日常更新

ansible/roles/verify_common/templates/incluster-traefik-http-probe-pod.yml.j2

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ _vf_http_pod }}
+  namespace: default
+spec:
+  restartPolicy: Never
+  # 与 02-0x M1/M2 类似：探针跑在控制面，避免部分环境下工作节点到 traefik ClusterIP 异常
+  nodeSelector:
+    node-role.kubernetes.io/control-plane: ""
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  containers:
+    - name: probe
+      image: curlimages/curl:8.5.0
+      env:
+        - name: URL
+          value: {{ _vf_url | to_json }}
+        - name: ASSERT
+          value: {{ verify_traefik_assertion | to_json }}
+        - name: HDRN
+          value: {{ verify_traefik_header_name | default('') | trim | to_json }}
+        - name: HDRV
+          value: {{ verify_traefik_header_value | default('') | trim | to_json }}
+      command: ["/bin/sh", "-c"]
+      args:
+        - |
+          set -euo pipefail
+          # -4：集群仅 IPv4 时避免优先 AAAA 导致「连不上 ClusterIP」
+          code=$(curl -4 -sS -o /dev/null -w "%{http_code}" --connect-timeout 25 --max-time 60 "$URL")
+          echo "[OC-ASSERT] assertion=${ASSERT} phase=http probe=in_cluster status_code=${code}"
+          test "$code" = "200"
+          if [ -n "$HDRN" ] && [ -n "$HDRV" ]; then
+            curl -4 -sS -D - -o /dev/null --connect-timeout 25 --max-time 60 "$URL" | tr -d "\r" | grep -qi "^${HDRN}: *${HDRV}$" || exit 1
+            echo "[OC-ASSERT] assertion=${ASSERT} phase=http probe=response_header name=${HDRN} value=${HDRV}"
+          fi