up

mitchross · mitchross · commit e21deb054f1c · 2025-07-18T00:31:03.000-04:00
diff --git a/README.md b/README.md
@@ -151,7 +151,7 @@ This final step uses our "App of Apps" pattern to bootstrap the entire cluster.
 ```bash
 # 1. Apply the ArgoCD main components and CRDs
 # This deploys the ArgoCD Helm chart, which creates the CRDs and controller.
-kustomize build infrastructure/argocd --enable-helm | kubectl apply -f -
+kustomize build infrastructure/controllers/argocd --enable-helm | kubectl apply -f -
 
 # 2. Wait for the ArgoCD CRDs to be established in the cluster
 # This command pauses until the Kubernetes API server recognizes the 'Application' resource type.
diff --git a/iac/README.md b/iac/README.md
@@ -53,37 +53,53 @@ packer build -var-file="vars/local.pkrvars.hcl" -var-file="vars/gpu.pkrvars.hcl"
 
 ### 3. Terraform - Provisioning Infrastructure
 
-The Terraform setup is now declarative. All node configurations are managed in one place.
+The Terraform setup is fully declarative with all node configurations managed in one place.
 
 1.  **Navigate to the Terraform directory:**
     ```bash
     cd iac/terraform/talos-cluster/
     ```
 
 2.  **Set up credentials:**
-    Create a `credentials.auto.tfvars` file. This file is ignored by Git and should contain your Proxmox secrets.
+    Create a `credentials.auto.tfvars` file (automatically loaded by Terraform). This file is git-ignored and contains your Proxmox secrets:
     ```hcl
     # iac/terraform/talos-cluster/credentials.auto.tfvars
-
     proxmox_api_url      = "https://<your-proxmox-ip>:8006/api2/json"
-    proxmox_api_token    = "<your-proxmox-api-token>" // e.g., root@pam!iac=...
+    proxmox_node         = "<your-proxmox-node-name>"
+    proxmox_api_token    = "<your-api-token-id>=<your-api-token-secret>"
+    proxmox_pool         = ""
     proxmox_ssh_password = "<your-proxmox-ssh-password>"
     ```
+    
+    **Example:**
+    ```hcl
+    proxmox_api_url      = "https://192.168.10.11:8006/api2/json"
+    proxmox_node         = "proxmox-threadripper"
+    proxmox_api_token    = "root@pam!iac=c30cfedb-0cd8-4c0f-932b-6aded8a1c3ae"
+    proxmox_pool         = ""
+    proxmox_ssh_password = "your-ssh-password"
+    ```
 
 3.  **Configure your cluster nodes:**
-    Open `variables.tf` and review the `nodes` variable. This is the single source of truth for your cluster's infrastructure.
-    - Adjust IPs, MAC addresses, cores, memory, and disk sizes as needed.
-    - **Crucially, ensure the MAC addresses here match the `hardwareAddr` selectors in `iac/talos/talconfig.yaml`**.
+    Node configurations are defined in `variables.tf` in the `nodes` variable. This is the single source of truth for your cluster infrastructure.
