npm install -g @anthropic-ai/claude-code
claude auth login  # 按照提示完成网页授权

git clone https://github.com/dtzp555-max/ocp.git
cd ocp

$ ocp status
{
    "proxy": {
        "status": "ok",
        "version": "3.16.4",
        "uptime": "19h 9m",
        "auth": "ok",
        "activeSessions": 0
    },
    "requests": {
        "total": 26,
        "active": 0,
        "errors": 19,
        "timeouts": 1
    },
    "plan": "Usage API returned 401 with no rate-limit headers",
    "recentErrors": [
        {
            "time": "2026-05-15T02:55:44.482Z",
            "message": "Failed to authenticate. API Error: 401 Invalid authentication credentials\n"       # 底层的 Claude CLI 会话已经过期或被登出，重新登录 Claude Cli
        },
        {
            "time": "2026-05-15T02:55:49.181Z",
            "message": "Failed to authenticate. API Error: 401 Invalid authentication credentials\n"
        },
        {
            "time": "2026-05-15T02:55:54.932Z",
            "message": "Failed to authenticate. API Error: 401 Invalid authentication credentials\n"
        }
    ]
}

$ ocp status
{
    "proxy": {
        "status": "ok",
        "version": "3.16.4",
        "uptime": "19h 14m",
        "auth": "ok",
        "activeSessions": 0
    },
    "requests": {
        "total": 26,
        "active": 0,
        "errors": 19,
        "timeouts": 1
    },
    "plan": {
        "currentSession": {
            "utilization": 0,
            "percent": "0%",
            "resetsIn": "1h 27m",
            "resetsAt": "2026-05-15T07:30:00.000Z",
            "resetsAtHuman": "Fri, May 15, 7:30 AM"
        },
        "weeklyLimits": {
            "allModels": {
                "utilization": 0.06,
                "percent": "6%",
                "resetsIn": "4d 15h",
                "resetsAt": "2026-05-19T22:00:00.000Z",
                "resetsAtHuman": "Tue, May 19, 10:00 PM"
            }
        },
        "extraUsage": {
            "status": "rejected",
            "disabledReason": "org_level_disabled"
        },
        "representativeClaim": "five_hour",
        "fallbackPercentage": 0.5
    },
    "recentErrors": [
    ]
}

$ ocp usage
Plan Usage Limits
─────────────────────────────────────
  Current session       0% used
                      Resets in 1h 22m  (Fri, May 15, 7:30 AM)

  Weekly (all models)   6% used
                      Resets in 4d 15h  (Tue, May 19, 10:00 PM)

  Extra usage         off

Model Stats (since proxy start)
─────────────────────────────────────────────────────────────────────
  Model                      Reqs   OK  Err  Avg Time  Max Time  Avg Prompt  Max Prompt
  ─────────────────────────────────────────────────────────────────────────────────────
  claude-opus-4-6              26    7   20      185s      584s          1K          4K
  Total                        26

Proxy: up 19h 19m | 26 reqs | 0 active | 19 err | 1 timeout


$ ocp usage --by-key
No usage data yet.

$ ./ocp keys add external-system
 
✓ Key created for "external-system"
 
  API Key: ocp_ShecmDRElEW
 
  Copy this key now — you won't see it again.
  Configure in IDE: OPENAI_API_KEY=ocp_ShecmDRElEW

ocp usage --by-key

┌──────────────────────────────────────────────────────────────────────┐
│           Claude 操作浏览器的四大方案（按推荐度排序）                      │
├──────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  方案 A：Claude for Chrome (官方扩展)        ⭐⭐⭐⭐⭐  推荐主选       │
│         → 官方原生方案，最稳定                                          │
│                                                                      │
│  方案 B：Playwright MCP Server                ⭐⭐⭐⭐⭐  自动化首选   │
│         → 程序化控制，适合测试与脚本                                     │
│                                                                      │
│  方案 C：Chrome DevTools MCP                  ⭐⭐⭐⭐    调试场景     │
│         → 性能分析、网络抓包                                            │
│                                                                      │
│  方案 D：Computer Use API                     ⭐⭐⭐    通用桌面控制    │
│         → 适合复杂桌面应用，非纯浏览器                                    │
│                                                                      │
└──────────────────────────────────────────────────────────────────────┘

┌────────────────────────────────────────────────────────────────────┐
│                Claude for Chrome 核心能力矩阵                       │
├────────────────────────────────────────────────────────────────────┤
│                                                                    │
│  📖 内容读取                                                        │
│     ├─ 当前页面 DOM 内容                                            │
│     ├─ 控制台日志（Console errors/warnings）                        │
│     ├─ 网络请求（Network requests）                                 │
│     └─ 多 Tab 内容（拖入标签组）                                     │
│                                                                    │
│  🖱️  浏览器操作                                                     │
│     ├─ 点击按钮、链接                                                │
│     ├─ 填写表单、输入文本                                            │
│     ├─ 导航跳转、刷新                                                │
│     ├─ 滚动、截图                                                    │
│     └─ 切换标签页                                                    │
│                                                                    │
│  🔐 会话继承                                                        │
│     └─ 自动复用你浏览器的登录状态（Gmail/AWS Console/Jira 等）       │
│                                                                    │
│  🎬 工作流录制                                                      │
│     ├─ 录制操作序列作为 GIF                                          │
│     └─ 保存为可重复执行的 Shortcuts                                  │
│                                                                    │
│  ⏰ 定时调度                                                        │
│     └─ 每日/每周/每月自动运行                                        │
│                                                                    │
└────────────────────────────────────────────────────────────────────┘

your-project/
├── CLAUDE.md              # 项目级 Claude 上下文（必须），用于介绍项目背景、技术栈、代码规范等。
├── .claude/
│   ├── settings.json      # 项目级 Claude 设置
│   └── commands/          # 自定义 slash 命令，创建 Markdown 文件，就能定义你自己的命令
│       ├── deploy.md
│       └── rollback.md
├── .vscode/
│   ├── settings.json      # VS Code 工作区设置
│   └── extensions.json    # 推荐扩展列表
└── .gitignore

#!/usr/bin/env bash
# PreToolUse Hook —— 在 Claude 执行 Bash 命令前做深度安全校验
# 退出码 2 = 阻止执行；退出码 0 = 放行

set -euo pipefail

# Claude Code 通过 stdin 传入 JSON，包含工具调用信息
INPUT=$(cat)

# 提取实际要执行的命令（需要 jq）
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')

# 如果不是 Bash 命令，直接放行
if [[ -z "$COMMAND" ]]; then
  exit 0
fi

# ── 危险模式黑名单（正则）──────────────────────────────
# 这里检测的是"语义"，能抓住变形后的命令
DANGEROUS_PATTERNS=(
  '\brm\s+.*-[rf]'                    # rm -rf / rm -f（任意位置）
  '/bin/rm'                           # 绝对路径调用 rm
  '\bdd\s+'                           # dd 命令
  '\bmkfs'                            # 格式化
  '>\s*/(etc|usr|var|boot|bin|sbin)'  # 重定向覆盖系统目录
  '\bsudo\b'                          # 提权
  '\bsu\s'                            # 切换用户
  ':\(\)\s*\{.*\|.*&\s*\}'            # fork bomb
  '\bchmod\s+.*777'                   # 危险权限
  '\bsystemctl\s+(stop|restart|disable|mask)'
  '\b(kill|pkill|killall)\b'
  '\b(reboot|shutdown|halt|poweroff)\b'
  '\bkubectl\s+(delete|drain|apply|patch|scale|edit)'
  '\bhelm\s+(install|upgrade|uninstall|rollback|delete)'
  '\bterraform\s+(apply|destroy|import)'
  '\bdocker\s+(rm|rmi|stop|kill|prune)'
  '\b(mysql|psql|mongo|redis-cli)\b'  # 直连数据库
  'curl.*\|\s*(bash|sh)'              # curl | bash 远程执行
  'wget.*\|\s*(bash|sh)'
  'eval\s'                            # eval 动态执行
)

for pattern in "${DANGEROUS_PATTERNS[@]}"; do
  if echo "$COMMAND" | grep -qE "$pattern"; then
    # 输出到 stderr，Claude 会看到这个原因
    echo "🚫 安全拦截：命令匹配危险模式 [$pattern]" >&2
    echo "被拦截的命令：$COMMAND" >&2
    echo "如确需执行，请人工在终端手动操作。" >&2
    exit 2   # 退出码 2 = 阻止执行
  fi
done

