nfs: disable unneeded services - #417

The nfs-server DaemonSet runs piraeus-csi-nfs-server v1.10.3, which
boots systemd as PID 1 in a privileged container with the host /dev
mounted. Its getty units hang up the host's getty@tty1 about a second
after the pod starts; systemd restarts the host getty until it hits
the start limit and gives up, so login on the local or out-of-band
console stops working on nodes that run the NFS server. Seen on
bare-metal Ubuntu 24.04 nodes with Cozystack 1.6.5 and 1.7.0.

Upstream fixed the image by disabling the services the NFS server does
not need (piraeusdatastore/linstor-csi#417, reported as
piraeusdatastore/piraeus-operator#961), first shipped in v1.10.6.

v2.10.7 is the newest release on the same 2.10 line whose image set
matches what this repository already builds itself: LINSTOR 1.33.3 and
LINSTOR CSI v1.11.2, so the nfs-server image now matches the CSI
driver. The bump also carries the operator-side NFS server template
changes made for those images, which an image-tag override alone
would leave behind. CRD changes in this range are descriptions only.

The chart is vendored the way `make update` does it, which also drops
the stale CRD copy from the vendored chart; piraeus-operator-crds
installs the CRDs.

Tested with helm template (nfs-server renders v1.11.2, operator
v2.10.7) and make helm-unit-tests.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <[email protected]>

The nfs-server DaemonSet runs piraeus-csi-nfs-server v1.10.3, which
boots systemd as PID 1 in a privileged container with the host /dev
mounted. Its getty units hang up the host's getty@tty1 about a second
after the pod starts; systemd restarts the host getty until it hits
the start limit and gives up, so login on the local or out-of-band
console stops working on nodes that run the NFS server. Seen on
bare-metal Ubuntu 24.04 nodes with Cozystack 1.6.5 and 1.7.0.

Upstream fixed the image by disabling the services the NFS server does
not need (piraeusdatastore/linstor-csi#417, reported as
piraeusdatastore/piraeus-operator#961); v1.10.6 includes the fix.

v2.10.7 is the newest release on the same 2.10 line whose image set
matches what this repository already builds itself: LINSTOR 1.33.3 and
LINSTOR CSI v1.11.2, so the nfs-server image now matches the CSI
driver. The bump also carries the operator-side NFS server template
changes made for those images, which an image-tag override alone
would leave behind. CRD changes in this range are descriptions only.

The chart is vendored the way `make update` does it, which also drops
the stale CRD copy from the vendored chart; piraeus-operator-crds
installs the CRDs. Declare the local chart dependency so Helm can
validate the umbrella chart without changing its rendered resources.

Tested with helm template (nfs-server renders v1.11.2, operator
v2.10.7) and make helm-unit-tests.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <[email protected]>

The nfs-server DaemonSet runs piraeus-csi-nfs-server v1.10.3, which
boots systemd as PID 1 in a privileged container with the host /dev
mounted. Its getty units hang up the host's getty@tty1 about a second
after the pod starts; systemd restarts the host getty until it hits
the start limit and gives up, so login on the local or out-of-band
console stops working on nodes that run the NFS server. Seen on
bare-metal Ubuntu 24.04 nodes with Cozystack 1.6.5 and 1.7.0.

Upstream fixed the image by disabling the services the NFS server does
not need (piraeusdatastore/linstor-csi#417, reported as
piraeusdatastore/piraeus-operator#961); v1.10.6 includes the fix.

v2.10.7 is the newest release on the same 2.10 line whose image set
matches what this repository already builds itself: LINSTOR 1.33.3 and
LINSTOR CSI v1.11.2, so the nfs-server image now matches the CSI
driver. The bump also carries the operator-side NFS server template
changes made for those images, which an image-tag override alone
would leave behind. CRD changes in this range are descriptions only.

The chart is vendored the way `make update` does it, which also drops
the stale CRD copy from the vendored chart; piraeus-operator-crds
installs the CRDs. Declare the local chart dependency so Helm can
validate the umbrella chart without changing its rendered resources.

v2.10.7 gives the CSI pods their client certificate as mounted files
through LS_USER_CERTIFICATE_FILE and LS_USER_KEY_FILE, instead of
inline values in LS_USER_CERTIFICATE and LS_USER_KEY. The
linstor-wait-until v0.3.1 in the linstor-csi image is built on a
golinstor release that reads only the inline variables, so its init
containers present no client certificate, the LINSTOR API closes the
TLS connection, and they retry on EOF forever. Move the image to
linstor-wait-until v1.0.0, the version upstream linstor-csi v1.11.2
pins.

Tested with helm template (nfs-server renders v1.11.2, operator
v2.10.7) and make helm-unit-tests.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <[email protected]>

The nfs-server DaemonSet runs piraeus-csi-nfs-server v1.10.3, which
boots systemd as PID 1 in a privileged container with the host /dev
mounted. Its getty units hang up the host's getty@tty1 about a second
after the pod starts; systemd restarts the host getty until it hits
the start limit and gives up, so login on the local or out-of-band
console stops working on nodes that run the NFS server. Seen on
bare-metal Ubuntu 24.04 nodes with Cozystack 1.6.5 and 1.7.0.

Upstream fixed the image by disabling the services the NFS server does
not need (piraeusdatastore/linstor-csi#417, reported as
piraeusdatastore/piraeus-operator#961); v1.10.6 includes the fix.

v2.10.7 is the newest release on the same 2.10 line whose image set
matches what this repository already builds itself: LINSTOR 1.33.3 and
LINSTOR CSI v1.11.2, so the nfs-server image now matches the CSI
driver. The bump also carries the operator-side NFS server template
changes made for those images, which an image-tag override alone
would leave behind. CRD changes in this range are descriptions only.

The chart is vendored the way `make update` does it, which also drops
the stale CRD copy from the vendored chart; piraeus-operator-crds
installs the CRDs. Declare the local chart dependency so Helm can
validate the umbrella chart without changing its rendered resources.

v2.10.7 gives the CSI pods their client certificate as mounted files
through LS_USER_CERTIFICATE_FILE and LS_USER_KEY_FILE, instead of
inline values in LS_USER_CERTIFICATE and LS_USER_KEY. The
linstor-wait-until v0.3.1 in the linstor-csi image is built on a
golinstor release that reads only the inline variables, so its init
containers present no client certificate, the LINSTOR API closes the
TLS connection, and they retry on EOF forever. Move the image to
linstor-wait-until v1.0.0, the version upstream linstor-csi v1.11.2
pins.

Tested with helm template (nfs-server renders v1.11.2, operator
v2.10.7) and make helm-unit-tests.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <[email protected]>

The nfs-server DaemonSet runs piraeus-csi-nfs-server v1.10.3, which
boots systemd as PID 1 in a privileged container with the host /dev
mounted. Its getty units hang up the host's getty@tty1 about a second
after the pod starts; systemd restarts the host getty until it hits
the start limit and gives up, so login on the local or out-of-band
console stops working on nodes that run the NFS server. Seen on
bare-metal Ubuntu 24.04 nodes with Cozystack 1.6.5 and 1.7.0.

Upstream fixed the image by disabling the services the NFS server does
not need (piraeusdatastore/linstor-csi#417, reported as
piraeusdatastore/piraeus-operator#961); v1.10.6 includes the fix.

v2.12.1 is the current stable release. Its image set is LINSTOR
1.35.3 and LINSTOR CSI v1.13.2, which this repository builds itself;
both builds follow in the next commits. The CSI release line is what
carries IO QoS limits (qos.linbit.com/* StorageClass parameters,
added in v1.11.3), which operators have asked for.

Behaviour that changes with this range:

- The CSIDriver moves to fsGroupPolicy: File, so fsGroup is applied
  to ReadWriteMany filesystem volumes too.
- The operator manages Secrets only in its own namespace, and the CSI
  controller loses its cluster-wide read on Secrets; nothing in this
  repository references snapshotter Secrets.
- The csi-health-monitor sidecar is removed.
- Volume group snapshots are enabled only when the
  groupsnapshot.storage.k8s.io/v1 API is served; the snapshot
  controller here still ships v1alpha1, so they stay off.

The csi-provisioner arguments are unchanged in this range, so the
restated strictTopology list stays complete.

The chart is vendored the way `make update` does it, which also drops
the stale CRD copy from the vendored chart; piraeus-operator-crds
installs the CRDs. Declare the local chart dependency so Helm can
validate the umbrella chart without changing its rendered resources.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <[email protected]>

The nfs-server DaemonSet runs piraeus-csi-nfs-server v1.10.3, which
boots systemd as PID 1 in a privileged container with the host /dev
mounted. Its getty units hang up the host's getty@tty1 about a second
after the pod starts; systemd restarts the host getty until it hits
the start limit and gives up, so login on the local or out-of-band
console stops working on nodes that run the NFS server. Seen on
bare-metal Ubuntu 24.04 nodes with Cozystack 1.6.5 and 1.7.0.

Upstream fixed the image by disabling the services the NFS server does
not need (piraeusdatastore/linstor-csi#417, reported as
piraeusdatastore/piraeus-operator#961); v1.10.6 includes the fix.

v2.12.1 is the current stable release. Its image set is LINSTOR
1.35.3 and LINSTOR CSI v1.13.2, which this repository builds itself;
both builds follow in the next commits. The CSI release line is what
carries IO QoS limits (qos.linbit.com/* StorageClass parameters,
added in v1.11.3), which operators have asked for.

Behaviour that changes with this range:

- The CSIDriver moves to fsGroupPolicy: File, so fsGroup is applied
  to ReadWriteMany filesystem volumes too.
- The operator manages Secrets only in its own namespace, and the CSI
  controller loses its cluster-wide read on Secrets; nothing in this
  repository references snapshotter Secrets.
- The csi-health-monitor sidecar is removed.
- Volume group snapshots are enabled only when the
  groupsnapshot.storage.k8s.io/v1 API is served; the snapshot
  controller here still ships v1alpha1, so they stay off.

The csi-provisioner arguments are unchanged in this range, so the
restated strictTopology list stays complete.

The chart is vendored the way `make update` does it, which also drops
the stale CRD copy from the vendored chart; piraeus-operator-crds
installs the CRDs. Declare the local chart dependency so Helm can
validate the umbrella chart without changing its rendered resources.

This commit is not deployable on its own. The operator now hands the
CSI pods their client certificate through LS_USER_CERTIFICATE_FILE and
LS_USER_KEY_FILE, which the linstor-wait-until in the current
linstor-csi image does not read, so the CSI init containers retry
forever until the linstor-csi update in the next commit.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <[email protected]>