#################################################################################################################
# Create a Ceph pool with settings for replication in production environments. A minimum of 3 OSDs on
# different hosts are required in this example.
#  kubectl create -f nfs.yaml
#
# This example is for Ceph v16 and above only. If you are using Ceph v15, see Rook v1.8 examples
# from the 'release-1.8' branch
#################################################################################################################

apiVersion: ceph.rook.io/v1
kind: CephNFS
metadata:
  name: my-nfs
  namespace: rook-ceph # namespace:cluster
spec:
  # Settings for the NFS server
  server:
    # The number of active NFS servers
    # Rook supports creating more than one active NFS server, but cannot guarantee high availability
    active: 1

    # where to run the NFS server
    placement:
      # nodeAffinity:
      #   requiredDuringSchedulingIgnoredDuringExecution:
      #     nodeSelectorTerms:
      #     - matchExpressions:
      #       - key: role
      #         operator: In
      #         values:
      #         - nfs-node
      # topologySpreadConstraints:
      # tolerations:
      # - key: nfs-node
      #   operator: Exists
      # podAffinity:
      # podAntiAffinity:

    # A key/value list of annotations to apply to NFS server pods
    annotations:
      # key: value

    # A key/value list of labels to apply to NFS server pods
    labels:
      # key: value

    # Resource requests and limits to apply to NFS server pods
    resources:
      # limits:
      #   cpu: "3"
      #   memory: "8Gi"
      # requests:
      #   cpu: "3"
      #   memory: "8Gi"

    # Set priority class to set to influence the scheduler's pod preemption
    # priorityClassName:

    # The logging levels: NIV_NULL | NIV_FATAL | NIV_MAJ | NIV_CRIT | NIV_WARN | NIV_EVENT | NIV_INFO | NIV_DEBUG | NIV_MID_DEBUG |NIV_FULL_DEBUG |NB_LOG_LEVEL
    logLevel: NIV_INFO

  # Configure security options for the NFS cluster. See docs for more information:
  # https://rook.github.io/docs/rook/latest/Storage-Configuration/NFS/nfs-security/
  security:
  #   sssd:
  #     sidecar:
  #       image: registry.access.redhat.com/rhel7/sssd:latest
  #       sssdConfigFile:
  #         volumeSource:
  #           configMap:
  #             name: my-nfs-sssd-config
  #             defaultMode: 0600 # mode must be 0600
  #       # debugLevel: 6
  #
  #       resources:
  #         limits:
  #           cpu: "2"
  #           memory: "1Gi"
  #         requests:
  #           cpu: "2"
  #           memory: "1Gi"
# ---
# # The built-in Ceph pool ".nfs" is used for storing configuration for all CephNFS clusters. If this
# # shared pool needs to be configured with alternate settings, create this pool (once) with any of
# # the pool properties. Create this pool before creating any CephNFSes, or else some properties may
# # not be applied when the pool is created by default. This pool must be replicated.
# apiVersion: ceph.rook.io/v1
# kind: CephBlockPool
# metadata:
#   name: builtin-nfs
#   namespace: rook-ceph # namespace:cluster
# spec:
#   # The required pool name ".nfs" cannot be specified as a K8s resource name, thus we override
#   # the pool name created in Ceph with this name property
#   name: .nfs
#   failureDomain: host
#   replicated:
#     size: 3
#     requireSafeReplicaSize: true
# ---
# # Example configmap for providing sssd.conf file to the SSSD sidecar
# # Note that this example uses an obfuscated password that may still not be as secure as desired
# apiVersion: v1
# kind: ConfigMap
# metadata:
#   name: my-nfs-sssd-config
#   namespace: rook-ceph # namespace:cluster
# data:
#   sssd.conf: |
#     [sssd]
#     # Only the nss service is required for the SSSD sidecar.
#     services = nss
#     domains = default
#     config_file_version = 2
#
#     [nss]
#     filter_users = root
#
#     [domain/default]
#     id_provider = ldap
#     ldap_uri = ldap://server.address
#     ldap_search_base = dc=company,dc=net
#     ldap_default_bind_dn = cn=admin,dc=company,dc=net
#     ldap_default_authtok_type = obfuscated_password
#     ldap_default_authtok = some-obfuscated-password
#     ldap_user_search_base = ou=users,dc=company,dc=net
#     ldap_group_search_base = ou=groups,dc=company,dc=net
#     ldap_access_filter = memberOf=cn=rook,ou=groups,dc=company,dc=net
#     # recommended options for speeding up LDAP lookups:
#     enumerate = false
#     ignore_group_members = true