feat(ansible): add K3s installation playbooks and configuration templates

ansible/.env.example

@@ -0,0 +1,18 @@
+# 环境变量模板
+# 复制为 .env 并填写实际值，然后 source .env
+
+# Tailscale Auth Key (必须)
+export TAILSCALE_AUTH_KEY=""
+
+# K3s Token (添加节点时需要，从首节点安装输出获取)
+export K3S_TOKEN=""
+
+# K3s Server URL (添加节点时需要)
+export K3S_SERVER_URL="https://k3s.dev.cm:6443"
+
+# SSH 密码 (如果使用密码认证，必须设置；如果使用密钥认证，留空)
+export SSH_PASSWORD=""
+
+# SSH 公钥路径 (默认 ~/.ssh/id_rsa.pub)
+# export SSH_PUBKEY=""
+

ansible/.gitignore

@@ -0,0 +1,17 @@
+# Ansible 临时文件
+*.retry
+
+# 敏感文件
+kubeconfig.yaml
+kubeconfig-*.yaml
+*.pem
+*.key
+
+# 本地环境
+.env
+.env.local
+
+# IDE
+.idea/
+.vscode/
+

ansible/README.md

@@ -0,0 +1,166 @@
+# K3s Ansible 自动化安装
+
+一键部署 K3s 集群，支持国内镜像加速、Tailscale 组网、SSH 安全加固。
+
+## 目录结构
+
+```
+ansible/
+├── ansible.cfg                 # Ansible 配置
+├── inventory/hosts.yml         # 主机清单 ⭐ 需修改
+├── group_vars/all.yml          # 全局变量
+├── .env.example                # 环境变量模板
+├── roles/
+│   ├── ssh/                    # SSH 安全加固
+│   │   ├── tasks/main.yml
+│   │   └── templates/sshd_config.j2
+│   ├── common/                 # 基础配置 (hostname, sysctl, tailscale)
+│   │   ├── tasks/main.yml
+│   │   └── handlers/main.yml
+│   └── k3s/                    # K3s 安装
+│       ├── tasks/main.yml
+│       └── templates/
+│           ├── k3s-server.yaml.j2   # Server 配置 (统一 init/join)
+│           ├── k3s-agent.yaml.j2    # Agent 配置
+│           └── registries.yaml.j2   # 镜像加速
+└── playbooks/
+    ├── site.yml                # 完整安装
+    ├── init.yml                # 首次安装 (含 SSH 加固)
+    └── add-node.yml            # 添加节点
+```
+
+## 快速开始
+
+### 1. 配置主机清单
+
+编辑 `inventory/hosts.yml`:
+
+```yaml
+masters:
+  hosts:
+    master1:
+      ansible_host: 10.0.0.1
+      node_hostname: master1
+      cluster_init: true        # 首个节点设为 true
+      node_region: cn-sh        # 区域标签
+      use_mirror: true          # 使用镜像加速
+      enable_lb: true           # 启用 LB
+      netfilter_mode: ""        # 阿里云/华为云设为 nodivert
+```
+
+### 2. 设置环境变量
+
+```bash
+# 必须
+export TAILSCALE_AUTH_KEY="tskey-auth-xxx"
+
+# 首次安装 (SSH 加固)
+export SSH_PASSWORD="your-root-password"
+
+# 添加节点时 (从首节点安装输出获取)
+export K3S_TOKEN="K10xxx::server:xxx"
+export K3S_SERVER_URL="https://10.0.0.1:6443"
+```
+
+### 3. 执行安装
+
+```bash
+cd k3s/ansible
+
+# 方式一: 首次安装 (含 SSH 加固，端口改为 2103，启用密钥认证)
