feat: Переименование geop в cod и добавление ARM64 поддержки

- Переименован пресет geop.yml в cod.yml - Обновлены все группы с geop на cod - Добавлена поддержка ARM64 для Astra Linux и RedOS - Создан Dockerfile.arm64 для RedOS с исправлением конфликтов пакетов - Улучшены разделители в логах Molecule - Зашифрован файл vault/secrets.yml - Обновлена роль devops с поддержкой vault - Добавлены шаблоны для SSH и sudoers конфигураций
2025-10-27 19:43:26 +03:00
parent c66bb35f97
commit 5543ae4d27
25 changed files with 1531 additions and 931 deletions
--- a/molecule/default/converge.yml
+++ b/molecule/default/converge.yml
@@ -1,4 +1,7 @@
 ---
+# =============================================================================
+# CONVERGE - Сборка и запуск тестовых сценариев
+# =============================================================================
 - hosts: localhost
  gather_facts: false
  vars:
@@ -15,6 +18,18 @@
      - /workspace/roles/**/vars/vault.yml

  tasks:
+    # =============================================================================
+    # НАСТРОЙКА - Загрузка конфигурации и подготовка
+    # =============================================================================
+    - name: Configuration setup
+      debug:
+        msg: |
+          ================================================================================
+          НАСТРОЙКА - Загрузка конфигурации и подготовка
+          ================================================================================
+          Preset: {{ preset_name }}
+          ================================================================================
+
    - name: Load preset configuration
      include_vars: "{{ preset_file }}"
      when: preset_file is file
@@ -25,52 +40,55 @@
 #        container: ansible-controller
 #        command: bash -lc "ansible-galaxy collection install -r /workspace/requirements.yml --force --no-deps --upgrade >/dev/null 2>&1 || true"

+    # =============================================================================
+    # VAULT - Работа с зашифрованными файлами
+    # =============================================================================
+    - name: Vault operations
+      debug:
+        msg: |
+          ================================================================================
+          VAULT - Работа с зашифрованными файлами
+          ================================================================================
+          Files: {{ vault_targets | length }} targets
+          ================================================================================
+
    - name: Preflight vault — normalize state (encrypt if plaintext, then decrypt)
      community.docker.docker_container_exec:
        container: ansible-controller
-        command: >
-          bash -lc '
-          set -euo pipefail; shopt -s nullglob globstar;
-          for p in {{ vault_targets | map('quote') | join(' ') }}; do
-            for f in $p; do
-              [ -f "$f" ] || continue;
-              if head -n1 "$f" | grep -q "^\$ANSIBLE_VAULT;"; then
-                echo "[vault] already encrypted: $f";
-              else
-                echo "[vault] plaintext -> encrypt: $f";
-                ansible-vault encrypt --encrypt-vault-id default --vault-password-file /workspace/vault/.vault "$f";
-              fi
-              echo "[vault] decrypt for run: $f";
-              ansible-vault decrypt --vault-password-file /workspace/vault/.vault "$f";
-            done
-          done
-          '
+        command: "bash -c 'VAULT_PASSWORD_FILE=\"/workspace/vault/.vault\"; if [ -f \"$VAULT_PASSWORD_FILE\" ] && [ -f \"/workspace/vault/secrets.yml\" ]; then ansible-vault decrypt --vault-password-file \"$VAULT_PASSWORD_FILE\" /workspace/vault/secrets.yml; fi'"
+      ignore_errors: true
+
+    # =============================================================================
+    # PLAYBOOK - Запуск основного playbook
+    # =============================================================================
+    - name: Playbook execution
+      debug:
+        msg: |
+          ================================================================================
+          PLAYBOOK - Запуск основного playbook
+          ================================================================================
+          File: /workspace/molecule/default/site.yml
+          ================================================================================

    - name: Run lab playbook
      community.docker.docker_container_exec:
        container: ansible-controller
-        command: >
-          bash -lc "
-            ANSIBLE_ROLES_PATH=/workspace/roles
-            ansible-playbook -i {{ lookup('env','MOLECULE_EPHEMERAL_DIRECTORY') }}/inventory/hosts.ini /workspace/molecule/default/site.yml
-          "
+        command: "bash -c 'ANSIBLE_ROLES_PATH=/workspace/roles; VAULT_PASSWORD_FILE=\"/workspace/vault/.vault\"; VAULT_SECRETS_FILE=\"/workspace/vault/secrets.yml\"; INVENTORY_FILE=\"/tmp/molecule_workspace/inventory/hosts.ini\"; if [ -f \"$VAULT_PASSWORD_FILE\" ] && [ -f \"$VAULT_SECRETS_FILE\" ]; then ansible-playbook -i \"$INVENTORY_FILE\" /workspace/molecule/default/site.yml --vault-password-file \"$VAULT_PASSWORD_FILE\" -e \"vault_file_path=$VAULT_SECRETS_FILE\"; else ansible-playbook -i \"$INVENTORY_FILE\" /workspace/molecule/default/site.yml; fi'"
+
+    # =============================================================================
+    # CLEANUP - Перешифровка файлов после выполнения
+    # =============================================================================
+    - name: Cleanup operations
+      debug:
+        msg: |
+          ================================================================================
+          CLEANUP - Перешифровка файлов после выполнения
+          ================================================================================
+          Re-encrypting vault files
+          ================================================================================

    - name: Post-run — re-encrypt secrets
      community.docker.docker_container_exec:
        container: ansible-controller
-        command: >
-          bash -lc '
-          set -euo pipefail; shopt -s nullglob globstar;
-          for p in {{ vault_targets | map('quote') | join(' ') }}; do
-            for f in $p; do
-              [ -f "$f" ] || continue;
-              if head -n1 "$f" | grep -q "^\$ANSIBLE_VAULT;"; then
-                echo "[vault] ok (encrypted): $f";
-              else
-                echo "[vault] encrypt back: $f";
-                ansible-vault encrypt --encrypt-vault-id default --vault-password-file /workspace/vault/.vault "$f" || true;
-              fi
-            done
-          done
-          '
+        command: "bash -c 'VAULT_PASSWORD_FILE=\"/workspace/vault/.vault\"; if [ -f \"$VAULT_PASSWORD_FILE\" ] && [ -f \"/workspace/vault/secrets.yml\" ]; then ansible-vault encrypt --encrypt-vault-id default --vault-password-file \"$VAULT_PASSWORD_FILE\" /workspace/vault/secrets.yml; fi'"
      ignore_errors: true
--- a/molecule/default/create.yml
+++ b/molecule/default/create.yml
@@ -1,4 +1,7 @@
 ---
+# =============================================================================
+# CREATE - Создание тестовых инстансов
+# =============================================================================
 - hosts: localhost
  gather_facts: false
  vars:
@@ -14,13 +17,21 @@
      alt9: "inecs/ansible-lab:alt9-latest"
      alt10: "inecs/ansible-lab:alt10-latest"
      astra: "inecs/ansible-lab:astra-linux-latest"
+      astra-arm64: "inecs/ansible-lab:astra-linux-arm64-latest"
      rhel: "inecs/ansible-lab:rhel-latest"
-      centos: "inecs/ansible-lab:centos-latest"
+      centos7: "inecs/ansible-lab:centos7-latest"
+      centos8: "inecs/ansible-lab:centos8-latest"
+      centos9: "inecs/ansible-lab:centos9-latest"
      alma: "inecs/ansible-lab:alma-latest"
      rocky: "inecs/ansible-lab:rocky-latest"
      redos: "inecs/ansible-lab:redos-latest"
-      ubuntu: "inecs/ansible-lab:ubuntu-latest"
-      debian: "inecs/ansible-lab:debian-latest"
+      ubuntu20: "inecs/ansible-lab:ubuntu20-latest"
+      ubuntu22: "inecs/ansible-lab:ubuntu22-latest"
+      ubuntu24: "inecs/ansible-lab:ubuntu24-latest"
+      debian9: "inecs/ansible-lab:debian9-latest"
+      debian10: "inecs/ansible-lab:debian10-latest"
+      debian11: "inecs/ansible-lab:debian11-latest"
+      debian12: "inecs/ansible-lab:debian12-latest"
    systemd_defaults:
      privileged: true
      command: "/sbin/init"
@@ -85,14 +96,43 @@

    - name: Display filtered hosts
      debug:
-        msg: "Platform {{ ansible_architecture }}: {{ hosts | length }} hosts will be deployed"
+        msg: |
+          ================================================================================
+          СОЗДАНИЕ ТЕСТОВЫХ ИНСТАНСОВ
+          ================================================================================
+          Platform: {{ ansible_architecture }}
+          Hosts: {{ hosts | length }}
+          ================================================================================
+
+    # =============================================================================
+    # СЕТЕВОЕ ПОДКЛЮЧЕНИЕ
+    # =============================================================================
+    - name: Network setup
+      debug:
+        msg: |
+          ================================================================================
+          НАСТРОЙКА СЕТИ
+          ================================================================================
+          Network: {{ docker_network }}
+          ================================================================================

    - name: Ensure network exists
      community.docker.docker_network:
        name: "{{ docker_network }}"
        state: present

-    # SYSTEMD nodes
+    # =============================================================================
+    # SYSTEMD NODES - Создание контейнеров с systemd
+    # =============================================================================
+    - name: Systemd nodes setup
+      debug:
+        msg: |
+          ================================================================================
+          SYSTEMD NODES - Создание контейнеров с systemd
+          ================================================================================
+          Count: {{ hosts | selectattr('type','undefined') | list | length }}
+          ================================================================================
+
    - name: Pull systemd images with correct platform
      command: "docker pull --platform {{ ansible_architecture }} {{ images[item.family] }}"
      loop: "{{ hosts | selectattr('type','undefined') | list }}"
@@ -208,7 +248,30 @@
      retries: 5
      delay: 3

-    # DinD nodes
+    # Создание vault директории в контейнерах
+    - name: Create vault directory in containers
+      community.docker.docker_container_exec:
+        container: "{{ item.name }}"
+        command: "mkdir -p /workspace/vault && chmod 755 /workspace/vault"
+      loop: "{{ hosts | selectattr('type','undefined') | list }}"
+      loop_control: { label: "{{ item.name }}" }
+      when: item.family is defined and images[item.family] is defined
+      ignore_errors: true
+      retries: 5
+      delay: 3
+
+    # =============================================================================
+    # DIND NODES - Создание контейнеров Docker-in-Docker
+    # =============================================================================
+    - name: DinD nodes setup
+      debug:
+        msg: |
+          ================================================================================
+          DIND NODES - Создание контейнеров Docker-in-Docker
+          ================================================================================
+          Count: {{ hosts | selectattr('type','defined') | selectattr('type','equalto','dind') | list | length }}
+          ================================================================================
+
    - name: Start DinD nodes (docker:27-dind)
      community.docker.docker_container:
        name: "{{ item.name }}"
@@ -225,7 +288,18 @@
      loop: "{{ hosts | selectattr('type','defined') | selectattr('type','equalto','dind') | list }}"
      loop_control: { label: "{{ item.name }}" }

-    # DOoD nodes (mount docker.sock)
+    # =============================================================================
+    # DOOD NODES - Создание контейнеров Docker-out-of-Docker
+    # =============================================================================
+    - name: DOoD nodes setup
+      debug:
+        msg: |
+          ================================================================================
+          DOOD NODES - Создание контейнеров Docker-out-of-Docker
+          ================================================================================
+          Count: {{ hosts | selectattr('type','defined') | selectattr('type','equalto','dood') | list | length }}
+          ================================================================================
+
    - name: Start DOoD nodes (systemd + docker.sock mount)
      community.docker.docker_container:
        name: "{{ item.name }}"
@@ -260,7 +334,18 @@
        item_name: "{{ item.0.name }}"
        item_group: "{{ item.1 }}"

-    # Render inventory
+    # =============================================================================
+    # ИНВЕНТАРЬ - Генерация inventory файла
+    # =============================================================================
+    - name: Inventory generation
+      debug:
+        msg: |
+          ================================================================================
+          ИНВЕНТАРЬ - Генерация inventory файла
+          ================================================================================
+          File: {{ generated_inventory }}
+          ================================================================================
+
    - name: Render inventory ini
      set_fact:
        inv_content: |
@@ -327,7 +412,7 @@
          {% endif %}
          
          {# Глобальный fallback для остальных хостов #}
-          [unmatched_hosts:vars]
+          [all:vars]
          ansible_python_interpreter=auto_silent

