feat(storage): add local-path-provisioner as the fleet's persistent-storage backend #58

2026-10-06T04:48:12Z

rock commented

2026-10-06 04:48:12 +00:00

Backend for the fleet's persistent /workspace (toolkit PR #26 makes the controller able to hold a PVC).

Longhorn is the only provisioner in this cluster and it currently cannot attach a new volume at all
(state=attaching, status.replicas=null, engine replicaAddressMap={}, while every component reports
healthy) — so a longhorn claim would sit Pending. This adds a provisioner that works today.

local-path-provisioner v0.0.37, vendored from upstream deploy/local-path-storage.yaml, as a wave-1 ArgoCD
application (k8s/argocd/apps/10-storage-observability.yaml -> k8s/infra/local-path), creating
StorageClass local-path (rancher.io/local-path, WaitForFirstConsumer).

Vendored rather than a chart source because the ArgoCD project's sourceRepos is an explicit allowlist, and
two of the three changes are mandatory here anyway:

change	why
namespace `pod-security.kubernetes.io/enforce=privileged`	the provisioner's helper Pods mount a `hostPath`; this cluster defaults to baseline, which forbids it
`config.json` nodePathMap -> `/var/lib/local-path-provisioner`	Talos mounts the root filesystem read-only, so upstream's `/opt/...` cannot be created
helper busybox pinned to `1.36`	upstream leaves it floating

The provisioner's setup script does mkdir -m 0777 -p, so the fleet's uid-1000 container can write without
any chown bootstrap — the manual step the static-hostPath alternative needs.

No commonLabels in the kustomization: kustomize would rewrite the vendored Deployment's immutable selector.

Verification: YAML parses to 9 objects; kubectl kustomize k8s/infra/local-path exit 0; gate 0 error.

Ordering: do NOT set spec.storage on the fleet CR until this is synced and the provisioner is Ready —
a claim against a StorageClass with no ready provisioner would leave the fleet pods unschedulable.

Backend for the fleet's persistent `/workspace` (toolkit PR #26 makes the controller able to hold a PVC). Longhorn is the only provisioner in this cluster and it currently cannot attach a new volume at all (`state=attaching`, `status.replicas=null`, engine `replicaAddressMap={}`, while every component reports healthy) — so a `longhorn` claim would sit Pending. This adds a provisioner that works today. `local-path-provisioner` v0.0.37, vendored from upstream `deploy/local-path-storage.yaml`, as a wave-1 ArgoCD application (`k8s/argocd/apps/10-storage-observability.yaml` -> `k8s/infra/local-path`), creating StorageClass `local-path` (`rancher.io/local-path`, `WaitForFirstConsumer`). Vendored rather than a chart source because the ArgoCD project's `sourceRepos` is an explicit allowlist, and two of the three changes are mandatory here anyway: | change | why | | --- | --- | | namespace `pod-security.kubernetes.io/enforce=privileged` | the provisioner's helper Pods mount a `hostPath`; this cluster defaults to baseline, which forbids it | | `config.json` nodePathMap -> `/var/lib/local-path-provisioner` | Talos mounts the root filesystem read-only, so upstream's `/opt/...` cannot be created | | helper busybox pinned to `1.36` | upstream leaves it floating | The provisioner's `setup` script does `mkdir -m 0777 -p`, so the fleet's uid-1000 container can write without any chown bootstrap — the manual step the static-hostPath alternative needs. No `commonLabels` in the kustomization: kustomize would rewrite the vendored Deployment's immutable selector. Verification: YAML parses to 9 objects; `kubectl kustomize k8s/infra/local-path` exit 0; gate 0 error. Ordering: do NOT set `spec.storage` on the fleet CR until this is synced and the provisioner is Ready — a claim against a StorageClass with no ready provisioner would leave the fleet pods unschedulable.

rock added 1 commit 2026-10-06 04:48:12 +00:00

feat(storage): add local-path-provisioner as the fleet's persistent-storage backend ebb1b9b02d

The changes on this branch are already on the target branch. This will be an empty commit.

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/local-path-backend:feat/local-path-backend

git checkout feat/local-path-backend

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#58