53 lines
2.2 KiB
YAML
53 lines
2.2 KiB
YAML
# Longhorn — this repo's pre-installed storage layer. Same pattern as
|
|
# apps/metallb.yaml: an Application pointing at a Helm chart
|
|
# (apps/longhorn/) that pulls in the official upstream chart. Once this
|
|
# syncs, any app in this cluster can request persistent storage (a
|
|
# PersistentVolumeClaim) and actually get real, replicated storage backed
|
|
# by the dedicated disk each worker prepared with
|
|
# talos/patch-longhorn.yaml — see docs/06-longhorn.md.
|
|
#
|
|
# Longhorn needs privileged Pods (it manages block devices directly) and
|
|
# the `open-iscsi`/`util-linux-tools` Talos system extensions baked into
|
|
# your node image — both covered in docs/01-prerequisites.md and
|
|
# docs/02-talos-bootstrap.md. Skipping either means Longhorn's Pods will
|
|
# sit unhealthy no matter how correctly this Application syncs.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: longhorn
|
|
namespace: argocd
|
|
# Deliberately NO resources-finalizer.argocd.argoproj.io here, unlike
|
|
# apps/demo.yaml and apps/metallb.yaml. Longhorn's CRDs (Volumes, Replicas,
|
|
# Engines) represent real data, not just running Pods — cascade-deleting
|
|
# this Application would tell Longhorn to tear down every volume and
|
|
# replica in the cluster along with it. Removing apps/longhorn.yaml from
|
|
# Git should be a rare, deliberate act, confirmed by hand
|
|
# (see docs/09-growing-up.md), never an accidental one-line prune.
|
|
spec:
|
|
project: default
|
|
|
|
source:
|
|
repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
|
|
targetRevision: main
|
|
path: apps/longhorn
|
|
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: longhorn-system
|
|
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
# Longhorn's manager Pods need hostPath volumes and privileged mode to
|
|
# manage block devices directly on each node. Kubernetes' baseline Pod
|
|
# Security profile rejects both, so this namespace is explicitly opted
|
|
# into the privileged profile—scoped only to longhorn-system.
|
|
managedNamespaceMetadata:
|
|
labels:
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
pod-security.kubernetes.io/audit: privileged
|
|
pod-security.kubernetes.io/warn: privileged
|
|
syncOptions:
|
|
- CreateNamespace=true
|