    - name: Write inventory file
--- a/molecule/default/destroy.yml
+++ b/molecule/default/destroy.yml
@@ -1,4 +1,7 @@
 ---
+# =============================================================================
+# DESTROY - Удаление тестовых инстансов
+# =============================================================================
 - hosts: localhost
  gather_facts: false
  vars:
@@ -16,11 +19,35 @@
    kind_clusters: []

  tasks:
+    # =============================================================================
+    # НАСТРОЙКА - Загрузка конфигурации
+    # =============================================================================
+    - name: Configuration setup
+      debug:
+        msg: |
+          ================================================================================
+          НАСТРОЙКА - Загрузка конфигурации
+          ================================================================================
+          Preset: {{ preset_name }}
+          ================================================================================
+
    - name: Load preset configuration
      include_vars: "{{ preset_file }}"
      when: preset_file is file
      ignore_errors: true

+    # =============================================================================
+    # УДАЛЕНИЕ КОНТЕЙНЕРОВ - Остановка и удаление контейнеров
+    # =============================================================================
+    - name: Container removal
+      debug:
+        msg: |
+          ================================================================================
+          УДАЛЕНИЕ КОНТЕЙНЕРОВ - Остановка и удаление контейнеров
+          ================================================================================
+          Count: {{ hosts | length }} containers
+          ================================================================================
+
    - name: Stop and remove containers
      community.docker.docker_container:
        name: "{{ item.name }}"
@@ -55,6 +82,18 @@
      ignore_errors: true
      when: item.volumes is defined

+    # =============================================================================
+    # ОЧИСТКА СЕТИ - Удаление Docker сети
+    # =============================================================================
+    - name: Network cleanup
+      debug:
+        msg: |
+          ================================================================================
+          ОЧИСТКА СЕТИ - Удаление Docker сети
+          ================================================================================
+          Network: {{ docker_network }}
+          ================================================================================
+
    - name: Remove network
      community.docker.docker_network:
        name: "{{ docker_network }}"
@@ -75,12 +114,14 @@
      vars:
        # Используем переменную hosts из загруженного пресета
        hosts: "{{ hosts }}"
-
    - name: Display cleanup summary
      debug:
        msg: |
-          🧹 Cleanup Summary:
-          - Removed containers: {{ hosts | length }}
-          - Removed DinD volumes: {{ hosts | selectattr('type','defined') | selectattr('type','equalto','dind') | list | length }}
-          - Network: {{ docker_network }}
-          - Removed kind clusters: {{ kind_clusters | default([]) | length }}
+          ================================================================================
+          CLEANUP SUMMARY
+          ================================================================================
+          Containers: {{ hosts | length }}
+          Volumes: {{ hosts | selectattr('type','defined') | selectattr('type','equalto','dind') | list | length }}
+          Network: {{ docker_network }}
+          Clusters: {{ kind_clusters | default([]) | length }}
+          ================================================================================
--- a/molecule/default/molecule.yml
+++ b/molecule/default/molecule.yml
@@ -8,7 +8,7 @@ driver:

 platforms:
  # Платформы будут созданы динамически через preset файлы
-  # Поддержка собственных образов DevOpsLab
+  # Поддержка собственных образов DevOpsLab с правильными тегами
  - name: placeholder
    image: ghcr.io/ansible-community/molecule-ubuntu-systemd:jammy
    pre_build_image: true
@@ -16,32 +16,70 @@ platforms:
  - name: ansible-controller
    image: inecs/ansible-lab:ansible-controller-latest
    pre_build_image: true
-  - name: alt-linux
+    volumes:
+      - "../vault:/workspace/vault:ro"
+  # ALT Linux
+  - name: alt9
    image: inecs/ansible-lab:alt9-latest
    pre_build_image: true
+  - name: alt10
+    image: inecs/ansible-lab:alt10-latest
+    pre_build_image: true
+  # Astra Linux
  - name: astra-linux
    image: inecs/ansible-lab:astra-linux-latest
    pre_build_image: true
+  - name: astra-linux-arm64
+    image: inecs/ansible-lab:astra-linux-arm64-latest
+    pre_build_image: true
+  # RED OS
  - name: redos
    image: inecs/ansible-lab:redos-latest
    pre_build_image: true
+  # RHEL
  - name: rhel
    image: inecs/ansible-lab:rhel-latest
    pre_build_image: true
-  - name: centos
-    image: inecs/ansible-lab:centos-latest
+  # CentOS
+  - name: centos7
+    image: inecs/ansible-lab:centos7-latest
    pre_build_image: true
+  - name: centos8
+    image: inecs/ansible-lab:centos8-latest
+    pre_build_image: true
+  - name: centos9
+    image: inecs/ansible-lab:centos9-latest
+    pre_build_image: true
+  # AlmaLinux
  - name: alma
    image: inecs/ansible-lab:alma-latest
    pre_build_image: true
+  # Rocky Linux
  - name: rocky
    image: inecs/ansible-lab:rocky-latest
    pre_build_image: true
-  - name: ubuntu
-    image: inecs/ansible-lab:ubuntu-latest
+  # Ubuntu
+  - name: ubuntu20
+    image: inecs/ansible-lab:ubuntu20-latest
    pre_build_image: true
-  - name: debian
-    image: inecs/ansible-lab:debian-latest
+  - name: ubuntu22
+    image: inecs/ansible-lab:ubuntu22-latest
+    pre_build_image: true
+  - name: ubuntu24
+    image: inecs/ansible-lab:ubuntu24-latest
+    pre_build_image: true
+  # Debian
+  - name: debian9
+    image: inecs/ansible-lab:debian9-latest
+    pre_build_image: true
+  - name: debian10
+    image: inecs/ansible-lab:debian10-latest
+    pre_build_image: true
+  - name: debian11
+    image: inecs/ansible-lab:debian11-latest
+    pre_build_image: true
+  - name: debian12
+    image: inecs/ansible-lab:debian12-latest
    pre_build_image: true

