feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

infrastructure/etcd/controller/login.py

@@ -0,0 +1,30 @@
+#!/usr/bin/python3
+"""仅由受控调用者捕获 stdout；不得手动运行以免在终端输出短期 token。"""
+import json
+import ssl
+import sys
+import urllib.request
+
+
+def main():
+    context = ssl.create_default_context()
+    context.load_cert_chain('/etc/homelab-etcd/peer.crt', '/etc/homelab-etcd/peer.key')
+    request = urllib.request.Request(
+        'https://bao.ad.ddupan.top:8200/v1/auth/homelab-etcd-renewal/login',
+        data=json.dumps({'name': 'etcd-laptop'}).encode(),
+        headers={'Content-Type': 'application/json'}, method='POST',
+    )
+    with urllib.request.urlopen(request, context=context, timeout=30) as response:
+        token = json.load(response)['auth']['client_token']
+    if not isinstance(token, str) or not token:
+        raise ValueError('empty token')
+    sys.stdout.write(token)
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except Exception:
+        # Bao 响应和异常对象可能带敏感内容，不写入 journal。
+        sys.stderr.write('Bao certificate login failed\n')
+        sys.exit(1)