feat(storage): add local-path-provisioner as the fleet's persistent-storage backend #58

2026-10-06T04:48:12Z

rock commented

2026-10-06 04:48:12 +00:00

Backend for the fleet's persistent /workspace (toolkit PR #26 makes the controller able to hold a PVC).

Longhorn is the only provisioner in this cluster and it currently cannot attach a new volume at all
(state=attaching, status.replicas=null, engine replicaAddressMap={}, while every component reports
healthy) — so a longhorn claim would sit Pending. This adds a provisioner that works today.

local-path-provisioner v0.0.37, vendored from upstream deploy/local-path-storage.yaml, as a wave-1 ArgoCD
application (k8s/argocd/apps/10-storage-observability.yaml -> k8s/infra/local-path), creating
StorageClass local-path (rancher.io/local-path, WaitForFirstConsumer).

Vendored rather than a chart source because the ArgoCD project's sourceRepos is an explicit allowlist, and
two of the three changes are mandatory here anyway:

change	why
namespace `pod-security.kubernetes.io/enforce=privileged`	the provisioner's helper Pods mount a `hostPath`; this cluster defaults to baseline, which forbids it
`config.json` nodePathMap -> `/var/lib/local-path-provisioner`	Talos mounts the root filesystem read-only, so upstream's `/opt/...` cannot be created
helper busybox pinned to `1.36`	upstream leaves it floating

The provisioner's setup script does mkdir -m 0777 -p, so the fleet's uid-1000 container can write without
any chown bootstrap — the manual step the static-hostPath alternative needs.

No commonLabels in the kustomization: kustomize would rewrite the vendored Deployment's immutable selector.

Verification: YAML parses to 9 objects; kubectl kustomize k8s/infra/local-path exit 0; gate 0 error.

Ordering: do NOT set spec.storage on the fleet CR until this is synced and the provisioner is Ready —
a claim against a StorageClass with no ready provisioner would leave the fleet pods unschedulable.

Backend for the fleet's persistent `/workspace` (toolkit PR #26 makes the controller able to hold a PVC). Longhorn is the only provisioner in this cluster and it currently cannot attach a new volume at all (`state=attaching`, `status.replicas=null`, engine `replicaAddressMap={}`, while every component reports healthy) — so a `longhorn` claim would sit Pending. This adds a provisioner that works today. `local-path-provisioner` v0.0.37, vendored from upstream `deploy/local-path-storage.yaml`, as a wave-1 ArgoCD application (`k8s/argocd/apps/10-storage-observability.yaml` -> `k8s/infra/local-path`), creating StorageClass `local-path` (`rancher.io/local-path`, `WaitForFirstConsumer`). Vendored rather than a chart source because the ArgoCD project's `sourceRepos` is an explicit allowlist, and two of the three changes are mandatory here anyway: | change | why | | --- | --- | | namespace `pod-security.kubernetes.io/enforce=privileged` | the provisioner's helper Pods mount a `hostPath`; this cluster defaults to baseline, which forbids it | | `config.json` nodePathMap -> `/var/lib/local-path-provisioner` | Talos mounts the root filesystem read-only, so upstream's `/opt/...` cannot be created | | helper busybox pinned to `1.36` | upstream leaves it floating | The provisioner's `setup` script does `mkdir -m 0777 -p`, so the fleet's uid-1000 container can write without any chown bootstrap — the manual step the static-hostPath alternative needs. No `commonLabels` in the kustomization: kustomize would rewrite the vendored Deployment's immutable selector. Verification: YAML parses to 9 objects; `kubectl kustomize k8s/infra/local-path` exit 0; gate 0 error. Ordering: do NOT set `spec.storage` on the fleet CR until this is synced and the provisioner is Ready — a claim against a StorageClass with no ready provisioner would leave the fleet pods unschedulable.

rock added 1 commit 2026-10-06 04:48:12 +00:00

feat(storage): add local-path-provisioner as the fleet's persistent-storage backend ebb1b9b02d

rock referenced this pull request

2026-10-26 03:24:12 +00:00

integration: merge minio-client fix, local-path backend, and local cloudflared ingress #70

rock closed this pull request

2026-10-26 03:26:52 +00:00