权限升级为rbac模型

CHANGELOG/README.md

@@ -5,3 +5,4 @@
 - [CHANGELOG-1.12.md](./CHANGELOG-1.12.md)
 - [CHANGELOG-1.13.md](./CHANGELOG-1.13.md)
 - [CHANGELOG-1.14.md](./CHANGELOG-1.14.md)
+- [CHANGELOG-2.0.md](./CHANGELOG-2.0.md)

helm-charts/core/ci/base/default_env.yaml

@@ -44,6 +44,7 @@ bkCiNotifyEmailSendChannel: blueking
 bkCiInitLocale: zh-CN
 bkCiRedisSsl: false
 bkCiEsHttps: false
+bkCiFrontendIndex: "rewrite .* /$subsystem/index.html break"
 bkCiDefaultLocale: zh_CN
 bkCiSupportLanguages: zh_CN,en_US
 bkEsbEnabled: false

helm-charts/core/ci/base/values.yaml

@@ -138,7 +138,7 @@ mysql:
       collation-server=utf8_general_ci
       max_connections=2000
       default-time-zone='+08:00'
-      sql_mode=STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
+      sql_mode=STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION
       [client]
       port=3306
       socket=/opt/bitnami/mysql/tmp/mysql.sock

helm-charts/core/ci/templates/init/init.bkrepo.yaml

@@ -89,6 +89,19 @@ spec:
                   curl -s -X PUT $REPO_INIT_GENERIC_METADATA_PATH/bk-store/static/file/$k -u {{ .Values.config.bkRepoUsername }}:{{ .Values.config.bkRepoPassword }} -H \"X-BKREPO-UID: {{ .Values.config.bkRepoUsername }}\" -H \"X-BKREPO-OVERWRITE: true\" --upload-file ${k}
                   echo -e ""
               done
+
+              # 打开制品库入口
+              services="project"
+              for service in $services
+              do
+                until curl --connect-timeout 3 -m 1 -s "http://{{ include "bkci.names.fullname" . }}-$service.{{ .Release.Namespace }}.svc.cluster.local" > nohup
+                do 
+                  echo "waiting for {{ include "bkci.names.fullname" . }}-$service";
+                  sleep 2;
+                done
+                echo "{{ include "bkci.names.fullname" . }}-$service is available";
+              done
+              curl -X PUT --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'X-DEVOPS-UID: admin' -d '{"showProjectList": true,"showNav": true,"status": "ok","deleted": false,"iframeUrl": "http://{{ .Values.config.bkRepoHost }}/ui/"}' "http://{{ include "bkci.names.fullname" . }}-project.{{ .Release.Namespace }}/api/op/services/update/Repo"
       restartPolicy: Never
 {{- end -}}
 {{- end -}}

helm-charts/core/ci/templates/init/init.iam-rbac.yaml

@@ -17,57 +17,39 @@ spec:
       labels: {{- include "bkci.labels.standard" . | nindent 8 }}
         app.kubernetes.io/component: init-iam
     spec:
-      {{- if .Values.mysql.enabled }}
-      initContainers:
-        - name: wait-for-mysql
-          image: {{ include "common.images.image" ( dict "imageRoot" .Values.backendImage "global" .Values.global) }}
-          imagePullPolicy: {{ .Values.backendImage.pullPolicy }}
-          command:
-            - "/bin/sh"
-            - "-c"
-            - |
-              until getent hosts {{ include "bkci.mysql.fullname" . }}
-              do
-                echo waiting for {{ include "bkci.mysql.fullname" . }};
-                sleep 2;
-              done
-              echo "MySQL is available";
-      {{- end }}
       containers:
         - name: init-iam
           image: {{ include "bkci-backend.image" . }}
           imagePullPolicy: {{ .Values.backendImage.pullPolicy }}
-          workingDir: /data/workspace/support-files/bkiam-rbac
-          {{ $mysqlData := split ":" (include "bkci.mysqlAddr" .) }}
+          workingDir: /data/workspace/support-files/
           command:
             - "/bin/bash"
             - "-c"
             - |
               # 修改auth链接
-              sed -i 's/ci-auth.service.consul:21936/{{- .Values.config.bkCiHost -}}\/auth/g' *.json
+              sed -i 's/ci-auth.service.consul:21936/{{- .Values.config.bkCiHost -}}\/auth/g' bkiam-rbac/*.json
               # 导入模型
               for i in $(find . -name '*.json'|sort)
               do
                python3 do_migrate.py -t {{ .Values.config.bkCiIamApigwUrl }} -a "{{ .Values.config.bkCiAppCode }}" -s "{{ .Values.config.bkCiAppToken }}" -f  $i --apigateway
               done
-              # 导入数据库
-              cat << EOF > iam.sql
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (1,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/process/api/open/pipeline/callback/", "pipeline", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (2,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/repository/api/open/repository/callback/", "repertory", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (3,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/ticket/api/open/ticket/callback/credential/", "credential", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (4,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/ticket/api/open/ticket/callback/cert/", "cert", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (5,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/environment/api/open/environment/callback/env/", "environment", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (6,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/environment/api/open/environment/callback/node/", "env_node", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (7,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/quality/api/open/quality/callback/rule", "rule", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (8,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/quality/api/open/quality/callback/group", "quality_group", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (11,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/project/api/open/project/callback/", "project", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (12,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/process/api/open/pipeline/callback/pipelineGroupInfo", "pipeline_group", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (13,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/process/api/open/pipeline/callback/pipelineTemplateInfo", "pipeline_template", "ci");
-              {{- if ne .Values.config.bkCodeccPrivateUrl "" }}
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (13,"{{ .Values.config.bkCodeccPrivateUrl }}", "/ms/openapi/api/open/v2/callback/instances/list", "codecc_task", "codecc");
-              {{- end }}
-              EOF
-              mysql -u{{- include "bkci.mysqlUsername" . }} -p{{- include "bkci.mysqlPassword" . }} -h{{ $mysqlData._0 }} -P{{ $mysqlData._1 }} devops_ci_auth < iam.sql;
+
+              services="auth"
+              for service in $services
+              do
+                until curl --connect-timeout 3 -m 1 -s "http://{{ include "bkci.names.fullname" . }}-$service.{{ .Release.Namespace }}.svc.cluster.local" > nohup
+                do 
+                  echo "waiting for {{ include "bkci.names.fullname" . }}-$service";
+                  sleep 2;
+                done
+                echo "{{ include "bkci.names.fullname" . }}-$service is available";
+              done
+
+              # 注册auth回调
+              echo "{{ include "bkci.names.fullname" . }}-auth is available";
+              sed -i 's/bk-ci.service.consul/{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}/g' ms-init/auth/iam-callback-resource-registere.conf
+              iam_json_file="ms-init/auth/iam-callback-resource-registere.conf"
+              curl -X POST -H "Content-Type:application/json" -d "@$iam_json_file" "http://{{ include "bkci.names.fullname" . }}-auth.{{ .Release.Namespace }}.svc.cluster.local/api/op/auth/iam/callback/" 
       restartPolicy: OnFailure
 {{- end -}}
 {{- end -}}