 provisioner:
--- a/molecule/default/site.yml
+++ b/molecule/default/site.yml
@@ -1,4 +1,7 @@
 ---
+# =============================================================================
+# SITE - Основной playbook для тестирования Ansible ролей
+# =============================================================================
 # Универсальный playbook для тестирования Ansible ролей
 # Автор: Сергей Антропов
 # Сайт: https://devops.org.ru
--- a/molecule/default/verify.yml
+++ b/molecule/default/verify.yml
@@ -1,4 +1,7 @@
 ---
+# =============================================================================
+# VERIFY - Проверка тестовых инстансов
+# =============================================================================
 - hosts: localhost
  gather_facts: false
  vars:
@@ -14,12 +17,35 @@
        groups: [test]

  tasks:
+    # =============================================================================
+    # НАСТРОЙКА - Загрузка конфигурации
+    # =============================================================================
+    - name: Configuration setup
+      debug:
+        msg: |
+          ================================================================================
+          НАСТРОЙКА - Загрузка конфигурации
+          ================================================================================
+          Preset: {{ preset_name }}
+          ================================================================================
+
    - name: Load preset configuration
      include_vars: "{{ preset_file }}"
      when: preset_file is file
      ignore_errors: true

-    # Проверка systemd узлов
+    # =============================================================================
+    # ПРОВЕРКА SYSTEMD УЗЛОВ - Статус systemd контейнеров
+    # =============================================================================
+    - name: Systemd nodes verification
+      debug:
+        msg: |
+          ================================================================================
+          ПРОВЕРКА SYSTEMD УЗЛОВ - Статус systemd контейнеров
+          ================================================================================
+          Count: {{ hosts | selectattr('type','undefined') | list | length }}
+          ================================================================================
+
    - name: Check systemd nodes status
      community.docker.docker_container_exec:
        container: "{{ item.name }}"
--- a/molecule/presets/cod.yml
+++ b/molecule/presets/cod.yml
@@ -0,0 +1,93 @@
+---
+# COD пресет с 5 контейнерами (Ubuntu + Debian + Alt + Astra + RedOS)
+# Автор: Сергей Антропов
+# Сайт: https://devops.org.ru
+# Описание: Пресет для тестирования ролей на различных ОС
+# Использует образы Ubuntu, Debian, Alt, Astra и RedOS
+
+docker_network: labnet
+generated_inventory: "{{ molecule_ephemeral_directory }}/inventory/hosts.ini"
+
+# Используем стабильные образы Ubuntu, Debian, Alt, Astra и RedOS (ARM64)
+images:
+  ubuntu: "inecs/ansible-lab:ubuntu22-latest"
+  debian: "inecs/ansible-lab:debian12-latest"
+  alt: "inecs/ansible-lab:alt10-latest"
+  astra: "inecs/ansible-lab:astra-latest-arm64"  # ARM64 образ
+  redos: "inecs/ansible-lab:redos-latest-arm64"  # ARM64 образ
+
+# Настройки для ARM64
+# Используем нативные ARM64 образы
+platform: "linux/arm64"
+
+# Настройки Docker для ARM64
+docker_options:
+  platform: "linux/arm64"
+  
+systemd_defaults:
+  privileged: true
+  command: "/bin/bash -c \"while true; do sleep 30; done\""
+  platform: "linux/arm64"  # Используем ARM64
+  volumes:
+    - "/sys/fs/cgroup:/sys/fs/cgroup:rw"
+  tmpfs: ["/run", "/run/lock"]
+  capabilities: ["SYS_ADMIN"]
+
+# Принудительная установка платформы для всех операций Docker
+docker_platform: "linux/amd64"
+
+hosts:
+  # =============================================================================
+  # UBUNTU СЕРВЕРЫ
+  # =============================================================================
+  - name: ubuntu1
+    family: ubuntu
+    groups: [cod, ubuntu]
+    platform: "linux/arm64"  # Используем ARM64
+    docker_options:
+      platform: "linux/arm64"
+    docker_platform: "linux/arm64"
+
+  # =============================================================================
+  # DEBIAN СЕРВЕРЫ
+  # =============================================================================
+  - name: debian1
+    family: debian
+    groups: [cod, debian]
+    platform: "linux/arm64"  # Используем ARM64
+    docker_options:
+      platform: "linux/arm64"
+    docker_platform: "linux/arm64"
+
+  # =============================================================================
+  # ALT СЕРВЕРЫ
+  # =============================================================================
+  - name: alt1
+    family: alt
+    groups: [cod, alt]
+    platform: "linux/arm64"  # Используем ARM64
+    docker_options:
+      platform: "linux/arm64"
+    docker_platform: "linux/arm64"
+
+  # =============================================================================
+  # ASTRA СЕРВЕРЫ (ARM64)
+  # =============================================================================
+  - name: astra1
+    family: astra
+    groups: [cod, astra]
+    platform: "linux/arm64"  # Используем ARM64
+    docker_options:
+      platform: "linux/arm64"
+    docker_platform: "linux/arm64"
+
+  # =============================================================================
+  # REDOS СЕРВЕРЫ (ARM64)
+  # =============================================================================
+  - name: redos1
+    family: redos
+    groups: [cod, redos]
+    platform: "linux/arm64"  # Используем ARM64
+    docker_options:
+      platform: "linux/arm64"
+    docker_platform: "linux/arm64"
--- a/molecule/presets/minimal.yml
+++ b/molecule/presets/minimal.yml
@@ -0,0 +1,45 @@
+---
+#description: Минимальный пресет для быстрого тестирования с 1 хостом (Debian)
+# Автор: Сергей Антропов
+# Сайт: https://devops.org.ru
+
+docker_network: labnet
+generated_inventory: "{{ molecule_ephemeral_directory }}/inventory/hosts.ini"
+
+# systemd-ready образы
+images:
+  alt9: "inecs/ansible-lab:alt9-latest"
+  alt10: "inecs/ansible-lab:alt10-latest"
+  astra: "inecs/ansible-lab:astra-linux-latest"
+  rhel: "inecs/ansible-lab:rhel-latest"
+  centos7: "inecs/ansible-lab:centos7-latest"
+  centos8: "inecs/ansible-lab:centos8-latest"
+  centos9: "inecs/ansible-lab:centos9-latest"
+  alma: "inecs/ansible-lab:alma-latest"
+  rocky: "inecs/ansible-lab:rocky-latest"
+  redos: "inecs/ansible-lab:redos-latest"
+  ubuntu20: "inecs/ansible-lab:ubuntu20-latest"
+  ubuntu22: "inecs/ansible-lab:ubuntu22-latest"
+  ubuntu24: "inecs/ansible-lab:ubuntu24-latest"
+  debian9: "inecs/ansible-lab:debian9-latest"
+  debian10: "inecs/ansible-lab:debian10-latest"
+  debian11: "inecs/ansible-lab:debian11-latest"
+  debian12: "inecs/ansible-lab:debian12-latest"
+  
+systemd_defaults:
+  privileged: true
+  command: "/sbin/init"
+  volumes:
+    - "/sys/fs/cgroup:/sys/fs/cgroup:rw"
+  tmpfs: ["/run", "/run/lock"]
+  capabilities: ["SYS_ADMIN"]
+
+hosts:
+  # Минимальный набор - один хост
+  - name: u1
+    family: astra
+    groups: [test]
+    supported_platforms: ["linux/amd64"]  # Только amd64
+  - name: u2
+    family: alt
+    groups: [test]