Files

adam 4c68bff964 Add k8s DaemonSet design for RKE2 nodes (Model A, per-node self-contained)

Design artifact (NOT applied). Per-node pod = host-poller + redis + web sharing
pod localhost; only host-poller privileged with hostPath /dev+/sys. No SAS
poller (no enclosures). MQTT_NODE_ID from spec.nodeName; MQTT creds via VSO
VaultStaticSecret reading secret/home_assistant (mqtt_user/pass -> MQTT_USERNAME/
PASSWORD). nodeSelector jbod-monitor=enabled to pin to pascal/currie/fermi.

2026-06-16 19:41:51 +00:00

2.5 KiB

Raw Blame History

jbod-monitor on RKE2 (DaemonSet)

Per-node self-contained deployment for Kubernetes worker nodes that can't run the docker-compose stack. Each opted-in node runs one pod (host-poller + redis + web) and publishes its own Home Assistant device (JBOD Monitor (<node>)) over MQTT.

This mirrors the docker-compose stack with no code changes — each node is independent, exactly like the standalone hosts.

What it collects

host-poller (privileged, hostPath /dev+/sys): IPMI/iDRAC env, CPU coretemp, on-metal drive SMART → node-local redis.
web: reads redis, publishes per-node MQTT discovery to the broker.
No SAS poller (no SES enclosures on these nodes). Consequence: host-drive entities have no ZFS pool label (no zfs_map producer).

Prereqs to verify before applying

Registry pull: confirm the cluster can pull docker.adamksmith.xyz/*. If it needs auth, sync a regcred into the jbod-monitor namespace and uncomment imagePullSecrets in daemonset.yaml.
VSO: vault-secrets-operator-system/openbao-kubernetes VaultAuth exists (it does, per infra notes). Confirm the transformation.templates syntax matches the installed VSO version.
MQTT egress: pods must reach 10.5.30.3:1883 (EMQX).

Apply order

# 1. Label ONLY the intended nodes (do not blanket-label all workers):
kubectl label node usco-dc-pascal usco-dc-currie usco-dc-fermi jbod-monitor=enabled

# 2. Namespace + DaemonSet:
kubectl apply -f k8s/daemonset.yaml

# 3. MQTT creds (VSO → Secret jbod-mqtt). Apply, then confirm it synced:
kubectl apply -f k8s/mqtt-vaultstaticsecret.yaml
kubectl -n jbod-monitor get vaultstaticsecret jbod-mqtt    # SYNCED=True
kubectl -n jbod-monitor get secret jbod-mqtt               # has MQTT_USERNAME/PASSWORD

# 4. Roll the web container so it picks up the secret (if it started first):
kubectl -n jbod-monitor rollout restart daemonset/jbod-monitor

Verify

kubectl -n jbod-monitor get pods -o wide        # one per labeled node
kubectl -n jbod-monitor logs <pod> -c host-poller | grep sweep
kubectl -n jbod-monitor logs <pod> -c web | grep -i mqtt   # "MQTT connected"

Then check Home Assistant for JBOD Monitor (usco-dc-pascal|currie|fermi).

Notes

pascal (R620) already has an iDRAC "System Board Inlet Temp" in HA via another integration — its env temp will partially duplicate; drives + CPU are net-new.
Pin image tags by SHA (already done: host-poller 514502e, web 1839e9d).
Removal: kubectl delete -f k8s/daemonset.yaml and unlabel the nodes.

2.5 KiB Raw Blame History