hermes: place OAuth sessions on shared Pi storage

services/hermes/oauth-session-store.yaml

@@ -2,10 +2,11 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: hermes-oauth-sessions
+  name: hermes-oauth-sessions-data
   namespace: hermes
 spec:
   accessModes: [ReadWriteOnce]
+  storageClassName: astreae
   resources:
     requests:
       storage: 1Gi
@@ -41,6 +42,30 @@ spec:
       labels:
         app: hermes-oauth-sessions
     spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: In
+                    values: ["true"]
+                  - key: hardware
+                    operator: In
+                    values: [rpi4, rpi5]
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: hardware
+                    operator: In
+                    values: [rpi5]
+            - weight: 50
+              preference:
+                matchExpressions:
+                  - key: hardware
+                    operator: In
+                    values: [rpi4]
       securityContext:
         fsGroup: 999
         seccompProfile:
@@ -76,7 +101,7 @@ spec:
       volumes:
         - name: data
           persistentVolumeClaim:
-            claimName: hermes-oauth-sessions
+            claimName: hermes-oauth-sessions-data
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy