归档：Kata / microVM runner 实验（2026-09-17 工作区快照）

从旧工作区 chore/recover-old-workspace 清理时保存，内容与 2026-09-17 stash@{0} 快照中的版本一致；未合并、未在 main 上使用，仅作参考，不开 PR。被 gitignore 的 tfstate 与凭据文件不在此分支，仍留在本地工作区。 Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-01 17:30:48 +00:00
parent 69d3476a6b
commit 55bb5be8b6
39 changed files with 1891 additions and 0 deletions
@@ -0,0 +1,24 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/bpg/proxmox" {
+  version     = "0.111.1"
+  constraints = "0.111.1"
+  hashes = [
+    "h1:ML2D3UUZTM99yrll/EBXj7wBYMb8xmQgomqFNybEoxY=",
+    "zh:18fb7c31a08dde6bffa1a4d4a211e604d6d17eec7092fd59331b3db3c6f3742c",
+    "zh:1cd60761538289d4dd2a1086b3ae62a7b0bdd4b1a2f824e9a44e243413168dba",
+    "zh:2eb76f6fc8299b6820ff678c8252332cc3366e226b5ae2e61748fd2449c1ed92",
+    "zh:45e6f7ebd0bf48911d37060359a4f359b5743b3092e985295733990e406d0416",
+    "zh:4aa8ba912eae37975d2e983394d173e595ca34fc76b5bf220b37d0e99d76e98c",
+    "zh:58e0789923103a77d502a0a9fc3eb920625e8eb935ec2d4ac0d006aebd1d186c",
+    "zh:6df8aa85fb8865915537e946c19b02538ad188018a629759c213c6f03730f642",
+    "zh:6ed47bc00d0913a1d0880618fa1376115e9edab6b4a658c081061a7f0e4ca360",
+    "zh:c5b10ff4f33df7e4c29e8f1127d49845b561b37b57517e844fb0954d7923d65e",
+    "zh:d016510e14b738499f0db9d9b3aafe82fc6877fb4ab4e9f831fb68a8d70a1385",
+    "zh:d941f394069bbf24351b363da1c64383f487067aaee0a84f9b96476d4912e212",
+    "zh:ddf271dbc2632ae8ffa8de3972f243ee47d260cb2ac90aa784f2746d98e21a0f",
+    "zh:ed0caa3501c42f611b7e9622c9b1df69fd85dc25a3cd88d3076381829688cd62",
+    "zh:f26e0763dbe6a6b2195c94b44696f2110f7f55433dc142839be16b9697fa5597",
+  ]
+}
@@ -0,0 +1,34 @@
+#cloud-config
+hostname: ${hostname}
+manage_etc_hosts: true
+timezone: Etc/UTC
+
+users:
+  - default
+  - name: ansible
+    groups: [adm, sudo]
+    shell: /bin/bash
+    lock_passwd: true
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    ssh_authorized_keys:
+      - ${ssh_public_key}
+
+package_update: true
+package_upgrade: false
+packages:
+  - ca-certificates
+  - curl
+  - jq
+  - qemu-guest-agent
+
+runcmd:
+  - [systemctl, enable, --now, qemu-guest-agent]
+  - [modprobe, kvm_amd]
+  - [sh, -c, 'test -c /dev/kvm && echo available > /var/lib/cloud/nested-kvm.status || echo unavailable > /var/lib/cloud/nested-kvm.status']
+  - [sh, -c, 'curl -sfL https://get.k3s.io -o /tmp/install-k3s.sh']
+  - [chmod, '0755', /tmp/install-k3s.sh]
+  - [sh, -c, 'INSTALL_K3S_VERSION="${k3s_version}" INSTALL_K3S_EXEC="server --disable=traefik --write-kubeconfig-mode=0644" /tmp/install-k3s.sh']
+  - [sh, -c, 'kubectl wait --for=condition=Ready node/${hostname} --timeout=180s']
+  - [touch, /var/lib/cloud/kata-lab-bootstrap.done]
+
+final_message: "kata-lab bootstrap completed after $UPTIME seconds"
@@ -0,0 +1,3 @@
+# Copy this file to credentials.auto.tfvars and replace the placeholder.
+# Format: user@realm!token-id=token-secret
+proxmox_api_token = "REPLACE_ME"
@@ -0,0 +1,86 @@
+locals {
+  ssh_public_key = trimspace(file(pathexpand(var.ssh_public_key_file)))
+  cloud_init = templatefile("${path.module}/cloud-init.yaml.tftpl", {
+    hostname       = var.vm_name
+    ssh_public_key = local.ssh_public_key
+    k3s_version    = var.k3s_version
+  })
+}
+
+data "proxmox_file" "ubuntu_noble" {
+  content_type = "import"
+  datastore_id = var.snippet_datastore_id
+  node_name    = var.node_name
+  file_name    = "noble-server-cloudimg-amd64.qcow2"
+}
+
+resource "proxmox_virtual_environment_file" "cloud_init" {
+  content_type = "snippets"
+  datastore_id = var.snippet_datastore_id
+  node_name    = var.node_name
+
+  source_raw {
+    data      = local.cloud_init
+    file_name = "${var.vm_name}-cloud-init.yaml"
+  }
+}
+
+resource "proxmox_virtual_environment_vm" "kata_lab" {
+  name        = var.vm_name
+  description = "Disposable single-node k3s and Kata Containers validation environment."
