topologySpreadConstraints:
- maxSkew: 1
  topologyKey: topology.kubernetes.io/zone
  whenUnsatisfiable: DoNotSchedule
  labelSelector:
    matchLabels:
      app: live-transcode
  minDomains: 2  # 至少分布在 2 个可用区
- maxSkew: 2
  topologyKey: media.network/tier
  whenUnsatisfiable: ScheduleAnyway
  labelSelector:
    matchLabels:
      app: live-transcode

affinity:
  podAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
    - weight: 80
      podAffinityTerm:
        labelSelector:
          matchLabels:
            app: s3-gateway
        topologyKey: topology.kubernetes.io/zone

apiVersion: v1
kind: Service
metadata:
  name: transcode-service
  annotations:
    service.kubernetes.io/topology-aware-hints: "auto"
spec:
  internalTrafficPolicy: Local
  ports:
  - port: 8080
    targetPort: 8080
  selector:
    app: transcode-worker

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-transcode-dr
spec:
  host: transcode-service
  trafficPolicy:
    loadBalancer:
      localityLbSetting:
        enabled: true
        failover:
          - from: zone-a
            to: zone-b
          - from: zone-b
            to: zone-a

apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: media-critical
value: 1000000
preemptionPolicy: PreemptLowerPriority
globalDefault: false
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: zone-a-media-quota
  namespace: media-prod
spec:
  hard:
    requests.nvidia.com/gpu: "200"
    requests.cpu: "5000"
    requests.memory: "20Ti"
  scopeSelector:
    matchExpressions:
    - operator: In
      scopeName: PriorityClass
      values: ["media-critical"]

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: transcode-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: transcode-worker
  minReplicas: 10
  maxReplicas: 200
  metrics:
  - type: Pods
    pods:
      metric:
        name: zone_queue_latency_p99
      target:
        type: AverageValue
        averageValue: "200ms"
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 60
      policies:
      - type: Percent
        value: 50
        periodSeconds: 60
      selectPolicy: Max

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: media-nvme-topology-aware
provisioner: csi.plugin.vendor.com
volumeBindingMode: WaitForFirstConsumer  # 核心：延迟绑定至 Pod 调度后
allowedTopologies:  # 限制存储仅在指定拓扑域创建
- matchLabelExpressions:
  - key: topology.kubernetes.io/zone
    values: ["zone-a", "zone-b", "zone-c"]
parameters:
  type: "NVMe-SSD"
  iops: "100000"
  throughput: "4000"  # 单位 MB/s，满足 4K/8K 素材顺序读写
  replicaPolicy: "zone-redundant"  # 存储层面同城双副本

func (s *MediaScheduler) PreheatIfNeeded(pod *v1.Pod, candidateNodes []*v1.Node) error {
    if tier := getDataTier(pod); tier == "warm" {
        // 1. 解析素材源 Bucket/Key
        // 2. 查询目标 Zone 是否有缓存 (Redis/Etcd 维护缓存索引)
        // 3. 无缓存则创建 DataLoad Job，设置 OwnerReference 关联 Pod
        // 4. Pod 添加 InitContainer: wait-for-data-load-complete
        // 5. 仅当目标 Zone 缓存就绪或预热进度 > 80% 时，允许调度打分通过
    }
    return nil
}

# Node 级注解 (由 Node Feature Discovery + Vendor Plugin 生成)
annotations:
  node.topology.media/hardware-topology: |
    {
      "gpu-nodes": [
        {"id": "gpu-0", "numa": 0, "pci": "0000:3b:00.0", "nvlink-domain": 0, "type": "T4"},
        {"id": "gpu-1", "numa": 0, "pci": "0000:3c:00.0", "nvlink-domain": 0, "type": "T4"},
        {"id": "gpu-2", "numa": 1, "pci": "0000:d8:00.0", "nvlink-domain": 1, "type": "T4"}
      ],
      "vpu-nodes": [
        {"id": "vpu-0", "numa": 0, "pci": "0000:1a:00.0", "codec": ["h264","h265","av1"], "max_streams": 64}
      ]
    }
  node.topology.media/numa-distance-matrix: "0:10,10:0"  # NUMA 节点间延迟参考值

resources:
  limits:
    nvidia.com/gpu: "2"
    media.huawei.com/ascend-npu: "1"
  requests:
    nvidia.com/gpu: "2"
    media.huawei.com/ascend-npu: "1"
# 自定义 Annotation 指定拓扑约束
annotations:
  scheduler.media/topology-constraint: |
    {
      "gpu": {"policy": "nvlink-domain-affinity", "domain_id": 0},  # 强制分配在同一 NVLink Domain
      "npu": {"policy": "numa-local", "preferred_numa": 0},        # 优先 NUMA 0 本地
      "cross-numa-penalty": 50                                      # 跨 NUMA 调度惩罚分
    }

