feat(vault): switch to nfs snapshots

[jazzlyn]

No description provided.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[tyriis-automation]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ EDITORCONFIG	editorconfig-checker	5		0	0.02s
✅ REPOSITORY	gitleaks	yes		no	2.95s
✅ YAML	prettier	5		0	0.43s
✅ YAML	yamllint	5		0	0.43s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security

[tyriis-automation]

--- kubernetes/talos-flux/apps/kube-system/csi-driver-nfs/app Kustomization: flux-system/apps-csi-driver-nfs HelmRelease: kube-system/csi-driver-nfs

+++ kubernetes/talos-flux/apps/kube-system/csi-driver-nfs/app Kustomization: flux-system/apps-csi-driver-nfs HelmRelease: kube-system/csi-driver-nfs

@@ -28,7 +28,11 @@

     cleanupOnFail: true
     remediation:
       retries: 3
   values:
     externalSnapshotter:
       enabled: false
+    volumeSnapshotClass:
+      create: true
+      deletionPolicy: Delete
+      name: nfs-csi-snapshot
 
--- kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault HelmRelease: secops/vault

+++ kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault HelmRelease: secops/vault

@@ -44,13 +44,13 @@

         size: 1Gi
         storageClass: ceph-block
       dataStorage:
         enabled: true
         mountPath: /vault/data
         size: 1Gi
-        storageClass: ceph-block
+        storageClass: nfs-csi
       extraEnvironmentVars:
         TZ: Europe/Vienna
       extraLabels:
         reloader.stakater.com/auto: 'true'
       ha:
         enabled: true
--- kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault PersistentVolumeClaim: secops/data-vault-0

+++ kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault PersistentVolumeClaim: secops/data-vault-0

@@ -14,8 +14,8 @@

     apiGroup: volsync.backube
     kind: ReplicationDestination
     name: data-vault-0
   resources:
     requests:
       storage: 1Gi
-  storageClassName: ceph-block
+  storageClassName: nfs-csi
 
--- kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault ReplicationSource: secops/data-vault-0

+++ kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault ReplicationSource: secops/data-vault-0

@@ -11,23 +11,23 @@

   restic:
     accessModes:
     - ReadWriteOnce
     cacheAccessModes:
     - ReadWriteOnce
     cacheCapacity: 1Gi
-    cacheStorageClassName: ceph-block
+    cacheStorageClassName: nfs-csi
     copyMethod: Snapshot
     moverSecurityContext:
       fsGroup: 1000
       runAsGroup: 1000
       runAsUser: 1000
     pruneIntervalDays: 14
     repository: vault-volsync
     retain:
       daily: 7
       hourly: 24
-    storageClassName: ceph-block
-    volumeSnapshotClassName: csi-ceph-blockpool
+    storageClassName: nfs-csi
+    volumeSnapshotClassName: nfs-csi-snapshot
   sourcePVC: data-vault-0
   trigger:
     schedule: 0 * * * *
 
--- kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault ReplicationDestination: secops/data-vault-0

+++ kubernetes/talos-flux/apps/secops/vault/app Kustomization: flux-system/vault ReplicationDestination: secops/data-vault-0

@@ -12,22 +12,22 @@

   restic:
     accessModes:
     - ReadWriteOnce
     cacheAccessModes:
     - ReadWriteOnce
     cacheCapacity: 1Gi
-    cacheStorageClassName: ceph-block
+    cacheStorageClassName: nfs-csi
     capacity: 1Gi
     cleanupCachePVC: true
     cleanupTempPVC: true
     copyMethod: Snapshot
     enableFileDeletion: true
     moverSecurityContext:
       fsGroup: 1000
       runAsGroup: 1000
       runAsUser: 1000
     repository: vault-volsync
-    storageClassName: ceph-block
-    volumeSnapshotClassName: csi-ceph-blockpool
+    storageClassName: nfs-csi
+    volumeSnapshotClassName: nfs-csi-snapshot
   trigger:
     manual: restore-once

[tyriis-automation]

--- HelmRelease: kube-system/csi-driver-nfs VolumeSnapshotClass: kube-system/nfs-csi-snapshot

+++ HelmRelease: kube-system/csi-driver-nfs VolumeSnapshotClass: kube-system/nfs-csi-snapshot

@@ -0,0 +1,8 @@

+---
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+  name: nfs-csi-snapshot
+driver: nfs.csi.k8s.io
+deletionPolicy: Delete
+
--- HelmRelease: secops/vault StatefulSet: secops/vault

+++ HelmRelease: secops/vault StatefulSet: secops/vault

@@ -157,13 +157,13 @@

     spec:
       accessModes:
       - ReadWriteOnce
       resources:
         requests:
           storage: 1Gi
-      storageClassName: ceph-block
+      storageClassName: nfs-csi
   - metadata:
       name: audit
     spec:
       accessModes:
       - ReadWriteOnce
       resources: