client-provisioner-runner
+  name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: leader-locking-nfs-client-provisioner
+  # replace with namespace where provisioner is deployed
+  namespace: kube-system
+rules:
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: leader-locking-nfs-client-provisioner
+subjects:
+  - kind: ServiceAccount
+    name: nfs-client-provisioner
+    # replace with namespace where provisioner is deployed
+    namespace: kube-system
+roleRef:
+  kind: Role
+  name: leader-locking-nfs-client-provisioner
+  apiGroup: rbac.authorization.k8s.io
+
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-prod-distribute
+provisioner: cmlc-nfs-storage #这里的名称要和provisioner配置文件中的环境变量PROVISIONER_NAME保持一致parameters:  archiveOnDelete: "false"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nfs-client-provisioner
+  labels:
+    app: nfs-client-provisioner
+  # replace with namespace where provisioner is deployed
+  namespace: kube-system  #与RBAC文件中的namespace保持一致
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nfs-client-provisioner
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: nfs-client-provisioner
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      serviceAccountName: nfs-client-provisioner
+      containers:
+        - name: nfs-client-provisioner
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmiinfs-subdir-external-provisioner:v4.0.2
+          volumeMounts:
+            - name: nfs-client-root
+              mountPath: /persistentvolumes
+          env:
+            - name: PROVISIONER_NAME
+              value: cmlc-nfs-storage
+            - name: NFS_SERVER
+              value: hcms-efs-class
+            - name: NFS_PATH
+              value: /var/lib/docker/nfs_data
+      volumes:
+        - name: nfs-client-root
+          nfs:
+            server: hcms-efs-class
+            path: /var/lib/docker/nfs_data
--- a/65-202504-湖南二级监管/yaml/k8s-pvc.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-pvc.yaml
@@ -0,0 +1,114 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-backend-log-pvc
+  namespace: zyly
+  labels:
+    cmii.type: middleware-base
+    cmii.app: nfs-backend-log-pvc
+    helm.sh/chart: all-persistence-volume-claims-1.1.0
+    app.kubernetes.io/version: uas-2.0
+spec:
+  storageClassName: hcms-efs-class
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 100Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: helm-emqxs
+  namespace: zyly
+  labels:
+    cmii.type: middleware-base
+    cmii.app: helm-emqxs
+    helm.sh/chart: all-persistence-volume-claims-1.1.0
+    app.kubernetes.io/version: uas-2.0
+spec:
+  storageClassName: hcms-efs-class
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 20Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: helm-mongo
+  namespace: zyly
+  labels:
+    cmii.type: middleware-base
+    cmii.app: helm-mongo
+    helm.sh/chart: all-persistence-volume-claims-1.1.0
+    app.kubernetes.io/version: uas-2.0
+spec:
+  storageClassName: hcms-efs-class
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 100Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: helm-rabbitmq
+  namespace: zyly
+  labels:
+    cmii.type: middleware-base
+    cmii.app: helm-rabbitmq
+    helm.sh/chart: all-persistence-volume-claims-1.1.0
+    app.kubernetes.io/version: uas-2.0
+spec:
+  storageClassName: hcms-efs-class
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 20Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: helm-mysql
+  namespace: zyly
+  labels:
+    cmii.type: middleware-base
+    cmii.app: helm-mysql
+    helm.sh/chart: all-persistence-volume-claims-1.1.0
+    app.kubernetes.io/version: uas-2.0
+spec:
+  storageClassName: hcms-efs-class
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 50Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: helm-minio
+  namespace: zyly
+  labels:
+    cmii.type: middleware-base
+    cmii.app: helm-mysql
+    helm.sh/chart: all-persistence-volume-claims-1.1.0
+    app.kubernetes.io/version: uas-2.0
+spec:
+  storageClassName: hcms-efs-class
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 500Gi
--- a/65-202504-湖南二级监管/yaml/k8s-rabbitmq.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-rabbitmq.yaml
@@ -0,0 +1,334 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: helm-rabbitmq
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: helm-rabbitmq
+    helm.sh/chart: rabbitmq-8.26.1
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: rabbitmq
+automountServiceAccountToken: true
+secrets:
+    - name: helm-rabbitmq
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: helm-rabbitmq
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: helm-rabbitmq
+    helm.sh/chart: rabbitmq-8.26.1
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: rabbitmq
+type: Opaque
+data:
+  rabbitmq-password: "blljUk45MXIuX2hq"
+  rabbitmq-erlang-cookie: "emFBRmt1ZU1xMkJieXZvdHRYbWpoWk52UThuVXFzcTU="
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-rabbitmq-config
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: helm-rabbitmq
+    helm.sh/chart: rabbitmq-8.26.1
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: rabbitmq
+data:
+  rabbitmq.conf: |-
+    ## Username and password
+    ##
+    default_user = admin
+    default_pass = nYcRN91r._hj
+    ## Clustering
+    ##
+    cluster_formation.peer_discovery_backend  = rabbit_peer_discovery_k8s
