From 15edd8fd1bdf245c01c23ca66c8004bec1932c55 Mon Sep 17 00:00:00 2001 From: Daren Lord Date: Mon, 18 Nov 2024 03:01:22 +0000 Subject: [PATCH] csi-driver-smb: add --- .../csi-driver-smb/app/externalsecret.yaml | 35 ++++++++ .../csi-driver-smb/app/helmrelease.yaml | 29 +++++++ .../csi-driver-smb/app/kustomization.yaml | 7 ++ .../apps/storage/csi-driver-smb/ks.yaml | 81 +++++++++++++++++++ .../storage-classes/cifs-appdata.yaml | 10 +++ .../storage-classes/cifs-movies.yaml | 9 +++ .../storage-classes/cifs-tv.yaml | 9 +++ .../storage-classes/kustomization.yaml | 7 ++ .../repositories/helm/csi-driver-smb.yaml | 10 +++ .../flux/vars/cluster-secrets.sops.yaml | 22 ++--- 10 files changed, 208 insertions(+), 11 deletions(-) create mode 100644 kubernetes/apps/storage/csi-driver-smb/app/externalsecret.yaml create mode 100644 kubernetes/apps/storage/csi-driver-smb/app/helmrelease.yaml create mode 100644 kubernetes/apps/storage/csi-driver-smb/app/kustomization.yaml create mode 100644 kubernetes/apps/storage/csi-driver-smb/ks.yaml create mode 100644 kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-appdata.yaml create mode 100644 kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-movies.yaml create mode 100644 kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-tv.yaml create mode 100644 kubernetes/apps/storage/csi-driver-smb/storage-classes/kustomization.yaml create mode 100644 kubernetes/flux/repositories/helm/csi-driver-smb.yaml diff --git a/kubernetes/apps/storage/csi-driver-smb/app/externalsecret.yaml b/kubernetes/apps/storage/csi-driver-smb/app/externalsecret.yaml new file mode 100644 index 00000000..cb9d3de9 --- /dev/null +++ b/kubernetes/apps/storage/csi-driver-smb/app/externalsecret.yaml @@ -0,0 +1,35 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: &name csi-driver-smb +spec: + target: + name: *name + deletionPolicy: Delete + template: + type: Opaque + data: + username: |- + {{ .username }} + password: |- + {{ .password }} + mountOptions: "dir_mode=0775,file_mode=0664,uid=0,gid=0,noperm,mfsymlinks,noserverino,multichannel,max_channels=4" + data: + - secretKey: username + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: &secretKey 37cdb723-94d5-4a46-8a52-76b4f034137f + property: username + - secretKey: password + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: *secretKey + property: password diff --git a/kubernetes/apps/storage/csi-driver-smb/app/helmrelease.yaml b/kubernetes/apps/storage/csi-driver-smb/app/helmrelease.yaml new file mode 100644 index 00000000..6597b6db --- /dev/null +++ b/kubernetes/apps/storage/csi-driver-smb/app/helmrelease.yaml @@ -0,0 +1,29 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: csi-driver-smb +spec: + interval: 30m + chart: + spec: + chart: csi-driver-smb + version: v1.16.0 + sourceRef: + kind: HelmRepository + name: csi-driver-smb + namespace: flux-system + install: + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + node: + nodeSelector: + node-role.kubernetes.io/worker: "" diff --git a/kubernetes/apps/storage/csi-driver-smb/app/kustomization.yaml b/kubernetes/apps/storage/csi-driver-smb/app/kustomization.yaml new file mode 100644 index 00000000..4eed917b --- /dev/null +++ b/kubernetes/apps/storage/csi-driver-smb/app/kustomization.yaml @@ -0,0 +1,7 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./externalsecret.yaml + - ./helmrelease.yaml diff --git a/kubernetes/apps/storage/csi-driver-smb/ks.yaml b/kubernetes/apps/storage/csi-driver-smb/ks.yaml new file mode 100644 index 