mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby Husky
9bb4ada1f5
redis-nextcloud-0 was CrashLoopBackOff: "mkdir: can't create directory
'/node-conf': Permission denied" and same for appendonlydir - the pod
had no podSecurityContext, so it couldn't write to its own PVC-backed
data directories. Added fsGroup/runAsUser: 1000 matching the
opstree/redis image's default non-root user. Verified live: Redis now
starts cleanly ("Ready to accept connections").
83 lines
2.5 KiB
YAML
83 lines
2.5 KiB
YAML
---
|
|
# Standalone Redis via the ot-container-kit redis-operator that's already
|
|
# deployed as infra (argocd-apps/infrastructure/redis-operator.yaml) but
|
|
# currently unused - GitLab's Redis is a hand-rolled StatefulSet instead
|
|
# (apps/gitlab/manifests/redis-cluster.yaml), not this operator. This is the
|
|
# first real consumer of it in the repo.
|
|
#
|
|
# Verified against the live CRD (redis.redis.redis.opstreelabs.in) 2026-08-17:
|
|
# apiVersion is v1beta1, not v1beta2 as originally guessed here (blocked
|
|
# ArgoCD from syncing the *entire* nextcloud Application - it validates all
|
|
# resource types up front, so one unknown apiVersion blocks everything, not
|
|
# just this resource). redisSecret also belongs nested under
|
|
# kubernetesConfig, not top-level.
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
metadata:
|
|
name: nextcloud-redis-password
|
|
namespace: nextcloud
|
|
spec:
|
|
length: 32
|
|
digits: 5
|
|
symbols: 0
|
|
noUpper: false
|
|
allowRepeat: true
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: nextcloud-redis-password
|
|
namespace: nextcloud
|
|
spec:
|
|
refreshInterval: "0" # generate once, don't rotate (Redis CR reads this at pod start only)
|
|
target:
|
|
name: redis-nextcloud-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
password: "{{ .password }}"
|
|
dataFrom:
|
|
- sourceRef:
|
|
generatorRef:
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
name: nextcloud-redis-password
|
|
---
|
|
apiVersion: redis.redis.opstreelabs.in/v1beta1
|
|
kind: Redis
|
|
metadata:
|
|
name: redis-nextcloud
|
|
namespace: nextcloud
|
|
spec:
|
|
# Without this, the redis process can't write to its PVC-backed data dirs
|
|
# (appendonlydir, node-conf) - "Permission denied", confirmed live 2026-08-17.
|
|
# 1000 matches the opstree/redis image's default non-root "redis" user.
|
|
podSecurityContext:
|
|
fsGroup: 1000
|
|
runAsUser: 1000
|
|
kubernetesConfig:
|
|
image: quay.io/opstree/redis:v7.0.12
|
|
imagePullPolicy: IfNotPresent
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
redisSecret:
|
|
name: redis-nextcloud-secret
|
|
key: password
|
|
redisExporter:
|
|
# image is required by the CRD schema even when enabled: false
|
|
enabled: false
|
|
image: quay.io/opstree/redis-exporter:v1.44.0
|
|
storage:
|
|
volumeClaimTemplate:
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: rook-ceph-block
|
|
resources:
|
|
requests:
|
|
storage: 2Gi
|