Enable iSCSI support for Portworx CSI

- Add dm_round_robin kernel module for Pure Storage multipath
- Uncomment and enable /etc/multipath.conf with Pure-specific settings
- Add apply-iscsi-config.sh script for rolling worker node updates

cluster/platform/external-dns/servicemonitor.yaml

@@ -0,0 +1,36 @@
+# ------------------------------------------------------------------------------
+# External-DNS Metrics - ServiceMonitor
+#
+# Configures Prometheus Operator to scrape External-DNS metrics
+# 
+# Scrape interval: 30s
+# Endpoint: /metrics on port 7979
+# Metrics namespace: externaldns_* (externaldns_registry_endpoints_total, etc.)
+# ------------------------------------------------------------------------------
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: external-dns-metrics
+  namespace: external-dns
+  labels:
+    app.kubernetes.io/name: external-dns
+    app.kubernetes.io/component: metrics
+    # Label selector for kube-prometheus-stack discovery
+    release: monitoring
+spec:
+  # Select the external-dns service
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: external-dns
+  
+  # Namespace selector
+  namespaceSelector:
+    matchNames:
+    - external-dns
+  
+  # Scrape endpoint configuration
+  endpoints:
+  - port: http
+    interval: 30s
+    scrapeTimeout: 10s
+    path: /metrics

cluster/platform/harbor/servicemonitor.yaml

@@ -0,0 +1,49 @@
+# ------------------------------------------------------------------------------
+# Harbor Metrics - ServiceMonitor
+#
+# Configures Prometheus Operator to scrape Harbor metrics
+# 
+# Scrape interval: 30s
+# Components scraped:
+#   - harbor-core: Core service HTTP metrics
+#   - harbor-registry: Registry-specific metrics  
+#   - harbor-jobservice: Job and vulnerability scan metrics
+#   - harbor-exporter: Harbor metrics exporter
+# Metrics namespace: harbor_* (harbor_core_*, harbor_project_*, etc.)
+# ------------------------------------------------------------------------------
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: harbor-metrics
+  namespace: harbor
+  labels:
+    app: harbor
+    app.kubernetes.io/name: harbor
+    app.kubernetes.io/component: metrics
+    # Label selector for kube-prometheus-stack discovery
+    release: monitoring
+spec:
+  # Select Harbor services with metrics endpoints
+  selector:
+    matchLabels:
+      app: harbor
+  
+  # Namespace selector
+  namespaceSelector:
+    matchNames:
+    - harbor
+  
+  # Scrape endpoint configuration
+  endpoints:
+  # Harbor Core - main API and web UI metrics
+  - port: http-metrics
+    interval: 30s
+    scrapeTimeout: 10s
+    path: /metrics
+    relabelings:
+    - sourceLabels: [__meta_kubernetes_service_label_component]
+      targetLabel: component
+      action: replace
+    - sourceLabels: [__meta_kubernetes_service_name]
+      targetLabel: service
+      action: replace

cluster/platform/ingress-nginx/servicemonitor.yaml

@@ -0,0 +1,37 @@
+# ------------------------------------------------------------------------------
+# Ingress-NGINX Controller Metrics - ServiceMonitor
+#
+# Configures Prometheus Operator to scrape Ingress-NGINX Controller metrics
+# 
+# Scrape interval: 30s
+# Endpoint: /metrics on port 10254
+# Metrics namespace: nginx_ingress_* (nginx_ingress_controller_requests, etc.)
+# ------------------------------------------------------------------------------
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: ingress-nginx-metrics
+  namespace: ingress-nginx
+  labels:
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/component: metrics
+    # Label selector for kube-prometheus-stack discovery
+    release: monitoring
+spec:
+  # Select the ingress-nginx-controller-metrics service
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+      app.kubernetes.io/component: controller
+  
+  # Namespace selector
+  namespaceSelector:
+    matchNames:
+    - ingress-nginx
+  
+  # Scrape endpoint configuration
+  endpoints:
+  - port: metrics
+    interval: 30s
+    scrapeTimeout: 10s
+    path: /metrics