00000000..e4c47cb4 --- /dev/null +++ b/kubernetes/apps/storage/csi-driver-smb/ks.yaml @@ -0,0 +1,81 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app csi-driver-smb + namespace: flux-system +spec: + targetNamespace: storage + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: external-secrets-stores + path: ./kubernetes/apps/storage/csi-driver-smb/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: false + interval: 30m + retryInterval: 1m + timeout: 5m +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app csi-driver-smb-storage-classes + namespace: flux-system +spec: + targetNamespace: storage + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: csi-driver-smb + path: ./kubernetes/apps/storage/csi-driver-smb/storage-classes + prune: true + force: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: false + interval: 30m + retryInterval: 1m + timeout: 5m + patches: + - target: + kind: StorageClass + patch: | + - op: add + path: /volumeBindingMode + value: Immediate + - op: add + path: /allowVolumeExpansion + value: true + - op: add + path: /reclaimPolicy + value: Delete + - op: add + path: /parameters/onDelete + value: retain + - op: add + path: /parameters/csi.storage.k8s.io~1node-stage-secret-name + value: csi-driver-smb + - op: add + path: /parameters/csi.storage.k8s.io~1node-stage-secret-namespace + value: storage + - op: add + path: /mountOptions + value: + - "dir_mode=0775" + - "file_mode=0664" + - "uid=0" + - "gid=100" + - noperm + - mfsymlinks + - noserverino +# - multichannel +# - max_channels=4 diff --git a/kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-appdata.yaml b/kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-appdata.yaml new file mode 100644 index 00000000..2df8d949 --- /dev/null +++ b/kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-appdata.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/storageclass.json +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: "cifs-appdata" +provisioner: smb.csi.k8s.io +parameters: + source: "//${SECRET_UNRAID_HOSTNAME}/k3s/appdata" + diff --git a/kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-movies.yaml b/kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-movies.yaml new file mode 100644 index 00000000..5284e780 --- /dev/null +++ b/kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-movies.yaml @@ -0,0 +1,9 @@ +--- +# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/storageclass.json +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: "cifs-movies" +provisioner: smb.csi.k8s.io +parameters: + source: "//${SECRET_UNRAID_HOSTNAME}/movies" diff --git a/kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-tv.yaml b/kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-tv.yaml new file mode 100644 index 00000000..aed83988 --- /dev/null +++ b/kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-tv.yaml @@ -0,0 +1,9 @@ +--- +# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/storageclass.json +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: "cifs-tv" +provisioner: smb.csi.k8s.io +parameters: + source: "//${SECRET_UNRAID_HOSTNAME}/shows" diff --git a/kubernetes/apps/storage/csi-driver-smb/storage-classes/kustomization.yaml b/kubernetes/apps/storage/csi-driver-smb/storage-classes/kustomization.yaml new file mode 100644 index 00000000..77af9529 --- /dev/null +++ b/kubernetes/apps/storage/csi-driver-smb/storage-classes/kustomization.yaml @@ -0,0 +1,7 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./cifs-appdata.yaml + - ./cifs-movies.yaml diff --git a/kubernetes/flux/repositories/helm/csi-driver-smb.yaml b/kubernetes/flux/repositories/helm/csi-driver-smb.yaml new file mode 100644 index 00000000..87bebefa --- /dev/null +++ b/kubernetes/flux/repositories/helm/csi-driver-smb.