unkin-agent
e10f0c09c9
## Why
The media estate is currently split across two 1Ti CephFS subvolumes (`media-tv`
and `media-movies`), so a download that lands in one and imports to the other is
a cross-filesystem copy, not a hardlink move. A single 10Ti `mediastore`
subvolume (already created on `cephfs_csi_ssd_ec_4_1`) collapses that: one
filesystem holding `/{fafflix,cheeztv}/{tvseries,movies}` plus
`/nzbget/downloads/complete`, so every arr import is an atomic same-fs hardlink.
This PR only provisions the volume and seeds its tree. No existing PV, PVC or
workload is touched, and nothing mounts the new claims yet — the cutover of the
arrs and the two jellyfins is a separate change.
## How
- Add static PVs `arrstack-mediastore`, `fafflix-mediastore` and
`cheeztv-mediastore`, all pointing at the same rootPath
(`/volumes/csi_ssd_ec_4_1/mediastore/a0152dac-…`) with unique names and
volumeHandles pinned by `claimRef` — the established pattern for the shared
media subvolumes.
- Add the matching RWX 10Ti PVCs (`mediastore` in arrstack,
`fafflix-mediastore`, `cheeztv-mediastore`), annotated
`k8up.io/backup: "false"` and statically bound via `volumeName` +
`storageClassName: ""`.
- Add `mediastore-bootstrap`, a one-shot ArgoCD Sync-hook Job
(`hook-delete-policy: BeforeHookCreation`, no sync-wave needed) that mounts
the arrstack claim and `mkdir -p`s the directory tree as uid/gid 1000 —
the uid the arrstack media pods run as. Idempotent, so it self-heals on
every sync.
- Wire the new manifests into the arrstack, fafflix and cheeztv bases.
## Validation
- `kustomize build` clean on `apps/overlays/au-syd1/{arrstack,fafflix,cheeztv}`
- `kubeconform` clean on all three overlays (91 / 29 / 32 resources valid)
- pre-commit (yamllint, check-yaml, no-plain-secrets) passed
Reviewed-on: #428
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
75 lines
2.2 KiB
YAML
75 lines
2.2 KiB
YAML
---
|
|
# Seeds the directory skeleton on the freshly created mediastore subvolume so
|
|
# the arrs, nzbget and both jellyfins mount subPaths that already exist and are
|
|
# owned by uid/gid 1000 (the uid every arrstack media pod runs as). mkdir -p is
|
|
# idempotent, so re-running it on every sync is harmless and self-heals a tree
|
|
# someone deleted by hand.
|
|
#
|
|
# Sync hook with BeforeHookCreation delete: ArgoCD replaces the completed Job
|
|
# each sync instead of failing on the immutable pod template. No sync-wave is
|
|
# needed -- the PVC applies in the same wave and the pod simply stays Pending
|
|
# until it binds.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: mediastore-bootstrap
|
|
namespace: arrstack
|
|
annotations:
|
|
argocd.argoproj.io/hook: Sync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
backoffLimit: 6
|
|
ttlSecondsAfterFinished: 600
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: mediastore-bootstrap
|
|
spec:
|
|
serviceAccountName: default
|
|
automountServiceAccountToken: false
|
|
restartPolicy: Never
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: mkdir
|
|
image: docker.io/library/alpine:3
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -eu
|
|
mkdir -p \
|
|
/media/fafflix/tvseries \
|
|
/media/fafflix/movies \
|
|
/media/cheeztv/tvseries \
|
|
/media/cheeztv/movies \
|
|
/media/nzbget/downloads/complete
|
|
ls -la /media
|
|
volumeMounts:
|
|
- name: mediastore
|
|
mountPath: /media
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: mediastore
|
|
persistentVolumeClaim:
|
|
claimName: mediastore
|