feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

2026-09-25 19:34:48 +00:00
parent acd4b55722
commit 3a2fe5fa0c
92 changed files with 4211 additions and 0 deletions
@@ -0,0 +1,37 @@
+---
+- name: 读取独立管理凭据元数据
+  ansible.builtin.uri:
+    url: "{{ pg_bao_url }}/v1/kv/metadata/infra/postgresql/ayatori/{{ pg_ayatori_instance }}"
+    headers: {X-Vault-Token: "{{ pg_bao_token }}"}
+    status_code: [200, 404]
+  register: pg_admin_metadata
+  no_log: true
+- name: 只在明确缺失时写入独立的用户名密码
+  ansible.builtin.uri:
+    url: "{{ pg_bao_url }}/v1/kv/data/infra/postgresql/ayatori/{{ pg_ayatori_instance }}"
+    method: POST
+    headers: {X-Vault-Token: "{{ pg_bao_token }}"}
+    body_format: json
+    body:
+      options: {cas: 0}
+      data:
+        username: "{{ pg_loaded_credentials[pg_ayatori_instance].ayatori_username }}"
+        password: "{{ pg_loaded_credentials[pg_ayatori_instance].ayatori_password }}"
+    status_code: 200
+  when: pg_admin_metadata.status == 404
+  changed_when: true
+  no_log: true
+- name: 回读已有管理凭据
+  ansible.builtin.uri:
+    url: "{{ pg_bao_url }}/v1/kv/data/infra/postgresql/ayatori/{{ pg_ayatori_instance }}"
+    headers: {X-Vault-Token: "{{ pg_bao_token }}"}
+    status_code: 200
+  register: pg_admin_readback
+  no_log: true
+- name: 不隐式覆盖或轮换不一致凭据
+  ansible.builtin.assert:
+    that:
+      - pg_admin_readback.json.data.data.keys() | sort == ['password', 'username']
+      - pg_admin_readback.json.data.data.username == pg_loaded_credentials[pg_ayatori_instance].ayatori_username
+      - pg_admin_readback.json.data.data.password == pg_loaded_credentials[pg_ayatori_instance].ayatori_password
+  no_log: true