### Example of Migrated Resources

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/2-collect-information/index.html

This snippet shows an example of the resources that will be saved to `v2-resources.yaml` after the upgrade, including cluster configuration.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  linstorPassphraseSecret: piraeus-passphrase
  patches: []
...
```

--------------------------------

### Example Output of Data Collection Script

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/2-collect-information/index.html

This is an example of the output you might see from the data collection script, showing resource differences and prompts for confirmation.

```diff
Using kubectl context: kubernetes-admin@kubernetes Found LinstorControllers: ["piraeus-cs"] Found LinstorSatelliteSets: ["piraeus-ns"] Found LinstorCSIDrivers: ["piraeus"] Found additional environment variables passed to LINSTOR Controller -- Default resource +++ Updated resource @@ -143,6 +143,12 @@ kind: Deployment        - args:          - startController          env: +        - name: FOO +          value: bar +        - name: EXAMPLE +          valueFrom: +            fieldRef: +              fieldPath: status.podIP          - name: JAVA_OPTS            value: -Djdk.tls.acknowledgeCloseNotify=true          - name: K8S_AWAIT_ELECTION_ENABLED Apply the patch (Y/n)? y ...
```

--------------------------------

### Install Piraeus Operator

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/get-started/index.html

Use this command to install the Piraeus Operator using its Kustomization manifest. The operator will be installed in the 'piraeus-datastore' namespace.

```bash
kubectl apply --server-side -f "https://github.com/piraeusdatastore/piraeus-operator/releases/latest/download/manifest.yaml"
```

--------------------------------

### Configure Satellite Pod Template

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorsatelliteconfiguration/index.html

This example configures resource requests for the satellite pod and enables host networking. It is applied as a patch to the default resources.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: resource-and-host-network
spec:
  podTemplate:
    spec:
      hostNetwork: true
      containers:
        - name: linstor-satellite
          resources:
            requests:
              cpu: 100m
```

--------------------------------

### Clone Piraeus Operator and Install with Helm

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/4-install-operator-v2/index.html

Clone the Piraeus Operator repository and install it using Helm, setting installCRDs to true to include necessary Custom Resource Definitions.

```bash
$ git clone -b v2.3.0 https://github.com/piraeusdatastore/piraeus-operator.git
$ cd piraeus-operator
$ helm install piraeus-operator charts/piraeus --set installCRDs=true
```

--------------------------------

### Install Kernel Headers on Ubuntu

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/install-kernel-headers/index.html

Installs the specific kernel headers for the currently running kernel on Ubuntu using apt. It's recommended to also install the 'linux-headers-virtual' package to ensure headers are updated with kernel upgrades.

```bash
$ sudo apt-get update $ sudo apt-get install -y linux-headers-$(uname -r)
```

--------------------------------

### LINSTOR Controller Container Configuration Example

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/explanation/image-configuration/index.html

Illustrates how the LINSTOR Controller deployment references its container image, which is dynamically replaced by the Piraeus Operator based on the image configuration.

```yaml
# ...       containers:
        - name: linstor-controller
          # will be replaced with:
          # image: quay.io/piraeusdatastore/piraeus-server:v1.31.0
          image: linstor-controller
# ...
```

--------------------------------

### Install Kernel Headers on Debian

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/install-kernel-headers/index.html

Use apt to update package lists and install virtual kernel headers. This is a general command for Debian-based systems.

```bash
$ sudo apt-get update $ sudo apt-get install -y linux-headers-virtual
```

--------------------------------

### Check ktls-utils Container Logs

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/drbd-tls/index.html

Verify that the ktls-utils container is running and has started successfully.

```bash
$ kubectl logs -l app.kubernetes.io/component=linstor-satellite -c ktls-utils
```

--------------------------------

### Install Kernel Headers for Architecture on Debian

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/install-kernel-headers/index.html

Installs kernel headers for the system's architecture. This is useful for ensuring headers are available for upgrades.

```bash
$ sudo apt-get update $ sudo apt-get install -y linux-headers-$(dpkg --print-architecture)
```

--------------------------------

### Scale Up Deployment

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/snapshots/index.html

Increase the number of replicas for a deployment to one. This will start a new pod that will use the restored volume.

```bash
$ kubectl scale deploy/volume-logger --replicas=1 deployment.apps/volume-logger scaled
```

