Add Harbor/Ceph runbooks and align single-node Ceph docs with abr deployment.

Document registry ingress split, image mirroring, loop OSD setup, and platform integration paths.
2026-07-01 00:22:06 +03:30
parent 8d1855b89c
commit ee5bd0a291
21 changed files with 2124 additions and 2 deletions
@@ -0,0 +1,113 @@
+{{- if and .Values.platform.createCredentialsSecret .Values.objectStore.claimName }}
+# Stable secret name for platform workers. Populated by a post-install Job once the OBC secret exists.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
+  namespace: {{ .Values.namespace }}
+  labels:
+    {{- include "cloudhost-ceph.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "1"
+    helm.sh/hook-delete-policy: before-hook-creation
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
+  namespace: {{ .Values.namespace }}
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "1"
+    helm.sh/hook-delete-policy: before-hook-creation
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "create", "patch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
+  namespace: {{ .Values.namespace }}
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "1"
+    helm.sh/hook-delete-policy: before-hook-creation
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
+    namespace: {{ .Values.namespace }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
+  namespace: {{ .Values.namespace }}
+  labels:
+    {{- include "cloudhost-ceph.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "10"
+    helm.sh/hook-delete-policy: before-hook-creation
+spec:
+  backoffLimit: 30
+  template:
+    spec:
+      serviceAccountName: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
+      restartPolicy: OnFailure
+      containers:
+        - name: sync
+          image: registry.abrban.com/proxy-dockerhub/bitnami/kubectl:1.32
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: OBC_SECRET
+              value: {{ printf "obc-%s-%s" .Values.namespace .Values.objectStore.claimName | quote }}
+            - name: TARGET_SECRET
+              value: {{ .Values.platform.credentialsSecretName | quote }}
+            - name: NAMESPACE
+              value: {{ .Values.namespace | quote }}
+            - name: ENDPOINT
+              value: {{ .Values.platform.endpoint | quote }}
+            - name: REGION
+              value: {{ .Values.platform.region | quote }}
+          command:
+            - /bin/bash
+            - -ec
+            - |
+              echo "Waiting for OBC secret ${OBC_SECRET} in ${NAMESPACE}..."
+              for i in $(seq 1 120); do
+                if kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" >/dev/null 2>&1; then
+                  break
+                fi
+                sleep 10
+              done
+              kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" >/dev/null
+
+              BUCKET=$(kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" -o jsonpath='{.data.BUCKET_NAME}' | base64 -d)
+              ACCESS=$(kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | base64 -d)
+              SECRET=$(kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}' | base64 -d)
+
+              cat <<EOF | kubectl apply -f -
+              apiVersion: v1
+              kind: Secret
+              metadata:
+                name: ${TARGET_SECRET}
+                namespace: ${NAMESPACE}
+                labels:
+                  app.kubernetes.io/part-of: cloudhost
+              type: Opaque
+              stringData:
+                SOURCE_STORAGE_ENDPOINT: "${ENDPOINT}"
+                SOURCE_STORAGE_REGION: "${REGION}"
+                SOURCE_STORAGE_BUCKET: "${BUCKET}"
+                SOURCE_STORAGE_ACCESS_KEY: "${ACCESS}"
+                SOURCE_STORAGE_SECRET_KEY: "${SECRET}"
+              EOF
+              echo "Synced bucket credentials to secret ${TARGET_SECRET} (bucket=${BUCKET})"
+{{- end }}