feat: add csi-driver-nfs addon (#837)

template/tasks/addons/csi_driver_nfs.yaml

@@ -0,0 +1,63 @@
+---
+- name: Set addon facts
+  ansible.builtin.set_fact:
+    addon_name: csi-driver-nfs
+    addon_namespace: kube-system
+
+- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'directory'
+  ansible.builtin.file:
+    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'file' and 'sops' not in item.path
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
+  block:
+    - name: Rename Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml"
+        dest: "{{ repository_path }}/.sops.yaml.orig"
+        mode: "0755"
+    - name: Remove Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml"
+        state: absent
+    - name: Template encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0755"
+        force: true
+      with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent
+  rescue:
+    - name: Restore Sops configuration file
+      ansible.builtin.copy:
+        src: "{{ repository_path }}/.sops.yaml.orig"
+        dest: "{{ repository_path }}/.sops.yaml"
+        mode: "0755"
+    - name: Remove backed up Sops configuration file
+      ansible.builtin.file:
+        path: "{{ repository_path }}/.sops.yaml.orig"
+        state: absent

template/tasks/addons/main.yaml

@@ -1,21 +1,25 @@
 ---
 
+- name: Process addon csi-driver-nfs
+  when: csi_driver_nfs.enabled | default(false)
+  ansible.builtin.include_tasks: csi_driver_nfs.yaml
+
 - name: Process addon hajimari
-  when: hajimari.enabled | default (false)
+  when: hajimari.enabled | default(false)
   ansible.builtin.include_tasks: hajimari.yaml
 
 - name: Process addon grafana
-  when: grafana.enabled | default (false)
+  when: grafana.enabled | default(false)
   ansible.builtin.include_tasks: grafana.yaml
 
 - name: Process addon kubernetes-dashboard
-  when: kubernetes_dashboard.enabled | default (false)
+  when: kubernetes_dashboard.enabled | default(false)
   ansible.builtin.include_tasks: kubernetes_dashboard.yaml
 
 - name: Process addon kube-prometheus-stack
-  when: kube_prometheus_stack.enabled | default (false)
+  when: kube_prometheus_stack.enabled | default(false)
   ansible.builtin.include_tasks: kube_prometheus_stack.yaml
 
 - name: Process addon weave-gitops
-  when: weave_gitops.enabled | default (false)
+  when: weave_gitops.enabled | default(false)
   ansible.builtin.include_tasks: weave_gitops.yaml

template/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2

@@ -0,0 +1,30 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: csi-driver-nfs
+  namespace: kube-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: csi-driver-nfs
+      version: v4.4.0
+      sourceRef:
+        kind: HelmRepository
+        name: csi-driver-nfs
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    externalSnapshotter:
+      enabled: false

template/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - ./helmrelease.yaml
+  - ./storageclass.yaml

template/templates/addons/csi-driver-nfs/app/storageclass.yaml.j2

@@ -0,0 +1,15 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+{% for item in csi_driver_nfs.storage_class %}
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: {{ item.name }}
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: {{ item.server }}
+  share: {{ item.share }}
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+mountOptions: ["hard", "noatime"]
+{% endfor %}

template/templates/addons/csi-driver-nfs/ks.yaml.j2

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-csi-driver-nfs
+  namespace: flux-system
+spec:
+  path: ./kubernetes/apps/kube-system/csi-driver-nfs/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

template/templates/kubernetes/apps/kube-system/kustomization.yaml.j2

@@ -1,3 +1,4 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -8,3 +9,6 @@ resources:
   - ./local-path-provisioner/ks.yaml
   - ./metrics-server/ks.yaml
   - ./reloader/ks.yaml
+  {% if csi_driver_nfs.enabled | default(false) %}
+  - ./csi-driver-nfs/ks.yaml
+  {% endif %}

template/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: csi-driver-nfs
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts

template/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2

@@ -6,6 +6,7 @@ resources:
   - ./bjw-s.yaml
   - ./cilium.yaml
   - ./coredns.yaml
+  - ./csi-driver-nfs.yaml
   - ./external-dns.yaml
   - ./grafana.yaml
   - ./hajimari.yaml

template/vars/addons.sample.yaml

@@ -10,7 +10,7 @@ hajimari:
 # https://github.com/grafana/grafana
 grafana:
   enabled: false
-  # password:
+  # password: # admin password
 
 # https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
 kube_prometheus_stack:
@@ -23,4 +23,12 @@ kubernetes_dashboard:
 # https://github.com/weaveworks/weave-gitops
 weave_gitops:
   enabled: false
-  # password:
+  # password: # admin password
+
+# https://github.com/kubernetes-csi/csi-driver-nfs
+csi_driver_nfs:
+  enabled: false
+  # storage_class:
+  #   - name: # name of the storage class (lower-kebab-case)
+  #     server: # dns name or ip address of nfs server
+  #     share: # exported share (path)