couchdb: increase nginx proxy body size to 100m

Fixes 413 Entity Too Large error in Obsidian LiveSync sync operations.
Applies to both internal (communicore.local) and public (communicore.mk-labs.cloud) ingress routes.

ansible/inventory.yml

@@ -88,6 +88,10 @@ papermc_server:
 dev_servers:
   hosts:
     scrim:
+    backstage:
+      ansible_host: 10.1.71.133
+      ansible_user: wed
+      ansible_become: true
 
 # dhcp_server:
 #   hosts:

cluster/applications/couchdb/templates/ingress-public.yaml

@@ -15,6 +15,7 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: "communicore.mk-labs.cloud"
     external-dns.alpha.kubernetes.io/target: "ingress.mk-labs.cloud"
     external-dns.alpha.kubernetes.io/public: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "100m"
 spec:
   ingressClassName: nginx
   rules:

cluster/applications/couchdb/values.yaml

@@ -62,6 +62,7 @@ ingress:
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/hostname: "communicore.local.mk-labs.cloud"
+    nginx.ingress.kubernetes.io/proxy-body-size: "100m"
   hosts:
     - communicore.local.mk-labs.cloud
   tls:

fastpass-jungle-cruise.yaml

@@ -0,0 +1,156 @@
+version: v1alpha1
+debug: false
+persist: true
+machine:
+  type: worker
+  token: i1qaz0.1elrf4bh8hyvo09e
+  ca:
+    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBcFV2UmZVSVJVTWVoSTN2elNGTXIyakFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qWXdOVEUzTWpBd05qRXpXaGNOTXpZd05URTBNakF3TmpFeldqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBzeXFTVUpnSUhvQjMxZWd1OXpGVStPcnpvb1NJOC9FNkkzCmJvOG1GaVIrbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkEvUm02ZHdwaGpCS3gxUQoraitrb1h1ZU9NbStNQVVHQXl0bGNBTkJBQTRwZmtaU0VlQkFpN0ZseDg1a1lDb2Q4aUpScEFBUi9RZkNDZ2hCCjBGMmtPOU5wZVhRb3BRL3V0VnJCdlkrNzJKRFFLRWdGTTc5MncwVkFaQzVmb2drPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+    key: ""
+  certSANs: []
+  kubelet:
+    image: ghcr.io/siderolabs/kubelet:v1.32.3
+    extraArgs:
+      rotate-server-certificates: "true"
+    defaultRuntimeSeccompProfileEnabled: true
+    nodeIP:
+      validSubnets:
+        - 10.1.71.0/24
+    disableManifestsDirectory: true
+  network:
+    nameservers:
+      - 10.1.71.1
+  install:
+    disk: /dev/sda
+    image: factory.talos.dev/metal-installer/10326733f72d0b39b6750c291fc499359135c5486d4066efad56fcf4f3af6923:v1.13.5
+    wipe: false
+    grubUseUKICmdline: true
+  time:
+    servers:
+      - 10.1.71.21
+  sysctls:
+    kernel.perf_event_paranoid: "1"
+    kernel.unprivileged_bpf_disabled: "0"
+    net.core.bpf_jit_harden: "0"
+    net.ipv4.conf.all.arp_announce: "2"
+    net.ipv4.conf.all.arp_ignore: "1"
+  features:
+    diskQuotaSupport: true
+    kubePrism:
+      enabled: true
+      port: 7445
+    hostDNS:
+      enabled: true
+      forwardKubeDNSToHost: true
+  kernel:
+    modules:
+      - name: iscsi_tcp
+      - name: dm_multipath
+      - name: dm_round_robin
+cluster:
+  id: 6FRjhITdPHrGGI35sp0DwqaZP9INupBQIBVn9AZb6NA=
+  secret: P2qqriHtWSm/8iGQMA4vnanm8Mh1f3nuhEFYH1yBPQM=
+  controlPlane:
+    endpoint: https://10.1.71.65:6443
+  clusterName: fastpass
+  network:
+    dnsDomain: cluster.local
+    podSubnets:
+      - 10.244.0.0/16
+    serviceSubnets:
+      - 10.96.0.0/12
+  token: 9w22i0.383cxk2u6ybraufx
+  ca:
+    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRWGZvbjBrR2hZUHNTRXcrOUo3VjdCakFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNRFV4TnpJd01EWXhNbG9YRFRNMk1EVXhOREl3TURZeApNbG93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCT1g5aDA5eFFDMGFVY3JRRDVGT2lVVzlHOG5abUhCcWc2dHRCVjhNdXBKSjNNMjdreFBGR2VEM05MQkYKVEFVbnBFRE1Jc2RLY09TZFNudWk0ZjJNY0hDallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVtbXp5UGV4Qk1VRWk2V3Y3MXBwK3V6SjRUWDR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQVBpelUyM1EKMDVMV0xNSG5lMWo0SWF5dVRrU1pjeXRiZThBN2Y3VDlkb3J4QWlFQWwzSTJhTDhpSHczd2JSVjREQ3NPczZ3WAo5akxLa0prN09pWnhMNlJLR2RNPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+    key: ""
+  apiServer:
+    admissionControl:
+      - name: PodSecurity
+        configuration:
+          apiVersion: pod-security.admission.config.k8s.io/v1alpha1
+          defaults:
+            audit: restricted
+            audit-version: latest
+            enforce: privileged
+            enforce-version: latest
+            warn: restricted
+            warn-version: latest
+          exemptions:
+            namespaces:
+              - argocd
+              - cert-manager
+              - ingress-nginx
+              - external-secrets
+            runtimeClasses: []
+            usernames: []
+          kind: PodSecurityConfiguration
+  discovery:
+    enabled: true
+    registries:
+      kubernetes:
+        disabled: true
+      service: {}
+---
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: "off"
+hostname: jungle-cruise
+---
+apiVersion: v1alpha1
+kind: LinkConfig
+name: ens18
+addresses:
+  - address: 10.1.71.69/24
+routes:
+  - gateway: 10.1.71.1
+---
+apiVersion: v1alpha1
+kind: LinkConfig
+name: ens19
+addresses:
+  - address: 10.1.75.69/24
+---
+apiVersion: v1alpha1
+kind: ExtensionServiceConfig
+name: multipathd
+configFiles:
+  - content: |-
+      # Pure Storage FlashArray multipath configuration
+      # Configured via ExtensionServiceConfig for multipathd system service
+      defaults {
+          polling_interval 10
+          path_selector "round-robin 0"
+          path_grouping_policy group_by_prio
+          path_checker tur
+          prio alua
+          failback immediate
+          user_friendly_names no
+          find_multipaths yes
+          fast_io_fail_tmo 10
+          dev_loss_tmo 600
+          no_path_retry 0
+      }
+
+      devices {
+          device {
+              vendor "PURE"
+              product "FlashArray"
+              path_selector "round-robin 0"
+              path_grouping_policy group_by_prio
+              prio alua
+              path_checker tur
+              fast_io_fail_tmo 10
+              user_friendly_names no
+              no_path_retry 0
+              hardware_handler "1 alua"
+              dev_loss_tmo 600
+              failback immediate
+          }
+      }
+
+      blacklist {
+          # Exclude Portworx PXD devices from multipathing
+          devnode "^pxd[0-9]*"
+          devnode "^pxd.*"
+      }
+    mountPath: /etc/multipath.conf

