1

.gitea/workflows/sync-consul.yml

@@ -30,6 +30,7 @@ jobs:
               export NAMESPACE=prod
               ;;
           esac
+          test -f "$KUBECONFIG"
           export RESTART_APIS=1
 
           REPO="${{ gitea.repository }}"

scripts/sync-to-consul.sh

@@ -125,7 +125,14 @@ load_secret() {
   fi
 }
 
-echo "==> 加载密钥（K8s Secret / env）"
+echo "==> 加载密钥（K8s Secret / env） ns=${NS} kubeconfig=${KUBECONFIG}"
+if ! kubectl -n "$NS" get secret prod-credentials >/dev/null 2>&1; then
+  echo "FAIL: 找不到 secret/${NS}/prod-credentials"
+  echo "  当前: KUBECONFIG=${KUBECONFIG}"
+  echo "  test 集群请先: kubectl --kubeconfig=/root/.kube/k3s-test.yaml apply -f /data/k3s-test/manifests/secrets.yaml"
+  echo "  或: kubectl -n ${NS} get secret"
+  exit 1
+fi
 load_secret MYSQL_ROOT_PASSWORD prod-credentials MYSQL_ROOT_PASSWORD
 load_secret REDIS_PASSWORD prod-credentials REDIS_PASSWORD
 load_secret RABBITMQ_DEFAULT_PASS prod-credentials RABBITMQ_DEFAULT_PASS
@@ -134,7 +141,7 @@ load_secret JWT_SECRET_KEY jwt-secret JWT_SECRET_KEY
 # 兼容：JWT 也放在 prod-credentials
 load_secret JWT_SECRET_KEY prod-credentials JWT_SECRET_KEY
 
-: "${MYSQL_ROOT_PASSWORD:?缺少 MYSQL_ROOT_PASSWORD（env 或 secret/prod-credentials）}"
+: "${MYSQL_ROOT_PASSWORD:?缺少 MYSQL_ROOT_PASSWORD（env 或 secret/${NS}/prod-credentials）}"
 : "${REDIS_PASSWORD:?缺少 REDIS_PASSWORD}"
 : "${RABBITMQ_DEFAULT_PASS:?缺少 RABBITMQ_DEFAULT_PASS}"
 : "${ELASTIC_PASSWORD:?缺少 ELASTIC_PASSWORD}"