apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: longhorn
  namespace: longhorn-system
spec:
  interval: 30m
  timeout: 15m
  chart:
    spec:
      chart: longhorn
      version: "1.12.1"
      sourceRef:
        kind: HelmRepository
        name: longhorn
        namespace: longhorn-system
      interval: 1h
  driftDetection:
    mode: enabled
  install:
    createNamespace: false      # namespace создаём отдельным ресурсом с PSA-меткой
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  postRenderers:
    - kustomize:
        patches:
          - target:
              kind: DaemonSet
              name: longhorn-manager
            # chart hardcodes readinessProbe without timeoutSeconds, so it falls back to the
            # k8s default of 1s; under CPU contention (e.g. busy nodes) that's too tight and
            # causes spurious "Readiness probe failed ... Client.Timeout exceeded" flapping
            patch: |
              apiVersion: apps/v1
              kind: DaemonSet
              metadata:
                name: longhorn-manager
              spec:
                template:
                  spec:
                    containers:
                    - name: longhorn-manager
                      readinessProbe:
                        timeoutSeconds: 5
                        failureThreshold: 5
  values:
    defaultSettings:
      defaultReplicaCount: 3            # по числу нод control-plane
      defaultDataPath: /var/lib/longhorn
      guaranteedEngineManagerCPU: 12
      guaranteedReplicaManagerCPU: 12
      # points at the in-cluster rclone proxy (clusters/base/infra/longhorn/s3-backup-proxy),
      # which itself encrypts and forwards to the real Wasabi bucket. "longhorn-backups" is
      # a virtual bucket the proxy creates on demand under the crypt remote - already exists.
      # region is a dummy value; the real endpoint comes from AWS_ENDPOINTS in the secret below.
      backupTarget: "s3://longhorn-backups@us-east-1/"
      backupTargetCredentialSecret: longhorn-backup-target-secret
      # чтобы не разъезжались реплики при 3 нодах
      replicaSoftAntiAffinity: false
    persistence:
      # the default "longhorn" StorageClass lives in ../storage-classes/longhorn.yaml -
      # the chart hardcodes staleReplicaTimeout: "30" and offers no value to override it
      createStorageClass: false
    csi:
      attacherReplicaCount: 3
      provisionerReplicaCount: 3
      resizerReplicaCount: 3
      snapshotterReplicaCount: 3
    ingress:
      enabled: false # exposed via Traefik explicitly