From 671c075a08ef31b8713cc4b2d6a04113a905cf14 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 22 Aug 2026 23:05:43 +1000
Subject: [PATCH] Mount mediafs CephFS into arrstack (#391)

Exposes the legacy mediafs CephFS filesystem to the arrstack namespace so the upcoming mediamover tool can migrate media and run bandwidth tests against the old filesystem; the ceph-mediafs client secret is already seeded in Vault. The mover deployment itself lands in a follow-up PR.

- Adds a `ceph-mediafs-secret` VaultStaticSecret in csi-cephfs syncing `kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret`
- Adds a 10Ti static RWX PV `arrstack-mediafs` (fsName `mediafs`, rootPath `/`, staged with the mediafs secret) pinned by claimRef
- Adds the matching `mediafs` PVC in arrstack (storageClassName "", volumeName-bound, backups excluded)
- Registers all three in their base kustomizations

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/391
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 apps/base/arrstack/kustomization.yaml         |  2 ++
 apps/base/arrstack/pv-mediafs.yaml            | 31 +++++++++++++++++++
 apps/base/arrstack/pvc-mediafs.yaml           | 20 ++++++++++++
 apps/base/csi-cephfs/kustomization.yaml       |  1 +
 .../csi-cephfs/vaultstaticsecret-mediafs.yaml | 15 +++++++++
 5 files changed, 69 insertions(+)
 create mode 100644 apps/base/arrstack/pv-mediafs.yaml
 create mode 100644 apps/base/arrstack/pvc-mediafs.yaml
 create mode 100644 apps/base/csi-cephfs/vaultstaticsecret-mediafs.yaml

diff --git a/apps/base/arrstack/kustomization.yaml b/apps/base/arrstack/kustomization.yaml
index d676b39..a3846b7 100644
--- a/apps/base/arrstack/kustomization.yaml
+++ b/apps/base/arrstack/kustomization.yaml
@@ -7,8 +7,10 @@ resources:
   - vaultauth.yaml
   - pv-media-tv.yaml
   - pv-media-movies.yaml
+  - pv-mediafs.yaml
   - pvc-media-tv.yaml
   - pvc-media-movies.yaml
+  - pvc-mediafs.yaml
   - media-bucket.yaml
   - backups-bucket.yaml
   - postgres
diff --git a/apps/base/arrstack/pv-mediafs.yaml b/apps/base/arrstack/pv-mediafs.yaml
new file mode 100644
index 0000000..66e604a
--- /dev/null
+++ b/apps/base/arrstack/pv-mediafs.yaml
@@ -0,0 +1,31 @@
+---
+# Static PV exposing the legacy mediafs CephFS filesystem root for the upcoming
+# mediamover tool. clusterID only selects the monitor set from the csi config;
+# fsName selects the actual filesystem, so the ssd_ec clusterID still reaches
+# mediafs on the same cluster. Staged with the dedicated ceph-mediafs client.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: arrstack-mediafs
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: arrstack
+    name: mediafs
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: arrstack-mediafs-static
+    nodeStageSecretRef:
+      name: ceph-mediafs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: mediafs
+      rootPath: /
diff --git a/apps/base/arrstack/pvc-mediafs.yaml b/apps/base/arrstack/pvc-mediafs.yaml
new file mode 100644
index 0000000..5dd6feb
--- /dev/null
+++ b/apps/base/arrstack/pvc-mediafs.yaml
@@ -0,0 +1,20 @@
+---
+# Legacy mediafs filesystem root, statically bound to the arrstack-mediafs PV
+# for the upcoming mediamover tool. storageClassName "" + volumeName disables
+# dynamic provisioning and binds the pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mediafs
+  namespace: arrstack
+  annotations:
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: arrstack-mediafs
+  volumeMode: Filesystem
diff --git a/apps/base/csi-cephfs/kustomization.yaml b/apps/base/csi-cephfs/kustomization.yaml
index cd444d8..b3854cc 100644
--- a/apps/base/csi-cephfs/kustomization.yaml
+++ b/apps/base/csi-cephfs/kustomization.yaml
@@ -6,5 +6,6 @@ resources:
   - namespace.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vaultstaticsecret-mediafs.yaml
   - storageclass.yaml
   - vmservicescrape.yaml
diff --git a/apps/base/csi-cephfs/vaultstaticsecret-mediafs.yaml b/apps/base/csi-cephfs/vaultstaticsecret-mediafs.yaml
new file mode 100644
index 0000000..7063e62
--- /dev/null
+++ b/apps/base/csi-cephfs/vaultstaticsecret-mediafs.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: ceph-mediafs-secret
+  namespace: csi-cephfs
+spec:
+  vaultAuthRef: ceph-csi-cephfs
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/csi/ceph-mediafs-secret
+  refreshAfter: 5m
+  destination:
+    name: ceph-mediafs-secret
+    create: true