fix(vaultwarden): migrate PVC from cephfs to ceph-rbd - #409
Open
GreatSymphonia wants to merge 1 commit into
Open
fix(vaultwarden): migrate PVC from cephfs to ceph-rbd#409GreatSymphonia wants to merge 1 commit into
GreatSymphonia wants to merge 1 commit into
Conversation
vaultwarden-pvc backs a plain SQLite file with a single replica (RWX not actually needed). The kernel CephFS client has corrupted this mount 3 times now (2026-08-06, 2026-08-25), each time breaking login via authentik SSO with "unable to open database file" / upstream timeout errors. Move it to ceph-rbd (block storage, RWO) like the other single-writer database workloads in this cluster.
alexvegas22
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexte
vaultwarden-pvc(SQLite, replica unique, RWX pas réellement nécessaire) est sur la storage classcephfs. Le client kernel CephFS a corrompu ce mount 3 fois :r2d2 unable to open database filedans les logs.r2d2, plus unFailedMountactif sur le nœud (mount CSI bloqué) — corrigé viaumount -ldu mount CSI + recréation du pod.Comme pour
forgejo,nextcloudetcampusparent, on déplace ce volume versceph-rbd(RWO, block storage) pour éliminer ce mode de panne récurrent.Changement
storageClassName: cephfs → ceph-rbdaccessModes: ReadWriteMany → ReadWriteOnce(un seul replica, RWX inutile)storageClassNameetaccessModessont immuables sur un PVC existant — ArgoCD ne pourra pas appliquer ce changement in-place et affichera un diff persistant (voire un échec de sync). Il faut migrer manuellement, dans cet ordre :kubectl scale deployment vaultwarden -n vaultwarden --replicas=0kubectl run vw-copy --image=busybox -n vaultwarden --overrides='...' --restart=Never -- sleep 3600monté sur l'ancien PVC, puiskubectl cple contenu de/dataen local (ou vers un nouveau pod monté sur les deux PVCs à la fois pour uncp -adirect)kubectl delete pvc vaultwarden-pvc -n vaultwarden(l'ancien, sur cephfs)ceph-rbdkubectl scale deployment vaultwarden -n vaultwarden --replicas=1kubectl logs deploy/vaultwarden -n vaultwarden) et tester le login SSOFenêtre de maintenance recommandée pour cette étape — vaultwarden sera indisponible pendant la copie des données.