+-------------------+     +-------------------+     +-------------------+
|   PreFilter       |     |   Filter          |     |   PreScore        |
| (拓扑可行性快速   |---->| (硬性约束: GPU/   |---->| (预计算拓扑距离、 |
|  剪枝)            |     |  NUMA/网卡)       |     |  碎片度指标)      |
+-------------------+     +-------------------+     +-------------------+
                                                        |
                                                        v
+-------------------+     +-------------------+     +-------------------+
|   Score           |<----|   NormalizeScore  |<----|   Reserve/Unreserve|
| (联合评分: α·拓扑 |     | (归一化 0-100)    |     | (状态回滚)        |
|  距离 + β·碎片度) |     |                   |     |                   |
+-------------------+     +-------------------+     +-------------------+

// pkg/plugins/mediasched/state.go
type NodeTopoInfo struct {
    NUMANodes          []NUMANodeInfo   // 每个 NUMA 节点的 CPU/内存/PCIe 拓扑
    GPUs               []GPUInfo        // GPU 设备级拓扑（亲缘 NUMA、NVLink 域）
    NICs               []NICInfo        // 网卡 NUMA 亲缘、SR-IOV VF 数量
    FragmentScore      float64          // 显存碎片度评分 [0,1]，越大越碎片化
}

type GPUInfo struct {
    UUID           string
    NUMAAffinity   int
    NVLinkDomain   int
    MemTotal       int64
    MemUsed        int64
    FreeBlocks     []MemBlock         // 空闲显存块列表（按地址排序）
}

type MemBlock struct {
    Start  uint64
    Size   uint64
}

// pkg/plugins/mediasched/scoring/topology.go
func (p *MediaSched) calculateTopologyScore(node *v1.Node, pod *v1.Pod, topo *NodeTopoInfo) int64 {
    // 1. 解析 Pod 资源需求（通过 ResourceClaim/Annotation 传递）
    req := parsePodTopoReq(pod)
    
    // 2. 计算最小拓扑代价（贪心匹配最优 GPU+NIC 组合）
    minCost := math.MaxFloat64
    for _, gpu := range topo.GPUs {
        if !gpuMatchesReq(gpu, req) { continue }
        for _, nic := range topo.NICs {
            if !nicMatchesReq(nic, req) { continue }
            cost := p.calcCost(req, gpu, nic, topo)
            if cost < minCost { minCost = cost }
        }
    }
    
    // 3. 线性映射到 [0, 100]，代价越低分越高
    return int64(100 * (1 - minCost/p.maxTopoCost))
}

// pkg/plugins/mediasched/scoring/fragment.go
func computeWEFI(gpu *GPUInfo, thresholdBytes int64) float64 {
    if len(gpu.FreeBlocks) == 0 { return 1.0 }
    
    var totalFree, weightedSum int64
    maxBlock := int64(0)
    for _, blk := range gpu.FreeBlocks {
        totalFree += int64(blk.Size)
        if int64(blk.Size) > maxBlock { maxBlock = int64(blk.Size) }
    }
    if totalFree == 0 { return 1.0 }
    
    for _, blk := range gpu.FreeBlocks {
        if int64(blk.Size) < thresholdBytes {
            weightedSum += (maxBlock - int64(blk.Size))
        }
    }
    return float64(weightedSum) / float64(totalFree)
}

# Dockerfile.mediasched
FROM golang:1.22 AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /mediasched ./cmd/mediasched

FROM gcr.io/distroless/static:nonroot
COPY --from=builder /mediasched /
ENTRYPOINT ["/mediasched"]

# deploy/mediasched-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mediasched
  namespace: kube-system
spec:
  replicas: 2
  selector:
    matchLabels:
      component: mediasched
  template:
    spec:
      serviceAccountName: mediasched-scheduler
      containers:
      - name: scheduler
        image: registry.example.com/mediasched:v1.3.0
        args:
        - --config=/etc/mediasched/config.yaml
        - --secure-port=10259
        - --kubeconfig=/etc/kubernetes/scheduler.conf
        volumeMounts:
        - name: config
          mountPath: /etc/mediasched
      volumes:
      - name: config
        configMap:
          name: mediasched-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: mediasched-config
  namespace: kube-system
data:
  config.yaml: |
    apiVersion: mediasched.io/v1alpha1
    kind: MediaSchedConfig
    weights:
      topology: 0.6
      fragment: 0.4
    fragmentThresholdBytes: 2147483648  # 2GiB
    nvlinkHopPenalty: 15
    pcieHopPenalty: 30

# 会议媒体服务器 Deployment 片段
spec:
  template:
    spec:
      containers:
      - name: sfu
        resources:
          limits:
            nvidia.com/gpu: "1"
            mediasched.io/numa-aligned-nic: "1"   # 由 Device Plugin 发布
            mediasched.io/gpu-mem-contiguous: "2Gi" # 连续显存需求
        env:
        - name: NVIDIA_VISIBLE_DEVICES
          value: "all"  # 由插件在 PreBind 阶段注入具体 UUID

// pkg/device-plugin/nvidia/topology.go
func (p *NvidiaDevicePlugin) GetDevicePluginOptions() *pluginapi.DevicePluginOptions {
    return &pluginapi.DevicePluginOptions{
        GetPreferredAllocationAvailable: true, // 启用 PreferredAllocation
    }
}

func (p *NvidiaDevicePlugin) PreferredAllocation(req *pluginapi.PreferredAllocationRequest) (*pluginapi.PreferredAllocationResponse, error) {
    // 结合 mediasched 计算的最优 GPU UUID 返回
    bestGPUs := p.selectBestGPUs(req.ContainerRequests[0].AvailableDeviceIDs, req.ContainerRequests[0].MustIncludeDeviceIDs)
    return &pluginapi.PreferredAllocationResponse{DeviceIDs: bestGPUs}, nil
}

mediasched/
├── cmd/mediasched/           # 入口：注册插件、启动 scheduler
├── pkg/
│   ├── plugins/mediasched/   # 插件核心逻辑
│   │   ├── state.go          # CycleState 数据结构
│   │   ├── prefilter.go      # 快速剪枝
│   │   ├── filter.go         # 硬性约束
│   │   ├── prescore.go       # 预计算拓扑/碎片指标
│   │   ├── score.go          # 联合评分入口
│   │   ├── scoring/
│   │   │   ├── topology.go   # 拓扑距离评分
│   │   │   └── fragment.go   # 碎片度评分
│   │   └── bind.go           # PreBind 注入 GPU UUID/NIC VF
│   ├── informers/            # Node/ConfigMap/Pod 监听
│   └── metrics/              # Prometheus 指标定义
├── deploy/                   # YAML/Helm Chart
├── test/                     # 单元/集成测试 (kind + ginkgo)
└── go.mod

// pkg/plugins/mediasched/prefilter.go
func (p *MediaSched) PreFilter(ctx context.Context, state *framework.CycleState, pod *v1.Pod) *framework.Status {
    // 1. 从 CycleState 取缓存键
    key := fmt.Sprintf("topo-%s", pod.UID)
    if cached, err := state.Read(key); err == nil {
        return nil // 命中缓存，直接通过
    }

    // 2. 异步预热：仅首次调度或缓存过期触发
    nodeList, err := p.nodeLister.List(labels.Everything())
    if err != nil { return framework.AsStatus(err) }

    snapshots := make(map[string]*NodeTopoInfo, len(nodeList))
    var wg sync.WaitGroup
    sem := make(chan struct{}, runtime.NumCPU()) // 限制并发度

    for _, node := range nodeList {
        wg.Add(1)
        sem <- struct{}{}
        go func(n *v1.Node) {
            defer wg.Done()
            defer func() { <-sem }()
            
            // 从本地 mmap 文件/SharedMemory 读取预计算拓扑（由 Node Agent 定时刷新）
            topo, err := p.loadNodeTopoFromShm(n.Name)
            if err != nil {
                klog.V(4).InfoS("Topo load failed", "node", n.Name, "err", err)
                return
            }
            snapshots[n.Name] = topo
        }(node)
    }
    wg.Wait()

    // 3. 写入 CycleState 供后续 Filter/Score 复用
    state.Write(key, snapshots)
    return nil
}

// pkg/plugins/mediasched/score.go
func (p *MediaSched) Score(ctx context.Context, state *framework.CycleState, pod *v1.Pod, nodeName string) (int64, *framework.Status) {
    // 1. 从 PreFilter 缓存读取
    snapshots, _ := state.Read(fmt.Sprintf("topo-%s", pod.UID))
    nodeTopo := snapshots.(map[string]*NodeTopoInfo)[nodeName]
    if nodeTopo == nil { return 0, framework.NewStatus(framework.Error, "topo missing") }