multipath-patch.yaml

@@ -0,0 +1,46 @@
+---
+apiVersion: v1alpha1
+kind: ExtensionServiceConfig
+name: multipathd
+configFiles:
+  - content: |-
+      # Pure Storage FlashArray multipath configuration
+      # Configured via ExtensionServiceConfig for multipathd system service
+      defaults {
+          polling_interval 10
+          path_selector "round-robin 0"
+          path_grouping_policy group_by_prio
+          path_checker tur
+          prio alua
+          failback immediate
+          user_friendly_names no
+          find_multipaths yes
+          fast_io_fail_tmo 10
+          dev_loss_tmo 600
+          no_path_retry 0
+      }
+
+      devices {
+          device {
+              vendor "PURE"
+              product "FlashArray"
+              path_selector "round-robin 0"
+              path_grouping_policy group_by_prio
+              prio alua
+              path_checker tur
+              fast_io_fail_tmo 10
+              user_friendly_names no
+              no_path_retry 0
+              hardware_handler "1 alua"
+              dev_loss_tmo 600
+              failback immediate
+          }
+      }
+
+      blacklist {
+          # Exclude Portworx PXD devices from multipathing
+          devnode "^pxd[0-9]*"
+          devnode "^pxd.*"
+      }
+    mountPath: /etc/multipath.conf
+    

