From f000301864eab68e9c1b21474e1d76fdd70e4331 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Thu, 10 Sep 2026 11:01:21 +0000 Subject: [PATCH] =?UTF-8?q?feat(flux):=20=E5=88=86=E9=98=B6=E6=AE=B5?= =?UTF-8?q?=E6=8E=A5=E7=AE=A1=20OpenEBS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- clusters/homelab/README.md | 1 + clusters/homelab/apps/openebs.yaml | 14 ++++++++ clusters/homelab/kustomization.yaml | 1 + platform/openebs/README.md | 54 ++++++++++++++++++++++++++++ platform/openebs/helmrelease.yaml | 35 ++++++++++++++++++ platform/openebs/helmrepository.yaml | 8 +++++ platform/openebs/kustomization.yaml | 15 ++++++++ 7 files changed, 128 insertions(+) create mode 100644 clusters/homelab/apps/openebs.yaml create mode 100644 platform/openebs/README.md create mode 100644 platform/openebs/helmrelease.yaml create mode 100644 platform/openebs/helmrepository.yaml create mode 100644 platform/openebs/kustomization.yaml diff --git a/clusters/homelab/README.md b/clusters/homelab/README.md index 9fe42e2..525a971 100644 --- a/clusters/homelab/README.md +++ b/clusters/homelab/README.md @@ -46,5 +46,6 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations - `gitea-actions`、`gitea` 与 External Secrets 已由 Flux HelmRelease 接管，Gitea 已升级到 `1.27.3`； - cert-manager 已固定现有 `v1.21.0` 并完成分阶段 Flux HelmRelease 接管； - Envoy Gateway 已固定现有 `v1.5.6` 并完成分阶段 Flux HelmRelease 接管； +- OpenEBS 已进入分阶段接管：固定现有 `4.4.0`，HelmRelease 暂停等待存储基线验证； - External Secrets Operator 已固定 chart `2.8.0` 并完成分阶段接管； - root Kustomization 与所有 brownfield 子 Kustomization 继续保持 `prune: false`。 diff --git a/clusters/homelab/apps/openebs.yaml b/clusters/homelab/apps/openebs.yaml new file mode 100644 index 0000000..ec2cf4b --- /dev/null +++ b/clusters/homelab/apps/openebs.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: openebs + namespace: flux-system +spec: + interval: 10m + path: ./platform/openebs + prune: false + sourceRef: + kind: GitRepository + name: flux-system + timeout: 3m + wait: false diff --git a/clusters/homelab/kustomization.yaml b/clusters/homelab/kustomization.yaml index 8d4dff0..4c98a4a 100644 --- a/clusters/homelab/kustomization.yaml +++ b/clusters/homelab/kustomization.yaml @@ -9,3 +9,4 @@ resources: - apps/gitea.yaml - apps/gitea-actions.yaml - apps/http-echo.yaml + - apps/openebs.yaml diff --git a/platform/openebs/README.md b/platform/openebs/README.md new file mode 100644 index 0000000..36b6a6b --- /dev/null +++ b/platform/openebs/README.md @@ -0,0 +1,54 @@ +# OpenEBS — 本地 ZFS 存储 + +OpenEBS umbrella chart 为单节点 k3s 提供 `zfs-localpv` CSI provisioner，并保留 +chart 自带的 local PV、Loki、Alloy 与 MinIO 组件。业务 PVC 使用独立声明的 +`localpv-zfs-ceph` StorageClass，在宿主机 ZFS pool `data/ceph` 上创建 dataset/zvol。 + +## 当前版本与引擎 + +- release：`openebs`，namespace：`openebs` +- chart/app：`4.4.0` +- ZFS LocalPV：启用 +- LVM LocalPV、RawFile LocalPV、Mayastor：显式禁用 +- bundled Loki SingleBinary：单副本 + +不要在 chart 升级时顺带启用其他存储引擎。`localpv-zfs-ceph` 当前承载 SeaweedFS、 +shared PostgreSQL、NetBox、VictoriaMetrics、VictoriaLogs、VictoriaTraces、Grafana 与 +RustFS 的持久卷；删除 StorageClass 不会删除已有 PV，但误删/重建 chart 资源可能中断 +provisioner，因此 brownfield 接管期间保持 `prune: false`。 + +## Flux 接管状态 + +现有 Helm release revision 为 3，保存的 user-supplied values 与本目录 `values.yaml` +一致。Git 中先登记固定 `4.4.0` 且 `suspend: true` 的 HelmRelease；阶段一仅让 Flux +管理 Helm source、release 声明、values ConfigMap 和现有 StorageClass，不运行 Helm +upgrade。确认 source Ready、Helm revision、OpenEBS Pod UID、PV/PVC 与 ZFS volume +健康后，再通过独立 PR 解除暂停。 + +CRD 在 install/upgrade 时使用 `CreateReplace`，但绝不通过删除 CRD 迁移。接管和升级 +是两个独立动作；首次激活不得改变 chart、values、StorageClass 或存储引擎。 + +## Break-glass 手工恢复 + +正常变更应提交 Git。Flux 不可用时可暂时执行： + +```bash +helm upgrade --install openebs openebs/openebs --version 4.4.0 \ + -n openebs --create-namespace -f platform/openebs/values.yaml +kubectl apply -f platform/openebs/storageclasses.yaml +``` + +恢复 Flux 后，应以 Git 为准并确认 HelmRelease 没有 drift。 + +## 验证 + +```bash +kubectl -n openebs get pods +kubectl get storageclass localpv-zfs-ceph +kubectl get pv | grep localpv-zfs-ceph +kubectl get pvc -A +zfs list -r data/ceph +``` + +所有既有 PV 必须保持 `Bound`。验证新 provisioner 时只创建单独的临时 PVC，不要修改 +或删除业务 PVC，也不要用 `helm uninstall` 验证接管。 diff --git a/platform/openebs/helmrelease.yaml b/platform/openebs/helmrelease.yaml new file mode 100644 index 0000000..d4d81ad --- /dev/null +++ b/platform/openebs/helmrelease.yaml @@ -0,0 +1,35 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: openebs + namespace: openebs +spec: + # 存储控制面先只登记；解除暂停必须使用独立 PR 并保留 live PV/PVC 基线。 + suspend: true + chart: + spec: + chart: openebs + interval: 1h + sourceRef: + kind: HelmRepository + name: openebs + version: 4.4.0 + driftDetection: + mode: enabled + install: + crds: CreateReplace + strategy: + name: RetryOnFailure + retryInterval: 5m + interval: 30m + releaseName: openebs + targetNamespace: openebs + timeout: 15m + upgrade: + crds: CreateReplace + strategy: + name: RetryOnFailure + retryInterval: 5m + valuesFrom: + - kind: ConfigMap + name: openebs-values diff --git a/platform/openebs/helmrepository.yaml b/platform/openebs/helmrepository.yaml new file mode 100644 index 0000000..9acd85e --- /dev/null +++ b/platform/openebs/helmrepository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: openebs + namespace: openebs +spec: + interval: 1h + url: https://openebs.github.io/openebs diff --git a/platform/openebs/kustomization.yaml b/platform/openebs/kustomization.yaml new file mode 100644 index 0000000..8c1092e --- /dev/null +++ b/platform/openebs/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +generatorOptions: + disableNameSuffixHash: true + labels: + reconcile.fluxcd.io/watch: Enabled +configMapGenerator: + - name: openebs-values + namespace: openebs + files: + - values.yaml=values.yaml +resources: + - helmrepository.yaml + - helmrelease.yaml + - storageclasses.yaml