--------------------------------

### Install Linstor Cluster with Helm

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/helm/index.html

Deploy the Piraeus Datastore Linstor cluster using the provided Helm chart. This command installs or upgrades the 'linstor-cluster' release in the 'piraeus-datastore' namespace.

```bash
helm upgrade --install --namespace piraeus-datastore linstor-cluster oci://ghcr.io/piraeusdatastore/helm-charts/linstor-cluster
```

--------------------------------

### Configure Satellite TLS with a Secret

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorsatelliteconfiguration/index.html

This example demonstrates creating a manually provisioned TLS secret and referencing it in the LinstorSatelliteConfiguration to secure communication between LINSTOR Satellites and the Controller. The secret must contain `ca.crt`, `tls.crt`, and `tls.key`.

```yaml
---
apiVersion: v1
kind: Secret
metadata:
  name: my-node-tls
  namespace: piraeus-datastore
data:
  ca.crt: LS0tLS1CRUdJT...
  tls.crt: LS0tLS1CRUdJT...
  tls.key: LS0tLS1CRUdJT...
---
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: satellite-tls
spec:
  internalTLS:
    secretName: my-node-tls
```

--------------------------------

### Check for Existing Kernel Headers

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/install-kernel-headers/index.html

Run this command to verify if the kernel headers for the current running kernel are already installed. If 'found headers' is printed, no further action is needed.

```bash
$ test -d /lib/modules/$(uname -r)/build/ && echo found headers
```

--------------------------------

### Apply Patches to Satellite Configuration

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorsatelliteconfiguration/index.html

This example configures the LINSTOR Satellite to use the "TRACE" log level for verbose output by patching the satellite-config ConfigMap.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: all-satellites
spec:
  patches:
    - target:
        kind: ConfigMap
        name: satellite-config
      patch: |-
        apiVersion: v1
        kind: ConfigMap
        metadata:
          name: satellite-config
        data:
          linstor_satellite.toml: |
            [logging]
              linstor_level = "TRACE"
```

--------------------------------

### Configure LINSTOR Storage Pools

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorsatelliteconfiguration/index.html

This example configures multiple LINSTOR Storage Pools, including LVM, LVM Thin, File System, File System Thin, ZFS, and ZFS Thin pools. It demonstrates specifying existing volume groups, thin pool configurations, creating pools from raw devices, and setting custom properties.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: storage-satellites
spec:
  storagePools:
    - name: vg1
      lvmPool: {}
    - name: vg1-thin
      lvmThinPool:
        volumeGroup: vg1
        thinPool: thin
    - name: vg2-from-raw-devices
      lvmPool:
        volumeGroup: vg2
      source:
        hostDevices:
          - /dev/sdb
          - /dev/sdc
      properties:
        - name: StorDriver/LvcreateOptions
          value: '-i 2'
    - name: fs1
      filePool: {}
    - name: fs2
      fileThinPool:
        directory: /mnt/data
    - name: zfs1
      zfsPool: {}
    - name: zfs2
      zfsThinPool:
        zPool: zfs-thin2
      source:
        hostDevices:
        - /dev/sdd
```

--------------------------------

### Install Kernel Development Packages for Upgrades on RHEL

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/install-kernel-headers/index.html

Installs kernel-devel packages to ensure kernel headers are included during system upgrades on RHEL-based systems.

```bash
$ sudo dnf install -y kernel-devel
```

--------------------------------

### Install or Upgrade Piraeus Operator with Helm

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/helm/index.html

Use this command to install or upgrade the Piraeus Operator in the 'piraeus-datastore' namespace. It ensures necessary CRDs are created and waits for the deployment to complete.

```bash
helm upgrade --install --create-namespace --namespace piraeus-datastore piraeus-operator oci://ghcr.io/piraeusdatastore/piraeus-operator/piraeus --set installCRDs=true --wait
```

--------------------------------

### Install LINSTOR Affinity Controller

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/linstor-affinity-controller/index.html

Deploy the LINSTOR Affinity Controller using Helm after adding the repository. If deployed in the same namespace as the Piraeus Operator, connection parameters are usually auto-detected.

```bash
helm install linstor-affinity-controller piraeus-charts/linstor-affinity-controller
```

