From 4639725099a6d853edbbc811871499dfe136172c Mon Sep 17 00:00:00 2001 From: rblundon Date: Thu, 31 Jul 2025 14:35:35 -0500 Subject: [PATCH] deploy Synology CSI --- cluster/{temp => }/applications-AoA.yaml | 2 + cluster/synology-storageclass-appset.yaml | 42 ++++++++++++++++++ cluster/synology-storageclass/controller.yaml | 10 ++--- .../synology-storageclass/kustomization.yaml | 1 - cluster/synology-storageclass/namespace.yaml | 5 +++ cluster/synology-storageclass/node.yaml | 12 +++-- .../synology-storageclass/snapshotter.yaml | 8 ++-- .../synology-storageclass/storage-class.yaml | 19 +++++++- .../synology-csi-scc.yaml | 44 +++++++++++-------- .../synology-secret-eso.yaml | 2 + cluster/temp/synology-storageclass.yaml | 33 -------------- 11 files changed, 111 insertions(+), 67 deletions(-) rename cluster/{temp => }/applications-AoA.yaml (91%) create mode 100644 cluster/synology-storageclass-appset.yaml delete mode 100644 cluster/temp/synology-storageclass.yaml diff --git a/cluster/temp/applications-AoA.yaml b/cluster/applications-AoA.yaml similarity index 91% rename from cluster/temp/applications-AoA.yaml rename to cluster/applications-AoA.yaml index 74a2614..74bbb5c 100644 --- a/cluster/temp/applications-AoA.yaml +++ b/cluster/applications-AoA.yaml @@ -4,6 +4,8 @@ kind: Application metadata: name: applications namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "5" spec: destination: name: in-cluster diff --git a/cluster/synology-storageclass-appset.yaml b/cluster/synology-storageclass-appset.yaml new file mode 100644 index 0000000..ba5f695 --- /dev/null +++ b/cluster/synology-storageclass-appset.yaml @@ -0,0 +1,42 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: synology-csi + namespace: openshift-gitops + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + goTemplate: true + goTemplateOptions: ["missingkey=error"] + generators: + - clusters: {} # Variable is .name + template: + metadata: + name: '{{.name}}-synology-csi' + annotations: + argocd.argoproj.io/sync-wave: "2" + spec: + destination: + name: in-cluster + namespace: synology-csi + project: default + source: + path: cluster/synology-storageclass + repoURL: https://github.com/rblundon/homelab.git + targetRevision: HEAD + syncPolicy: + automated: + prune: false + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: openshift-gitops + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas \ No newline at end of file diff --git a/cluster/synology-storageclass/controller.yaml b/cluster/synology-storageclass/controller.yaml index efc56be..99f0137 100644 --- a/cluster/synology-storageclass/controller.yaml +++ b/cluster/synology-storageclass/controller.yaml @@ -92,7 +92,7 @@ spec: capabilities: add: ["SYS_ADMIN"] allowPrivilegeEscalation: true - image: registry.k8s.io/sig-storage/csi-provisioner:v3.0.0 + image: registry.k8s.io/sig-storage/csi-provisioner:v5.2.0 args: - --timeout=60s - --csi-address=$(ADDRESS) @@ -111,7 +111,7 @@ spec: capabilities: add: ["SYS_ADMIN"] allowPrivilegeEscalation: true - image: registry.k8s.io/sig-storage/csi-attacher:v3.3.0 + image: registry.k8s.io/sig-storage/csi-attacher:v4.2.0 args: - --v=5 - --csi-address=$(ADDRESS) @@ -128,7 +128,7 @@ spec: capabilities: add: ["SYS_ADMIN"] allowPrivilegeEscalation: true - image: registry.k8s.io/sig-storage/csi-resizer:v1.3.0 + image: registry.k8s.io/sig-storage/csi-resizer:v1.13.2 args: - --v=5 - --csi-address=$(ADDRESS) @@ -145,7 +145,7 @@ spec: capabilities: add: ["SYS_ADMIN"] allowPrivilegeEscalation: true - image: synology/synology-csi:v1.2.0 #v1.1.3 + image: ghcr.io/xphyr/synology-csi:1.4.0 args: - --nodeid=NotUsed - --endpoint=$(CSI_ENDPOINT) @@ -167,4 +167,4 @@ spec: emptyDir: {} - name: client-info secret: - secretName: client-info-secret + secretName: client-info-secret \ No newline at end of file diff --git a/cluster/synology-storageclass/kustomization.yaml b/cluster/synology-storageclass/kustomization.yaml index 381760e..007d5ed 100644 --- a/cluster/synology-storageclass/kustomization.yaml +++ b/cluster/synology-storageclass/kustomization.yaml @@ -12,4 +12,3 @@ resources: - storage-class.yaml - snapshotter.yaml - volume-snapshot-class.yaml -- enable-iscsi.yaml \ No newline at end of file diff --git a/cluster/synology-storageclass/namespace.yaml b/cluster/synology-storageclass/namespace.yaml index bcf8c6a..b5b8a4e 100644 --- a/cluster/synology-storageclass/namespace.yaml +++ b/cluster/synology-storageclass/namespace.yaml @@ -2,10 +2,15 @@ apiVersion: v1 kind: Namespace metadata: + annotations: + argocd.argoproj.io/sync-wave: "1" labels: kubernetes.io/metadata.name: synology-csi name: synology-csi argocd.argoproj.io/managed-by: openshift-gitops-operator + pod-security.kubernetes.io/audit: baseline + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/warn: baseline name: synology-csi spec: finalizers: diff --git a/cluster/synology-storageclass/node.yaml b/cluster/synology-storageclass/node.yaml index a35f729..c9b2585 100644 --- a/cluster/synology-storageclass/node.yaml +++ b/cluster/synology-storageclass/node.yaml @@ -64,7 +64,7 @@ spec: securityContext: privileged: true imagePullPolicy: Always - image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.3.0 + image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.14.0 args: - --v=5 - --csi-address=$(ADDRESS) # the csi socket path inside the pod @@ -86,8 +86,12 @@ spec: - name: csi-plugin securityContext: privileged: true - imagePullPolicy: Always #IfNotPresent - image: synology/synology-csi:v1.2.0 #v1.1.3 + allowPrivilegeEscalation: true + capabilities: + add: + - SYS_ADMIN + imagePullPolicy: IfNotPresent + image: ghcr.io/xphyr/synology-csi:1.4.0 args: - --nodeid=$(KUBE_NODE_NAME) - --endpoint=$(CSI_ENDPOINT) @@ -137,4 +141,4 @@ spec: - name: device-dir hostPath: path: /dev - type: Directory \ No newline at end of file + type: Directory diff --git a/cluster/synology-storageclass/snapshotter.yaml b/cluster/synology-storageclass/snapshotter.yaml index 25b62ad..fc293e4 100644 --- a/cluster/synology-storageclass/snapshotter.yaml +++ b/cluster/synology-storageclass/snapshotter.yaml @@ -19,7 +19,7 @@ rules: verbs: ["get", "list", "watch"] - apiGroups: ["snapshot.storage.k8s.io"] resources: ["volumesnapshotcontents"] - verbs: ["create", "get", "list", "watch", "update", "delete"] + verbs: ["create", "get", "list", "watch", "update", "patch", "delete"] - apiGroups: ["snapshot.storage.k8s.io"] resources: ["volumesnapshotcontents/status"] verbs: ["update"] @@ -65,7 +65,7 @@ spec: capabilities: add: ["SYS_ADMIN"] allowPrivilegeEscalation: true - image: registry.k8s.io/sig-storage/csi-snapshotter:v4.2.1 + image: registry.k8s.io/sig-storage/csi-snapshotter:v8.2.1 args: - --v=5 - --csi-address=$(ADDRESS) @@ -82,7 +82,7 @@ spec: capabilities: add: ["SYS_ADMIN"] allowPrivilegeEscalation: true - image: synology/synology-csi:v1.1.3 + image: ghcr.io/xphyr/synology-csi:1.4.0 args: - --nodeid=NotUsed - --endpoint=$(CSI_ENDPOINT) @@ -104,4 +104,4 @@ spec: emptyDir: {} - name: client-info secret: - secretName: client-info-secret + secretName: client-info-secret \ No newline at end of file diff --git a/cluster/synology-storageclass/storage-class.yaml b/cluster/synology-storageclass/storage-class.yaml index ee8612e..1ac4739 100644 --- a/cluster/synology-storageclass/storage-class.yaml +++ b/cluster/synology-storageclass/storage-class.yaml @@ -1,3 +1,4 @@ +--- apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: @@ -9,7 +10,23 @@ provisioner: csi.san.synology.com parameters: dsm: '10.10.121.35' protocol: 'iscsi' - location: '/volume1' + location: '/volume1/openshift-iscsi' csi.storage.k8s.io/fstype: 'ext4' reclaimPolicy: Delete #Retain allowVolumeExpansion: true + +--- +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: synology-nfs-storage +provisioner: csi.san.synology.com +parameters: + protocol: "nfs" + dsm: '10.10.121.35' + location: '/volume1/openshift-nfs' + mountPermissions: '0755' +mountOptions: + - nfsvers=4.1 +reclaimPolicy: Delete +allowVolumeExpansion: true \ No newline at end of file diff --git a/cluster/synology-storageclass/synology-csi-scc.yaml b/cluster/synology-storageclass/synology-csi-scc.yaml index d0ea4aa..1acb5a9 100644 --- a/cluster/synology-storageclass/synology-csi-scc.yaml +++ b/cluster/synology-storageclass/synology-csi-scc.yaml @@ -1,29 +1,35 @@ --- -kind: SecurityContextConstraints apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +allowHostPorts: false +priority: null +requiredDropCapabilities: [] +allowPrivilegedContainer: true +runAsUser: + type: RunAsAny +users: + - 'system:serviceaccount:synology-csi:csi-controller-sa' + - 'system:serviceaccount:synology-csi:csi-node-sa' + - 'system:serviceaccount:synology-csi:csi-snapshotter-sa' +allowHostDirVolumePlugin: true +allowHostIPC: false +seLinuxContext: + type: RunAsAny +readOnlyRootFilesystem: false metadata: name: synology-csi-scc -allowHostDirVolumePlugin: true -allowHostNetwork: true -allowPrivilegedContainer: true -allowedCapabilities: -- 'SYS_ADMIN' -defaultAddCapabilities: [] + annotations: + argocd.argoproj.io/sync-wave: "3" fsGroup: type: RunAsAny groups: [] -priority: -readOnlyRootFilesystem: false -requiredDropCapabilities: [] -runAsUser: - type: RunAsAny -seLinuxContext: - type: RunAsAny +defaultAddCapabilities: [] supplementalGroups: type: RunAsAny -users: -- system:serviceaccount:synology-csi:csi-controller-sa -- system:serviceaccount:synology-csi:csi-node-sa -- system:serviceaccount:synology-csi:csi-snapshotter-sa volumes: -- '*' + - '*' +allowHostPID: false +allowHostNetwork: true +allowPrivilegeEscalation: true +allowedCapabilities: + - SYS_ADMIN \ No newline at end of file diff --git a/cluster/synology-storageclass/synology-secret-eso.yaml b/cluster/synology-storageclass/synology-secret-eso.yaml index afabb08..235b5ea 100644 --- a/cluster/synology-storageclass/synology-secret-eso.yaml +++ b/cluster/synology-storageclass/synology-secret-eso.yaml @@ -2,6 +2,8 @@ apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: + annotations: + argocd.argoproj.io/sync-wave: "2" name: client-info-secret namespace: synology-csi spec: diff --git a/cluster/temp/synology-storageclass.yaml b/cluster/temp/synology-storageclass.yaml deleted file mode 100644 index b565740..0000000 --- a/cluster/temp/synology-storageclass.yaml +++ /dev/null @@ -1,33 +0,0 @@ ---- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: synology-storageclass - finalizers: - - resources-finalizer.argocd.argoproj.io - annotations: - argocd.argoproj.io/sync-wave: "4" -spec: - destination: - name: in-cluster - namespace: synology-csi - project: default - source: - path: cluster/synology-storageclass - repoURL: https://github.com/rblundon/homelab.git - targetRevision: HEAD - syncPolicy: - automated: - prune: false - selfHeal: true - syncOptions: - - RespectIgnoreDifferences=true - - CreateNamespace=true - managedNamespaceMetadata: - labels: - argocd.argoproj.io/managed-by: openshift-gitops - ignoreDifferences: - - group: apps - kind: Deployment - jsonPointers: - - /spec/replicas \ No newline at end of file