+    cluster_formation.k8s.host = kubernetes.default.svc.cluster.local
+    cluster_formation.node_cleanup.interval = 10
+    cluster_formation.node_cleanup.only_log_warning = true
+    cluster_partition_handling = autoheal
+    # queue master locator
+    queue_master_locator = min-masters
+    # enable guest user
+    loopback_users.guest = false
+    #default_vhost = default-vhost
+    #disk_free_limit.absolute = 50MB
+    #load_definitions = /app/load_definition.json
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: helm-rabbitmq-endpoint-reader
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: helm-rabbitmq
+    helm.sh/chart: rabbitmq-8.26.1
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: rabbitmq
+rules:
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: helm-rabbitmq-endpoint-reader
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: helm-rabbitmq
+    helm.sh/chart: rabbitmq-8.26.1
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: rabbitmq
+subjects:
+  - kind: ServiceAccount
+    name: helm-rabbitmq
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: helm-rabbitmq-endpoint-reader
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-rabbitmq-headless
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: helm-rabbitmq
+    helm.sh/chart: rabbitmq-8.26.1
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: rabbitmq
+spec:
+  clusterIP: None
+  ports:
+    - name: epmd
+      port: 4369
+      targetPort: epmd
+    - name: amqp
+      port: 5672
+      targetPort: amqp
+    - name: dist
+      port: 25672
+      targetPort: dist
+    - name: dashboard
+      port: 15672
+      targetPort: stats
+  selector: 
+    app.kubernetes.io/name: helm-rabbitmq
+    app.kubernetes.io/release: zyly
+  publishNotReadyAddresses: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-rabbitmq
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: helm-rabbitmq
+    helm.sh/chart: rabbitmq-8.26.1
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: rabbitmq
+spec:
+  type: ClusterIP
+  ports:
+    - name: amqp
+      port: 5672
+      targetPort: amqp
+    - name: dashboard
+      port: 15672
+      targetPort: dashboard
+  selector:
+    app.kubernetes.io/name: helm-rabbitmq
+    app.kubernetes.io/release: zyly
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: helm-rabbitmq
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: helm-rabbitmq
+    helm.sh/chart: rabbitmq-8.26.1
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: rabbitmq
+spec:
+  serviceName: helm-rabbitmq-headless
+  podManagementPolicy: OrderedReady
+  replicas: 1
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: helm-rabbitmq
+      app.kubernetes.io/release: zyly
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: helm-rabbitmq
+        helm.sh/chart: rabbitmq-8.26.1
+        app.kubernetes.io/release: zyly
+        app.kubernetes.io/managed-by: rabbitmq
+      annotations:
+        checksum/config: d6c2caa9572f64a06d9f7daa34c664a186b4778cd1697ef8e59663152fc628f1
+        checksum/secret: d764e7b3d999e7324d1afdfec6140092a612f04b6e0306818675815cec2f454f
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      serviceAccountName: helm-rabbitmq
+      affinity: {}
+      securityContext:
+        fsGroup: 5001
+        runAsUser: 5001
+      terminationGracePeriodSeconds: 120
+      initContainers:
+        - name: volume-permissions
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/bitnami-shell:11-debian-11-r136
+          imagePullPolicy: "Always"
+          command:
+            - /bin/bash
+          args:
+            - -ec
+            - |
+              mkdir -p "/bitnami/rabbitmq/mnesia"
+              chown -R "5001:5001" "/bitnami/rabbitmq/mnesia"
+          securityContext:
+            runAsUser: 0
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 200Mi
+              cpu: 200m
+          volumeMounts:
+            - name: data
+              mountPath: /bitnami/rabbitmq/mnesia
+      containers:
+        - name: rabbitmq
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/rabbitmq:3.9.12-debian-10-r3
+          imagePullPolicy: "Always"
+          env:
+            - name: BITNAMI_DEBUG
+              value: "false"
+            - name: MY_POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: K8S_SERVICE_NAME
+              value: "helm-rabbitmq-headless"
+            - name: K8S_ADDRESS_TYPE
+              value: hostname
+            - name: RABBITMQ_FORCE_BOOT
+              value: "no"
+            - name: RABBITMQ_NODE_NAME
+              value: "rabbit@$(MY_POD_NAME).$(K8S_SERVICE_NAME).$(MY_POD_NAMESPACE).svc.cluster.local"
+            - name: K8S_HOSTNAME_SUFFIX
+              value: ".$(K8S_SERVICE_NAME).$(MY_POD_NAMESPACE).svc.cluster.local"
+            - name: RABBITMQ_MNESIA_DIR
+              value: "/bitnami/rabbitmq/mnesia/$(RABBITMQ_NODE_NAME)"
+            - name: RABBITMQ_LDAP_ENABLE
+              value: "no"
+            - name: RABBITMQ_LOGS
+              value: "-"
+            - name: RABBITMQ_ULIMIT_NOFILES
+              value: "65536"
+            - name: RABBITMQ_USE_LONGNAME
+              value: "true"
+            - name: RABBITMQ_ERL_COOKIE
+              valueFrom:
+                secretKeyRef:
+                  name: helm-rabbitmq
+                  key: rabbitmq-erlang-cookie
+            - name: RABBITMQ_LOAD_DEFINITIONS
+              value: "no"
