tkestack · pavlelee · Jun 16, 2026 · Jun 16, 2026 · Jun 16, 2026
diff --git a/incubator/adp/README.md b/incubator/adp/README.md
@@ -283,7 +283,7 @@ MySQL:
 | `components.s3.cos.expireTime` | ⚪ 选填 | 签名过期时间 | `3600s` |
 | `components.s3.cos.credentialTime` | ⚪ 选填 | 临时凭证有效期                                               | `3600s`                                     |
 | `components.s3.cos.stsKey`         | ⚪ 选填 | sts模式下，保存cos访问秘钥的secret名称，需部署前主动创建。若配置该值，则仅支持通过sts模式访问cos资源，禁止使用永久secretId、secretKey | `sts-key`                                   |
-| `components.s3.cos.stsRoleArn`     | ⚪ 选填 | sts模式的角色标识，需要在腾讯云控制台创建CAM角色，并授予cos全读写权限 | `qcs::cam::uin/1234567890:roleName/CosFull` |
+| `components.s3.cos.stsRoleArn`     | ⚪ 选填 | sts模式的角色标识，需要在腾讯云控制台创建CAM角色，并关联QcloudTsearchFullAccess、QcloudHunYuanFullAccess、QcloudOCRFullAccess、QcloudLKEAPFullAccess、QcloudCOSFullAccess权限策略 | `qcs::cam::uin/1234567890:roleName/CosFull` |
 
 **注意**
 
@@ -394,8 +394,10 @@ components:
 | `components.clickhouse.port` | ✅ 必填 | ClickHouse 端口 | `9000` |
 | `components.clickhouse.user` | ✅ 必填 | ClickHouse 用户名 | `default` |
 | `components.clickhouse.password` | ✅ 必填 | ClickHouse 密码 | `your-password` |
+| `components.clickhouse.disabled` | ✅ 必填 | 是否禁用ClickHouse，默认启用，禁用后部分功能不可用 | `false` |
 
 **providerType 可选值：**
+
 - tencent: `clickhouse`
 
 **购买链接：** https://console.cloud.tencent.com/tchousec/instance

diff --git a/incubator/adp/charts/adp-web-app/values.yaml b/incubator/adp/charts/adp-web-app/values.yaml
@@ -1,4 +1,4 @@
 images:
   adp-web-app:
-    url: "{{ .Values.global.imageRegistry }}/tke-market/webappchatbot:226_2606140002_stable_v3.4.1.1-33c8949a77-8777a9d38-88a31fa5d-cn"
+    url: "{{ .Values.global.imageRegistry }}/tke-market/webappchatbot:227_2606161428_stable_v3.4.1.1-c11ee78673-9e9d9d007-9576c2541-cn"
 replicas: 1
diff --git a/incubator/adp/charts/deploy-data-init/templates/data-init-job.yaml b/incubator/adp/charts/deploy-data-init/templates/data-init-job.yaml
@@ -118,10 +118,23 @@ spec:
             value: {{ include "ex.s3_host" . | trim | quote }}
           - name: S3_RESOURCE_URL
             value: {{ include "ex.s3_resource_url" . | trim | quote }}
+          {{- if .Values.global.components.s3.cos.stsKey }}
+          - name: S3_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.global.components.s3.cos.stsKey }}
+                key: ADP_ASSUME_ROLE_SECRET_ID
+          - name: S3_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: {{ .Values.global.components.s3.cos.stsKey }}
+                key: ADP_ASSUME_ROLE_SECRET_KEY
+          {{- else }}
           - name: S3_ACCESS_KEY
             value: {{ include "ex.s3_AK" . | trim | quote }}
           - name: S3_SECRET_KEY
             value: {{ include "ex.s3_SK" . | trim | quote }}
+          {{- end }}
           - name: S3_BUCKET_NAME
             value: {{ include "ex.s3_bucket" . | trim | quote }}
           - name: S3_RESOURCE_DIR

diff --git a/incubator/adp/charts/deploy-pre-check/scripts/check.py b/incubator/adp/charts/deploy-pre-check/scripts/check.py
@@ -466,15 +466,20 @@ def check_object_storage() -> bool:
     cos_region = os.getenv('COS_REGION', '')
     cos_bucket = os.getenv('COS_BUCKET', '')
     cos_subpath = os.getenv('COS_SUBPATH', '')
-
+    cos_sts_key = os.getenv('COS_STS_KEY', '')
+
     print_info("对象存储类型: 腾讯云 COS")
     print_info(f"COS 区域: {cos_region}")
     print_info(f"COS 存储桶: {cos_bucket}")
     print_info(f"COS 子路径: {cos_subpath}")
 
-    if not cos_secret_id or cos_secret_id == 'xxx':
-        print_error("COS 配置无效（secret_id 未设置）")
-        return False
+    # stsKey 不为空时说明已开启 sts 代理模式，无需校验 secretId/secretKey
+    if cos_sts_key:
+        print_info("COS sts模式（stsKey 已配置），跳过 SecretId/SecretKey 校验")
+    else:
+        if not cos_secret_id or cos_secret_id == 'xxx':
+            print_error("COS 配置无效（secret_id 未设置）")
+            return False
 
     if not cos_bucket:
         print_error("COS 配置无效（bucket 未设置）")

diff --git a/incubator/adp/charts/deploy-pre-check/templates/job.yaml b/incubator/adp/charts/deploy-pre-check/templates/job.yaml
@@ -181,6 +181,8 @@ spec:
           value: {{ $components.s3.cos.bucket | quote }}
         - name: COS_SUBPATH
           value: {{ $components.s3.cos.subPath | quote }}
+        - name: COS_STS_KEY
+          value: {{ dig "s3" "cos" "stsKey" "" $components | quote }}
         {{- end }}
         # ---------- K8s Resources ----------
           value: {{ .Values.global.components.s3.cos.subPath | quote }}