Upgrade K3s and infrastructure with selective DNS relay

ansible/inventory/group_vars/all.yml

@@ -12,9 +12,13 @@ ha_server_url: "{{ lookup('env', 'HA_SERVER_URL') | default('', true) }}"
 # ============================================
 # K3s Server URL (优先使用 HA_SERVER_URL，否则动态使用 init 节点地址)
 k3s_server_url: "{{ ha_server_url if (ha_server_url | length > 0) else '' }}"
-k3s_version: "v1.35.6+k3s1"
+k3s_version: "v1.35.9+k3s1"
 tailscale_version: "1.102.3"
 
+# 仅这些节点到控制平面的 Tailscale 连接回落到中继；DNS 必须直接指向节点公网地址。
+tailscale_control_plane_relay_peers:
+  - tthk.node.dev.cm
+
 # ETCD 配置
 etcd_snapshot_retention: 1
 etcd_snapshot_schedule_cron: "0 0 * * *"