adam
4c68bff964
Design artifact (NOT applied). Per-node pod = host-poller + redis + web sharing pod localhost; only host-poller privileged with hostPath /dev+/sys. No SAS poller (no enclosures). MQTT_NODE_ID from spec.nodeName; MQTT creds via VSO VaultStaticSecret reading secret/home_assistant (mqtt_user/pass -> MQTT_USERNAME/ PASSWORD). nodeSelector jbod-monitor=enabled to pin to pascal/currie/fermi.
31 lines
985 B
YAML
31 lines
985 B
YAML
# MQTT broker creds for the web container, synced from OpenBao by VSO.
|
|
#
|
|
# Reads secret/home_assistant (keys mqtt_user / mqtt_pass) and renders a k8s
|
|
# Secret `jbod-mqtt` with MQTT_USERNAME / MQTT_PASSWORD keys (consumed via
|
|
# envFrom in the DaemonSet). VSO's `vso-read` policy can read secret/data/*,
|
|
# so unlike the claude-read token it CAN read home_assistant — no creds ever
|
|
# touch these manifests.
|
|
#
|
|
# Verify the transformation syntax against the installed VSO version.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: jbod-mqtt
|
|
namespace: jbod-monitor
|
|
spec:
|
|
vaultAuthRef: vault-secrets-operator-system/openbao-kubernetes
|
|
mount: secret
|
|
type: kv-v2
|
|
path: home_assistant
|
|
refreshAfter: 1h
|
|
destination:
|
|
name: jbod-mqtt
|
|
create: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
MQTT_USERNAME:
|
|
text: '{{ .Secrets.mqtt_user }}'
|
|
MQTT_PASSWORD:
|
|
text: '{{ .Secrets.mqtt_pass }}'
|