+ansible-playbook playbooks/site.yml --tags ssh,common,k3s,status
+
+# 方式二: 常规安装 (已配置 SSH 密钥)
+ansible-playbook playbooks/site.yml
+
+# 方式三: 仅安装首个 master
+ansible-playbook playbooks/site.yml -l master1
+
+# 方式四: 添加新节点
+ansible-playbook playbooks/add-node.yml -l agent1
+```
+
+### 4. 获取 kubeconfig
+
+```bash
+# 安装完成后自动保存到 ansible/kubeconfig.yaml
+sed -i '' 's/127.0.0.1/k3s.yourdomain.com/g' kubeconfig.yaml
+export KUBECONFIG=$(pwd)/kubeconfig.yaml
+kubectl get nodes
+```
+
+## 节点变量
+
+| 变量 | 类型 | 默认值 | 说明 |
+|------|------|--------|------|
+| `ansible_host` | string | - | 节点 IP |
+| `node_hostname` | string | - | 主机名 |
+| `cluster_init` | bool | false | 首个 master 设为 true |
+| `node_region` | string | - | 区域标签 (cn-sh/hk/us-west) |
+| `use_mirror` | bool | false | 使用镜像加速 |
+| `enable_lb` | bool | - | 启用 K3s LB |
+| `netfilter_mode` | string | "" | Tailscale netfilter: off/nodivert/on |
+| `node_labels` | dict | - | 自定义标签 |
+| `kubelet_reserved` | string | - | 资源预留: cpu=500m,memory=512Mi |
+
+## 环境变量
+
+| 变量 | 必须 | 说明 |
+|------|------|------|
+| `TAILSCALE_AUTH_KEY` | ✅ | Tailscale Auth Key |
+| `K3S_TOKEN` | 加入节点时 | 集群 Token |
+| `K3S_SERVER_URL` | 加入节点时 | API Server 地址 |
+| `SSH_PASSWORD` | 首次安装 | SSH 密码 |
+| `SSH_PUBKEY` | - | SSH 公钥 (默认 ~/.ssh/id_rsa.pub) |
+
+## 镜像加速
+
+当 `use_mirror: true` 时自动启用:
+
+- K3s 安装脚本: `rancher-mirror.rancher.cn`
+- 常规容器镜像加速
+
+## SSH 安全加固
+
+首次安装时 (`--tags ssh`) 自动执行:
+
+1. 端口改为 2103
+2. 禁用密码登录
+3. 启用密钥认证
+4. 自动添加本地公钥
+
+## 常用命令
+
+```bash
+# 测试连接
+ansible all -m ping
+
+# 仅运行特定阶段
+ansible-playbook playbooks/site.yml --tags common
+ansible-playbook playbooks/site.yml --tags k3s
+
+# 指定节点
+ansible-playbook playbooks/site.yml -l master1,agent1
+
+# 调试模式
+ansible-playbook playbooks/site.yml -vvv
+
+# 检查语法
+ansible-playbook playbooks/site.yml --syntax-check
+```
+
+## 故障排查
+
+```bash
+# K3s 状态
+systemctl status k3s
+journalctl -u k3s -f
+
+# Tailscale 状态
+tailscale status
+
+# 获取 Token
+cat /var/lib/rancher/k3s/server/node-token
+```
+
+

ansible/ansible.cfg

@@ -0,0 +1,18 @@
+[defaults]
+inventory = inventory/hosts.yml
+roles_path = roles
+host_key_checking = False
+retry_files_enabled = False
+stdout_callback = yaml
+interpreter_python = auto_silent
+
+[privilege_escalation]
+become = True
+become_method = sudo
+become_user = root
+
+[ssh_connection]
+pipelining = True
+ssh_args = -o ControlMaster=auto -o ControlPersist=60s
+
+

ansible/group_vars/all.yml

@@ -0,0 +1,46 @@
+# K3s Ansible 全局变量
+---
+# ============================================
+# 敏感信息 (通过环境变量传入)
+# ============================================
+tailscale_auth_key: "{{ lookup('env', 'TAILSCALE_AUTH_KEY') }}"
+k3s_token: "{{ lookup('env', 'K3S_TOKEN') }}"
+k3s_server_url: "{{ lookup('env', 'K3S_SERVER_URL') | default('https://k3s.dev.cm:6443', true) }}"
+
+# ============================================
+# K3s 配置
+# ============================================
+k3s_version: "v1.31.4+k3s1"
+k3s_tls_san: "k3s.dev.cm,k3s.fillcode.com"
+
+# ETCD 配置
+etcd_snapshot_retention: 1
+etcd_snapshot_schedule_cron: "0 0 * * *"
+etcd_snapshot_compress: true
+
+# 禁用的组件
+k3s_disable_components:
+  - traefik
+
+# ============================================
+# 安装源配置
+# ============================================
+# 国内镜像源
+mirror_k3s_install_url: "https://rancher-mirror.rancher.cn/k3s/k3s-install.sh"
+# 官方源
+global_k3s_install_url: "https://get.k3s.io"
+
+# ============================================
+# 镜像加速配置 (use_mirror: true 时启用)
+# ============================================
+registry_mirrors:
+  docker.io:
+    - "docker.1ms.run"
+    - "docker.m.daocloud.io"
+  ghcr.io:
+    - "ghcr.m.daocloud.io"
+  registry.k8s.io:
+    - "k8s.m.daocloud.io"
+  quay.io:
+    - "quay.m.daocloud.io"
+

ansible/inventory/hosts.yml

@@ -0,0 +1,54 @@
+# K3s 集群主机清单
+---
+all:
+  vars:
+    # SSH 配置 (初始连接使用密码)
+    ansible_user: root
+    ansible_port: 2103
+    ansible_password: "{{ lookup('env', 'SSH_PASSWORD') }}"
+
+    # SSH 安全配置
+    ssh_new_port: 2103
+    ssh_pubkey: "{{ lookup('env', 'SSH_PUBKEY') | default(lookup('file', '~/.ssh/id_rsa.pub'), true) }}"
+
+  children:
+    # Master 节点 (Server)
+    masters:
+      hosts:
+        tca:
+          ansible_host: tca.node.dev.cm
+          node_hostname: tca
+          cluster_init: true
+          node_region: cn-sh
+          use_mirror: true
+        tcb:
+          ansible_host: tcb.node.dev.cm
+          node_hostname: tcb
+          node_region: cn-sh
+          use_mirror: true
+        tcc:
+          ansible_host: tcc.node.dev.cm
+          node_hostname: tcc
+          node_region: cn-sh
+          use_mirror: true
+
+    # Agent 节点 (Worker)
+    agents:
+      hosts:
+        alihk:
+          ansible_host: alihk.node.dev.cm
+          node_hostname: alihk
+          node_region: cn-hk
+          enable_lb: true
+          netfilter_mode: nodivert
+        clawhk:
+          ansible_host: clawhk.node.dev.cm
+          node_hostname: clawhk
+          node_region: cn-hk
+
+    # 节点分组
+    k3s_cluster:
+      children:
+        masters:
+        agents:
+

ansible/playbooks/add-node.yml

@@ -0,0 +1,19 @@
+# 添加新节点到集群
+# 使用: export K3S_TOKEN='xxx' K3S_SERVER_URL='xxx' TAILSCALE_AUTH_KEY='xxx'
+#       ansible-playbook playbooks/add-node.yml -l <node_name>
+---
+- name: Validate
+  hosts: localhost
+  gather_facts: no
+  tasks:
+    - ansible.builtin.fail:
+        msg: "请设置: export K3S_TOKEN='xxx'"
+      when: lookup('env', 'K3S_TOKEN') | length == 0
+
+- name: Add node
+  hosts: masters:agents:!master_init
+  gather_facts: yes
+  roles:
+    - common
+    - k3s
+

ansible/playbooks/init.yml

@@ -0,0 +1,8 @@
+# 首次安装 (包含 SSH 加固)
+# 使用: export SSH_PASSWORD='xxx' TAILSCALE_AUTH_KEY='xxx'
+#       ansible-playbook playbooks/init.yml
+---
+- name: First time installation with SSH hardening
+  import_playbook: site.yml
+  tags: [ssh, common, k3s, status]
+

ansible/playbooks/site.yml

@@ -0,0 +1,93 @@
+# K3s 集群安装 Playbook
+---
+- name: Validate environment
+  hosts: localhost
+  gather_facts: no
+  tasks:
+    - name: Check TAILSCALE_AUTH_KEY
+      ansible.builtin.fail:
+        msg: "请设置: export TAILSCALE_AUTH_KEY='tskey-auth-xxx'"
+      when: lookup('env', 'TAILSCALE_AUTH_KEY') | length == 0
+
+    - name: Check SSH credentials
+      ansible.builtin.debug:
+        msg: |
+          {% if lookup('env', 'SSH_PASSWORD') | length > 0 %}
+          ✓ 使用密码登录 (首次安装)
+          {% else %}
+          ✓ 使用密钥登录
+          {% endif %}
+
+# ============================================
+# 阶段 1: SSH 安全加固 (可选，首次安装时使用)
+# ============================================
+- name: SSH Security Hardening
+  hosts: k3s_cluster
+  gather_facts: no
+  tags: [ssh, never]
+  roles:
+    - ssh
+
+# ============================================
+# 阶段 2: 基础配置
+# ============================================
+- name: Common Setup
+  hosts: k3s_cluster
+  gather_facts: yes
+  tags: [common]
+  roles:
+    - common
+
+# ============================================
+# 阶段 3: 安装 K3s (按顺序: init -> masters -> agents)
+# ============================================
+- name: Install K3s on init node
+  hosts: masters
+  gather_facts: yes
+  serial: 1
+  tags: [k3s]
+  roles:
+    - role: k3s
+      when: cluster_init | default(false)
+
+- name: Install K3s on other masters
+  hosts: masters
+  gather_facts: yes
+  serial: 1
+  tags: [k3s]
+  roles:
+    - role: k3s
+      when: not (cluster_init | default(false))
+
+- name: Install K3s on agents
+  hosts: agents
+  gather_facts: yes
+  tags: [k3s]
+  roles:
+    - k3s
+
+# ============================================
+# 阶段 4: 显示集群状态
+# ============================================
+- name: Show cluster status
+  hosts: masters
+  gather_facts: no
+  tags: [status]
+  run_once: true
+  tasks:
+    - name: Get nodes
+      ansible.builtin.shell: kubectl get nodes -o wide
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      register: nodes
+      when: cluster_init | default(false)
+
+    - name: Display nodes
+      ansible.builtin.debug:
+        msg: |
+          ══════════════════════════════════════════════════════════════
+          K3s 集群节点:
+          {{ nodes.stdout }}
+          ══════════════════════════════════════════════════════════════
+      when: cluster_init | default(false)
+

ansible/roles/common/handlers/main.yml

@@ -0,0 +1,4 @@
+---
+- name: Apply sysctl
+  ansible.builtin.command: sysctl --system
+

ansible/roles/common/tasks/main.yml

@@ -0,0 +1,46 @@
+# 基础配置 Role
+# 功能: hostname、sysctl、Tailscale 安装
+---
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ node_hostname }}"
+  when: node_hostname is defined
+
+- name: Update /etc/hosts
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    regexp: '^127\.0\.1\.1'
+    line: "127.0.1.1 {{ node_hostname }}"
+  when: node_hostname is defined
+
+- name: Configure sysctl for IP forwarding
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/99-k3s.conf
+    content: |
+      net.ipv4.ip_forward = 1
+      net.ipv6.conf.all.forwarding = 1
+    mode: '0644'
+  notify: Apply sysctl
+
+- name: Install dependencies
+  ansible.builtin.apt:
+    name: [curl, wget, ca-certificates]
+    state: present
+    update_cache: yes
+
+- name: Check if Tailscale is installed
+  ansible.builtin.command: which tailscale
+  register: tailscale_check
+  ignore_errors: yes
+  changed_when: false
+
+- name: Install Tailscale
+  ansible.builtin.shell: curl -fsSL https://tailscale.com/install.sh | sh
+  when: tailscale_check.rc != 0
+
+- name: Enable Tailscale service
+  ansible.builtin.systemd:
+    name: tailscaled
+    enabled: yes
+    state: started
+

ansible/roles/k3s/tasks/main.yml

@@ -0,0 +1,103 @@
+# K3s 安装 Role (统一 Server 和 Agent)
+---
+- name: Validate TAILSCALE_AUTH_KEY
+  ansible.builtin.fail:
+    msg: "请设置环境变量: export TAILSCALE_AUTH_KEY='tskey-auth-xxx'"
+  when: tailscale_auth_key | length == 0
+
+- name: Validate K3S_TOKEN for join nodes
+  ansible.builtin.fail:
+    msg: "请设置环境变量: export K3S_TOKEN='xxx'"
+  when:
+    - not (cluster_init | default(false))
+    - k3s_token | length == 0
+
+- name: Create K3s config directory
+  ansible.builtin.file:
+    path: /etc/rancher/k3s
+    state: directory
+    mode: '0755'
+
+# Server 节点配置
+- name: Deploy K3s server config
+  ansible.builtin.template:
+    src: k3s-server.yaml.j2
+    dest: /etc/rancher/k3s/config.yaml
+    mode: '0600'
+  when: "'masters' in group_names"
+
+# Agent 节点配置
+- name: Deploy K3s agent config
+  ansible.builtin.template:
+    src: k3s-agent.yaml.j2
+    dest: /etc/rancher/k3s/config.yaml
+    mode: '0600'
+  when: "'agents' in group_names"
+
+# 镜像加速配置
+- name: Deploy registries.yaml
+  ansible.builtin.template:
+    src: registries.yaml.j2
+    dest: /etc/rancher/k3s/registries.yaml
+    mode: '0644'
+  when: use_mirror | default(false)
+
+# 安装 K3s
+- name: Set install URL
+  ansible.builtin.set_fact:
+    k3s_install_url: "{{ mirror_k3s_install_url if (use_mirror | default(false)) else global_k3s_install_url }}"
+    k3s_install_mirror: "{{ 'INSTALL_K3S_MIRROR=cn' if (use_mirror | default(false)) else '' }}"
+
+- name: Check if K3s is installed
+  ansible.builtin.stat:
+    path: /usr/local/bin/k3s
+  register: k3s_binary
+
+- name: Install K3s server
+  ansible.builtin.shell: |
+    curl -sfL {{ k3s_install_url }} | {{ k3s_install_mirror }} INSTALL_K3S_VERSION={{ k3s_version }} sh -s - server
+  when:
+    - "'masters' in group_names"
+    - not k3s_binary.stat.exists
+
+- name: Install K3s agent
+  ansible.builtin.shell: |
+    curl -sfL {{ k3s_install_url }} | {{ k3s_install_mirror }} INSTALL_K3S_VERSION={{ k3s_version }} sh -s - agent
+  when:
+    - "'agents' in group_names"
+    - not k3s_binary.stat.exists
+
+# 等待 K3s 就绪 (仅 Server)
+- name: Wait for K3s server ready
+  ansible.builtin.wait_for:
+    path: /var/lib/rancher/k3s/server/node-token
+    timeout: 120
+  when: "'masters' in group_names"
+
+# 输出 Token (仅 cluster-init)
+- name: Get node token
+  ansible.builtin.slurp:
+    src: /var/lib/rancher/k3s/server/node-token
+  register: node_token
+  when: cluster_init | default(false)
+
+- name: Display node token
+  ansible.builtin.debug:
+    msg: |
+      ══════════════════════════════════════════════════════════════
+      K3S_TOKEN (用于添加新节点):
+      {{ node_token.content | b64decode | trim }}
+      
+      K3S_SERVER_URL:
+      https://{{ ansible_host }}:6443
+      ══════════════════════════════════════════════════════════════
+  when: cluster_init | default(false)
+
+# 保存 kubeconfig (仅 cluster-init)
+- name: Fetch kubeconfig
+  ansible.builtin.fetch:
+    src: /etc/rancher/k3s/k3s.yaml
+    dest: "{{ playbook_dir }}/../kubeconfig.yaml"
+    flat: yes
+  when: cluster_init | default(false)
+

ansible/roles/k3s/templates/k3s-agent.yaml.j2

@@ -0,0 +1,28 @@
+# K3s Agent 配置模板
+---
+server: "{{ k3s_server_url }}"
+token: "{{ k3s_token }}"
+
+# Tailscale VPN
+vpn-auth: "name=tailscale,joinKey={{ tailscale_auth_key }}{% if netfilter_mode | default('') %},extraArgs=--netfilter-mode={{ netfilter_mode }}{% endif %}"
+
+# 节点标签
+node-label:
+{% if node_region is defined %}
+  - "topology.kubernetes.io/region={{ node_region }}"
+{% endif %}
+{% if enable_lb is defined %}
+  - "svccontroller.k3s.cattle.io/enablelb={{ enable_lb | string | lower }}"
+{% endif %}
+{% if node_labels is defined %}
+{% for key, value in node_labels.items() %}
+  - "{{ key }}={{ value }}"
+{% endfor %}
+{% endif %}
+
+# Kubelet 资源预留
+{% if kubelet_reserved is defined %}
+kubelet-arg:
+  - "kube-reserved={{ kubelet_reserved }}"
+{% endif %}
+

ansible/roles/k3s/templates/k3s-server.yaml.j2

@@ -0,0 +1,42 @@
+# K3s Server 统一配置模板 (master-init 和 master-join)
+---
+{% if cluster_init | default(false) %}
+# 首个节点初始化集群
+cluster-init: true
+{% else %}
+# 加入已有集群
+server: "{{ k3s_server_url }}"
+token: "{{ k3s_token }}"
+{% endif %}
+
+tls-san:
+  - "{{ k3s_tls_san }}"
+
+# ETCD 快照配置
+etcd-snapshot-retention: {{ etcd_snapshot_retention }}
+etcd-snapshot-schedule-cron: "{{ etcd_snapshot_schedule_cron }}"
+etcd-snapshot-compress: {{ etcd_snapshot_compress | lower }}
+
+# Tailscale VPN
+vpn-auth: "name=tailscale,joinKey={{ tailscale_auth_key }}{% if netfilter_mode | default('') %},extraArgs=--netfilter-mode={{ netfilter_mode }}{% endif %}"
+
+# 禁用组件
+disable:
+{% for component in k3s_disable_components %}
+  - {{ component }}
+{% endfor %}
+
+# 节点标签
+node-label:
+{% if node_region is defined %}
+  - "topology.kubernetes.io/region={{ node_region }}"
+{% endif %}
+{% if enable_lb is defined %}
+  - "svccontroller.k3s.cattle.io/enablelb={{ enable_lb | string | lower }}"
+{% endif %}
+{% if node_labels is defined %}
+{% for key, value in node_labels.items() %}
+  - "{{ key }}={{ value }}"
+{% endfor %}
+{% endif %}
+

ansible/roles/k3s/templates/registries.yaml.j2

@@ -0,0 +1,11 @@
+# 镜像加速配置
+---
+mirrors:
+{% for registry, endpoints in registry_mirrors.items() %}
+  "{{ registry }}":
+    endpoint:
+{% for endpoint in endpoints %}
+      - "https://{{ endpoint }}"
+{% endfor %}
+{% endfor %}
+

