From dad62647cd49f2d7efc0f17d6359aef8cee17c82 Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Sat, 18 Apr 2026 11:37:45 +0000 Subject: [PATCH] [grampsweb] Align PVC resource to encrypted storage; imported state MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Context Grampsweb stack had an empty Terraform state — 7 K8s resources (namespace, PVC, service, deployment, ingress, ExternalSecret manifest, TLS secret) existed in the cluster but weren't tracked. This blocked commit 7b248897 (ollama LLM env-var removal) from being applied because any apply would attempt to re-create existing resources. Additionally, the TF source declared a **grampsweb-data-proxmox** PVC on **storage_class=proxmox-lvm**, while the cluster had **grampsweb-data-encrypted** on **proxmox-lvm-encrypted** (1 Gi, bound). The deployment was referencing the encrypted PVC. This divergence predated this change — the source was simply out of date vs cluster reality. ## This change Two things: 1. **Source alignment** (the only file diff): - Renames `kubernetes_persistent_volume_claim.data_proxmox` → `data_encrypted`, metadata.name to match cluster, storage class to `proxmox-lvm-encrypted`. - Updates the deployment volume `claim_name` reference accordingly. - Aligns with the newer project convention documented in `.claude/CLAUDE.md`: "Default for sensitive data is proxmox-lvm-encrypted" and "Convention: PVC names end in `-encrypted`". - No destroy/recreate: the PVC and deployment already use the encrypted PVC in the cluster; TF source now just describes reality. 2. **State imports** (out-of-band, via `scripts/tg import`, not in diff): - `kubernetes_namespace.grampsweb` <- `grampsweb` - `kubernetes_persistent_volume_claim.data_encrypted` <- `grampsweb/grampsweb-data-encrypted` - `kubernetes_service.grampsweb` <- `grampsweb/grampsweb` - `kubernetes_deployment.grampsweb` <- `grampsweb/grampsweb` - `module.ingress.kubernetes_ingress_v1.proxied-ingress` <- `grampsweb/family` - `module.tls_secret.kubernetes_secret.tls_secret` <- `grampsweb/tls-secret` - `kubernetes_manifest.external_secret` <- `apiVersion=external-secrets.io/v1beta1,kind=ExternalSecret,namespace=grampsweb,name=grampsweb-secrets` ## Apply result `Apply complete! Resources: 0 added, 7 changed, 0 destroyed.` In-place updates applied: - Deployment: dropped `GRAMPSWEB_LLM_BASE_URL` + `GRAMPSWEB_LLM_MODEL` env vars (both containers) — realising the intent of commit 7b248897. - Ingress: realigned Traefik middleware annotation + cleaned stale `uptime.viktorbarzin.me/external-monitor=false` annotation. - TLS secret: removed Kyverno-generated labels (Kyverno's `sync-tls-secret` ClusterPolicy re-applies them on next reconcile — no functional impact; same pattern in 29 other stacks using `setup_tls_secret` module). - Namespace, PVC, service: trivial metadata alignments (label / `wait_until_bound` / `wait_for_load_balancer`). - `kubernetes_manifest.external_secret`: populated the `manifest` attribute after import (expected). ## What is NOT in this change - No replica bump: deployment stays at `replicas=0` (stack is intentionally inactive per 2026-03-14 OOM incident note). - No destroy/recreate of any resource. - The broader code-w97 (11 stacks with empty state) is NOT closed — only grampsweb is imported. 10 stacks remain: beads-server, insta2spotify, isponsorblocktv, kyverno, meshcentral, pvc-autoresizer, shadowsocks, tor-proxy, travel_blog, + meshcentral PVC. ## Reproduce locally ``` KUBECONFIG=/home/wizard/code/config kubectl get all,ingress,pvc,externalsecret,secret -n grampsweb # Deployment still replicas=0; PVC grampsweb-data-encrypted Bound; ingress 'family' # on family.viktorbarzin.me; ExternalSecret SecretSynced True. cd /home/wizard/code/infra/stacks/grampsweb /home/wizard/code/infra/scripts/tg plan # Expected: 'No changes.' (clean state after apply). ``` ## Test Plan ### Automated ``` $ cd /home/wizard/code/infra/stacks/grampsweb && /home/wizard/code/infra/scripts/tg plan Plan: 0 to add, 7 to change, 0 to destroy. [pre-apply] $ /home/wizard/code/infra/scripts/tg apply --non-interactive Plan: 0 to add, 7 to change, 0 to destroy. kubernetes_namespace.grampsweb: Modifications complete after 0s [id=grampsweb] kubernetes_persistent_volume_claim.data_encrypted: Modifications complete after 0s [id=grampsweb/grampsweb-data-encrypted] kubernetes_service.grampsweb: Modifications complete after 0s [id=grampsweb/grampsweb] module.ingress.kubernetes_ingress_v1.proxied-ingress: Modifications complete after 0s [id=grampsweb/family] module.tls_secret.kubernetes_secret.tls_secret: Modifications complete after 0s [id=grampsweb/tls-secret] kubernetes_manifest.external_secret: Modifications complete after 0s kubernetes_deployment.grampsweb: Modifications complete after 1s [id=grampsweb/grampsweb] Apply complete! Resources: 0 added, 7 changed, 0 destroyed. $ terraform fmt -check -recursive stacks/grampsweb (no output - formatted clean) ``` ### Manual Verification ``` $ KUBECONFIG=/home/wizard/code/config kubectl get all,ingress,pvc,externalsecret,secret -n grampsweb # - deployment.apps/grampsweb 0/0 0 0 47d (replicas=0 preserved) # - service/grampsweb ClusterIP 10.106.232.205:80/TCP # - persistentvolumeclaim/grampsweb-data-encrypted Bound pvc-c9a5dcf4... 1Gi RWO proxmox-lvm-encrypted # - ingress/family traefik family.viktorbarzin.me -> 10.0.20.200:80,443 # - externalsecret/grampsweb-secrets vault-kv 15m SecretSynced True # - secret/tls-secret kubernetes.io/tls # No pod crashes (no pods — replicas=0). ``` Closes: code-8m6 --- stacks/grampsweb/main.tf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/stacks/grampsweb/main.tf b/stacks/grampsweb/main.tf index 2d3e89ee..c6c7cb70 100644 --- a/stacks/grampsweb/main.tf +++ b/stacks/grampsweb/main.tf @@ -61,10 +61,10 @@ module "tls_secret" { tls_secret_name = var.tls_secret_name } -resource "kubernetes_persistent_volume_claim" "data_proxmox" { +resource "kubernetes_persistent_volume_claim" "data_encrypted" { wait_until_bound = false metadata { - name = "grampsweb-data-proxmox" + name = "grampsweb-data-encrypted" namespace = kubernetes_namespace.grampsweb.metadata[0].name annotations = { "resize.topolvm.io/threshold" = "80%" @@ -74,7 +74,7 @@ resource "kubernetes_persistent_volume_claim" "data_proxmox" { } spec { access_modes = ["ReadWriteOnce"] - storage_class_name = "proxmox-lvm" + storage_class_name = "proxmox-lvm-encrypted" resources { requests = { storage = "1Gi" @@ -316,7 +316,7 @@ resource "kubernetes_deployment" "grampsweb" { volume { name = "data" persistent_volume_claim { - claim_name = kubernetes_persistent_volume_claim.data_proxmox.metadata[0].name + claim_name = kubernetes_persistent_volume_claim.data_encrypted.metadata[0].name } } }