feat: add spegel to core components (#1225)

* feat: add spegel to core components

Signed-off-by: Devin Buhl <devin@buhl.casa>

* downgrade: csi-smb-driver

Signed-off-by: Devin Buhl <devin@buhl.casa>

* more: change to smb

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>

.github/tests/addons.yaml

@@ -49,8 +49,5 @@ addon_discord_template_notifier:
 addon_volsync:
   enabled: true
 
-addon_spegel:
-  enabled: true
-
 addon_longhorn:
   enabled: true

bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2

@@ -8,6 +8,6 @@ resources:
   - ./kubelet-csr-approver/ks.yaml
   #% endif %#
   - ./metrics-server/ks.yaml
-  #% if bootstrap_distribution in ['k0s', 'talos'] and addon_spegel.enabled %#
+  #% if bootstrap_distribution in ['k0s', 'talos'] %#
   - ./spegel/ks.yaml
   #% endif %#

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k0s', 'talos'] and addon_spegel.enabled %#
+#% if bootstrap_distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease

bootstrap/templates/kubernetes/apps/kube-system/spegel/app/kustomization.yaml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k0s', 'talos'] and addon_spegel.enabled %#
+#% if bootstrap_distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

bootstrap/templates/kubernetes/apps/kube-system/spegel/ks.yaml.j2

@@ -1,4 +1,4 @@
-#% if bootstrap_distribution in ['k0s', 'talos'] and addon_spegel.enabled %#
+#% if bootstrap_distribution in ['k0s', 'talos'] %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

bootstrap/templates/kubernetes/apps/storage/csi-driver-smb/app/helmrelease.yaml.j2

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: csi-driver-smb
-      version: v1.14.0
+      version: v1.13.0
       sourceRef:
         kind: HelmRepository
         name: csi-driver-smb

bootstrap/templates/kubernetes/apps/storage/csi-driver-smb/app/storageclass.yaml.j2

@@ -9,15 +9,14 @@ provisioner: smb.csi.k8s.io
 parameters:
   source: "#{ item.source }#"
   csi.storage.k8s.io/node-stage-secret-name: "#{ item.secret_name|default(item.name + '-secret') }#"
-  csi.storage.k8s.io/node-stage-secret-namespace: "#{ item.secret_namespace|default("storage") }#"
+  csi.storage.k8s.io/node-stage-secret-namespace: "#{ item.secret_namespace|default('storage') }#"
-  onDelete: retain
 reclaimPolicy: Retain
 volumeBindingMode: Immediate
 mountOptions:
-  - dir_mode=#{ item.dir_mode|default("0777") }#
+  - "dir_mode=#{ item.dir_mode|default('0777') }#"
-  - file_mode=#{ item.file_mode|default("0666") }#
+  - "file_mode=#{ item.file_mode|default('0666') }#"
-  - uid=#{ item.uid|default("1000") }#
+  - "uid=#{ item.uid|default('1000') }#"
-  - gid=#{ item.gid|default("1000") }#
+  - "gid=#{ item.gid|default('1000') }#"
   - noperm
   - mfsymlinks
   - cache=strict

bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2

@@ -36,10 +36,7 @@ spec:
         apply:
           before:
             - sudo bash /home/#{ item.username }#/k0s/hooks/apply-system.sh
-            - sudo mv /home/#{ item.username }#/k0s/containerd/unprivileged-ports.toml /etc/k0s/containerd.d/unprivileged-ports.toml
+            - sudo mv /home/#{ item.username }#/k0s/containerd/default.toml /etc/k0s/containerd.d/default.toml
-            #% if addon_spegel.enabled %#
-            - sudo mv /home/#{ item.username }#/k0s/containerd/spegel.toml /etc/k0s/containerd.d/spegel.toml
-            #% endif %#
         reset:
           before:
             - sudo bash /home/#{ item.username }#/k0s/hooks/reset-cilium.sh

bootstrap/templates/kubernetes/k0s/resources/containerd/default.toml.j2

@@ -1,4 +1,7 @@
-#% if bootstrap_distribution == 'k0s' and addon_spegel.enabled %#
+#% if bootstrap_distribution == 'k0s' %#
+[plugins."io.containerd.grpc.v1.cri"]
+  enable_unprivileged_ports = true
+  enable_unprivileged_icmp = true
 [plugins."io.containerd.grpc.v1.cri".registry]
   config_path = "/var/lib/k0s/containerd/certs.d"
 [plugins."io.containerd.grpc.v1.cri".containerd]

bootstrap/templates/kubernetes/k0s/resources/containerd/unprivileged-ports.toml.j2

@@ -1,5 +0,0 @@
-#% if bootstrap_distribution == 'k0s' %#
-[plugins."io.containerd.grpc.v1.cri"]
-  enable_unprivileged_ports = true
-  enable_unprivileged_icmp = true
-#% endif %#

bootstrap/templates/kubernetes/talos/talconfig.yaml.j2

@@ -73,12 +73,10 @@ controlPlane:
               [plugins."io.containerd.grpc.v1.cri"]
                 enable_unprivileged_ports = true
                 enable_unprivileged_icmp = true
-              #% if addon_spegel.enabled %#
               [plugins."io.containerd.grpc.v1.cri".containerd]
                 discard_unpacked_layers = false
               [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
                 discard_unpacked_layers = false
-              #% endif %#
 
     # Disable search domain everywhere
     - &disableSearchDomainPatch |-

bootstrap/vars/addons.sample.yaml

@@ -72,19 +72,14 @@ addon_discord_template_notifier:
 addon_volsync:
   enabled: false
 
-# https://github.com/XenitAB/spegel
-addon_spegel:
-  # Note: This only applies to k0s at the moment
-  enabled: false
-
 # https://github.com/longhorn/longhorn
 addon_longhorn:
   # IMPORTANT: Only enable this if you have 3 or more nodes in your cluster
   # and you have enough IOPS on disk to support the number of replicas.
   # Longhorn is currently unsupported in Talos
-  # Note: Consider enabling volsync if you would like to configure snapshots
+  # NOTE: Consider enabling volsync if you would like to configure snapshots
   # and backups to durable storage.
-  # Note: You must label any node that you want to allocate storage to longhorn
+  # NOTE: You must label any node that you want to allocate storage to longhorn
   # with label node.longhorn.io/create-default-disk="true"
   # ie: kubectl label --overwrite node <node name> node.longhorn.io/create-default-disk="true"
   enabled: false