┌─────────────────────────────────────────────────────────────┐
│                      客户端 SDK                              │
└──────────────────────────┬──────────────────────────────────┘
                           │ WebRTC Signaling (WebSocket/gRPC)
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                   信令网关集群 (Stateless)                   │
│  - 房间路由、鉴权、会话控制                                  │
│  - 无本地状态，水平扩展                                       │
└──────────────────────────┬──────────────────────────────────┘
                           │ gRPC (Room/Session Metadata)
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                   元数据中台 (Stateful)                      │
│  - Redis Cluster: 房间拓扑、用户映射、ICE 候选缓存           │
│  - etcd: 分布式锁、Leader 选举、配置版本                     │
│  - Kafka: 事件溯源（房间生命周期、质量上报）                 │
└──────────────────────────┬──────────────────────────────────┘
                           │ Media Plane Assignment
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                   媒体节点池 (Stateless SFU)                 │
│  - 仅处理 RTP 转发、转码、录制推流                           │
│  - 启动时从元数据中台拉取房间拓扑，无本地持久化               │
│  - 支持任意节点接管任意房间                                  │
└─────────────────────────────────────────────────────────────┘

// 伪代码：无状态媒体节点核心处理循环
func (m *MediaNode) HandlePacket(ctx context.Context, pkt *rtp.Packet) error {
    // 1. 从本地缓存或 Redis 读取最新拓扑（TTL 100ms）
    topology := m.topologyCache.GetOrFetch(pkt.RoomID)
    
    // 2. 纯转发逻辑，无副作用
    for _, sub := range topology.Subscribers(pkt.SSRC) {
        if err := m.transport.WriteRTP(sub.Addr, pkt); err != nil {
            metrics.ForwardErrors.Inc()
        }
    }
    return nil
}

# media-node-deployment.yaml 关键片段
spec:
  template:
    spec:
      containers:
      - name: sfu
        lifecycle:
          preStop:
            exec:
              command: ["/bin/sh","-c","/usr/local/bin/graceful-drain.sh"]
      terminationGracePeriodSeconds: 120
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: media-node-pdb
spec:
  minAvailable: 80%  # 保证至少 80% 节点可用
  selector:
    matchLabels:
      app: media-node

阶段 1：双写建立 (T0 ~ T1)
├── 目标节点从 Redis 拉取房间拓扑，建立本地转发表
├── 目标节点向源节点发送 ICE 重协商候选（可选，视网络拓扑）
└── 源节点开始将入向 RTP 复制转发至目标节点（UDP 级镜像，延迟 < 2ms）

阶段 2：原子切流 (T1)
├── 信令网关下发 RoomSwitch 指令（携带新媒体节点 IP/端口）
├── 客户端执行 ICE Restart / DTLS Rehandshake（< 50ms）
└── 服务端原子更新 Redis 中房间媒体节点映射（Lua 脚本保证原子性）

阶段 3：校验与清理 (T1 ~ T2)
├── 目标节点确认收到首帧关键帧，上报 SwitchSuccess
├── 源节点停止双写，释放房间资源
└── 监控系统对比迁移前后 QoS 指标（丢包、抖动、首帧渲染时延）

# 自定义指标：每节点活跃房间数、带宽利用率
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: media-node-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: media-node
  minReplicas: 10
  maxReplicas: 500
  metrics:
  - type: Pods
    pods:
      metric:
        name: media_node_active_rooms
      target:
        type: AverageValue
        averageValue: "50"  # 单节点目标房间数
  - type: Pods
    pods:
      metric:
        name: media_node_bandwidth_usage_ratio
      target:
        type: AverageValue
        averageValue: "70%" # 带宽水位线
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300  # 缩容冷却 5 分钟，防抖
      policies:
      - type: Percent
        value: 10
        periodSeconds: 60

