Kubernetes operator of Nexo - NexoCluster resources with health-gated rolling updates
232
nexo-operator runs Nexo clusters on Kubernetes from one resource,
NexoCluster: a StatefulSet per pool, the S3 and console Services and a disruption budget. It replaces the
pods itself when their template changes (a new image, new settings), one at a time and only while the
cluster can lose a node without losing its write quorum; it never deletes the volumes of the drives.
The image is multi-arch (linux/amd64, linux/arm64), distroless, non-root (UID 65532), signed with cosign keyless and carries SBOM and provenance attestations.
# the operator (CRD, RBAC, Deployment with this image), from the release of the same tag
kubectl apply --server-side -f https://github.com/R3n3r0/Nexo/releases/latest/download/nexo-operator.yaml
# a cluster of 4 servers x 4 drives
kubectl create namespace storage
kubectl -n storage create secret generic lake-credentials \
--from-literal=root-user=lake-admin --from-literal=root-password='a-long-random-secret'
kubectl apply -f - <<'YAML'
apiVersion: nexo.r3n3r0.github.io/v1alpha1
kind: NexoCluster
metadata: {name: lake, namespace: storage}
spec:
image: docker.io/paolor/nexo:latest
credentials: {secretName: lake-credentials}
pools:
- {name: pool-0, servers: 4, volumesPerServer: 4, storage: 100Gi}
YAML
kubectl -n storage get nexo
cosign verify docker.io/paolor/nexo-operator:<tag> \
--certificate-identity 'https://github.com/R3n3r0/Nexo/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
License: AGPL-3.0-only.
Content type
Image
Digest
sha256:5b48e6064…
Size
11.5 MB
Last updated
11 days ago
docker pull paolor/nexo-operator