# 通过 ResourceQuota + PriorityClass 实现硬隔离
apiVersion: v1
kind: ResourceQuota
metadata:
  name: mig-gpu-1g.5gb-quota
  namespace: media-live
spec:
  hard:
    nvidia.com/mig-1g.5gb: "10"  # 限制该命名空间最多占用 10 个 1g.5gb 实例
---
# Pod 指定具体 MIG Profile
resources:
  limits:
    nvidia.com/mig-1g.5gb: 1

apiVersion: policy.karmada.io/v1alpha1
kind: PropagationPolicy
metadata:
  name: transcode-propagation
spec:
  resourceSelectors:
  - apiVersion: apps/v1
    kind: Deployment
    name: transcode-worker
  placement:
    clusterAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: region
            operator: In
            values: ["cn-east-1", "cn-south-1"]  # 仅部署在华东、华南
        topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: region  # 联邦层面按 Region 均衡
          whenUnsatisfiable: DoNotSchedule
    replicaScheduling: WeightedPreference
    replicaSchedulingType: Divided
    weightPreference:
    - targetCluster:
        clusterNames: ["cn-east-1-cluster"]
      weight: 60  # 华东权重高（核心存储/用户集中）
    - targetCluster:
        clusterNames: ["cn-south-1-cluster"]
      weight: 40

// 伪代码：成本评分归一化 (0-100 分，越低成本越高分)
func calculateCostScore(pod *v1.Pod, node *v1.Node, costModel *CostModel) int64 {
    // 1. 估算任务资源消耗
    estCPU := getRequest(pod, "cpu")
    estGPU := getRequest(pod, "nvidia.com/gpu")
    estEgressGB := estimateEgress(pod, node) // 基于历史画像预测

    // 2. 计算单位成本
    computeCost := costModel.GetComputeCost(node.Labels["zone"], node.Labels["instance-type"], estCPU, estGPU)
    networkCost := costModel.GetNetworkCost(pod.Namespace, node.Labels["zone"], estEgressGB)
    storageCost := costModel.GetStorageCost(pod, node.Labels["zone"])

    totalCost := computeCost + networkCost + storageCost
    
    // 3. 归一化 (假设集群内最大成本差 10 倍)
    maxCost := costModel.GetMaxEstimatedCost(pod)
    return 100 - int64((totalCost / maxCost) * 100)
}

// 最终评分 = w1*LocalityScore + w2*CostScore + w3*ResourceUtilizationScore
// 权重建议：核心实时业务 w1=0.7, w2=0.1; 离线异步业务 w1=0.2, w2=0.6

# Node 合规标签 (由运维管控系统自动打标，禁止人工修改)
labels:
  compliance.data-sovereignty: "cn-only"        # 数据不出中国
  compliance.industry: "broadcast-tv"           # 广电行业
  compliance.security-level: "level-3"          # 等保三级
  compliance.zone-type: "core-internal"         # 核心内网区，禁止公网 IP
annotations:
  compliance.audit-id: "cmp-2024-00123"         # 资产审计单号
  compliance.cert-expiry: "2025-12-31"          # 合规认证到期日

func (h *ComplianceValidator) ValidateCreate(ctx context.Context, obj runtime.Object) error {
    pod := obj.(*v1.Pod)
    
    // 1. 解析 Pod 关联的数据敏感度 (从 Label/Annotation/ConfigMap 继承)
    dataClass := getDataClassification(pod) // public / internal / confidential / restricted
    
    // 2. 查询目标节点合规属性 (从 Node Label/Annotation 读取)
    node, err := h.nodeLister.Get(pod.Spec.NodeName)
    if err != nil { return err }
    
    // 3. 硬性规则矩阵
    rules := map[string][]string{
        "restricted":   {"compliance.data-sovereignty=cn-only", "compliance.zone-type=core-internal"},
        "confidential": {"compliance.data-sovereignty=cn-only"},
        "internal":     {"compliance.industry=broadcast-tv"},
    }
    
    requiredLabels := rules[dataClass]
    for _, req := range requiredLabels {
        kv := strings.Split(req, "=")
        if node.Labels[kv[0]] != kv[1] {
            return fmt.Errorf("合规拦截: Pod[%s/%s] 数据级别[%s] 要求节点满足[%s], 当前节点[%s] 不满足", 
                pod.Namespace, pod.Name, dataClass, req, node.Name)
        }
    }
    return nil
}