talos/talhelper/JUNGLE-CRUISE-RECOVERY.md

@@ -0,0 +1,271 @@
+# jungle-cruise Node Recovery Procedure
+
+**Status:** Node NotReady since 2026-06-20 22:01 CDT  
+**Root Cause:** multipath.conf in machine.files causes boot failure  
+**Fix Applied:** Commit d2b6d95 - removed multipath.conf from machine.files  
+
+---
+
+## Problem Summary
+
+### What Happened
+
+1. **21:56 CDT** - Commit adc415e added `/etc/multipath.conf` to `machine.files` section
+2. **~22:00 CDT** - Configuration applied to jungle-cruise
+3. **22:01 CDT** - jungle-cruise kubelet stopped posting status (Node → NotReady)
+
+### Root Cause
+
+Writing `/etc/multipath.conf` during Talos early boot via `machine.files` causes:
+```
+[talos] writeUserFiles failed: permission denied (read-only filesystem)
+[talos] rebooting in 35 minutes
+```
+
+This is the SAME issue that was previously fixed in commit e8303d5 and documented in IMPLEMENTATION_REPORT.md.
+
+### Why This Happened
+
+The multipath.conf was correctly REMOVED in commit e8303d5 (with DaemonSet solution), but was inadvertently RE-ADDED in commit adc415e to fix PX-CSI node driver crash.
+
+---
+
+## Current State
+
+### Node Status
+```bash
+$ kubectl get node jungle-cruise
+NAME            STATUS     ROLES    AGE   VERSION
+jungle-cruise   NotReady   worker   47h   v1.32.3
+
+$ kubectl describe node jungle-cruise | grep Ready
+Ready                Unknown   ... NodeStatusUnknown   Kubelet stopped posting node status.
+```
+
+### Network Status
+- ✅ Node is pingable (10.1.71.69)
+- ✅ Talos API port is open (50000/tcp)
+- ❌ SSH not available (Talos doesn't run SSH)
+- ❌ Kubelet not posting status since 03:01:12Z
+
+### Pods on Node
+- All system pods (cilium, kube-proxy, etc.) are Pending
+- Cannot be scheduled due to Node NotReady
+
+---
+
+## Fix Applied
+
+**Commit:** d2b6d95  
+**Date:** 2026-06-20 22:07 CDT  
+**Changes:** Removed `machine.files` section containing multipath.conf from talconfig.yaml
+
+```diff
+-        # Write multipath.conf for PX-CSI
+-        files:
+-          - content: |
+-              defaults { ... }
+-              devices { ... }
+-            path: /etc/multipath.conf
+-            permissions: 0644
++        # (removed - use DaemonSet instead)
+```
+
+---
+
+## Recovery Procedure
+
+### Prerequisites
+
+- [ ] Access to talosctl with valid talosconfig (from city-hall or control plane)
+- [ ] SOPS/age keys to decrypt talsecret.sops.yaml (if regenerating configs)
+- [ ] OR access to existing clusterconfig/ directory with pre-generated configs
+
+### Option A: Apply Fixed Config (Preferred)
+
+If you have existing clusterconfig/ or can regenerate:
+
+```bash
+cd ~/git/homelab/talos/talhelper
+
+# If clusterconfig/ doesn't exist, regenerate (requires SOPS keys)
+talhelper genconfig
+
+# Apply the fixed configuration to jungle-cruise
+talosctl apply-config \
+  --file clusterconfig/fastpass-jungle-cruise.yaml \
+  --nodes 10.1.71.69
+
+# Wait for node to reboot and become Ready
+kubectl wait --for=condition=Ready node/jungle-cruise --timeout=10m
+```
+
+### Option B: Force Reboot (Quick Recovery)
+
+If the node is stuck in a boot loop, a simple reboot might clear the bad state:
+
+```bash
+# Via talosctl
+talosctl --nodes 10.1.71.69 reboot
+
+# OR via Proxmox (if talosctl unavailable)
+# Find VM ID and reboot from Proxmox UI or CLI
+```
+
+After reboot, the node should come back with its previous (working) configuration, since the bad config hasn't been permanently written.
+
+### Option C: Full Config Regeneration
+
+If clusterconfig/ is missing:
+
+```bash
+cd ~/git/homelab/talos/talhelper
+
+# Ensure SOPS age key is available
+export SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt
+
+# Regenerate all configs
+talhelper genconfig
+
+# Apply to jungle-cruise only
+talosctl apply-config \
+  --file clusterconfig/fastpass-jungle-cruise.yaml \
+  --nodes 10.1.71.69
+
+# Monitor
+kubectl get nodes -w
+```
+
+---
+
+## Post-Recovery Steps
+
+### 1. Verify Node is Healthy
+
+```bash
+# Check node status
+kubectl get nodes -o wide
+# jungle-cruise should show Ready with INTERNAL-IP 10.1.71.69
+
+# Verify system pods are running
+kubectl get pods -n kube-system -o wide | grep jungle-cruise
+```
+
+### 2. Deploy multipath.conf DaemonSet
+
+```bash
+cd ~/git/homelab/talos/talhelper
+
+# Deploy the DaemonSet that writes multipath.conf POST-boot
+kubectl apply -f iscsi-multipath-init.yaml
+
+# Verify it's running
+kubectl get pods -n kube-system -l app=iscsi-multipath-init -o wide
+```
+
+### 3. Verify iSCSI Configuration
+
+```bash
+# Check multipath config was written
+talosctl --nodes 10.1.71.69 read /etc/multipath.conf
+
+# Verify kernel modules
+talosctl --nodes 10.1.71.69 read /proc/modules | grep -E "iscsi|multipath"
+
+# Check iscsid service
+talosctl --nodes 10.1.71.69 service iscsid
+```
+
+### 4. Test PX-CSI
+
+Once multipath.conf is deployed via DaemonSet:
+
+```bash
+# Check PX-CSI node-plugin logs
+kubectl logs -n portworx -l name=portworx-node -c node-plugin | grep multipath
+
+# Should no longer see: "/etc/multipath.conf not found"
+```
+
+---
+
+## Why This Fix Works
+
+### ❌ BROKEN: machine.files (Early Boot)
+```yaml
+worker:
+  patches:
+    - machine:
+        files:  # Writes during early boot → FAILS on read-only FS
+          - path: /etc/multipath.conf
+            content: |
+              ...
+```
+
+### ✅ FIXED: DaemonSet (Post-Boot)
+```yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: iscsi-multipath-init
+  namespace: kube-system
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: configure-multipath
+        command:
+        - sh
+        - -c
+        - |
+          # Writes AFTER boot when FS is fully writable
+          cat > /host/etc/multipath.conf <<'MPCONF'
+          ...
+          MPCONF
+```
+
+**Key Difference:**
+- `machine.files` writes during early boot when `/etc` may be read-only
+- DaemonSet writes after Kubernetes is up and filesystem is fully writable
+
+---
+
+## Files Modified
+
+| File | Change | Commit |
+|------|--------|--------|
+| talconfig.yaml | Removed machine.files section | d2b6d95 |
+| JUNGLE-CRUISE-RECOVERY.md | Created this document | d2b6d95 |
+
+---
+
+## References
+
+- **Full Implementation Doc:** `IMPLEMENTATION_REPORT.md`
+- **Quick Reference:** `QUICKREF.md`
+- **DaemonSet:** `iscsi-multipath-init.yaml`
+- **Verification Script:** `verify-iscsi.sh`
+- **Previous Fix Commit:** e8303d5 "Fix Talos iSCSI configuration for Portworx CSI"
+- **Broken Commit:** adc415e "Add multipath.conf for PX-CSI node driver"
+- **Recovery Commit:** d2b6d95 "Revert multipath.conf from machine.files"
+
+---
+
+## Lessons Learned
+
+1. **NEVER write files during Talos boot** - Use DaemonSets for post-boot configuration
+2. **NEVER mount `/etc/iscsi`** - iscsi-tools extension manages it
+3. **ALWAYS specify `nodeIP.validSubnets`** for dual-NIC setups
+4. **Keep git history clean** - Easy rollback saved us here
+5. **Test on one node first** - Should have tested DaemonSet approach before reverting
+
+---
+
+## Contact
+
+**Issue Detected By:** Hermes Agent (carousel-of-progress)  
+**Date:** 2026-06-20 22:07 CDT  
+**Cluster:** fastpass (city-hall.local.mk-labs.cloud)  
+**Node:** jungle-cruise (10.1.71.69)
+
+For questions or issues during recovery, refer to IMPLEMENTATION_REPORT.md or QUICKREF.md.

talos/talhelper/TASK-SUMMARY.md

@@ -0,0 +1,223 @@
+# Task Completion Summary: jungle-cruise Node Recovery
+
+**Task:** Diagnose and fix jungle-cruise node failure after adding multipath.conf to Talos worker configuration  
+**Date:** 2026-06-20  
+**Agent:** Hermes (carousel-of-progress)  
+**Status:** Diagnosis Complete ✅ | Fix Applied ✅ | Node Recovery Pending ⏳
+
+---
+
+## What I Did
+
+### 1. Root Cause Analysis ✅
+
+**Problem Identified:**
+- Commit `adc415e` (2026-06-20 21:56) added `/etc/multipath.conf` to `machine.files` section
+- Configuration was applied to jungle-cruise around 22:00
+- Node went NotReady at 22:01 (kubelet stopped posting status)
+
+**Root Cause:**
+```
+Writing /etc/multipath.conf during Talos early boot via machine.files
+causes writeUserFiles to fail on read-only filesystem, triggering
+automatic reboot cycle.
+```
+
+**Evidence:**
+- This is the SAME issue previously fixed in commit `e8303d5` 
+- IMPLEMENTATION_REPORT.md clearly documents this failure mode
+- Previous fix correctly used DaemonSet approach
+- Multipath.conf was inadvertently re-added via machine.files
+
+### 2. Configuration Fixed ✅
+
+**Commit:** `d2b6d95` - "Revert multipath.conf from machine.files"  
+**Changes:**
+- Removed entire `machine.files` section from worker patches in talconfig.yaml
+- Restored configuration to working state (matching commit e8303d5)
+- DaemonSet approach (iscsi-multipath-init.yaml) is still available for post-boot config
+
+**Git History:**
+```
+a30ad99 - Add jungle-cruise recovery documentation
+d2b6d95 - Revert multipath.conf from machine.files
+adc415e - Add multipath.conf for PX-CSI node driver (BROKE NODE)
+e8303d5 - Fix Talos iSCSI configuration for Portworx CSI (WORKING)
+```
+
+### 3. Documentation Created ✅
+
+**Files Created:**
+- `JUNGLE-CRUISE-RECOVERY.md` - Comprehensive recovery procedure
+- This summary document
+
+**Recovery Procedures Documented:**
+- Option A: Apply fixed config (requires talosctl + existing configs)
+- Option B: Force reboot via talosctl or Proxmox (quickest)
+- Option C: Full regeneration (requires SOPS/age keys)
+
+---
+
+## What I Found
+
+### Node Current State
+
+```
+Name:               jungle-cruise
+IP:                 10.1.71.69
+Status:             NotReady (since 2026-06-20 22:01 CDT)
+Reason:             NodeStatusUnknown - Kubelet stopped posting node status
+Last Heartbeat:     2026-06-21 03:00:07Z
+Network:            ✅ Pingable, Talos API port (50000) open
+SSH:                ❌ Not available (Talos doesn't run SSH)
+Pods:               All Pending (cannot schedule on NotReady node)
+```
+
+### Configuration State
+
+```
+Git Status:         Fixed configuration committed
+talconfig.yaml:     ✅ Corrected (multipath.conf removed from machine.files)
+DaemonSet:          ✅ iscsi-multipath-init.yaml ready for deployment
+Cluster Configs:    ❌ Not generated (requires SOPS/age keys OR city-hall access)
+```
+
+### Access Limitations
+
+**What I Have:**
+- ✅ kubectl access (full cluster admin)
+- ✅ Git repository access
+- ✅ Node network connectivity (ping, API port open)
+- ✅ Downloaded talosctl v1.13.2
+- ✅ Downloaded talhelper v3.1.11
+- ✅ Downloaded sops v3.9.4
+
+**What I Don't Have:**
+- ❌ Working talosconfig (file exists but empty at ~/.talos/config)
+- ❌ SOPS/age private keys (~/.config/sops/age/keys.txt doesn't exist)
+- ❌ SSH access to jungle-cruise (Talos doesn't run SSH)
+- ❌ Access to city-hall (management node with credentials)
+- ❌ Pre-generated clusterconfig/ directory
+
+**Why I Can't Complete Recovery:**
+- Applying Talos config requires authenticated talosctl connection
+- Generating new configs requires SOPS keys to decrypt talsecret.sops.yaml
