From aae640d67501db9f993f4034c0cc722739e11cbb Mon Sep 17 00:00:00 2001
From: xiaolipro <2357729423@qq.com>
Date: Mon, 21 Sep 2026 16:36:47 +0800
Subject: [PATCH] 1

---
 .gitea/workflows/sync-consul.yml |  1 +
 scripts/sync-to-consul.sh        | 11 +++++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/sync-consul.yml b/.gitea/workflows/sync-consul.yml
index 117b8c5..7df673d 100644
--- a/.gitea/workflows/sync-consul.yml
+++ b/.gitea/workflows/sync-consul.yml
@@ -30,6 +30,7 @@ jobs:
               export NAMESPACE=prod
               ;;
           esac
+          test -f "$KUBECONFIG"
           export RESTART_APIS=1
 
           REPO="${{ gitea.repository }}"
diff --git a/scripts/sync-to-consul.sh b/scripts/sync-to-consul.sh
index bed8387..5fa9bdd 100644
--- a/scripts/sync-to-consul.sh
+++ b/scripts/sync-to-consul.sh
@@ -125,7 +125,14 @@ load_secret() {
   fi
 }
 
-echo "==> 加载密钥（K8s Secret / env）"
+echo "==> 加载密钥（K8s Secret / env） ns=${NS} kubeconfig=${KUBECONFIG}"
+if ! kubectl -n "$NS" get secret prod-credentials >/dev/null 2>&1; then
+  echo "FAIL: 找不到 secret/${NS}/prod-credentials"
+  echo "  当前: KUBECONFIG=${KUBECONFIG}"
+  echo "  test 集群请先: kubectl --kubeconfig=/root/.kube/k3s-test.yaml apply -f /data/k3s-test/manifests/secrets.yaml"
+  echo "  或: kubectl -n ${NS} get secret"
+  exit 1
+fi
 load_secret MYSQL_ROOT_PASSWORD prod-credentials MYSQL_ROOT_PASSWORD
 load_secret REDIS_PASSWORD prod-credentials REDIS_PASSWORD
 load_secret RABBITMQ_DEFAULT_PASS prod-credentials RABBITMQ_DEFAULT_PASS
@@ -134,7 +141,7 @@ load_secret JWT_SECRET_KEY jwt-secret JWT_SECRET_KEY
 # 兼容：JWT 也放在 prod-credentials
 load_secret JWT_SECRET_KEY prod-credentials JWT_SECRET_KEY
 
-: "${MYSQL_ROOT_PASSWORD:?缺少 MYSQL_ROOT_PASSWORD（env 或 secret/prod-credentials）}"
+: "${MYSQL_ROOT_PASSWORD:?缺少 MYSQL_ROOT_PASSWORD（env 或 secret/${NS}/prod-credentials）}"
 : "${REDIS_PASSWORD:?缺少 REDIS_PASSWORD}"
 : "${RABBITMQ_DEFAULT_PASS:?缺少 RABBITMQ_DEFAULT_PASS}"
 : "${ELASTIC_PASSWORD:?缺少 ELASTIC_PASSWORD}"