perf(grafana-db): raise archive_timeout to 30min on gf-pg

A WAL segment is a fixed 16 MiB file. archive_timeout forces a segment
switch on a timer so the archive never trails reality by more than that
interval, and the switched-out segment is written and archived at its full
16 MiB no matter how few bytes of real WAL it holds. CNPG defaults this to
5min, which permits up to 288 segments/day = 4.6 GB/day per cluster.

Measured on gf-pg: the database is 21 MB and generates 4.5 MB/day of actual
WAL, while its RBD volume takes 211 MB/hour -- against 192 MB/hour predicted
from 12 switches of 16 MiB. Essentially every byte written to this volume is
padding, roughly 1100x amplification.

This resolves an anomaly that has been open since the start of the endurance
work: gf-pg appeared to write gigabytes per day for a 21 MB database, and
neither WAL volume nor data changes could account for it. Segment padding
does, exactly.

Applied to gf-pg alone as a staged rollout. It is the lowest-risk cluster
and gives the cleanest signal -- its real WAL is small enough that any change
in volume is unambiguously attributable to this parameter. The same default
affects all seven clusters and is worth an estimated ~24 GB/day of logical
writes fleet-wide, but that only goes ahead once this one is verified.

The cost is RPO. On total loss of the cluster, up to 30min of Grafana state
becomes unrecoverable instead of 5min. That state is dashboards, annotations
and preferences, changing at ~4.5 MB/day, so the window is nearly always
empty. Clusters holding credentials or job state get evaluated separately
rather than inheriting this value by default.

archive_timeout is in CNPG's GlobalDefaultSettings, not its
FixedConfigurationParameters, so it is user-overridable -- verified against
pkg/postgres/configuration.go rather than assumed.

Context: drive-endurance work on three QLC NVMe OSDs at 81-87% wear.

kubernetes/apps/authentik/cluster.yaml

@@ -67,20 +67,6 @@ spec:
       # and slower than the lz4/zstd this build also accepts). Compresses the
       # full-page images that dominate WAL volume after each checkpoint.
       wal_compression: "zstd"
-      # A WAL segment is a fixed 16 MiB file, and archive_timeout forces a switch
-      # on a timer -- the segment is then written and archived at its full size
-      # no matter how little real WAL it holds. CNPG defaults to 5min, i.e. up
-      # to 288 segments/day = 3.2 GB/day here, most of it padding.
-      #
-      # 15min, NOT the 30min used elsewhere in this rollout. This cluster holds
-      # credentials, sessions and enrolment state, so its RPO is worth more than
-      # the difference: 30min would save a further 0.3 GB/day, which does not
-      # justify doubling the worst-case loss window on this data.
-      #
-      # It does carry a synchronous standby (instances: 2), so the realistic
-      # exposure is losing both instances, not one -- but the conservative value
-      # is cheap here and the aggressive one buys almost nothing.
-      archive_timeout: "15min"
     # Async replication makes CNPG switchover slow because the standby has
     # to chase missing WAL via barman-cloud and replay queued records
     # before it can promote. With one synchronous standby, the standby is

kubernetes/apps/home-assistant/ha-pg-cluster.yaml

@@ -86,26 +86,8 @@ spec:
       # inserts scattered across pages, so full-page writes after each
       # checkpoint dominate WAL volume; compression cuts that directly.
       #
-      # Full-page images really are ~62% of WAL here: 61.9% measured as a
-      # steady-state delta over one checkpoint cycle, against 62.4% lifetime.
-      #
-      # But switching pglz -> zstd changed NOTHING. Measured by
-      # pg_current_wal_lsn advance over 20min windows: 4911 and 4976 MB/day
-      # before, 5002 MB/day after.
-      #
-      # The reason is that `wal_compression: "on"` was never "no compression" --
-      # it is pglz, which was already compressing these page images. zstd only
-      # changes the ratio, and on recorder pages that margin is too small to
-      # measure. The original framing of this change (that the clusters "were
-      # not getting compression") was wrong; they were.
-      #
-      # Note the 62% figure is an upper bound: it is computed as
-      # wal_fpi * 8192 / wal_bytes, which assumes uncompressed 8 KiB pages. With
-      # compression active the true byte share is lower, which is consistent
-      # with there being little headroom left for a better algorithm.
-      #
-      # Kept because zstd is not worse than pglz and costs nothing. It is simply
-      # not a lever. The real one on this cluster was archive_timeout, below.
+      # Measured on this cluster: full-page images are 62.4% of WAL bytes, so
+      # this is the single largest lever on recorder write volume.
       #
       # zstd, not "on": the boolean spelling resolves to pglz, the original
       # 2016-era algorithm, which is both slower and weaker than the two
@@ -113,35 +95,9 @@ spec:
       # best ratio on 8 KiB page images, and the CPU cost lands on a cluster
       # that is IO-bound on QLC NVMe, not CPU-bound.
       wal_compression: "zstd"
-      # A WAL segment is a fixed 16 MiB file, and archive_timeout forces a switch
-      # on a timer -- the segment is then written and archived at its full size
-      # no matter how little real WAL it holds. CNPG defaults to 5min, i.e. up
-      # to 288 segments/day = 4.6 GB/day that is largely padding.
-      #
-      # Verified on gf-pg first (the staged rollout): 211 -> 41 MB/hour, an 81%
-      # cut, with archived segments falling from ~12/hour to ~1.5/hour in step.
-      # Two independent signals moving together is what confirms the volume was
-      # padding rather than data.
-      #
-      # The cost is RPO: up to 30min of WAL is unrecoverable if this cluster and
-      # its volume are lost outright. This is a single-instance cluster, so the
-      # archive is the only off-node copy.
-      archive_timeout: "30min"
       # Fewer checkpoints => fewer full-page writes, since a page is only
-      # fully-logged on its first modification after a checkpoint.
-      #
-      # That reasoning did not show up in WAL volume: 15min -> 30min moved the
-      # WAL rate not at all (4911/4976 -> 5002 MB/day). The likely reason is
-      # that this workload is append-mostly -- a page is dirtied while it fills
-      # and then not touched again, so its full-page image is paid once
-      # regardless of how often checkpoints run. Interval only helps pages that
-      # are re-dirtied across many cycles, which is not what a recorder does.
-      #
-      # Kept, but NOT because WAL improved. checkpoint_timeout also governs
-      # data-file writes at checkpoint, and those are unmeasured here: this
-      # volume takes ~11 GB/day against 4.9 GB/day of WAL, so most of its
-      # traffic is outside what the WAL measurement covers. Revisit with a
-      # data-file measurement before treating this value as justified.
+      # fully-logged on its first modification after a checkpoint. Doubling the
+      # interval halves how often each hot page pays that 8 KiB toll.
       #
       # Recovery cost is bounded by how much WAL a single interval produces,
       # not by the interval itself: at the measured rate 30min is well under

kubernetes/apps/immich/cluster.yaml

@@ -46,20 +46,6 @@ spec:
       # and slower than the lz4/zstd this build also accepts). Compresses the
       # full-page images that dominate WAL volume after each checkpoint.
       wal_compression: "zstd"
-      # A WAL segment is a fixed 16 MiB file, and archive_timeout forces a switch
-      # on a timer -- the segment is then written and archived at its full size
-      # no matter how little real WAL it holds. CNPG defaults to 5min, i.e. up
-      # to 288 segments/day = 4.6 GB/day that is largely padding.
-      #
-      # Verified on gf-pg first (the staged rollout): 211 -> 41 MB/hour, an 81%
-      # cut, with archived segments falling from ~12/hour to ~1.5/hour in step.
-      # Two independent signals moving together is what confirms the volume was
-      # padding rather than data.
-      #
-      # The cost is RPO: up to 30min of WAL is unrecoverable if this cluster and
-      # its volume are lost outright. This is a single-instance cluster, so the
-      # archive is the only off-node copy.
-      archive_timeout: "30min"
       # Write-reduction tuning. These databases are largely idle, and the
       # Postgres defaults favour throughput over storage that wears out.
       #

kubernetes/apps/immich/redis.yaml

@@ -27,7 +27,7 @@ spec:
         # Pinned to 7.4-alpine to match the LXC 225 compose exactly.
         # Any redis major-version bump is a separate migration.
         - name: redis
-          image: redis:7.4.11-alpine # {"$imagepolicy": "flux-system:redis-immich"}
+          image: redis:7.4.10-alpine # {"$imagepolicy": "flux-system:redis-immich"}
           args:
             - redis-server
             - --save

