Democratic CSI managing iSCSI LUNs on Synology DSM

democratic-controller.nomad

job "democratic-controller" {
  datacenters = ["dc1"]
  type        = "service"

  group "controller" {
    task "controller" {
      driver = "docker"

      config {
        image = "democraticcsi/democratic-csi:v1.6.3"

        args = [
          "--csi-version=1.2.0",
          "--csi-name=org.democratic-csi.synology-iscsi",
          "--driver-config-file=${NOMAD_SECRETS_DIR}/driver-config-file.yaml",
          "--log-level=debug",
          "--csi-mode=controller",
          "--server-socket=/csi-data/csi.sock",
          "--server-address=0.0.0.0",
          "--server-port=9000",
        ]
      }

      csi_plugin {
        id        = "synology-iscsi"
        type      = "controller"
        mount_dir = "/csi-data"
      }

      template {
        destination = "${NOMAD_SECRETS_DIR}/driver-config-file.yaml"
        data        = <<EOH
driver: synology-iscsi
httpConnection:
  protocol: https
  host: synology.byb.lan
  port: 5001
  username: nomad
  password: "{{ with secret "kv/csi_iscsi" }}{{ .Data.data.password }}{{ end }}"
  allowInsecure: true
  session: democratic-csi
  serialize: true
synology:
  volume: /volume1
iscsi:
  targetPortal: synology.byb.lan
  baseiqn: "iqn.2000-01.com.synology:csi."
  lunTemplate:
    type: "BLUN"
  lunSnapshotTemplate:
    is_locked: true
    is_app_consistent: true
  targetTemplate:
    auth_type: 0
    max_sessions: 0
EOH
      }

      vault {
        policies      = ["csi-iscsi"]
        change_mode   = "signal"
        change_signal = "SIGHUP"
      }

      resources {
        cpu    = 30
        memory = 50
      }
    }
  }
}

democratic-node.nomad

job "democratic-node" {
  datacenters = ["dc1"]
  type        = "system"

  group "node" {
    task "node" {
      driver = "docker"

      config {
        image        = "democraticcsi/democratic-csi:v1.6.3"
        network_mode = "host"
        ipc_mode     = "host"
        privileged   = true

        args = [
          "--csi-version=1.2.0",
          "--csi-name=org.democratic-csi.synology-iscsi",
          "--driver-config-file=${NOMAD_SECRETS_DIR}/driver-config-file.yaml",
          "--log-level=debug",
          "--csi-mode=node",
          "--server-socket=/csi-data/csi.sock",
        ]

        mount {
          type     = "bind"
          target   = "/host"
          source   = "/"
          readonly = false
        }
      }

      csi_plugin {
        id        = "synology-iscsi"
        type      = "node"
        mount_dir = "/csi-data"
      }

      template {
        destination = "${NOMAD_SECRETS_DIR}/driver-config-file.yaml"

        data = <<EOH
driver: synology-iscsi
httpConnection:
  protocol: https
  host: synology.byb.lan
  port: 5001
  username: nomad
  password: "{{ with secret "kv/csi_iscsi" }}{{ .Data.data.password }}{{ end }}"
  allowInsecure: true
  session: democratic-csi
  serialize: true
synology:
  volume: /volume1
iscsi:
  targetPortal: synology.byb.lan
  baseiqn: "iqn.2000-01.com.synology:csi."
  lunTemplate:
    type: "BLUN"
  lunSnapshotTemplate:
    is_locked: true
    is_app_consistent: true
  targetTemplate:
    auth_type: 0
    max_sessions: 0
EOH
      }

      vault {
        policies      = ["csi-iscsi"]
        change_mode   = "signal"
        change_signal = "SIGHUP"
      }

      resources {
        cpu    = 30
        memory = 50
      }
    }
  }
}

iscsi-volume.hcl

type         = "csi"
id           = "prometheus"
name         = "prometheus"
plugin_id    = "synology-iscsi"
capacity_min = "10GiB"
capacity_max = "10GiB"

capability {
  access_mode     = "single-node-writer"
  attachment_mode = "file-system"
}

mount_options {
  fs_type     = "ext4"
  mount_flags = ["noatime"]
}