# ── 生产环境主机名二次确认 ──────────────────────────
# 如果命令里包含生产环境标识，记录审计日志
if echo "$COMMAND" | grep -qiE 'prod|production'; then
  echo "$(date '+%Y-%m-%d %H:%M:%S') [PROD-CMD] $COMMAND" \
    >> ~/.claude/audit-prod.log
fi

# ── 全量审计日志 ────────────────────────────────────
echo "$(date '+%Y-%m-%d %H:%M:%S') $COMMAND" >> ~/.claude/audit-all.log

exit 0

chmod +x ~/projects/prod-ops/.claude/hooks/pretooluse-guard.sh

# kubectl create namespace argocd
namespace/argocd created

# kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml --server-side
customresourcedefinition.apiextensions.k8s.io/applications.argoproj.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/applicationsets.argoproj.io serverside-applied
customresourcedefinition.apiextensions.k8s.io/appprojects.argoproj.io serverside-applied
serviceaccount/argocd-application-controller serverside-applied
...
networkpolicy.networking.k8s.io/argocd-applicationset-controller-network-policy serverside-applied
networkpolicy.networking.k8s.io/argocd-dex-server-network-policy serverside-applied
networkpolicy.networking.k8s.io/argocd-notifications-controller-network-policy serverside-applied
networkpolicy.networking.k8s.io/argocd-redis-network-policy serverside-applied
networkpolicy.networking.k8s.io/argocd-repo-server-network-policy serverside-applied
networkpolicy.networking.k8s.io/argocd-server-network-policy serverside-applied

# kubectl get pods -n argocd
NAME                                               READY   STATUS    RESTARTS        AGE
argocd-application-controller-0                    1/1     Running   0               6m11s
argocd-applicationset-controller-77475dfcf-qzvsf   1/1     Running   1 (3m47s ago)   6m15s
argocd-dex-server-6485c5ddf5-4ms4f                 1/1     Running   0               6m14s
argocd-notifications-controller-758f795776-4n5rb   1/1     Running   0               6m14s
argocd-redis-6cc4bb5db5-svpwm                      1/1     Running   0               6m13s
argocd-repo-server-c76cf57cd-pv8sb                 1/1     Running   0               6m12s
argocd-server-6f85b59c87-zhmqh                     1/1     Running   0               6m12s

# kubectl apply -f argocd_ingress.yml 
ingress.networking.k8s.io/argocd configured

# kubectl get ingresses -A
NAMESPACE   NAME     CLASS   HOSTS                ADDRESS                                               PORTS   AGE
argocd      argocd   alb     argocd.example.com   k8s-argocd-argocd-8e8cb.ap-east-1.elb.amazonaws.com   80      8m22s

# curl -Iv 172.31.68.215:8080
> HEAD / HTTP/1.1
> Host: 172.31.68.215:8080
> User-Agent: curl/8.18.0
> Accept: */*
> 

HTTP/1.1 307 Temporary Redirect
Location: https://172.31.68.215:8080/

containers:
- args:
  - /usr/local/bin/argocd-server
  - --insecure

$ kubectl get pods -A
NAMESPACE     NAME                                               READY   STATUS    RESTARTS   AGE
argocd        argocd-server-6ff754765c-pt5z6                     0/1     Running   0          18s

kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath="{.data.password}" | base64 -d

kubectl apply -f argocd/bootstrap/root-app.yaml

# egrep -c '(vmx|svm)' /proc/cpuinfo
64

sudo apt update
sudo apt install -y qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virtinst virt-manager
sudo systemctl enable --now libvirtd

wget https://github.com/siderolabs/talos/releases/download/v1.14.0-alpha.0/metal-amd64.raw.zst

zstd -d metal-amd64.raw.zst

cp metal-amd64.raw /var/lib/libvirt/images/talos-control-plane-01.raw

# 建议稍微扩容一下，20G 比较稳妥
qemu-img resize /var/lib/libvirt/images/talos-control-plane-01.raw 20G

# 导入并运行虚拟机
virt-install \
  --name talos-control-plane-01 \
  --ram 4096 \
  --vcpus 4 \
  --disk path=/var/lib/libvirt/images/talos-control-plane-01.raw,bus=virtio \
  --os-variant ubuntu22.04 \
  --network network=default,model=virtio \
  --graphics none \
  --import \
  --boot hd \
  --console pty,target_type=serial

