声明式管理 Proxmox API 对象与 Samba DNS 上游

infrastructure/proxmox/ansible/roles/pve_sdn/tasks/main.yml

@@ -1,60 +1,81 @@
 ---
-# SDN config is cluster-wide (/etc/pve/sdn/), so everything runs once.
-
-- name: Read existing zones
-  ansible.builtin.command:
-    cmd: "pvesh get /cluster/sdn/zones --output-format json"
-  register: _zones
-  changed_when: false
-  check_mode: false
+- name: Validate Proxmox API inputs
+  ansible.builtin.assert:
+    that:
+      - pve_api_host | length > 0
+      - pve_api_user | length > 0
+      - pve_api_token_id | length > 0
+      - pve_api_token_secret | length > 0
+    fail_msg: Missing Proxmox API environment variables
   run_once: true
+  delegate_to: localhost
+  no_log: true
 
-- name: Create the VLAN zone
-  ansible.builtin.command:
-    cmd: >-
-      pvesh create /cluster/sdn/zones --zone {{ pve_sdn_zone }} --type vlan
-      --bridge {{ pve_sdn_bridge }} --mtu {{ pve_sdn_mtu }}
-      --nodes {{ groups['pve'] | join(',') }}
-  when: pve_sdn_zone not in (_zones.stdout | from_json | map(attribute='zone') | list)
+- name: Read current PVE SDN zones
+  ansible.builtin.uri:
+    url: "https://{{ pve_api_host }}:8006/api2/json/cluster/sdn/zones"
+    headers:
+      Authorization: >-
+        PVEAPIToken={{ pve_api_user }}!{{ pve_api_token_id }}={{ pve_api_token_secret }}
+    ca_path: /etc/ssl/certs/ca-certificates.crt
+    return_content: true
+  register: pve_sdn_zone_state
   run_once: true
+  delegate_to: localhost
+  no_log: true
 
-- name: Read existing vnets
-  ansible.builtin.command:
-    cmd: "pvesh get /cluster/sdn/vnets --output-format json"
-  register: _vnets
-  changed_when: false
-  check_mode: false
+- name: Reconcile the PVE VLAN zone
+  community.proxmox.proxmox_zone:
+    api_host: "{{ pve_api_host }}"
+    api_user: "{{ pve_api_user }}"
+    api_token_id: "{{ pve_api_token_id }}"
+    api_token_secret: "{{ pve_api_token_secret }}"
+    validate_certs: "{{ pve_api_validate_certs }}"
+    ca_path: /etc/ssl/certs/ca-certificates.crt
+    zone: "{{ pve_sdn_zone }}"
+    type: vlan
+    bridge: "{{ pve_sdn_bridge }}"
+    mtu: "{{ pve_sdn_mtu }}"
+    nodes: "{{ groups['pve'] | join(',') }}"
+    update: true
+    state: present
+  when: >-
+    _current_zone | length == 0 or
+    _current_zone.type != 'vlan' or
+    _current_zone.bridge != pve_sdn_bridge or
+    _current_zone.mtu | int != pve_sdn_mtu | int or
+    _current_zone.nodes != (groups['pve'] | join(','))
   run_once: true
+  delegate_to: localhost
+  no_log: true
+  vars:
+    ansible_python_interpreter: "{{ pve_api_python_interpreter }}"
+    _current_zone: >-
+      {{ pve_sdn_zone_state.json.data |
+         selectattr('zone', 'equalto', pve_sdn_zone) | first | default({}) }}
 
-- name: Create the VNets
-  ansible.builtin.command:
-    cmd: >-
-      pvesh create /cluster/sdn/vnets --vnet {{ item.name }}
-      --zone {{ pve_sdn_zone }} --tag {{ item.tag }}
-      --alias '{{ item.alias }}'
+# The module owns the SDN global lock and applies pending configuration before
+# releasing it; a separate unconditional `pvesh set /cluster/sdn` is harmful
+# because it reports changed on every run.
+- name: Reconcile PVE VNets
+  community.proxmox.proxmox_vnet:
+    api_host: "{{ pve_api_host }}"
+    api_user: "{{ pve_api_user }}"
+    api_token_id: "{{ pve_api_token_id }}"
+    api_token_secret: "{{ pve_api_token_secret }}"
+    validate_certs: "{{ pve_api_validate_certs }}"
+    ca_path: /etc/ssl/certs/ca-certificates.crt
+    vnet: "{{ item.name }}"
+    zone: "{{ pve_sdn_zone }}"
+    tag: "{{ item.tag }}"
+    alias: "{{ item.alias }}"
+    update: true
+    state: present
   loop: "{{ pve_sdn_vnets }}"
   loop_control:
-    label: "{{ item.name }} (vlan {{ item.tag }})"
-  when: item.name not in (_vnets.stdout | from_json | map(attribute='vnet') | list)
-  run_once: true
-
-- name: Apply the SDN configuration
-  # SDN changes stay PENDING until applied; without this the VNet bridges are
-  # never actually created on the nodes.
-  ansible.builtin.command:
-    cmd: "pvesh set /cluster/sdn"
-  register: _apply
-  changed_when: true
-  run_once: true
-
-- name: Report
-  ansible.builtin.shell:
-    cmd: "pvesh get /cluster/sdn/vnets --output-format json | python3 -c \"import json,sys;[print('   ',v['vnet'],'vlan',v.get('tag'),'zone',v.get('zone')) for v in json.load(sys.stdin)]\""
-  register: _rep
-  changed_when: false
-  run_once: true
-
-- name: Show it
-  ansible.builtin.debug:
-    msg: "{{ _rep.stdout_lines }}"
+    label: "{{ item.name }} (VLAN {{ item.tag }})"
   run_once: true
+  delegate_to: localhost
+  no_log: true
+  vars:
+    ansible_python_interpreter: "{{ pve_api_python_interpreter }}"