+    - Review and adjust IPs, MAC addresses, cores, memory, and disk sizes as needed
+    - **Important**: Ensure MAC addresses match the `hardwareAddr` selectors in `iac/talos/talconfig.yaml`
+    - VM IDs and roles are pre-configured for a 3-master + 3-worker cluster
 
 4.  **Initialize and apply Terraform:**
     ```bash
-    # Initialize Terraform
+    # Initialize Terraform (only needed once)
     terraform init -upgrade
 
-    # Create execution plan
+    # Plan and apply changes
     terraform plan -out=.tfplan
+    terraform apply .tfplan
+    ```
 
-    # Apply the plan
+    **For targeted deployments** (e.g., recreating a single VM):
+    ```bash
+    # Target specific resources
+    terraform plan -target='proxmox_virtual_environment_vm.vm["talos-master-00"]' -out=.tfplan
     terraform apply .tfplan
     ```
 
@@ -193,6 +209,7 @@ cilium install \
   --helm-set=l2announcements.enabled=true \
   --helm-set=externalIPs.enabled=true \
   --set gatewayAPI.enabled=true \
-  --helm-set=devices=e+
+  --helm-set=devices=e+ \
+  --helm-set=operator.replicas=1
 ```
 
diff --git a/iac/talos/talconfig.yaml b/iac/talos/talconfig.yaml
@@ -16,12 +16,12 @@ schematic:
   customization:
     systemExtensions:
       officialExtensions:
-        - siderolabs/amd-ucode
-        - siderolabs/gasket-driver
-        - siderolabs/i915
-        - siderolabs/iscsi-tools
-        - siderolabs/qemu-guest-agent
-        - siderolabs/util-linux-tools
+            - siderolabs/amd-ucode
+            - siderolabs/gasket-driver
+            - siderolabs/iscsi-tools
+            - siderolabs/nfsd
+            - siderolabs/qemu-guest-agent
+            - siderolabs/util-linux-tools
 # Node configurations
 nodes:
   # Control plane nodes
@@ -38,32 +38,32 @@ nodes:
         routes:
           - network: 0.0.0.0/0
             gateway: 192.168.10.1
-  - hostname: talos-cluster-control-01
-    controlPlane: true
-    ipAddress: 192.168.10.101
-    installDisk: /dev/sda
-    networkInterfaces:
-      - deviceSelector:
-          hardwareAddr: "bc:24:11:ed:73:bf"
-        dhcp: false
-        addresses:
-          - 192.168.10.101/24
-        routes:
-          - network: 0.0.0.0/0
-            gateway: 192.168.10.1
-  - hostname: talos-cluster-control-02
-    controlPlane: true
-    ipAddress: 192.168.10.102
-    installDisk: /dev/sda
-    networkInterfaces:
-      - deviceSelector:
-          hardwareAddr: "bc:24:11:98:6b:13"
-        dhcp: false
-        addresses:
-          - 192.168.10.102/24
-        routes:
-          - network: 0.0.0.0/0
-            gateway: 192.168.10.1
+  # - hostname: talos-cluster-control-01
+  #   controlPlane: true
+  #   ipAddress: 192.168.10.101
+  #   installDisk: /dev/sda
+  #   networkInterfaces:
+  #     - deviceSelector:
+  #         hardwareAddr: "bc:24:11:ed:73:bf"
+  #       dhcp: false
+  #       addresses:
+  #         - 192.168.10.101/24
+  #       routes:
+  #         - network: 0.0.0.0/0
+  #           gateway: 192.168.10.1
+  # - hostname: talos-cluster-control-02
+  #   controlPlane: true
+  #   ipAddress: 192.168.10.102
+  #   installDisk: /dev/sda
+  #   networkInterfaces:
+  #     - deviceSelector:
+  #         hardwareAddr: "bc:24:11:98:6b:13"
+  #       dhcp: false
+  #       addresses:
+  #         - 192.168.10.102/24
+  #       routes:
+  #         - network: 0.0.0.0/0
+  #           gateway: 192.168.10.1
   # GPU worker node
   - hostname: talos-cluster-gpu-worker-00
     controlPlane: false
@@ -75,12 +75,12 @@ nodes:
           officialExtensions:
             - siderolabs/amd-ucode
             - siderolabs/gasket-driver
-            - siderolabs/i915
             - siderolabs/iscsi-tools
-            - siderolabs/qemu-guest-agent
-            - siderolabs/util-linux-tools
+            - siderolabs/nfsd
             - siderolabs/nonfree-kmod-nvidia-production
             - siderolabs/nvidia-container-toolkit-production
+            - siderolabs/qemu-guest-agent
+            - siderolabs/util-linux-tools
     networkInterfaces:
       - deviceSelector:
           hardwareAddr: "bc:24:11:77:86:5f"
@@ -120,8 +120,8 @@ nodes:
           officialExtensions:
             - siderolabs/amd-ucode
             - siderolabs/gasket-driver
-            - siderolabs/i915
             - siderolabs/iscsi-tools
+            - siderolabs/nfsd
             - siderolabs/qemu-guest-agent
             - siderolabs/util-linux-tools
     networkInterfaces:
@@ -156,8 +156,8 @@ nodes:
           officialExtensions:
             - siderolabs/amd-ucode
             - siderolabs/gasket-driver
-            - siderolabs/i915
             - siderolabs/iscsi-tools
+            - siderolabs/nfsd
             - siderolabs/qemu-guest-agent
             - siderolabs/util-linux-tools
     networkInterfaces:
diff --git a/iac/talos/talsecret.sops.yaml b/iac/talos/talsecret.sops.yaml
diff --git a/iac/terraform/talos-cluster/.gitignore b/iac/terraform/talos-cluster/.gitignore
@@ -0,0 +1,11 @@
+# Terraform files
+*.tfstate
+*.tfstate.*
+.terraform/
+.terraform.lock.hcl
+*.tfplan*
+
+# Credentials
+credentials.sh
+credentials.auto.tfvars
+.env 
diff --git a/iac/terraform/talos-cluster/locals.tf b/iac/terraform/talos-cluster/locals.tf
@@ -3,7 +3,7 @@ locals {
   cluster_name     = "talos-cluster"
   cluster_endpoint = "https://192.168.10.199:6443"
   cni_name         = "cilium"
-  talos_version    = "v1.10.4"
+  talos_version    = "v1.10.5"
   gateway          = "192.168.10.1"
   network_bridge   = "vmbr0"
   disk_storage     = "local-lvm"
diff --git a/iac/terraform/talos-cluster/talsecret.sops.yaml b/iac/terraform/talos-cluster/talsecret.sops.yaml
@@ -0,0 +1,23 @@
+cluster:
+  id: D3nPe_k7rwyTo44O127B5WT3HspZp-k26lVDW3JwSXw=
+  secret: iwROKtvLC8O2jx50LcdFok66uZJCqeSuejmFDRMTHqA=
+secrets:
+  bootstraptoken: ygnalx.uwwromwhs4t7i5wp
+  secretboxencryptionsecret: tlcPi1BEGzlIObP10Mt6bJdq0mYJ5mFfOGg6OG0ENjc=
+trustdinfo:
+  token: xlmxx3.r2ppcobcw0me89p2
+certs:
+  etcd:
+    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNTZ0F3SUJBZ0lSQUoyRVlnU1FKanNPbFZnZ3J0cFBjM0l3Q2dZSUtvWkl6ajBFQXdJd0R6RU4KTUFzR0ExVUVDaE1FWlhSalpEQWVGdzB5TlRBM01UY3hNak16TURWYUZ3MHpOVEEzTVRVeE1qTXpNRFZhTUE4eApEVEFMQmdOVkJBb1RCR1YwWTJRd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFTT0ZNeThUdUt3ClFpTjUrNmJVbm4weEtzenZPRXNlelI1aHh5bExON2ZmTnA0VXhLTjBXTDhtT2pQWUVmMkZlYVlPSDIrUTA2SFQKM1RCM1pvL3JybXk2bzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSApBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkF4bWtsMkE2NUdtCm5idkFTUzRSVDQrYktTVkpNQW9HQ0NxR1NNNDlCQU1DQTBjQU1FUUNJRVpTL0ZKT2hsd2ZSU3dHY21ZSkkwS3IKL3BtRlpVaE1Tb3BjTnJwZjJMMUxBaUE0YlhVR0puNHM1aElETUNaQWpSRE1kMjVrUEhzYzVxdVNqMlJVYi9JZgprQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUJCMWhScDdPcVRQd2x3Tm1VOTc5cFcvMGozS3lWRG5ydXR0Zmw0bjBtdG5vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFamhUTXZFN2lzRUlqZWZ1bTFKNTlNU3JNN3poTEhzMGVZY2NwU3plMzN6YWVGTVNqZEZpLwpKam96MkJIOWhYbW1EaDl2a05PaDA5MHdkMmFQNjY1c3VnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+  k8s:
+    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpVENDQVRDZ0F3SUJBZ0lSQU9IK0hkM2hvMUlObUNNYUM1cGE5ZFV3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEEzTVRjeE1qTXpNRFZhRncwek5UQTNNVFV4TWpNegpNRFZhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVFUNWxiRlZFNWxLOEJkYWVGNUh4RFUxa1dzM0EwTDdkNk4rVjFYdHA3SzZHN0o3TnM1a2ZnQkgzR2UKbkNaOTZBVEd3UC9yZ01uTi9DUytJL3dCMGMycm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGRTluVmlsMWFYeWh1bTB1cFp6d04zVmxQVHFpTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDSUc4RXJkNjIKNVNFZzJ5VnVjaDJsc1FKNDNvTUNSZ29mQjdvNUJJVUltaTlsQWlCTWRrdWwzYWc2a1dEcXptc0tYSUhTY3d5Vwo1VHJ4V1ZOelZrU092VDBNVUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+    