image-automation commits tag bumps straight to master with no CI gate, and
the broker is a single pod — so an image that fails to come up would be
silent. Two changes make that safe:
- gatus TCP-checks the broker's ClusterIP on :1883, so a pod that never comes
up alerts within one interval. Reachability needed a scoped egress (apps ns)
+ ingress (home-assistant ns, gatus pod on :1883 only), mirroring the
existing evcc -> mosquitto:1883 allow.
- strategy Recreate -> RollingUpdate (maxUnavailable:0, maxSurge:1). With the
PVC gone there is no RWO volume to fence, so the new broker comes up and
passes its readiness probe before the old one is torn down — no full-down
window on a bump/reschedule; clients on the old pod just reconnect. The brief
two-pod overlap is two independent stateless brokers behind the LB, fine with
no shared state + self-healing discovery.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The broker ran on a floating `eclipse-mosquitto:2` tag — no reproducibility,
and a reschedule could pull a changed/broken image. Rather than hand-pin a
digest (which would then never get patched), add it to the repo's Flux
image-automation like redis et al.:
- ImageRepository + ImagePolicy tracking eclipse-mosquitto, semver range 2.x
(auto-bump minor+patch; a 3.0 major stays a deliberate migration), matching
plain-semver tags only (excludes -openssl/latest/bare 2).
- The deployment image carries the pinned tag + the $imagepolicy marker, so
each bump lands as a git commit and rolls the broker (brief restart;
discovery self-heals via HA).
Net: the broker is both pinned (reproducible) and auto-patched.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.8