    // 2. 并行计算两个子评分
    var topoScore, fragScore int64
    var wg sync.WaitGroup
    wg.Add(2)
    go func() { defer wg.Done(); topoScore = p.calcTopoScore(pod, nodeTopo) }()
    go func() { defer wg.Done(); fragScore = p.calcFragmentScore(pod, nodeTopo) }()
    wg.Wait()

    // 3. 加权合成（权重从 ConfigMap 热加载）
    return int64(float64(topoScore)*p.weights.Topology + float64(fragScore)*p.weights.Fragment), nil
}

// NormalizeScore 必须实现，否则 kube-scheduler 会跳过归一化导致分数失真
func (p *MediaSched) NormalizeScore(ctx context.Context, state *framework.CycleState, pod *v1.Pod, scores framework.NodeScoreList) *framework.Status {
    // 标准 Min-Max 归一化至 [0, 100]
    var max, min int64 = 0, 100
    for _, s := range scores { if s.Score > max { max = s.Score }; if s.Score < min { min = s.Score } }
    if max == min { return nil }
    for i := range scores {
        scores[i].Score = (scores[i].Score - min) * 100 / (max - min)
    }
    return nil
}

// pkg/plugins/mediasched/permit.go
func (p *MediaSched) Permit(ctx context.Context, state *framework.CycleState, pod *v1.Pod, nodeName string) (*framework.Status, time.Duration) {
    // 1. 构造分布式锁 Key：node-gpu-mem-nic
    lockKey := fmt.Sprintf("mediasched/lock/%s/%s", nodeName, pod.Spec.NodeName) // 简化示意
    
    // 2. 尝试获取锁（TTL 30s，防止死锁）
    acquired, err := p.distLock.TryAcquire(ctx, lockKey, 30*time.Second)
    if err != nil { return framework.NewStatus(framework.Error, err.Error()), 0 }
    if !acquired {
        // 返回等待时间，Scheduler 会在 Permit 阶段阻塞，不进入 Bind
        return framework.NewStatus(framework.Wait, "resource lock contention"), 5 * time.Second
    }

    // 3. 双重校验：锁内再次检查显存碎片度、VF 可用性
    if !p.recheckResources(nodeName, pod) {
        p.distLock.Release(lockKey)
        return framework.NewStatus(framework.Unschedulable, "resource vanished after score"), 0
    }

    // 4. 将分配结果写入 CycleState 供 Bind 直接使用
    alloc := &AllocationResult{GPUUUID: "...", MemBlock: MemBlock{...}, VFID: ...}
    state.Write("allocation-result", alloc)
    return framework.NewStatus(framework.Success, ""), 0
}

# 由 Node Agent (DRA Driver) 创建的 ResourceSlice 示例
apiVersion: resource.k8s.io/v1alpha3
kind: ResourceSlice
metadata:
  name: node-gpu-topo-<uuid>
spec:
  driver: mediasched.nvidia.com
  pool: gpu-pool-a100
  nodes: ["k8s-worker-01"]
  devices:
  - name: gpu-0
    basic:
      attributes:
        nvidia.com/gpu.uuid: "GPU-123456"
        mediasched.io/numa-node: "0"
        mediasched.io/nvlink-domain: "0"
        mediasched.io/free-mem-bytes: "42949672960"
        mediasched.io/largest-free-block: "21474836480"  # 关键：最大连续块
        mediasched.io/wefi: "0.15"
    capacity: "1"  # 可切分为多个 MIG 实例
  - name: nic-mlx5-0
    basic:
      attributes:
        mediasched.io/numa-node: "0"
        mediasched.io/pcie-slot: "0000:3b:00.0"
        mediasched.io/rdma-capable: "true"
        mediasched.io/vf-available: "8"

// pkg/plugins/mediasched/dra_adapter.go
func (p *MediaSched) preFilterDRA(ctx context.Context, state *framework.CycleState, pod *v1.Pod) *framework.Status {
    // 1. 解析 Pod 引用的 ResourceClaim
    claims := getPodResourceClaims(pod) // 从 Pod.Spec.ResourceClaims 解析
    for _, claim := range claims {
        // 2. 从 Informer 缓存获取 ResourceClaim 对象
        rc, err := p.claimLister.Get(claim.Namespace, claim.Name)
        if err != nil { return framework.AsStatus(err) }
        
        // 3. 解析 AllocationResult (由 DRA Controller 填充)
        if rc.Status.Allocation == nil { continue }
        for _, dev := range rc.Status.Allocation.Devices.Results {
            // 直接获取调度器无需再次决策的拓扑信息
            topo := parseDeviceAttributes(dev.DeviceAttributes)
            state.Write("dra-allocation-"+dev.Device, topo)
        }
    }
    return nil
}

传统迁移 (cudaMemcpy)：
  Src GPU VRAM (0x7f00_0000) --PCIe Copy--> Dst GPU VRAM (0x7f00_0000)  // 数据搬运，耗时 ∝ 数据量

VMM 迁移：
  1. cudaMemUnmap(Src VA)          // 解除虚拟地址映射
  2. cudaMemMap(Dst VA, Src PA)    // 将物理页映射到目标 GPU 虚拟地址
  3. TLB Shootdown (跨 GPU)       // 硬件自动处理，微秒级

// pkg/defrag/controller/vmm_migrate.go
func (c *DefragController) migrateContainerGPUMemory(ctx context.Context, srcPod, dstPod *v1.Pod, gpuUUID string, blocks []MemBlock) error {
    // 1. 通过 CRI 获取容器 PID Namespace
    srcPid := c.criClient.GetContainerPID(srcPod.Namespace, srcPod.Name, "sfu")
    dstPid := c.criClient.GetContainerPID(dstPod.Namespace, dstPod.Name, "sfu")

    // 2. 进入目标 PID NS 调用 libcuda.so VMM API (需容器特权/挂载 nvidia.com/gpu=all)
    //    此处伪代码展示逻辑，实际需 CGO 调用 CUDA Driver API
    for _, blk := range blocks {
        // Src: 解除映射
        if err := cudaMemUnmap(srcPid, blk.Start, blk.Size); err != nil {
            return fmt.Errorf("unmap src failed: %w", err)
        }
        // Dst: 映射物理页 (需通过 nvidia-peermem 获取 PFN)
        pfn, err := getPhysicalFrameNumber(srcPid, blk.Start)
        if err != nil { return err }
        if err := cudaMemMap(dstPid, blk.Start, blk.Size, pfn, cudaMemMapFlagsReadWrite); err != nil {
            // 回滚：重新映射回 Src
            cudaMemMap(srcPid, blk.Start, blk.Size, pfn, cudaMemMapFlagsReadWrite)
            return fmt.Errorf("map dst failed: %w", err)
        }
    }
    
    // 3. 通知应用层 (媒体服务器) 更新内部 Buffer Pool 指针
    //    通过 gRPC/Unix Domain Socket 发送 BufferRelocated 事件
    return c.notifyAppBufferRelocated(dstPod, gpuUUID, blocks)
}

// pkg/plugins/mediasched/net_topo.go
func (p *MediaSched) discoverNIC Topology(node *v1.Node) ([]NICInfo, error) {
    // 1. 从 SriovNetworkNodeState CRD 读取 VF 分配状态
    sriovState, err := p.sriovLister.Get(node.Name)
    if err != nil { return nil, err }

    var nics []NICInfo
    for _, iface := range sriovState.Status.Interfaces {
        if iface.Driver != "mlx5_core" && iface.Driver != "ice" { continue } // 仅支持 RDMA 网卡
        
        pciAddr := iface.PciAddress
        numaNode := getNUMANodeFromPCI(pciAddr) // 解析 /sys/bus/pci/devices/.../numa_node
        
        // 2. 统计可用 VF 数量 (TotalVFs - AllocatedVFs)
        freeVFs := iface.TotalVFs - len(iface.VFs)
        
        // 3. 探测 RDMA 链路状态 (ibv_devinfo / rdma link)
        rdmaCapable := checkRDMAHealth(pciAddr)
        
        nics = append(nics, NICInfo{
            PCIAddr:     pciAddr,
            NUMAAffinity: numaNode,
            Driver:      iface.Driver,
            FreeVFs:     freeVFs,
            RDMAReady:   rdmaCapable,
            MaxBWGbps:   getLinkSpeed(pciAddr), // ethtool 解析
        })
    }
    return nics, nil
}

