feat: 声明 sandbox 双节点 K3s 集群

2026-09-17 14:57:48 +00:00
parent cadfee0aea
commit 6585d8c46a
25 changed files with 1132 additions and 0 deletions
@@ -0,0 +1,54 @@
+---
+- name: Reconcile sandbox LXC nodes
+  hosts: sandbox_pve
+  gather_facts: false
+  serial: 1
+  roles:
+    - sandbox_lxc
+
+- name: Reconcile sandbox node OS baseline
+  hosts: k3s_cluster
+  gather_facts: false
+  roles:
+    - sandbox_base
+
+- name: Reconcile sandbox PostgreSQL primary
+  hosts: postgres_primary
+  gather_facts: false
+  roles:
+    - sandbox_postgresql
+
+- name: Reconcile sandbox PostgreSQL synchronous standby
+  hosts: postgres_standby
+  gather_facts: false
+  roles:
+    - sandbox_postgresql
+
+- name: Finalize synchronous PostgreSQL settings
+  hosts: postgres_primary
+  gather_facts: false
+  roles:
+    - sandbox_postgresql
+
+- name: Validate runtime K3s datastore credential
+  hosts: k3s_cluster
+  gather_facts: false
+  tasks:
+    - name: Require the Bao-provided PostgreSQL password
+      ansible.builtin.assert:
+        that:
+          - sandbox_postgresql_k3s_password | length > 0
+          - server_config_yaml is defined
+          - (server_config_yaml | from_yaml)['datastore-endpoint'] == sandbox_k3s_datastore_endpoint
+        fail_msg: SANDBOX_K3S_DB_PASSWORD must be populated from Bao
+        quiet: true
+      no_log: true
+
+- name: Install the sandbox K3s control plane
+  ansible.builtin.import_playbook: k3s.orchestration.site
+
+- name: Reconcile Flux controllers and root sync
+  hosts: sandbox1
+  gather_facts: false
+  roles:
+    - sandbox_flux