apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: fix-rook-osd-metadata-device
  annotations:
    policies.kyverno.io/title: Fix Rook OSD Metadata Device
    policies.kyverno.io/category: Rook-Ceph
    policies.kyverno.io/severity: high
    policies.kyverno.io/description: >-
      Temporary policy to fix rook-ceph OSD deployments that use metadataDevice.
      Replaces expand-bluefs with a no-op and adds conditional block.db symlink
      creation. Remove this policy after all OSDs are recreated without DB devices.
spec:
  background: false
  rules:
    - name: noop-expand-bluefs
      match:
        any:
          - resources:
              kinds:
                - Deployment
              namespaces:
                - rook-ceph
              selector:
                matchLabels:
                  app: rook-ceph-osd
      mutate:
        patchStrategicMerge:
          spec:
            template:
              spec:
                initContainers:
                  - name: expand-bluefs
                    command: ["/bin/true"]
                    args: []
    - name: add-block-db-symlink
      match:
        any:
          - resources:
              kinds:
                - Deployment
              namespaces:
                - rook-ceph
              selector:
                matchLabels:
                  app: rook-ceph-osd
      mutate:
        patchesJson6902: |-
          - op: add
            path: /spec/template/spec/initContainers/-
            value:
              name: create-block-db-symlink
              image: quay.io/ceph/ceph:v19.2.0
              command: ["/bin/bash", "-c"]
              args:
                - |
                  set -e
                  # Only create block.db symlink if /dev/sdb has a valid BlueStore label
                  if ! ceph-bluestore-tool show-label --dev /dev/sdb 2>/dev/null; then
                    echo "No BlueStore label on /dev/sdb, skipping block.db symlink"
                    exit 0
                  fi
                  echo "BlueStore label found on /dev/sdb"
                  # Use activate-osd mount (OSD-specific data directory)
                  if [ -e "/osd-data/block" ]; then
                    ln -sf /dev/sdb /osd-data/block.db
                    echo "Created block.db -> /dev/sdb in /osd-data/"
                  else
                    echo "No block device found in /osd-data/, skipping"
                  fi
              securityContext:
                privileged: true
                runAsUser: 0
              volumeMounts:
                - name: activate-osd
                  mountPath: /osd-data
                - name: devices
                  mountPath: /dev