ce7cb702218693d08ea6d83464d2457c9250027c

vendor/infrastructure/openebs/helm-release.yaml

@@ -0,0 +1,126 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: openebs
+  namespace: openebs
+spec:
+  interval: 15m
+  releaseName: openebs
+  targetNamespace: openebs
+  chart:
+    spec:
+      chart: openebs
+      version: 4.6.2
+      sourceRef:
+        kind: HelmRepository
+        name: openebs
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: Deployment
+              name: openebs-zfs-localpv-controller
+            patch: |
+              apiVersion: apps/v1
+              kind: Deployment
+              metadata:
+                name: openebs-zfs-localpv-controller
+              spec:
+                template:
+                  spec:
+                    containers:
+                      - name: csi-provisioner
+                        resources:
+                          requests:
+                            cpu: 2m
+                            memory: 80Mi
+                      - name: csi-resizer
+                        resources:
+                          requests:
+                            cpu: 5m
+                            memory: 96Mi
+                      - name: csi-snapshotter
+                        resources:
+                          requests:
+                            cpu: 1m
+                            memory: 56Mi
+                      - name: snapshot-controller
+                        resources:
+                          requests:
+                            cpu: 1m
+                            memory: 56Mi
+                      - name: openebs-zfs-plugin
+                        resources:
+                          requests:
+                            cpu: 1m
+                            memory: 72Mi
+          - target:
+              kind: ClusterRole
+              name: openebs-zfs-provisioner-role
+            patch: |
+              - op: add
+                path: /rules/-
+                value:
+                  apiGroups:
+                    - apps
+                  resources:
+                    - deployments
+                    - replicasets
+                  verbs:
+                    - get
+  values:
+    localpv-provisioner:
+      localpv:
+        replicas: 2
+    zfs-localpv:
+      analytics:
+        enabled: false
+      zfsController:
+        provisioner:
+          image:
+            tag: v6.4.0@sha256:6ebe60fd8ed67a7f8a90d34402e9e706b274e53612d6fa5fbb8285728db622e2
+          extraArgs:
+            - --capacity-ownerref-level=2
+        resizer:
+          image:
+            tag: v2.3.0@sha256:48fb3deb93cd848e3c8998b6368f4322c93bb5ce4a90d1307b6dda0dbefb9a0e
+        snapshotter:
+          image:
+            tag: v8.7.0@sha256:b03d3334f8035fa42660b166f6eb819a659a14774da020eb1b6c52cd422eaadb
+        snapshotController:
+          image:
+            tag: v8.7.0@sha256:8511f417d0072efcd937aedd7cc79a937d5066e64ee17beb6097301c92742f19
+        replicas: 2
+      zfsNode:
+        driverRegistrar:
+          image:
+            tag: v2.18.0@sha256:b7fefd08651f00ac4df1a196ed4c621c2451fbb899297fe9fad9e36c667af0c0
+        resources:
+          limits:
+            memory: 32Mi
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        nodeSelector:
+          has-zfs: "true"
+    engines:
+      local:
+        lvm:
+          enabled: false
+        zfs:
+          enabled: true
+      replicated:
+        mayastor:
+          enabled: false
+    loki:
+      enabled: false
+    alloy:
+      enabled: false

vendor/infrastructure/openebs/host-prep.md

@@ -0,0 +1,23 @@
+# OpenEBS ZFS Host Prep
+
+Run on the ZFS node before reconciling `platform-openebs`.
+
+Upgrade the host ZFS stack and enable any required pool features before OpenEBS is installed. Backwards-incompatible pool features must be enabled only after confirming every host that may import the pool supports them.
+
+Create the neutral parent dataset used by OpenEBS LocalPV ZFS. Workload-facing ZFS properties are declared in StorageClass parameters instead of being baked into parent datasets:
+
+```sh
+sudo zfs create -p ********
+```
+
+Verify the OpenEBS parent dataset:
+
+```sh
+zfs get recordsize,compression,dedup,mountpoint ********
+```
+
+Label the Kubernetes node:
+
+```sh
+kubectl label node <zfs-node-name> has-zfs=true --overwrite
+```

vendor/infrastructure/openebs/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
+  - storageclass.yaml
+  - storageclass-ssd.yaml
+  - network-policies.yaml

vendor/infrastructure/openebs/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openebs

vendor/infrastructure/openebs/network-policies.yaml

@@ -0,0 +1,62 @@
+---
+# OpenEBS components: apiserver access, DNS.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: openebs
+  namespace: openebs
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEntities:
+        - host
+  egress:
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-openebs-probes
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: openebs
+            openebs.io/component-name: openebs-localpv-provisioner
+      toPorts:
+        - ports:
+            - port: "8081"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-ingress-openebs-probe-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: openebs
+            openebs.io/component-name: openebs-localpv-provisioner
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP

vendor/infrastructure/openebs/storageclass-ssd.yaml

@@ -0,0 +1,20 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: openebs-hostpath-ssd
+  annotations:
+    openebs.io/cas-type: local
+    cas.openebs.io/config: |
+      - name: StorageType
+        value: "hostpath"
+      - name: BasePath
+        value: "********"
+provisioner: openebs.io/local
+volumeBindingMode: WaitForFirstConsumer
+allowedTopologies:
+  - matchLabelExpressions:
+      - key: kubernetes.io/hostname
+        values:
+          - "********-2697"
+reclaimPolicy: Delete
+allowVolumeExpansion: false

vendor/infrastructure/openebs/storageclass.yaml

@@ -0,0 +1,31 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: openebs-zfspv-1m-zstd
+provisioner: zfs.csi.openebs.io
+parameters:
+  poolname: "********"
+  fstype: "zfs"
+  recordsize: "1M"
+  compression: "zstd"
+  dedup: "off"
+  thinprovision: "yes"
+allowVolumeExpansion: true
+volumeBindingMode: WaitForFirstConsumer
+reclaimPolicy: Retain
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: openebs-hostpath-hdd
+  annotations:
+    openebs.io/cas-type: local
+    cas.openebs.io/config: |
+      - name: StorageType
+        value: "hostpath"
+      - name: BasePath
+        value: "********"
+provisioner: openebs.io/local
+volumeBindingMode: WaitForFirstConsumer
+reclaimPolicy: Retain
+allowVolumeExpansion: false