From b0ffeccb016ebf9a3363afb59bc37f7978ea7895 Mon Sep 17 00:00:00 2001 From: pikastech Date: Mon, 20 Jul 2026 05:02:32 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20=E7=94=A8=20k3s=20API=20=E6=8E=A2?= =?UTF-8?q?=E6=B5=8B=20worker=20=E9=9A=A7=E9=81=93?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/reference/platform-infra.md | 1 + scripts/src/platform-infra-k3s-cluster.ts | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/reference/platform-infra.md b/docs/reference/platform-infra.md index 41e6decb..da028f7d 100644 --- a/docs/reference/platform-infra.md +++ b/docs/reference/platform-infra.md @@ -23,6 +23,7 @@ - 无固定公网地址的 worker 由宿主内网 SSH 控制，主动连接 control-plane WireGuard endpoint；worker provider route 只作为部署后补充验收入口。 - 集群 apply 先经宿主内网 SSH 分发零依赖 proxy client，确认它连接声明的 `vpn-server` 且外网 probe 成功，再启动或恢复 `k3s-agent`。 - 集群 apply 在 proxy 前先收敛 worker WireGuard；内容一致时不强写，只有 unit 未运行或握手过期且隧道探针失败时才恢复 worker 接口。 + - worker WireGuard 的业务探针固定使用 control-plane API `:6443`，不以可能被策略丢弃的 ICMP 判断隧道健康。 - 大型 proxy 工件由 Windows 宿主按 YAML `upstreamUrl` 获取并校验 SHA-256，Provider/trans 只承载控制命令，不作为大二进制数据面。 - WireGuard 只承载集群三层网络；NAT 或链路不稳定的 worker proxy 使用 `vpn-server` 输出的 Hysteria2 client YAML，不把应用出网 TCP 再套入 WireGuard TCP 路径。 - proxy client 协议实现版本由 host-proxy YAML 声明，并与所连接的 `vpn-server` 协议实现版本保持一致。 diff --git a/scripts/src/platform-infra-k3s-cluster.ts b/scripts/src/platform-infra-k3s-cluster.ts index de1bf977..2d4fc6e1 100644 --- a/scripts/src/platform-infra-k3s-cluster.ts +++ b/scripts/src/platform-infra-k3s-cluster.ts @@ -259,14 +259,14 @@ if [ "$changed" = true ]; then systemctl restart wg-quick@${wg.interfaceName} elif ! systemctl is-active --quiet wg-quick@${wg.interfaceName}; then systemctl start wg-quick@${wg.interfaceName} -elif ! ping -c 1 -W 3 ${address(wg.controlPlaneAddress)} >/dev/null 2>&1; then +elif ! timeout 5 nc -z ${address(wg.controlPlaneAddress)} 6443 >/dev/null 2>&1; then handshake="$(wg show ${wg.interfaceName} latest-handshakes 2>/dev/null | awk '{print $2}' | head -n1)" now="$(date +%s)" if [ -z "$handshake" ] || [ $((now - handshake)) -ge 180 ]; then systemctl restart wg-quick@${wg.interfaceName} fi fi -ping -c 3 -W 5 ${address(wg.controlPlaneAddress)} >/dev/null +timeout 15 nc -z ${address(wg.controlPlaneAddress)} 6443 `; } @@ -370,7 +370,7 @@ if [ "$wg_changed" = true ]; then elif ! systemctl is-active --quiet wg-quick@${wg.interfaceName}; then systemctl start wg-quick@${wg.interfaceName} fi -ping -c 3 -W 5 ${address(wg.controlPlaneAddress)} >/dev/null +timeout 15 nc -z ${address(wg.controlPlaneAddress)} 6443 desired_hash=${shQuote(desiredHash)} desired_hash_file=/etc/unidesk/k3s-agent-desired.sha256 current_hash=$(cat "$desired_hash_file" 2>/dev/null || true)