key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxlNGhrTCtmNFY5R0ZhR1NsY3VKTmhEb1NGQ3FmMnJxV2hoTmRyL2RHNHdvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFRStaV3hWUk9aU3ZBWFduaGVSOFExTlpGck53TkMrM2VqZmxkVjdhZXl1aHV5ZXpiT1pINApBUjl4bnB3bWZlZ0V4c0QvNjRESnpmd2t2aVA4QWRITnF3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+  k8saggregator:
+    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRZjNqSFlQazNKcEsxWU5NVGpVWVlvVEFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMU1EY3hOekV5TXpNd05Wb1hEVE0xTURjeE5URXlNek13TlZvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCSzdwYzZGOUJQUkxRam4wYlhoemFlWUhwWUtnS3lnS1VSaGluM2ZMbk52cSt2NHAxU0VKClRWcU5KY1JoazJHYzZkYUJwTGkwZ3ZQOVZpUVJqeDliK0x1allUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVsNk03TmlXNVpzbE54Sk9FZEFjYnlXK0pDOFF3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFMR3RqZDFsOVl6ZHlqZVJXL0pOb1lTNXVSRE9jbTRsdDlKVnFPMVp6SUF0QWlFQWpPaStFT3pTYlJxWlVEZlUKQU1EODdqamhKeWFKWnc2cXVoTTkyVlljb0JNPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+    key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU1VZzIvWmtpT2R3NVU2di9SQVB1MkdTc2U1aG5KejZUMEN5VjJXVGlrYUNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFcnVsem9YMEU5RXRDT2ZSdGVITnA1Z2VsZ3FBcktBcFJHR0tmZDh1YzIrcjYvaW5WSVFsTgpXbzBseEdHVFlaenAxb0drdUxTQzgvMVdKQkdQSDF2NHV3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+  k8sserviceaccount:
+    key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBM3pRV1JGbWpZelAyNlJwKzJOVE5JdHp1NUdqRGpZamxIOGZ0NWdYTFZPZmEyYzlCCnhJVkloY1R1Vk5XalUyQ0p1dndRMmRxNUk0elhId1FTaEpSdHZ5MExLWDFBWU4xMXRxN3cxbmxzTXhLQ2ZOZFUKeTJkaDJNN2dEN1dtRS9ZZHRwZEtEOVB2Qjd0cXpoQ2djVHJTYjBtRDU3NW8vc2xnT3ZHSmwvdEIvV0pxNnRHNApITmZxS090bkFkK2tMbitUeEk2bkhHaGVCWXJ4d1dMc0NMYjVNeCtmUVh3UVJWcHVaTmxSb2tEU010OUZiWkVQCjRqR3BhRktGZTEraUt1eFkyN29iMERBOGJwUnJjSXJ6NkJnRWUvVWZwako3MHJiQjVSSEZFTitvUitTaTd3cCsKMUNYOXlzazRPNmQySHpLTmZ0enpURE0vNG0vWWNLTmhhWHlmeEdsWisxZjgvb2dFOUpTcktBcmc2Yi9pVXgyUwpka2dBUHFORXJldDRxMEE0ZG9Gd1pBWC9EV1hqYnFrY1VuVnRnd291ei9lUCtHN2sxOHR6cnpPZk1WVFlPTWtuClR2Qll3ZXcwRFZHbVF1RFpubUhjUHprRUUxTlY2Vlo3SnhkOTFvdG84VmhLOGk4RWFCeWJWdjdXcVJjOUk1UlEKNVpYQW45dFF2UjJ5N1NKcGdDMzZSWE8wMi8vTWtFL0pFZFgwR0dWc2daRG9BbTIwdGJMMmR6T0dydENPa205UApuY25CS01VK21RRkFKczQ1ekpEVE16cUtWdmJVNkZRRG04MXhXR1ArOWN1MXE3bjFqTkdNb0NXT2NpM2JzL01hCno0VitSczIrNFErYmFkUCt3MzBCVHBLSE5kUTQrZjJyY0VLdXo4ZGhTa2V2VUJyQUpVTHMyUGRxZFRjQ0F3RUEKQVFLQ0FnQVJyNlhvQ3BaSXdSQmFqaS9vN0l2SXJHcjlqRk9hZm5OeFhqMDZrZEQzekZ0cUVPTXNPRWR6MmhQcwpndlVySVNZb3U5cDErTC9jMGtjbGZRUWVuMGhHOHNIRXF0a1VFOWhFL24yMDhQQWk1OStSRnRyd055UG9zeFBNCkN0KzdDekIxakcxZzdiRXVFcXEyNDFoalFINzJOSVFRTStWTDh4Yjk5SytyYkV4aFVKQWFSVDNxZ3kxWnlyVmgKejUvSjAzQVpEaGl0eHBOVXF4clc4UWkwOUJLdysxdDZLK042SzEwOS9uNWFkZnB4NzRFbjJtdkF4NkNkMUpRaApINFhSRXVORG5lNmdRNEkyWE9wYWc1Z3FGdVVjRVdOTm53aHl2T3FHUlM4eFZCZVlnc1JxWHBHSUsrNTlTQTU5Cm81cFhoSUR6d1h4QjJIbkNib3hlK0lNNmdaYURLczJlTjcrYmJ4YW0vbzF5dldXaUU4MitBbzIrUjhKM1VpRncKTWNJVGxuK1pCbXQ3MjlyYjlxczlnRFRiOUdJWXNFOWYwTTZlU2ZmY0pGN2hTRUduWU9tVnVRT3NZK1pyRS8reQpJK2FXbzNsa1d6bDhsODU4Q0lIZDBkclFzV1MxN0pwa1BwRTRpRGxWOHdOREZadjd0c1hJbjBtcE1LY1JqUVVSCjM1STBYRU45U2FVSUVhclZrZkxxcXFQUWo1YzhXS2lnUlZsOGhnUkJ4YjlXekFGdVQ5TklYOXBFWVA4ckN5Ui8KMVE3TFZZV3pmRi84ZjZKdnJ1N2k3bHdUdmdnZjEvaWpPTlZvdmJ5dDZqKzZaV1FycWtmV1pSY044VXVNcFZRNgpPSzJFUm15QUlzV2h5SXNsUzNDd2xyZmY2azJXaWIzMGRESWVMOVBoYmQzMURMQkhrUUtDQVFFQStsa21YN0hvCnZOVVBxTUtLWGVZbXRvYXJab1FMb3lVQUJtWkhFMmpuS3JwSTlQNEJVR0xySnprZ0lvV0s2VU5EU1BsY3ZYbjYKR2tib2lrQ3N3RUNycFpCbmdwSUh0UXpoY2pCYUVhZ2ZLeFpBaFVja28xSVNFQWRMOTdXTGdlSThFYVM3dTBxSApDUGVoVzJBQ2lxZFgvZ2F0d3M0R2R1OWtiNFlQTTRXU3VkNG9MOUM0Q3hhL01va293Uno0Njh3MFBRRDZoMktGCmlSUjk1bXBsOTI2NDQ0SUpEV0tYQVdiRzZhZ3p5Wjh0YkhKQi9ZZ3FZZWJ6VUZJdm5QT3hvdUVLRXYvdzlmSUcKVm5XaDhIWFUzSVA2ek1qS1dpdHoweXRHdTNZM2lYeXYwbkEwYmhoaURsamxqU3AzL1MrUmZEZTk5OVNpOHgrQgptZjVxZktyTFhac3pid0tDQVFFQTVENE8wNS8zUHBaZy9nYzNDL1RyNGVGQ2NiVVpMaWxUeC9kaEhhZmhQVkRaCkdnMXBUR3g0N3JIOUhUa29BcE1BZklqbmFVcUtHN2lBRkFyQVBPWW9Gei8vU2ltTFNGNmNZSEM5RkhvTHY1NysKWkZxK3VzL3ZxZ3dZeGxCYUtDWDIvYXVFNHBZVWFiM0xPVUtGd2Qrdm5QV2RjeVIrU1ExZFZVZ1l0Y1U5c2NJSgpUdGlTUVM5SDVlL3FCUFl1VnNSMlI2Qmdvc3hWaDNjUXRNZko0b0p0UXY1dGhlR1VBWUxCTHQ5MGVORnA5Z09pClZUUnAxUmVSSWl0R2JxVHZWa3Y4ZW5zS2V5QUFJeklMa1JqdWJhUUdLN1dvaDF6eHNNV1IyVm9XRkxOQzI1dncKcHpNOGtQUE9UU3VYZWE3RFR0aHdjZWp0bnQrbUxqcmpwM3BCaHpWV3VRS0NBUUE1VkhFVk9RaXpOWmVBYmd5Qgp0RkxwT2EzR3JEWitCZHNibkJCcXdYc3VyYnBIWUdPc3BQcDA0UUFhNTdvSDhQOVhsc05HSU1qRmU3ZUU4WXFkCi9ERlNtTjhiWjVXY1FIYmdUM0pRMk05S2JxNFgxMUxzazc3UExOeVl2VnBWUkJtOWNKd05KK1FFaWJESjNCSzQKN2RtWXNxN1lEWll0Wm1UNXBSbVdFdUNtNzlrRUdpZ0xZZ29tNklJTXR6WEp5ZG1zbnF6QWxDOUFWUkQvMHgzRwpxL1JySlR3dGRJWmdLOGtoZVFOakNMQytST3dYd3pieGRKSURzczUwZ3RvTEVyM2IzQUN5VWRwaHNrNkRZbmg4Cmh6ekg2TE51TXNVemRwV2NHRlpmaGM0OXdyUS9BaFp5Y3FrZXlycnZvQlVRL1RManJpNGl2dlJPNzVRek9HbVoKNWhEQkFvSUJBUUNuRHlsSkNzQXNwbU10N0ZnRlAycmI5VVh0OW5FTTBhRUtMMjU5QjJFY3dTMTNIVFBpaFU3cQozNHAxdGwwcnJTOWc5OC94eUdaWUxlNUpQU2xDS2ZCVVBEcCtyUFBPcjdsaitZRGNHUXk2WUFTeHJaNEhIS1crCllJWk51WWlUOUYzWmhJNktUdkY0Q0R4VWwvVlJWNG14cURGcmt0MkFXUERrdUJXbURrMis2MWhteHF3ZVhCNFQKRmt6Qy92SWgva0RZNG5GNUYzak80MzV0NUFKSDhkRkpoUExqV0o0OWtOZ1hsK1VuZlpoQ1FweXlJdUFINGUwUQpCbjdTQTVWUEkrVVVQVFVKcy8yRnhWNmtBSXliNGIvR2hIdHJRTU9DOE1sMVByUUV5TVQ1K3lUbExPSjY4b2toCkFQUXBVNXFPL21zblpTZHY3eUV5bTFZQVFzTHQxVU81QW9JQkFCOHdqY3VpOWZ2R2ZLM1U5RTBPbU9RV290TzUKSW9LNzFMQmJkdFVSbGNtaXBxb3RTaEExMmpqNGlYd1FLMjlldU1Icm9zdnlsc2FlUmNKY0RiOE0rNzlpN0ltOApyV2FRb2dZZWN1T0xlZ3UxT0Q4K1QxeHB1Qkt0WHUxWTBjaWs2R3lsQWdWUUtOQTVaRnBsZUowZDJ5cU13VDN2Ck5aVVdhRnh0L3NubXdxendTcUF6ZU54SEk2VURrWVhFeTFUWmxxeWNnYTRqRkpLTmJJRy93ZlNqTHVmeU9XVTAKMVhzSVBtNUQrY1JyV0JTSkhiS0swTVBGbWhUV3BUbUNUU3d5UGtjODlyTWw4RndCQUk2cEtaRzZLelBUczBCbwpCTGgwYW5hUjFCbFppR0x0Q2NNSnozS3FqR01UcG1BM09JekRhNzJjTHFkeEplejhrMEc5WHpEUXRWcz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
+  os:
+    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBK0ROT3AvQ1BlU0N0dmQxWjVJMDI2VEFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXdOekUzTVRJek16QTJXaGNOTXpVd056RTFNVEl6TXpBMldqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQUVodUxVdzZCT0xOclpMaHVZZUZRREM2SHh4ZzhmZFQvT0QyCnZTaFcvVlpJbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkQrQ3RyZktacGFyT0ZZdwp4V1FPbUtobEJEaFJNQVVHQXl0bGNBTkJBTDl1b1JweVYzRFJ3MUhtQ2xoL1pRM0RqU2d0a256eUwwYk9VZ0hPCjJCUERubWVoWDV1RThwdU1MWGxYNUJ4YzhlV0tlWEJZcGRiZllJcm9sSGRVNUFNPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+    key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJRDUwRDZ5R21uMmhVbnlKZlVVdUhtY1lkUm5ndnFxSHZUMmFyR3VKTEtydQotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
diff --git a/infrastructure/storage/csi-driver-smb/storage-class.yaml b/infrastructure/storage/csi-driver-smb/storage-class.yaml
@@ -18,3 +18,24 @@ mountOptions:
 reclaimPolicy: Retain
 volumeBindingMode: Immediate
 allowVolumeExpansion: true
+---
+# Ollama specific storage class
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ollama-smb
+provisioner: smb.csi.k8s.io
+parameters:
+  # Point directly to the ollama subfolder on the SMB share
+  source: //192.168.10.133/k8s/ollama
+  csi.storage.k8s.io/node-stage-secret-name: smbcreds
+  csi.storage.k8s.io/node-stage-secret-namespace: csi-driver-smb
+mountOptions:
+  - dir_mode=0777
+  - file_mode=0777
+  - noperm
+  - mfsymlinks
+  - vers=3.0
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+allowVolumeExpansion: true
diff --git a/my-apps/ai/ollama/pvc.yaml b/my-apps/ai/ollama/pvc.yaml
@@ -13,4 +13,4 @@ spec:
   resources:
     requests:
       storage: 150Gi
-  storageClassName: longhorn
+  storageClassName: ollama-smb