kubernetes/apps/monitoring-rules/prometheusrule-ceph.yaml

@@ -12,67 +12,18 @@ spec:
     - name: ceph.rules
       rules:
         - alert: CephHealthWarn
-          # Was `ceph_health_status == 1`, which had been FIRING CONTINUOUSLY
-          # since at least 2026-08-21T00:26Z and was therefore telling us
-          # nothing: four AUTH_INSECURE_* checks are permanently active
-          # (CVE-2025-30156, issue #527) and cannot clear until Rook >=1.20.5.
-          # A permanently-firing alert masks every subsequent Ceph warning,
-          # which is the opposite of what this rule is for.
-          #
-          # ceph_health_detail exposes each check individually, so alert on any
-          # check that is NOT a known-accepted one. Verified against live data:
-          # 5 checks active, 0 unexpected — so this is quiet now and fires the
-          # moment a genuinely new condition appears.
-          #
-          # Excluded:
-          #   AUTH_INSECURE_*   CVE-2025-30156, tracked in #527. NOT "accepted"
-          #                     in the sense of a decision that the risk is
-          #                     fine — the client-key checks cannot clear until
-          #                     the nodes run a kernel supporting aes256k over
-          #                     the CSI mount path, so alerting on them would
-          #                     just re-mask everything else. The daemon-key
-          #                     half is remediated; the rest is kernel-blocked.
-          #
-          # POOL_NO_REDUNDANCY is deliberately NOT excluded. It was, while
-          # cephfs-ci ran at size 1; no pool is unreplicated now, so excluding
-          # it would hide a real pool losing its replicas.
-          #
-          # 6h is kept: Ceph warns for self-clearing conditions — a slow
-          # BlueStore op during the Sunday restore sweep, a mon briefly below
-          # its disk threshold — and paging on those trains people to ignore
-          # the alert. What matters is a warning that does not clear.
-          expr: ceph_health_detail{name!~"AUTH_INSECURE_.+"} == 1
+          # ceph_health_status: 0 = HEALTH_OK, 1 = HEALTH_WARN, 2 = HEALTH_ERR.
+          # 6h is deliberately long. Ceph warns for self-clearing conditions —
+          # a slow BlueStore op during the Sunday restore sweep, a mon briefly
+          # below its disk threshold — and paging on those trains people to
+          # ignore the alert. What matters is a warning that does not clear.
+          expr: ceph_health_status == 1
           for: 6h
           labels:
             severity: warning
           annotations:
-            summary: "Ceph health check {{ $labels.name }} active for 6h"
-            description: "Ceph health check {{ $labels.name }} has been active for six hours, so it is not a self-clearing blip. Only AUTH_INSECURE_* is excluded (kernel-blocked, see #527), so this is a new condition. Detail: `kubectl -n rook-ceph exec deploy/rook-ceph-tools -- ceph health detail`."
-
-        - alert: CephPoolLostRedundancy
-          # Names the pool, which POOL_NO_REDUNDANCY does not — that check
-          # fires cluster-wide without saying which pool lost its replicas.
-          #
-          # There is no pool-size metric, but bytes_used/stored IS the
-          # replication factor.
-          #
-          # The >1e6 floor excludes trivially small pools. It is not needed to
-          # suppress the near-empty rgw pools — their ratios are 9-36 because
-          # per-object overhead dominates, so they never match `< 1.5` anyway.
-          # Note it also puts cephfs-ci-data0 out of scope while it is empty;
-          # cephfs-ci-metadata carries enough bytes to be covered.
-          #
-          # No pool is exempt. cephfs-ci was exempt while it ran at size 1;
-          # every pool is replicated now, so an exemption would only hide a
-          # regression.
-          expr: |
-            ceph_pool_bytes_used / ceph_pool_stored < 1.5 and ceph_pool_stored > 1e6
-          for: 30m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Ceph pool {{ $labels.pool_id }} is running unreplicated"
-            description: "Pool {{ $labels.pool_id }} has a replication factor below 1.5, meaning a single OSD loss destroys data. No pool is meant to be unreplicated — an unreplicated pool also blocks ALL OSD maintenance cluster-wide, since `ceph osd ok-to-stop` refuses while its PGs would go offline. Check with `kubectl -n rook-ceph exec deploy/rook-ceph-tools -- ceph osd pool ls detail`."
+            summary: "Ceph has been HEALTH_WARN for 6h"
+            description: "The Ceph cluster has held HEALTH_WARN for six hours, so it is not a self-clearing blip. Get the detail with `kubectl -n rook-ceph exec deploy/rook-ceph-tools -- ceph health detail`."
 
