jakman85andClaude Opus 4.8
cbc2301b30
Text-only cleanup after the upgrade campaign. Updates stale version strings, prose, and comments to the verified current facts; no Kubernetes behavior or version pins changed except the kubectl toolchain bump (below). Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie, Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB, dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18, Grafana 13.2.0. - Version strings across infra/ and platform/ READMEs + comments - kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew) - Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh) - COMPLETED/historical banners on the three executed plan docs - Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges - Appended dated DECISIONS-LOG entry (2026-08-30) superseding the 2026-08-26 LIVE STATE line Left as revalidation items (not blind-edited): external-snapshotter v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1, conformance ImageVolume feature-gate assertions under 1.36. Co-Authored-By: Claude Opus 4.8 <[email protected]>
46 lines
3.1 KiB
YAML
46 lines
3.1 KiB
YAML
---
|
|
# external-snapshotter — the cluster-wide CSI snapshot control plane (Phase 2, storage).
|
|
#
|
|
# WHY: Longhorn's CSI driver (driver.longhorn.io) can create CSI VolumeSnapshots, but the
|
|
# `snapshot.storage.k8s.io` API (VolumeSnapshot / VolumeSnapshotContent / VolumeSnapshotClass)
|
|
# and the snapshot-controller that reconciles them are NOT part of k3s or of Longhorn — they are
|
|
# a SEPARATE, cluster-singleton component (kubernetes-csi/external-snapshotter). Without it the
|
|
# CRDs are absent (only `snapshots.longhorn.io` + the kubevirt.io snapshot CRDs exist), so:
|
|
# * no VolumeSnapshotClass can be created (item 2), and
|
|
# * CDI cannot do SNAPSHOT smart-clone (item 3) — it falls back to slow host-assisted `copy`,
|
|
# which leaves the default virt StorageClass "degraded" (CDIDefaultStorageClassDegraded).
|
|
# Installing it here (controllers pass) registers the CRDs; the VolumeSnapshotClass + the CDI
|
|
# StorageProfiles that CONSUME them are applied by platform-config (dependsOn: platform).
|
|
#
|
|
# CONTROLLERS/CONFIGS SPLIT (F-MON1): this is the CONTROLLERS half. The snapshot.storage.k8s.io
|
|
# CRDs are registered by the `client/config/crd` base below; the snapshot-controller Deployment
|
|
# (into kube-system, upstream default) reconciles VolumeSnapshots. Custom resources that use these
|
|
# CRDs (the Longhorn VolumeSnapshotClass, item 2) live in platform-config so the CRDs exist first.
|
|
#
|
|
# VERSION (Renovate-maintained): external-snapshotter v8.2.0.
|
|
# * The v8.x line updated its Kubernetes deps to 1.31 at v8.1.0. This cluster is now k3s v1.36.4,
|
|
# so the v8.2.0 pin is NO LONGER verified against the running Kubernetes version — RE-CHECK it
|
|
# for 1.36 (a newer external-snapshotter line may be the version-matched choice). Pin left as-is
|
|
# pending that revalidation.
|
|
# * snapshot.storage.k8s.io CRDs are served at v1 (GA) — driver.longhorn.io speaks v1, so
|
|
# Longhorn CSI snapshots + CDI snapshot-clone work against these CRDs.
|
|
# * The upstream setup manifest pins the controller image to an older v8.0.x tag; the `images`
|
|
# transformer below re-pins it to v8.2.0 so the running controller matches the CRD version.
|
|
# * The `client/config/crd` base also ships the beta VolumeGroupSnapshot CRDs; that feature is
|
|
# gated OFF in the controller (no --enable-volume-group-snapshots arg), so they are inert.
|
|
#
|
|
# Kustomize loads these as REMOTE bases (github.com/...?ref=<tag>) — the same remote-manifest
|
|
# pattern platform/kubevirt uses for the KubeVirt/CDI operators; Flux's kustomize-controller
|
|
# fetches them identically at reconcile.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
# renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
|
|
- https://github.com/kubernetes-csi/external-snapshotter/client/config/crd?ref=v8.2.0
|
|
# renovate: datasource=github-releases depName=kubernetes-csi/external-snapshotter
|
|
- https://github.com/kubernetes-csi/external-snapshotter/deploy/kubernetes/snapshot-controller?ref=v8.2.0
|
|
images:
|
|
# Re-pin the controller image to the base ref so controller == CRD version (see header note).
|
|
- name: registry.k8s.io/sig-storage/snapshot-controller
|
|
newTag: v8.2.0
|