Piraeus Datastore

https://piraeus.io/docs/stable/
Admin
Piraeus Datastore is a cloud-native storage system that empowers Kubernetes Local Persistent Volumes...
Tokens:75,532
Snippets:877
Trust Score:6.8
Update:6 months ago
Show doc for...
Tokens:
Raw
### Clone and Install Piraeus Operator v2 with Helm

Source: https://piraeus.io/docs/stable/upgrade/migration/4-install-operator-v2?q=

Clone the Piraeus Operator v2 repository and install it using Helm. Set `installCRDs` to `true` to include necessary Custom Resource Definitions.

```bash
$ git clone -b v2.3.0 https://github.com/piraeusdatastore/piraeus-operator.git
$ cd piraeus-operator
$ helm install piraeus-operator charts/piraeus --set installCRDs=true

```

--------------------------------

### Example TLS Session Statistics Output

Source: https://piraeus.io/docs/stable/how-to/drbd-tls?q=

This is an example output from /proc/net/tls_stat. Non-zero values for TlsRxSw and TlsTxSw indicate that TLS sessions are active. If TLS offloading is used, TlsTxDevice and TlsRxDevice might be non-zero instead.

```text
TlsCurrTxSw                         4
TlsCurrRxSw                         4
TlsCurrTxDevice                     0
TlsCurrRxDevice                     0
TlsTxSw                             4
TlsRxSw                             4
TlsTxDevice                         0
TlsRxDevice                         0
TlsDecryptError                     0
TlsRxDeviceResync                   0
TlsDecryptRetry                     0
TlsRxNoPadViolation                 0

```

--------------------------------

### Example of Resources Saved to v2-resources.yaml

Source: https://piraeus.io/docs/stable/upgrade/migration/2-collect-information

This is an example of the LinstorCluster resource definition that will be saved to the `v2-resources.yaml` file after the data collection script runs. It includes configuration for the LINSTOR cluster and its patches.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  linstorPassphraseSecret: piraeus-passphrase
  patches: []
...

```

--------------------------------

### Install Kernel Headers on Ubuntu

Source: https://piraeus.io/docs/stable/how-to/install-kernel-headers

Commands to install specific kernel headers or the virtual package for automatic updates on Ubuntu.

```bash
$ sudo apt-get update
$ sudo apt-get install -y linux-headers-$(uname -r)
```

```bash
$ sudo apt-get update
$ sudo apt-get install -y linux-headers-virtual
```

--------------------------------

### Example Resource Patch Output

Source: https://piraeus.io/docs/stable/upgrade/migration/2-collect-information?q=

This output shows an example of a resource patch generated by the data collection script, highlighting environment variable additions to the LINSTOR Controller deployment. It prompts for user confirmation before applying.

```yaml
Using kubectl context: kubernetes-admin@kubernetes
Found LinstorControllers: ["piraeus-cs"]
Found LinstorSatelliteSets: ["piraeus-ns"]
Found LinstorCSIDrivers: ["piraeus"]
Found additional environment variables passed to LINSTOR Controller
---
- Default resource
+++ Updated resource
@@ -143,6 +143,12 @@
 kind: Deployment
      - args:
        - startController
        env:
+        - name: FOO
+          value: bar
+        - name: EXAMPLE
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
         - name: JAVA_OPTS
           value: -Djdk.tls.acknowledgeCloseNotify=true
         - name: K8S_AWAIT_ELECTION_ENABLED
Apply the patch (Y/n)? y
...

```

--------------------------------

### Configure CSI Controller Deployment

Source: https://piraeus.io/docs/stable/reference/linstorcluster?q=

Configure the CSI Controller deployment, including enabling it, setting the number of replicas, and defining resource requests via a pod template. This example sets 2 replicas and a memory request of 1Gi.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  csiController:
    enabled: true
    replicas: 2
    podTemplate:
      spec:
        containers:
          - name: linstor-csi
            resources:
              requests:
                memory: 1Gi

```

--------------------------------

### Example Output of Data Collection Script

Source: https://piraeus.io/docs/stable/upgrade/migration/2-collect-information

This output shows the script's interaction, including detected Linstor resources and a proposed patch for a deployment's environment variables. It prompts for user confirmation before applying changes.

```yaml
Using kubectl context: kubernetes-admin@kubernetes
Found LinstorControllers: ["piraeus-cs"]
Found LinstorSatelliteSets: ["piraeus-ns"]
Found LinstorCSIDrivers: ["piraeus"]
Found additional environment variables passed to LINSTOR Controller
---
---
--- Default resource
+++ Updated resource
@@ -143,6 +143,12 @@
 kind: Deployment
       - args:
         - startController
+        env:
+        - name: FOO
+          value: bar
+        - name: EXAMPLE
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
         - name: JAVA_OPTS
           value: -Djdk.tls.acknowledgeCloseNotify=true
         - name: K8S_AWAIT_ELECTION_ENABLED
Apply the patch (Y/n)? y
...

```

--------------------------------

### Install Kernel Headers on Debian

Source: https://piraeus.io/docs/stable/how-to/install-kernel-headers

Commands to install specific kernel headers or the architecture-based package for automatic updates on Debian.

```bash
$ sudo apt-get update
$ sudo apt-get install -y linux-headers-$(uname -r)
```

```bash
$ sudo apt-get update
$ sudo apt-get install -y linux-headers-$(dpkg --print-architecture)
```

--------------------------------

### Install Kernel Headers on RHEL and Compatible Distributions

Source: https://piraeus.io/docs/stable/how-to/install-kernel-headers

Commands to install kernel development headers using the dnf package manager on RHEL, AlmaLinux, or Rocky Linux.

```bash
$ sudo dnf install -y kernel-devel-$(uname -r)
```

```bash
$ sudo dnf install -y kernel-devel
```

--------------------------------

### Install Piraeus Operator

Source: https://piraeus.io/docs/stable/tutorial/get-started?q=

Installs Piraeus Operator using kubectl and Kustomize. Ensure you have kubectl version >= 1.22 and Linux kernel headers installed.

```bash
$ kubectl apply --server-side -f "https://github.com/piraeusdatastore/piraeus-operator/releases/latest/download/manifest.yaml"
namespace/piraeus-datastore configured
...
```

--------------------------------

### Upgrade Piraeus with Helm

Source: https://piraeus.io/docs/stable/upgrade?q=

Execute this Helm command to upgrade the Piraeus installation. Ensure you include any custom override values used during the initial installation.

```bash
helm upgrade piraeus-op ./charts/piraeus -f <overrides>

```

--------------------------------

### Backup etcd Database

Source: https://piraeus.io/docs/stable/upgrade

Creates a snapshot of the etcd database and copies it to the local machine before starting the upgrade.

```bash
kubectl exec piraeus-op-etcd-0 -- etcdctl snapshot save /tmp/save.db
kubectl cp piraeus-op-etcd-0:/tmp/save.db save.db
```

--------------------------------

### Configure CSI Node DaemonSet

Source: https://piraeus.io/docs/stable/reference/linstorcluster?q=

Configure the CSI Node DaemonSet, including enabling it and setting resource requests via a pod template. This example sets a memory request of 1Gi.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  csiNode:
    enabled: true
    podTemplate:
      spec:
        containers:
          - name: linstor-csi
            resources:
              requests:
                memory: 1Gi

```

--------------------------------

### Reference Images in Workload Resources

Source: https://piraeus.io/docs/stable/explanation/image-configuration?q=

Example of how component images are referenced in Kubernetes deployment manifests.

```yaml
# ...
      containers:
        - name: linstor-controller
          # will be replaced with:
          # image: quay.io/piraeusdatastore/piraeus-server:v1.31.0
          image: linstor-controller
# ...

```

--------------------------------

### Configure High Availability Controller DaemonSet

Source: https://piraeus.io/docs/stable/reference/linstorcluster?q=

Configure the High Availability Controller DaemonSet, including enabling it and setting resource requests via a pod template. This example sets a memory request of 1Gi.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  highAvailabilityController:
    enabled: true
    podTemplate:
      spec:
        containers:
          - name: ha-controller
            resources:
              requests:
                memory: 1Gi

```

--------------------------------

### Configure Affinity Controller Deployment

Source: https://piraeus.io/docs/stable/reference/linstorcluster?q=

Configure the Affinity Controller deployment, including enabling it, setting the number of replicas, and defining resource requests via a pod template. This example sets 3 replicas and a memory request of 1Gi.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  affinityController:
    enabled: true
    replicas: 3
    podTemplate:
      spec:
        containers:
          - name: linstor-affinity-controller
            resources:
              requests:
                memory: 1Gi

```

--------------------------------

### Deploy LINSTOR Affinity Controller

Source: https://piraeus.io/docs/stable/how-to/linstor-affinity-controller?q=

Deploy the LINSTOR Affinity Controller using the Helm chart. This command installs the controller into the 'piraeus-datastore' namespace.

```bash
helm install linstor-affinity-controller piraeus-charts/linstor-affinity-controller
```

--------------------------------

### Configure LINSTOR Satellite Properties

Source: https://piraeus.io/docs/stable/reference/linstorsatelliteconfiguration

This example configures various LINSTOR satellite properties, including static values, values from node labels/annotations, and expanded properties from labels. Use `optional: yes` to prevent setting the property if the source value is empty.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: ipv6-nodes
spec:
  properties:
    - name: PrefNic
      value: "default-ipv6"
    - name: Aux/example-property
      valueFrom:
        nodeFieldRef: metadata.labels['piraeus.io/example']
    - name: AutoplaceTarget
      valueFrom:
        nodeFieldRef: metadata.annotations['piraeus.io/autoplace']
      optional: yes
    - name: Aux/role/
      expandFrom:
        nodeFieldRef: metadata.labels['node-role.kubernetes.io/*']
        nameTemplate: "$1"
        valueTemplate: "$2"
    - name: Aux/features
      expandFrom:
        nodeFieldRef: metadata.labels['feature.example.com/*']
        valueTemplate: "$1"
        delimiter: ","

```

--------------------------------

### Create StorageClass, PVC, and Deployment

Source: https://piraeus.io/docs/stable/tutorial/snapshots

Provision the storage infrastructure and a sample workload for testing snapshots.

```yaml
$ kubectl apply -f - <<EOF
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: piraeus-storage
provisioner: linstor.csi.linbit.com
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer
parameters:
  linstor.csi.linbit.com/storagePool: pool1
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data-volume
spec:
  storageClassName: piraeus-storage
  resources:
    requests:
      storage: 1Gi
  accessModes:
    - ReadWriteOnce
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: volume-logger
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: volume-logger
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: volume-logger
    spec:
      terminationGracePeriodSeconds: 0
      containers:
        - name: volume-logger
          image: busybox
          args:
            - sh
            - -c
            - |
              echo "Hello from \$HOSTNAME, running on \$NODENAME, started at \$(date)" >> /volume/hello
              # We use this to keep the Pod running
              tail -f /dev/null
          env:
            - name: NODENAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - mountPath: /volume
              name: data-volume
      volumes:
        - name: data-volume
          persistentVolumeClaim:
            claimName: data-volume
EOF
```

--------------------------------

### Verify deployment and volume binding

Source: https://piraeus.io/docs/stable/tutorial/get-started?q=

Waits for the pod to be ready and confirms the PVC is bound.

```bash
$ kubectl wait pod --for=condition=Ready -l app.kubernetes.io/name=web-server
pod/web-server-84867b5449-hgdzx condition met
$ kubectl get persistentvolumeclaim
NAME          STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS      AGE
data-volume   Bound    pvc-9e1149e7-33db-47a7-8fc6-172514422143   1Gi        RWO            piraeus-storage   1m
```

--------------------------------

### Wait for Piraeus Datastore to be Ready

Source: https://piraeus.io/docs/stable/tutorial/get-started?q=

Waits for all Piraeus Datastore related pods to be in a Ready state within the 'piraeus-datastore' namespace.

```bash
$ kubectl wait pod --for=condition=Ready -n piraeus-datastore -l app.kubernetes.io/name=piraeus-datastore
pod/linstor-controller-65cbbc74db-9vm9n condition met
pod/linstor-csi-controller-5ccb7d84cd-tvd9h condition met
pod/linstor-csi-node-2lkpd condition met
pod/linstor-csi-node-hbcvv condition met
pod/linstor-csi-node-hmrd7 condition met
pod/n1.example.com condition met
pod/n2.example.com condition met
pod/n3.example.com condition met
pod/piraeus-operator-controller-manager-dd898f48c-bhbtv condition met

```

--------------------------------

### Example SSL certificate mismatch error

Source: https://piraeus.io/docs/stable/how-to/api-tls?q=

An example of the error message returned when the certificate subject name does not match the target host.

```text
curl: (60) SSL: no alternative certificate subject name matches target host name 'linstor-controller.piraeus-datastore.svc'
```

--------------------------------

### Import Database Backup

Source: https://piraeus.io/docs/stable/upgrade/migration/1-migrate-database

Restore the database backup into the new backend using the linstor-database tool.

```bash
$ kubectl exec linstor-database-migration -- /usr/share/linstor-server/bin/linstor-database import-db -c /etc/linstor /backup/backup-before-migration.json
Loading configuration file "/etc/linstor/linstor.toml"
15:39:41.270 [main] INFO LINSTOR/linstor-db -- SYSTEM - ErrorReporter DB version 1 found.
15:39:41.272 [main] INFO LINSTOR/linstor-db -- SYSTEM - Log directory set to: './logs'
15:39:41.848 [main] INFO LINSTOR/linstor-db -- SYSTEM - Attempting dynamic load of extension module "com.linbit.linstor.modularcrypto.FipsCryptoModule"
15:39:41.849 [main] INFO LINSTOR/linstor-db -- SYSTEM - Extension module "com.linbit.linstor.modularcrypto.FipsCryptoModule" is not installed
15:39:41.850 [main] INFO LINSTOR/linstor-db -- SYSTEM - Attempting dynamic load of extension module "com.linbit.linstor.modularcrypto.JclCryptoModule"
15:39:41.858 [main] INFO LINSTOR/linstor-db -- SYSTEM - Dynamic load of extension module "com.linbit.linstor.modularcrypto.JclCryptoModule" was successful
15:39:41.859 [main] INFO LINSTOR/linstor-db -- SYSTEM - Attempting dynamic load of extension module "com.linbit.linstor.spacetracking.ControllerSpaceTrackingModule"
15:39:41.860 [main] INFO LINSTOR/linstor-db -- SYSTEM - Dynamic load of extension module "com.linbit.linstor.spacetracking.ControllerSpaceTrackingModule" was successful
15:39:43.307 [main] INFO LINSTOR/linstor-db -- SYSTEM - Initializing the k8s crd database connector
15:39:43.307 [main] INFO LINSTOR/linstor-db -- SYSTEM - Kubernetes-CRD connection URL is "k8s"
15:40:22.418 [main] INFO LINSTOR/linstor-db -- SYSTEM - Import finished
```

--------------------------------

### Deploy Snapshot Controller

Source: https://piraeus.io/docs/stable/tutorial/snapshots

Apply the necessary manifests to deploy the snapshot controller if it is missing.

```bash
kubectl apply -k https://github.com/kubernetes-csi/external-snapshotter//client/config/crd
kubectl apply -k https://github.com/kubernetes-csi/external-snapshotter//deploy/kubernetes/snapshot-controller
```

--------------------------------

### List Piraeus Datastore Pods and Components

Source: https://piraeus.io/docs/stable/explanation/components

Use this kubectl command to list all running Pods and their associated Piraeus Datastore components.

```bash
$ kubectl get pods '-ocustom-columns=NAME:.metadata.name,COMPONENT:.metadata.labels.app\.kubernetes\.io/component'
NAME                                                   COMPONENT
ha-controller-vd82w                                    ha-controller
linstor-affinity-controller-c84cf8958-p5wjx            linstor-affinity-controller
linstor-controller-6c8f8dc47-cm8hr                     linstor-controller
linstor-csi-controller-59b9968b86-ftl76                linstor-csi-controller
linstor-csi-nfs-server-n64jv                           linstor-csi-nfs-server
linstor-csi-node-hcmk9                                 linstor-csi-node
linstor-satellite-k8s-10.test-66687                    linstor-satellite
piraeus-operator-controller-manager-6dcfcb4568-6jntp   piraeus-operator
piraeus-operator-gencert-59449cb449-nzg6z              piraeus-operator-gencert
```

--------------------------------

### Verify Volume Content

Source: https://piraeus.io/docs/stable/tutorial/snapshots

Wait for the Pod to become ready and then execute a command inside the Pod to verify that the data has been successfully restored.

```bash
$ kubectl wait pod --for=condition=Ready -l app.kubernetes.io/name=volume-logger
pod/volume-logger-cbcd897b7-5qjbz condition met
$ kubectl exec deploy/volume-logger -- cat /volume/hello
Hello from volume-logger-cbcd897b7-jrmks, running on n3.example.com, started at Mon Feb 13 15:32:46 UTC 2023
Hello from volume-logger-cbcd897b7-gr6hh, running on n3.example.com, started at Mon Feb 13 15:42:17 UTC 2023
```

--------------------------------

### Wait for Piraeus Datastore Readiness

Source: https://piraeus.io/docs/stable/tutorial/get-started

Blocks execution until all Piraeus Datastore pods are in the Ready state.

```bash
$ kubectl wait pod --for=condition=Ready -n piraeus-datastore -l app.kubernetes.io/name=piraeus-datastore
```

--------------------------------

### Curl SSL Error Example

Source: https://piraeus.io/docs/stable/how-to/api-tls

This is an example of a `curl` error message indicating an issue with alternative certificate subject names not matching the target host. Ensure correct subject names are specified when provisioning certificates.

```bash
curl: (60) SSL: no alternative certificate subject name matches target host name 'linstor-controller.piraeus-datastore.svc'

```

--------------------------------

### Apply Piraeus Datastore Monitoring and Alerting Rules

Source: https://piraeus.io/docs/stable/how-to/monitoring

Apply the monitoring and alerting resources for Piraeus Datastore using `kubectl apply` with a Kustomization URL. Ensure the Prometheus Operator is configured to watch all namespaces.

```bash
$ kubectl apply --server-side -n piraeus-datastore -k "https://github.com/piraeusdatastore/piraeus-operator//config/extras/monitoring?ref=v2"

```

--------------------------------

### Check Piraeus Operator Version

Source: https://piraeus.io/docs/stable/how-to/drbd-tls

Verify the installed version of the Piraeus Operator using kubectl.

```bash
$ kubectl get pods -l app.kubernetes.io/component=piraeus-operator -ojsonpath='{.items[*].spec.containers[?(@.name=="manager")].image}{"\n"}'
quay.io/piraeusdatastore/piraeus-operator:v2.3.0
```

--------------------------------

### Deploy Piraeus Operator

Source: https://piraeus.io/docs/stable/how-to/helm

Installs or upgrades the Piraeus Operator in the piraeus-datastore namespace with CRDs enabled.

```bash
helm upgrade --install --create-namespace --namespace piraeus-datastore piraeus-operator oci://ghcr.io/piraeusdatastore/piraeus-operator/piraeus --set installCRDs=true --wait
```

--------------------------------

### Verify Database Configuration

Source: https://piraeus.io/docs/stable/upgrade/migration/1-migrate-database

Check the linstor.toml file inside the migration pod to confirm the database connection URL has been updated.

```bash
$ kubectl exec linstor-database-migration -- cat /etc/linstor/linstor.toml
[db]
  connection_url = "k8s"
```

--------------------------------

### Deploy a web server using the volume

Source: https://piraeus.io/docs/stable/tutorial/get-started?q=

Creates a deployment that mounts the previously defined PersistentVolumeClaim.

```yaml
$ kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-server
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: web-server
  template:
    metadata:
      labels:
        app.kubernetes.io/name: web-server
    spec:
      containers:
        - name: web-server
          image: nginx
          volumeMounts:
            - mountPath: /usr/share/nginx/html
              name: data
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: data-volume
EOF
```

--------------------------------

### Check SecureBoot State

Source: https://piraeus.io/docs/stable/how-to/secure-boot

Verify if SecureBoot is enabled on a Kubernetes node. This is a prerequisite for following the guide.

```bash
# mokutil --sb-state
SecureBoot enabled

```

--------------------------------

### Import DRBD Signing Certificate

Source: https://piraeus.io/docs/stable/how-to/secure-boot

Enroll the generated DRBD signing certificate into the machine owner keys (MOK) using mokutil. A password will be required during the process.

```bash
# mokutil --import signing_key.x509
input password:
input password again:

```

--------------------------------

### Get Volume Snapshot Status

Source: https://piraeus.io/docs/stable/tutorial/snapshots?q=

Retrieves the status of a specific VolumeSnapshot, including its readiness, source PVC, and class.

```bash
kubectl get volumesnapshot data-volume-snapshot-1

```

--------------------------------

### Apply Piraeus Datastore Cluster Resources

Source: https://piraeus.io/docs/stable/upgrade/migration/4-install-operator-v2?q=

Apply the generated resources to deploy the Piraeus Datastore Cluster. This command creates the necessary Piraeus-specific custom resources.

```bash
$ kubectl apply -f v2-resources.yaml --server-side
linstorcluster.piraeus.io/linstorcluster created
linstorsatelliteconfiguration.piraeus.io/host-networking created
linstorsatelliteconfiguration.piraeus.io/piraeus-op-ns created

```

--------------------------------

### DRBD Module Loader Build Error

Source: https://piraeus.io/docs/stable/how-to/raspian?q=

Example of the build error encountered when kernel header files are missing from the build container.

```text
make[2]: *** No rule to make target '/usr/src/linux-headers-6.6.51+rpt-common-rpi/scripts/Makefile.extrawarn'.  Stop.
make[1]: *** [Makefile:236: compat.h] Error 2
make: *** [Makefile:131: module] Error 2
```

--------------------------------

### Unpack and restore database

Source: https://piraeus.io/docs/stable/how-to/restore-linstor-db?q=

Extract the backup archive and apply the database state to the cluster.

```bash
$ mkdir restore
$ cd restore
# Replace $BACKUP_NAME with your selected backup name
$ kubectl get secrets --sort-by=.metadata.name -l piraeus.io/backup=$BACKUP_NAME -ogo-template='{{range .items}}{{index .data "backup.tar.gz" | base64decode}}{{end}}' > backup.tar.gz
$ tar -xvf backup.tar.gz
```

```bash
$ kubectl api-resources --api-group=internal.linstor.linbit.com -oname | xargs --no-run-if-empty kubectl delete crds
$ kubectl create -f .
```

--------------------------------

### Verify Workload Status and Data

Source: https://piraeus.io/docs/stable/tutorial/snapshots

Wait for the deployment to be ready and verify the logged data on the volume.

```bash
$ kubectl wait pod --for=condition=Ready -l app.kubernetes.io/name=volume-logger
pod/volume-logger-cbcd897b7-jrmks condition met
$ kubectl exec deploy/volume-logger -- cat /volume/hello
Hello from volume-logger-cbcd897b7-jrmks, running on n3.example.com, started at Mon Feb 13 15:32:46 UTC 2023
```

--------------------------------

### Get Piraeus Operator Version

Source: https://piraeus.io/docs/stable/how-to/drbd-tls?q=

Check the deployed version of the Piraeus Operator using kubectl. Ensure you meet the minimum version requirement of 2.3.0.

```bash
$ kubectl get pods -l app.kubernetes.io/component=piraeus-operator -ojsonpath='{.items[*].spec.containers[?(@.name=="manager")].image}{"\n"}'
quay.io/piraeusdatastore/piraeus-operator:v2.3.0

```

--------------------------------

### Configure LinstorCluster for Control Plane Nodes

Source: https://piraeus.io/docs/stable/upgrade

To restore the old behavior of Piraeus Datastore components starting on control plane nodes, add these tolerations to your LinstorCluster resource.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  tolerations:
  - key: node-role.kubernetes.io/control-plane
    effect: NoSchedule
    operator: Exists
  - key: node-role.kubernetes.io/worker
    effect: NoSchedule
    operator: Exists
```

--------------------------------

### Scale Up Deployment

Source: https://piraeus.io/docs/stable/tutorial/snapshots

Scale up the deployment to one replica. The new Pod will automatically use the restored volume.

```bash
$ kubectl scale deploy/volume-logger --replicas=1
deployment.apps/volume-logger scaled
```

--------------------------------

### Set Backup Name Variable

Source: https://piraeus.io/docs/stable/how-to/restore-linstor-db

Assigns the name of the desired backup to the BACKUP_NAME variable for subsequent commands. Replace the example name with the actual name of the backup you want to restore.

```bash
$ BACKUP_NAME=linstor-backup-for-linstor-controller-db7fbfd95-zsfmm

```

--------------------------------

### Deploy Workload with Replicated Volume

Source: https://piraeus.io/docs/stable/tutorial/replicated-volumes

Create a Kubernetes Deployment that uses the `replicated-volume` PersistentVolumeClaim. The Pod logs its hostname, node name, and start time to a file within the volume.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: volume-logger
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: volume-logger
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: volume-logger
    spec:
      terminationGracePeriodSeconds: 0
      containers:
        - name: volume-logger
          image: busybox
          args:
            - sh
            - -c
            - |
              echo "Hello from \$HOSTNAME, running on \$NODENAME, started at \$(date)" >> /volume/hello
              # We use this to keep the Pod running
              tail -f /dev/null
          env:
            - name: NODENAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - mountPath: /volume
              name: replicated-volume
      volumes:
        - name: replicated-volume
          persistentVolumeClaim:
            claimName: replicated-volume
```

--------------------------------

### List LINSTOR resources

Source: https://piraeus.io/docs/stable/tutorial/get-started?q=

Uses the linstor client to inspect the volume status.

```bash
$ kubectl -n piraeus-datastore exec deploy/linstor-controller -- linstor resource list-volumes
+-------------------------------------------------------------------------------------------------------------------------------------------+
| Node           | Resource                                 | StoragePool | VolNr | MinorNr | DeviceName    | Allocated | InUse  |    State |
|===========================================================================================================================================|
| n1.example.com | pvc-9e1149e7-33db-47a7-8fc6-172514422143 | pool1       |     0 |    1000 | /dev/drbd1000 | 16.91 MiB | InUse  | UpToDate |
+-------------------------------------------------------------------------------------------------------------------------------------------+
```

--------------------------------

### LinstorCluster with Manually Provisioned TLS Secrets

Source: https://piraeus.io/docs/stable/reference/linstorcluster?q=

This example demonstrates how to create manually provisioned TLS secrets and reference them within the LinstorCluster configuration. The same secret is used for all LINSTOR API clients.

```APIDOC
## LinstorCluster with Manually Provisioned TLS Secrets

### Description
This example creates manually provisioned TLS secrets and references them in the LinstorCluster configuration. It uses the same secret for all clients of the LINSTOR API.

### Method
N/A (Kubernetes resource definition)

### Endpoint
N/A (Kubernetes resource definition)

### Request Body
```yaml
---
apiVersion: v1
kind: Secret
metadata:
  name: my-linstor-api-tls
  namespace: piraeus-datastore
data:
  ca.crt: LS0tLS1CRUdJT...
  tls.crt: LS0tLS1CRUdJT...
  tls.key: LS0tLS1CRUdJT...
---
apiVersion: v1
kind: Secret
metadata:
  name: my-linstor-client-tls
  namespace: piraeus-datastore
data:
  ca.crt: LS0tLS1CRUdJT...
  tls.crt: LS0tLS1CRUdJT...
  tls.key: LS0tLS1CRUdJT...
---
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  apiTLS:
    apiSecretName: my-linstor-api-tls
    clientSecretName: my-linstor-client-tls
    csiControllerSecretName: my-linstor-client-tls
    csiNodeSecretName: my-linstor-client-tls
    affinityControllerSecretName: my-linstor-client-tls
    nfsServerSecretName: my-linstor-client-tls
```

### Response
N/A (Kubernetes resource definition)
```

--------------------------------

### Restart LINSTOR deployments

Source: https://piraeus.io/docs/stable/how-to/restore-linstor-db?q=

Scale the deployments back up and verify the rollout status.

```bash
$ kubectl scale deployment piraeus-operator-controller-manager --replicas 1
deployment.apps/piraeus-operator-controller-manager scaled
$ kubectl scale deployment linstor-controller --replicas 1
deployment.apps/linstor-controller scaled
$ kubectl rollout status deployment piraeus-operator-controller-manager
Waiting for deployment "piraeus-operator-controller-manager" rollout to finish: 0 of 1 updated replicas are available...
deployment "piraeus-operator-controller-manager" successfully rolled out
$ kubectl rollout status deployment linstor-controller
Waiting for deployment "linstor-controller" rollout to finish: 0 of 1 updated replicas are available...
deployment "linstor-controller" successfully rolled out
```

--------------------------------

### Get LINSTOR Controller Deployment Details

Source: https://piraeus.io/docs/stable/upgrade/migration/1-migrate-database?q=

Retrieves the LINSTOR Controller image, ConfigMap name, and service account name from its deployment configuration. This information is crucial for setting up the migration pod.

```bash
$ kubectl get deploy/piraeus-op-cs-controller --output=jsonpath='IMAGE={$.spec.template.spec.containers[?(@.name=="linstor-controller")].image}{"\n"}CONFIG_MAP={$.spec.template.spec.volumes[?(@.name=="linstor-conf")].configMap.name}{"\n"}SERVICE_ACCOUNT={$.spec.template.spec.serviceAccountName}{"\n"}'
IMAGE=quay.io/piraeusdatastore/piraeus-server:v1.24.2
CONFIG_MAP=piraeus-op-cs-controller-config
SERVICE_ACCOUNT=linstor-controller


```

--------------------------------

### Verify CSI Controller Configuration

Source: https://piraeus.io/docs/stable/how-to/external-controller?q=

Inspect the linstor-csi-controller deployment to verify it is using the expected external controller URL.

```bash
$ kubectl get -n piraeus-datastore deployment linstor-csi-controller -ojsonpath='{.spec.template.spec.containers[?(@.name=="linstor-csi")].env[?(@.name=="LS_CONTROLLERS")].value}{"\n"}'
http://linstor-controller.example.com:3370
```

--------------------------------

### Get Driver Toolkit Image for OpenShift

Source: https://piraeus.io/docs/stable/how-to/openshift?q=

Use this command to retrieve the specific Driver Toolkit image version that matches your OpenShift release. This image contains essential files for building DRBD.

```bash
$ oc adm release info --image-for=driver-toolkit
quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1328c4e7944b6d8eda40a8f789471a1aec63abda75ac1199ce098b965ec16709

```

--------------------------------

### Create Linstor Satellite Storage Pool Configuration

Source: https://piraeus.io/docs/stable/tutorial/get-started?q=

Apply this Kubernetes manifest to create a LinstorSatelliteConfiguration resource, defining a fileThinPool named 'pool1' on each node. This configuration does not require additional host setup.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: storage-pool
spec:
  storagePools:
    - name: pool1
      fileThinPool:
        directory: /var/lib/piraeus-datastore/pool1
```

--------------------------------

### Extract Helm-Generated LINSTOR Passphrase

Source: https://piraeus.io/docs/stable/upgrade/migration/2-collect-information

Use this kubectl command to retrieve the LINSTOR passphrase secret generated by Helm. This passphrase is required for the LINSTOR Controller to start and must be migrated to Piraeus Operator v2.

```bash
$ kubectl get secrets piraeus-op-passphrase -ogo-template='{{.data.MASTER_PASSPHRASE}}{{"\n"}}'
ZVRxanl1cVBscXV1ZTk1cmEwVTk5b0ptd0F4OGFmWlVPUVA0NWNnUw==

```

--------------------------------

### Verify Configured Storage Pools

Source: https://piraeus.io/docs/stable/tutorial/get-started?q=

Run this command to list all configured storage pools after the Linstor nodes have reconnected. It confirms that the 'pool1' fileThinPool is active and shows its capacity details.