+            - name: RABBITMQ_SECURE_PASSWORD
+              value: "yes"
+            - name: RABBITMQ_USERNAME
+              value: "admin"
+            - name: RABBITMQ_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: helm-rabbitmq
+                  key: rabbitmq-password
+            - name: RABBITMQ_PLUGINS
+              value: "rabbitmq_management, rabbitmq_peer_discovery_k8s, rabbitmq_shovel, rabbitmq_shovel_management, rabbitmq_auth_backend_ldap"
+          ports:
+            - name: amqp
+              containerPort: 5672
+            - name: dist
+              containerPort: 25672
+            - name: dashboard
+              containerPort: 15672
+            - name: epmd
+              containerPort: 4369
+          livenessProbe:
+            exec:
+              command:
+                - /bin/bash
+                - -ec
+                - rabbitmq-diagnostics -q ping
+            initialDelaySeconds: 120
+            periodSeconds: 30
+            timeoutSeconds: 20
+            successThreshold: 1
+            failureThreshold: 6
+          readinessProbe:
+            exec:
+              command:
+                - /bin/bash
+                - -ec
+                - rabbitmq-diagnostics -q check_running && rabbitmq-diagnostics -q check_local_alarms
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 20
+            successThreshold: 1
+            failureThreshold: 3
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - /bin/bash
+                  - -ec
+                  - |
+                    if [[ -f /opt/bitnami/scripts/rabbitmq/nodeshutdown.sh ]]; then
+                        /opt/bitnami/scripts/rabbitmq/nodeshutdown.sh -t "120" -d  "false"
+                    else
+                        rabbitmqctl stop_app
+                    fi
+          resources:
+            limits:
+              memory: 2Gi
+              cpu: "2"
+            requests:
+              memory: 200Mi
+              cpu: 200m
+          volumeMounts:
+            - name: configuration
+              mountPath: /bitnami/rabbitmq/conf
+            - name: data
+              mountPath: /bitnami/rabbitmq/mnesia
+      volumes:
+        - name: configuration
+          configMap:
+            name: helm-rabbitmq-config
+            items:
+              - key: rabbitmq.conf
+                path: rabbitmq.conf
+        - name: data
+          persistentVolumeClaim:
+            claimName: helm-rabbitmq
--- a/65-202504-湖南二级监管/yaml/k8s-redis.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-redis.yaml
@@ -0,0 +1,585 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+automountServiceAccountToken: true
+metadata:
+  name: helm-redis
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: helm-redis
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+type: Opaque
+data:
+  redis-password: "TWNhY2hlQDQ1MjI="
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-redis-configuration
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+data:
+  redis.conf: |-
+    # User-supplied common configuration:
+    # Enable AOF https://redis.io/topics/persistence#append-only-file
+    appendonly yes
+    # Disable RDB persistence, AOF persistence already enabled.
+    save ""
+    # End of common configuration
+  master.conf: |-
+    dir /data
+    # User-supplied master configuration:
+    rename-command FLUSHDB ""
+    rename-command FLUSHALL ""
+    # End of master configuration
+  replica.conf: |-
+    dir /data
+    slave-read-only yes
+    # User-supplied replica configuration:
+    rename-command FLUSHDB ""
+    rename-command FLUSHALL ""
+    # End of replica configuration
+---
+# Source: outside-deploy/charts/redis-db/templates/health-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-redis-health
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+data:
+  ping_readiness_local.sh: |-
+    #!/bin/bash
+
+    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
+    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h localhost \
+        -p $REDIS_PORT \
+        ping
+    )
+    if [ "$response" != "PONG" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_liveness_local.sh: |-
+    #!/bin/bash
+
+    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
+    [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h localhost \
+        -p $REDIS_PORT \
+        ping
+    )
+    if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_readiness_master.sh: |-
+    #!/bin/bash
+
+    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
+    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h $REDIS_MASTER_HOST \
+        -p $REDIS_MASTER_PORT_NUMBER \
+        ping
+    )
+    if [ "$response" != "PONG" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_liveness_master.sh: |-
+    #!/bin/bash
+
+    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
+    [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
+    response=$(
+      timeout -s 3 $1 \
+      redis-cli \
+        -h $REDIS_MASTER_HOST \
+        -p $REDIS_MASTER_PORT_NUMBER \
+        ping
+    )
+    if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then
+      echo "$response"
+      exit 1
+    fi
+  ping_readiness_local_and_master.sh: |-
+    script_dir="$(dirname "$0")"
+    exit_status=0
+    "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
+    "$script_dir/ping_readiness_master.sh" $1 || exit_status=$?