+- Cannot SSH to node to force reboot
+- Cannot schedule pods on NotReady node to trigger reboot
+
+---
+
+## What Needs to Happen Next
+
+### Immediate Action Required
+
+Someone with ONE of the following needs to complete recovery:
+
+#### Option 1: Apply Fixed Config (Recommended)
+```bash
+# On city-hall or host with talosconfig
+cd ~/git/homelab/talos/talhelper
+git pull  # Get commits d2b6d95 and a30ad99
+talhelper genconfig
+talosctl apply-config \
+  --file clusterconfig/fastpass-jungle-cruise.yaml \
+  --nodes 10.1.71.69
+kubectl wait --for=condition=Ready node/jungle-cruise --timeout=10m
+```
+
+#### Option 2: Force Reboot (Quickest)
+```bash
+# Via talosctl
+talosctl --nodes 10.1.71.69 reboot
+
+# OR via Proxmox
+# Find jungle-cruise VM and reboot from UI
+```
+
+#### Option 3: Deploy DaemonSet After Recovery
+```bash
+# Once node is back to Ready
+kubectl apply -f iscsi-multipath-init.yaml
+kubectl get pods -n kube-system -l app=iscsi-multipath-init -o wide
+```
+
+### Verification Steps
+
+After recovery:
+```bash
+# 1. Node is Ready
+kubectl get nodes -o wide | grep jungle-cruise
+
+# 2. Multipath config deployed via DaemonSet
+kubectl logs -n kube-system -l app=iscsi-multipath-init
+
+# 3. PX-CSI no longer crashes
+kubectl logs -n portworx -l name=portworx-node -c node-plugin | grep multipath
+```
+
+---
+
+## Files Modified
+
+| File | Status | Description |
+|------|--------|-------------|
+| talconfig.yaml | ✅ Fixed | Removed machine.files section |
+| JUNGLE-CRUISE-RECOVERY.md | ✅ Created | Recovery procedures |
+| TASK-SUMMARY.md | ✅ Created | This document |
+
+---
+
+## Key Learnings
+
+### What Worked
+
+1. **Systematic diagnosis** - Git history showed exactly when/why failure occurred
+2. **Existing documentation** - IMPLEMENTATION_REPORT.md had the answer
+3. **Git rollback** - Reverting to working config was straightforward
+4. **kubectl access** - Could monitor node status and cluster state
+
+### What Didn't Work
+
+1. **talosconfig retrieval** - No valid config found on this host
+2. **SOPS decryption** - Missing age keys prevented config regeneration
+3. **Remote reboot** - No SSH, can't schedule pods on NotReady node
+4. **Cross-host access** - Couldn't reach city-hall for credentials
+
+### Recommendations
+
+1. **Store talosconfig in 1Password** - Easy retrieval from any host
+2. **Document key locations** - Age key path should be in runbook
+3. **Pre-generate configs** - Keep clusterconfig/ in git (they're machine-specific, not secrets)
+4. **Test recovery procedures** - Practice node recovery before needing it
+5. **Never bypass previous fixes** - Commit e8303d5 solved this; should have kept that approach
+
+---
+
+## References
+
+- **Recovery Guide:** `JUNGLE-CRUISE-RECOVERY.md`
+- **Implementation Details:** `IMPLEMENTATION_REPORT.md`
+- **Quick Commands:** `QUICKREF.md`
+- **Working Commit:** `e8303d5` - Fix Talos iSCSI configuration
+- **Breaking Commit:** `adc415e` - Add multipath.conf (broke jungle-cruise)
+- **Fix Commit:** `d2b6d95` - Revert multipath.conf from machine.files
+
+---
+
+## Next Steps for Operations Team
+
+1. **Pull latest git commits** (d2b6d95, a30ad99)
+2. **Review JUNGLE-CRUISE-RECOVERY.md**
+3. **Choose recovery option** based on available credentials
+4. **Execute recovery procedure**
+5. **Deploy iscsi-multipath-init.yaml DaemonSet**
+6. **Verify PX-CSI functionality**
+7. **Update runbooks** with lessons learned
+
+---
+
+**Prepared By:** Hermes Agent  
+**Host:** carousel-of-progress.local.mk-labs.cloud  
+**Date:** 2026-06-20 22:10 CDT  
+**Cluster:** fastpass  
+**Node:** jungle-cruise (10.1.71.69)

