fix(k3s): streamline Ansible deployment and reduce output noise

ansible/README.md

@@ -154,6 +154,18 @@ ansible-playbook playbooks/site.yml -vvv
 ansible-playbook playbooks/site.yml --syntax-check
 ```
 
+默认隐藏 `skipped`，循环只显示文件名；保留正常状态、变更、失败和最终节点列表。SSH 登录方式、端口详情在 `-v` 时显示。使用 Ansible [内置回调配置](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/default_callback.html)，无需额外插件。
+
+```bash
+# 更安静：只显示变更、失败与执行汇总（也会隐藏 debug 节点列表）
+ANSIBLE_DISPLAY_OK_HOSTS=false ansible-playbook playbooks/site.yml
+
+# 排查被跳过的任务
+ANSIBLE_DISPLAY_SKIPPED_HOSTS=true ansible-playbook playbooks/site.yml -v
+```
+
+中继任务仅在 master 上动态加载，init/join 安装阶段也只为匹配的 master 加载 role。现有任务不依赖系统 facts，因此不再逐阶段采集；常规全量执行复用已探测的 init SSH 端口，只添加 worker 等未选中 init 的情况仍会单独探测。
+
 ## 升级已有集群
 
 加载 `ansible/.env` 后运行：
@@ -167,7 +179,7 @@ master 逐台升级，worker 保持并行（默认 20 forks）。已有 server
 
 选择性中继名单见 `inventory/group_vars/all.yml` 的 `tailscale_control_plane_relay_peers`，说明见 `README_MANUAL.md`。
 
-在安装 Ansible 的 Python 环境运行就绪检查回归：`python -m unittest discover -s tests -v`。
+在安装 Ansible 的 Python 环境运行本地回归：`python -m unittest discover -s tests -v`。测试使用临时 inventory，验证标签继承、节点调度、Token 分发、端口回退、版本判断和输出，不连接集群。
 
 ### 2026-10-16 执行记录
 

ansible/ansible.cfg

@@ -4,14 +4,12 @@ roles_path = roles
 host_key_checking = False
 retry_files_enabled = False
 stdout_callback = default
-callbacks_enabled = ansible.builtin.default
+display_skipped_hosts = False
+callback_result_format = yaml
 interpreter_python = /usr/bin/python3
 deprecation_warnings = False
 forks = 20
 
-[callback_default]
-result_format = yaml
-
 [privilege_escalation]
 become = True
 become_method = sudo

ansible/inventory/group_vars/all.yml

@@ -13,7 +13,7 @@ ha_server_url: "{{ lookup('env', 'HA_SERVER_URL') | default('', true) }}"
 # K3s Server URL (优先使用 HA_SERVER_URL，否则动态使用 init 节点地址)
 k3s_server_url: "{{ ha_server_url if (ha_server_url | length > 0) else '' }}"
 k3s_version: "v1.35.9+k3s1"
-tailscale_version: "1.102.3"
+tailscale_version: "1.104.4"
 
 # 仅这些节点到控制平面的 Tailscale 连接回落到中继；DNS 必须直接指向节点公网地址。
 tailscale_control_plane_relay_peers:

ansible/inventory/hosts.yml

@@ -61,6 +61,10 @@ all:
           node_hostname: tthk
           node_region: cn-hk
           enable_lb: true
+        vpsuk:
+          ansible_host: vpsuk.node.dev.cm
+          node_hostname: vpsuk
+          node_region: uk-lon
         alihk:
           ansible_host: alihk.node.dev.cm
           node_hostname: alihk

ansible/playbooks/site.yml

@@ -24,6 +24,7 @@
           {% else %}
           ✓ 使用密钥登录
           {% endif %}
+        verbosity: 1
       run_once: true
       delegate_to: localhost
 
@@ -36,16 +37,17 @@
       delegate_to: localhost
       become: false
       register: new_port_check
-      ignore_errors: true
+      failed_when: false
+      check_mode: false
 
     - name: Set SSH port based on availability
       ansible.builtin.set_fact:
-        ansible_port: "{{ ssh_new_port if new_port_check is succeeded else 22 }}"
+        ansible_port: "{{ ssh_new_port if new_port_check.state | default('') == 'started' else 22 }}"
 
     - name: Display detected SSH port
       ansible.builtin.debug:
         msg: "{{ inventory_hostname }}: 使用端口 {{ ansible_port }}"
-      when: ansible_verbosity > 0
+        verbosity: 1
 
 # ============================================
 # 阶段 1: SSH 安全加固 (可选，首次安装时使用)
@@ -62,7 +64,7 @@
 # ============================================
 - name: Common Setup
   hosts: k3s_cluster
-  gather_facts: true
+  gather_facts: false
   tags: [common]
   roles:
     - common
@@ -72,12 +74,16 @@
 # ============================================
 - name: Install K3s on init node
   hosts: masters
-  gather_facts: true
+  gather_facts: false
   serial: 1
   any_errors_fatal: true
   tags: [k3s]
-  roles:
-    - role: k3s
+  tasks:
+    - name: Configure the init master
+      ansible.builtin.include_role:
+        name: k3s
+        apply:
+          tags: [k3s]
       when: cluster_init | default(false)
 
