gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 05:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Scooby Husky
2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/rook-ceph/cluster-values.yaml
+219
View File
@@ -0,0 +1,219 @@
# Rook-Ceph Cluster Values
# https://github.com/rook/rook/blob/master/deploy/charts/rook-ceph-cluster/values.yaml
# Operator namespace (must match where operator is deployed)
operatorNamespace: rook-ceph
# Enable toolbox for debugging
toolbox:
enabled: true
tolerations:
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
resources:
limits:
memory: "256Mi"
requests:
cpu: "50m"
memory: "64Mi"
# Enable Prometheus monitoring
monitoring:
enabled: true
createPrometheusRules: true
# Ceph Cluster specification
cephClusterSpec:
# Ceph version - Squid (v19)
cephVersion:
image: quay.io/ceph/ceph:v19.2.0
allowUnsupported: false
# Data directory on host
dataDirHostPath: /var/lib/rook
# Skip upgrade checks (homelab - we control updates)
skipUpgradeChecks: false
# Continue if host not found
continueUpgradeAfterChecksEvenIfNotHealthy: false
# Wait for nodes before starting OSDs
waitTimeoutForHealthyOSDInMinutes: 10
# Mon configuration
mon:
count: 3
allowMultiplePerNode: false
# MGR configuration
mgr:
count: 2
allowMultiplePerNode: false
modules:
- name: pg_autoscaler
enabled: true
- name: rook
enabled: true
- name: dashboard
enabled: true
# Dashboard configuration
dashboard:
enabled: true
ssl: false # TLS handled by ingress
port: 7000
# Authentication: OAuth2-Proxy via ingress annotations
# See: infrastructure/rook-ceph/ingress.yaml
# Blueprint: infrastructure/authentik/ceph-dashboard-blueprint.yaml
config:
mgr/dashboard/standby_behaviour: "error"
mgr/dashboard/remote_user_header: "X-Forwarded-User"
mgr/dashboard/remote_user_trust_proxy: "true"
# Network configuration
network:
connections:
encryption:
enabled: false
compression:
enabled: false
# Crash collector
crashCollector:
disable: false
# Log collector
logCollector:
enabled: true
periodicity: daily
maxLogSize: 500M
# Cleanup policy (for uninstall)
cleanupPolicy:
confirmation: ""
sanitizeDisks:
method: quick
dataSource: zero
iteration: 1
allowUninstallWithVolumes: false
# Resource limits
resources:
mgr:
limits:
memory: "1Gi"
requests:
cpu: "100m"
memory: "512Mi"
mon:
limits:
memory: "2Gi"
requests:
cpu: "100m"
memory: "512Mi"
osd:
limits:
memory: "16Gi"
requests:
cpu: "2"
memory: "16Gi"
prepareosd:
limits:
memory: "400Mi"
requests:
cpu: "100m"
memory: "50Mi"
# Storage configuration - explicit nodes with passthrough NVMe
# sdb = dedicated 60GB WAL/DB device per node
storage:
useAllNodes: false
useAllDevices: false
nodes:
- name: "talos-cp-01"
devices:
- name: "nvme0n1"
config:
metadataDevice: "sdb"
- name: "talos-cp-02"
devices:
- name: "nvme0n1"
config:
metadataDevice: "sdb"
- name: "talos-cp-03"
devices:
- name: "nvme0n1"
config:
metadataDevice: "sdb"
- name: "talos-cp-04"
devices:
- name: "nvme0n1"
config:
metadataDevice: "sdb"
config:
osdsPerDevice: "1"
# Placement - allow on control-plane
placement:
all:
tolerations:
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
# Health check configuration
healthCheck:
daemonHealth:
mon:
disabled: false
interval: 45s
osd:
disabled: false
interval: 60s
status:
disabled: false
interval: 60s
livenessProbe:
mon:
disabled: false
mgr:
disabled: false
osd:
disabled: false
# Block pools configuration - matches existing deployment
cephBlockPools:
- name: replicapool
spec:
failureDomain: host
replicated:
size: 2 # 2 replicas
storageClass:
enabled: true
name: rook-ceph-block
isDefault: true
reclaimPolicy: Delete
allowVolumeExpansion: true
volumeBindingMode: Immediate
parameters:
imageFormat: "2"
imageFeatures: layering
csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner
csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph
csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
csi.storage.k8s.io/fstype: ext4
# Disable CephFS (not needed)
cephFileSystems: []
# Object Store with OIDC support - simplified for now
cephObjectStores: []
# Ingress for dashboard (also applied via postsync hook)
ingress:
dashboard: {}
infrastructure/rook-ceph/manifests/cephfs-filesystem.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: ceph.rook.io/v1
kind: CephFilesystem
metadata:
name: fileshare
namespace: rook-ceph
spec:
metadataPool:
replicated:
size: 2
dataPools:
- name: data0
replicated:
size: 2
preserveFilesystemOnDelete: true
metadataServer:
activeCount: 1
activeStandby: true
infrastructure/rook-ceph/manifests/cephfs-storageclass.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: rook-cephfs
provisioner: rook-ceph.cephfs.csi.ceph.com
parameters:
clusterID: rook-ceph
fsName: fileshare
csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph
csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
reclaimPolicy: Delete
volumeBindingMode: Immediate
allowVolumeExpansion: true
infrastructure/rook-ceph/manifests/envoy-backend.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: Backend
metadata:
name: ceph-dashboard
namespace: rook-ceph
spec:
endpoints:
- fqdn:
hostname: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
port: 8443
tls:
insecureSkipVerify: true
infrastructure/rook-ceph/manifests/envoy-route.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: ceph-dashboard
namespace: rook-ceph
spec:
parentRefs:
- name: edge
namespace: gateway
sectionName: https