// pkg/plugins/mediasched/scoring/network.go
func (p *MediaSched) calcNetworkScore(nodeTopo *NodeTopoInfo, podReq *PodNetReq) int64 {
    bestScore := int64(0)
    for _, nic := range nodeTopo.NICs {
        if nic.FreeVFs == 0 || !nic.RDMAReady { continue }
        if !numaMatch(podReq.NUMAPreference, nic.NUMAAffinity) { continue }

        // 基础分：PCIe 跳数越近越高
        baseScore := 100 - pcieHopPenalty(podReq.GPUNUMA, nic.NUMAAffinity)*10
        
        // 动态惩罚：从 Prometheus 查询最近 1 分钟丢包率、队列深度
        lossRate := p.metricsClient.QueryNodeNICLoss(nodeTopo.NodeName, nic.PCIAddr)
        queueDepth := p.metricsClient.QueryNodeNICQueue(nodeTopo.NodeName, nic.PCIAddr)
        
        penalty := int64(lossRate * 5000) + int64(queueDepth/100) // 经验系数
        finalScore := baseScore - penalty
        if finalScore < 0 { finalScore = 0 }
        if finalScore > bestScore { bestScore = finalScore }
    }
    return bestScore
}

# tests/chaos/test_gpu_ejection.py
import pytest
from kubernetes import client, config
from chaoslib import inject_gpu_reset, wait_for_condition

@pytest.mark.chaos
def test_gpu_ejection_reschedule(k8s_client, mediasched_namespace):
    # 1. 部署 10 个媒体服务器副本 (每副本 1 GPU)
    deploy = create_media_deployment(replicas=10, gpu_limit=1)
    k8s_client.apps_v1.create_namespaced_deployment(mediasched_namespace, deploy)
    wait_for_pods_ready(k8s_client, mediasched_namespace, label_selector="app=media-sfu", count=10)

    # 2. 选取一个运行 Pod 的节点，注入 GPU 复位
    target_pod = get_running_pod_on_node(k8s_client, "k8s-worker-03")
    gpu_uuid = get_pod_gpu_uuid(target_pod)
    
    # 在节点上执行 gpureset (需特权 DaemonSet 协助)
    inject_gpu_reset(node="k8s-worker-03", gpu_uuid=gpu_uuid)

    # 3. 验证：Pod 被驱逐 -> 重建 -> 调度到健康 GPU
    def pod_rescheduled_on_healthy_gpu():
        new_pod = get_pod_by_uid(k8s_client, target_pod.uid) # Deployment 会创建新 Pod
        if not new_pod or new_pod.status.phase != "Running": return False
        new_gpu = get_pod_gpu_uuid(new_pod)
        return is_gpu_healthy(new_gpu) and new_gpu != gpu_uuid

    assert wait_for_condition(pod_rescheduled_on_healthy_gpu, timeout=120, interval=5)
    
    # 4. 验证：调度器日志包含 "Topology changed, re-scoring" 且无 Error 级别日志
    assert check_scheduler_logs("Topology changed", level="INFO")
    assert not check_scheduler_logs("Failed to bind", level="ERROR")

# 租户层级：root -> enterprise-A -> dept-video -> team-meeting
apiVersion: hnc.x-k8s.io/v1alpha2
kind: HierarchicalNamespace
metadata:
  name: enterprise-A
  namespace: enterprise-A
spec:
  parent: root
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: gpu-quota
  namespace: enterprise-A
spec:
  hard:
    nvidia.com/gpu: "64"           # 硬上限
    mediasched.io/gpu-mem-gb: "512" # 自定义扩展资源配额 (需 APIServer 聚合层支持)
---
# 子命名空间自动继承父配额，可进一步细分

// pkg/plugins/mediasched/postfilter.go
func (p *MediaSched) PostFilter(ctx context.Context, state *framework.CycleState, pod *v1.Pod, filteredNodeStatusMap framework.NodeToStatusMap) (*framework.PostFilterResult, *framework.Status) {
    // 仅对高优先级 Pod 尝试抢占
    if pod.Spec.PriorityClassName != "meeting-sla-gold" && pod.Spec.PriorityClassName != "meeting-sla-silver" {
        return nil, nil
    }

    candidates := p.findPreemptionCandidates(pod, filteredNodeStatusMap)
    if len(candidates) == 0 { return nil, nil }