--------------------------------

### Upgrade Piraeus with Helm

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/index.html

Standard command to upgrade Piraeus using Helm. Ensure to pass any custom override options used during installation.

```bash
helm upgrade piraeus-op ./charts/piraeus -f <overrides>
```

--------------------------------

### Add Piraeus Datastore Helm Repository

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/linstor-affinity-controller/index.html

Run this command to add the Piraeus Datastore Helm chart repository to your Helm configuration. This makes the LINSTOR Affinity Controller chart available for installation.

```bash
helm repo add piraeus-charts https://piraeus.io/helm-charts/
```

--------------------------------

### Apply Patches to LINSTOR Resources

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorcluster/index.html

Applies custom patches to resources managed by the operator. This example sets a CPU limit for the CSI Node init container and configures the LINSTOR Controller service for SingleStack mode. Patches are applied as-is, so exercise caution.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  patches:
    - target:
        kind: Daemonset
        name: csi-node
      patch: |-
        - op: add
          path: /spec/template/spec/initContainers/0/resources
          value:
            limits:
              cpu: 10m
    - target:
        kind: Service
        name: linstor-controller
      patch: |-
        apiVersion: v1
        kind: service
        metadata:
          name: linstor-controller
        spec:
          ipFamilyPolicy: SingleStack
```

--------------------------------

### Configure LINSTOR Satellite Properties

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorsatelliteconfiguration/index.html

This example demonstrates setting various properties on LINSTOR Satellites. It includes direct value assignment, inheriting from node labels and annotations, and expanding node labels into multiple properties.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: ipv6-nodes
spec:
  properties:
    - name: PrefNic
      value: "default-ipv6"
    - name: Aux/example-property
      valueFrom:
        nodeFieldRef: metadata.labels['piraeus.io/example']
    - name: AutoplaceTarget
      valueFrom:
        nodeFieldRef: metadata.annotations['piraeus.io/autoplace']
      optional: yes
    - name: Aux/role/
      expandFrom:
        nodeFieldRef: metadata.labels['node-role.kubernetes.io/*']
        nameTemplate: "$1"
        valueTemplate: "$2"
    - name: Aux/features
      expandFrom:
        nodeFieldRef: metadata.labels['feature.example.com/*']
        valueTemplate: "$1"
        delimiter: ","
```

--------------------------------

### Install Kernel Development Packages on RHEL

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/install-kernel-headers/index.html

Installs kernel-devel packages for Red Hat Enterprise Linux and compatible distributions using dnf. This command installs headers for the current kernel.

```bash
$ sudo dnf install -y kernel-devel-$(uname -r)
```

--------------------------------

### Import Certificate to Machine Owner Key (MOK)

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/secure-boot/index.html

Enroll the generated certificate into the machine's trust store using `mokutil`. You will be prompted to enter and confirm a password.

```bash
# mokutil --import signing_key.x509 input password:
input password again:
```

--------------------------------

### Download and Run Data Collection Script

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/2-collect-information/index.html

Use this command to download and execute the script that collects information for the migration. It will prompt for confirmation on resource modifications.

```bash
$ curl --proto '=https' --tlsv1.2 -sSf   https://piraeus.io/docs/v2/how-to/upgrade/collect-operator-v1-information.sh   | bash -s
```

--------------------------------

### Verify Logged Data

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/snapshots/index.html

After creating the workload, wait for the Pod to become ready and then execute a command to view the logged data within the volume.

```bash
$ kubectl wait pod --for=condition=Ready -l app.kubernetes.io/name=volume-logger pod/volume-logger-cbcd897b7-jrmks condition met
```

```bash
$ kubectl exec deploy/volume-logger -- cat /volume/hello
```

--------------------------------

### Wait for Piraeus Datastore Pods to be Ready

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/get-started/index.html

This command waits for all Piraeus Datastore related pods, including the controller manager and CSI components, to be in a Ready state within the 'piraeus-datastore' namespace.

```bash
kubectl wait pod --for=condition=Ready -n piraeus-datastore -l app.kubernetes.io/name=piraeus-datastore
```

--------------------------------

### Create Deployment for Volume Consumer

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/get-started/index.html

Deploy a simple Nginx web server that mounts the 'data-volume' PersistentVolumeClaim at '/usr/share/nginx/html'. This Pod acts as the consumer needed to bind the PVC.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-server
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: web-server
  template:
    metadata:
      labels:
        app.kubernetes.io/name: web-server
    spec:
      containers:
        - name: web-server
          image: nginx
          volumeMounts:
            - mountPath: /usr/share/nginx/html
              name: data
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: data-volume
```

--------------------------------

### Import LINSTOR Database from Backup

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/1-migrate-database/index.html

Use the linstor-database tool to import the database from a JSON backup file. This command should be executed within the migration pod.

```bash
$ kubectl exec linstor-database-migration -- /usr/share/linstor-server/bin/linstor-database import-db -c /etc/linstor /backup/backup-before-migration.json
```

--------------------------------

### Check Piraeus Operator Version

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/drbd-tls/index.html

Verify the installed Piraeus Operator version. Requires Operator version >= 2.3.0.

```bash
$ kubectl get pods -l app.kubernetes.io/component=piraeus-operator -ojsonpath='{.items[*].spec.containers[?(@.name=="manager")].image}{"\n"}'
```

--------------------------------

### Verify Volume Mount in Pod

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/get-started/index.html

Check the filesystem within the running web server Pod to confirm that the volume is mounted at the expected path and shows available capacity.

```bash
$ kubectl exec deploy/web-server -- df -h /usr/share/nginx/html Filesystem      Size  Used Avail Use% Mounted on /dev/drbd1000   973M   24K  906M   1% /usr/share/nginx/html
```

--------------------------------

### Set LINSTOR Controller Properties

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorcluster/index.html

Sets cluster-wide properties on the LINSTOR Controller. This example configures the port range for DRBD® volumes.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  properties:
    - name: TcpPortAutoRange
      value: "10000-20000"
```

--------------------------------

### List Piraeus Datastore Pods and Components

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/explanation/components/index.html

Use this kubectl command to list all running pods in your cluster and their corresponding Piraeus Datastore component labels. This helps in identifying and managing individual Piraeus components.

```bash
$ kubectl get pods '-ocustom-columns=NAME:.metadata.name,COMPONENT:.metadata.labels.app\.kubernetes\.io/component'
NAME                                                   COMPONENT
ha-controller-vd82w                                    ha-controller
linstor-affinity-controller-c84cf8958-p5wjx            linstor-affinity-controller
linstor-controller-6c8f8dc47-cm8hr                     linstor-controller
linstor-csi-controller-59b9968b86-ftl76                linstor-csi-controller
linstor-csi-nfs-server-n64jv                           linstor-csi-nfs-server
linstor-csi-node-hcmk9                                 linstor-csi-node
linstor-satellite-k8s-10.test-66687                    linstor-satellite
piraeus-operator-controller-manager-6dcfcb4568-6jntp   piraeus-operator
piraeus-operator-gencert-59449cb449-nzg6z              piraeus-operator-gencert
```

--------------------------------

### Apply Kustomization and Rollout Status

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/4-install-operator-v2/index.html

Apply the Kustomization configuration using kubectl and monitor the deployment's rollout status.

```bash
$ kubectl apply -k . --server-side
$ kubectl rollout status -n piraeus-datastore -w deploy/piraeus-operator-controller-manager
```

--------------------------------

### Create StorageClass, PVC, and Deployment

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/snapshots/index.html

This snippet defines a StorageClass for Piraeus, a PersistentVolumeClaim, and a Deployment for a volume logger workload. Ensure your StorageClass name matches the PVC.

```yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: piraeus-storage
provisioner: linstor.csi.linbit.com
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer
parameters:
  linstor.csi.linbit.com/storagePool: pool1
---
aspiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data-volume
spec:
  storageClassName: piraeus-storage
  resources:
    requests:
      storage: 1Gi
  accessModes:
    - ReadWriteOnce
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: volume-logger
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: volume-logger
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: volume-logger
    spec:
      terminationGracePeriodSeconds: 0
      containers:
        - name: volume-logger
          image: busybox
          args:
            - sh
            - -c
            - |
              echo "Hello from $HOSTNAME, running on $NODENAME, started at $(date)" >> /volume/hello
              # We use this to keep the Pod running
              tail -f /dev/null
          env:
            - name: NODENAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - mountPath: /volume
              name: data-volume
      volumes:
        - name: data-volume
          persistentVolumeClaim:
            claimName: data-volume
```

--------------------------------

### Retrieve Helm-Generated LINSTOR Passphrase

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/2-collect-information/index.html

Use this kubectl command to get the LINSTOR passphrase generated by Helm. This is crucial for migrating to Piraeus Operator v2.

```bash
$ kubectl get secrets piraeus-op-passphrase -ogo-template='{{.data.MASTER_PASSPHRASE}}{"\n"}}' ZVRxanl1cVBscXV1ZTk1cmEwVTk5b0ptd0F4OGFmWlVPUVA0NWNnUw==
```

--------------------------------

### Generate Key Material with OpenSSL

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/secure-boot/index.html

Create a private key and a self-signed certificate for signing kernel modules. The certificate is valid for 10 years.

```bash
$ openssl req -x509 -new -nodes -utf8 -sha256 -days 36500 -batch -outform DER \
     -out signing_key.x509 -keyout signing_key.pem -config - <<EOF [ req ] default_bits = 4096 distinguished_name = req_distinguished_name prompt = no string_mask = utf8only x509_extensions = myexts  [ req_distinguished_name ] O = Piraeus Datastore CN = Piraeus Datastore kernel module signing key emailAddress = piraeus-signing-key@example.com  [ myexts ] basicConstraints=critical,CA:FALSE keyUsage=digitalSignature subjectKeyIdentifier=hash authorityKeyIdentifier=keyid EOF
```

--------------------------------

### Verify DRBD Module Loading

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/secure-boot/index.html

Check the logs of the `drbd-module-loader` init container to confirm that the DRBD modules have been loaded successfully after signing.

```bash
$ kubectl logs ds/linstor-satellite.node1.example.com drbd-module-loader ... DRBD version loaded: version: 9.2.8 (api:2/proto:86-122) GIT-hash: e163b05a76254c0f51f999970e861d72bb16409a build by @linstor-satellite.k8s-21.test-zskzl, 2024-04-03 09:04:15 Transports (api:20): tcp (9.2.8) lb-tcp (9.2.8) rdma (9.2.8)
```

--------------------------------

### Deploy Piraeus Operator with Kustomize

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/4-install-operator-v2/index.html

Use kubectl and Kustomize to deploy the Piraeus Operator. Ensure the version and namespace in kustomization.yaml are set correctly.

```yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/piraeusdatastore/piraeus-operator//config/default?ref=v2.3.0 # Change the version here
namespace: piraeus-datastore # Change the namespace here
```

--------------------------------

### Configure LinstorSatelliteConfiguration for Module Signing

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/secure-boot/index.html

Mount the signing key secret into the `drbd-module-loader` init container and set the `LB_SIGN` environment variable to enable kernel module signing.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: drbd-module-signing
spec:
  podTemplate:
    spec:
      initContainers:
      - name: drbd-module-loader
        env:
        - name: LB_SIGN
          value: /signing-key
        volumeMounts:
        - name: signing-key
          mountPath: /signing-key
          readOnly: true
      volumes:
      - name: signing-key
        secret:
          secretName: drbd-signing-keys
```

--------------------------------

### Port-forward Grafana Service

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/monitoring/index.html

Forward the Grafana service to your local port 3000 to access the Grafana dashboard. Use 'admin' and 'prom-operator' as credentials if using the example deployment.

```bash
$ kubectl port-forward -n monitoring services/prometheus-grafana 3000:http-web
```

--------------------------------

### Show Helm Chart Values

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/helm/index.html

Use this command to display all configurable values for the Piraeus Datastore Helm chart. This helps in understanding customization options before deployment.

```bash
helm show values oci://ghcr.io/piraeusdatastore/piraeus-operator/piraeus
```

```bash
helm show values oci://ghcr.io/piraeusdatastore/helm-charts/linstor-cluster
```

--------------------------------

### Check Current LINSTOR Database Backend

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/1-migrate-database/index.html

Use this command to check the currently used backend of your LINSTOR cluster. If the connection_url starts with 'etcd://', migration is recommended.

```bash
$ kubectl exec deploy/piraeus-op-cs-controller -- cat /etc/linstor/linstor.toml [db]   connection_url = "etcd://piraeus-op-etcd:2379"
```

--------------------------------

### Configure Satellite TLS with Cert-Manager

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorsatelliteconfiguration/index.html

This example shows how to configure LINSTOR Satellite TLS secrets to be automatically created by cert-manager. It references an existing cert-manager Issuer named `piraeus-root`.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: satellite-tls
spec:
  internalTLS:
    certManager:
      kind: Issuer
      name: piraeus-root
```

--------------------------------

### Automatic TLS Secret Creation with Cert-Manager

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorcluster/index.html

This example configures the LinstorCluster to automatically create TLS secrets using a cert-manager Issuer. It also specifies a CA reference for certificate validation.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  apiTLS:
    certManager:
      kind: Issuer
      name: piraeus-root
    caReference:
      name: trust-root
      kind: Secret
      key: root.crt

```

--------------------------------

### Backup LINSTOR Controller Database with etcdctl

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/index.html

Create a backup of the LINSTOR Controller database using etcdctl. This is a crucial step before upgrading.

```bash
kubectl exec piraeus-op-etcd-0 -- etcdctl snapshot save /tmp/save.db kubectl cp piraeus-op-etcd-0:/tmp/save.db save.db
```

--------------------------------

### Configure Tolerations for Control Plane Nodes

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/index.html

To restore the old behavior of starting Piraeus Datastore components on control plane nodes, modify the LinstorCluster resource to include specific tolerations.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  tolerations:
  - key: node-role.kubernetes.io/control-plane
    effect: NoSchedule
    operator: Exists
  - key: node-role.kubernetes.io/worker
    effect: NoSchedule
    operator: Exists
```

--------------------------------

### Read Logged Information from Replicated Volume

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/replicated-volumes/index.html

Access the content of the log file within the replicated volume to verify that the Pod has correctly logged its hostname, node name, and start time.

```bash
kubectl exec deploy/volume-logger -- cat /volume/hello
```

--------------------------------

### Deploy kube-prometheus-stack Helm Chart

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/monitoring/index.html

Deploy the kube-prometheus-stack chart to set up Prometheus, AlertManager, and Grafana. Configure it to monitor all namespaces by setting `*NilUsesHelmValues` parameters to false.

```bash
$ helm install --create-namespace -n monitoring prometheus prometheus-community/kube-prometheus-stack \ 
  --set prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false \ 
  --set prometheus.prometheusSpec.podMonitorSelectorNilUsesHelmValues=false \ 
  --set prometheus.prometheusSpec.ruleSelectorNilUsesHelmValues=false
```

--------------------------------

### Get Volume Snapshot Details

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/snapshots/index.html

Retrieve detailed information about a volume snapshot using kubectl. This command shows the snapshot's readiness, source volume, size, and creation time.

```bash
$ kubectl get volumesnapshot data-volume-snapshot-1 NAME                     READYTOUSE   SOURCEPVC     SOURCESNAPSHOTCONTENT   RESTORESIZE   SNAPSHOTCLASS       SNAPSHOTCONTENT                                    CREATIONTIME   AGE data-volume-snapshot-1   true         data-volume                           1Gi           piraeus-snapshots   snapcontent-a8757c1d-cd37-42d2-9557-a24b1222d118   15s            15s
```

--------------------------------

### Configure Evacuation Timeouts

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorsatelliteconfiguration/index.html

This example sets custom timeouts for Satellite evacuation. `attachedVolumeReattachTimeout` is set to one hour, and `unattachedVolumeAttachTimeout` is set to 30 minutes. This configuration requires `deletionPolicy: Evacuate` to be effective.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: evacuation-timeout
spec:
  deletionPolicy: Evacuate
  evacuationStrategy:
    attachedVolumeReattachTimeout: "1h"
    unattachedVolumeAttachTimeout: "30m"
```

--------------------------------

### Apply Piraeus Datastore Monitoring Resources

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/monitoring/index.html

Apply the monitoring and alerting resources for Piraeus Datastore using kubectl. This assumes Prometheus Operator is deployed and configured to watch all namespaces.

```bash
$ kubectl apply --server-side -n piraeus-datastore -k "https://github.com/piraeusdatastore/piraeus-operator//config/extras/monitoring?ref=v2"
```

--------------------------------

### Configure LinstorCluster for External Controller

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/external-controller/index.html

Specify the URL of the external LINSTOR Controller in the `LinstorCluster` resource to connect Piraeus Datastore to an existing LINSTOR setup. Ensure the URL is correct and the controller is reachable.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  externalController:
    url: http://linstor-controller.example.com:3370
```

--------------------------------

### External LINSTOR Cluster Version Output

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/explanation/image-configuration/index.html

Example output from the 'linstor controller version' command, showing the version of an external LINSTOR cluster. This information is used by the Piraeus Operator for automatic tag matching.

```bash
$ linstor controller version
linstor controller 1.31.2; GIT-hash: 6a9a4bb37f547ff73317585a3efa217523e01f43
```

--------------------------------

### Manually Provisioned TLS Secrets for LINSTOR API

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorcluster/index.html

This example demonstrates creating Kubernetes Secrets for LINSTOR API TLS and referencing them in the LinstorCluster configuration. It shows how to use a single secret for multiple API clients.

```yaml
---
apiVersion: v1
kind: Secret
metadata:
  name: my-linstor-api-tls
  namespace: piraeus-datastore
data:
  ca.crt: LS0tLS1CRUdJT...
  tls.crt: LS0tLS1CRUdJT...
  tls.key: LS0tLS1CRUdJT...
---
apiVersion: v1
kind: Secret
metadata:
  name: my-linstor-client-tls
  namespace: piraeus-datastore
data:
  ca.crt: LS0tLS1CRUdJT...
  tls.crt: LS0tLS1CRUdJT...
  tls.key: LS0tLS1CRUdJT...
---
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  apiTLS:
    apiSecretName: my-linstor-api-tls
    clientSecretName: my-linstor-client-tls
    csiControllerSecretName: my-linstor-client-tls
    csiNodeSecretName: my-linstor-client-tls
    affinityControllerSecretName: my-linstor-client-tls
    nfsServerSecretName: my-linstor-client-tls

```

--------------------------------

### Set Satellite Deletion Policy to Evacuate

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorsatelliteconfiguration/index.html

This example configures the LINSTOR Satellite deletion policy to `Evacuate`. This policy attempts to move all deployed resources to a replacement node before removing the Satellite, requiring spare capacity.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: satellite-deletion-policy
spec:
  deletionPolicy: Evacuate
```

--------------------------------

### Verify linstor-csi-controller Deployment URL

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/external-controller/index.html

Inspect the 'linstor-csi-controller' Deployment to ensure the LS_CONTROLLERS environment variable is set to the correct external controller URL.

```bash
$ kubectl get -n piraeus-datastore deployment linstor-csi-controller -ojsonpath='{.spec.template.spec.containers[?(@.name=="linstor-csi")].env[?(@.name=="LS_CONTROLLERS")].value}{"\n"}'
http://linstor-controller.example.com:3370
```

--------------------------------

### Apply Piraeus Datastore Cluster Resources

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/4-install-operator-v2/index.html

Apply the Piraeus Datastore Cluster resources, including LinstorCluster and LinstorSatelliteConfiguration, using kubectl.

```bash
$ kubectl apply -f v2-resources.yaml --server-side
linstorcluster.piraeus.io/linstorcluster created
linstorsatelliteconfiguration.piraeus.io/host-networking created
linstorsatelliteconfiguration.piraeus.io/piraeus-op-ns created
```

--------------------------------

### Get LINSTOR Controller Image, ConfigMap, and Service Account

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/migration/1-migrate-database/index.html

Retrieves essential information about the LINSTOR Controller deployment, including its image, ConfigMap name, and service account. This information is needed to configure the migration pod.

```bash
$ kubectl get deploy/piraeus-op-cs-controller --output=jsonpath='IMAGE={$.spec.template.spec.containers[?(@.name=="linstor-controller")].image}{"\n"}CONFIG_MAP={$.spec.template.spec.volumes[?(@.name=="linstor-conf")].configMap.name}{"\n"}SERVICE_ACCOUNT={$.spec.template.spec.serviceAccountName}{"\n"}' IMAGE=quay.io/piraeusdatastore/piraeus-server:v1.24.2 CONFIG_MAP=piraeus-op-cs-controller-config SERVICE_ACCOUNT=linstor-controller
```

--------------------------------

### Configure LINSTOR Passphrase Secret

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorcluster/index.html

Configures the LINSTOR passphrase secret for encrypted volumes and backup credentials. The secret must exist in the operator's namespace and contain a MASTER_PASSPHRASE entry. Remember to change the example passphrase.

```yaml
---
apiVersion: v1
kind: Secret
metadata:
  name: linstor-passphrase
  namespace: piraeus-datastore
data:
  # CHANGE THIS TO USE YOUR OWN PASSPHRASE!
  # Created by: echo -n "example-passphrase" | base64
  MASTER_PASSPHRASE: ZXhhbXBsZS1wYXNzcGhyYXNl
---
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  linstorPassphraseSecret: linstor-passphrase
```

--------------------------------

### Configure Node Affinity for Linstor Satellite Pods

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/upgrade/index.html

To restore the old behavior where linstor satellite pods required nodes marked with 'linstor.linbit.com/piraeus-node=true', apply this affinity configuration. This is an example of how to configure pod affinity and tolerations, which are now supported by all CRDs.

```yaml
affinity:  
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
        - key: linstor.linbit.com/piraeus-node
          operator: In
          values:
          - "true"
```

--------------------------------

### Default Image Configuration Structure

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/explanation/image-configuration/index.html

Defines the base repository and component images with tags or digests. The 'match' section allows for OS-specific image selection.

```yaml
base: quay.io/piraeusdatastore
components:
  linstor-controller:
    tag: v1.31.0
    image: piraeus-server
```

```yaml
components:
  drbd-module-loader:
    tag: v9.2.13
    image: drbd9-noble
    match:
      - osImage: Red Hat Enterprise Linux Server 7\.
        image: drbd9-centos7
      - osImage: Red Hat Enterprise Linux 8\.
        image: drbd9-almalinux8
```

--------------------------------

### Configure LINSTOR Controller to Use IPv4 Only

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/reference/linstorsatelliteconfiguration/index.html

This example configures the LINSTOR Controller to exclusively use IPv4 addresses when attempting to connect to LINSTOR Satellites, even within a dual-stack cluster. This is useful for environments with specific network requirements.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: ipv4-only
spec:
  ipFamilies:
  - IPv4
```

--------------------------------

### Create Service Account and RBAC for Piraeus Operator

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/how-to/external-cluster-api/index.html

Creates a Service Account, Role, and RoleBinding in the Management Cluster for the Piraeus Operator. Assumes Cluster API resources are in 'workload-cluster-ns' namespace.

```bash
$ export KUBECONFIG=management.kubeconfig
$ export KUBENS=workload-cluster-ns
$ kubectl --namespace=$KUBENS create serviceaccount piraeus-operator
serviceaccount/piraeus-operator created
$ kubectl --namespace=$KUBENS role piraeus-operator --verb=get,update --resource=machines.cluster.x-k8s.io
role.rbac.authorization.k8s.io/piraeus-operator created
$ kubectl --namespace=$KUBENS create rolebinding piraeus-operator --role=piraeus-operator --serviceaccount=$KUBENS:piraeus-operator
rolebinding.rbac.authorization.k8s.io/piraeus-operator created
```

--------------------------------

### Verify Volume Snapshot Readiness

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/tutorial/snapshots/index.html

Use kubectl to wait for a volume snapshot to be ready for use. This is useful before attempting to restore data from the snapshot.

```bash
$ kubectl wait volumesnapshot --for=jsonpath='{.status.readyToUse}'=true data-volume-snapshot-1 volumesnapshot.snapshot.storage.k8s.io/data-volume-snapshot-1 condition met
```

--------------------------------

### Override Image Configuration with ConfigMap Documents

Source: https://github.com/piraeusdatastore/docs/blob/gh-pages/v2.10.7/explanation/image-configuration/index.html

Add new YAML documents to the Piraeus Operator's image configuration ConfigMap to override specific component images. Ensure filenames start with a higher number (e.g., '1_') than default files to apply overrides last.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: piraeus-operator-image-config
data:
  0_piraeus_datastore_images.yaml: |
    # ...
  0_sig_storage_images.yaml: |
    # ...
  1_override.yaml: |
    ---
    base: quay.io/piraeusdatastore
    components:
      linstor-controller:
        image: piraeus-server
        tag: v1.31.1
      linstor-satellite:
        image: piraeus-server
        digest: sha256:8bc7fd45545744864633371161e6fcd6bcaea1e7a21fb053588f970b9f912b07
```