# jbod-monitor on RKE2 (DaemonSet)

Per-node self-contained deployment for Kubernetes worker nodes that can't run
the docker-compose stack. Each opted-in node runs one pod (`host-poller` +
`redis` + `web`) and publishes its own Home Assistant device
(`JBOD Monitor (<node>)`) over MQTT.

This mirrors the docker-compose stack with **no code changes** — each node is
independent, exactly like the standalone hosts.

## What it collects

- **host-poller** (privileged, hostPath `/dev`+`/sys`): IPMI/iDRAC env, CPU
  coretemp, on-metal drive SMART → node-local redis.
- **web**: reads redis, publishes per-node MQTT discovery to the broker.
- No SAS poller (no SES enclosures on these nodes). Consequence: host-drive
  entities have no ZFS pool label (no zfs_map producer).

## Prereqs to verify before applying

1. **Registry pull**: confirm the cluster can pull `docker.adamksmith.xyz/*`.
   If it needs auth, sync a `regcred` into the `jbod-monitor` namespace and
   uncomment `imagePullSecrets` in `daemonset.yaml`.
2. **VSO**: `vault-secrets-operator-system/openbao-kubernetes` VaultAuth exists
   (it does, per infra notes). Confirm the `transformation.templates` syntax
   matches the installed VSO version.
3. **MQTT egress**: pods must reach `10.5.30.3:1883` (EMQX).

## Apply order

```bash
# 1. Label ONLY the intended nodes (do not blanket-label all workers):
kubectl label node usco-dc-pascal usco-dc-currie usco-dc-fermi jbod-monitor=enabled

# 2. Namespace + DaemonSet:
kubectl apply -f k8s/daemonset.yaml

# 3. MQTT creds (VSO → Secret jbod-mqtt). Apply, then confirm it synced:
kubectl apply -f k8s/mqtt-vaultstaticsecret.yaml
kubectl -n jbod-monitor get vaultstaticsecret jbod-mqtt    # SYNCED=True
kubectl -n jbod-monitor get secret jbod-mqtt               # has MQTT_USERNAME/PASSWORD

# 4. Roll the web container so it picks up the secret (if it started first):
kubectl -n jbod-monitor rollout restart daemonset/jbod-monitor
```

## Verify

```bash
kubectl -n jbod-monitor get pods -o wide        # one per labeled node
kubectl -n jbod-monitor logs <pod> -c host-poller | grep sweep
kubectl -n jbod-monitor logs <pod> -c web | grep -i mqtt   # "MQTT connected"
```

Then check Home Assistant for `JBOD Monitor (usco-dc-pascal|currie|fermi)`.

## Notes

- pascal (R620) already has an iDRAC "System Board Inlet Temp" in HA via another
  integration — its env temp will partially duplicate; drives + CPU are net-new.
- Pin image tags by SHA (already done: host-poller `514502e`, web `1839e9d`).
- Removal: `kubectl delete -f k8s/daemonset.yaml` and unlabel the nodes.