    // 选取“碎片度最高、优先级最低、迁移成本最小”节点
    victimNode := p.selectBestVictimNode(candidates, pod)
    
    // 返回提名节点，Scheduler 会驱逐受害者 Pod 并重试调度
    return &framework.PostFilterResult{
        NominatedNodeName: victimNode.Name,
    }, nil
}

# 稳定版
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-scheduler-stable
  namespace: kube-system
spec:
  replicas: 2
  template:
    spec:
      containers:
      - name: scheduler
        image: registry/kube-scheduler:v1.28.4
        args:
        - --scheduler-name=default-scheduler  # 默认调度器
        - --config=/etc/kubernetes/scheduler-config.yaml
---
# 金丝雀版 (挂载 mediasched 插件)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-scheduler-canary
  namespace: kube-system
spec:
  replicas: 1
  template:
    spec:
      containers:
      - name: scheduler
        image: registry/kube-scheduler:v1.28.4-mediasched-v1.3.0
        args:
        - --scheduler-name=mediasched-scheduler  # 自定义调度器名
        - --config=/etc/kubernetes/scheduler-config-canary.yaml
        - --feature-gates=DynamicResourceAllocation=true

# 金丝雀测试负载
apiVersion: apps/v1
kind: Deployment
metadata:
  name: media-sfu-canary
spec:
  template:
    metadata:
      annotations:
        scheduler.alpha.kubernetes.io/affinity: "mediasched-scheduler" # 指定调度器
    spec:
      schedulerName: mediasched-scheduler  # 关键：绕过默认调度器
      priorityClassName: meeting-sla-silver
      ...

# argo-rollout-canary.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: kube-scheduler-canary
spec:
  replicas: 3
  strategy:
    canary:
      canaryService: scheduler-canary-metrics # 指标服务
      stableService: scheduler-stable-metrics
      trafficRouting:
        istio:
          virtualService: scheduler-mirror
      steps:
      - setWeight: 10
      - pause: {duration: 15m}
      - analysis:
          templates:
          - templateName: scheduler-slo-analysis
      - setWeight: 50
      - pause: {duration: 30m}
      - setWeight: 100
  selector:
    matchLabels:
      component: kube-scheduler-canary

// pkg/plugins/mediasched/compliance_filter.go
func (p *MediaSched) Filter(ctx context.Context, state *framework.CycleState, pod *v1.Pod, nodeInfo *framework.NodeInfo) *framework.Status {
    // 1. 解析 Pod 合规标签 (由准入控制器注入)
    compliance := pod.Labels["compliance.dataresidency"] // 如: "cn-shanghai-finance"
    if compliance == "" { return nil } // 无要求则跳过

    // 2. 从 Node Label/Annotation 获取节点合规属性
    node := nodeInfo.Node()
    nodeRegion := node.Labels["topology.kubernetes.io/region"]
    nodeZone := node.Labels["topology.kubernetes.io/zone"]
    nodeCerts := node.Annotations["compliance.certifications"] // 如: "ISO27001,PCI-DSS,Level3"

    // 3. 硬性匹配规则引擎 (可外挂 OPA/Rego 策略)
    if !p.complianceEngine.Match(compliance, nodeRegion, nodeZone, nodeCerts) {
        return framework.NewStatus(framework.Unschedulable, 
            fmt.Sprintf("Compliance mismatch: pod requires %s, node %s has %s/%s", 
                compliance, node.Name, nodeRegion, nodeCerts))
    }
    return nil
}

{
  "timestamp": "2024-01-15T10:30:00.123Z",
  "event": "SCHEDULE_DECISION",
  "scheduler": "mediasched-scheduler",
  "pod": {"uid": "abc-123", "namespace": "enterprise-A", "name": "sfu-xyz", "priority": "meeting-sla-gold"},
  "node": {"name": "k8s-worker-05", "region": "cn-shanghai", "zone": "cn-shanghai-a"},
  "decision": "BIND",
  "score_breakdown": {"topology": 92, "fragment": 88, "network": 95, "compliance": 100},
  "preemption": null,
  "defrag_triggered": false,
  "compliance_tags": ["finance", "pii", "iso27001"],
  "operator": "system:serviceaccount:kube-system:mediasched-scheduler",
  "signature": "sha256:..." // 可选：KMS 签名防篡改
}