hostnames:
- ceph.kube.huskypup.net
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- group: gateway.envoyproxy.io
kind: Backend
name: ceph-dashboard
infrastructure/rook-ceph/manifests/istio-destinationrule.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
name: rook-ceph-mgr-dashboard
namespace: rook-ceph
spec:
host: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
trafficPolicy:
tls:
mode: SIMPLE
sni: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
insecureSkipVerify: true
infrastructure/rook-ceph/manifests/istio-virtualservice.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: ceph-dashboard
namespace: rook-ceph
spec:
hosts:
- ceph.kube.huskypup.net
gateways:
- istio-system/edge
http:
- timeout: 3600s
route:
- destination:
host: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
port:
number: 8443
infrastructure/rook-ceph/manifests/nfs-external-service.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: v1
kind: Service
metadata:
name: rook-ceph-nfs-fileshare-external
namespace: rook-ceph
labels:
app: rook-ceph-nfs
ceph_nfs: fileshare
spec:
type: LoadBalancer
selector:
ceph_nfs: fileshare
ports:
- name: nfs
port: 2049
targetPort: 2049
protocol: TCP
infrastructure/rook-ceph/manifests/nfs.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: ceph.rook.io/v1
kind: CephNFS
metadata:
name: fileshare
namespace: rook-ceph
spec:
server:
active: 1
placement:
tolerations:
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
infrastructure/rook-ceph/manifests/servicemonitor.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: rook-ceph-mgr
namespace: rook-ceph
labels:
app: rook-ceph-mgr
rook_cluster: rook-ceph
release: kube-prometheus-stack
spec:
namespaceSelector:
matchNames:
- rook-ceph
selector:
matchLabels:
app: rook-ceph-mgr
rook_cluster: rook-ceph
endpoints:
- port: http-metrics
path: /metrics
interval: 30s
infrastructure/rook-ceph/manifests/smb-gateway.yaml
+83
View File
@@ -0,0 +1,83 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: cephfs-smb-pvc
namespace: rook-ceph
labels:
app: cephfs-smb-gateway
spec:
accessModes:
- ReadWriteMany
storageClassName: rook-cephfs
resources:
requests:
storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cephfs-smb-gateway
namespace: rook-ceph
labels:
app: cephfs-smb-gateway
spec:
replicas: 1
selector:
matchLabels:
app: cephfs-smb-gateway
template:
metadata:
labels:
app: cephfs-smb-gateway
spec:
containers:
- name: smb
image: docker.io/dperson/samba:amd64
args:
- -s
- "fileshare;/fileshare;yes;no;no;all"
- -u
- "fileshare;fileshare"
- -w
- "WORKGROUP"
ports:
- containerPort: 139
name: smb
- containerPort: 445
name: smb-alt
volumeMounts:
- name: cephfs
mountPath: /fileshare
securityContext:
runAsUser: 0
runAsGroup: 0
privileged: true
volumes:
- name: cephfs
persistentVolumeClaim:
claimName: cephfs-smb-pvc
tolerations:
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
---
apiVersion: v1
kind: Service
metadata:
name: cephfs-smb-gateway
namespace: rook-ceph
labels:
app: cephfs-smb-gateway
spec:
type: LoadBalancer
selector:
app: cephfs-smb-gateway
ports:
- name: smb
port: 139
targetPort: 139
protocol: TCP
- name: smb-alt
port: 445
targetPort: 445
protocol: TCP
infrastructure/rook-ceph/operator-values.yaml
+132
View File
@@ -0,0 +1,132 @@
# Rook-Ceph Operator Values
# https://github.com/rook/rook/blob/master/deploy/charts/rook-ceph/values.yaml
# Install CRDs with the chart (required for bootstrap)
crds:
enabled: true
# Enable RBD CSI driver (block storage)
enableRbdDriver: true
# Disable CephFS CSI driver (not needed for this deployment)
enableCephfsDriver: false
# Enable Prometheus monitoring
monitoring:
enabled: true
# Allow operator to run on control-plane nodes
tolerations:
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
# Resource limits for operator
resources:
limits:
memory: 512Mi
requests:
cpu: 100m
memory: 128Mi
# Enable device discovery daemon
enableDiscoveryDaemon: true
# CSI driver configuration
csi:
# Enable RBD provisioner
enableRbdDriver: true
# Disable CephFS provisioner
enableCephfsDriver: false
# Enable CSI host networking for better performance
enableCSIHostNetwork: true
# CSI plugin tolerations for running on all nodes
pluginTolerations:
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
provisionerTolerations:
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
# Provisioner replicas (HA)
provisionerReplicas: 2
# Resource limits for CSI pods
csiRBDPluginResource: |
- name : driver-registrar
resource:
requests:
memory: 64Mi
cpu: 25m
limits:
memory: 128Mi
- name : csi-rbdplugin
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 512Mi
- name : liveness-prometheus
resource:
requests:
memory: 64Mi
cpu: 25m
limits:
memory: 128Mi
csiRBDProvisionerResource: |
- name : csi-provisioner
resource:
requests:
memory: 64Mi
cpu: 25m
limits:
memory: 256Mi
- name : csi-resizer
resource:
requests:
memory: 64Mi
cpu: 25m
limits:
memory: 256Mi
- name : csi-attacher
resource:
requests:
memory: 64Mi
cpu: 25m
limits:
memory: 256Mi
- name : csi-snapshotter
resource:
requests:
memory: 64Mi
cpu: 25m
limits:
memory: 256Mi
- name : csi-rbdplugin
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 512Mi
- name : liveness-prometheus
resource:
requests:
memory: 64Mi
cpu: 25m
limits:
memory: 128Mi
# Discover devices automatically
discover:
tolerations:
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"