ansible/roles/ssh/tasks/main.yml

@@ -0,0 +1,51 @@
+# SSH 安全加固 Role
+# 功能: 修改端口、配置密钥认证、禁用密码登录
+---
+- name: Ensure .ssh directory exists
+  ansible.builtin.file:
+    path: /root/.ssh
+    state: directory
+    mode: '0700'
+
+- name: Add SSH public key
+  ansible.builtin.authorized_key:
+    user: root
+    key: "{{ ssh_pubkey }}"
+    state: present
+
+- name: Backup original sshd_config
+  ansible.builtin.copy:
+    src: /etc/ssh/sshd_config
+    dest: /etc/ssh/sshd_config.bak
+    remote_src: yes
+    force: no
+
+- name: Deploy secure sshd_config
+  ansible.builtin.template:
+    src: sshd_config.j2
+    dest: /etc/ssh/sshd_config
+    mode: '0600'
+    validate: '/usr/sbin/sshd -t -f %s'
+  register: sshd_config
+
+- name: Restart sshd service
+  ansible.builtin.systemd:
+    name: sshd
+    state: restarted
+  when: sshd_config.changed
+
+- name: Update ansible_port to new SSH port
+  ansible.builtin.set_fact:
+    ansible_port: "{{ ssh_new_port }}"
+  when: sshd_config.changed
+
+- name: Wait for SSH on new port
+  ansible.builtin.wait_for:
+    port: "{{ ssh_new_port }}"
+    host: "{{ ansible_host }}"
+    delay: 5
+    timeout: 60
+  delegate_to: localhost
+  become: no
+  when: sshd_config.changed
+

ansible/roles/ssh/templates/sshd_config.j2

@@ -0,0 +1,12 @@
+# SSH 配置模板
+Port {{ ssh_new_port }}
+PermitRootLogin prohibit-password
+PasswordAuthentication no
+PubkeyAuthentication yes
+ChallengeResponseAuthentication no
+UsePAM yes
+X11Forwarding no
+PrintMotd no
+AcceptEnv LANG LC_*
+Subsystem sftp /usr/lib/openssh/sftp-server
+

apps/infra/data/cloudnative-pg/helmchart.yaml

@@ -19,7 +19,7 @@ spec:
                   values:
                     - "cn-sh"
     tolerations:
-      - key: "node-role.kubernetes.io/control-plane"
+      - key: "node-role.kubernetes.io/master"
         operator: "Exists"
         effect: "NoSchedule"
     image:

apps/infra/devops/cert-manager/helmchart-dnspod.yaml

@@ -30,6 +30,6 @@ spec:
                   values:
                     - "cn-sh"
     tolerations:
-      - key: "node-role.kubernetes.io/control-plane"
+      - key: "node-role.kubernetes.io/master"
         operator: "Exists"
         effect: "NoSchedule"

apps/infra/devops/cert-manager/helmchart.yaml

@@ -21,7 +21,7 @@ spec:
                   values:
                     - "cn-sh"
     tolerations:
-      - key: "node-role.kubernetes.io/control-plane"
+      - key: "node-role.kubernetes.io/master"
         operator: "Exists"
         effect: "NoSchedule"
     webhook:
@@ -35,7 +35,7 @@ spec:
                     values:
                       - "cn-sh"
       tolerations:
-        - key: "node-role.kubernetes.io/control-plane"
+        - key: "node-role.kubernetes.io/master"
           operator: "Exists"
           effect: "NoSchedule"
     cainjector:
@@ -49,7 +49,7 @@ spec:
                     values:
                       - "cn-sh"
       tolerations:
-        - key: "node-role.kubernetes.io/control-plane"
+        - key: "node-role.kubernetes.io/master"
           operator: "Exists"
           effect: "NoSchedule"
     # 在删除证书时同时删除secret

apps/infra/devops/velero/helmchart.yaml

@@ -26,6 +26,10 @@ spec:
                   operator: In
                   values:
                     - homea  
+    kubectl:
+      image:
+        repository: alpine/k8s
+        tag: "1.34.0"
     deployNodeAgent: true
     snapshotsEnabled: false
     configuration:

apps/infra/gitops/flux/clusterrolebinding.yaml

@@ -0,0 +1,29 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dev-cm-flux-web-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flux-web-admin
+subjects:
+  - kind: Group
+    name: dev.cm:owners
+    apiGroup: rbac.authorization.k8s.io
+  - kind: Group
+    name: dev.cm:admins
+    apiGroup: rbac.authorization.k8s.io
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dev-cm-flux-web-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flux-web-user
+subjects:
+  - kind: Group
+    name: dev.cm
+    apiGroup: rbac.authorization.k8s.io

apps/infra/gitops/flux/flux-instance.yaml

@@ -10,7 +10,6 @@ spec:
     artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"
   components:
     - source-controller
-    - source-watcher
     - kustomize-controller
     - helm-controller
     - notification-controller
@@ -22,4 +21,21 @@ spec:
     domain: "cluster.local"
   storage:
     class: "local-path"
-    size: "10Gi"
+    size: "10Gi"
+  kustomize:
+    patches:
+      - target:
+          kind: Deployment
+        patch: |
+          - op: add
+            path: /spec/template/spec/affinity
+            value:
+              nodeAffinity:
+                preferredDuringSchedulingIgnoredDuringExecution:
+                  - weight: 1
+                    preference:
+                      matchExpressions:
+                        - key: kubernetes.io/hostname
+                          operator: In
+                          values:
+                            - homea

apps/infra/gitops/flux/helmchart.yaml

@@ -8,6 +8,16 @@ spec:
   targetNamespace: infra-gitops
   version: 0.40.0
   valuesContent: |-
+    affinity:
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - homea  
     installCRDs: true
     web:
       config:

apps/kube/coredns/nodelocaldns.yaml

@@ -126,7 +126,7 @@ spec:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
               - matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
+                  - key: node-role.kubernetes.io/master
                     operator: NotIn
                     values:
                       - "true"

apps/kube/patch-affinity.yaml

@@ -6,7 +6,14 @@ spec:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
               - matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
+                  - key: node-role.kubernetes.io/master
                     operator: In
                     values:
                       - "true"
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+        - key: node-role.kubernetes.io/master
+          operator: Exists
+          effect: NoSchedule

install/README.md

@@ -59,7 +59,7 @@ mkdir -p /etc/rancher/k3s && vim /etc/rancher/k3s/config.yaml
 
 ```shell
 curl -sfL https://get.k3s.io | \
-  INSTALL_K3S_VERSION=v1.33.2+k3s1 \
+  INSTALL_K3S_VERSION=v1.34.2+k3s1 \
   sh -s - server
 ```
 
@@ -69,7 +69,7 @@ curl -sfL https://get.k3s.io | \
 
 ```shell
 curl -sfL https://rancher-mirror.rancher.cn/k3s/k3s-install.sh | \
-  INSTALL_K3S_VERSION=v1.33.2+k3s1 \
+  INSTALL_K3S_VERSION=v1.34.2+k3s1 \
   INSTALL_K3S_MIRROR=cn  \
   sh -s - server
 ```

install/agent.config.yaml

@@ -4,8 +4,8 @@ token: "K1010dd6f0853e824cfaf417117f31a0d797a738aa2d4b9d01cd5972a9b084c81a0::ser
 
 # 网络相关
 # WARN 阿里云、华为云因使用100网段作为dns等内部服务 需要关闭netfilter 否则会自动添加iptables规则导致无法访问dns
-# WARN 需要添加 extraArgs=--netfilter-mode=off
+# WARN 需要添加 extraArgs=--netfilter-mode=nodivert
-vpn-auth: "name=tailscale,joinKey=tskey-auth-kUMo6hWP9711CNTRL-oo21xakMTxCKJBWK8t9XxComm3fAFUvy,extraArgs=--netfilter-mode=off"
+vpn-auth: "name=tailscale,joinKey=tskey-auth-kUMo6hWP9711CNTRL-oo21xakMTxCKJBWK8t9XxComm3fAFUvy"
 
 # 节点相关
 # 保留节点资源 根据节点做不同配置