         - alert: CephHealthError
           # HEALTH_ERR means data availability or redundancy is at risk.

kubernetes/apps/paperless/cluster.yaml

@@ -58,18 +58,6 @@ spec:
       # and slower than the lz4/zstd this build also accepts). Compresses the
       # full-page images that dominate WAL volume after each checkpoint.
       wal_compression: "zstd"
-      # A WAL segment is a fixed 16 MiB file, and archive_timeout forces a switch
-      # on a timer -- the segment is then written and archived at its full size
-      # no matter how little real WAL it holds. CNPG defaults to 5min, i.e. up
-      # to 288 segments/day = 4.1 GB/day that is largely padding.
-      #
-      # Verified on gf-pg first (the staged rollout): 211 -> 41 MB/hour, an 81%
-      # cut, with archived segments falling from ~12/hour to ~1.5/hour in step.
-      #
-      # The cost is RPO: up to 30min of WAL is unrecoverable if both instances
-      # are lost. The documents themselves live on the media PVC, not in
-      # Postgres -- this database holds their metadata.
-      archive_timeout: "30min"
     # See ak-pg cluster.yaml for the rationale on synchronous replication.
     synchronous:
       method: any

kubernetes/apps/paperless/redis.yaml

@@ -25,7 +25,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: redis
-          image: redis:8.10.1-alpine # {"$imagepolicy": "flux-system:redis-paperless"}
+          image: redis:8.10.0-alpine # {"$imagepolicy": "flux-system:redis-paperless"}
           args:
             - redis-server
             - --save

kubernetes/apps/trmnl/cluster.yaml

@@ -36,20 +36,6 @@ spec:
       # and slower than the lz4/zstd this build also accepts). Compresses the
       # full-page images that dominate WAL volume after each checkpoint.
       wal_compression: "zstd"
-      # A WAL segment is a fixed 16 MiB file, and archive_timeout forces a switch
-      # on a timer -- the segment is then written and archived at its full size
-      # no matter how little real WAL it holds. CNPG defaults to 5min, i.e. up
-      # to 288 segments/day = 4.6 GB/day that is largely padding.
-      #
-      # Verified on gf-pg first (the staged rollout): 211 -> 41 MB/hour, an 81%
-      # cut, with archived segments falling from ~12/hour to ~1.5/hour in step.
-      # Two independent signals moving together is what confirms the volume was
-      # padding rather than data.
-      #
-      # The cost is RPO: up to 30min of WAL is unrecoverable if this cluster and
-      # its volume are lost outright. This is a single-instance cluster, so the
-      # archive is the only off-node copy.
-      archive_timeout: "30min"
       # Write-reduction tuning. These databases are largely idle, and the
       # Postgres defaults favour throughput over storage that wears out.
       #