helm-charts/core/ci/templates/init/init.iam.yaml

@@ -17,52 +17,40 @@ spec:
       labels: {{- include "bkci.labels.standard" . | nindent 8 }}
         app.kubernetes.io/component: init-iam
     spec:
-      {{- if .Values.mysql.enabled }}
-      initContainers:
-        - name: wait-for-mysql
-          image: {{ include "common.images.image" ( dict "imageRoot" .Values.backendImage "global" .Values.global) }}
-          imagePullPolicy: {{ .Values.backendImage.pullPolicy }}
-          command:
-            - "/bin/sh"
-            - "-c"
-            - |
-              until getent hosts {{ include "bkci.mysql.fullname" . }}
-              do 
-                echo waiting for {{ include "bkci.mysql.fullname" . }};
-                sleep 2;
-              done
-              echo "MySQL is available";
-      {{- end }}
       containers:
         - name: init-iam
           image: {{ include "bkci-backend.image" . }}
           imagePullPolicy: {{ .Values.backendImage.pullPolicy }}
-          workingDir: /data/workspace/support-files/bkiam
+          workingDir: /data/workspace/support-files/
           {{ $mysqlData := split ":" (include "bkci.mysqlAddr" .) }}
           command:
             - "/bin/bash"
             - "-c"
             - |
               # 修改auth链接
-              sed -i 's/ci-auth.service.consul:21936/{{- .Values.config.bkCiHost -}}\/auth/g' *.json
+              sed -i 's/ci-auth.service.consul:21936/{{- .Values.config.bkCiHost -}}\/auth/g' bkiam/*.json
               # 导入模型
               for i in $(find . -name '*.json'|sort)
               do
                python3 bkiam_do_migrate.py -t {{ .Values.config.bkIamPrivateUrl }} -a "{{ .Values.config.bkCiAppCode }}" -s "{{ .Values.config.bkCiAppToken }}" -f  $i
               done
-              # 导入数据库
-              cat << EOF > iam.sql
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (1,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/process/api/open/pipeline/callback/", "pipeline", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (2,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/repository/api/open/repository/callback/", "repertory", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (3,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/ticket/api/open/ticket/callback/credential/", "credential", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (4,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/ticket/api/open/ticket/callback/cert/", "cert", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (5,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/environment/api/open/environment/callback/env/", "environment", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (6,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/environment/api/open/environment/callback/node/", "env_node", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (7,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/quality/api/open/quality/callback/rule", "rule", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (8,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/quality/api/open/quality/callback/group", "quality_group", "ci");
-              INSERT IGNORE INTO T_AUTH_IAM_CALLBACK (ID,GATEWAY,PATH, RESOURCE,SYSTEM) VALUES (11,"http://{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}", "/ms/project/api/open/project/callback/", "project", "ci");
-              EOF
-              mysql -u{{- include "bkci.mysqlUsername" . }} -p{{- include "bkci.mysqlPassword" . }} -h{{ $mysqlData._0 }} -P{{ $mysqlData._1 }} devops_ci_auth < iam.sql;
+
+              services="auth"
+              for service in $services
+              do
+                until curl --connect-timeout 3 -m 1 -s "http://{{ include "bkci.names.fullname" . }}-$service.{{ .Release.Namespace }}.svc.cluster.local" > nohup
+                do 
+                  echo "waiting for {{ include "bkci.names.fullname" . }}-$service";
+                  sleep 2;
+                done
+                echo "{{ include "bkci.names.fullname" . }}-$service is available";
+              done
+
+              # 注册auth回调
+              echo "{{ include "bkci.names.fullname" . }}-auth is available";
+              sed -i 's/bk-ci.service.consul/{{ include "bkci.names.fullname" . }}-gateway.{{ .Release.Namespace }}/g' ms-init/auth/iam-callback-resource-registere.conf
+              iam_json_file="ms-init/auth/iam-callback-resource-registere.conf"
+              curl -X POST -H "Content-Type:application/json" -d "@$iam_json_file" "http://{{ include "bkci.names.fullname" . }}-auth.{{ .Release.Namespace }}.svc.cluster.local/api/op/auth/iam/callback/" 
       restartPolicy: OnFailure
 {{- end -}}
 {{- end -}}

scripts/bk-ci-setup.sh

@@ -170,7 +170,7 @@ setup_ci__ms_service_env (){
   env_line_append "$service_env" "CLASSPATH" ".:lib/*"
   env_line_append "$service_env" "SPRING_CONFIG_LOCATION" "file:./application.yml"
   env_line_append "$service_env" "SPRING_CLOUD_CONFIG_ENABLED" false
-  env_line_append "$service_env" "JAVA_TOOL_OPTIONS" "-Djava.security.egd=file:/dev/urandom -Dcertificate.file= -Dservice.log.dir=./logs/ -Dfile.encoding=UTF-8 -Dsun.jnu.encoding=utf8 -XX:NewRatio=1 -XX:SurvivorRatio=8 -XX:+UseConcMarkSweepGC"
+  env_line_append "$service_env" "JAVA_TOOL_OPTIONS" "-Dspring.main.allow-circular-references=true -Djava.security.egd=file:/dev/urandom -Dcertificate.file= -Dservice.log.dir=./logs/ -Dfile.encoding=UTF-8 -Dsun.jnu.encoding=utf8 -XX:NewRatio=1 -XX:SurvivorRatio=8 -XX:+UseConcMarkSweepGC"
 }
 
 # 微服务启动env.
@@ -307,6 +307,7 @@ setup_ci_gateway (){
   # prod目录指向agent-package.
   # 预期200: curl -I bk-ci.service.consul/static/files/jar/worker-agent.jar
   update_link_to_target "$gateway_data_dir/files/prod" "$BK_CI_HOME/agent-package"
+  cp -f "$gateway_data_dir/files/prod/script/docker_init.sh" "$gateway_data_dir/files/prod/"
   # 在全部 ci-gateway 节点上注册主入口域名: bk-ci.service.consul, 用于在集群内提供web服务.
   if [ -x $CTRL_DIR/bin/reg_consul_svc ]; then
     check_empty_var LAN_IP || return 15

scripts/bk-ci-slim.sh

@@ -167,7 +167,7 @@ MEM_OPTS="-Xms256m -Xmx512m"
 CLASSPATH=".:lib/*"
 SPRING_CONFIG_LOCATION="file:./application.yml"
 SPRING_CLOUD_CONFIG_ENABLED=false
-JAVA_TOOL_OPTIONS="-Djava.security.egd=file:/dev/urandom -Dcertificate.file= -Dservice.log.dir=./logs/ -Dfile.encoding=UTF-8 -Dsun.jnu.encoding=utf8 -XX:NewRatio=1 -XX:SurvivorRatio=8 -XX:+UseConcMarkSweepGC"
+JAVA_TOOL_OPTIONS="-Dspring.main.allow-circular-references=true -Djava.security.egd=file:/dev/urandom -Dcertificate.file= -Dservice.log.dir=./logs/ -Dfile.encoding=UTF-8 -Dsun.jnu.encoding=utf8 -XX:NewRatio=1 -XX:SurvivorRatio=8 -XX:+UseConcMarkSweepGC"
 EOF
 
 echo "copy classes:"

scripts/bkce-create-users.sh

@@ -30,6 +30,9 @@ echo "注册 蓝鲸 ESB"
 
 echo "导入 IAMv3 权限模板."
 ./bin/bkiam_migrate.sh -t "$BK_IAM_PRIVATE_URL" -a "$BK_CI_APP_CODE" -s "$BK_CI_APP_TOKEN" "$BK_CI_SRC_DIR"/support-files/bkiam/*.json
+echo "导入 IAM RBAC 权限模板."
+./bin/bkiam_migrate.sh -t "$BK_IAM_PRIVATE_URL" -a "$BK_CI_APP_CODE" -s "$BK_CI_APP_TOKEN" "$BK_CI_SRC_DIR"/support-files/bkiam-rbac/*.json
+
 
 echo "配置数据库访问权限."
 # 中控机配置mysql login-path
@@ -51,7 +54,7 @@ for sub_dir in "$BK_CI_SRC_DIR"/support-files/sql/*
 do
    if [[ -d $sub_dir ]]; then
      echo "import sub_dir $sub_dir/*.sql"
-     ./bin/sql_migrate.sh -n mysql-ci "$sub_dir/*.sql"
+     ./bin/sql_migrate.sh -n mysql-ci $sub_dir/*.sql
    fi
 done
 

scripts/bkce-set-env03.sh

@@ -95,10 +95,17 @@ set_env03 BK_CI_MYSQL_ADDR=${BK_MYSQL_IP}:3306 BK_CI_MYSQL_USER=bk_ci BK_CI_MYSQ
 set_env03 BK_CI_REDIS_HOST=$BK_REDIS_IP BK_CI_REDIS_PASSWORD=$BK_PAAS_REDIS_PASSWORD
 
 # 调整BK_CI_AUTH_PROVIDER及URL等
-set_env03_en BK_CI_AUTH_PROVIDER=bk_login_v3 \
+set_env03_en BK_CI_AUTH_PROVIDER=rbac \
   BK_CI_FQDN=$(echo ${BK_PAAS_PUBLIC_ADDR}|sed "s#paas#devops#g;s#:80##g") \
   BK_CI_PUBLIC_URL=http://\$BK_CI_FQDN \
-  BK_CI_REPOSITORY_GITLAB_URL=http://\$BK_CI_FQDN
+  BK_CI_REPOSITORY_GITLAB_URL=http://\$BK_CI_FQDN \
+  BK_CI_IAM_SYSTEM_ID=bk_ci_rbac \
+  BK_CI_IAM_MIGRATE_TOKEN=9sBQj!M0 \
+  BK_CI_IAM_APIGW_URL=http://$BK_APIGW_APIGATEWAY_CONSUL_SERVICE:6006/api/bk-iam/prod \
+  BK_CI_ITSM_APIGW_URL=$BK_PAAS_PRIVATE_URL \
+  BK_CI_IAM_URL_PREFIX=$BK_PAAS_PUBLIC_URL/o/bk_iam \
+  BK_CI_ITSM_URL_PREFIX=$BK_PAAS_PUBLIC_URL/o/bk_itsm/#/ \
+  BK_CI_IAM_WEB_URL=$BK_PAAS_PUBLIC_URL/o/bk_iam/ \
 
