2026-07-08 08:31:12 +00:00
6 changed files with 39 additions and 26 deletions
@@ -13,7 +13,6 @@ resources:
  - config-sync-token.sops.yaml
  - mosquitto-bootstrap.yaml
  - mosquitto-config.yaml
-  - mosquitto-pvc.yaml
  - mosquitto-certificate.yaml
  - mosquitto-service.yaml
  - mosquitto-iot-service.yaml
@@ -5,8 +5,14 @@ metadata:
  namespace: home-assistant
 data:
  mosquitto.conf: |
-    persistence true
-    persistence_location /mosquitto/data/
+    # No on-disk persistence. Retained messages + sessions are re-populated by
+    # clients on reconnect (evcc republishes state, Shellies re-send their
+    # announce/online, HA re-publishes discovery), so the broker keeps no
+    # durable state. This drops the Ceph PVC dependency (the broker starts even
+    # if Ceph is degraded) and lets it reschedule anywhere in seconds — no RWO
+    # volume to fence/detach/reattach. Trade-off: a broker restart briefly
+    # empties retained state until clients reconnect (self-healing).
+    persistence false
    log_dest stdout
    log_type error
    log_type warning
@@ -17,9 +17,25 @@ spec:
      labels:
        app.kubernetes.io/name: mosquitto
    spec:
-      # No nodeSelector / tolerations — mosquitto-iot uses ETP=Cluster, so
-      # IoT-VLAN traffic landing on k8s-edge can be forwarded to a broker
-      # pod on any node.
+      # Runs on any node (no nodeSelector); the mosquitto-iot LB forwards
+      # IoT-VLAN traffic to the broker wherever it lands.
+      # Availability: home-critical priority (never preempted, reschedules
+      # first) + short fault tolerations so a node failure reschedules the
+      # broker in ~30s instead of the default ~5min. Single replica + Recreate
+      # stays (mosquitto can't run two brokers at once), but with persistence
+      # off there is no PVC to fence/detach/reattach, so it can restart
+      # anywhere instantly and no longer depends on Ceph being healthy.
+      priorityClassName: home-critical
+      terminationGracePeriodSeconds: 10
+      tolerations:
+        - key: node.kubernetes.io/not-ready
+          operator: Exists
+          effect: NoExecute
+          tolerationSeconds: 30
+        - key: node.kubernetes.io/unreachable
+          operator: Exists
+          effect: NoExecute
+          tolerationSeconds: 30
      securityContext:
        fsGroup: 1883
      containers:
@@ -136,8 +152,6 @@ spec:
            - name: config
              mountPath: /mosquitto/config
              readOnly: true
-            - name: data
-              mountPath: /mosquitto/data
            - name: auth
              mountPath: /mosquitto/auth
            - name: tls
@@ -162,9 +176,6 @@ spec:
        - name: config
          configMap:
            name: mosquitto-config
-        - name: data
-          persistentVolumeClaim:
-            claimName: mosquitto-data
        - name: auth
          emptyDir: {}
        - name: tls
@@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: mosquitto-data
-  namespace: home-assistant
-  annotations:
-    kustomize.toolkit.fluxcd.io/prune: disabled
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: ceph-block
-  resources:
-    requests:
-      storage: 1Gi
@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - cluster-settings.yaml
+  - priority-classes.yaml
@@ -0,0 +1,11 @@
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: home-critical
+value: 1000000
+globalDefault: false
+description: >-
+  Load-bearing home services (e.g. the MQTT broker the heat pump, energy
+  meters, EV charging and Home Assistant all depend on) that must reschedule
+  ahead of ordinary workloads and be evicted last under node pressure. Sits
+  well below system-cluster-critical (2e9) and above the default (0).