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: csi-driver-smb + namespace: flux-system +spec: + interval: 1h + url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts diff --git a/kubernetes/flux/vars/cluster-secrets.sops.yaml b/kubernetes/flux/vars/cluster-secrets.sops.yaml index aaf37dd8..3a433710 100644 --- a/kubernetes/flux/vars/cluster-secrets.sops.yaml +++ b/kubernetes/flux/vars/cluster-secrets.sops.yaml @@ -4,10 +4,10 @@ metadata: name: cluster-secrets namespace: flux-system stringData: - SECRET_DOMAIN: ENC[AES256_GCM,data:uqdjPED+mxmdUTx7TJIR9A==,iv:hmVDDwzqBYWA7mSqCp0WEZZjHXY1jPtfj71kcHQuWNk=,tag:s/o0767NO/ERXhOrVogwlw==,type:str] - SECRET_INTERNAL_DOMAIN: ENC[AES256_GCM,data:V+a232owGhaq0AbwmA==,iv:Kun8a5FY4hJkYIaQaQabhF68YQmg84WvSf7mN5wXReE=,tag:btvlR9FxIC40pcfjIT1xZQ==,type:str] - SECRET_ACME_EMAIL: ENC[AES256_GCM,data:O54SPqcxk9AQPM+/SY3AJf9Q18s=,iv:nz8g9wMv1qvFrcaybD1GaxUMU5/yWKNpfncswCN8MCk=,tag:OzDI/ADGJEmZqzdkBMOV6A==,type:str] - SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:v+fc5FKSWZDj1FxKOfFqX8b0IhBUzhWMJv/mnPRzRP6+d5qQ,iv:3Vi4MKuFKnCeqdekTWEJs4az+eKbR7acmAeWdk6aOp4=,tag:FtVoEGs5CgXtKGF28Rrjng==,type:str] + SECRET_DOMAIN: ENC[AES256_GCM,data:HjoRmQzaP5jG8m1iMc198Q==,iv:1GNInjU80g3lstoVYUY9/pOSh9QnCCmXN44PhZgvOv8=,tag:62X6LxGg9vt1wiW8kf/CsA==,type:str] + SECRET_ACME_EMAIL: ENC[AES256_GCM,data:gG7gLBw7i5xLu1HkOYA8O76WPsc=,iv:d71Ip9lrtZR5FFWvV+NQbP9epP6v9cYM1Ntag6yHWAQ=,tag:ZzljWFeetwVubEuIOljrSA==,type:str] + SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:22ZGxjzd/GM9JscAoadi+f2Y6UKL6BJ16LOpxObPrw+geR6A,iv:9M1HGTCzlDI8bLAUFzYPznzBJueRnc+/tGORIlDJS88=,tag:1aGOpgabBTt+OdJI/7xBnw==,type:str] + SECRET_UNRAID_HOSTNAME: ENC[AES256_GCM,data:DxjjDKkowZYrE7qK,iv:hifntnMQWrtBEDPucuO/KmblEuWNF7qUz8Mi9s44KaM=,tag:zyEJ92uqKXfu6yh18dqqYw==,type:str] sops: kms: [] gcp_kms: [] @@ -17,14 +17,14 @@ sops: - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZTZrNUxQeDRHWUhPUk1o - UklhUlo0V2ZIOTRmTXd3bWN5bndLT0VUZG1RCnJSd3doWHhrOFdpeUE2Q0JWdWoy - OTRnOVZYajdFMVIzQzRKdlF4bTVEb2MKLS0tIHk2OEtTYUlML0YxU2sva2JjUUJQ - S1hvdXk5dFdRZE00T2NrNC9GaStIYUUK6NfuJJZDu8O2c+6pacIbah7oI8eKYxqX - AWRROo/oWzrHoK7eXZHKeTuTi3lgFIFuRSEMzyipcZfu2HKHyVLShQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZVo3MWRwMFRzeXA5UXN0 + cGRkbUl6THpQRzlORENoNDZzbzlQenkvMEh3Ck53NzdEOW4yVjlJcUNLU1M2QVVK + Qm9CMVpFeXg3dGRuaVVreUFtdDJ0MVUKLS0tIDVQQUpTVHJDSHhJdS9lMk5NdXhu + N1dXTnlOaUNLUjh5SVRCZzlhVUF4Y1EKoLjz8aT2CdHI6URVJheQID4/7DkPfWXB + yG/wM3CEOlnXP5Eyj8X5r/LmCoeBD7LNlAwQ0PGythA3v+LQpat9Uw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-11-07T06:32:06Z" - mac: ENC[AES256_GCM,data:VgeNG+ZraWxkjsd2PBTCaeulXifmt5KkMEVJCJOmLWuKAFCyrIZ+C1fV1J8+rGkRkuEDx+ZWHtvElv9TfTCFqHAhLG/crkRe/HQFvsxOJoC8qO4ciFMn80jTzDGj6dD5VVGLUnkAWaiWbInS0oJC6/ZEhPuTCo1JFrPycpnr4YA=,iv:dE0czOEMYM82/a9/2HLezQlrs6ITatuZPKw+NuegIHw=,tag:UZw1WhREn5sitTbgf9MBSA==,type:str] + lastmodified: "2024-11-18T02:32:55Z" + mac: ENC[AES256_GCM,data:dGBL3bQNdmHZlHpPQUDi5b5kgDWe/dFzS82Xnu1YjwCTMG5ktHzZ7O2NNndAyG670NQD5gFzW1j0HG/pl0CKosD2+9Ly2zew4ROykr7M6/Pk4bcmtMBn/jZbYAF7wJpC+qrXCgJwkLaHMoFN1/Pyy6CeuNhMKc3ykIQ/n35BOWE=,iv:cvlbcWAs+34JOrOwKJa8g7/vwUqXqef/dmt1UEld3LE=,tag:WkHlS08QJfC46cJsUnFsRg==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.9.1