+    exit $exit_status
+  ping_liveness_local_and_master.sh: |-
+    script_dir="$(dirname "$0")"
+    exit_status=0
+    "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
+    "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
+    exit $exit_status
+---
+# Source: outside-deploy/charts/redis-db/templates/scripts-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-redis-scripts
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+data:
+  start-master.sh: |
+    #!/bin/bash
+
+    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
+    if [[ ! -f /opt/bitnami/redis/etc/master.conf ]];then
+        cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf
+    fi
+    if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then
+        cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
+    fi
+    ARGS=("--port" "${REDIS_PORT}")
+    ARGS+=("--requirepass" "${REDIS_PASSWORD}")
+    ARGS+=("--masterauth" "${REDIS_PASSWORD}")
+    ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
+    ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf")
+    exec redis-server "${ARGS[@]}"
+  start-replica.sh: |
+    #!/bin/bash
+
+    get_port() {
+        hostname="$1"
+        type="$2"
+
+        port_var=$(echo "${hostname^^}_SERVICE_PORT_$type" | sed "s/-/_/g")
+        port=${!port_var}
+        
+        if [ -z "$port" ]; then
+            case $type in
+                "SENTINEL")
+                    echo 26379
+                    ;;
+                "REDIS")
+                    echo 6379
+                    ;;
+            esac
+        else
+            echo $port
+        fi
+    }
+
+    get_full_hostname() {
+        hostname="$1"
+        echo "${hostname}.${HEADLESS_SERVICE}"
+    }
+
+    REDISPORT=$(get_port "$HOSTNAME" "REDIS")
+    
+    [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
+    [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
+    if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then
+        cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf
+    fi
+    if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then
+        cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
+    fi
+
+    echo "" >> /opt/bitnami/redis/etc/replica.conf
+    echo "replica-announce-port $REDISPORT" >> /opt/bitnami/redis/etc/replica.conf
+    echo "replica-announce-ip $(get_full_hostname "$HOSTNAME")" >> /opt/bitnami/redis/etc/replica.conf
+    ARGS=("--port" "${REDIS_PORT}")
+    ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}")
+    ARGS+=("--requirepass" "${REDIS_PASSWORD}")
+    ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}")
+    ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
+    ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf")
+    exec redis-server "${ARGS[@]}"
+---
+# Source: outside-deploy/charts/redis-db/templates/headless-svc.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-redis-headless
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+spec:
+  type: ClusterIP
+  clusterIP: None
+  ports:
+    - name: tcp-redis
+      port: 6379
+      targetPort: redis
+  selector:
+    app.kubernetes.io/name: redis-db
+    app.kubernetes.io/release: zyly
+---
+# Source: outside-deploy/charts/redis-db/templates/master/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-redis-master
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+    cmii.type: middleware
+    cmii.app: redis
+    app.kubernetes.io/component: master
+spec:
+  type: ClusterIP
+  
+  ports:
+    - name: tcp-redis
+      port: 6379
+      targetPort: redis
+      nodePort: null
+  selector:
+    app.kubernetes.io/name: redis-db
+    app.kubernetes.io/release: zyly
+    cmii.type: middleware
+    cmii.app: redis
+    app.kubernetes.io/component: master
+---
+# Source: outside-deploy/charts/redis-db/templates/replicas/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: helm-redis-replicas
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+    app.kubernetes.io/component: replica
+spec:
+  type: ClusterIP
+  ports:
+    - name: tcp-redis
+      port: 6379
+      targetPort: redis
+      nodePort: null
+  selector:
+    app.kubernetes.io/name: redis-db
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/component: replica
+---
+# Source: outside-deploy/charts/redis-db/templates/master/statefulset.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: helm-redis-master
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+    cmii.type: middleware
+    cmii.app: redis
+    app.kubernetes.io/component: master
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: redis-db
+      app.kubernetes.io/release: zyly
+      cmii.type: middleware
+      cmii.app: redis
+      app.kubernetes.io/component: master
+  serviceName: helm-redis-headless
+  updateStrategy:
+    rollingUpdate: {}
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: redis-db
+        octopus.control: redis-db-wdd
+        app.kubernetes.io/release: zyly
+        app.kubernetes.io/managed-by: octopus
+        cmii.type: middleware
+        cmii.app: redis
+        app.kubernetes.io/component: master
+      annotations:
+        checksum/configmap: b64aa5db67e6e63811f3c1095b9fce34d83c86a471fccdda0e48eedb53a179b0
+        checksum/health: 6e0a6330e5ac63e565ae92af1444527d72d8897f91266f333555b3d323570623
+        checksum/scripts: b88df93710b7c42a76006e20218f05c6e500e6cc2affd4bb1985832f03166e98
+        checksum/secret: 43f1b0e20f9cb2de936bd182bc3683b720fc3cf4f4e76cb23c06a52398a50e8d
+    spec:
+      affinity: {}
+      securityContext:
+        fsGroup: 1001
+      serviceAccountName: helm-redis
+      imagePullSecrets:
+        - name: harborsecret
+      terminationGracePeriodSeconds: 30
+      containers:
+        - name: redis
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/redis:6.2.6-debian-10-r0
+          imagePullPolicy: "Always"
+          securityContext:
+            runAsUser: 1001
+          command:
+            - /bin/bash
+          args:
+            - -c
+            - /opt/bitnami/scripts/start-scripts/start-master.sh
+          env:
+            - name: BITNAMI_DEBUG
+              value: "false"
+            - name: REDIS_REPLICATION_MODE
+              value: master
+            - name: ALLOW_EMPTY_PASSWORD
+              value: "no"
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: helm-redis
+                  key: redis-password
+            - name: REDIS_TLS_ENABLED
+              value: "no"
+            - name: REDIS_PORT
+              value: "6379"
+          ports:
+            - name: redis
+              containerPort: 6379
+          livenessProbe:
+            initialDelaySeconds: 20
+            periodSeconds: 5
+            # One second longer than command timeout should prevent generation of zombie processes.
+            timeoutSeconds: 6
+            successThreshold: 1
+            failureThreshold: 5
+            exec:
+              command:
+                - sh
+                - -c
+                - /health/ping_liveness_local.sh 5
+          readinessProbe:
+            initialDelaySeconds: 20
+            periodSeconds: 5
+            timeoutSeconds: 2
+            successThreshold: 1
+            failureThreshold: 5
+            exec:
+              command:
+                - sh
+                - -c
+                - /health/ping_readiness_local.sh 1
+          resources:
+            limits:
+              cpu: "2"
+              memory: 8Gi
+            requests:
+              cpu: "2"
+              memory: 8Gi
+          volumeMounts:
+            - name: start-scripts
+              mountPath: /opt/bitnami/scripts/start-scripts
+            - name: health
+              mountPath: /health
+            - name: redis-data
+              mountPath: /data
+              subPath: 
+            - name: config
+              mountPath: /opt/bitnami/redis/mounted-etc
+            - name: redis-tmp-conf
+              mountPath: /opt/bitnami/redis/etc/
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: start-scripts
+          configMap:
+            name: helm-redis-scripts
+            defaultMode: 0755
+        - name: health
+          configMap:
+            name: helm-redis-health
+            defaultMode: 0755
+        - name: config
+          configMap:
+            name: helm-redis-configuration
+        - name: redis-tmp-conf
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+        - name: redis-data
+          emptyDir: {}
+---
+# Source: outside-deploy/charts/redis-db/templates/replicas/statefulset.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: helm-redis-replicas
+  namespace: zyly
+  labels:
+    app.kubernetes.io/name: redis-db
+    octopus.control: redis-db-wdd
+    app.kubernetes.io/release: zyly
+    app.kubernetes.io/managed-by: octopus
+    app.kubernetes.io/component: replica
+spec:
+  replicas: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: redis-db
+      app.kubernetes.io/release: zyly
+      app.kubernetes.io/component: replica
+  serviceName: helm-redis-headless
+  updateStrategy:
+    rollingUpdate: {}
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: redis-db
+        octopus.control: redis-db-wdd
+        app.kubernetes.io/release: zyly
+        app.kubernetes.io/managed-by: octopus
+        app.kubernetes.io/component: replica
+      annotations:
+        checksum/configmap: b64aa5db67e6e63811f3c1095b9fce34d83c86a471fccdda0e48eedb53a179b0
+        checksum/health: 6e0a6330e5ac63e565ae92af1444527d72d8897f91266f333555b3d323570623
+        checksum/scripts: b88df93710b7c42a76006e20218f05c6e500e6cc2affd4bb1985832f03166e98
+        checksum/secret: 43f1b0e20f9cb2de936bd182bc3683b720fc3cf4f4e76cb23c06a52398a50e8d
+    spec:
+      imagePullSecrets:
+        - name: harborsecret
+      securityContext:
+        fsGroup: 1001
+      serviceAccountName: helm-redis
+      terminationGracePeriodSeconds: 30
+      containers:
+        - name: redis
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/redis:6.2.6-debian-10-r0
+          imagePullPolicy: "Always"
+          securityContext:
+            runAsUser: 1001
+          command:
+            - /bin/bash
+          args:
+            - -c
+            - /opt/bitnami/scripts/start-scripts/start-replica.sh
+          env:
+            - name: BITNAMI_DEBUG
+              value: "false"
+            - name: REDIS_REPLICATION_MODE
+              value: slave
+            - name: REDIS_MASTER_HOST
+              value: helm-redis-master-0.helm-redis-headless.zyly.svc.cluster.local
+            - name: REDIS_MASTER_PORT_NUMBER
+              value: "6379"
+            - name: ALLOW_EMPTY_PASSWORD
+              value: "no"
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: helm-redis
+                  key: redis-password
+            - name: REDIS_MASTER_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: helm-redis
+                  key: redis-password
+            - name: REDIS_TLS_ENABLED
+              value: "no"
+            - name: REDIS_PORT
+              value: "6379"
+          ports:
+            - name: redis
+              containerPort: 6379
+          livenessProbe:
+            initialDelaySeconds: 20
+            periodSeconds: 5
+            timeoutSeconds: 6
+            successThreshold: 1
+            failureThreshold: 5
+            exec:
+              command:
+                - sh
+                - -c
+                - /health/ping_liveness_local_and_master.sh 5
+          readinessProbe:
+            initialDelaySeconds: 20
+            periodSeconds: 5
+            timeoutSeconds: 2
+            successThreshold: 1
+            failureThreshold: 5
+            exec:
+              command:
+                - sh
+                - -c
+                - /health/ping_readiness_local_and_master.sh 1
+          resources:
+            limits:
+              cpu: "2"
+              memory: 8Gi
+            requests:
+              cpu: "2"
+              memory: 8Gi
+          volumeMounts:
+            - name: start-scripts
+              mountPath: /opt/bitnami/scripts/start-scripts
+            - name: health
+              mountPath: /health
+            - name: redis-data
+              mountPath: /data
+              subPath: 
+            - name: config
+              mountPath: /opt/bitnami/redis/mounted-etc
+            - name: redis-tmp-conf
+              mountPath: /opt/bitnami/redis/etc
+      volumes:
+        - name: start-scripts
+          configMap:
+            name: helm-redis-scripts
+            defaultMode: 0755
+        - name: health
+          configMap:
+            name: helm-redis-health
+            defaultMode: 0755
+        - name: config
+          configMap:
+            name: helm-redis-configuration
+        - name: redis-tmp-conf
+          emptyDir: {}
+        - name: redis-data
+          emptyDir: {}
+
--- a/65-202504-湖南二级监管/yaml/k8s-srs.yaml
+++ b/65-202504-湖南二级监管/yaml/k8s-srs.yaml
@@ -0,0 +1,496 @@
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: helm-live-srs-cm
+  namespace: zyly
+  labels:
+    cmii.app: live-srs
+    cmii.type: live
+    octopus.control: wdd
+    app.kubernetes.io/managed-by: octopus
+    helm.sh/chart: cmlc-live-srs-rtc-2.0.0
+data:
+  srs.rtc.conf: |-
+    listen              31935;
+    max_connections     4096;
+    srs_log_tank        console;
+    srs_log_level       info;
+    srs_log_file        /home/srs.log;
+    daemon              off;
+    http_api {
+        enabled         on;
+        listen          1985;
+        crossdomain     on;
+    }
+    stats {
+        network         0;
+    }
+    http_server {
+        enabled         on;
+        listen          8080;
+        dir             /home/hls;
+    }
+    srt_server {
+        enabled         on;
+        listen          30556;
+        maxbw           1000000000;
+        connect_timeout 4000;
+        peerlatency     600;
+        recvlatency     600;
+    }
+    rtc_server {
+        enabled         on;
+        listen          30090;
+        candidate       $CANDIDATE;
+    }
+    vhost __defaultVhost__ {
+        http_hooks {
+            enabled       on;
+            on_publish    http://helm-live-op-svc-v2:8080/hooks/on_push;
+        }
+        http_remux {
+            enabled     on;
+        }
+        rtc {
+            enabled     on;
+            rtmp_to_rtc on;
+            rtc_to_rtmp on;
+            keep_bframe off;
+        }
+        tcp_nodelay     on;
+        min_latency     on;
+        play {
+            gop_cache       off;
+            mw_latency      100;
+            mw_msgs         10;
+        }
+        publish {
+            firstpkt_timeout    8000;
+            normal_timeout      4000;
+            mr on;
+        }
+        dvr {
+            enabled         off;
+            dvr_path        /home/dvr/[app]/[stream]/[2006][01]/[timestamp].mp4;
+            dvr_plan        session;
+        }
+        hls {
+            enabled          on;
+            hls_path         /home/hls;
+            hls_fragment     10;
+            hls_window       60;
+            hls_m3u8_file    [app]/[stream].m3u8;
+            hls_ts_file      [app]/[stream]/[2006][01][02]/[timestamp]-[duration].ts;
+            hls_cleanup      on;
+            hls_entry_prefix http://36.137.146.187;
+        }
+    }
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: helm-live-srs-svc-exporter
+  namespace: zyly
+  labels:
+    octopus.control: wdd
+    app.kubernetes.io/managed-by: octopus
+spec:
+  ports:
+    - name: rtmp
+      protocol: TCP
+      port: 31935
+      targetPort: 31935
+      nodePort: 31935
+    - name: rtc
+      protocol: UDP
+      port: 30090
+      targetPort: 30090
+      nodePort: 30090
+    - name: rtc-tcp
+      protocol: TCP
+      port: 30090
+      targetPort: 30090
+      nodePort: 30090
+    - name: srt
+      protocol: UDP
+      port: 30556
+      targetPort: 30556
+      nodePort: 30556
+    - name: api
+      protocol: TCP
+      port: 1985
+      targetPort: 1985
+      nodePort: 30080
+  selector:
+    srs-role: rtc
+  type: NodePort
+  sessionAffinity: None
+  externalTrafficPolicy: Cluster
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: helm-live-srs-svc
+  namespace: zyly
+  labels:
+    octopus.control: wdd
+    app.kubernetes.io/managed-by: octopus
+spec:
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8080
+      targetPort: 8080
+    - name: api
+      protocol: TCP
+      port: 1985
+      targetPort: 1985
+  selector:
+    srs-role: rtc
+  type: ClusterIP
+  sessionAffinity: None
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: helm-live-srsrtc-svc
+  namespace: zyly
+  labels:
+    octopus.control: wdd
+    app.kubernetes.io/managed-by: octopus
+spec:
+  ports:
+    - name: rtmp
+      protocol: TCP
+      port: 31935
+      targetPort: 31935
+  selector:
+    srs-role: rtc
+  type: ClusterIP
+  sessionAffinity: None
+
+---
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  name: helm-live-srs-rtc
+  namespace: zyly
+  labels:
+    octopus.control: wdd
+    app.kubernetes.io/managed-by: octopus
+    cmii.app: live-srs
+    cmii.type: live
+    helm.sh/chart: cmlc-live-srs-rtc-2.0.0
+    srs-role: rtc
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      srs-role: rtc
+  template:
+    metadata:
+      labels:
+        srs-role: rtc
+    spec:
+      volumes:
+        - name: srs-conf-file
+          configMap:
+            name: helm-live-srs-cm
+            items:
+              - key: srs.rtc.conf
+                path: docker.conf
+            defaultMode: 420
+        - name: srs-vol
+          emptyDir:
+            sizeLimit: 8Gi
+      containers:
+        - name: srs-rtc
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/srs:v5.0.195
+          ports:
+            - name: srs-rtmp
+              containerPort: 31935
+              protocol: TCP
+            - name: srs-api
+              containerPort: 1985
+              protocol: TCP
+            - name: srs-flv
+              containerPort: 8080
+              protocol: TCP
+            - name: srs-webrtc
+              containerPort: 30090
+              protocol: UDP
+            - name: srs-webrtc-tcp
+              containerPort: 30090
+              protocol: TCP
+            - name: srs-srt
+              containerPort: 30556
+              protocol: UDP
+          env:
+            - name: CANDIDATE
+              value: dkjg.hncmict.com
+          resources:
+            limits:
+              cpu: 2000m
+              memory: 4Gi
+            requests:
+              cpu: 100m
+              memory: 256Mi
+          volumeMounts:
+            - name: srs-conf-file
+              mountPath: /usr/local/srs/conf/docker.conf
+              subPath: docker.conf
+            - name: srs-vol
+              mountPath: /home/dvr
+              subPath: zyly/helm-live/dvr
+            - name: srs-vol
+              mountPath: /home/hls
+              subPath: zyly/helm-live/hls
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: Always
+        - name: oss-adaptor
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/cmii-srs-oss-adaptor:2023-SA-skip-CHL
+          env:
+            - name: OSS_ENDPOINT
+              value: 'http://helm-minio:9000'
+            - name: OSS_AK
+              value: cmii
+            - name: OSS_SK
+              value: 'B#923fC7mk'
+            - name: OSS_BUCKET
+              value: live-cluster-hls
+            - name: SRS_OP
+              value: 'http://helm-live-op-svc-v2:8080'
+            - name: MYSQL_ENDPOINT
+              value: 'helm-mysql:3306'
+            - name: MYSQL_USERNAME
+              value: k8s_admin
+            - name: MYSQL_PASSWORD
+              value: fP#UaH6qQ3)8
+            - name: MYSQL_DATABASE
+              value: cmii_live_srs_op
+            - name: MYSQL_TABLE
+              value: live_segment
+            - name: LOG_LEVEL
+              value: info
+            - name: OSS_META
+              value: 'yes'
+          resources:
+            limits:
+              cpu: 2000m
+              memory: 4Gi
+            requests:
+              cpu: 100m
+              memory: 256Mi
+          volumeMounts:
+            - name: srs-vol
+              mountPath: /cmii/share/hls
+              subPath: zyly/helm-live/hls
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: Always
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      dnsPolicy: ClusterFirst
+      securityContext: {}
+      imagePullSecrets:
+        - name: harborsecret
+      affinity: {}
+      schedulerName: default-scheduler
+  serviceName: helm-live-srsrtc-svc
+  podManagementPolicy: OrderedReady
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      partition: 0
+  revisionHistoryLimit: 10
+---
+# live-srs部分
+---
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: helm-live-op-v2
+  namespace: zyly
+  labels:
+    octopus.control: wdd
+    app.kubernetes.io/managed-by: octopus
+    cmii.app: live-engine
+    cmii.type: live
+    helm.sh/chart: cmlc-live-live-op-2.0.0
+    live-role: op-v2
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      live-role: op-v2
+  template:
+    metadata:
+      labels:
+        live-role: op-v2
+    spec:
+      volumes:
+        - name: srs-conf-file
+          configMap:
+            name: helm-live-op-cm-v2
+            items:
+              - key: live.op.conf
+                path: bootstrap.yaml
+            defaultMode: 420
+      containers:
+        - name: helm-live-op-v2
+          image: hncm-fc766f84.ecis.changsha-2.cmecloud.cn/cmii/cmii-live-operator:5.2.0
+          ports:
+            - name: operator