talos/talhelper/apply-iscsi-config.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+# Apply iSCSI configuration to worker nodes
+# This regenerates configs with the iscsi-tools extension and applies them
+
+set -e
+
+echo "=========================================="
+echo "Talos iSCSI Configuration Update"
+echo "=========================================="
+echo ""
+echo "This will:"
+echo "  1. Generate new Talos configs with iscsi-tools extension"
+echo "  2. Apply configs to each worker node (one at a time)"
+echo "  3. Reboot each node to load iSCSI modules"
+echo "  4. Wait for each node to become Ready before continuing"
+echo ""
+read -p "Proceed? (y/N): " -n 1 -r
+echo
+if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+  echo "Aborted."
+  exit 0
+fi
+
+echo ""
+echo "Step 1: Generating Talos configurations..."
+talhelper genconfig
+
+declare -A WORKERS=(
+  ["jungle-cruise"]="10.1.71.69"
+  ["haunted-mansion"]="10.1.71.70"
+  ["peter-pans-flight"]="10.1.71.71"
+)
+
+for worker in jungle-cruise haunted-mansion peter-pans-flight; do
+  ip="${WORKERS[$worker]}"
+  echo ""
+  echo "=========================================="
+  echo "Updating $worker ($ip)..."
+  echo "=========================================="
+  
+  echo "Applying configuration (will reboot)..."
+  talosctl apply-config --nodes ${ip} \
+    --file clusterconfig/fastpass-${worker}.yaml \
+    --mode=reboot
+  
+  echo "Waiting for $worker to reboot and become Ready..."
+  sleep 30  # Give it time to start rebooting
+  kubectl wait --for=condition=Ready node/${worker} --timeout=10m
+  
+  echo "✓ $worker is back up."
+  
+  if [ "$worker" != "peter-pans-flight" ]; then
+    echo "Sleeping 30s before next node..."
+    sleep 30
+  fi
+done
+
+echo ""
+echo "=========================================="
+echo "✓ All workers updated!"
+echo "=========================================="
+echo ""
+echo "Verifying iSCSI modules on jungle-cruise..."
+kubectl debug node/jungle-cruise -it --image=busybox -- cat /proc/modules | grep -E "iscsi|multipath" || echo "Modules check failed"
+
+echo ""
+echo "Next steps:"
+echo "  1. Verify iSCSI modules loaded on all nodes"
+echo "  2. Proceed with Portworx CSI installation"

talos/talhelper/talconfig.yaml

@@ -128,6 +128,7 @@ worker:
           modules:
             - name: iscsi_tcp
             - name: dm_multipath
+            - name: dm_round_robin
 
         kubelet:
           extraMounts:
@@ -148,29 +149,30 @@ worker:
         sysctls:
           net.ipv4.conf.all.arp_announce: "2"
           net.ipv4.conf.all.arp_ignore: "1"
-        # files:
-        #   - content: |
-        #       defaults {
-        #           polling_interval 10
-        #       }
-        #       devices {
-        #           device {
-        #               vendor "PURE"
-        #               product "FlashArray"
-        #               path_selector "queue-length 0"
-        #               path_grouping_policy group_by_prio
-        #               prio alua
-        #               path_checker tur
-        #               fast_io_fail_tmo 10
-        #               user_friendly_names no
-        #               no_path_retry 0
-        #               hardware_handler "1 alua"
-        #               dev_loss_tmo 600
-        #               failback immediate
-        #           }
-        #       }
-        #     path: /etc/multipath.conf
-        #     op: create
+        
+        files:
+          - content: |
+              defaults {
+                  polling_interval 10
+              }
+              devices {
+                  device {
+                      vendor "PURE"
+                      product "FlashArray"
+                      path_selector "queue-length 0"
+                      path_grouping_policy group_by_prio
+                      prio alua
+                      path_checker tur
+                      fast_io_fail_tmo 10
+                      user_friendly_names no
+                      no_path_retry 0
+                      hardware_handler "1 alua"
+                      dev_loss_tmo 600
+                      failback immediate
+                  }
+              }
+            path: /etc/multipath.conf
+            op: create
 
 # ─── Nodes ───────────────────────────────────────────────────────────────────
 nodes: