wangbo
971540a2a4
新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。 新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。 所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。 验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。
35 lines
1.4 KiB
Bash
Executable File
35 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck source=scripts/cluster/common.sh
|
|
source "$script_dir/common.sh"
|
|
load_cluster_env
|
|
|
|
cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
snapshot_name=acceptance-$(date -u '+%Y%m%dT%H%M%SZ')
|
|
k3s etcd-snapshot save --name "$snapshot_name" >/dev/null
|
|
snapshot=$(find /var/lib/rancher/k3s/server/db/snapshots -maxdepth 1 -type f \
|
|
-name "$snapshot_name-*" -printf '%T@ %p\n' | sort -rn | awk 'NR == 1 { sub(/^[^ ]+ /, ""); print }')
|
|
[[ -n $snapshot && -s $snapshot ]]
|
|
etcdutl=$(find /var/lib/rancher/k3s/data -type f -path '*/bin/etcdutl' -print -quit)
|
|
[[ -x $etcdutl ]]
|
|
working_directory=$(mktemp -d)
|
|
trap 'rm -rf -- "$working_directory"' EXIT
|
|
case $snapshot in
|
|
*.zip)
|
|
if command -v unzip >/dev/null 2>&1 && unzip -t "$snapshot" >/dev/null 2>&1; then
|
|
unzip -p "$snapshot" >"$working_directory/snapshot.db"
|
|
else
|
|
gzip -dc "$snapshot" >"$working_directory/snapshot.db"
|
|
fi
|
|
;;
|
|
*) cp "$snapshot" "$working_directory/snapshot.db" ;;
|
|
esac
|
|
"$etcdutl" snapshot status "$working_directory/snapshot.db" -w json |
|
|
jq -e '.hash != null and .totalKey > 0 and .totalSize > 0' >/dev/null
|
|
k3s etcd-snapshot ls --s3 | grep -F "$snapshot_name" >/dev/null
|
|
echo "etcd_backup_verification=PASS snapshot=$snapshot_name local=true oss=true"
|
|
REMOTE
|