[14:37:33] <btullis>	 elukey: brouberol: I made a mistake on the ticket description here: T429331 - I said that the 'lvmd' pod was the *only* component that requires elevated privileges and that we had moved it outside of the k8s environment.
[14:37:34] <stashbot>	 T429331: Import and adapt the upstream TopoLVM Helm chart - https://phabricator.wikimedia.org/T429331
[14:39:20] <btullis>	 I was wrong in this assertion. The `topolvm-node` component also has to run as root: https://github.com/topolvm/topolvm/blob/main/docs/topolvm-node.md
[14:39:34] <btullis>	 This is just the same as what we do with the ceph-csi plugins.
[14:41:26] <btullis>	 I filed this to fix it. https://gerrit.wikimedia.org/r/c/operations/deployment-charts/+/1310116
[14:42:41] <btullis>	 The elevated permissions pod does already run in the `kube-system` namespace, as per the policy guidelines: https://wikitech.wikimedia.org/wiki/Kubernetes/Upstream_Helm_charts_policy#Special_considerations_considering_privileges
[14:57:17] <elukey>	 thanks for letting us know!
[14:57:56] <elukey>	 yeah those pods can run only in a PSS that is more allowing, the restricted one is surely not going to work with topolvm-node
[15:54:40] <btullis>	 In case anyone would like to read along, the TopoLVM CSI is now installed and it works as expected. I've just done my first tests creating a pod with an ephemeral 10 GB mounted volume that uses NVMe local storage on the k8s worker. When the pod was deleted, the LVM logical volume was deleted, too. https://phabricator.wikimedia.org/T428895#12115579
[19:05:54] <brouberol>	 nicely done Ben! This is going to be extremely useful