 if grep -w repo $CTRL_DIR/install.config|grep -v ^\# ; then
   set_env03_en BK_REPO_GATEWAY_IP=$BK_REPO_GATEWAY_IP \

scripts/bkenv.properties

@@ -9,6 +9,8 @@ BK_CODECC_DATA_DIR=
 BK_CODECC_HOME=
 # BK_CODECC_PRIVATE_URL无默认值. 无需修改. 声明依赖, 蓝鲸环境下会自动填充. 其他环境无需填写.
 BK_CODECC_PRIVATE_URL=
+# BK_CODECC_PRIVATE_PROJECT_ID 项目ID
+BK_CODECC_PRIVATE_PROJECT_ID=
 # BK_CI_CODECC_OPENAPI_TOKEN无默认值. 获取CODECC任务回调接口TOKEN
 BK_CI_CODECC_OPENAPI_TOKEN=
 # BK_DOMAIN无默认值. 按需修改. 声明依赖, 蓝鲸环境下会自动填充. 其他环境需修改, 建议使用用户持有的公网域名(但解析为内网IP).
@@ -142,7 +144,9 @@ BK_ESB_ENABLED=false
 # BK_ESB_HOST
 BK_ESB_HOST=
 # BK_CI_PUBLIC_PATH
-BK_CI_PUBLIC_PATH=
+BK_CI_PUBLIC_PATH=""
+# BK_CI_FRONTEND_INDEX
+BK_CI_FRONTEND_INDEX="rewrite .* /\$subsystem/index.html break"
 
 ##########
 # 2-公共依赖

src/backend/ci/core/auth/biz-auth/src/main/kotlin/com/tencent/devops/auth/cron/AuthCronManager.kt

@@ -252,7 +252,7 @@ class AuthCronManager @Autowired constructor(
                             )
                         }
                         page++
-                    } while (resourceGroupConfigResult.size == PageUtil.DEFAULT_PAGE)
+                    } while (resourceGroupConfigResult.size == PageUtil.DEFAULT_PAGE_SIZE)
                     logger.info("init auth resource group config I18n end")
                 } finally {
                     redisLock.unlock()

src/backend/ci/core/project/api-project/src/main/kotlin/com/tencent/devops/project/pojo/ProjectCreateInfo.kt

@@ -66,6 +66,8 @@ data class ProjectCreateInfo(
     val logoAddress: String? = null,
     @ApiModelProperty("项目性质")
     val authSecrecy: Int? = ProjectAuthSecrecyStatus.PUBLIC.value,
+    @ApiModelProperty("是否可用")
+    val enabled: Boolean = true,
     @ApiModelProperty("运营产品ID")
     val productId: Int? = null,
     @ApiModelProperty("运营产品名称")

src/backend/ci/core/project/biz-project/src/main/kotlin/com/tencent/devops/project/dao/ProjectDao.kt

@@ -389,7 +389,7 @@ class ProjectDao {
                 userDeptDetail.deptName,
                 userDeptDetail.centerName,
                 channelCode!!.name,
-                true,
+                projectCreateInfo.enabled,
                 properties?.let {
                     JsonUtil.toJson(it, false)
                 },

src/backend/ci/core/store/biz-store-image-sample/src/main/kotlin/com/tencent/devops/store/service/image/impl/SampleImageInitService.kt

@@ -96,7 +96,8 @@ class SampleImageInitService @Autowired constructor(
                     projectInfo = ProjectCreateInfo(
                         projectName = imageInitRequest?.projectCode ?: "Demo",
                         englishName = projectCode,
-                        description = imageInitRequest?.projectDesc ?: "demo project"
+                        description = imageInitRequest?.projectDesc ?: "demo project",
+                        enabled = false
                     ),
                     needAuth = false,
                     needValidate = true,

src/frontend/bk-permission/.bk.development.env

@@ -0,0 +1,4 @@
+# .bk.development.env 生产模式生效
+
+# 开发 port
+BK_APP_PORT = 5002