update ceph

ceph-csi-drivers/values.yaml.gotmpl

@@ -0,0 +1,32 @@
+# Rook-compatible default values for the ceph-csi-drivers Helm chart.
+#
+# Use these values when installing or upgrading the ceph-csi-drivers chart
+# alongside the rook-ceph operator chart. The driver names must match the
+# provisioner names used by Rook (e.g. in StorageClasses and VolumeSnapshotClasses).
+#
+# If the Rook operator is installed in a namespace other than rook-ceph, replace
+# "rook-ceph" in the driver names below with your operator namespace.
+
+operatorConfig:
+  namespace: rook-ceph # namespace:operator
+  driverSpecDefaults:
+    imageSet:
+      name: rook-csi-operator-image-set-configmap
+    nodePlugin:
+      priorityClassName: system-node-critical
+    controllerPlugin:
+      priorityClassName: system-cluster-critical
+
+drivers:
+  rbd:
+    enabled: true
+    name: rook-ceph.rbd.csi.ceph.com # csi-provisioner-name
+  cephfs:
+    enabled: true
+    name: rook-ceph.cephfs.csi.ceph.com # csi-provisioner-name
+  nfs:
+    enabled: false
+    name: rook-ceph.nfs.csi.ceph.com # csi-provisioner-name
+  nvmeof:
+    enabled: false
+    name: rook-ceph.nvmeof.csi.ceph.com # csi-provisioner-name

helmfile.d/01-infrastructure.lock

@@ -1,22 +1,25 @@
 version: 1.2.3
 dependencies:
+  - name: ceph-csi-drivers
+    repository: https://ceph.github.io/ceph-csi-operator
+    version: 1.0.4
   - name: cert-manager
     repository: https://charts.jetstack.io
-    version: v1.20.2
+    version: v1.21.0
   - name: cert-manager-webhook-hetzner
     repository: https://charts.hetzner.cloud
-    version: 0.7.0
+    version: 0.8.0
   - name: rook-ceph
     repository: https://charts.rook.io/release
-    version: v1.20.1
+    version: v1.20.2
   - name: rook-ceph-cluster
     repository: https://charts.rook.io/release
-    version: v1.20.1
+    version: v1.20.2
   - name: tailscale-operator
     repository: https://pkgs.tailscale.com/helmcharts
     version: 1.98.4
   - name: traefik
     repository: https://traefik.github.io/charts
-    version: 41.0.0
+    version: 41.0.2
-digest: sha256:136ebb8590cb490a700ed1382e5c5b02f2e054a5d4a5dee59446fdb9a3fd0ee3
+digest: sha256:a1492fa5400875bfa07546304bd721b0bb144daed784890c3f7d15bba368b6e8
-generated: "2026-06-22T10:04:23.320029485-06:00"
+generated: "2026-07-15T08:54:18.801317262-06:00"

helmfile.d/01-infrastructure.yaml

@@ -1,6 +1,8 @@
 repositories:
   - name: rook-release
     url:  https://charts.rook.io/release
+  - name: ceph-csi-operator
+    url: https://ceph.github.io/ceph-csi-operator
   - name: traefik
     url: https://traefik.github.io/charts
   - name: tailscale
@@ -53,12 +55,20 @@ releases:
     namespace: rook-ceph
     createNamespace: true
     chart: rook-release/rook-ceph
+    version: 1.20.2
     values:
       - ../rook-ceph/values.yaml.gotmpl
+  - name: ceph-csi-drivers
+    namespace: rook-ceph
+    createNamespace: true
+    chart: ceph-csi-operator/ceph-csi-drivers
+    values:
+      - ../ceph-csi-drivers/values.yaml.gotmpl
   - name: rook-ceph-cluster
     namespace: rook-ceph
     createNamespace: true
     chart: rook-release/rook-ceph-cluster
+    version: 1.20.2
     values:
       - ../rook-ceph-cluster/values.yaml.gotmpl
     set:

helmfile.d/02-datastore.lock

@@ -5,12 +5,12 @@ dependencies:
     version: 4.9.0
   - name: mariadb
     repository: https://charts.bitnami.com/bitnami
-    version: 26.1.5
+    version: 26.2.0
   - name: pgo
     repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
     version: 5.8.1
   - name: postgrescluster
     repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
     version: 5.7.4
-digest: sha256:d45d84c37d54d2ed3183c312adc6a9d67c273c58cf136360cbe521666b198961
+digest: sha256:3b25151801d6e1d8f40da20804958c88dbe89dde77eaa139276299c8312520ab
-generated: "2026-06-22T10:04:23.168393304-06:00"
+generated: "2026-07-14T11:36:03.449589097-06:00"

helmfile.d/03-apps.lock

@@ -35,9 +35,9 @@ dependencies:
     version: 0.1.0
   - name: matrix-synapse
     repository: https://ananace.gitlab.io/charts
-    version: 3.12.30
+    version: 3.12.31
   - name: static-site
     repository: git+https://github.com/cfpb/static-site@charts?ref=main
     version: 0.1.1
-digest: sha256:1487ec79f2a92f72b8307749d5e02b4227157308ca2cca34ae702226c67800e7
+digest: sha256:02095ab4a4e86a172518e248e3863126116ba0895f58c2e21d1ec39d28ef3ac6
-generated: "2026-06-22T10:04:29.800833027-06:00"
+generated: "2026-07-15T08:54:24.15674129-06:00"

rook-ceph-cluster/values.yaml.gotmpl

@@ -2,6 +2,10 @@ cephClusterSpec:
   dashboard:
     ssl: false
 
+  mon:
+    count: 3
+    allowMultiplePerNode: false
+
   storage:
     useAllNodes: true
     useAllDevices: false
@@ -22,7 +26,7 @@ cephClusterSpec:
         memory: 256Mi
       limits:
         cpu: "1"
-        memory: 64Mi
+        memory: 2Gi
     osd:
       requests:
         cpu: 100m
@@ -66,7 +70,7 @@ cephFileSystems:
         replicated:
           size: 2
       dataPools:
-        - failureDomain: host
+        - failureDomain: osd
           replicated:
             size: 2
           # Optional and highly recommended, 'data0' by default, see https://github.com/rook/rook/blob/master/Documentation/ceph-filesystem-crd.md#pools
@@ -80,7 +84,7 @@ cephFileSystems:
             memory: 64Mi
           limits:
             cpu: "1"
-            memory: 32Mi
+            memory: 512Mi
     storageClass:
       enabled: true
       isDefault: false
@@ -103,3 +107,68 @@ cephFileSystems:
         # will set default as `ext4`. Note that `xfs` is not recommended due to potential deadlock
         # in hyperconverged settings where the volume is mounted on the same node as the osds.
         csi.storage.k8s.io/fstype: ext4
+
+cephBlockPools:
+  - name: ceph-blockpool
+    # see https://github.com/rook/rook/blob/master/Documentation/CRDs/Block-Storage/ceph-block-pool-crd.md#spec for available configuration
+    spec:
+      failureDomain: osd
+      replicated:
+        size: 3
+      # Enables collecting RBD per-image IO statistics by enabling dynamic OSD performance counters. Defaults to false.
+      # For reference: https://docs.ceph.com/docs/latest/mgr/prometheus/#rbd-io-statistics
+      # enableRBDStats: true
+    storageClass:
+      enabled: true
+      name: ceph-block
+      annotations: {}
+      labels: {}
+      isDefault: true
+      reclaimPolicy: Delete
+      allowVolumeExpansion: true
+      volumeBindingMode: "Immediate"
+      mountOptions: []
+      # see https://kubernetes.io/docs/concepts/storage/storage-classes/#allowed-topologies
+      allowedTopologies: []
+      #        - matchLabelExpressions:
+      #            - key: rook-ceph-role
+      #              values:
+      #                - storage-node
+      # see https://github.com/rook/rook/blob/master/Documentation/Storage-Configuration/Block-Storage-RBD/block-storage.md#provision-storage for available configuration
+      parameters:
+        # (optional) mapOptions is a comma-separated list of map options.
+        # For krbd options refer
+        # https://docs.ceph.com/docs/latest/man/8/rbd/#kernel-rbd-krbd-options
+        # For nbd options refer
+        # https://docs.ceph.com/docs/latest/man/8/rbd-nbd/#options
+        # mapOptions: lock_on_read,queue_depth=1024
+
+        # (optional) unmapOptions is a comma-separated list of unmap options.
+        # For krbd options refer
+        # https://docs.ceph.com/docs/latest/man/8/rbd/#kernel-rbd-krbd-options
+        # For nbd options refer
+        # https://docs.ceph.com/docs/latest/man/8/rbd-nbd/#options
+        # unmapOptions: force
+
+        # RBD image format. Defaults to "2".
+        imageFormat: "2"
+
+        # RBD image features, equivalent to OR'd bitfield value: 63
+        # Available for imageFormat: "2". Older releases of CSI RBD
+        # support only the `layering` feature. The Linux kernel (KRBD) supports the
+        # full feature complement as of 5.4
+        imageFeatures: layering
+
+        # These secrets contain Ceph admin credentials.
+        csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
+        csi.storage.k8s.io/provisioner-secret-namespace: "{{ .Release.Namespace }}"
+        csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner
+        csi.storage.k8s.io/controller-expand-secret-namespace: "{{ .Release.Namespace }}"
+        csi.storage.k8s.io/controller-publish-secret-name: rook-csi-rbd-provisioner
+        csi.storage.k8s.io/controller-publish-secret-namespace: "{{ .Release.Namespace }}"
+        csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
+        csi.storage.k8s.io/node-stage-secret-namespace: "{{ .Release.Namespace }}"
+        # Specify the filesystem type of the volume. If not specified, csi-provisioner
+        # will set default as `ext4`. Note that `xfs` is not recommended due to potential deadlock
+        # in hyperconverged settings where the volume is mounted on the same node as the osds.
+        csi.storage.k8s.io/fstype: ext4