+  tags        = ["terraform", "disposable", "kata"]
+
+  node_name = var.node_name
+  vm_id     = var.vm_id
+
+  started         = true
+  on_boot         = false
+  stop_on_destroy = true
+
+  agent {
+    enabled = true
+    timeout = "15m"
+  }
+
+  cpu {
+    cores = var.vm_cores
+    type  = "host"
+  }
+
+  memory {
+    dedicated = var.vm_memory_mb
+  }
+
+  operating_system {
+    type = "l26"
+  }
+
+  scsi_hardware = "virtio-scsi-single"
+
+  disk {
+    datastore_id = var.disk_datastore_id
+    import_from  = data.proxmox_file.ubuntu_noble.id
+    interface    = "scsi0"
+    iothread     = true
+    discard      = "on"
+    size         = var.vm_disk_gb
+  }
+
+  initialization {
+    datastore_id      = var.disk_datastore_id
+    user_data_file_id = proxmox_virtual_environment_file.cloud_init.id
+
+    ip_config {
+      ipv4 {
+        address = "dhcp"
+      }
+    }
+  }
+
+  network_device {
+    bridge = var.network_bridge
+    model  = "virtio"
+  }
+
+  serial_device {}
+}
@@ -0,0 +1,12 @@
+output "vm_id" {
+  value = proxmox_virtual_environment_vm.kata_lab.vm_id
+}
+
+output "vm_ipv4_addresses" {
+  description = "QEMU guest agent 报告的地址；忽略 loopback 和 CNI 地址后再用于 SSH。"
+  value       = proxmox_virtual_environment_vm.kata_lab.ipv4_addresses
+}
+
+output "ssh_user" {
+  value = "ansible"
+}
@@ -0,0 +1,17 @@
+provider "proxmox" {
+  endpoint  = var.proxmox_endpoint
+  api_token = var.proxmox_api_token
+
+  # Snippet uploads use SSH. The provider deliberately does not read
+  # ~/.ssh/config, so map the PVE node explicitly and use the current agent.
+  ssh {
+    agent       = false
+    username    = "root"
+    private_key = file(pathexpand(var.proxmox_ssh_private_key_file))
+
+    node {
+      name    = "pve2"
+      address = "192.168.10.7"
+    }
+  }
+}
@@ -0,0 +1,83 @@
+variable "proxmox_endpoint" {
+  description = "Proxmox VE API endpoint，不包含 /api2/json。"
+  type        = string
+  default     = "https://pve1.ad.ddupan.top:8006/"
+}
+
+variable "proxmox_api_token" {
+  description = "Proxmox API token，格式为 user@realm!token-id=secret。"
+  type        = string
+  sensitive   = true
+}
+
+variable "node_name" {
+  description = "承载 disposable kata-lab VM 的 PVE 节点。"
+  type        = string
+  default     = "pve2"
+}
+
+variable "vm_id" {
+  description = "kata-lab VMID。"
+  type        = number
+  default     = 147
+}
+
+variable "vm_name" {
+  description = "kata-lab VM 名称和 guest hostname。"
+  type        = string
+  default     = "kata-lab"
+}
+
+variable "vm_memory_mb" {
+  description = "VM 固定内存；pve2 只有约 7.4 GiB 可见内存。"
+  type        = number
+  default     = 4096
+}
+
+variable "vm_cores" {
+  description = "VM vCPU 数量。"
+  type        = number
+  default     = 4
+}
+
+variable "vm_disk_gb" {
+  description = "VM root disk 大小。"
+  type        = number
+  default     = 41
+}
+
+variable "disk_datastore_id" {
+  description = "VM root disk 所在 datastore。"
+  type        = string
+  default     = "pve-rg-hdd"
+}
+
+variable "snippet_datastore_id" {
+  description = "启用 snippets 的共享 datastore。"
+  type        = string
+  default     = "laptop"
+}
+
+variable "network_bridge" {
+  description = "连接 kata-lab VM 的 PVE bridge。"
+  type        = string
+  default     = "vmbr0"
+}
+
+variable "ssh_public_key_file" {
+  description = "注入 cloud-init 用户的 SSH 公钥路径。"
+  type        = string
+  default     = "~/.ssh/id_ed25519.pub"
+}
+
+variable "proxmox_ssh_private_key_file" {
+  description = "provider 上传 snippet 时登录 PVE 节点使用的私钥路径。"
+  type        = string
+  default     = "~/.ssh/id_ed25519"
+}
+
+variable "k3s_version" {
+  description = "可选的固定 k3s 版本；空值使用 stable channel。"
+  type        = string
+  default     = ""
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.10.0"
+
+  required_providers {
+    proxmox = {
+      source  = "bpg/proxmox"
+      version = "0.111.1"
+    }
+  }
+}