removed nfs-photo
This commit is contained in:
azykov@mail.ru
@@ -34,8 +34,7 @@ spec:
|
||||
# already there. Running it as a restartPolicy:Always init
|
||||
# container (started, gated on the startupProbe below, before
|
||||
# regular containers) guarantees that ordering; a regular sidecar
|
||||
# container racing "app" on every pod start does not. Same
|
||||
# pattern as clusters/base/apps/nfs-photo.
|
||||
# container racing "app" on every pod start does not.
|
||||
mergerfs:
|
||||
dependsOn:
|
||||
- fix-permissions
|
||||
|
||||
@@ -1,95 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nfs-photo-config
|
||||
namespace: nfs
|
||||
data:
|
||||
ganesha.conf: |
|
||||
NFS_Core_Param {
|
||||
NFS_Port = 2049;
|
||||
Protocols = NFSv4;
|
||||
Fsid_Device = true;
|
||||
}
|
||||
|
||||
NFSV4 {
|
||||
RecoveryBackend = fs_ng;
|
||||
RecoveryRoot = /recovery;
|
||||
Lease_Lifetime = 40;
|
||||
Grace_Period = 50;
|
||||
}
|
||||
|
||||
VFS {
|
||||
Link_Support = true;
|
||||
Symlink_Support = true;
|
||||
CanSetTime = true;
|
||||
umask = 0000;
|
||||
}
|
||||
|
||||
EXPORT {
|
||||
Export_Id = 1;
|
||||
|
||||
Path = /export;
|
||||
Pseudo = /export;
|
||||
|
||||
SecType = sys;
|
||||
Protocols = NFSv4;
|
||||
|
||||
FSAL {
|
||||
Name = VFS;
|
||||
}
|
||||
|
||||
CLIENT {
|
||||
Clients = *;
|
||||
Access_Type = RW;
|
||||
Squash = No_Root_Squash;
|
||||
Protocols = NFSv4;
|
||||
}
|
||||
}
|
||||
|
||||
# individual disks, exported alongside the merged /export view so
|
||||
# clients (webdav) can also see each underlying disk on its own.
|
||||
EXPORT {
|
||||
Export_Id = 2;
|
||||
|
||||
Path = /disks/base;
|
||||
Pseudo = /base;
|
||||
|
||||
SecType = sys;
|
||||
Protocols = NFSv4;
|
||||
|
||||
FSAL {
|
||||
Name = VFS;
|
||||
}
|
||||
|
||||
CLIENT {
|
||||
Clients = *;
|
||||
Access_Type = RW;
|
||||
Squash = No_Root_Squash;
|
||||
Protocols = NFSv4;
|
||||
}
|
||||
}
|
||||
|
||||
EXPORT {
|
||||
Export_Id = 3;
|
||||
|
||||
Path = /disks/sub1;
|
||||
Pseudo = /sub1;
|
||||
|
||||
SecType = sys;
|
||||
Protocols = NFSv4;
|
||||
|
||||
FSAL {
|
||||
Name = VFS;
|
||||
}
|
||||
|
||||
CLIENT {
|
||||
Clients = *;
|
||||
Access_Type = RW;
|
||||
Squash = No_Root_Squash;
|
||||
Protocols = NFSv4;
|
||||
}
|
||||
}
|
||||
|
||||
LOG {
|
||||
Default_Log_Level = INFO;
|
||||
}
|
||||
@@ -1,240 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: nfs-photo
|
||||
namespace: nfs
|
||||
spec:
|
||||
interval: 30m
|
||||
chartRef:
|
||||
kind: OCIRepository
|
||||
name: nfs-photo
|
||||
driftDetection:
|
||||
mode: enabled
|
||||
values:
|
||||
controllers:
|
||||
app:
|
||||
strategy: Recreate
|
||||
podDisruptionBudget:
|
||||
maxUnavailable: "0"
|
||||
initContainers:
|
||||
fix-permissions:
|
||||
image:
|
||||
repository: hectorm/nfs-ganesha
|
||||
tag: v10
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- chmod -R a+rwX /disks/base /disks/sub1
|
||||
# native sidecar (restartPolicy: Always): mounts the two disks and
|
||||
# exposes their union at /disks/merged via FUSE. It must be up and
|
||||
# actually mounted *before* the "app" container is created, since
|
||||
# HostToContainer propagation only relays mounts made *after* the
|
||||
# receiving container's own mount exists - it won't retroactively
|
||||
# pick up a FUSE mount that's already there. Running it as a
|
||||
# restartPolicy:Always init container (started, gated on the
|
||||
# startupProbe below, before regular containers) guarantees that
|
||||
# ordering; a regular sidecar container racing "app" on every pod
|
||||
# start does not.
|
||||
mergerfs:
|
||||
dependsOn:
|
||||
- fix-permissions
|
||||
restartPolicy: Always
|
||||
image:
|
||||
repository: ghcr.io/hotio/mergerfs
|
||||
tag: release-v2.42.0
|
||||
args:
|
||||
- "-o"
|
||||
# category.search=newest (not ff): getattr on the merged root
|
||||
# dir has to report one branch's attrs, and with ff that's
|
||||
# always the first branch (base) regardless of which branch
|
||||
# actually changed. NFS-Ganesha's directory cache relies on
|
||||
# that mtime to know when to re-fetch a stale readdir listing
|
||||
# - with ff, writes to any branch but the first never bump the
|
||||
# merged root's reported mtime, so Ganesha keeps serving a
|
||||
# stale listing to NFS clients (confirmed: mergerfs's own
|
||||
# readdir is always a correct live union - this is purely a
|
||||
# getattr/mtime-propagation issue up through the NFS cache).
|
||||
- "allow_other,use_ino,func.create=ff,category.action=all,category.create=ff,category.search=newest"
|
||||
- "/disks/base:/disks/sub1"
|
||||
- "/disks/merged"
|
||||
securityContext:
|
||||
privileged: true
|
||||
probes:
|
||||
startup:
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- grep -q fuse.mergerfs /proc/mounts
|
||||
periodSeconds: 1
|
||||
timeoutSeconds: 2
|
||||
failureThreshold: 30
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
# runs after mergerfs is confirmed mounted (see dependsOn) and has
|
||||
# /export, /disks/base and /disks/sub1 all mounted too, so the
|
||||
# /proc/self/mounts snapshot it takes covers every path ganesha
|
||||
# exports. ganesha's FSAL_VFS resolves each EXPORT's Path against
|
||||
# this frozen /etc/mtab, not the live /proc/mounts - any exported
|
||||
# path missing from it (e.g. this ran before mergerfs, or without
|
||||
# that path mounted here at all) fails at startup with
|
||||
# "resolve_posix_filesystem(<path>) ... No such file or directory"
|
||||
# even though the path is mounted fine in every other container.
|
||||
mtab-setup:
|
||||
dependsOn:
|
||||
- mergerfs
|
||||
image:
|
||||
repository: hectorm/nfs-ganesha
|
||||
tag: v10
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- cat /proc/self/mounts > /mtab-vol/mtab
|
||||
containers:
|
||||
app:
|
||||
image:
|
||||
repository: hectorm/nfs-ganesha
|
||||
tag: v10
|
||||
securityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- CHOWN
|
||||
- DAC_OVERRIDE
|
||||
- DAC_READ_SEARCH
|
||||
- FOWNER
|
||||
- FSETID
|
||||
- SETGID
|
||||
- SETUID
|
||||
- SYS_RESOURCE
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
spec:
|
||||
initialDelaySeconds: 2
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 2
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
enabled: true
|
||||
spec:
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 2
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 2
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
|
||||
service:
|
||||
app:
|
||||
controller: app
|
||||
# cluster-internal only. pinned (not DNS name): webdav's PV mounts
|
||||
# this over NFS via the kubelet's in-tree kernel NFS client, which
|
||||
# runs in the node's host network namespace and can't reliably
|
||||
# resolve/route Kubernetes Service DNS names - it needs a stable IP
|
||||
# it can reach directly.
|
||||
type: ClusterIP
|
||||
clusterIP: 10.43.166.34
|
||||
ports:
|
||||
nfs:
|
||||
port: 2049
|
||||
protocol: TCP
|
||||
|
||||
persistence:
|
||||
config:
|
||||
type: configMap
|
||||
name: nfs-photo-config
|
||||
globalMounts:
|
||||
- path: /etc/ganesha/ganesha.conf
|
||||
subPath: ganesha.conf
|
||||
readOnly: true
|
||||
base:
|
||||
type: persistentVolumeClaim
|
||||
accessMode: ReadWriteOnce
|
||||
size: 100Gi
|
||||
storageClass: longhorn-single-replica
|
||||
retain: true
|
||||
advancedMounts:
|
||||
app:
|
||||
mergerfs:
|
||||
- path: /disks/base
|
||||
fix-permissions:
|
||||
- path: /disks/base
|
||||
# exported directly as its own NFS share (Pseudo=/base, see
|
||||
# configmap.yaml) alongside the merged /export view.
|
||||
app:
|
||||
- path: /disks/base
|
||||
mtab-setup:
|
||||
- path: /disks/base
|
||||
sub1:
|
||||
type: persistentVolumeClaim
|
||||
accessMode: ReadWriteOnce
|
||||
size: 100Gi
|
||||
storageClass: longhorn-single-replica
|
||||
retain: true
|
||||
advancedMounts:
|
||||
app:
|
||||
mergerfs:
|
||||
- path: /disks/sub1
|
||||
fix-permissions:
|
||||
- path: /disks/sub1
|
||||
# exported directly as its own NFS share (Pseudo=/sub1, see
|
||||
# configmap.yaml) alongside the merged /export view.
|
||||
app:
|
||||
- path: /disks/sub1
|
||||
mtab-setup:
|
||||
- path: /disks/sub1
|
||||
merged:
|
||||
type: emptyDir
|
||||
advancedMounts:
|
||||
app:
|
||||
mergerfs:
|
||||
- path: /disks/merged
|
||||
mountPropagation: Bidirectional
|
||||
app:
|
||||
- path: /export
|
||||
mountPropagation: HostToContainer
|
||||
mtab-setup:
|
||||
- path: /export
|
||||
mountPropagation: HostToContainer
|
||||
dev-fuse:
|
||||
type: hostPath
|
||||
hostPath: /dev/fuse
|
||||
advancedMounts:
|
||||
app:
|
||||
mergerfs:
|
||||
- path: /dev/fuse
|
||||
run:
|
||||
type: emptyDir
|
||||
globalMounts:
|
||||
- path: /run
|
||||
tmp:
|
||||
type: emptyDir
|
||||
globalMounts:
|
||||
- path: /tmp
|
||||
recovery:
|
||||
type: emptyDir
|
||||
globalMounts:
|
||||
- path: /recovery
|
||||
etc-mtab:
|
||||
type: emptyDir
|
||||
advancedMounts:
|
||||
app:
|
||||
app:
|
||||
- path: /etc/mtab
|
||||
subPath: mtab
|
||||
mtab-setup:
|
||||
- path: /mtab-vol
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: OCIRepository
|
||||
metadata:
|
||||
name: nfs-photo
|
||||
namespace: nfs
|
||||
spec:
|
||||
interval: 1h
|
||||
url: oci://ghcr.io/bjw-s-labs/helm/app-template
|
||||
ref:
|
||||
tag: "5.0.1"
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helmrepository.yaml
|
||||
- configmap.yaml
|
||||
- helmrelease.yaml
|
||||
@@ -90,21 +90,6 @@ spec:
|
||||
existingClaim: ganesha-export
|
||||
globalMounts:
|
||||
- path: /webdav/export
|
||||
photo:
|
||||
type: persistentVolumeClaim
|
||||
existingClaim: nfs-photo-export
|
||||
globalMounts:
|
||||
- path: /webdav/photo/library
|
||||
photo-base:
|
||||
type: persistentVolumeClaim
|
||||
existingClaim: nfs-photo-base
|
||||
globalMounts:
|
||||
- path: /webdav/photo/library-base
|
||||
photo-sub1:
|
||||
type: persistentVolumeClaim
|
||||
existingClaim: nfs-photo-sub1
|
||||
globalMounts:
|
||||
- path: /webdav/photo/library-sub1
|
||||
sda2:
|
||||
type: persistentVolumeClaim
|
||||
existingClaim: nas1-sda2
|
||||
|
||||
@@ -36,118 +36,6 @@ spec:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: nfs-photo-export-nfs
|
||||
spec:
|
||||
capacity:
|
||||
storage: 200Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: ""
|
||||
mountOptions:
|
||||
- nfsvers=4.1
|
||||
nfs:
|
||||
# pinned ClusterIP, not the service DNS name - kubelet's in-tree kernel
|
||||
# NFS client runs in the node's host network namespace and can't
|
||||
# reliably resolve/route Kubernetes Service DNS names. See nfs-photo's
|
||||
# helmrelease.yaml (service.app.clusterIP) for the matching pin.
|
||||
server: 10.43.166.34
|
||||
path: /export
|
||||
claimRef:
|
||||
namespace: webdav
|
||||
name: nfs-photo-export
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nfs-photo-export
|
||||
namespace: webdav
|
||||
annotations:
|
||||
helm.sh/resource-policy: keep
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
storageClassName: ""
|
||||
volumeName: nfs-photo-export-nfs
|
||||
resources:
|
||||
requests:
|
||||
storage: 200Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: nfs-photo-base-nfs
|
||||
spec:
|
||||
capacity:
|
||||
storage: 100Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: ""
|
||||
mountOptions:
|
||||
- nfsvers=4.1
|
||||
nfs:
|
||||
server: 10.43.166.34
|
||||
path: /base
|
||||
claimRef:
|
||||
namespace: webdav
|
||||
name: nfs-photo-base
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nfs-photo-base
|
||||
namespace: webdav
|
||||
annotations:
|
||||
helm.sh/resource-policy: keep
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
storageClassName: ""
|
||||
volumeName: nfs-photo-base-nfs
|
||||
resources:
|
||||
requests:
|
||||
storage: 100Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: nfs-photo-sub1-nfs
|
||||
spec:
|
||||
capacity:
|
||||
storage: 100Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: ""
|
||||
mountOptions:
|
||||
- nfsvers=4.1
|
||||
nfs:
|
||||
server: 10.43.166.34
|
||||
path: /sub1
|
||||
claimRef:
|
||||
namespace: webdav
|
||||
name: nfs-photo-sub1
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nfs-photo-sub1
|
||||
namespace: webdav
|
||||
annotations:
|
||||
helm.sh/resource-policy: keep
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
storageClassName: ""
|
||||
volumeName: nfs-photo-sub1-nfs
|
||||
resources:
|
||||
requests:
|
||||
storage: 100Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: nas1-sda2-nfs
|
||||
spec:
|
||||
|
||||
@@ -14,6 +14,5 @@ resources:
|
||||
- fava.yaml
|
||||
- infcloud.yaml
|
||||
- syncthing.yaml
|
||||
- nfs-photo.yaml
|
||||
- photo-stats.yaml
|
||||
- immich.yaml
|
||||
@@ -1,17 +0,0 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: nfs-photo
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
path: ./clusters/base/apps/nfs-photo
|
||||
prune: true
|
||||
wait: true
|
||||
dependsOn:
|
||||
- name: namespaces
|
||||
- name: infra
|
||||
retryInterval: 5s
|
||||
@@ -14,7 +14,6 @@ spec:
|
||||
dependsOn:
|
||||
- name: namespaces
|
||||
- name: nfs-ganesha
|
||||
- name: nfs-photo
|
||||
retryInterval: 5s
|
||||
decryption:
|
||||
provider: sops
|
||||
|
||||
Reference in New Issue
Block a user