feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

2026-09-25 19:34:48 +00:00
parent acd4b55722
commit 3a2fe5fa0c
92 changed files with 4211 additions and 0 deletions
@@ -0,0 +1,59 @@
+---
+# 只读收敛入口；秘密首次创建、删除或轮换不放进 site.yml。
+- name: 在任何主机变更前读取并校验已有凭据
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  tasks:
+    - name: 要求有效的显式 Bao 身份
+      ansible.builtin.assert:
+        that:
+          - pg_bao_token | length > 0
+          - pg_bao_url is match('^https://')
+      no_log: true
+    - name: 读取两个实例的管理凭据
+      ansible.builtin.uri:
+        url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_secret_paths[item] }}"
+        headers:
+          X-Vault-Token: "{{ pg_bao_token }}"
+        status_code: 200
+      loop: [prod, dev]
+      register: pg_secret_response
+      no_log: true
+    - name: 整理并验证凭据结构
+      ansible.builtin.set_fact:
+        pg_loaded_credentials: "{{ pg_loaded_credentials | default({}) | combine({item.item: item.json.data.data}) }}"
+      loop: "{{ pg_secret_response.results }}"
+      no_log: true
+    - name: 拒绝缺失或短密码
+      ansible.builtin.assert:
+        that:
+          - pg_loaded_credentials[item].superuser_password | length >= 32
+          - pg_loaded_credentials[item].ayatori_password | length >= 32
+          - pg_loaded_credentials[item].ayatori_username == 'ayatori'
+      loop: [prod, dev]
+      no_log: true
+    - name: 校验生产复制与 API 凭据
+      ansible.builtin.assert:
+        that:
+          - pg_loaded_credentials.prod.replication_password | length >= 32
+          - pg_loaded_credentials.prod.rest_password | length >= 32
+      no_log: true
+    - name: 读取已有 etcd 消费者凭据
+      ansible.builtin.uri:
+        url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_etcd_secret_path }}"
+        headers:
+          X-Vault-Token: "{{ pg_bao_token }}"
+        status_code: 200
+      register: pg_etcd_response
+      no_log: true
+    - name: 校验 etcd prefix 并交付内存引用
+      ansible.builtin.assert:
+        that:
+          - pg_etcd_response.json.data.data.username == 'patroni-pg-prod'
+          - pg_etcd_response.json.data.data.prefix == '/homelab/patroni/pg-prod/'
+      no_log: true
+    - name: 保存短生命周期内存引用
+      ansible.builtin.set_fact:
+        pg_loaded_etcd: "{{ pg_etcd_response.json.data.data }}"
+      no_log: true