deploy Synology CSI

2025-07-31 14:35:35 -05:00
parent edb019c38e
commit 4639725099
11 changed files with 111 additions and 67 deletions
--- a/cluster/temp/applications-AoA.yaml
+++ b/cluster/temp/applications-AoA.yaml
@@ -4,6 +4,8 @@ kind: Application
 metadata:
  name: applications
  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "5"
 spec:
  destination:
    name: in-cluster
--- a/cluster/synology-storageclass-appset.yaml
+++ b/cluster/synology-storageclass-appset.yaml
@@ -0,0 +1,42 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: synology-csi
+  namespace: openshift-gitops
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+  - clusters: {} # Variable is .name
+  template:
+    metadata:
+      name: '{{.name}}-synology-csi'
+      annotations:
+        argocd.argoproj.io/sync-wave: "2"
+      spec:
+        destination:
+          name: in-cluster
+          namespace: synology-csi
+        project: default
+        source:
+          path: cluster/synology-storageclass
+          repoURL: https://github.com/rblundon/homelab.git
+          targetRevision: HEAD
+        syncPolicy:
+          automated:
+            prune: false
+            selfHeal: true
+          syncOptions:
+          - RespectIgnoreDifferences=true
+          - CreateNamespace=true
+          managedNamespaceMetadata:
+            labels:
+              argocd.argoproj.io/managed-by: openshift-gitops
+        ignoreDifferences:
+        - group: apps
+          kind: Deployment
+          jsonPointers:
+          - /spec/replicas
--- a/cluster/synology-storageclass/controller.yaml
+++ b/cluster/synology-storageclass/controller.yaml
@@ -92,7 +92,7 @@ spec:
            capabilities:
              add: ["SYS_ADMIN"]
            allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-provisioner:v3.0.0
+          image: registry.k8s.io/sig-storage/csi-provisioner:v5.2.0
          args:
            - --timeout=60s
            - --csi-address=$(ADDRESS)
@@ -111,7 +111,7 @@ spec:
            capabilities:
              add: ["SYS_ADMIN"]
            allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-attacher:v3.3.0
+          image: registry.k8s.io/sig-storage/csi-attacher:v4.2.0
          args:
            - --v=5
            - --csi-address=$(ADDRESS)
@@ -128,7 +128,7 @@ spec:
            capabilities:
              add: ["SYS_ADMIN"]
            allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-resizer:v1.3.0
+          image: registry.k8s.io/sig-storage/csi-resizer:v1.13.2
          args:
            - --v=5
            - --csi-address=$(ADDRESS)
@@ -145,7 +145,7 @@ spec:
            capabilities:
              add: ["SYS_ADMIN"]
            allowPrivilegeEscalation: true
-          image: synology/synology-csi:v1.2.0 #v1.1.3
+          image: ghcr.io/xphyr/synology-csi:1.4.0
          args:
            - --nodeid=NotUsed
            - --endpoint=$(CSI_ENDPOINT)
--- a/cluster/synology-storageclass/kustomization.yaml
+++ b/cluster/synology-storageclass/kustomization.yaml
@@ -12,4 +12,3 @@ resources:
 - storage-class.yaml
 - snapshotter.yaml
 - volume-snapshot-class.yaml
- enable-iscsi.yaml
--- a/cluster/synology-storageclass/namespace.yaml
+++ b/cluster/synology-storageclass/namespace.yaml
@@ -2,10 +2,15 @@
 apiVersion: v1
 kind: Namespace
 metadata:
+  annotations:
+      argocd.argoproj.io/sync-wave: "1"
  labels:
    kubernetes.io/metadata.name: synology-csi
    name: synology-csi
    argocd.argoproj.io/managed-by: openshift-gitops-operator
+    pod-security.kubernetes.io/audit: baseline
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: baseline
  name: synology-csi
 spec:
  finalizers:
--- a/cluster/synology-storageclass/node.yaml
+++ b/cluster/synology-storageclass/node.yaml
@@ -64,7 +64,7 @@ spec:
          securityContext:
            privileged: true
          imagePullPolicy: Always
-          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.3.0
+          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.14.0
          args:
            - --v=5
            - --csi-address=$(ADDRESS)                         # the csi socket path inside the pod
@@ -86,8 +86,12 @@ spec:
        - name: csi-plugin
          securityContext:
            privileged: true
-          imagePullPolicy: Always #IfNotPresent
-          image: synology/synology-csi:v1.2.0 #v1.1.3
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+              - SYS_ADMIN
+          imagePullPolicy: IfNotPresent
+          image: ghcr.io/xphyr/synology-csi:1.4.0
          args:
            - --nodeid=$(KUBE_NODE_NAME)
            - --endpoint=$(CSI_ENDPOINT)
--- a/cluster/synology-storageclass/snapshotter.yaml
+++ b/cluster/synology-storageclass/snapshotter.yaml
@@ -19,7 +19,7 @@ rules:
    verbs: ["get", "list", "watch"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshotcontents"]
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+    verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshotcontents/status"]
    verbs: ["update"]
@@ -65,7 +65,7 @@ spec:
            capabilities:
              add: ["SYS_ADMIN"]
            allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-snapshotter:v4.2.1
+          image: registry.k8s.io/sig-storage/csi-snapshotter:v8.2.1
          args:
            - --v=5
            - --csi-address=$(ADDRESS)
@@ -82,7 +82,7 @@ spec:
            capabilities:
              add: ["SYS_ADMIN"]
            allowPrivilegeEscalation: true
-          image: synology/synology-csi:v1.1.3
+          image: ghcr.io/xphyr/synology-csi:1.4.0
          args:
            - --nodeid=NotUsed
            - --endpoint=$(CSI_ENDPOINT)
--- a/cluster/synology-storageclass/storage-class.yaml
+++ b/cluster/synology-storageclass/storage-class.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
@@ -9,7 +10,23 @@ provisioner: csi.san.synology.com
 parameters:
  dsm: '10.10.121.35'
  protocol: 'iscsi'
-  location: '/volume1'
+  location: '/volume1/openshift-iscsi'
  csi.storage.k8s.io/fstype: 'ext4'
 reclaimPolicy: Delete #Retain
 allowVolumeExpansion: true
+
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: synology-nfs-storage
+provisioner: csi.san.synology.com
+parameters:
+  protocol: "nfs"
+  dsm: '10.10.121.35'
+  location: '/volume1/openshift-nfs'
+  mountPermissions: '0755'
+mountOptions:
+  - nfsvers=4.1
+reclaimPolicy: Delete
+allowVolumeExpansion: true
--- a/cluster/synology-storageclass/synology-csi-scc.yaml
+++ b/cluster/synology-storageclass/synology-csi-scc.yaml
@@ -1,29 +1,35 @@
 ---
-kind: SecurityContextConstraints
 apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+allowHostPorts: false
+priority: null
+requiredDropCapabilities: []
+allowPrivilegedContainer: true
+runAsUser:
+  type: RunAsAny
+users:
+  - 'system:serviceaccount:synology-csi:csi-controller-sa'
+  - 'system:serviceaccount:synology-csi:csi-node-sa'
+  - 'system:serviceaccount:synology-csi:csi-snapshotter-sa'
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+seLinuxContext:
+  type: RunAsAny
+readOnlyRootFilesystem: false
 metadata:
  name: synology-csi-scc
-allowHostDirVolumePlugin: true
-allowHostNetwork: true
-allowPrivilegedContainer: true
-allowedCapabilities:
- 'SYS_ADMIN'
-defaultAddCapabilities: []
+  annotations:
+      argocd.argoproj.io/sync-wave: "3"
 fsGroup:
  type: RunAsAny
 groups: []
-priority:
-readOnlyRootFilesystem: false
-requiredDropCapabilities: []
-runAsUser:
-  type: RunAsAny
-seLinuxContext:
-  type: RunAsAny
+defaultAddCapabilities: []
 supplementalGroups:
  type: RunAsAny
-users:
- system:serviceaccount:synology-csi:csi-controller-sa
- system:serviceaccount:synology-csi:csi-node-sa
- system:serviceaccount:synology-csi:csi-snapshotter-sa
 volumes:
  - '*'
+allowHostPID: false
+allowHostNetwork: true
+allowPrivilegeEscalation: true
+allowedCapabilities:
+  - SYS_ADMIN
--- a/cluster/synology-storageclass/synology-secret-eso.yaml
+++ b/cluster/synology-storageclass/synology-secret-eso.yaml
@@ -2,6 +2,8 @@
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
  name: client-info-secret
  namespace: synology-csi
 spec:
--- a/cluster/temp/synology-storageclass.yaml
+++ b/cluster/temp/synology-storageclass.yaml
@@ -1,33 +0,0 @@
---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: synology-storageclass
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-  annotations:
-    argocd.argoproj.io/sync-wave: "4"
-spec:
-  destination:
-    name: in-cluster
-    namespace: synology-csi
-  project: default
-  source:
-    path: cluster/synology-storageclass
-    repoURL: https://github.com/rblundon/homelab.git
-    targetRevision: HEAD
-  syncPolicy:
-    automated:
-      prune: false
-      selfHeal: true
-    syncOptions:
-    - RespectIgnoreDifferences=true
-    - CreateNamespace=true
-    managedNamespaceMetadata:
-      labels:
-        argocd.argoproj.io/managed-by: openshift-gitops
-  ignoreDifferences:
-  - group: apps
-    kind: Deployment
-    jsonPointers:
-    - /spec/replicas