feat: 声明 sandbox 双节点 K3s 集群

infrastructure/proxmox/ansible/roles/vyos_router/defaults/main.yml

@@ -71,3 +71,20 @@ vyos_ospf_router_id: "192.168.10.2"
 vyos_ospf_area: "0"
 vyos_ospf_networks:
   - "192.168.10.0/24"
+
+# Stable K3s datastore endpoint. Only the declared writable primary is present
+# in the backend; PostgreSQL health checks must never be treated as promotion.
+vyos_postgresql_listen_address: "10.60.0.1"
+vyos_postgresql_port: 5432
+vyos_postgresql_primary_address: "10.60.0.11"
+
+# Stable API endpoint for the two-node sandbox K3s control plane. HAProxy owns
+# this /32 on the existing labnet interface and performs only TCP health checks.
+vyos_sandbox_k3s_api_address: "10.60.0.13"
+vyos_sandbox_k3s_api_interface: eth1
+vyos_sandbox_k3s_api_port: 6443
+vyos_sandbox_k3s_servers:
+  - name: sandbox1
+    address: "10.60.0.11"
+  - name: sandbox2
+    address: "10.60.0.12"

infrastructure/proxmox/ansible/roles/vyos_router/tasks/main.yml

@@ -3,6 +3,23 @@
 # `set` lines against the running config and issues only the differences, so
 # re-runs are no-ops. Supports --check and --diff.
 
+- name: Read current VyOS configuration commands
+  vyos.vyos.vyos_command:
+    commands:
+      - show configuration commands
+  register: _vyos_running_commands
+  changed_when: false
+
+- name: Remove obsolete HAProxy PostgreSQL protocol check
+  vyos.vyos.vyos_config:
+    lines:
+      - delete load-balancing haproxy backend sandbox-postgresql-primary health-check
+    save: true
+    comment: Remove unsupported PostgreSQL protocol check
+  when: >-
+    "set load-balancing haproxy backend sandbox-postgresql-primary health-check 'pgsql'"
+    in _vyos_running_commands.stdout[0]
+
 - name: Render the desired configuration
   ansible.builtin.set_fact:
     _vyos_lines: >-

infrastructure/proxmox/ansible/roles/vyos_router/templates/vyos.conf.j2

@@ -29,6 +29,29 @@ set protocols ospf area {{ vyos_ospf_area }} network {{ i.network }}
 set protocols ospf interface {{ i.iface }} passive
 {% endfor %}
 
+{# --- K3s PostgreSQL datastore: fixed endpoint, explicitly selected primary --- #}
+set load-balancing haproxy service sandbox-postgresql listen-address {{ vyos_postgresql_listen_address }}
+set load-balancing haproxy service sandbox-postgresql port {{ vyos_postgresql_port }}
+set load-balancing haproxy service sandbox-postgresql mode 'tcp'
+set load-balancing haproxy service sandbox-postgresql backend 'sandbox-postgresql-primary'
+set load-balancing haproxy backend sandbox-postgresql-primary mode 'tcp'
+set load-balancing haproxy backend sandbox-postgresql-primary server primary address {{ vyos_postgresql_primary_address }}
+set load-balancing haproxy backend sandbox-postgresql-primary server primary port {{ vyos_postgresql_port }}
+set load-balancing haproxy backend sandbox-postgresql-primary server primary check
+
+{# --- Sandbox K3s API: stable address with both control-plane nodes --- #}
+set interfaces ethernet {{ vyos_sandbox_k3s_api_interface }} address '{{ vyos_sandbox_k3s_api_address }}/32'
+set load-balancing haproxy service sandbox-k3s-api listen-address {{ vyos_sandbox_k3s_api_address }}
+set load-balancing haproxy service sandbox-k3s-api port {{ vyos_sandbox_k3s_api_port }}
+set load-balancing haproxy service sandbox-k3s-api mode 'tcp'
+set load-balancing haproxy service sandbox-k3s-api backend 'sandbox-k3s-api'
+set load-balancing haproxy backend sandbox-k3s-api mode 'tcp'
+{% for server in vyos_sandbox_k3s_servers %}
+set load-balancing haproxy backend sandbox-k3s-api server {{ server.name }} address {{ server.address }}
+set load-balancing haproxy backend sandbox-k3s-api server {{ server.name }} port {{ vyos_sandbox_k3s_api_port }}
+set load-balancing haproxy backend sandbox-k3s-api server {{ server.name }} check
+{% endfor %}
+
 {# --- management --- #}
 set service ssh port 22