归档：Kata / microVM runner 实验（2026-09-17 工作区快照）

从旧工作区 chore/recover-old-workspace 清理时保存，内容与 2026-09-17
stash@{0} 快照中的版本一致；未合并、未在 main 上使用，仅作参考，不开 PR。
被 gitignore 的 tfstate 与凭据文件不在此分支，仍留在本地工作区。

Co-Authored-By: Claude Opus 5.5 <[email protected]>

infrastructure/kata-lxc-lab/terraform/.terraform.lock.hcl

@@ -0,0 +1,24 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/bpg/proxmox" {
+  version     = "0.111.1"
+  constraints = "0.111.1"
+  hashes = [
+    "h1:ML2D3UUZTM99yrll/EBXj7wBYMb8xmQgomqFNybEoxY=",
+    "zh:18fb7c31a08dde6bffa1a4d4a211e604d6d17eec7092fd59331b3db3c6f3742c",
+    "zh:1cd60761538289d4dd2a1086b3ae62a7b0bdd4b1a2f824e9a44e243413168dba",
+    "zh:2eb76f6fc8299b6820ff678c8252332cc3366e226b5ae2e61748fd2449c1ed92",
+    "zh:45e6f7ebd0bf48911d37060359a4f359b5743b3092e985295733990e406d0416",
+    "zh:4aa8ba912eae37975d2e983394d173e595ca34fc76b5bf220b37d0e99d76e98c",
+    "zh:58e0789923103a77d502a0a9fc3eb920625e8eb935ec2d4ac0d006aebd1d186c",
+    "zh:6df8aa85fb8865915537e946c19b02538ad188018a629759c213c6f03730f642",
+    "zh:6ed47bc00d0913a1d0880618fa1376115e9edab6b4a658c081061a7f0e4ca360",
+    "zh:c5b10ff4f33df7e4c29e8f1127d49845b561b37b57517e844fb0954d7923d65e",
+    "zh:d016510e14b738499f0db9d9b3aafe82fc6877fb4ab4e9f831fb68a8d70a1385",
+    "zh:d941f394069bbf24351b363da1c64383f487067aaee0a84f9b96476d4912e212",
+    "zh:ddf271dbc2632ae8ffa8de3972f243ee47d260cb2ac90aa784f2746d98e21a0f",
+    "zh:ed0caa3501c42f611b7e9622c9b1df69fd85dc25a3cd88d3076381829688cd62",
+    "zh:f26e0763dbe6a6b2195c94b44696f2110f7f55433dc142839be16b9697fa5597",
+  ]
+}

infrastructure/kata-lxc-lab/terraform/main.tf

@@ -0,0 +1,95 @@
+locals {
+  ssh_public_key = trimspace(file(pathexpand(var.ssh_public_key_file)))
+}
+
+data "proxmox_file" "ubuntu_noble" {
+  content_type = "vztmpl"
+  datastore_id = var.template_datastore
+  node_name    = var.proxmox_node
+  file_name    = var.template_file_name
+}
+
+resource "proxmox_virtual_environment_container" "kata_lxc_lab" {
+  node_name = var.proxmox_node
+  vm_id     = var.container_id
+
+  description   = "Disposable privileged LXC for validating k3s and Kata with direct host KVM access."
+  unprivileged  = false
+  started       = true
+  start_on_boot = false
+  tags          = ["disposable", "kata", "lxc", "terraform"]
+
+  cpu {
+    cores = 4
+  }
+
+  memory {
+    dedicated = 8192
+    swap      = 0
+  }
+
+  disk {
+    datastore_id = var.root_datastore
+    size         = 16
+  }
+
+  features {
+    fuse    = true
+    keyctl  = true
+    mknod   = true
+    nesting = true
+  }
+
+  device_passthrough {
+    path = "/dev/kvm"
+    mode = "0660"
+  }
+
+  device_passthrough {
+    path = "/dev/vhost-net"
+    mode = "0660"
+  }
+
+  device_passthrough {
+    path = "/dev/vhost-vsock"
+    mode = "0660"
+  }
+
+  device_passthrough {
+    path = "/dev/kmsg"
+    mode = "0660"
+  }
+
+  device_passthrough {
+    path = "/dev/net/tun"
+    mode = "0666"
+  }
+
+  initialization {
+    hostname = var.container_name
+
+    ip_config {
+      ipv4 {
+        address = "dhcp"
+      }
+    }
+
+    user_account {
+      keys = [local.ssh_public_key]
+    }
+  }
+
+  network_interface {
+    name   = "eth0"
+    bridge = "vmbr0"
+  }
+
+  operating_system {
+    template_file_id = data.proxmox_file.ubuntu_noble.id
+    type             = "ubuntu"
+  }
+
+  wait_for_ip {
+    ipv4 = true
+  }
+}

infrastructure/kata-lxc-lab/terraform/outputs.tf

@@ -0,0 +1,7 @@
+output "container_id" {
+  value = proxmox_virtual_environment_container.kata_lxc_lab.vm_id
+}
+
+output "ipv4" {
+  value = proxmox_virtual_environment_container.kata_lxc_lab.ipv4
+}

infrastructure/kata-lxc-lab/terraform/provider.tf

@@ -0,0 +1,15 @@
+provider "proxmox" {
+  endpoint  = var.proxmox_endpoint
+  api_token = var.proxmox_api_token
+
+  ssh {
+    agent       = false
+    username    = "root"
+    private_key = file(pathexpand(var.proxmox_ssh_private_key_file))
+
+    node {
+      name    = var.proxmox_node
+      address = var.proxmox_node_address
+    }
+  }
+}

infrastructure/kata-lxc-lab/terraform/variables.tf

@@ -0,0 +1,54 @@
+variable "proxmox_endpoint" {
+  type    = string
+  default = "https://pve1.ad.ddupan.top:8006"
+}
+
+variable "proxmox_api_token" {
+  type      = string
+  sensitive = true
+}
+
+variable "proxmox_node" {
+  type    = string
+  default = "pve2"
+}
+
+variable "proxmox_node_address" {
+  type    = string
+  default = "192.168.10.7"
+}
+
+variable "proxmox_ssh_private_key_file" {
+  type    = string
+  default = "~/.ssh/id_ed25519"
+}
+
+variable "ssh_public_key_file" {
+  type    = string
+  default = "~/.ssh/id_ed25519.pub"
+}
+
+variable "container_id" {
+  type    = number
+  default = 147
+}
+
+variable "container_name" {
+  type    = string
+  default = "kata-lxc-lab"
+}
+
+variable "template_datastore" {
+  type    = string
+  default = "laptop"
+}
+
+variable "template_file_name" {
+  type    = string
+  default = "ubuntu-24.04-standard_24.04-2_amd64.tar.zst"
+}
+
+variable "root_datastore" {
+  type    = string
+  default = "local-lvm"
+}

infrastructure/kata-lxc-lab/terraform/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.10"
+
+  required_providers {
+    proxmox = {
+      source  = "bpg/proxmox"
+      version = "0.111.1"
+    }
+  }
+}