Configure Kubernetes persistent volumes with NFS storage for container data persistence

#!/usr/bin/env bash

set -euo pipefail

# NFS Kubernetes Persistent Volume Setup Script
# Production-grade installer for NFS-backed persistent storage

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m'

# Configuration
readonly NFS_DIR="/srv/nfs/k8s-storage"
readonly EXPORTS_FILE="/etc/exports"
readonly SCRIPT_NAME=$(basename "$0")

# Global variables
CLUSTER_NETWORK=""
NFS_SERVER_IP=""
MODE=""
PKG_MGR=""
PKG_INSTALL=""
FIREWALL_CMD=""
NFS_SERVICE=""

# Cleanup function
cleanup() {
    echo -e "${RED}[ERROR] Script failed. Cleaning up...${NC}" >&2
    if [[ -d "${NFS_DIR}" ]] && [[ -z "$(ls -A ${NFS_DIR})" ]]; then
        rm -rf "${NFS_DIR}"
    fi
    exit 1
}

trap cleanup ERR

usage() {
    cat << EOF
Usage: $SCRIPT_NAME [server|client] <cluster_network> [nfs_server_ip]

Examples:
  $SCRIPT_NAME server 192.168.1.0/24
  $SCRIPT_NAME client 192.168.1.0/24 192.168.1.10

Arguments:
  mode             'server' or 'client'
  cluster_network  CIDR notation (e.g., 192.168.1.0/24)
  nfs_server_ip    NFS server IP (required for client mode)
EOF
    exit 1
}

log_info() {
    echo -e "${GREEN}$1${NC}"
}

log_warn() {
    echo -e "${YELLOW}$1${NC}"
}

log_error() {
    echo -e "${RED}$1${NC}" >&2
}

detect_distro() {
    if [[ ! -f /etc/os-release ]]; then
        log_error "Cannot detect distribution. /etc/os-release not found."
        exit 1
    fi

    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            FIREWALL_CMD="ufw"
            NFS_SERVICE="nfs-kernel-server"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            FIREWALL_CMD="firewalld"
            NFS_SERVICE="nfs-server"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            FIREWALL_CMD="firewalld"
            NFS_SERVICE="nfs-server"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
}

check_prerequisites() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi

    if ! command -v systemctl &> /dev/null; then
        log_error "systemctl is required but not found"
        exit 1
    fi
}

validate_network() {
    if [[ ! $1 =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$ ]]; then
        log_error "Invalid network format. Use CIDR notation (e.g., 192.168.1.0/24)"
        exit 1
    fi
}

validate_ip() {
    if [[ ! $1 =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
        log_error "Invalid IP address format"
        exit 1
    fi
}

update_system() {
    echo "[1/8] Updating system packages..."
    case "$PKG_MGR" in
        apt)
            apt update && apt upgrade -y
            ;;
        dnf|yum)
            $PKG_INSTALL update
            ;;
    esac
    log_info "System packages updated successfully"
}

install_nfs_server() {
    echo "[2/8] Installing NFS server components..."
    case "$PKG_MGR" in
        apt)
            $PKG_INSTALL nfs-kernel-server nfs-common
            ;;
        dnf|yum)
            $PKG_INSTALL nfs-utils
            ;;
    esac
    log_info "NFS server components installed"
}

install_nfs_client() {
    echo "[2/8] Installing NFS client components..."
    case "$PKG_MGR" in
        apt)
            $PKG_INSTALL nfs-common
            ;;
        dnf|yum)
            $PKG_INSTALL nfs-utils
            ;;
    esac
    log_info "NFS client components installed"
}

create_nfs_directory() {
    echo "[3/8] Creating NFS storage directory..."
    mkdir -p "${NFS_DIR}"
    chown nobody:nogroup "${NFS_DIR}" 2>/dev/null || chown nfsnobody:nfsnobody "${NFS_DIR}"
    chmod 755 "${NFS_DIR}"
    log_info "NFS storage directory created: ${NFS_DIR}"
}

configure_nfs_exports() {
    echo "[4/8] Configuring NFS exports..."
    local export_line="${NFS_DIR} ${CLUSTER_NETWORK}(rw,sync,no_subtree_check,no_root_squash,no_all_squash,insecure)"
    
    if ! grep -q "${NFS_DIR}" "${EXPORTS_FILE}" 2>/dev/null; then
        echo "${export_line}" >> "${EXPORTS_FILE}"
    else
        log_warn "Export already exists in ${EXPORTS_FILE}"
    fi
    
    exportfs -ra
    log_info "NFS exports configured"
}

start_nfs_service() {
    echo "[5/8] Starting NFS service..."
    systemctl enable --now "${NFS_SERVICE}"
    systemctl start rpcbind 2>/dev/null || true
    log_info "NFS service started and enabled"
}

