---
# iSCSI Multipath Initialization DaemonSet
# 
# Configures multipath.conf for Pure Storage FlashArray on Talos worker nodes.
# Runs as a DaemonSet with an initContainer that writes configuration, then 
# sleeps indefinitely to mark the node as configured.
#
# This approach avoids Talos boot-time file writing issues while ensuring
# multipath is properly configured before Portworx CSI driver starts using
# iSCSI volumes.

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: iscsi-multipath-init
  namespace: kube-system
  labels:
    app: iscsi-multipath-init
    component: storage
spec:
  selector:
    matchLabels:
      app: iscsi-multipath-init
  template:
    metadata:
      labels:
        app: iscsi-multipath-init
        component: storage
    spec:
      hostNetwork: true
      hostPID: true
      
      # Only run on worker nodes with iSCSI storage network
      nodeSelector:
        node-role.kubernetes.io/worker: ""
      
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/control-plane
      
      initContainers:
      - name: configure-multipath
        image: alpine:3.19
        securityContext:
          privileged: true
        command:
        - sh
        - -c
        - |
          set -e
          
          echo "Configuring multipath for Pure Storage FlashArray..."
          
          # Write multipath.conf using nsenter to access host's writable filesystem
          # Talos mounts /etc as read-only in containers, but writable in host namespace
          nsenter -t 1 -m -u -i -n -- sh -c 'cat > /etc/multipath.conf' <<'MPCONF'
          # Multipath configuration for Pure Storage FlashArray
          # Managed by iscsi-multipath-init DaemonSet
          
          defaults {
              polling_interval 10
              find_multipaths yes
              user_friendly_names no
          }
          
          devices {
              device {
                  vendor "PURE"
                  product "FlashArray"
                  path_selector "service-time 0"
                  path_grouping_policy group_by_prio
                  prio alua
                  path_checker tur
                  fast_io_fail_tmo 10
                  user_friendly_names no
                  no_path_retry 0
                  hardware_handler "1 alua"
                  dev_loss_tmo 600
                  failback immediate
              }
          }
          
          # Blacklist Portworx virtual block devices
          blacklist {
              devnode "^pxd[0-9]*"
              devnode "^pxd.*"
          }
          MPCONF
          
          echo "✓ Multipath configuration written to /etc/multipath.conf"
          
          # Reload multipathd if running (Talos manages the service)
          if nsenter -t 1 -m -u -i -n -- multipathd show status >/dev/null 2>&1; then
            echo "Reloading multipathd..."
            nsenter -t 1 -m -u -i -n -- multipathd reconfigure || true
          fi
          
          echo "✓ Multipath configuration complete"
          echo "Current multipath devices:"
          nsenter -t 1 -m -u -i -n -- multipath -ll || echo "  (no multipath devices yet)"
      
      containers:
      # Pause container keeps the pod running to indicate configuration is applied
      - name: pause
        image: registry.k8s.io/pause:3.9
        resources:
          requests:
            cpu: 1m
            memory: 8Mi
          limits:
            cpu: 10m
            memory: 16Mi