Starting install...
Allocating 'talos-control-plane-01.qcow2'                                                                                                            | 3.1 MB  00:00:00 ... 
Creating domain...                                                                                                                                   |    0 B  00:00:00     
Running text console command: virsh --connect qemu:///system console talos-control-plane-01
Connected to domain 'talos-control-plane-01'
Escape character is ^] (Ctrl + ])

# journalctl -u libvirtd -n 50 --no-pager
May 07 15:13:11 vp-jmpsvr systemd[1]: Starting Virtualization daemon...
May 07 15:13:11 vp-jmpsvr systemd[1]: Started Virtualization daemon.
May 07 15:13:12 vp-jmpsvr dnsmasq[417014]: started, version 2.90 cachesize 150
May 07 15:13:12 vp-jmpsvr dnsmasq[417014]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset no-nftset auth cryptohash DNSSEC loop-detect inotify dumpfile
May 07 15:13:12 vp-jmpsvr dnsmasq-dhcp[417014]: DHCP, IP range 192.168.122.2 -- 192.168.122.254, lease time 1h
May 07 15:13:12 vp-jmpsvr dnsmasq-dhcp[417014]: DHCP, sockets bound exclusively to interface virbr0
May 07 15:13:12 vp-jmpsvr dnsmasq[417014]: reading /etc/resolv.conf
May 07 15:13:12 vp-jmpsvr dnsmasq[417014]: using nameserver 8.8.8.8#53
May 07 15:13:12 vp-jmpsvr dnsmasq[417014]: using nameserver 114.114.114.114#53
May 07 15:13:12 vp-jmpsvr dnsmasq[417014]: read /etc/hosts - 3 names
May 07 15:13:12 vp-jmpsvr dnsmasq[417014]: read /var/lib/libvirt/dnsmasq/default.addnhosts - 0 names
May 07 15:13:12 vp-jmpsvr dnsmasq-dhcp[417014]: read /var/lib/libvirt/dnsmasq/default.hostsfile
May 07 17:20:03 vp-jmpsvr libvirtd[416897]: libvirt version: 8.0.0, package: 1ubuntu7.16 (Hector Cao <[email protected]> Wed, 04 Feb 2026 11:49:12 +0100)
May 07 17:20:03 vp-jmpsvr libvirtd[416897]: hostname: vp-jmpsvr
May 07 17:20:03 vp-jmpsvr libvirtd[416897]: Unable to read from monitor: Connection reset by peer
May 07 17:20:03 vp-jmpsvr libvirtd[416897]: internal error: qemu unexpectedly closed the monitor: 2026-05-07T09:20:03.828580Z qemu-system-x86_64: -append only allowed with -kernel option
May 07 17:20:03 vp-jmpsvr libvirtd[416897]: internal error: process exited while connecting to monitor: 2026-05-07T09:20:03.828580Z qemu-system-x86_64: -append only allowed with -kernel option

# virsh list --all
 Id   Name                     State
----------------------------------------
 1    talos-control-plane-01   running

virsh net-dhcp-leases default

virsh destroy talos-control-plane-01
virsh undefine talos-control-plane-01

# virsh console 1
Connected to domain 'talos-control-plane-01'
Escape character is ^] (Ctrl + ])

# virsh net-list
 Name      State    Autostart   Persistent
--------------------------------------------
 default   active   yes         yes

virsh net-dhcp-leases default

sudo dnf install -y yum-utils

sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo

sudo dnf install -y terraform

$ terraform version
Terraform v1.15.2
on linux_amd64

$ aws sts get-caller-identity
{
    "UserId": "AIDA2H52UFCAOSDMJBUX6",
    "Account": "<AWS_ACCOUNT_ID>",
    "Arn": "arn:aws:iam::<AWS_ACCOUNT_ID>:user/ops"
}

