归档：Kata / microVM runner 实验（2026-09-17 工作区快照）

从旧工作区 chore/recover-old-workspace 清理时保存，内容与 2026-09-17
stash@{0} 快照中的版本一致；未合并、未在 main 上使用，仅作参考，不开 PR。
被 gitignore 的 tfstate 与凭据文件不在此分支，仍留在本地工作区。

Co-Authored-By: Claude Opus 5.5 <[email protected]>

infrastructure/kata-lab/terraform/cloud-init.yaml.tftpl

@@ -0,0 +1,34 @@
+#cloud-config
+hostname: ${hostname}
+manage_etc_hosts: true
+timezone: Etc/UTC
+
+users:
+  - default
+  - name: ansible
+    groups: [adm, sudo]
+    shell: /bin/bash
+    lock_passwd: true
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    ssh_authorized_keys:
+      - ${ssh_public_key}
+
+package_update: true
+package_upgrade: false
+packages:
+  - ca-certificates
+  - curl
+  - jq
+  - qemu-guest-agent
+
+runcmd:
+  - [systemctl, enable, --now, qemu-guest-agent]
+  - [modprobe, kvm_amd]
+  - [sh, -c, 'test -c /dev/kvm && echo available > /var/lib/cloud/nested-kvm.status || echo unavailable > /var/lib/cloud/nested-kvm.status']
+  - [sh, -c, 'curl -sfL https://get.k3s.io -o /tmp/install-k3s.sh']
+  - [chmod, '0755', /tmp/install-k3s.sh]
+  - [sh, -c, 'INSTALL_K3S_VERSION="${k3s_version}" INSTALL_K3S_EXEC="server --disable=traefik --write-kubeconfig-mode=0644" /tmp/install-k3s.sh']
+  - [sh, -c, 'kubectl wait --for=condition=Ready node/${hostname} --timeout=180s']
+  - [touch, /var/lib/cloud/kata-lab-bootstrap.done]
+
+final_message: "kata-lab bootstrap completed after $UPTIME seconds"