cluster

commit 5a1377fff9f562bdc9a965ae65140d9bd6a80972
parent 41cec19153173e50d7a0fa9baefecbb05f37c7aa
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Thu,  2 Apr 2026 00:32:26 +0200

use stateful set and userns and no pvc

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/image-builder/buildkitd-deployment.yaml
 | 
22
++++++++++++----------
D
apps/talos_cluster/image-builder/buildkitd-pvc.yaml
 | 
12
------------
A
apps/talos_cluster/image-builder/buildkitd-statefulset.yaml
 | 
60
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
M
apps/talos_cluster/image-builder/kustomization.yaml
 | 
3
+--

4 files changed, 73 insertions(+), 24 deletions(-)
diff --git a/apps/talos_cluster/image-builder/buildkitd-deployment.yaml b/apps/talos_cluster/image-builder/buildkitd-deployment.yaml
@@ -13,12 +13,14 @@ spec:
       labels:
         app: buildkitd
     spec:
+      hostUsers: false
       containers:
         - name: buildkitd
-          # Pin to a specific version — update to latest stable as needed
           image: moby/buildkit:v0.29.0
           args:
             - --addr
+            - unix:///run/buildkit/buildkitd.sock
+            - --addr
             - tcp://0.0.0.0:1234
           ports:
             - containerPort: 1234
@@ -29,23 +31,23 @@ spec:
             exec:
               command:
                 - buildctl
-                - --addr
-                - tcp://localhost:1234
                 - debug
                 - workers
             initialDelaySeconds: 5
-            periodSeconds: 10
-            failureThreshold: 6
+            periodSeconds: 30
+          livenessProbe:
+            exec:
+              command:
+                - buildctl
+                - debug
+                - workers
+            initialDelaySeconds: 5
+            periodSeconds: 30
           volumeMounts:
-            - name: cache
-              mountPath: /var/lib/buildkit
             - name: docker-config
               mountPath: /root/.docker
               readOnly: true
       volumes:
-        - name: cache
-          persistentVolumeClaim:
-            claimName: buildkitd-cache
         - name: docker-config
           secret:
             secretName: image-builder-registry-secret
diff --git a/apps/talos_cluster/image-builder/buildkitd-pvc.yaml b/apps/talos_cluster/image-builder/buildkitd-pvc.yaml
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: buildkitd-cache
-  namespace: image-builder
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: hcloud-volumes
-  resources:
-    requests:
-      storage: 20Gi
diff --git a/apps/talos_cluster/image-builder/buildkitd-statefulset.yaml b/apps/talos_cluster/image-builder/buildkitd-statefulset.yaml
@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app: buildkitd
+  name: buildkitd
+  namespace: image-builder
+spec:
+  serviceName: buildkitd
+  podManagementPolicy: Parallel
+  replicas: 1
+  selector:
+    matchLabels:
+      app: buildkitd
+  template:
+    metadata:
+      labels:
+        app: buildkitd
+    spec:
+      hostUsers: false
+      containers:
+        - name: buildkitd
+          image: moby/buildkit:master
+          args:
+            - --addr
+            - unix:///run/buildkit/buildkitd.sock
+            - --addr
+            - tcp://0.0.0.0:1234
+          ports:
+            - containerPort: 1234
+              protocol: TCP
+          readinessProbe:
+            exec:
+              command:
+                - buildctl
+                - debug
+                - workers
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          livenessProbe:
+            exec:
+              command:
+                - buildctl
+                - debug
+                - workers
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          securityContext:
+            privileged: true
+          volumeMounts:
+            - name: docker-config
+              mountPath: /root/.docker
+              readOnly: true
+      volumes:
+        - name: docker-config
+          secret:
+            secretName: image-builder-registry-secret
+            items:
+              - key: dockerconfig.json
+                path: config.json
diff --git a/apps/talos_cluster/image-builder/kustomization.yaml b/apps/talos_cluster/image-builder/kustomization.yaml
@@ -3,8 +3,7 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - rbac.yaml
-  - buildkitd-pvc.yaml
-  - buildkitd-deployment.yaml
+  - buildkitd-statefulset.yaml
   - buildkitd-service.yaml
   - binfmt-daemonset.yaml
   - registry-secret.yaml