// topology_cache.go
type atomicTopologyView struct {
    ptr unsafe.Pointer // *RoomTopologyView
}

func (c *TopologyCache) Get(roomID string) *RoomTopologyView {
    return (*RoomTopologyView)(atomic.LoadPointer(&c.views[roomID].ptr))
}

func (c *TopologyCache) ApplyDiff(roomID string, diff *TopologyDiff) {
    // 1. 深拷贝当前视图 (Copy-on-Write)
    old := c.Get(roomID)
    new := old.Clone() 
    new.Apply(diff) // 增量修改：增/删 Subscriber, 更新 SSRC 映射
    
    // 2. 原子发布新版本
    atomic.StorePointer(&c.views[roomID].ptr, unsafe.Pointer(new))
    
    // 3. 异步回收旧版本 (Epoch-based Reclamation, 避免 ABA 问题)
    c.epoch.Reclaim(old)
}

// media_transport.c - 批量发送优化
struct mmsghdr msgs[MAX_BATCH]; // MAX_BATCH = 64
struct iovec iovs[MAX_BATCH];

// 构建批量发送向量：同一目标 IP+Port 的多个 RTP 包合并为一个系统调用
for (subscriber : room.subscribers) {
    // 1. 重写 SSRC/Seq/Timestamp (零拷贝修改 mbuf 元数据)
    rtp_rewrite_header(pkt, subscriber.ssrc_map);
    
    // 2. 填充 mmsghdr
    msgs[batch_cnt].msg_hdr.msg_iov = &iovs[batch_cnt];
    msgs[batch_cnt].msg_hdr.msg_iovlen = 1;
    iovs[batch_cnt].iov_base = pkt->data; // 指向同一物理内存 (refcnt++)
    iovs[batch_cnt].iov_len = pkt->len;
    batch_cnt++;
}

// 3. 单次系统调用发送 64 个包
int sent = sendmmsg(fd, msgs, batch_cnt, MSG_ZEROCOPY);

DTLS Handshake (Client <-> Signaling Gateway)
       │
       ▼
Master Key (MK) + Master Salt (MS)  [仅在信令网关/元数据中台持有]
       │
       ├──► Exporter Label: "EXTRACTOR-dtls_srtp" (RFC 5705)
       │       │
       │       ▼
       │  Keying Material (KM) = PRF(MK, "EXTRACTOR-dtls_srtp", ClientRandom+ServerRandom, 2*KeyLen+2*SaltLen)
       │       │
       │       ├──► Client Write Key/Salt (SRTP_TX)
       │       └──► Server Write Key/Salt (SRTP_RX)
       │
       └──► **加密存入 Redis** (Key: `room:{id}:dtls:km`, Value: Encrypted(KM), TTL=RoomLife+24h)
               │
               ├──► 源节点启动时拉取 -> 导出 TX/RX Key -> 正常收发
               └──► 目标节点迁移接管时拉取 -> 导出 TX/RX Key -> **无需握手直接收发**

# ResourceSlice 示例：将一张 A10 (24GB) 切分为 4 个 "nvenc-slot" + 显存配额
apiVersion: resource.k8s.io/v1alpha2
kind: ResourceSlice
metadata:
  name: node-gpu-0-a10-slices
spec:
  driver: nvidia.com/dra-driver
  pool:
    name: nvidia-a10-pool
    generation: 1
  nodes:
  - name: gpu-node-0
    resources:
    - name: nvidia.com/nvenc-slot
      capacity: "4"  # 4 个并发编码会话
      devices:
      - name: gpu-0-enc-0
        attributes:
          memory: "6Gi"      # 显存配额
          compute_capability: "8.6"
          driver_version: "550.54.15"
      - name: gpu-0-enc-1
        attributes: { ... }
      # ... enc-2, enc-3

# transcoder-pod.yaml
spec:
  containers:
  - name: ffmpeg-transcoder
    resources:
      limits:
        nvidia.com/nvenc-slot: "1"  # 申请 1 个编码槽位
    env:
    - name: NVIDIA_VISIBLE_DEVICES  # DRA Controller 自动注入具体 Device ID
      valueFrom:
        resourceFieldRef:
          resource: limits.nvidia.com/nvenc-slot

// spot_controller.go 核心逻辑
func (c *SpotController) Run(ctx context.Context) {
    for {
        select {
        case <-ctx.Done(): return
        case event := <-c.metadataWatcher.Events():
            if event.Type == "terminate" {
                // 1. 立即打污点，阻止新房间调度
                c.taintNode(nodeName, "spot-terminating=true:NoSchedule")
                
                // 2. 触发「预检点迁移」: 仅迁移核心大房间(>20人)，小房间走断线重连
                c.triggerSelectiveDrain(nodeName, policy.CoreRoomsOnly)
                
                // 3. 等待迁移完成或超时(90s)后主动删除 Pod
                c.waitAndForceDelete(nodeName, 90*time.Second)
            }
        }
    }
}

# media-node-deployment 混部策略
spec:
  template:
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 80
            preference:
              matchExpressions:
              - key: node.kubernetes.io/instance-type
                operator: In
                values: ["on-demand"]  # 优先调度到按需实例
          - weight: 20
            preference:
              matchExpressions:
              - key: node.kubernetes.io/instance-type
                operator: In
                values: ["spot"]       # 允许溢出到 Spot
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: ScheduleAnyway
        labelSelector:
          matchLabels:
            app: media-node
      - maxSkew: 1
        topologyKey: node.kubernetes.io/instance-lifecycle  # 关键：跨 Spot/OnDemand 均匀分布
        whenUnsatisfiable: ScheduleAnyway
        labelSelector: ...

用户侧 (Client SDK)
    │ 生成 Room Key (RK, 256-bit) -> 通过信令 E2EE 通道分发给合法成员
    ▼
媒体节点 (SFU) --RTP(加密)--> 录制 Sidecar (Recorder)
    │
    │ Recorder 实时封装 MP4/WebM，但**不落盘明文**
    │
    ├─► 生成 File Key (FK, 256-bit, 每文件唯一)
    │     │
    │     ├─► 加密文件内容: AES-256-GCM(FK, Plaintext) -> Ciphertext
    │     │
    │     └─► 加密 FK: Wrapped_FK = RSA-OAEP(PubKey_KMS, FK)  // KMS 公钥加密
    │
    └─► 上传对象存储:
          Object Key: recordings/{tenant}/{room}/{timestamp}.mp4.enc
          Metadata:
            x-amz-meta-wrapped-fk: <Base64(Wrapped_FK)>
            x-amz-meta-rk-id: <RK_ID>  // 关联房间密钥，用于权限校验
            x-amz-meta-retention-days: 90

sequenceDiagram
    participant User as 用户/合规系统
    participant API as 录制管理 API
    participant KMS as 密钥管理服务
    participant OSS as 对象存储
    
    User->>API: DELETE /recordings/{id} (理由: GDPR Art.17)
    API->>KMS: ScheduleKeyDeletion(KeyId=Wrapped_FK, PendingWindow=7d)
    KMS-->>API: KeyState=PendingDeletion
    API->>OSS: DeleteObjectTagging(Tag: "compliance=deleted") // 标记不可读
    Note right of KMS: 7天宽限期内可撤销恢复
    KMS->>KMS: 物理销毁 FK 明文密钥材料 (HSM Zeroize)
    KMS-->>API: KeyState=Deleted (不可逆)
    API->>User: 返回 DeletionProof {KeyId, DestructionTime, HSM_Attestation}

# .gitlab-ci.yml 混沌测试阶段
chaos_regression:
  stage: chaos-test
  image: chaosiq/chaostoolkit:latest
  script:
    - chaos run experiments/media_node_drain.yaml --var "target_namespace=prod"
    - chaos run experiments/redis_partition.yaml
    - chaos run experiments/spot_termination_sim.yaml
  artifacts:
    reports:
      junit: chaos-report.xml
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"  # 每日定时跑
    - if: $CI_COMMIT_TAG =~ /^v/             # 发版前强制跑