configure_firewall() {
    echo "[6/8] Configuring firewall..."
    case "$FIREWALL_CMD" in
        ufw)
            if systemctl is-active --quiet ufw; then
                ufw allow from "${CLUSTER_NETWORK}" to any port nfs
                ufw allow from "${CLUSTER_NETWORK}" to any port 2049
                ufw allow from "${CLUSTER_NETWORK}" to any port 111
            fi
            ;;
        firewalld)
            if systemctl is-active --quiet firewalld; then
                firewall-cmd --permanent --add-service=nfs
                firewall-cmd --permanent --add-service=rpc-bind
                firewall-cmd --permanent --add-service=mountd
                firewall-cmd --reload
            fi
            ;;
    esac
    log_info "Firewall configured for NFS"
}

test_nfs_connectivity() {
    echo "[7/8] Testing NFS connectivity..."
    local test_mount="/mnt/nfs-test"
    
    mkdir -p "${test_mount}"
    if mount -t nfs "${NFS_SERVER_IP}:${NFS_DIR}" "${test_mount}"; then
        echo "NFS test successful" > "${test_mount}/test.txt"
        if [[ -f "${test_mount}/test.txt" ]]; then
            log_info "NFS connectivity test passed"
        else
            log_error "Failed to write test file"
        fi
        umount "${test_mount}"
    else
        log_error "Failed to mount NFS share"
        exit 1
    fi
    rmdir "${test_mount}"
}

verify_installation() {
    echo "[8/8] Verifying installation..."
    
    if [[ "$MODE" == "server" ]]; then
        if systemctl is-active --quiet "${NFS_SERVICE}"; then
            log_info "NFS server is running"
        else
            log_error "NFS server is not running"
            exit 1
        fi
        
        if showmount -e localhost | grep -q "${NFS_DIR}"; then
            log_info "NFS export is active"
        else
            log_error "NFS export not found"
            exit 1
        fi
    else
        if showmount -e "${NFS_SERVER_IP}" | grep -q "${NFS_DIR}"; then
            log_info "Can see NFS exports from server"
        else
            log_error "Cannot see NFS exports from server"
            exit 1
        fi
    fi
    
    log_info "Installation verification completed successfully"
}

generate_k8s_manifests() {
    echo "Generating Kubernetes manifests..."
    
    cat > nfs-pv.yaml << EOF
apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfs-pv-01
  labels:
    type: nfs
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteMany
  nfs:
    server: ${NFS_SERVER_IP}
    path: "${NFS_DIR}"
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-storage
EOF

    cat > nfs-storageclass.yaml << EOF
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: nfs-storage
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer
EOF

    log_info "Kubernetes manifests generated: nfs-pv.yaml, nfs-storageclass.yaml"
}

main() {
    if [[ $# -lt 2 ]] || [[ $# -gt 3 ]]; then
        usage
    fi
    
    MODE="$1"
    CLUSTER_NETWORK="$2"
    
    if [[ "$MODE" != "server" ]] && [[ "$MODE" != "client" ]]; then
        log_error "Mode must be 'server' or 'client'"
        usage
    fi
    
    if [[ "$MODE" == "client" ]] && [[ $# -ne 3 ]]; then
        log_error "NFS server IP required for client mode"
        usage
    fi
    
    if [[ $# -eq 3 ]]; then
        NFS_SERVER_IP="$3"
        validate_ip "$NFS_SERVER_IP"
    fi
    
    validate_network "$CLUSTER_NETWORK"
    
    check_prerequisites
    detect_distro
    
    log_info "Starting NFS ${MODE} installation for Kubernetes..."
    log_info "Cluster network: ${CLUSTER_NETWORK}"
    [[ -n "$NFS_SERVER_IP" ]] && log_info "NFS server: ${NFS_SERVER_IP}"
    
    update_system
    
    if [[ "$MODE" == "server" ]]; then
        install_nfs_server
        create_nfs_directory
        configure_nfs_exports
        start_nfs_service
        configure_firewall
        NFS_SERVER_IP=$(hostname -I | awk '{print $1}')
        generate_k8s_manifests
    else
        install_nfs_client
        configure_firewall
        test_nfs_connectivity
    fi
    
    verify_installation
    
    log_info "NFS ${MODE} installation completed successfully!"
    
    if [[ "$MODE" == "server" ]]; then
        echo ""
        log_info "Next steps:"
        echo "1. Run this script on Kubernetes nodes with: $SCRIPT_NAME client $CLUSTER_NETWORK $NFS_SERVER_IP"
        echo "2. Apply Kubernetes manifests: kubectl apply -f nfs-pv.yaml -f nfs-storageclass.yaml"
    fi
}

main "$@"