k3s (D6): Dienst-VM k3s per tofu, Rollen k3s-server/k3s-agent/k3s-apps, Manifeste, NEX-Sprachdienste als k3s-Umzugstest

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

platform/proxmox/tofu/main.tf

@@ -169,3 +169,74 @@ resource "proxmox_virtual_environment_container" "infra" {
 
 # HA (Ressource + Node-Affinity-Regel) und Replikation setzt die Ansible-Rolle pve-host per root-SSH.
 # So braucht der tofu-Token kein Sys.Console auf /.
+
+# Dienst-VMs ohne GPU (D6, k3s-Steuerung): Klon vom Template des Knotens auf tank, HA + Replikation
+# setzt die Rolle pve-host (wie bei den Containern).
+resource "proxmox_virtual_environment_vm" "svc" {
+  for_each  = try(local.site.service_vms, {})
+  name      = each.key
+  node_name = each.value.node
+  vm_id     = each.value.vmid
+  tags      = ["knaster", "infra"]
+  pool_id   = try(each.value.pool, "infra")
+
+  machine       = "q35"
+  bios          = "ovmf"
+  on_boot       = true
+  scsi_hardware = "virtio-scsi-single"
+
+  clone {
+    vm_id        = local.site.cluster.templates[each.value.node]
+    node_name    = each.value.node
+    datastore_id = each.value.storage
+    full         = true
+  }
+
+  agent {
+    enabled = true
+  }
+
+  cpu {
+    cores = each.value.cores
+    type  = "host"
+  }
+
+  memory {
+    dedicated = each.value.memory_mb
+    floating  = each.value.memory_mb # Ballooning erlaubt (kein Passthrough)
+  }
+
+  efi_disk {
+    datastore_id      = each.value.storage
+    type              = "4m"
+    pre_enrolled_keys = false
+  }
+
+  disk {
+    datastore_id = each.value.storage
+    interface    = "scsi0"
+    size         = each.value.disk_gb
+    discard      = "on"
+    ssd          = true
+    iothread     = true
+  }
+
+  network_device {
+    bridge = local.site.cluster.bridge
+  }
+
+  initialization {
+    datastore_id        = each.value.storage
+    vendor_data_file_id = "local:snippets/knaster-vendor.yaml"
+    ip_config {
+      ipv4 {
+        address = each.value.ip
+        gateway = each.value.ip == "dhcp" ? null : local.site.cluster.gateway
+      }
+    }
+    user_account {
+      username = "knaster"
+      keys     = [local.ssh_key]
+    }
+  }
+}

platform/proxmox/tofu/outputs.tf

@@ -3,9 +3,19 @@ locals {
   gpu_vm_ipv4 = {
     for k, v in proxmox_virtual_environment_vm.gpu : k => try(flatten([
       for i, name in v.network_interface_names : v.ipv4_addresses[i]
-      if !contains(["lo"], name) && !startswith(name, "docker") && !startswith(name, "br-") && !startswith(name, "veth")
+      if !contains(["lo"], name) && !startswith(name, "docker") && !startswith(name, "br-") && !startswith(name, "veth") && !startswith(name, "cni") && !startswith(name, "flannel")
     ])[0], null)
   }
+  svc_vm_ipv4 = {
+    for k, v in proxmox_virtual_environment_vm.svc : k => try(flatten([
+      for i, name in v.network_interface_names : v.ipv4_addresses[i]
+      if !contains(["lo"], name) && !startswith(name, "docker") && !startswith(name, "br-") && !startswith(name, "veth") && !startswith(name, "cni") && !startswith(name, "flannel")
+    ])[0], null)
+  }
+}
+
+output "service_vms" {
+  value = { for k, v in proxmox_virtual_environment_vm.svc : k => { node = v.node_name, vmid = v.vm_id, ipv4 = local.svc_vm_ipv4[k] } }
 }
 
 output "gpu_vms" {
@@ -21,6 +31,7 @@ output "ansible_inventory" {
   value = yamlencode({
     all = { children = {
       gpu_vms = { hosts = { for k, ip in local.gpu_vm_ipv4 : k => { ansible_host = ip } if ip != null } }
+      service_vms = { hosts = { for k, ip in local.svc_vm_ipv4 : k => { ansible_host = ip } if ip != null } }
       infra = { hosts = {
         for k, v in proxmox_virtual_environment_container.infra : k => { ansible_host = v.ipv4["eth0"] } if try(v.ipv4["eth0"], null) != null
       } }