ci(Jenkinsfile): 更新部署配置和变量引用方式

- 将默认命名空间改为 portal-frontend
- 统一使用 env 变量前缀引用环境变量
- 改进 Kubernetes 部署逻辑，支持 TLS 和更完善的错误处理
- 优化镜像清理和保留策略触发流程

Jenkinsfile

@@ -3,7 +3,7 @@ pipeline {
 
     parameters {
         choice(name: 'env', choices: ['dev', 'test', 'prod'], description: '部署环境')
-        string(name: 'NAMESPACE', defaultValue: 'hfln-dev', description: 'K8s 命名空间')
+        string(name: 'NAMESPACE', defaultValue: 'portal-frontend', description: 'K8s 命名空间')
         string(name: 'DOMAIN', defaultValue: '', description: 'Ingress 域名（留空则不创建 Ingress）')
     }
 
@@ -25,8 +25,9 @@ pipeline {
             steps {
                 script {
                     env.HARBOR_PROJECT = params.env
-                    env.IMAGE_TAG = "${HARBOR_HOST}/${env.HARBOR_PROJECT}/${PROJECT_NAME}:${BUILD_NUMBER}"
+                    env.IMAGE_TAG = "${env.HARBOR_HOST}/${env.HARBOR_PROJECT}/${env.PROJECT_NAME}:${BUILD_NUMBER}"
                     echo ">>> 环境：${params.env}, Harbor项目：${env.HARBOR_PROJECT}, K8s命名空间：${params.NAMESPACE}"
+                    echo ">>> IMAGE_TAG = ${env.IMAGE_TAG}"
                 }
             }
         }
@@ -42,10 +43,10 @@ pipeline {
             steps {
                 script {
                     sh """
-                        docker login -u ${HARBOR_USER} -p ${HARBOR_PASS} ${HARBOR_HOST}
-                        docker build --build-arg ENV=${params.env} -t ${IMAGE_TAG} .
+                        docker login -u ${env.HARBOR_USER} -p ${env.HARBOR_PASS} ${env.HARBOR_HOST}
+                        docker build --build-arg ENV=${params.env} -t ${env.IMAGE_TAG} .
                     """
-                    echo "✅ 镜像构建成功：${IMAGE_TAG}"
+                    echo "✅ 镜像构建成功：${env.IMAGE_TAG}"
                 }
             }
         }
@@ -54,8 +55,8 @@ pipeline {
             steps {
                 script {
                     sh """
-                        docker push ${IMAGE_TAG}
-                        docker rmi ${IMAGE_TAG}
+                        docker push ${env.IMAGE_TAG}
+                        docker rmi ${env.IMAGE_TAG} || true
                     """
                     echo "✅ 镜像推送并本地清理完成"
                 }
@@ -66,27 +67,35 @@ pipeline {
             steps {
                 script {
                     echo ">>> 测试节点能否拉取镜像..."
+                    // 注意：确保 Jenkins 节点能免密 SSH 到这些节点，或将这一步改为跳过
                     sh """
-                        ssh root@${NODE1_IP} docker login -u ${HARBOR_USER} -p ${HARBOR_PASS} ${HARBOR_HOST} && docker pull ${IMAGE_TAG} || echo '[❌ 节点 node1 拉取失败]'
-                        ssh root@${NODE2_IP} docker login -u ${HARBOR_USER} -p ${HARBOR_PASS} ${HARBOR_HOST} && docker pull ${IMAGE_TAG} || echo '[❌ 节点 node2 拉取失败]'
+                        ssh root@${env.NODE1_IP} docker login -u ${env.HARBOR_USER} -p ${env.HARBOR_PASS} ${env.HARBOR_HOST} && docker pull ${env.IMAGE_TAG} || echo '[❌ 节点 ${env.NODE1_IP} 拉取失败]'
+                        ssh root@${env.NODE2_IP} docker login -u ${env.HARBOR_USER} -p ${env.HARBOR_PASS} ${env.HARBOR_HOST} && docker pull ${env.IMAGE_TAG} || echo '[❌ 节点 ${env.NODE2_IP} 拉取失败]'
                     """
                 }
             }
         }
 
-        stage('�� Kubernetes 部署') {
+        stage('📦 部署到 Kubernetes') {
             steps {
                 script {
-                    def domain = params.DOMAIN.trim()
-                    def ingressBlock = domain ? """
----
+                    def domain = params.DOMAIN?.trim()
+                    // 组装 ingress 块（如果 domain 非空）
+                    def ingressBlock = ''
+                    if (domain) {
+                        ingressBlock = """---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: ${PROJECT_NAME}
+  name: ${env.PROJECT_NAME}
+  namespace: ${params.NAMESPACE}
   annotations:
     nginx.ingress.kubernetes.io/rewrite-target: /
 spec:
+  tls:
+  - hosts:
+    - ${domain}
+    secretName: portal-tls
   rules:
   - host: ${domain}
     http:
@@ -95,41 +104,31 @@ spec:
         pathType: Prefix
         backend:
           service:
-            name: ${PROJECT_NAME}
+            name: ${env.PROJECT_NAME}
             port:
               number: 80
-""" : ""
-
-                    echo ">>> 开始部署至 Kubernetes 命名空间：${params.NAMESPACE}"
-
-                    sh """
-                        export KUBECONFIG=${KUBECONFIG_PATH}
-                        kubectl get ns ${params.NAMESPACE} || kubectl create ns ${params.NAMESPACE}
+"""
+                    }
 
-                        # 检查Deployment是否存在
-                        if kubectl get deployment ${PROJECT_NAME} -n ${params.NAMESPACE} >/dev/null 2>&1; then
-                            echo ">>> Deployment已存在，更新镜像..."
-                            kubectl set image deployment/${PROJECT_NAME} ${PROJECT_NAME}=${IMAGE_TAG} -n ${params.NAMESPACE}
-                        else
-                            echo ">>> Deployment不存在，创建新的Deployment..."
-                            kubectl apply -n ${params.NAMESPACE} -f - <<EOF
-apiVersion: apps/v1
+                    // 生成完整 deploy.yaml 内容
+                    def deployYaml = """apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: ${PROJECT_NAME}
+  name: ${env.PROJECT_NAME}
+  namespace: ${params.NAMESPACE}
 spec:
   replicas: 2
   selector:
     matchLabels:
-      app: ${PROJECT_NAME}
+      app: ${env.PROJECT_NAME}
   template:
     metadata:
       labels:
-        app: ${PROJECT_NAME}
+        app: ${env.PROJECT_NAME}
     spec:
       containers:
-      - name: ${PROJECT_NAME}
-        image: ${IMAGE_TAG}
+      - name: ${env.PROJECT_NAME}
+        image: ${env.IMAGE_TAG}
         ports:
         - containerPort: 80
         env:
@@ -139,24 +138,31 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: ${PROJECT_NAME}
+  name: ${env.PROJECT_NAME}
+  namespace: ${params.NAMESPACE}
 spec:
   type: NodePort
   selector:
-    app: ${PROJECT_NAME}
+    app: ${env.PROJECT_NAME}
   ports:
   - port: 80
     targetPort: 80
     nodePort: 30088
 ${ingressBlock}
-EOF
-                        fi
+"""
+
+                    writeFile file: 'deploy.yaml', text: deployYaml
+                    sh """
+                        export KUBECONFIG=${env.KUBECONFIG_PATH}
+                        kubectl get ns ${params.NAMESPACE} >/dev/null 2>&1 || kubectl create ns ${params.NAMESPACE}
+                        kubectl apply -f deploy.yaml
+                        kubectl rollout status deployment/${env.PROJECT_NAME} -n ${params.NAMESPACE} --timeout=120s || echo '[rollout timeout or incomplete]'
                     """
 
                     if (domain) {
-                        echo ">>> ✅ 部署完成，访问地址：http://${domain}/"
+                        echo ">>> ✅ 部署完成（含 Ingress），访问地址：https://${domain}/ （请确保 DNS 已指向 Ingress 公网 IP 且 secret portal-tls 已创建）"
                     } else {
-                        echo ">>> ✅ 部署完成，访问地址：http://${NODE1_IP}:30088/"
+                        echo ">>> ✅ 部署完成（NodePort），访问地址：http://${env.NODE1_IP}:30088/ 或 http://${env.NODE2_IP}:30088/"
                     }
                 }
             }
@@ -165,7 +171,7 @@ EOF
         stage('🧹 清理本地旧镜像（保留最新3个）') {
             steps {
                 script {
-                    def baseImage = "${HARBOR_HOST}/${env.HARBOR_PROJECT}/${PROJECT_NAME}"
+                    def baseImage = "${env.HARBOR_HOST}/${env.HARBOR_PROJECT}/${env.PROJECT_NAME}"
                     sh """
                         docker images ${baseImage} --format "{{.Repository}}:{{.Tag}}" \\
                         | grep -v latest \\
@@ -178,7 +184,7 @@ EOF
             }
         }
 
-        stage('�� 清理悬空镜像 <none>') {
+        stage('🧼 清理 dangling 镜像') {
             steps {
                 script {
                     sh """
@@ -189,14 +195,13 @@ EOF
             }
         }
 
-        stage('�� 触发 Harbor 镜像保留策略') {
+        stage('🔁 触发 Harbor 镜像保留策略（可选）') {
             steps {
                 script {
                     sh """
-                        curl -u ${HARBOR_USER}:${HARBOR_PASS} -X POST \\
-                        "http://${HARBOR_HOST}/api/v2.0/retentions/${HARBOR_RETENTION_ID}/executions"
+                        curl -u ${env.HARBOR_USER}:${env.HARBOR_PASS} -X POST "http://${env.HARBOR_HOST}/api/v2.0/retentions/${env.HARBOR_RETENTION_ID}/executions" || echo '[retention trigger failed]'
                     """
-                    echo "✅ Harbor 镜像保留策略已触发"
+                    echo "✅ Harbor 镜像保留策略已触发（若配置）"
                 }
             }
         }
@@ -204,7 +209,7 @@ EOF
 
     post {
         success {
-            echo "✅ 构建 & 部署成功 ��"
+            echo "✅ 构建 & 部署成功 🎉"
         }
         failure {
             echo "❌ 构建或部署失败，请检查日志"
@@ -213,4 +218,4 @@ EOF
             cleanWs()
         }
     }
-}
+}