b3529f8e96
Adds three new bluejay-infra apps that auto-pickup via ApplicationSet (apps/*
directory generator on main):
* apps/multus/multus.yaml — Multus CNI v4.2.2 thick-plugin daemonset (verbatim
upstream, project-annotated). Enables KubeVirt VMs to attach additional
network interfaces. Required by ci1 to bridge onto PROD VLAN 57.
* apps/cdi/{cdi-operator.yaml,cdi-cr.yaml,README.md} — Containerized Data
Importer v1.65.0 (verbatim upstream). Operator + CR pattern. Enables
populating PVCs from HTTP/registry/upload sources, used to load the Windows
Server 2025 ISO into the windows-server-2025-iso PVC.
* apps/kubevirt-vms/prod-vlan57-nad.yaml — NetworkAttachmentDefinition for
PROD VLAN 57 bridge. **Deploy gated on Phase 1.5 host work**: requires
br-prod bridge enslaving enp86s0.57 on each RKE2 node (Puppet config-as-code).
ci1.yaml continues to use pod-network masquerade until that lands; switching
to multus.networkName: kubevirt-vms/prod-vlan57 is a one-line YAML edit
followed by a GitOps push.
Cluster verification (2026-05-08):
- KubeVirt LIVE (3 nodes, virt-api/controller/handler/operator all Running)
- Calico CNI on /etc/cni/net.d + /opt/cni/bin (Multus default paths)
- ApplicationSet `bluejay-infra` already watches `apps/*` on main
Reproducibility: upstream YAMLs vendored verbatim with project header diffs
only. Bumping versions = re-curl + git push. No deploy-time internet fetch.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
70 lines
3.1 KiB
YAML
70 lines
3.1 KiB
YAML
# =============================================================================
|
|
# NetworkAttachmentDefinition — PROD VLAN 57 bridge
|
|
# =============================================================================
|
|
# Purpose: makes KubeVirt VMs reachable on the PROD VLAN (10.0.57.0/24)
|
|
# alongside the existing pod network. Required for ci1 to bridge onto PROD
|
|
# (e.g. to provision/scrape edge1, edge2, kiosks, Pis on the same L2 segment).
|
|
#
|
|
# **DEPLOY GATE — Phase 1.5 host work required first**:
|
|
# On every RKE2 node (rke2-server, rke2-agent1, rke2-agent2):
|
|
# 1. Switch port (UniFi USL16LP) trunks VLAN 57 to the node — usually
|
|
# already true since BLUEJAY-WS reaches 10.0.57.x services. Verify
|
|
# with `ip link show enp86s0.57` after configuring sub-interface, OR
|
|
# `tcpdump -ni enp86s0 vlan 57` and ping a known PROD host.
|
|
# 2. Linux bridge `br-prod` enslaving `enp86s0.57` (VLAN sub-interface).
|
|
# NetworkManager profile examples in the runbook below.
|
|
# 3. Verify Multus DaemonSet `kube-multus-ds` is Ready on all nodes.
|
|
#
|
|
# Without those, applying this NAD has no effect except to register the CRD.
|
|
# A VM that requests this NAD with no bridge present will fail with:
|
|
# `error adding pod kubevirt-vms_ci1 to CNI network "prod-vlan57": failed to
|
|
# plumb VLAN: open /sys/class/net/br-prod/master: no such file or directory`
|
|
#
|
|
# Configuration notes:
|
|
# - cniVersion 0.3.1 to match Multus daemon-config.json
|
|
# - mtu 1500 (matches enp86s0 default; bump if jumbo frames configured)
|
|
# - bridge name `br-prod` is convention; if Puppet picks a different name
|
|
# (e.g. `br57`, `br-vlan57`), edit BOTH this NAD and the ci1.yaml
|
|
# interface block. Keep them in sync.
|
|
# - vlan: 0 because the host bridge already strips VLAN tag (br-prod sits
|
|
# on top of `enp86s0.57`). If we instead used a VLAN-aware bridge with
|
|
# trunk port, set vlan: 57 here. Current convention is VLAN-stripped at
|
|
# the sub-interface, so the bridge passes untagged frames.
|
|
#
|
|
# Apply:
|
|
# kubectl --kubeconfig $env:USERPROFILE\.kube\rke2.yaml apply -f apps/kubevirt-vms/prod-vlan57-nad.yaml
|
|
#
|
|
# Then update ci1.yaml networks: stanza to:
|
|
# - name: prod-net
|
|
# multus:
|
|
# networkName: kubevirt-vms/prod-vlan57
|
|
# and the interface block from `masquerade` to `bridge`.
|
|
# =============================================================================
|
|
|
|
---
|
|
# Namespace must exist already (created by ci1.yaml's first document).
|
|
# This file imports a NAD into that same namespace.
|
|
apiVersion: k8s.cni.cncf.io/v1
|
|
kind: NetworkAttachmentDefinition
|
|
metadata:
|
|
name: prod-vlan57
|
|
namespace: kubevirt-vms
|
|
annotations:
|
|
bluejay.iamworkin.lan/host-bridge: "br-prod (enslaves enp86s0.57)"
|
|
bluejay.iamworkin.lan/cidr: "10.0.57.0/24"
|
|
bluejay.iamworkin.lan/gateway: "10.0.57.1"
|
|
bluejay.iamworkin.lan/dns: "10.0.56.1 (pfSense Unbound)"
|
|
spec:
|
|
config: |
|
|
{
|
|
"cniVersion": "0.3.1",
|
|
"name": "prod-vlan57",
|
|
"type": "bridge",
|
|
"bridge": "br-prod",
|
|
"ipam": {},
|
|
"mtu": 1500,
|
|
"vlan": 0,
|
|
"promiscMode": true,
|
|
"preserveDefaultVlan": false
|
|
}
|