mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
5208379310
With them only Longhorn's own components can reach the longhorn-manager API, which any pod could otherwise call without authentication to manage volumes. 1.12 was kept off because its instance-manager policy left the host-side iSCSI initiator out; 1.13 opens port 3260 to any source while v1DataEngineInitiatorSourceCIDRs is empty.
60 lines
2.3 KiB
YAML
60 lines
2.3 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: helm-longhorn
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
# Argo CD 3.x adds these for apps with PreDelete hooks (the Longhorn
|
|
# chart has one). Listed here so the parent app doesn't see a diff.
|
|
- pre-delete-finalizer.argocd.argoproj.io
|
|
- pre-delete-finalizer.argocd.argoproj.io/cleanup
|
|
spec:
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
project: default
|
|
sources:
|
|
- chart: longhorn
|
|
repoURL: https://charts.longhorn.io/
|
|
# One minor at a time; each upgrade moves every volume to the new
|
|
# engine image before the next.
|
|
targetRevision: 1.13.0
|
|
helm:
|
|
values: |
|
|
persistence:
|
|
defaultClassReplicaCount: 1
|
|
preUpgradeChecker:
|
|
jobEnabled: false
|
|
# restrictInternalTraffic is on by default since 1.12: only Longhorn
|
|
# components may reach the longhorn-manager API (otherwise any pod
|
|
# could manage volumes unauthenticated). Since 1.13 iSCSI (3260)
|
|
# stays open to the host-side initiator.
|
|
# From 1.13 the CSI controller may read every Secret in the cluster,
|
|
# for provisioner-secret StorageClass parameters. Neither
|
|
# StorageClass here uses those.
|
|
csi:
|
|
allowControllerSecretAccess: false
|
|
# New in 1.13, three replicas by default; this cluster has one node.
|
|
longhornGlobalManager:
|
|
replicas: 1
|
|
# Since 1.8 the backup target is a BackupTarget resource instead of
|
|
# the backup-target setting.
|
|
defaultBackupStore:
|
|
backupTarget: nfs://192.168.1.99:/volume1/microk8s-nfs
|
|
# Every poll rewrites the backupvolume objects, about 8% of all
|
|
# datastore writes at 300s. Backups only run nightly.
|
|
pollInterval: 1800
|
|
defaultSettings:
|
|
# Move volumes to the new engine image after each Longhorn
|
|
# upgrade, one at a time. At 0 they stayed behind on 1.7.1/1.7.2.
|
|
concurrentAutomaticEngineUpgradePerNodeLimit: 1
|
|
parameters:
|
|
- name: csi.kubeletRootDir
|
|
value: "/var/snap/microk8s/common/var/lib/kubelet"
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: longhorn-system |