+              containerPort: 8080
+              protocol: TCP
+          resources:
+            limits:
+              cpu: 4800m
+              memory: 4Gi
+            requests:
+              cpu: 100m
+              memory: 256Mi
+          volumeMounts:
+            - name: srs-conf-file
+              mountPath: /cmii/bootstrap.yaml
+              subPath: bootstrap.yaml
+          livenessProbe:
+            httpGet:
+              path: /cmii/health
+              port: 8080
+              scheme: HTTP
+            initialDelaySeconds: 60
+            timeoutSeconds: 5
+            periodSeconds: 20
+            successThreshold: 1
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /cmii/health
+              port: 8080
+              scheme: HTTP
+            initialDelaySeconds: 60
+            timeoutSeconds: 5
+            periodSeconds: 20
+            successThreshold: 1
+            failureThreshold: 3
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: Always
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      dnsPolicy: ClusterFirst
+      securityContext: {}
+      imagePullSecrets:
+        - name: harborsecret
+      affinity: {}
+      schedulerName: default-scheduler
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 25%
+      maxSurge: 25%
+  revisionHistoryLimit: 10
+  progressDeadlineSeconds: 600
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: helm-live-op-svc-v2
+  namespace: zyly
+  labels:
+    octopus.control: wdd
+    app.kubernetes.io/managed-by: octopus
+spec:
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+      nodePort: 30333
+  selector:
+    live-role: op-v2
+  type: NodePort
+  sessionAffinity: None
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: helm-live-op-svc
+  namespace: zyly
+  labels:
+    octopus.control: wdd
+    app.kubernetes.io/managed-by: octopus
+spec:
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+  selector:
+    live-role: op
+  type: ClusterIP
+  sessionAffinity: None
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: helm-live-op-cm-v2
+  namespace: zyly
+  labels:
+    octopus.control: wdd
+    app.kubernetes.io/managed-by: octopus
+    cmii.app: live-engine
+    cmii.type: live
+data:
+  live.op.conf: |-
+    server:
+      port: 8080
+    spring:
+      main:
+        allow-bean-definition-overriding: true
+        allow-circular-references: true
+      application:
+        name: cmii-live-operator
+      platform:
+        info:
+          name: cmii-live-operator
+          description: cmii-live-operator
+          version: uas-2.0
+          scanPackage: com.cmii.live.op
+      cloud:
+        nacos:
+          config:
+            username: nacos
+            password: KingKong@95461234
+            server-addr: helm-nacos:8848
+            extension-configs:
+              - data-id: cmii-live-operator.yml
+                group: uas-2.0
+                refresh: true
+            shared-configs:
+              - data-id: cmii-backend-system.yml
+                group: uas-2.0
+                refresh: true
+          discovery:
+            enabled: false
+
+    live:
+      engine:
+        type: srs
+        endpoint:  'http://helm-live-srs-svc:1985'
+      proto:
+        rtmp: 'rtmp://36.137.146.187:31935'
+        rtsp: 'rtsp://36.137.146.187:30554'
+        srt: 'srt://36.137.146.187:30556'
+        flv: 'http://36.137.146.187:30500'
+        hls: 'http://36.137.146.187:30500'
+        rtc: 'webrtc://36.137.146.187:30080'
+        replay: 'https://36.137.146.187:30333'
+      minio:
+        endpoint: http://helm-minio:9000
+        access-key: cmii
+        secret-key: B#923fC7mk
+        bucket: live-cluster-hls
--- a/65-202504-湖南二级监管/数据库脚本下载.txt
+++ b/65-202504-湖南二级监管/数据库脚本下载.txt
@@ -0,0 +1,24 @@
+
+
+wget --no-check-certificate https://oss.demo.uavcmlc.com/cmlc-installation/tmp/all_tables_jianguan.sql
+wget --no-check-certificate https://oss.demo.uavcmlc.com/cmlc-installation/tmp/sense_adapter.sql
+wget --no-check-certificate https://oss.demo.uavcmlc.com/cmlc-installation/tmp/uav_lifecycle.sql
+wget --no-check-certificate https://oss.demo.uavcmlc.com/cmlc-installation/tmp/uav_notice.sql
+wget --no-check-certificate https://oss.demo.uavcmlc.com/cmlc-installation/tmp/z_cmii_nacos_config.sql
+
+wget --no-check-certificate https://oss.demo.uavcmlc.com/cmlc-installation/tmp/doris_table_init.sql
+
+wget --no-check-certificate https://oss.demo.uavcmlc.com/cmlc-installation/tmp/uav_lifecycle_0514.sql
+
+
+mc rm demo/cmlc-installation/tmp/all_tables_jianguan.sql
+mc rm demo/cmlc-installation/tmp/sense_adapter.sql
+mc rm demo/cmlc-installation/tmp/uav_lifecycle.sql
+mc rm demo/cmlc-installation/tmp/uav_notice.sql
+mc rm demo/cmlc-installation/tmp/z_nacos_config_info.sql
+mc rm demo/cmlc-installation/tmp/uav_lifecycle_0514.sql
+
+
+mysql -uroot -pQzfXQhd3bQ -h127.0.0.1 -P3306 < uav_lifecycle_0514.sql
+
+mysql -hdoris-cluster-fe-service -P9030 -uroot < doris_table_init.sql