From 19f80551444678110a512810fb1e40bb183b4839 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 14:32:11 +1000 Subject: [PATCH] Deploy cephrgw-operator to cephrgw-system (#261) ## Why The new `cephrgw-operator` provisions Ceph RGW (S3) buckets and access keys (RW/RO) from Kubernetes CRDs via the Ceph manager dashboard API. This deploys it as a platform app. ## Changes - Add `apps/base/cephrgw-system`: namespace, ServiceAccount + ClusterRole/Binding (manage `ceph.unkin.net` CRDs, Secrets, leader-election leases), and the operator Deployment. CRDs are pulled from the operator repo at tag `v0.1.0`; the Deployment sources dashboard credentials from the `cephrgw-credentials` Secret via `envFrom` and carries the reloader annotation. - Add `apps/overlays/au-syd1/cephrgw-system` referencing the base. - Register `apps/overlays/*/cephrgw-system` in the platform ApplicationSet. The platform AppProject already permits `*-system` namespaces and the Namespace/ClusterRole/CRD cluster resources, so no project change is needed. ## Ordering / dependencies - Depends on the Gitea repo from terraform-git #34 and on the operator being pushed + tagged **v0.1.0** (image `git.unkin.net/unkin/cephrgw-operator:v0.1.0` and the raw CRD `install.yaml` at that tag). The `kubeconform` check will stay red until v0.1.0 exists, then go green. - The `cephrgw-credentials` Secret must be created out-of-band in `cephrgw-system` (see the operator's `docs/ceph-setup.md`); it is intentionally **not** managed in GitOps. --------- Co-authored-by: benvin Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/261 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/cephrgw-system/deployment.yaml | 66 +++++++++++++++++++ apps/base/cephrgw-system/kustomization.yaml | 11 ++++ apps/base/cephrgw-system/namespace.yaml | 5 ++ apps/base/cephrgw-system/rbac.yaml | 38 +++++++++++ .../au-syd1/cephrgw-system/kustomization.yaml | 6 ++ argocd/applicationsets/platform.yaml | 1 + 6 files changed, 127 insertions(+) create mode 100644 apps/base/cephrgw-system/deployment.yaml create mode 100644 apps/base/cephrgw-system/kustomization.yaml create mode 100644 apps/base/cephrgw-system/namespace.yaml create mode 100644 apps/base/cephrgw-system/rbac.yaml create mode 100644 apps/overlays/au-syd1/cephrgw-system/kustomization.yaml diff --git a/apps/base/cephrgw-system/deployment.yaml b/apps/base/cephrgw-system/deployment.yaml new file mode 100644 index 0000000..0a27938 --- /dev/null +++ b/apps/base/cephrgw-system/deployment.yaml @@ -0,0 +1,66 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cephrgw-operator + namespace: cephrgw-system + labels: + app.kubernetes.io/name: cephrgw-operator + annotations: + # Restart the operator when the credentials Secret rotates. + reloader.stakater.com/auto: "true" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: cephrgw-operator + template: + metadata: + labels: + app.kubernetes.io/name: cephrgw-operator + spec: + serviceAccountName: cephrgw-operator + securityContext: + runAsNonRoot: true + containers: + - name: operator + image: git.unkin.net/unkin/cephrgw-operator:v0.1.0 + args: + - --metrics-bind-address=:8080 + - --health-probe-bind-address=:8081 + - --leader-elect + envFrom: + # Provides CEPH_DASHBOARD_URL/USERNAME/PASSWORD and, optionally, + # CEPH_RGW_ENDPOINT / CEPH_DASHBOARD_CA. Create this Secret per + # docs/ceph-setup.md; it is intentionally not managed in GitOps. + - secretRef: + name: cephrgw-credentials + ports: + - containerPort: 8080 + name: metrics + - containerPort: 8081 + name: health + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 500m + memory: 256Mi diff --git a/apps/base/cephrgw-system/kustomization.yaml b/apps/base/cephrgw-system/kustomization.yaml new file mode 100644 index 0000000..c3558d4 --- /dev/null +++ b/apps/base/cephrgw-system/kustomization.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - namespace.yaml + # CRDs are pulled from the cephrgw-operator repo at the matching tag rather + # than vendored here, so they never drift from the operator. + - https://git.unkin.net/unkin/cephrgw-operator/raw/tag/v0.1.0/config/crd/install.yaml + - rbac.yaml + - deployment.yaml diff --git a/apps/base/cephrgw-system/namespace.yaml b/apps/base/cephrgw-system/namespace.yaml new file mode 100644 index 0000000..1ad6666 --- /dev/null +++ b/apps/base/cephrgw-system/namespace.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: cephrgw-system diff --git a/apps/base/cephrgw-system/rbac.yaml b/apps/base/cephrgw-system/rbac.yaml new file mode 100644 index 0000000..aad1349 --- /dev/null +++ b/apps/base/cephrgw-system/rbac.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: cephrgw-operator + namespace: cephrgw-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cephrgw-operator +rules: + - apiGroups: ["ceph.unkin.net"] + resources: ["*"] + verbs: ["*"] + # The operator delivers RGW access/secret keys into Secrets. + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cephrgw-operator +subjects: + - kind: ServiceAccount + name: cephrgw-operator + namespace: cephrgw-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cephrgw-operator diff --git a/apps/overlays/au-syd1/cephrgw-system/kustomization.yaml b/apps/overlays/au-syd1/cephrgw-system/kustomization.yaml new file mode 100644 index 0000000..861c6ed --- /dev/null +++ b/apps/overlays/au-syd1/cephrgw-system/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ../../../base/cephrgw-system diff --git a/argocd/applicationsets/platform.yaml b/argocd/applicationsets/platform.yaml index 3e99f87..71b298d 100644 --- a/argocd/applicationsets/platform.yaml +++ b/argocd/applicationsets/platform.yaml @@ -18,6 +18,7 @@ spec: - path: apps/overlays/*/cattle-system - path: apps/overlays/*/cert-manager - path: apps/overlays/*/certificates + - path: apps/overlays/*/cephrgw-system - path: apps/overlays/*/cnpg-system - path: apps/overlays/*/consul - path: apps/overlays/*/elastic-system