adamksmith/jbod-monitor
1
0
Fork 0
Code Issues 3 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

k8s: add registry-cred VSS + imagePullSecrets after prereq check

Browse Source 
Prereqs verified on the cluster: VSO 1.3.0 (transformation supported,
openbao-kubernetes VaultAuth healthy), MQTT egress to 10.5.30.3:1883 reachable
from a pod, target nodes untainted, registry requires auth. Add
registry-cred-vaultstaticsecret.yaml (secret/registry/nexus -> dockerconfigjson,
mirroring existing cluster pattern) and wire imagePullSecrets into the DaemonSet.
README updated with verified prereqs + apply order.
This commit is contained in:
adam
2026-06-16 19:56:01 +00:00
parent 5032c58f7d
commit 0f0bdf4f6c
3 changed files with 36 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
k8s/README.md
View File

@@ -16,31 +16,35 @@ independent, exactly like the standalone hosts.
- No SAS poller (no SES enclosures on these nodes). Consequence: host-drive
entities have no ZFS pool label (no zfs_map producer).
## Prereqs to verify before applying
## Prereqs — verified 2026-06-16
1. **Registry pull**: confirm the cluster can pull `docker.adamksmith.xyz/*`.
If it needs auth, sync a `regcred` into the `jbod-monitor` namespace and
uncomment `imagePullSecrets` in `daemonset.yaml`.
2. **VSO**: `vault-secrets-operator-system/openbao-kubernetes` VaultAuth exists
(it does, per infra notes). Confirm the `transformation.templates` syntax
matches the installed VSO version.
3. **MQTT egress**: pods must reach `10.5.30.3:1883` (EMQX).
1. **Registry pull**: registry requires auth. `registry-cred-vaultstaticsecret.yaml`
syncs `secret/registry/nexus` → `docker-registry-cred` (dockerconfigjson),
referenced as `imagePullSecrets` in the DaemonSet. (Mirrors the cluster's
existing `*-registry-cred` pattern.)
2. **VSO**: v1.3.0; `openbao-kubernetes` VaultAuth healthy; `transformation.templates`
supported. No existing VSS in the cluster uses transformation, so watch the
`jbod-mqtt` VSS status on first apply for template errors.
3. **MQTT egress**: confirmed — a cluster pod reached `10.5.30.3:1883`.
4. **Nodes**: pascal/currie/fermi are untainted → no tolerations needed.
## Apply order
```bash
# 1. Label ONLY the intended nodes (do not blanket-label all workers):
kubectl label node usco-dc-pascal usco-dc-currie usco-dc-fermi jbod-monitor=enabled
# (canary: label just usco-dc-fermi first)
# 2. Namespace + DaemonSet:
kubectl apply -f k8s/daemonset.yaml
# 3. MQTT creds (VSO → Secret jbod-mqtt). Apply, then confirm it synced:
# 3. Secrets (VSO → docker-registry-cred + jbod-mqtt). Apply, then confirm sync:
kubectl apply -f k8s/registry-cred-vaultstaticsecret.yaml
kubectl apply -f k8s/mqtt-vaultstaticsecret.yaml
kubectl -n jbod-monitor get vaultstaticsecret jbod-mqtt # SYNCED=True
kubectl -n jbod-monitor get secret jbod-mqtt # has MQTT_USERNAME/PASSWORD
kubectl -n jbod-monitor get vaultstaticsecret # SYNCED=True for both
kubectl -n jbod-monitor get secret jbod-mqtt -o jsonpath='{.data.MQTT_USERNAME}' | base64 -d
# 4. Roll the web container so it picks up the secret (if it started first):
# 4. Roll the DaemonSet so pods pick up the secrets if they raced ahead:
kubectl -n jbod-monitor rollout restart daemonset/jbod-monitor
```