46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
# Longhorn — this repo's pre-installed storage layer. Same pattern as
|
|
# apps/metallb.yaml: an Application pointing at a Helm chart
|
|
# (apps/longhorn/) that pulls in the official upstream chart. Once this
|
|
# syncs, any app in this cluster can request persistent storage (a
|
|
# PersistentVolumeClaim) and actually get real, replicated storage backed
|
|
# by the dedicated disk each worker prepared with
|
|
# talos/patch-longhorn.yaml — see docs/06-longhorn.md.
|
|
#
|
|
# Longhorn needs privileged Pods (it manages block devices directly) and
|
|
# the `open-iscsi`/`util-linux-tools` Talos system extensions baked into
|
|
# your node image — both covered in docs/01-prerequisites.md and
|
|
# docs/02-talos-bootstrap.md. Skipping either means Longhorn's Pods will
|
|
# sit unhealthy no matter how correctly this Application syncs.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: longhorn
|
|
namespace: argocd
|
|
spec:
|
|
project: default
|
|
|
|
source:
|
|
repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
|
|
targetRevision: main
|
|
path: apps/longhorn
|
|
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: longhorn-system
|
|
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
# Longhorn's manager Pods need hostPath volumes and privileged mode to
|
|
# manage block devices directly on each node. Kubernetes' baseline Pod
|
|
# Security profile rejects both, so this namespace is explicitly opted
|
|
# into the privileged profile—scoped only to longhorn-system.
|
|
managedNamespaceMetadata:
|
|
labels:
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
pod-security.kubernetes.io/audit: privileged
|
|
pod-security.kubernetes.io/warn: privileged
|
|
syncOptions:
|
|
- CreateNamespace=true
|