$ tree 
.
├── main.tf         # Terraform 主入口，调用其他模块
├── variables.tf    # 定义变量，用于在 Terraform 中使用动态值
├── providers.tf    # 定义 AWS 提供商
├── versions.tf     # 定义 AWS 提供商的版本
├── vpc.tf          # 定义 VPC 模块，用于创建 AWS VPC
├── eks.tf          # 定义 EKS 模块，用于创建 AWS EKS 集群
├── aws-alb.tf      # 定义 ALB 模块，用于创建 AWS ALB
├── efs.tf          # 定义 EFS 模块，用于创建 AWS EFS 文件系统
└── outputs.tf      # 定义输出，用于在 Terraform 中使用资源 ID

variable "aws_region" {
  default = "ap-east-1"
}

variable "eks_cluster_name" {
  default = "eks-6992-hk-uat"
}

variable "eks_cluster_version" {
  default = "1.35"
}

provider "aws" {
  region = var.aws_region
}

provider "helm" {
  kubernetes {
    host                   = module.eks-6992-hk-uat.cluster_endpoint
    cluster_ca_certificate = base64decode(module.eks-6992-hk-uat.cluster_certificate_authority_data)

    # 确保 exec 块语法正确
    exec {
      api_version = "client.authentication.k8s.io/v1beta1"
      args        = ["eks", "get-token", "--cluster-name", module.eks-6992-hk-uat.cluster_name]
      command     = "aws"
    }
  }
}

provider "kubernetes" {
  host = module.eks-6992-hk-uat.cluster_endpoint

  cluster_ca_certificate = base64decode(
    module.eks-6992-hk-uat.cluster_certificate_authority_data
  )

  exec {
    api_version = "client.authentication.k8s.io/v1beta1"

    command = "aws"

    args = [
      "eks",
      "get-token",
      "--cluster-name",
      module.eks-6992-hk-uat.cluster_name
    ]
  }
}

terraform {
  required_version = ">= 1.15"          # 锁定 Terraform 版本

  required_providers {             # 锁定 AWS 提供商版本
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.50"
    }
    helm = {
      source  = "hashicorp/helm"
      version = "~> 2.15"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.29"
    }
  }
}

module "eks-6992-hk-uat-vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.8.1"

  name = "${var.eks_cluster_name}-vpc"     # VPC 名称

  cidr = "10.0.0.0/16"

  azs = [                                  # 跨三个可用区以实现高可用
    "${var.aws_region}a",
    "${var.aws_region}b",
    "${var.aws_region}c"
  ]

  private_subnets = [                      # Private Subnets，节点实例和工作节点实例位于 Private Subnets 中的可用区
    "10.0.1.0/24",
    "10.0.2.0/24",
    "10.0.3.0/24"
  ]

  public_subnets = [                      # Public Subnets, ALB/NAT Gateway 必须位于 Public Subnets 中的可用区
    "10.0.101.0/24",
    "10.0.102.0/24",
    "10.0.103.0/24"
  ]

  enable_nat_gateway = true                # 启用 NAT Gateway, 用于节点实例和工作节点实例访问互联网

  single_nat_gateway = true                # 启用单 NAT Gateway, 用于节点实例和工作节点实例访问互联网， NAT Gateway 数量为 1，省钱模式

  enable_dns_hostnames = true              # 启用 DNS 主机名，用于节点实例和工作节点实例的 DNS 解析
  enable_dns_support = true                # 启用 DNS 支持，用于节点实例和工作节点实例的 DNS 解析
  
  # 关键：EKS 自动发现子网所需的标签。为了让 EKS 自动识别哪些子网用于存放负载均衡器，哪些用于存放 Pod，你需要确保子网拥有正确的标签（只有共有子网可忽略此配置）
  public_subnet_tags = {
    "kubernetes.io/role/elb" = 1
  }
  private_subnet_tags = {
    "kubernetes.io/role/internal-elb" = 1
  }    
}

module "eks-6992-hk-uat" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.28"

  cluster_name    = var.eks_cluster_name           # EKS 集群名称
  cluster_version = var.eks_cluster_version        # 指定 K8s 版本

  vpc_id     = module.eks-6992-hk-uat-vpc.vpc_id                     # VPC ID，用于创建 EKS 集群的 VPC ID
  subnet_ids = module.eks-6992-hk-uat-vpc.private_subnets            # Private Subnets，节点实例和工作节点实例位于 Private Subnets 中的可用区   

  
  cluster_endpoint_public_access = true                # 启用集群端点访问（API Server），用于外部访问 EKS 集群

  # 托管节点组配置（Managed Node Groups）。使用 AWS Auto Scaling Group (ASG)，需要在集群中安装 Cluster Autoscaler 来自动调整节点实例数量。当发现 Pod 因为资源不足无法调度时，它会去修改 AWS ASG 的 desired_size 来增加节点实例数量。
  # 建议 切换到 EKS Auto Mode (2024年底发布的新模式)，EKS Auto Mode 是 AWS 提供的“完全代管”体验。它将 Karpenter、EBS 驱动、CNI 等全部内置并由 AWS 直接管理。
    #   eks_managed_node_groups = {
    #     default = {
    #       instance_types = ["t3.large"]
    #       min_size     = 1
    #       max_size     = 5
    #       desired_size = 2
    #       disk_size = 100                              # 节点实例和工作节点实例的 EBS 卷大小，单位为 GiB
    #     }
    #   }
  # 关键：开启 EKS Auto Mode 配置
  cluster_compute_config = {
    enabled    = true
    node_pools = ["general-purpose", "system"] 
  }

  
  # 必须：Auto Mode 下不需要手动引导插件
  bootstrap_self_managed_addons = false

  # 自动模式下，建议让模块处理节点所需的 IAM Role 权限
  # Auto Mode 节点需要能够与 EKS 控制面通信的权限  
  enable_cluster_creator_admin_permissions = true        # 启用集群创建者管理员权限，用于集群创建者对 EKS 集群进行管理

  # 关闭 CloudWatch 日志输出以节省成本
  cluster_enabled_log_types = []
}

module "alb_controller_irsa_role" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
  version = "~> 5.39"

  role_name = "${var.eks_cluster_name}-alb-controller"

  attach_load_balancer_controller_policy = true

  oidc_providers = {
    main = {
      provider_arn = module.eks-6992-hk-uat.oidc_provider_arn

      namespace_service_accounts = [
        "kube-system:aws-load-balancer-controller"
      ]
    }
  }
}

# 2. 使用 Helm 部署控制器

resource "helm_release" "aws_load_balancer_controller" {
  name       = "aws-load-balancer-controller"
  repository = "https://aws.github.io/eks-charts"
  chart      = "aws-load-balancer-controller"
  namespace  = "kube-system"
  version    = "1.14.0" # 建议检查最新版本

  set {
    name  = "clusterName"
    value = module.eks-6992-hk-uat.cluster_name
  }
  # --- 新增以下两项以解决 VPC ID 获取失败的问题 ---
  set {
    name  = "vpcId"
    value = module.eks-6992-hk-uat-vpc.vpc_id
  }

  set {
    name  = "region"
    value = var.aws_region
  }
  # ----------------------------------------------

  set {
    name  = "serviceAccount.create"
    value = "true"
  }

  set {
    name  = "serviceAccount.name"
    value = "aws-load-balancer-controller"
  }

  set {
    name  = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
    value = module.alb_controller_irsa_role.iam_role_arn
  }
}

resource "aws_efs_file_system" "eks_efs" {
  creation_token = "${var.eks_cluster_name}-efs"

  performance_mode = "generalPurpose"
  throughput_mode  = "bursting"

  encrypted = true

  tags = {
    Name = "${var.eks_cluster_name}-efs"
  }
}

# EFS 必须在每个 Private Subnet 创建 Mount Target。
resource "aws_efs_mount_target" "private" {
  count = length(module.eks-6992-hk-uat-vpc.private_subnets)

  file_system_id  = aws_efs_file_system.eks_efs.id
  subnet_id       = module.eks-6992-hk-uat-vpc.private_subnets[count.index]

  security_groups = [
    aws_security_group.efs.id
  ]
}

# EFS 安全组
resource "aws_security_group" "efs" {
  name_prefix = "${var.eks_cluster_name}-efs-sg"

  vpc_id = module.eks-6992-hk-uat-vpc.vpc_id

  ingress {
    from_port   = 2049
    to_port     = 2049
    protocol    = "tcp"

    cidr_blocks = ["10.0.0.0/16"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"

    cidr_blocks = ["0.0.0.0/0"]
  }
}

# 创建 IAM Role（IRSA）
module "efs_csi_irsa_role" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
  version = "~> 5.39"

  role_name = "${var.eks_cluster_name}-efs-csi"

  attach_efs_csi_policy = true

  oidc_providers = {
    main = {
      provider_arn = module.eks-6992-hk-uat.oidc_provider_arn

      namespace_service_accounts = [
        "kube-system:efs-csi-controller-sa"
      ]
    }
  }
}

resource "helm_release" "aws_efs_csi_driver" {
  name       = "aws-efs-csi-driver"

  repository = "https://kubernetes-sigs.github.io/aws-efs-csi-driver/"
  chart      = "aws-efs-csi-driver"

  namespace  = "kube-system"


  set {
    name  = "controller.serviceAccount.create"
    value = "true"
  }

  set {
    name  = "controller.serviceAccount.name"
    value = "efs-csi-controller-sa"
  }

  set {
    name  = "controller.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"

    value = module.efs_csi_irsa_role.iam_role_arn
  }
}

# 创建 StorageClass
resource "kubernetes_storage_class" "efs" {
  metadata {
    name = "efs-sc"
  }

  storage_provisioner = "efs.csi.aws.com"

  parameters = {
    provisioningMode = "efs-ap"

    fileSystemId = aws_efs_file_system.eks_efs.id

    directoryPerms = "700"

    gidRangeStart = "1000"
    gidRangeEnd   = "2000"

    basePath = "/dynamic_provisioning"
  }

  reclaim_policy      = "Retain"

  volume_binding_mode = "Immediate"
}

$ terraform init
Initializing modules...
Downloading registry.terraform.io/terraform-aws-modules/vpc/aws 5.8.1 for eks-6992-hk-uat-vpc...
- eks-6992-hk-uat-vpc in .terraform/modules/eks-6992-hk-uat-vpc
...
Initializing the backend...


Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

$ terraform plan
╷
│ Error: Reference to undeclared module
│ 
│   on eks.tf line 8, in module "eks-6992-hk-uat":
│    8:   vpc_id     = module.vpc.vpc_id                     # VPC ID，用于创建 EKS 集群的 VPC ID
│ 
│ No module call named "vpc" is declared in the root module.
╵
╷
│ Error: Reference to undeclared module
│ 
│   on eks.tf line 9, in module "eks-6992-hk-uat":
│    9:   subnet_ids = module.vpc.private_subnets            # Private Subnets，节点实例和工作节点实例位于 Private Subnets 中的可用区   
│ 
│ No module call named "vpc" is declared in the root module.
╵

sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=disabled/' /etc/selinux/config

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:368]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT

# kubernetes nodes
-A INPUT -m comment --comment "kubernetes nodes" -s 172.31.5.58 -j ACCEPT
-A INPUT -m comment --comment "kubernetes nodes" -s 172.31.5.68 -j ACCEPT
-A INPUT -m comment --comment "kubernetes nodes" -s 172.31.0.230 -j ACCEPT

-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT -m comment --comment "k8s ingress http,https"


...

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

helm upgrade minio minio/minio   -n minio   -f values.yaml

kubectl apply -f console-ingress.yaml

sudo apt update 
sudo apt install nfs-kernel-server -y

sudo mkdir -p /data/nfs/nacos 

sudo chown nobody:nogroup /data/nfs/nacos 
sudo chmod 777 /data/nfs/nacos

sudo nano /etc/exports

/data/nfs/nacos  192.168.1.0/24(rw,sync,no_subtree_check,no_root_squash)

sudo exportfs -a 
sudo systemctl restart nfs-kernel-server

sudo apt install nfs-common -y

helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/ 

helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
     --set nfs.server=192.168.1.100 \
     --set nfs.path=/data/nfs/nacos \
     --set storageClass.name=nfs-storage \
     --set storageClass.defaultClass=true