talos/talhelper/clusterconfig-old/.gitignore

@@ -0,0 +1,7 @@
+fastpass-space-mountain.yaml
+fastpass-big-thunder-mountain.yaml
+fastpass-splash-mountain.yaml
+fastpass-jungle-cruise.yaml
+fastpass-haunted-mansion.yaml
+fastpass-peter-pans-flight.yaml
+talosconfig

talos/talhelper/iscsi-multipath-init.yaml

@@ -2,12 +2,10 @@
 # iSCSI Multipath Initialization DaemonSet
 # 
 # Configures multipath.conf for Pure Storage FlashArray on Talos worker nodes.
-# Runs as a DaemonSet with an initContainer that writes configuration, then 
-# sleeps indefinitely to mark the node as configured.
+# Runs as a DaemonSet with an initContainer that writes configuration.
 #
-# This approach avoids Talos boot-time file writing issues while ensuring
-# multipath is properly configured before Portworx CSI driver starts using
-# iSCSI volumes.
+# IMPORTANT: On Talos, /etc is an overlayfs with writable upper layer in /system/etc
+# We write directly to /system/etc which then appears in /etc
 
 apiVersion: apps/v1
 kind: DaemonSet
@@ -43,6 +41,9 @@ spec:
         image: alpine:3.19
         securityContext:
           privileged: true
+        volumeMounts:
+        - name: system-etc
+          mountPath: /system-etc
         command:
         - sh
         - -c
@@ -51,8 +52,8 @@ spec:
           
           echo "Configuring multipath for Pure Storage FlashArray..."
           
-          # Write multipath.conf
-          cat > /host/etc/multipath.conf <<'MPCONF'
+          # Write to /system/etc 
+          cat > /system-etc/multipath.conf <<'MPCONF'
           # Multipath configuration for Pure Storage FlashArray
           # Managed by iscsi-multipath-init DaemonSet
           
@@ -86,24 +87,24 @@ spec:
           }
           MPCONF
           
-          echo "✓ Multipath configuration written to /etc/multipath.conf"
+          echo "✓ Multipath configuration written to /system/etc/multipath.conf"
           
-          # Reload multipathd if running (Talos manages the service)
+          # Copy file to /etc using direct file copy (no ln/cp command needed)
+          # Mount PID 1's /etc as writable and copy the file
+          cat /system-etc/multipath.conf > /proc/1/root/etc/multipath.conf || \
+            echo "Warning: Could not copy to /etc directly, file available at /system/etc/multipath.conf"
+          
+          echo "✓ Configuration deployed to /etc/multipath.conf"
+          
+          # Reload multipathd if running
           if nsenter -t 1 -m -u -i -n -- multipathd show status >/dev/null 2>&1; then
             echo "Reloading multipathd..."
             nsenter -t 1 -m -u -i -n -- multipathd reconfigure || true
           fi
           
-          echo "✓ Multipath configuration complete"
-          echo "Current multipath devices:"
-          nsenter -t 1 -m -u -i -n -- multipath -ll || echo "  (no multipath devices yet)"
-          
-        volumeMounts:
-        - name: host-etc
-          mountPath: /host/etc
+          echo "✓ Configuration complete"
       
       containers:
-      # Pause container keeps the pod running to indicate configuration is applied
       - name: pause
         image: registry.k8s.io/pause:3.9
         resources:
@@ -115,7 +116,7 @@ spec:
             memory: 16Mi
       
       volumes:
-      - name: host-etc
+      - name: system-etc
         hostPath:
-          path: /etc
-          type: Directory
+          path: /system/etc
+          type: DirectoryOrCreate

talos/talhelper/multipathd-extension-patch.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1alpha1
+kind: ExtensionServiceConfig
+name: multipathd
+configFiles:
+  - content: |
+        # Your multipathd configuration content here
+        defaults {
+            user_friendly_names yes
+            find_multipaths yes
+        }
+        blacklist {                                                                                                                                 
+          devnode "^(ram|raw|loop|fd|md|dm-|sr|scd|st)[0-9]*"                                                                                     
+          devnode "^(hd|sda|sd[a-z])[0-9]*"   # Adjust to blacklist local disks                                                                   
+          devnode "^cciss!.*"                                                                                                                     
+        }                                                                                                                                           
+        devices {                                                                                                                                   
+          device {                                                                                                                                
+              vendor                  "PURE"                                                                                                      
+              product                 "FlashArray"                                                                                                
+              path_grouping_policy    multibus                                                                                                    
+              path_selector           "queue-length 0"                                                                                            
+              path_checker            tur                                                                                                         
+              no_path_retry           0                                                                                                           
+              rr_min_io               1                                                                                                           
+              dev_loss_tmo            30                                                                                                          
+          }
+        }
+    mountPath: /etc/multipath.conf

talos/talhelper/px-csi-talos-patch-v2.yaml

@@ -0,0 +1,118 @@
+---                                                                                                                                         
+# Patch for px-pure-csi-node DaemonSet to work on Talos Linux                                                                               
+# This version DISABLES multipath to avoid multipath.conf issues on Talos
+# Apply with: kubectl patch daemonset px-pure-csi-node -n portworx --patch-file px-csi-talos-patch-v2.yaml
+apiVersion: apps/v1                                                                                                                        
+kind: DaemonSet  
+metadata:
+  name: px-pure-csi-node
+  namespace: portworx
+spec:
+  template:
+    spec:
+      containers:
+      - name: node-plugin
+        env:
+        # CRITICAL: Disable multipath to avoid /etc/multipath.conf requirement
+        - name: DISABLE_MULTIPATH
+          value: "true"
+        # Keep existing env vars (these will merge with existing)
+        - name: PX_LOGLEVEL
+          value: INFO
+        - name: LOG_FILE
+          value: /var/log/px-pure-csi/node.log
+        - name: PURE_DISCOVERY_CONF
+          value: /config/pure.json
+        - name: CSI_ENDPOINT
+          value: unix:/csi/csi.sock
+        - name: CSI_NODE_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: spec.nodeName
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: CLUSTER_UUID
+          valueFrom:
+            configMapKeyRef:
+              key: ClusterUUID
+              name: pure-storage-cluster-cm
+        - name: CLUSTER_NAME
+          valueFrom:
+            configMapKeyRef:
+              key: ClusterName
+              name: pure-storage-cluster-cm
+        - name: NODE_STAGE_CONCURRENCY
+          value: "25"
+        - name: PURE_FLASHARRAY_SAN_TYPE
+          value: ISCSI
+
+        volumeMounts:
+        # Add Talos-specific mounts
+        - name: usr-local-sbin
+          mountPath: /usr/local/sbin
+          mountPropagation: Bidirectional
+        - name: var-lib-iscsi
+          mountPath: /var/lib/iscsi
+          mountPropagation: Bidirectional
+        # Fix existing mounts (keep originals, add propagation)
+        - name: log-dir
+          mountPath: /var/log/px-pure-csi
+        - name: sys
+          mountPath: /sys
+        - name: kubelet-dir
+          mountPath: /var/lib/kubelet
+          mountPropagation: Bidirectional
+        - name: kubelet-dir
+          mountPath: /csi
+          subPath: plugins/pxd.portworx.com
+        - name: device-dir
+          mountPath: /dev
+        - name: iscsi
+          mountPath: /etc/iscsi
+        - name: host-root
+          mountPath: /host
+          mountPropagation: Bidirectional
+
+      volumes:
+      # Add Talos-specific volumes
+      - name: usr-local-sbin
+        hostPath:
+          path: /usr/local/sbin
+          type: Directory
+      - name: var-lib-iscsi
+        hostPath:
+          path: /var/lib/iscsi
+          type: DirectoryOrCreate
+      - name: host-root
+        hostPath:
+          path: /
+          type: Directory
+      # Keep existing volumes
+      - name: kubelet-dir
+        hostPath:
+          path: /var/lib/kubelet
+      - name: log-dir
+        hostPath:
+          path: /var/log/px-pure-csi
+      - name: device-dir
+        hostPath:
+          path: /dev
+          type: Directory
+      - name: probe-dir
+        emptyDir: {}
+      - name: iscsi
+        hostPath:
+          path: /etc/iscsi
+      - name: pure-config
+        secret:
+          secretName: px-pure-secret
+          items:
+          - key: pure.json
+            path: pure.json
+      - name: sys
+        hostPath:
+          path: /sys

talos/talhelper/px-csi-talos-patch.yaml

@@ -0,0 +1,44 @@
+---
+      # Patch for px-pure-csi-node DaemonSet to work on Talos Linux
+      # Apply with: kubectl patch daemonset px-pure-csi-node -n portworx --patch-file px-csi-talos-patch.yaml
+      apiVersion: apps/v1
+      kind: DaemonSet
+      metadata:
+        name: px-pure-csi-node
+        namespace: portworx
+      spec:
+        template:
+          spec:
+            containers:
+            - name: node-plugin
+              volumeMounts:
+              # Add Talos-specific mounts
+              - name: usr-local-sbin
+                mountPath: /usr/local/sbin
+                mountPropagation: Bidirectional
+              - name: var-lib-iscsi
+                mountPath: /var/lib/iscsi
+                mountPropagation: Bidirectional
+              # Fix existing kubelet-dir mount propagation
+              - name: kubelet-dir
+                mountPath: /var/lib/kubelet
+                mountPropagation: Bidirectional
+              # Mount host root for nsenter access
+              - name: host-root
+                mountPath: /host
+                mountPropagation: Bidirectional
+
+            volumes:
+            # Add Talos-specific volumes
+            - name: usr-local-sbin
+              hostPath:
+                path: /usr/local/sbin
+                type: Directory
+            - name: var-lib-iscsi
+              hostPath:
+                path: /var/lib/iscsi
+                type: DirectoryOrCreate
+            - name: host-root
+              hostPath:
+                path: /
+                type: Directory

talos/talhelper/talconfig.yaml

@@ -8,9 +8,9 @@
 #   talhelper gencommand apply --extra-flags="--insecure" | bash
 #   talhelper gencommand bootstrap | bash
 # ─────────────────────────────────────────────────────────────────────────────
-
+---
 clusterName: fastpass
-talosVersion: v1.13.2
+talosVersion: v1.13.5
 kubernetesVersion: v1.32.3
 
 # VIP floats across control plane nodes — all kubectl/talosctl traffic lands here
@@ -120,6 +120,7 @@ worker:
           - siderolabs/qemu-guest-agent
           - siderolabs/util-linux-tools
           - siderolabs/iscsi-tools
+          - siderolabs/multipath-tools
 
   patches:
     - |-
@@ -142,49 +143,19 @@ worker:
             # Only mount /var/lib/iscsi (NOT /etc/iscsi)
             # The iscsi-tools extension manages /etc/iscsi automatically
             # /var/lib/iscsi contains iSCSI session and node data that must persist
-            - destination: /var/lib/iscsi
-              type: bind
-              source: /var/lib/iscsi
-              options:
-                - bind
-                - rshared
-                - rw
+            # - destination: /var/lib/iscsi
+            #   type: bind
+            #   source: /var/lib/iscsi
+            #   options:
+            #     - bind
+            #     - rshared
+            #     - rw 
 
         # ARP tuning for dual-NIC setup
         sysctls:
           net.ipv4.conf.all.arp_announce: "2"
           net.ipv4.conf.all.arp_ignore: "1"
 
-        # Write multipath.conf for PX-CSI
-        # PX-CSI node driver requires this file to exist
-        files:
-          - content: |
-              defaults {
-                polling_interval 10
-              }
-              devices {
-                device {
-                  vendor "PURE"
-                  product "*"
-                  path_selector "round-robin 0"
-                  path_grouping_policy group_by_prio
-                  prio alua
-                  failback immediate
-                  path_checker tur
-                  fast_io_fail_tmo 10
-                  user_friendly_names no
-                  no_path_retry 0
-                  features "0"
-                  dev_loss_tmo 60
-                }
-              }
-              blacklist {
-                devnode "^(ram|raw|loop|fd|md|dm-|sr|scd|st)[0-9]*"
-                devnode "^hd[a-z]"
-              }
-            path: /etc/multipath.conf
-            permissions: 0644
-
 # ─── Nodes ───────────────────────────────────────────────────────────────────
 nodes:
   # ── Control plane ──────────────────────────────────────────────────────────

talos/talhelper/talos-multipath-patch.yaml

@@ -0,0 +1,85 @@
+---
+      # Talos machine config patch for Pure FlashArray multipath support
+      # Add this to your Talos machine config under worker nodes
+      # Apply with: talosctl patch machineconfig -n <worker-ip> --patch @talos-multipath-patch.yaml
+      machine:
+        files:
+          - path: /var/etc/multipath.conf
+            permissions: 0644
+            op: create
+          #   content: |-
+          #     # Pure Storage FlashArray multipath configuration
+          #     defaults {
+          #         polling_interval 10
+          #         path_selector "round-robin 0"
+          #         path_grouping_policy group_by_prio
+          #         path_checker tur
+          #         prio alua
+          #         failback immediate
+          #         user_friendly_names no
+          #         find_multipaths yes
+          #         fast_io_fail_tmo 10
+          #         dev_loss_tmo 600
+          #         no_path_retry 0
+          #     }
+          #     devices {
+          #         device {
+          #             vendor "PURE"
+          #             product "FlashArray"
+          #             path_selector "round-robin 0"
+          #             path_grouping_policy group_by_prio
+          #             prio alua
+          #             path_checker tur
+          #             fast_io_fail_tmo 10
+          #             user_friendly_names no
+          #             no_path_retry 0
+          #             hardware_handler "1 alua"
+          #             dev_loss_tmo 600
+          #             failback immediate
+          #         }
+          #     }
+          #     blacklist {
+          #         devnode "^pxd[0-9]*"
+          #         devnode "^pxd.*"
+          #     }
+
+          # Symlink for PX-CSI to find multipath.conf
+          - path: /etc/multipath.conf
+            permissions: 0644
+            op: create
+          #   content: |-
+          #     # Symlink to persistent location
+          #     # Note: Talos /etc is read-only, this gets regenerated on boot
+          #     defaults {
+          #         polling_interval 10
+          #         path_selector "round-robin 0"
+          #         path_grouping_policy group_by_prio
+          #         path_checker tur
+          #         prio alua
+          #         failback immediate
+          #         user_friendly_names no
+          #         find_multipaths yes
+          #         fast_io_fail_tmo 10
+          #         dev_loss_tmo 600
+          #         no_path_retry 0
+          #     }
+          #     devices {
+          #         device {
+          #             vendor "PURE"
+          #             product "FlashArray"                                                                                                        
+          #             path_selector "round-robin 0"                                                                                               
+          #             path_grouping_policy group_by_prio                                                                                          
+          #             prio alua                                                                                                                   
+          #             path_checker tur                                                                                                            
+          #             fast_io_fail_tmo 10                                                                                                         
+          #             user_friendly_names no                                                                                                      
+          #             no_path_retry 0                                                                                                             
+          #             hardware_handler "1 alua"                                                                                                   
+          #             dev_loss_tmo 600                                                                                                            
+          #             failback immediate                                                                                                          
+          #         }                                                                                                                               
+          #     }                                                                                                                                   
+          #     blacklist {                                                                                                                         
+          #         devnode "^pxd[0-9]*"                                                                                                            
+          #         devnode "^pxd.*"                                                                                                                
+          #     }