chore(storage): remove democratic-csi leftovers

CHANGELOG.md

@@ -28,6 +28,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Docs no longer claim `~/.kube/<cluster>.yaml` are RKE2 admin kubeconfigs (they were overwritten by Rancher-proxied ones); break-glass is `~/.kube/<cluster>-rke2.yaml`
 - poc-apps wildcard certificate copy re-synced: gitops-core `cert-sync` uses direct RKE2 admin credentials for all clusters and fails loudly ([gitops-core#6](https://github.com/DataKnifeAI/gitops-core/pull/6))
 
+### Removed
+- **democratic-csi**: `democratic_csi_*` variables, the `deploy_democratic_csi_{nprd,prd,poc}_apps` resources (never in state; count was 0), the `democratic_csi_config` output, `scripts/install-democratic-csi.sh`, `scripts/generate-helm-values-from-tfvars.sh` and `docs/DEMOCRATIC_CSI_TRUENAS_SETUP.md`. Nothing on any cluster used the driver; TrueNAS CSI is the only storage driver. Remove the `democratic_csi_*` entries from your local `terraform.tfvars`
+
 ### Known issues
 - Terraform Rancher API token expired; registration modules read a hard-coded `/home/lee/git/rancher-deploy/config/.rancher-api-token`
 - RKE2 leaf certs on all control-plane nodes expire 2027-01-08 (poc-apps 2027-01-15) — rotate per [docs/RKE2_CERT_ROTATION.md](docs/RKE2_CERT_ROTATION.md)

README.md

@@ -19,7 +19,7 @@ Also automated when enabled in `terraform.tfvars`:
 
 - **cert-manager** + **Rancher** on the manager cluster
 - Downstream registration into Rancher
-- **Democratic CSI** (TrueNAS NFS) and/or official **TrueNAS CSI** on app clusters
+- Official **TrueNAS CSI** (NFS) on app clusters
 - **Envoy Gateway** + **kube-vip** LoadBalancer IPs on app clusters
 - Operators: CloudNativePG, MongoDB Community, OpenSearch, GitHub ARC
 - Optional **Palworld operator** (default: **prd-apps** only)
@@ -92,8 +92,8 @@ Full walkthrough: [docs/DEPLOYMENT_GUIDE.md](docs/DEPLOYMENT_GUIDE.md).
 | SSH keys & recovery | [SSH_AND_ACCESS.md](docs/SSH_AND_ACCESS.md) |
 | Cluster access, SSO & break-glass | [CLUSTER_ACCESS_AND_SSO.md](docs/CLUSTER_ACCESS_AND_SSO.md) |
 | DNS | [DNS_CONFIGURATION.md](docs/DNS_CONFIGURATION.md) |
-| TrueNAS / Democratic CSI | [DEMOCRATIC_CSI_TRUENAS_SETUP.md](docs/DEMOCRATIC_CSI_TRUENAS_SETUP.md) |
-| TrueNAS CSI migration | [TRUENAS_CSI_MIGRATION.md](docs/TRUENAS_CSI_MIGRATION.md) |
+| TrueNAS CSI | [TRUENAS_CSI_MULTI_NODE.md](docs/TRUENAS_CSI_MULTI_NODE.md) |
+| TrueNAS CSI migration (done) | [TRUENAS_CSI_MIGRATION.md](docs/TRUENAS_CSI_MIGRATION.md) |
 | Troubleshooting | [TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md) |
 | Ops notes | [OPS_NOTES.md](docs/OPS_NOTES.md) |
 | Example homelab diagram | [examples/homelab/index.html](examples/homelab/index.html) |

docs/ARCHITECTURE.md

@@ -50,9 +50,8 @@ Break-glass paths (Rancher local user, RKE2 admin kubeconfigs) bypass Authentik.
 
 - **VM disks**: Proxmox datastore from `clusters.*.storage` (example: `local-vm-zfs`).
 - **Persistent volumes** (apps clusters):
-  - **Democratic CSI** → storage class `truenas-nfs` (vars: `democratic_csi_*`)
   - **Official TrueNAS CSI** → `truenas-csi-nfs` (vars: `truenas_csi_*`; SCALE 25.10+)
-  - Migration between drivers: [TRUENAS_CSI_MIGRATION.md](TRUENAS_CSI_MIGRATION.md)
+  - democratic-csi (`truenas-nfs`) was retired; migration history: [TRUENAS_CSI_MIGRATION.md](TRUENAS_CSI_MIGRATION.md)
 
 For a visual of an example two-node Proxmox homelab (hosts, MD1420 shelves, bonds, Ceph/ZFS, TrueNAS CSI, guest clusters), see [../examples/homelab/index.html](../examples/homelab/index.html).
 

docs/CLOUDNATIVEPG_SETUP.md

@@ -491,13 +491,13 @@ kubectl logs -n cnpg-system deployment/cnpg-controller-manager
 
 ```bash
 # Verify storage class exists
-kubectl get storageclass truenas-nfs
+kubectl get storageclass truenas-csi-nfs
 
 # Check PVC binding
 kubectl describe pvc my-postgres-cluster-1
 
 # Verify TrueNAS connectivity
-kubectl get pods -n democratic-csi
+kubectl get pods -n truenas-csi
 ```
 
 ### Replication Issues