```bash
kubectl -n piraeus-datastore exec deploy/linstor-controller -- linstor storage-pool list
```

--------------------------------

### Get Driver Toolkit Image for Specific OpenShift Version

Source: https://piraeus.io/docs/stable/how-to/openshift?q=

When preparing for an OpenShift update, use this command to extract the Driver Toolkit image for the new version. This ensures DRBD can rebuild successfully after the update.

```bash
$ oc adm release info 4.12.2 --image-for=driver-toolkit
quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1328c4e7944b6d8eda40a8f789471a1aec63abda75ac1199ce098b965ec16709

```

--------------------------------

### Trigger pod rollout and verify migration

Source: https://piraeus.io/docs/stable/tutorial/replicated-volumes?q=

Restarts the deployment and waits for the pod to become ready on a new node.

```bash
$ kubectl rollout restart deploy/volume-logger
deployment.apps/volume-logger restarted
$ kubectl wait pod --for=condition=Ready -l app.kubernetes.io/name=volume-logger
pod/volume-logger-5db9dd7b87-lps2f condition met
$ kubectl get pods -owide
NAME                             READY   STATUS    RESTARTS   AGE   IP            NODE             NOMINATED NODE   READINESS GATES
volume-logger-5db9dd7b87-lps2f   1/1     Running   0          26s   10.125.97.9   n2.example.com   <none>           <none>
```

--------------------------------

### LinstorCluster with Automatic TLS Secret Creation via Cert-Manager

Source: https://piraeus.io/docs/stable/reference/linstorcluster?q=

This example configures automatic creation of LINSTOR API and LINSTOR Client TLS secrets using a cert-manager issuer. Certificates are validated against the certificate in the `trust-root` Secret.

```APIDOC
## LinstorCluster with Automatic TLS Secret Creation via Cert-Manager

### Description
This example sets up automatic creation of the LINSTOR API and LINSTOR Client TLS secret using a cert-manager issuer named `piraeus-root`. The certificates will be validated against the certificate in the `trust-root` Secret.

### Method
N/A (Kubernetes resource definition)

### Endpoint
N/A (Kubernetes resource definition)

### Request Body
```yaml
apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorcluster
spec:
  apiTLS:
    certManager:
      kind: Issuer
      name: piraeus-root
    caReference:
      name: trust-root
      kind: Secret
      key: root.crt
```

### Response
N/A (Kubernetes resource definition)
```

--------------------------------

### Verify Storage Pool Configuration

Source: https://piraeus.io/docs/stable/tutorial/get-started

Once nodes are back online, use this command to confirm that the 'pool1' storage pool has been successfully configured on each node.

```bash
$ kubectl -n piraeus-datastore exec deploy/linstor-controller -- linstor storage-pool list
```

--------------------------------

### Verify Data Deletion

Source: https://piraeus.io/docs/stable/tutorial/snapshots?q=

Attempts to display the content of the '/volume/hello' file on the 'volume-logger' pod. This command is expected to fail if the file was successfully deleted.

```bash
kubectl exec deploy/volume-logger -- cat /volume/hello

```

--------------------------------

### Create LINSTOR Database Backup

Source: https://piraeus.io/docs/stable/upgrade/migration/1-migrate-database?q=

Execute the linstor-database export-db command within the migration Pod to create a backup. Ensure the configuration file path and backup destination are correct.

```bash
$ kubectl exec linstor-database-migration -- /usr/share/linstor-server/bin/linstor-database export-db -c /etc/linstor /backup/backup-before-migration.json
Loading configuration file "/etc/linstor/linstor.toml"
15:22:55.684 [main] INFO LINSTOR/linstor-db -- SYSTEM - ErrorReporter DB first time init.
15:22:55.685 [main] INFO LINSTOR/linstor-db -- SYSTEM - Log directory set to: './logs'
15:22:56.417 [main] INFO LINSTOR/linstor-db -- SYSTEM - Attempting dynamic load of extension module "com.linbit.linstor.modularcrypto.FipsCryptoModule"
15:22:56.418 [main] INFO LINSTOR/linstor-db -- SYSTEM - Extension module "com.linbit.linstor.modularcrypto.FipsCryptoModule" is not installed
15:22:56.418 [main] INFO LINSTOR/linstor-db -- SYSTEM - Attempting dynamic load of extension module "com.linbit.linstor.modularcrypto.JclCryptoModule"
15:22:56.426 [main] INFO LINSTOR/linstor-db -- SYSTEM - Dynamic load of extension module "com.linbit.linstor.modularcrypto.JclCryptoModule" was successful
15:22:56.427 [main] INFO LINSTOR/linstor-db -- SYSTEM - Attempting dynamic load of extension module "com.linbit.linstor.spacetracking.ControllerSpaceTrackingModule"
15:22:56.429 [main] INFO LINSTOR/linstor-db -- SYSTEM - Dynamic load of extension module "com.linbit.linstor.spacetracking.ControllerSpaceTrackingModule" was successful
15:22:57.666 [main] INFO LINSTOR/linstor-db -- SYSTEM - Initializing the etcd database
15:22:57.667 [main] INFO LINSTOR/linstor-db -- SYSTEM - etcd connection URL is "etcd://piraeus-op-etcd:2379"
15:22:59.480 [main] INFO LINSTOR/linstor-db -- SYSTEM - Export finished

```

--------------------------------

### Create VolumeSnapshotClass

Source: https://piraeus.io/docs/stable/tutorial/snapshots

Defines the provisioner and deletion policy for snapshots. Requires the linstor.csi.linbit.com driver.

```bash
$ kubectl apply -f - <<EOF
apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshotClass
metadata:
  name: piraeus-snapshots
driver: linstor.csi.linbit.com
deletionPolicy: Delete
EOF

```

--------------------------------

### Override Images with YAML Documents

Source: https://piraeus.io/docs/stable/explanation/image-configuration?q=

Use this method to override default component images by adding a new YAML document to the `piraeus-operator-image-config` ConfigMap. Ensure the filename starts with a higher number than existing documents to guarantee it's applied last.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: piraeus-operator-image-config
data:
  0_piraeus_datastore_images.yaml: |
    # ...
  0_sig_storage_images.yaml: |
    # ...
  1_override.yaml: |
    ---
    base: quay.io/piraeusdatastore
    components:
      linstor-controller:
        image: piraeus-server
        tag: v1.31.1
      linstor-satellite:
        image: piraeus-server
        digest: sha256:8bc7fd45545744864633371161e6fcd6bcaea1e7a21fb053588f970b9f912b07

```

--------------------------------

### Deploy Piraeus Datastore

Source: https://piraeus.io/docs/stable/how-to/helm

Creates the Linstor cluster deployment within the piraeus-datastore namespace.

```bash
helm upgrade --install --namespace piraeus-datastore linstor-cluster oci://ghcr.io/piraeusdatastore/helm-charts/linstor-cluster
```

--------------------------------

### Configure LinstorSatelliteConfiguration for Signing

Source: https://piraeus.io/docs/stable/how-to/secure-boot?q=

Update the satellite configuration to mount the signing keys and enable the LB_SIGN environment variable.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: drbd-module-signing
spec:
  podTemplate:
    spec:
      initContainers:
      - name: drbd-module-loader
        env:
        - name: LB_SIGN
          value: /signing-key
        volumeMounts:
        - name: signing-key
          mountPath: /signing-key
          readOnly: true
      volumes:
      - name: signing-key
        secret:
          secretName: drbd-signing-keys
```

--------------------------------

### Generate Client Certificate with OpenSSL

Source: https://piraeus.io/docs/stable/how-to/api-tls

Creates a client certificate for LINSTOR API authentication.

```bash
openssl req -new -sha256 -key api-client.key -subj "/CN=linstor-client" -out api-client.csr
openssl x509 -req -in api-client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out api-client.crt -days 3650 -sha256
```

--------------------------------

### Generate Server Certificate with OpenSSL

Source: https://piraeus.io/docs/stable/how-to/api-tls

Creates a server certificate with multiple subject alternative names for service discovery.

```bash
cat /etc/ssl/openssl.cnf > api-csr.cnf
cat >> api-csr.cnf <<EOF
[ v3_req ]
subjectAltName = @alt_names
[ alt_names ]
DNS.0 = linstor-controller.piraeus-datastore.svc.cluster.local
DNS.1 = linstor-controller.piraeus-datastore.svc
DNS.2 = linstor-controller
EOF
openssl req -new -sha256 -key api-server.key -subj "/CN=linstor-controller" -config api-csr.cnf -extensions v3_req -out api-server.csr
openssl x509 -req -in api-server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -config api-csr.cnf -extensions v3_req -out api-server.crt -days 3650 -sha256
```

--------------------------------

### Deploy a Workload with Replicated Storage

Source: https://piraeus.io/docs/stable/tutorial/replicated-volumes?q=

Creates a Deployment that mounts the replicated volume and logs node information to a file.

```yaml
$ kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: volume-logger
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: volume-logger
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: volume-logger
    spec:
      terminationGracePeriodSeconds: 0
      containers:
        - name: volume-logger
          image: busybox
          args:
            - sh
            - -c
            - |
              echo "Hello from \$HOSTNAME, running on \$NODENAME, started at \$(date)" >> /volume/hello
              # We use this to keep the Pod running
              tail -f /dev/null
          env:
            - name: NODENAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - mountPath: /volume
              name: replicated-volume
      volumes:
        - name: replicated-volume
          persistentVolumeClaim:
            claimName: replicated-volume
EOF
```

--------------------------------

### Update LINSTOR Controller Configuration

Source: https://piraeus.io/docs/stable/upgrade/migration/1-migrate-database

Apply the new database connection URL using Helm to point the LINSTOR controller to the new backend.

```bash
$ helm upgrade piraeus-op ./charts/piraeus --reuse-values --set operator.controller.dbConnectionURL=k8s
```

--------------------------------

### Generate Keys for LINSTOR Controller and Satellite with openssl

Source: https://piraeus.io/docs/stable/how-to/internal-tls?q=

Create RSA private keys for the LINSTOR Controller and Satellite components using openssl.

```bash
openssl genrsa -out controller.key 4096
openssl genrsa -out satellite.key 4096

```

--------------------------------

### Configure DRBD Module Loader for Signing

Source: https://piraeus.io/docs/stable/how-to/secure-boot

Configure the `LinstorSatelliteConfiguration` to mount the DRBD signing keys and set the `LB_SIGN` environment variable. This enables the `drbd-module-loader` to sign kernel modules.

```yaml
apiVersion: piraeus.io/v1
kind: LinstorSatelliteConfiguration
metadata:
  name: drbd-module-signing
spec:
  podTemplate:
    spec:
      initContainers:
      - name: drbd-module-loader
        env:
        - name: LB_SIGN
          value: /signing-key
        volumeMounts:
        - name: signing-key
          mountPath: /signing-key
          readOnly: true
      volumes:
      - name: signing-key
        secret:
          secretName: drbd-signing-keys

```
Tokens:
Raw