e8303d5129
Root cause: Previous config violated boot-time security model - Removed /etc/iscsi mount (iscsi-tools extension manages it) - Moved multipath.conf to post-boot DaemonSet - Added explicit kubelet nodeIP for dual-NIC workers Deliverables: - Fixed talconfig.yaml with working worker patch - iscsi-multipath-init.yaml DaemonSet for multipath config - Automated deployment and verification scripts - Complete documentation suite Ready for production deployment to fastpass worker nodes. Co-authored-by: Talos Specialist <subagent@hermes>
122 lines
3.4 KiB
YAML
122 lines
3.4 KiB
YAML
---
|
|
# iSCSI Multipath Initialization DaemonSet
|
|
#
|
|
# Configures multipath.conf for Pure Storage FlashArray on Talos worker nodes.
|
|
# Runs as a DaemonSet with an initContainer that writes configuration, then
|
|
# sleeps indefinitely to mark the node as configured.
|
|
#
|
|
# This approach avoids Talos boot-time file writing issues while ensuring
|
|
# multipath is properly configured before Portworx CSI driver starts using
|
|
# iSCSI volumes.
|
|
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: iscsi-multipath-init
|
|
namespace: kube-system
|
|
labels:
|
|
app: iscsi-multipath-init
|
|
component: storage
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: iscsi-multipath-init
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: iscsi-multipath-init
|
|
component: storage
|
|
spec:
|
|
hostNetwork: true
|
|
hostPID: true
|
|
|
|
# Only run on worker nodes with iSCSI storage network
|
|
nodeSelector:
|
|
node-role.kubernetes.io/worker: ""
|
|
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
key: node-role.kubernetes.io/control-plane
|
|
|
|
initContainers:
|
|
- name: configure-multipath
|
|
image: alpine:3.19
|
|
securityContext:
|
|
privileged: true
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
|
|
echo "Configuring multipath for Pure Storage FlashArray..."
|
|
|
|
# Write multipath.conf
|
|
cat > /host/etc/multipath.conf <<'MPCONF'
|
|
# Multipath configuration for Pure Storage FlashArray
|
|
# Managed by iscsi-multipath-init DaemonSet
|
|
|
|
defaults {
|
|
polling_interval 10
|
|
find_multipaths yes
|
|
user_friendly_names no
|
|
}
|
|
|
|
devices {
|
|
device {
|
|
vendor "PURE"
|
|
product "FlashArray"
|
|
path_selector "service-time 0"
|
|
path_grouping_policy group_by_prio
|
|
prio alua
|
|
path_checker tur
|
|
fast_io_fail_tmo 10
|
|
user_friendly_names no
|
|
no_path_retry 0
|
|
hardware_handler "1 alua"
|
|
dev_loss_tmo 600
|
|
failback immediate
|
|
}
|
|
}
|
|
|
|
# Blacklist Portworx virtual block devices
|
|
blacklist {
|
|
devnode "^pxd[0-9]*"
|
|
devnode "^pxd.*"
|
|
}
|
|
MPCONF
|
|
|
|
echo "✓ Multipath configuration written to /etc/multipath.conf"
|
|
|
|
# Reload multipathd if running (Talos manages the service)
|
|
if nsenter -t 1 -m -u -i -n -- multipathd show status >/dev/null 2>&1; then
|
|
echo "Reloading multipathd..."
|
|
nsenter -t 1 -m -u -i -n -- multipathd reconfigure || true
|
|
fi
|
|
|
|
echo "✓ Multipath configuration complete"
|
|
echo "Current multipath devices:"
|
|
nsenter -t 1 -m -u -i -n -- multipath -ll || echo " (no multipath devices yet)"
|
|
|
|
volumeMounts:
|
|
- name: host-etc
|
|
mountPath: /host/etc
|
|
|
|
containers:
|
|
# Pause container keeps the pod running to indicate configuration is applied
|
|
- name: pause
|
|
image: registry.k8s.io/pause:3.9
|
|
resources:
|
|
requests:
|
|
cpu: 1m
|
|
memory: 8Mi
|
|
limits:
|
|
cpu: 10m
|
|
memory: 16Mi
|
|
|
|
volumes:
|
|
- name: host-etc
|
|
hostPath:
|
|
path: /etc
|
|
type: Directory
|