Created static Kubernetes NFS PersistentVolume and PersistentVolumeClaim objects for the existing Gitea storage paths on Kryptovisor fastdata.
No running Gitea workload was migrated or restarted. The active deployments still use their existing hostPath volumes.
Namespace-scoped claims in gitea:
pvc/gitea-data-nfs -> pv/gitea-data-nfspvc/gitea-git-nfs -> pv/gitea-git-nfspvc/gitea-act-runner-data-nfs -> pv/gitea-act-runner-data-nfspvc/gitea-act-runner-2-data-nfs -> pv/gitea-act-runner-2-data-nfsAll PVs use:
kryptovisor.auth.home.lan/mnt/fastdata/k8s-pvcs/gitea/...persistentVolumeReclaimPolicy: RetainstorageClassName: ""ReadWriteManynfsvers=4.2, sec=sys, hard, timeo=600, retrans=2All four PV/PVC pairs bound successfully.
A temporary smoke pod mounted all four claims read-only and completed with:
static NFS PVC smoke mount ok
The smoke pod was deleted after verification.
Kryptovisor exports /mnt/fastdata and /mnt/bigdata to drg-k8s with sec=sys, all_squash, and the dedicated NFS identity:
k8s-nfs-access:files-bigdata-rw
uid=1240000012
gid=1240000009
This means Kubernetes pod access to these NFS exports is intentionally represented as a shared NFS service identity, not as individual FreeIPA/Kerberos user identities.
Docker runner cache should not use these NFS PVs for /var/lib/docker; use node-local ext4 hostPath for Docker/overlay2 cache.
Temporary manifest used during the change:
/home/ax_julian/temp/gitea-static-nfs-pvcs-2026-05-10.yaml