csi-driver-smb: add

kubernetes/apps/storage/csi-driver-smb/app/externalsecret.yaml

@@ -0,0 +1,35 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name csi-driver-smb
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+        mountOptions: "dir_mode=0775,file_mode=0664,uid=0,gid=0,noperm,mfsymlinks,noserverino,multichannel,max_channels=4"
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretKey 37cdb723-94d5-4a46-8a52-76b4f034137f
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretKey
+        property: password

kubernetes/apps/storage/csi-driver-smb/app/helmrelease.yaml

@@ -0,0 +1,29 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: csi-driver-smb
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: csi-driver-smb
+      version: v1.16.0
+      sourceRef:
+        kind: HelmRepository
+        name: csi-driver-smb
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    node:
+      nodeSelector:
+        node-role.kubernetes.io/worker: ""

kubernetes/apps/storage/csi-driver-smb/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml

kubernetes/apps/storage/csi-driver-smb/ks.yaml

@@ -0,0 +1,81 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app csi-driver-smb
+  namespace: flux-system
+spec:
+  targetNamespace: storage
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets-stores
+  path: ./kubernetes/apps/storage/csi-driver-smb/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app csi-driver-smb-storage-classes
+  namespace: flux-system
+spec:
+  targetNamespace: storage
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: csi-driver-smb
+  path: ./kubernetes/apps/storage/csi-driver-smb/storage-classes
+  prune: true
+  force: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  patches:
+    - target:
+        kind: StorageClass
+      patch: |
+        - op: add
+          path: /volumeBindingMode
+          value: Immediate
+        - op: add
+          path: /allowVolumeExpansion
+          value: true
+        - op: add
+          path: /reclaimPolicy
+          value: Delete
+        - op: add
+          path: /parameters/onDelete
+          value: retain
+        - op: add
+          path: /parameters/csi.storage.k8s.io~1node-stage-secret-name
+          value: csi-driver-smb
+        - op: add
+          path: /parameters/csi.storage.k8s.io~1node-stage-secret-namespace
+          value: storage
+        - op: add
+          path: /mountOptions
+          value:
+            - "dir_mode=0775"
+            - "file_mode=0664"
+            - "uid=0"
+            - "gid=100"
+            - noperm
+            - mfsymlinks
+            - noserverino
+#            - multichannel
+#            - max_channels=4

kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-appdata.yaml

@@ -0,0 +1,10 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/storageclass.json
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: "cifs-appdata"
+provisioner: smb.csi.k8s.io
+parameters:
+  source: "//${SECRET_UNRAID_HOSTNAME}/k3s/appdata"
+

kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-movies.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/storageclass.json
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: "cifs-movies"
+provisioner: smb.csi.k8s.io
+parameters:
+  source: "//${SECRET_UNRAID_HOSTNAME}/movies"

kubernetes/apps/storage/csi-driver-smb/storage-classes/cifs-tv.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/storageclass.json
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: "cifs-tv"
+provisioner: smb.csi.k8s.io
+parameters:
+  source: "//${SECRET_UNRAID_HOSTNAME}/shows"

kubernetes/apps/storage/csi-driver-smb/storage-classes/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./cifs-appdata.yaml
+  - ./cifs-movies.yaml

kubernetes/flux/repositories/helm/csi-driver-smb.yaml

@@ -0,0 +1,10 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: csi-driver-smb
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts

kubernetes/flux/vars/cluster-secrets.sops.yaml

@@ -4,10 +4,10 @@ metadata:
     name: cluster-secrets
     namespace: flux-system
 stringData:
-    SECRET_DOMAIN: ENC[AES256_GCM,data:uqdjPED+mxmdUTx7TJIR9A==,iv:hmVDDwzqBYWA7mSqCp0WEZZjHXY1jPtfj71kcHQuWNk=,tag:s/o0767NO/ERXhOrVogwlw==,type:str]
+    SECRET_DOMAIN: ENC[AES256_GCM,data:HjoRmQzaP5jG8m1iMc198Q==,iv:1GNInjU80g3lstoVYUY9/pOSh9QnCCmXN44PhZgvOv8=,tag:62X6LxGg9vt1wiW8kf/CsA==,type:str]
-    SECRET_INTERNAL_DOMAIN: ENC[AES256_GCM,data:V+a232owGhaq0AbwmA==,iv:Kun8a5FY4hJkYIaQaQabhF68YQmg84WvSf7mN5wXReE=,tag:btvlR9FxIC40pcfjIT1xZQ==,type:str]
+    SECRET_ACME_EMAIL: ENC[AES256_GCM,data:gG7gLBw7i5xLu1HkOYA8O76WPsc=,iv:d71Ip9lrtZR5FFWvV+NQbP9epP6v9cYM1Ntag6yHWAQ=,tag:ZzljWFeetwVubEuIOljrSA==,type:str]
-    SECRET_ACME_EMAIL: ENC[AES256_GCM,data:O54SPqcxk9AQPM+/SY3AJf9Q18s=,iv:nz8g9wMv1qvFrcaybD1GaxUMU5/yWKNpfncswCN8MCk=,tag:OzDI/ADGJEmZqzdkBMOV6A==,type:str]
+    SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:22ZGxjzd/GM9JscAoadi+f2Y6UKL6BJ16LOpxObPrw+geR6A,iv:9M1HGTCzlDI8bLAUFzYPznzBJueRnc+/tGORIlDJS88=,tag:1aGOpgabBTt+OdJI/7xBnw==,type:str]
-    SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:v+fc5FKSWZDj1FxKOfFqX8b0IhBUzhWMJv/mnPRzRP6+d5qQ,iv:3Vi4MKuFKnCeqdekTWEJs4az+eKbR7acmAeWdk6aOp4=,tag:FtVoEGs5CgXtKGF28Rrjng==,type:str]
+    SECRET_UNRAID_HOSTNAME: ENC[AES256_GCM,data:DxjjDKkowZYrE7qK,iv:hifntnMQWrtBEDPucuO/KmblEuWNF7qUz8Mi9s44KaM=,tag:zyEJ92uqKXfu6yh18dqqYw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -17,14 +17,14 @@ sops:
         - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZTZrNUxQeDRHWUhPUk1o
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZVo3MWRwMFRzeXA5UXN0
-            UklhUlo0V2ZIOTRmTXd3bWN5bndLT0VUZG1RCnJSd3doWHhrOFdpeUE2Q0JWdWoy
+            cGRkbUl6THpQRzlORENoNDZzbzlQenkvMEh3Ck53NzdEOW4yVjlJcUNLU1M2QVVK
-            OTRnOVZYajdFMVIzQzRKdlF4bTVEb2MKLS0tIHk2OEtTYUlML0YxU2sva2JjUUJQ
+            Qm9CMVpFeXg3dGRuaVVreUFtdDJ0MVUKLS0tIDVQQUpTVHJDSHhJdS9lMk5NdXhu
-            S1hvdXk5dFdRZE00T2NrNC9GaStIYUUK6NfuJJZDu8O2c+6pacIbah7oI8eKYxqX
+            N1dXTnlOaUNLUjh5SVRCZzlhVUF4Y1EKoLjz8aT2CdHI6URVJheQID4/7DkPfWXB
-            AWRROo/oWzrHoK7eXZHKeTuTi3lgFIFuRSEMzyipcZfu2HKHyVLShQ==
+            yG/wM3CEOlnXP5Eyj8X5r/LmCoeBD7LNlAwQ0PGythA3v+LQpat9Uw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-07T06:32:06Z"
+    lastmodified: "2024-11-18T02:32:55Z"
-    mac: ENC[AES256_GCM,data:VgeNG+ZraWxkjsd2PBTCaeulXifmt5KkMEVJCJOmLWuKAFCyrIZ+C1fV1J8+rGkRkuEDx+ZWHtvElv9TfTCFqHAhLG/crkRe/HQFvsxOJoC8qO4ciFMn80jTzDGj6dD5VVGLUnkAWaiWbInS0oJC6/ZEhPuTCo1JFrPycpnr4YA=,iv:dE0czOEMYM82/a9/2HLezQlrs6ITatuZPKw+NuegIHw=,tag:UZw1WhREn5sitTbgf9MBSA==,type:str]
+    mac: ENC[AES256_GCM,data:dGBL3bQNdmHZlHpPQUDi5b5kgDWe/dFzS82Xnu1YjwCTMG5ktHzZ7O2NNndAyG670NQD5gFzW1j0HG/pl0CKosD2+9Ly2zew4ROykr7M6/Pk4bcmtMBn/jZbYAF7wJpC+qrXCgJwkLaHMoFN1/Pyy6CeuNhMKc3ykIQ/n35BOWE=,iv:cvlbcWAs+34JOrOwKJa8g7/vwUqXqef/dmt1UEld3LE=,tag:WkHlS08QJfC46cJsUnFsRg==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.1