claude-botandClaude Opus 4.8
33283754ba
shelly-manager will build+flash BLE proxies by spawning short-lived esphome Jobs (on the shelly-manager-iot macvlan → mDNS → OTA:3232) and streaming their logs. Give it a namespace-scoped identity to do so: - ServiceAccount shelly-manager + Role shelly-manager-firmware (jobs: create/get/list/watch/delete; pods: get/list/watch; pods/log: get) + RoleBinding. No cluster-wide, secret, or exec rights. - Wire serviceAccountName into the Deployment. - Sync esphome/shelly-ble-proxy.yaml logger to the lean level already OTA'd to the device (esp32_ble_client DEBUG, not VERBOSE) so the PVC stops filling; VERBOSE is now an on-demand diagnostic via the pipeline. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
56 lines
1.9 KiB
YAML
56 lines
1.9 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- backup-password-externalsecret.yaml
|
|
- pvcs.yaml
|
|
- deployment.yaml
|
|
- service.yaml
|
|
- bgp-service.yaml
|
|
- vscode-service.yaml
|
|
- vscode-gate-service.yaml
|
|
- ingress.yaml
|
|
- vscode-ingress.yaml
|
|
- prometheus-token-externalsecret.yaml
|
|
- config-sync-token-externalsecret.yaml
|
|
- mosquitto-bootstrap.yaml
|
|
- mosquitto-config.yaml
|
|
- mosquitto-certificate.yaml
|
|
- mosquitto-service.yaml
|
|
- mosquitto-iot-service.yaml
|
|
- mosquitto-deployment.yaml
|
|
- mosquitto-evcc-credentials-externalsecret.yaml
|
|
- shelly-manager-pvc.yaml
|
|
- shelly-manager-network-attachment.yaml
|
|
- shelly-manager-firmware-rbac.yaml
|
|
- shelly-ble-proxy-key-externalsecret.yaml
|
|
- shelly-manager-deployment.yaml
|
|
- shelly-manager-service.yaml
|
|
- shelly-manager-gate-service.yaml
|
|
- shelly-manager-ingress.yaml
|
|
- esphome-pvc.yaml
|
|
- esphome-deployment.yaml
|
|
- esphome-service.yaml
|
|
- esphome-gate-service.yaml
|
|
- esphome-ingress.yaml
|
|
configMapGenerator:
|
|
# nginx config for the reverse-proxy sidecar. Hash suffix disabled so
|
|
# the cm name stays stable; editing proxy.conf does not auto-roll the
|
|
# pod — restart manually with
|
|
# `kubectl rollout restart deploy/home-assistant -n home-assistant`.
|
|
# The `.template` suffix opts the file into nginx-unprivileged's
|
|
# /docker-entrypoint.d/20-envsubst-on-templates.sh pass, which writes
|
|
# the rendered output to /etc/nginx/conf.d/default.conf at startup.
|
|
- name: ha-proxy-config
|
|
namespace: home-assistant
|
|
files:
|
|
- default.conf.template=proxy.conf
|
|
# config-sync sidecar script. Hash suffix disabled (name stays stable), so
|
|
# editing config-sync.sh does not auto-roll the pod — restart manually with
|
|
# `kubectl rollout restart deploy/home-assistant -n home-assistant`.
|
|
- name: ha-config-sync-script
|
|
namespace: home-assistant
|
|
files:
|
|
- sync.sh=config-sync.sh
|
|
generatorOptions:
|
|
disableNameSuffixHash: true
|