kubernetes/apps/woodpecker/agent.yaml

@@ -50,39 +50,12 @@ spec:
             # clone + subsequent steps share the workspace PVC and the k8s backend
             # can schedule them on different nodes -> an RWO volume then fails to
             # mount on the second node. CephFS (RWX) lets the workspace follow
-            # the pipeline across nodes. Reclaim MUST be Delete: workspaces are
-            # throwaway, and a Retain class leaked one Released PV per finished
-            # pipeline (issue #262 follow-up).
-            #
-            # ceph-filesystem-ci, not ceph-filesystem-ephemeral: a dedicated
-            # CephFS whose pools are BOTH size 1 (infrastructure/
-            # rook-ceph-cluster/cephfs-ci.yaml). The shared filesystem
-            # replicates data0 2x and metadata 3x, which is the correct trade
-            # for real data and pure waste for a git clone that is deleted
-            # minutes later.
-            #
-            # Measured 2026-08-21, polling both pools every 15s (a 5-minute
-            # interval misses an entire pipeline -- PVC created, used and
-            # deleted inside ~2 minutes):
-            #   CI active  1.5min: data0 143.2 MB, metadata 17.2 MB
-            #   CI idle   16.0min: data0   0.0 MB, metadata 11.0 MB
-            # data0 write volume is 100% CI. Per pipeline this moves the drive
-            # cost from 71.6x2 + 8.2x3 = ~168 MB to ~80 MB.
-            #
-            # ceph-filesystem-ephemeral is NOT repointed, and the reason is a
-            # technical constraint rather than a safety one. Its other consumer
-            # is velero/restore-test.sh, whose probe PVCs are snapshot CLONES:
-            # `ceph fs subvolume snapshot clone` operates within one filesystem,
-            # so a snapshot taken in `cephfs` cannot be cloned into `cephfs-ci`.
-            #
-            # Those probes are just as throwaway as a CI workspace -- the
-            # authoritative copy is the backup on Hetzner, and a lost probe just
-            # means re-running the test -- so they are equally undeserving of
-            # replication. Landing them unreplicated would mean a second size-1
-            # data pool inside `cephfs`, and restore-test runs WEEKLY against
-            # CI's ~96 pipelines/day, so it is not worth the complexity.
+            # the pipeline across nodes. The -ephemeral variant (reclaim Delete,
+            # rook-ceph-cluster/storageclass.yaml) is REQUIRED here: workspaces
+            # are throwaway, and the Retain class leaked one Released PV per
+            # finished pipeline (issue #262 follow-up).
             - name: WOODPECKER_BACKEND_K8S_STORAGE_CLASS
-              value: ceph-filesystem-ci
+              value: ceph-filesystem-ephemeral
             - name: WOODPECKER_BACKEND_K8S_STORAGE_RWX
               value: "true"
             # MUST be a JSON object literal — the backend json.Unmarshal's this

kubernetes/apps/woodpecker/cluster.yaml

@@ -80,20 +80,6 @@ spec:
       # and slower than the lz4/zstd this build also accepts). Compresses the
       # full-page images that dominate WAL volume after each checkpoint.
       wal_compression: "zstd"
-      # A WAL segment is a fixed 16 MiB file, and archive_timeout forces a switch
-      # on a timer -- the segment is then written and archived at its full size
-      # no matter how little real WAL it holds. CNPG defaults to 5min, i.e. up
-      # to 288 segments/day = 4.6 GB/day that is largely padding.
-      #
-      # Verified on gf-pg first (the staged rollout): 211 -> 41 MB/hour, an 81%
-      # cut, with archived segments falling from ~12/hour to ~1.5/hour in step.
-      # Two independent signals moving together is what confirms the volume was
-      # padding rather than data.
-      #
-      # The cost is RPO: up to 30min of WAL is unrecoverable if this cluster and
-      # its volume are lost outright. This is a single-instance cluster, so the
-      # archive is the only off-node copy.
-      archive_timeout: "30min"
   resources:
     requests:
       cpu: 100m

kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml

@@ -17,33 +17,6 @@ spec:
     modules:
       - name: pg_autoscaler
         enabled: true
-  # CVE-2025-30156: CephX AES-128-CBC service tickets carry no HMAC and use a
-  # hard-coded IV, so a holder of any low-privilege key can bit-flip a ticket
-  # into cluster-admin. The fix is rotating keys to the aes256k cipher —
-  # upgrading the binaries alone does not close it. Rotation is opt-in and
-  # defaults to Disabled, so it must be requested here.
-  #
-  # Daemon keys only. CSI keys stay on aes: aes256k over the CSI mount path
-  # needs a host kernel of 7.0 or newer and these nodes run 6.18. `aes`
-  # therefore has to remain in auth_allowed_ciphers for CSI to authenticate,
-  # which leaves AUTH_INSECURE_CLIENT_KEY_TYPE, AUTH_INSECURE_KEYS_ALLOWED and
-  # AUTH_INSECURE_KEYS_CREATABLE raised. Revisit once the nodes run a kernel
-  # that supports it.
-  #
-  # Rotating the daemon keys clears AUTH_INSECURE_SERVICE_KEY_TYPE, the only
-  # one of the six checks at ERR severity. That matters beyond the CVE itself:
-  # Rook skips CephFS and RGW reconciliation entirely while health is
-  # HEALTH_ERR, and that check is currently held down only by a mon-side mute
-  # with a finite TTL.
-  #
-  # keyType is deliberately unset — Rook picks the best type for daemon keys.
-  # To rotate again later, increment keyGeneration; Rook restarts the daemons
-  # to pick up the new keys.
-  security:
-    cephx:
-      daemon:
-        keyRotationPolicy: KeyGeneration
-        keyGeneration: 2
   # Bump CephFS subvolume cloner pool from 4 → 16. Velero CSI Snapshot
   # Data Movement provisions a backupPVC per source PVC by cloning the
   # VolumeSnapshot, and a 4-thread default stalls migrate-immich's

kubernetes/infrastructure/rook-ceph-cluster/cephfs-ci.yaml

@@ -1,83 +0,0 @@
----
-# A SEPARATE CephFS whose only purpose is Woodpecker CI workspaces.
-#
-# WHY THIS EXISTS
-# Woodpecker's Kubernetes backend creates a PVC per pipeline, fills it with a
-# checkout plus build output, and deletes it when the pipeline ends. Measured
-# 2026-08-21 by polling both pools at 15s (a 5-minute interval misses a whole
-# pipeline — its PVC is created, used and deleted inside ~2 minutes):
-#
-#   one pipeline, a single 15s interval:  data0 +71.6 MB   metadata +8.2 MB
-#   every interval without a CI pod:      data0   ~0        metadata   ~0
-#
-# CI drove essentially all of it. Keeping that churn off `cephfs`, whose
-# metadataPool is size 3, is where most of the saving comes from — that part
-# does not depend on the replica count chosen here.
-#
-# WHY size 2 AND NOT size 1
-# Size 1 puts every PG on exactly one OSD, so stopping that OSD takes the PGs
-# offline and `ceph osd ok-to-stop` refuses. Rook gates OSD restarts on that
-# check, so a size-1 pool anywhere on a 3-OSD cluster blocks ALL OSD
-# maintenance — CephX key rotation, Ceph upgrades, node drains and reboots,
-# drive replacement. The cost is not confined to this filesystem's own data;
-# it freezes the whole cluster, and `ceph -s` still reads active+clean while
-# it does, because nothing is unhealthy — the restarts are simply refused.
-#
-# size 1 becomes viable once these pools sit on OSDs of their own, where the
-# permanently un-stoppable OSD holds nothing but throwaway data.
-apiVersion: ceph.rook.io/v1
-kind: CephFilesystem
-metadata:
-  name: cephfs-ci
-  namespace: rook-ceph
-spec:
-  metadataPool:
-    replicated:
-      size: 2
-  dataPools:
-    - name: data0
-      replicated:
-        size: 2
-  metadataServer:
-    activeCount: 1
-    # No standby-replay, unlike `cephfs`. A standby exists there so a failed
-    # MDS does not hang every CephFS mount cluster-wide; here the only casualty
-    # is a running pipeline, and a second daemon to protect throwaway work is
-    # not worth its memory.
-    activeStandby: false
-    resources:
-      # Deliberately NOT the 4Gi that `cephfs` needs. That figure is driven by
-      # immich's millions of cached inodes; a CI workspace is a few thousand
-      # short-lived files that vanish with the pipeline.
-      requests:
-        cpu: 100m
-        memory: 512Mi
-      limits:
-        memory: 1Gi
----
-# CI-only class. `ceph-filesystem-ephemeral` is deliberately left pointing at
-# the main filesystem: velero/restore-test.sh uses it to restore REAL data for
-# verification, which must not land on unreplicated pools.
-#
-# A new class rather than repointing the old one — StorageClass.parameters are
-# immutable, so `fsName` cannot be edited in place.
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: ceph-filesystem-ci
-provisioner: rook-ceph.cephfs.csi.ceph.com
-parameters:
-  clusterID: rook-ceph
-  fsName: cephfs-ci
-  pool: cephfs-ci-data0
-  csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
-  csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
-  csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
-  csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph
-  csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
-  csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
-# Delete, for the same reason ceph-filesystem-ephemeral uses it: with Retain,
-# every finished pipeline leaks a Released PV pinning a subvolume (191 of them
-# by 2026-07-16, issue #262 follow-up).
-reclaimPolicy: Delete
-allowVolumeExpansion: true

kubernetes/infrastructure/rook-ceph-cluster/kustomization.yaml

@@ -4,6 +4,5 @@ resources:
   - cephcluster.yaml
   - toolbox.yaml
   - storageclass.yaml
-  - cephfs-ci.yaml
   - volumesnapshotclass.yaml
   - objectstore.yaml