nfs-subdir

Signed-off-by: gwg313 <gwg313@pm.me>

management/platform-apps/kustomization.yaml

@@ -8,5 +8,6 @@ resources:
   - tetragon-policies.yaml
   - sealed-secrets.yaml
   - cert-manager.yaml
+  - nfs-subdir.yaml
   - forgejo.yaml
   - navidrome.yaml

management/platform-apps/nfs-subdir.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nfs-provisioner
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    path: platform/nfs-subdir
+    repoURL: 'https://github.com/gwg313/homelab-gitops.git'
+    targetRevision: main
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: nfs-subdir-external-provisioner
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

platform/nfs-subdir/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: nfs-subdir
+description: NFS Subdir External Provisioner
+type: application
+version: 1.0.0
+appVersion: 1.0.0
+
+dependencies:
+  - name: nfs-subdir-external-provisioner
+    version: 4.0.18
+    repository: https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/

platform/nfs-subdir/templates/extra-storage-classes.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-ephemeral
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+provisioner: cluster.local/nfs-subdir-external-provisioner
+parameters:
+  archiveOnDelete: "false"
+  pathPattern: "ephemeral/${.PVC.namespace}/${.PVC.name}" 
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-retain
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+provisioner: cluster.local/nfs-subdir-external-provisioner
+parameters:
+  archiveOnDelete: "false"
+  pathPattern: "retained/${.PVC.namespace}/${.PVC.name}"
+reclaimPolicy: Retain
+volumeBindingMode: Immediate

platform/nfs-subdir/values.yaml

@@ -0,0 +1,27 @@
+nfs-subdir-external-provisioner:
+  nfs:
+    server: truenas.local.gwg313.xyz
+    path: /mnt/tank/k8s/nfs-subdir
+    mountOptions:
+      - hard
+      - noatime
+
+  storageClass:
+    create: true
+    name: nfs-client
+    defaultClass: true
+    accessModes: ReadWriteMany
+    reclaimPolicy: Delete
+    archiveOnDelete: "true"
+    pathPattern: "${.PVC.namespace}/${.PVC.name}"
+
+  podSecurityContext:
+    runAsNonRoot: true
+    runAsUser: 65534
+    fsGroup: 65534
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL