fix(ceph): OSD raw volume label must not contain "ceph"

All three OSD prepare jobs on the Hetzner rehearsal finished with zero OSDs: cephosd: skipping device "sdb1": ["Used by ceph-disk"] The partition is exactly what the machine config asked for (PARTLABEL r-ceph-osd, plain Linux partition type). ceph-volume rejects it anyway — its ceph-disk-member test is `"ceph" in PARTLABEL or PARTTYPE in ceph_disk_guids` (ceph_volume/util/device.py) — so any label containing "ceph" reads as a legacy ceph-disk partition and is never provisioned. Talos derives the label from the RawVolumeConfig name (r-<name>), so the name changes: ceph-osd -> osd-data, label r-osd-data. This is why the rebuild branch called it osd-data; the #798 review renamed it back for symmetry with the node label without this failure being known. Production is unaffected today: the MS-01 OSDs match on the by-id half of devicePathFilter and no r-ceph-osd partition exists there. The partlabel half is the migration target and would have failed on the first repartitioned drive. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
fix(infrastructure): move the LAPI ServersTransport behind the Traefik CRDs
2026-09-06 23:44:06 +02:00 · 2026-09-06 23:23:16 +02:00 · 2026-09-06 23:20:15 +02:00 · 2026-09-06 23:17:00 +02:00
13 changed files with 89 additions and 94 deletions
@@ -1379,8 +1379,8 @@ EOF
            vm_addr="${NODE_ADDRS[$idx]}"
            vols=$(talosctl -n "$vm_addr" -e "$vm_addr" get discoveredvolumes 2>&1) \
                || fail "could not read volumes from $vm_node ($vm_addr): ${vols//$'\n'/ | }"
-            awk '$NF == "r-ceph-osd" {found=1} END {exit !found}' <<<"$vols" \
-                || fail "$vm_node has no r-ceph-osd partition — RawVolumeConfig did not take"
+            awk '$NF == "r-osd-data" {found=1} END {exit !found}' <<<"$vols" \
+                || fail "$vm_node has no r-osd-data partition — RawVolumeConfig did not take"
            kubectl get node "$vm_node" \
                -o jsonpath='{.metadata.labels.storage\.renner\.uno/ceph-osd}' \
                | grep -q true \
@@ -1,6 +1,6 @@
 ---
 # This manifest was generated by flux. DO NOT EDIT.
-# Flux Version: v2.8.6
+# Flux Version: v2.8.3
 # Components: source-controller,kustomize-controller,helm-controller,notification-controller,image-reflector-controller,image-automation-controller
 apiVersion: v1
 kind: Namespace
@@ -8,7 +8,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
  name: flux-system
@@ -19,7 +19,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: allow-egress
  namespace: flux-system
 spec:
@@ -39,7 +39,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: allow-scraping
  namespace: flux-system
 spec:
@@ -59,7 +59,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: allow-webhooks
  namespace: flux-system
 spec:
@@ -78,7 +78,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: critical-pods-flux-system
  namespace: flux-system
 spec:
@@ -98,7 +98,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: crd-controller-flux-system
 rules:
 - apiGroups:
@@ -204,7 +204,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: flux-edit-flux-system
@@ -231,7 +231,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -257,7 +257,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: cluster-reconciler-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -277,7 +277,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: crd-controller-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -315,7 +315,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: buckets.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -702,7 +702,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: externalartifacts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -898,7 +898,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: gitrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1385,7 +1385,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: helmcharts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1744,7 +1744,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: helmrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2070,7 +2070,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: ocirepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2484,7 +2484,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: source-controller
  namespace: flux-system
 ---
@@ -2495,7 +2495,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -2516,7 +2516,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -2537,7 +2537,7 @@ spec:
        app.kubernetes.io/component: source-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.8.6
+        app.kubernetes.io/version: v2.8.3
    spec:
      containers:
      - args:
@@ -2560,7 +2560,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/source-controller:v1.8.3
+        image: ghcr.io/fluxcd/source-controller:v1.8.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -2624,7 +2624,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: kustomizations.kustomize.toolkit.fluxcd.io
 spec:
  group: kustomize.toolkit.fluxcd.io
@@ -3338,7 +3338,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: kustomize-controller
  namespace: flux-system
 ---
@@ -3349,7 +3349,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    control-plane: controller
  name: kustomize-controller
  namespace: flux-system
@@ -3368,7 +3368,7 @@ spec:
        app.kubernetes.io/component: kustomize-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.8.6
+        app.kubernetes.io/version: v2.8.3
    spec:
      containers:
      - args:
@@ -3387,7 +3387,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/kustomize-controller:v1.8.4
+        image: ghcr.io/fluxcd/kustomize-controller:v1.8.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -3444,7 +3444,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: helmreleases.helm.toolkit.fluxcd.io
 spec:
  group: helm.toolkit.fluxcd.io
@@ -4197,11 +4197,8 @@ spec:
                      rollback has been performed.
                    type: boolean
                  force:
-                    description: |-
-                      Force forces resource updates through a replacement strategy
-                      that avoids 3-way merge conflicts on client-side apply.
-                      This field is ignored for server-side apply (which always
-                      forces conflicts with other field managers).
+                    description: Force forces resource updates through a replacement
+                      strategy.
                    type: boolean
                  recreate:
                    description: |-
@@ -4405,11 +4402,8 @@ spec:
                      upgrade has been performed.
                    type: boolean
                  force:
-                    description: |-
-                      Force forces resource updates through a replacement strategy
-                      that avoids 3-way merge conflicts on client-side apply.
-                      This field is ignored for server-side apply (which always
-                      forces conflicts with other field managers).
+                    description: Force forces resource updates through a replacement
+                      strategy.
                    type: boolean
                  preserveValues:
                    description: |-
@@ -4894,7 +4888,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: helm-controller
  namespace: flux-system
 ---
@@ -4905,7 +4899,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    control-plane: controller
  name: helm-controller
  namespace: flux-system
@@ -4924,7 +4918,7 @@ spec:
        app.kubernetes.io/component: helm-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.8.6
+        app.kubernetes.io/version: v2.8.3
    spec:
      containers:
      - args:
@@ -4943,7 +4937,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/helm-controller:v1.5.4
+        image: ghcr.io/fluxcd/helm-controller:v1.5.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -5000,7 +4994,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: alerts.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -5394,7 +5388,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: providers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -5809,7 +5803,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: receivers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -5933,10 +5927,7 @@ spec:
              secretRef:
                description: |-
                  SecretRef specifies the Secret containing the token used
-                  to validate the payload authenticity. The Secret must contain a 'token'
-                  key. For GCR receivers, the Secret must also contain an 'email' key
-                  with the IAM service account email configured on the Pub/Sub push
-                  subscription, and an 'audience' key with the expected OIDC token audience.
+                  to validate the payload authenticity.
                properties:
                  name:
                    description: Name of the referent.
@@ -6293,7 +6284,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: notification-controller
  namespace: flux-system
 ---
@@ -6304,7 +6295,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -6325,7 +6316,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    control-plane: controller
  name: webhook-receiver
  namespace: flux-system
@@ -6346,7 +6337,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -6365,7 +6356,7 @@ spec:
        app.kubernetes.io/component: notification-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.8.6
+        app.kubernetes.io/version: v2.8.3
    spec:
      containers:
      - args:
@@ -6383,7 +6374,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.8.4
+        image: ghcr.io/fluxcd/notification-controller:v1.8.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -6445,7 +6436,7 @@ metadata:
    app.kubernetes.io/component: image-reflector-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: imagepolicies.image.toolkit.fluxcd.io
 spec:
  group: image.toolkit.fluxcd.io
@@ -7037,7 +7028,7 @@ metadata:
    app.kubernetes.io/component: image-reflector-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: imagerepositories.image.toolkit.fluxcd.io
 spec:
  group: image.toolkit.fluxcd.io
@@ -7647,7 +7638,7 @@ metadata:
    app.kubernetes.io/component: image-reflector-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: image-reflector-controller
  namespace: flux-system
 ---
@@ -7658,7 +7649,7 @@ metadata:
    app.kubernetes.io/component: image-reflector-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    control-plane: controller
  name: image-reflector-controller
  namespace: flux-system
@@ -7677,7 +7668,7 @@ spec:
        app.kubernetes.io/component: image-reflector-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.8.6
+        app.kubernetes.io/version: v2.8.3
    spec:
      containers:
      - args:
@@ -7756,7 +7747,7 @@ metadata:
    app.kubernetes.io/component: image-automation-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: imageupdateautomations.image.toolkit.fluxcd.io
 spec:
  group: image.toolkit.fluxcd.io
@@ -8585,7 +8576,7 @@ metadata:
    app.kubernetes.io/component: image-automation-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
  name: image-automation-controller
  namespace: flux-system
 ---
@@ -8596,7 +8587,7 @@ metadata:
    app.kubernetes.io/component: image-automation-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.6
+    app.kubernetes.io/version: v2.8.3
    control-plane: controller
  name: image-automation-controller
  namespace: flux-system
@@ -8615,7 +8606,7 @@ spec:
        app.kubernetes.io/component: image-automation-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.8.6
+        app.kubernetes.io/version: v2.8.3
    spec:
      containers:
      - args:
@@ -8634,7 +8625,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/image-automation-controller:v1.1.2
+        image: ghcr.io/fluxcd/image-automation-controller:v1.1.1
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -8,10 +8,10 @@ metadata:
 spec:
  interval: 1m0s
  ref:
-    branch: master
+    branch: rehearsal-san
  secretRef:
-    name: flux-system
-  url: https://gitea.renner.uno/k.renner/homelab.git
+    name: flux-system-breakglass
+  url: https://github.com/konairius/Homelab.git
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -31,22 +31,12 @@
 # serves read-only decision streams to a valid bouncer key and nothing else.
 # The admin surface is cscli, in-cluster. If the source address ever becomes
 # deterministic, an ipAllowList can be added on top.
---
+#
 # The LAPI serves HTTPS only once tls.enabled is set — there is no plaintext
 # fallback and no second port; 8080 is the TLS port. Its certificate comes
 # from the chart's own self-signed CA, so Traefik needs that CA to verify the
-# backend. SANs include crowdsec-service.crowdsec.svc.cluster.local, which is
-# what the Service resolves to.
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: crowdsec-lapi
-  namespace: crowdsec
-spec:
-  serverName: crowdsec-service.crowdsec.svc.cluster.local
-  rootCAs:
-    - secret: crowdsec-root-secret
---
+# backend; the ServersTransport carrying it is a traefik.io CRD consumer and
+# lives in post-crds/crowdsec-lapi-serverstransport.yaml.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -0,0 +1,11 @@
+# traefik.io CRD consumer for the public LAPI endpoint (crowdsec/lapi-ingress.yaml
+# holds the Ingress). The CA it names is the chart's self-signed LAPI CA.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: crowdsec-lapi
+  namespace: crowdsec
+spec:
+  serverName: crowdsec-service.crowdsec.svc.cluster.local
+  rootCAs:
+    - secret: crowdsec-root-secret
@@ -31,4 +31,5 @@ resources:
  - traefik-crowdsec-middleware.yaml
  - traefik-rate-limit-middleware.yaml
  - traefik-security-headers-middleware.yaml
+  - crowdsec-lapi-serverstransport.yaml
  - ../network-policies/
@@ -144,10 +144,12 @@ spec:
    useAllDevices: false
    # Two forms while the production drives are migrated:
    #
-    #   by-partlabel/r-ceph-osd  the target. Talos names the drive in the
-    #                            machine config (RawVolumeConfig ceph-osd), so
+    #   by-partlabel/r-osd-data  the target. Talos names the drive in the
+    #                            machine config (RawVolumeConfig osd-data), so
    #                            this file needs to know nothing about models,
-    #                            serials or hostnames.
+    #                            serials or hostnames. The label must not
+    #                            contain "ceph": ceph-volume rejects any such
+    #                            partition as a legacy ceph-disk member.
    #   by-id/nvme-SAMSUNG…      the three MS-01 drives as they are today:
    #                            bluestore written straight onto the raw disk,
    #                            with no partition table and therefore no
@@ -159,7 +161,7 @@ spec:
    #
    # The second half goes when those three are repartitioned, one node at a
    # time. Until then it is what keeps the running OSDs claimed.
-    devicePathFilter: "^/dev/disk/by-(partlabel/r-ceph-osd|id/nvme-SAMSUNG_MZQLB960HAJR)"
+    devicePathFilter: "^/dev/disk/by-(partlabel/r-osd-data|id/nvme-SAMSUNG_MZQLB960HAJR)"
    config:
      osdsPerDevice: "1"
  # Highest built-in class: kubelet evicts these last and the kernel gives
@@ -57,7 +57,7 @@ up: true
 ---
 apiVersion: v1alpha1
 kind: RawVolumeConfig
-name: ceph-osd
+name: osd-data
 provisioning:
  diskSelector:
    # Two disks: the system disk and the attached volume. Matching on transport
@@ -42,7 +42,7 @@ up: true
 ---
 apiVersion: v1alpha1
 kind: RawVolumeConfig
-name: ceph-osd
+name: osd-data
 provisioning:
  diskSelector:
    match: '!system_disk'
@@ -42,7 +42,7 @@ up: true
 ---
 apiVersion: v1alpha1
 kind: RawVolumeConfig
-name: ceph-osd
+name: osd-data
 provisioning:
  diskSelector:
    match: '!system_disk'
@@ -21,7 +21,7 @@ auto: off
 hostname: vm-2
 ---
 # The OSD device, named by the machine that has it. Ceph then consumes
-# /dev/disk/by-partlabel/r-ceph-osd and needs to know nothing about models,
+# /dev/disk/by-partlabel/r-osd-data and needs to know nothing about models,
 # serials or hostnames — the same CephCluster works here and on the MS-01s.
 #
 # The selector is a CEL expression, so each machine says whatever identifies its
@@ -29,7 +29,7 @@ hostname: vm-2
 # real nodes it will name the Samsung.
 apiVersion: v1alpha1
 kind: RawVolumeConfig
-name: ceph-osd
+name: osd-data
 provisioning:
  diskSelector:
    match: disk.transport == "virtio" && !system_disk
@@ -15,7 +15,7 @@ hostname: vm-3
 ---
 apiVersion: v1alpha1
 kind: RawVolumeConfig
-name: ceph-osd
+name: osd-data
 provisioning:
  diskSelector:
    match: disk.transport == "virtio" && !system_disk
@@ -19,7 +19,7 @@ hostname: vm-4
 ---
 apiVersion: v1alpha1
 kind: RawVolumeConfig
-name: ceph-osd
+name: osd-data
 provisioning:
  diskSelector:
    match: disk.transport == "virtio" && !system_disk
Author	SHA1	Message	Date
claude-botandClaude Fable 5.1	6446616621	fix(ceph): OSD raw volume label must not contain "ceph" All three OSD prepare jobs on the Hetzner rehearsal finished with zero OSDs: cephosd: skipping device "sdb1": ["Used by ceph-disk"] The partition is exactly what the machine config asked for (PARTLABEL r-ceph-osd, plain Linux partition type). ceph-volume rejects it anyway — its ceph-disk-member test is `"ceph" in PARTLABEL or PARTTYPE in ceph_disk_guids` (ceph_volume/util/device.py) — so any label containing "ceph" reads as a legacy ceph-disk partition and is never provisioned. Talos derives the label from the RawVolumeConfig name (r-<name>), so the name changes: ceph-osd -> osd-data, label r-osd-data. This is why the rebuild branch called it osd-data; the #798 review renamed it back for symmetry with the node label without this failure being known. Production is unaffected today: the MS-01 OSDs match on the by-id half of devicePathFilter and no r-ceph-osd partition exists there. The partlabel half is the migration target and would have failed on the first repartitioned drive. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-06 23:44:06 +02:00
claude-botandClaude Fable 5.1	5cb944a2d3	fix(infrastructure): move the LAPI ServersTransport behind the Traefik CRDs A cold rebuild stops permanently at the infrastructure Kustomization: ServersTransport/crowdsec/crowdsec-lapi dry-run failed: no matches for kind "ServersTransport" in version "traefik.io/v1alpha1" Flux dry-runs the whole apply set, so this one unknown kind rejects all of it — including the Traefik HelmRelease that installs the CRD. Measured on the Hetzner rehearsal: zero HelmReleases, zero CRDs, no progress. The public LAPI endpoint (2026-09-02) landed after the post-crds sweep and put a traefik.io consumer back into the layer that creates traefik.io. The Ingress is a core kind and stays. Rehearsal branch: one step. For production this must ship add-then-remove, because both Kustomizations prune. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-06 23:23:16 +02:00
claude-botandClaude Fable 5.1	c269d68639	rehearsal: flux components as the operator CLI (v2.8.3) writes them Throwaway branch only. The local flux CLI is v2.8.3 while master carries v2.8.6, so `flux bootstrap` committed a downgrade to GitHub; mirroring it here keeps Gitea, GitHub and the cluster on one version for this run. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-06 23:20:15 +02:00
claude-botandClaude Fable 5.1	394ab82093	rehearsal: flux sync manifests for the GitHub break-glass source Throwaway branch only. Gitea push-mirror force-syncs every branch on every push, which erased the commit `flux bootstrap github` made here; carrying the same gotk-sync on the Gitea side keeps mirror and cluster in step. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-06 23:17:00 +02:00