nordisk/holger

Deploying holger on Talos Linux

Holger fits Talos' immutable-OS model with no machine-config changes: the binary lives in the container image, configuration in a ConfigMap, and all persistent state (chart stores, znippy archives) on a PVC.

StorageClass

Talos ships no default StorageClass — the PVC in pvc.yaml (storageClassName: local-path) will stay Pending until one exists.

• Dev / single node: install local-path-provisioner:

kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml

Note: local-path stores data under /opt/local-path-provisioner on the node. On Talos, allowlist that path via a machine-config patch:

machine:
  kubelet:
    extraMounts:
      - destination: /opt/local-path-provisioner
        type: bind
        source: /var/local-path-provisioner
        options: [bind, rshared, rw]

• Production / bare metal: use a real CSI driver — OpenEBS Mayastor (NVMe-oF, needs vm.nr_hugepages via machine config) or democratic-csi against a ZFS/NFS appliance. Set storageClassName accordingly.

TLS

holger terminates TLS itself (app-level rustls) on both the gRPC and HTTP/OCI ports — no cleartext path. Provide the server cert/key via the holger-tls Secret (secret.yaml), e.g. from cert-manager or:

kubectl -n holger create secret tls holger-tls --cert=tls.crt --key=tls.key

For mTLS, add ca.crt to that Secret and uncomment client_ca in the ConfigMap's RON: client-cert CNs then become writer identities.

Exposure without a cloud LoadBalancer

• MetalLB (preferred): announce a VIP on the airgap LAN, keep service.yaml as ClusterIP and add a LoadBalancer service, or
• NodePort: apply service-nodeport.yaml (gRPC on 30051, HTTPS on 30443 on every node IP).

Single replica

The Deployment pins replicas: 1 with strategy: Recreate: writable file-backed repositories live on one ReadWriteOnce volume. Scale-out needs RWX storage and is not yet supported. Take PVC snapshots (or back up /var/lib/holger) instead of adding replicas.

Quick validation

kubectl create namespace holger
kubectl -n holger create secret tls holger-tls --cert=tls.crt --key=tls.key
kubectl apply -f deploy/k8s/
kubectl -n holger wait --for=condition=Ready pod -l app=holger --timeout=120s
kubectl -n holger port-forward svc/holger 8443:8443 &
curl -k https://localhost:8443/healthz                 # → ok
helm push mychart-0.1.0.tgz oci://localhost:8443/charts
helm pull oci://localhost:8443/charts/mychart --version 0.1.0