002d6799b1
Use nsenter to write multipath.conf in host's mount namespace instead of trying to write to /host/etc which is read-only in containers. Talos mounts /etc as read-only in container namespaces but allows writes in the host mount namespace. This fix uses nsenter to access PID 1's mount namespace where /etc is writable. Also removed unnecessary volumeMounts and volumes since we're using nsenter instead of hostPath mounts. Fixes: Init:Error - 'can't create /host/etc/multipath.conf: Read-only file system'
113 lines
3.4 KiB
YAML
113 lines
3.4 KiB
YAML
---
|
|
# iSCSI Multipath Initialization DaemonSet
|
|
#
|
|
# Configures multipath.conf for Pure Storage FlashArray on Talos worker nodes.
|
|
# Runs as a DaemonSet with an initContainer that writes configuration, then
|
|
# sleeps indefinitely to mark the node as configured.
|
|
#
|
|
# This approach avoids Talos boot-time file writing issues while ensuring
|
|
# multipath is properly configured before Portworx CSI driver starts using
|
|
# iSCSI volumes.
|
|
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: iscsi-multipath-init
|
|
namespace: kube-system
|
|
labels:
|
|
app: iscsi-multipath-init
|
|
component: storage
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: iscsi-multipath-init
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: iscsi-multipath-init
|
|
component: storage
|
|
spec:
|
|
hostNetwork: true
|
|
hostPID: true
|
|
|
|
# Only run on worker nodes with iSCSI storage network
|
|
nodeSelector:
|
|
node-role.kubernetes.io/worker: ""
|
|
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
key: node-role.kubernetes.io/control-plane
|
|
|
|
initContainers:
|
|
- name: configure-multipath
|
|
image: alpine:3.19
|
|
securityContext:
|
|
privileged: true
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
|
|
echo "Configuring multipath for Pure Storage FlashArray..."
|
|
|
|
# Write multipath.conf using nsenter to access host's writable filesystem
|
|
# Talos mounts /etc as read-only in containers, but writable in host namespace
|
|
nsenter -t 1 -m -u -i -n -- sh -c 'cat > /etc/multipath.conf' <<'MPCONF'
|
|
# Multipath configuration for Pure Storage FlashArray
|
|
# Managed by iscsi-multipath-init DaemonSet
|
|
|
|
defaults {
|
|
polling_interval 10
|
|
find_multipaths yes
|
|
user_friendly_names no
|
|
}
|
|
|
|
devices {
|
|
device {
|
|
vendor "PURE"
|
|
product "FlashArray"
|
|
path_selector "service-time 0"
|
|
path_grouping_policy group_by_prio
|
|
prio alua
|
|
path_checker tur
|
|
fast_io_fail_tmo 10
|
|
user_friendly_names no
|
|
no_path_retry 0
|
|
hardware_handler "1 alua"
|
|
dev_loss_tmo 600
|
|
failback immediate
|
|
}
|
|
}
|
|
|
|
# Blacklist Portworx virtual block devices
|
|
blacklist {
|
|
devnode "^pxd[0-9]*"
|
|
devnode "^pxd.*"
|
|
}
|
|
MPCONF
|
|
|
|
echo "✓ Multipath configuration written to /etc/multipath.conf"
|
|
|
|
# Reload multipathd if running (Talos manages the service)
|
|
if nsenter -t 1 -m -u -i -n -- multipathd show status >/dev/null 2>&1; then
|
|
echo "Reloading multipathd..."
|
|
nsenter -t 1 -m -u -i -n -- multipathd reconfigure || true
|
|
fi
|
|
|
|
echo "✓ Multipath configuration complete"
|
|
echo "Current multipath devices:"
|
|
nsenter -t 1 -m -u -i -n -- multipath -ll || echo " (no multipath devices yet)"
|
|
|
|
containers:
|
|
# Pause container keeps the pod running to indicate configuration is applied
|
|
- name: pause
|
|
image: registry.k8s.io/pause:3.9
|
|
resources:
|
|
requests:
|
|
cpu: 1m
|
|
memory: 8Mi
|
|
limits:
|
|
cpu: 10m
|
|
memory: 16Mi
|