refactor(cluster): 通用化第四个 Worker 节点接入

将原宁波专用接入脚本改为由环境变量控制节点名称、站点和 WireGuard 端口，支持香港双物理节点 Worker 池。增加候选节点启用开关和服务商网络许可门禁，未明确批准时禁止任何 WireGuard 或 K3s 写操作。同步调整生产验收、巡检、拓扑校验和运行手册。\n\n验证：\n- scripts/cluster 全部 Shell 脚本 bash -n\n- scripts/cluster 全部 ShellCheck\n- git diff --check\n- 本地凭据值扫描\n- 当前三节点 WireGuard/K3s/PostgreSQL 只读基线检查
2026-08-01 11:23:19 +08:00
parent e77bd17754
commit ed3b970178
7 changed files with 175 additions and 93 deletions
@@ -12,11 +12,15 @@ hosts=("$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST" "$CLUSTER_LOS_ANGELES_HOS
 public_endpoints=("${CLUSTER_NINGBO_HOST#*@}" "${CLUSTER_HONGKONG_HOST#*@}" "${CLUSTER_LOS_ANGELES_HOST#*@}")
 wireguard_ips=(10.77.0.1 10.77.0.2 10.77.0.3)
 wireguard_ports=(51820 51820 51820)
-if [[ -n $CLUSTER_NINGBO_WORKER_HOST ]]; then
-  hosts+=("$CLUSTER_NINGBO_WORKER_HOST")
-  public_endpoints+=("${CLUSTER_NINGBO_WORKER_HOST#*@}")
+if [[ -n $CLUSTER_WORKER_NODE_4_HOST ]]; then
+  [[ $CLUSTER_WORKER_NODE_4_NETWORK_APPROVED == true ]] || {
+    echo 'dedicated Worker private-network setup is blocked until the provider approves this non-proxy Kubernetes use in writing' >&2
+    exit 1
+  }
+  hosts+=("$CLUSTER_WORKER_NODE_4_HOST")
+  public_endpoints+=("${CLUSTER_WORKER_NODE_4_HOST#*@}")
  wireguard_ips+=(10.77.0.4)
-  wireguard_ports+=(443)
+  wireguard_ports+=("$CLUSTER_WORKER_NODE_4_WIREGUARD_PORT")
 fi
 public_keys=()