 - name: Fetch K3S_TOKEN & K3S_SERVER_URL from init node
@@ -100,11 +106,15 @@
       delegate_to: localhost
       become: false
       register: init_node_port_check
-      ignore_errors: true
+      failed_when: false
+      check_mode: false
+      when: init_node not in ansible_play_hosts_all
 
     - name: Set init node SSH port
       ansible.builtin.set_fact:
-        init_node_port: "{{ ssh_new_port if init_node_port_check is succeeded else 22 }}"
+        init_node_port: >-
+          {{ hostvars[init_node].ansible_port if init_node in ansible_play_hosts_all else
+             (ssh_new_port if init_node_port_check.state | default('') == 'started' else 22) }}
 
     - name: Read K3S_TOKEN from init node
       ansible.builtin.slurp:
@@ -115,33 +125,30 @@
       vars:
         ansible_port: "{{ hostvars[inventory_hostname].init_node_port }}"
 
-    - name: Determine K3S_SERVER_URL
-      ansible.builtin.set_fact:
-        # 优先使用 HA_SERVER_URL 环境变量，否则使用 init 节点地址
-        k3s_server_url: "{{ ha_server_url if (ha_server_url | length > 0) else 'https://' + hostvars[init_node].ansible_host + ':6443' }}"
-
+    # run_once 的 set_fact 会将结果共享给当前 play 的所有目标节点。
     - name: Set K3S_TOKEN and K3S_SERVER_URL for target hosts
       ansible.builtin.set_fact:
         k3s_token: "{{ k3s_token_content.content | b64decode | trim }}"
-        k3s_server_url: "{{ k3s_server_url }}"
-      delegate_to: "{{ item }}"
-      delegate_facts: true
-      loop: "{{ ansible_play_hosts }}"
+        k3s_server_url: "{{ ha_server_url if (ha_server_url | length > 0) else 'https://' + hostvars[init_node].ansible_host + ':6443' }}"
       no_log: true
 
 - name: Install K3s on other masters
   hosts: masters
-  gather_facts: true
+  gather_facts: false
   serial: 1
   any_errors_fatal: true
   tags: [k3s]
-  roles:
-    - role: k3s
+  tasks:
+    - name: Configure the remaining masters
+      ansible.builtin.include_role:
+        name: k3s
+        apply:
+          tags: [k3s]
       when: not (cluster_init | default(false))
 
 - name: Install K3s on agents
   hosts: agents
-  gather_facts: true
+  gather_facts: false
   any_errors_fatal: true
   tags: [k3s]
   roles:

ansible/roles/common/tasks/control-plane-relay.yml

@@ -27,6 +27,8 @@
     - { src: k3s-control-plane-relay.py, dest: /usr/local/sbin/k3s-control-plane-relay, mode: "0755" }
     - { src: k3s-control-plane-relay.service, dest: /etc/systemd/system/k3s-control-plane-relay.service, mode: "0644" }
     - { src: k3s-control-plane-relay.timer, dest: /etc/systemd/system/k3s-control-plane-relay.timer, mode: "0644" }
+  loop_control:
+    label: "{{ item.src }}"
   register: control_plane_relay_files
 
 - name: Persist and apply selective relay

ansible/roles/common/tasks/main.yml

@@ -31,36 +31,23 @@
     state: present
     update_cache: true
 
-- name: Check if Tailscale is installed
-  ansible.builtin.command: which tailscale
-  register: common_tailscale_check
-  failed_when: false
-  changed_when: false
-
 - name: Check current Tailscale version
-  ansible.builtin.shell: tailscale version | head -1
+  ansible.builtin.command: tailscale version
   register: common_tailscale_version
   failed_when: false
   changed_when: false
-  when: common_tailscale_check.rc == 0
-
-- name: Set Tailscale install flag
-  ansible.builtin.set_fact:
-    tailscale_needs_install: "{{
-      common_tailscale_check.rc != 0 or
-      (common_tailscale_version.stdout | default('') is not search(tailscale_version))
-    }}"
+  check_mode: false
 
 - name: Download Tailscale install script
   ansible.builtin.get_url:
     url: https://tailscale.com/install.sh
     dest: /tmp/tailscale-install.sh
     mode: "0755"
-  when: common_tailscale_check.rc != 0
+  when: common_tailscale_version.rc != 0
 
 - name: Install Tailscale via install script
   ansible.builtin.command: /tmp/tailscale-install.sh
-  when: common_tailscale_check.rc != 0
+  when: common_tailscale_version.rc != 0
   changed_when: true
 
 - name: Install specific Tailscale version
@@ -69,7 +56,7 @@
       - "tailscale={{ tailscale_version }}"
     state: present
     allow_downgrade: true
-  when: tailscale_needs_install
+  when: (common_tailscale_version.stdout_lines | first | default('')) != tailscale_version
 
 - name: Remove Tailscale install script
   ansible.builtin.file:
@@ -83,6 +70,9 @@
     state: started
 
 - name: Configure selective control-plane relay
-  ansible.builtin.import_tasks: control-plane-relay.yml
+  ansible.builtin.include_tasks:
+    file: control-plane-relay.yml
+    apply:
+      tags: [control-plane-relay]
   when: inventory_hostname in groups['masters']
   tags: [control-plane-relay]

ansible/roles/k3s/tasks/main.yml

@@ -27,22 +27,12 @@
   when: k3s_binary.stat.exists
 
 # 部署配置文件（注册变更状态）
-- name: Deploy K3s server config
+- name: Deploy K3s config
   ansible.builtin.template:
-    src: k3s-server.yaml.j2
+    src: "{{ 'k3s-server.yaml.j2' if 'masters' in group_names else 'k3s-agent.yaml.j2' }}"
     dest: /etc/rancher/k3s/config.yaml
     mode: "0600"
-  when: "'masters' in group_names"
-  register: k3s_server_config
-  no_log: true
-
-- name: Deploy K3s agent config
-  ansible.builtin.template:
-    src: k3s-agent.yaml.j2
-    dest: /etc/rancher/k3s/config.yaml
-    mode: "0600"
-  when: "'agents' in group_names"
-  register: k3s_agent_config
+  register: k3s_config
   no_log: true
 
 - name: Deploy registries.yaml
@@ -60,18 +50,10 @@
     k3s_needs_install: "{{ 
       not k3s_binary.stat.exists or 
       (force_reinstall | default(false) | bool) or 
-      (k3s_server_config.changed | default(false)) or 
-      (k3s_agent_config.changed | default(false)) or
+      k3s_config.changed or
       (k3s_binary.stat.exists and k3s_current_version.stdout is defined and k3s_version not in k3s_current_version.stdout)
     }}"
 
-# 设置安装变量
-- name: Set K3s install variables
-  ansible.builtin.set_fact:
-    k3s_install_url: "{{ mirror_k3s_install_url if (use_mirror | default(false)) else global_k3s_install_url }}"
-    k3s_install_mirror: "{{ 'INSTALL_K3S_MIRROR=cn' if (use_mirror | default(false)) else '' }}"
-
-
 # 下载安装脚本
 - name: Save an uncompressed etcd snapshot before upgrading
   ansible.builtin.command:
@@ -79,7 +61,7 @@
       - /usr/local/bin/k3s
       - etcd-snapshot
       - save
-      - --etcd-snapshot-name
+      - --name
       - "pre-upgrade-{{ k3s_version }}"
       - --etcd-snapshot-compress=false
   when:
@@ -103,32 +85,21 @@
 
 - name: Download K3s install script
   ansible.builtin.get_url:
-    url: "{{ k3s_install_url }}"
+    url: "{{ mirror_k3s_install_url if (use_mirror | default(false)) else global_k3s_install_url }}"
     dest: /tmp/k3s-install.sh
     mode: "0755"
   when: k3s_needs_install
 
 # 安装 K3s
-- name: Install K3s server
+- name: Install K3s
   ansible.builtin.command:
-    cmd: /tmp/k3s-install.sh server
+    argv:
+      - /tmp/k3s-install.sh
+      - "{{ 'server' if 'masters' in group_names else 'agent' }}"
   environment:
     INSTALL_K3S_VERSION: "{{ k3s_version }}"
     INSTALL_K3S_MIRROR: "{{ 'cn' if (use_mirror | default(false)) else '' }}"
-  when:
-    - "'masters' in group_names"
-    - k3s_needs_install
-  changed_when: true
-
-- name: Install K3s agent
-  ansible.builtin.command:
-    cmd: /tmp/k3s-install.sh agent
-  environment:
-    INSTALL_K3S_VERSION: "{{ k3s_version }}"
-    INSTALL_K3S_MIRROR: "{{ 'cn' if (use_mirror | default(false)) else '' }}"
-  when:
-    - "'agents' in group_names"
-    - k3s_needs_install
+  when: k3s_needs_install
   changed_when: true
 
 # 清理安装脚本
@@ -143,8 +114,7 @@
     state: restarted
   when:
     - k3s_registries_config.changed | default(false)
-    - k3s_binary.stat.exists
-    - k3s_version in k3s_current_version.stdout
+    - not k3s_needs_install
 
 # /readyz includes the local API server's etcd readiness check.
 - name: Wait for the local API server and etcd to be ready