feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

2026-09-25 19:34:48 +00:00
parent acd4b55722
commit 3a2fe5fa0c
92 changed files with 4211 additions and 0 deletions
@@ -0,0 +1,46 @@
+---
+- name: 核对秘密元数据（非 404 错误不能视为不存在）
+  ansible.builtin.uri:
+    url: "{{ pg_bao_url }}/v1/kv/metadata/{{ pg_secret_paths[pg_secret_instance] }}"
+    headers:
+      X-Vault-Token: "{{ pg_bao_token }}"
+    status_code: [200, 404]
+  register: pg_secret_metadata
+  no_log: true
+- name: 明确不存在时创建一次
+  when: pg_secret_metadata.status == 404
+  block:
+    - name: 拒绝为已有实例重造丢失秘密
+      ansible.builtin.assert:
+        that: >-
+          groups['pg_hosts'] | map('extract', hostvars, 'pg_has_data')
+          | select('equalto', true) | list | length == 0
+    - name: 随机生成只在本次执行内存存在的值
+      ansible.builtin.set_fact:
+        pg_new_secret:
+          ayatori_username: ayatori
+          ayatori_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
+          superuser_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
+          replication_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
+          rest_password: "{{ lookup('password', '/dev/null', length=48, chars=['ascii_letters', 'digits']) }}"
+      no_log: true
+    - name: 使用 KV v2 CAS=0 防覆盖写入
+      ansible.builtin.uri:
+        url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_secret_paths[pg_secret_instance] }}"
+        method: POST
+        headers:
+          X-Vault-Token: "{{ pg_bao_token }}"
+        body_format: json
+        body:
+          options: {cas: 0}
+          data: "{{ pg_new_secret }}"
+        status_code: 200
+      changed_when: true
+      no_log: true
+- name: 确认已有秘密数据可读，软删除必须失败
+  ansible.builtin.uri:
+    url: "{{ pg_bao_url }}/v1/kv/data/{{ pg_secret_paths[pg_secret_instance] }}"
+    headers:
+      X-Vault-Token: "{{ pg_bao_token }}"
+    status_code: 200
+  no_log: true