From 96ea51014393696fad95728e9efb596d380778a0 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Mon, 26 Oct 2026 10:02:08 +0100 Subject: [PATCH] feat(music-assistant): add PO token server for YouTube Music provider MA's YouTube Music provider needs a bgutil PO token server; MA installs the matching yt-dlp plugin unpinned from PyPI (2.0.2 today), so the server tracks 2.x via image automation. The MA docs' "1.2.1" predates the 2.x plugin line. Reachable only from the MA pod; egress limited to DNS and world:443. Co-Authored-By: Claude Opus 5.5 --- .../apps/music-assistant/kustomization.yaml | 1 + .../apps/music-assistant/po-token-server.yaml | 114 ++++++++++++++++++ .../infrastructure/image-automation/README.md | 1 + .../image-automation/bgutil-pot-provider.yaml | 23 ++++ .../image-automation/kustomization.yaml | 1 + 5 files changed, 140 insertions(+) create mode 100644 kubernetes/apps/music-assistant/po-token-server.yaml create mode 100644 kubernetes/infrastructure/image-automation/bgutil-pot-provider.yaml diff --git a/kubernetes/apps/music-assistant/kustomization.yaml b/kubernetes/apps/music-assistant/kustomization.yaml index df0699af..516f7ca9 100644 --- a/kubernetes/apps/music-assistant/kustomization.yaml +++ b/kubernetes/apps/music-assistant/kustomization.yaml @@ -5,5 +5,6 @@ resources: - network-attachment.yaml - configmap-net-reconcile.yaml - deployment.yaml + - po-token-server.yaml - ingress.yaml - kumamonitors.yaml diff --git a/kubernetes/apps/music-assistant/po-token-server.yaml b/kubernetes/apps/music-assistant/po-token-server.yaml new file mode 100644 index 00000000..a9001bbb --- /dev/null +++ b/kubernetes/apps/music-assistant/po-token-server.yaml @@ -0,0 +1,114 @@ +# PO token server for the Music Assistant YouTube Music provider. +# MA installs the bgutil-ytdlp-pot-provider yt-dlp plugin unpinned at runtime +# (latest from PyPI), so the server tracks the same major via image automation. +# Unauthenticated by design; reachable only from the MA pod (CNP below). +apiVersion: apps/v1 +kind: Deployment +metadata: + name: po-token-server + namespace: music-assistant + labels: + app.kubernetes.io/name: po-token-server +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: po-token-server + template: + metadata: + labels: + app.kubernetes.io/name: po-token-server + spec: + enableServiceLinks: false + automountServiceAccountToken: false + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + seccompProfile: + type: RuntimeDefault + containers: + - name: po-token-server + image: docker.io/brainicism/bgutil-ytdlp-pot-provider:2.0.2 # {"$imagepolicy": "flux-system:bgutil-pot-provider"} + ports: + - name: http + containerPort: 4416 + protocol: TCP + livenessProbe: + httpGet: + path: /ping + port: http + initialDelaySeconds: 20 + periodSeconds: 30 + timeoutSeconds: 10 + readinessProbe: + httpGet: + path: /ping + port: http + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + resources: + requests: + cpu: 20m + memory: 128Mi + limits: + memory: 512Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] +--- +apiVersion: v1 +kind: Service +metadata: + name: po-token-server + namespace: music-assistant +spec: + selector: + app.kubernetes.io/name: po-token-server + ports: + - name: http + port: 4416 + targetPort: http +--- +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: po-token-server + namespace: music-assistant +spec: + endpointSelector: + matchLabels: + app.kubernetes.io/name: po-token-server + ingress: + - fromEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": music-assistant + app.kubernetes.io/name: music-assistant + toPorts: + - ports: + - port: "4416" + protocol: TCP + # Kubelet probes. + - fromEntities: + - host + - remote-node + egress: + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": kube-system + k8s-app: kube-dns + toPorts: + - ports: + - port: "53" + protocol: UDP + - port: "53" + protocol: TCP + # YouTube BotGuard challenge fetch. + - toEntities: + - world + toPorts: + - ports: + - port: "443" + protocol: TCP diff --git a/kubernetes/infrastructure/image-automation/README.md b/kubernetes/infrastructure/image-automation/README.md index b4e4df60..c8d17fb4 100644 --- a/kubernetes/infrastructure/image-automation/README.md +++ b/kubernetes/infrastructure/image-automation/README.md @@ -37,6 +37,7 @@ existing `flux-system` GitRepository whose Secret was created by | paperless-ngx | `2.x` | | | audiobookshelf | `2.x` | | | music-assistant | `2.x` | | +| bgutil-pot-provider | `2.x` | Bare-semver filter (node flavor); major follows MA's unpinned PyPI plugin | | immich-server / immich-machine-learning | `2.x` | v-prefix filter; bump in lockstep | | home-assistant | `2026.x` | Calver — bump range each year | | matter-server | `8.x` | Pre-release filter | diff --git a/kubernetes/infrastructure/image-automation/bgutil-pot-provider.yaml b/kubernetes/infrastructure/image-automation/bgutil-pot-provider.yaml new file mode 100644 index 00000000..4e7b578e --- /dev/null +++ b/kubernetes/infrastructure/image-automation/bgutil-pot-provider.yaml @@ -0,0 +1,23 @@ +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImageRepository +metadata: + name: bgutil-pot-provider + namespace: flux-system +spec: + image: docker.io/brainicism/bgutil-ytdlp-pot-provider + interval: 1h +--- +# Bare semver tags are the node flavor; -node/-deno/sha-* variants excluded. +apiVersion: image.toolkit.fluxcd.io/v1 +kind: ImagePolicy +metadata: + name: bgutil-pot-provider + namespace: flux-system +spec: + imageRepositoryRef: + name: bgutil-pot-provider + filterTags: + pattern: '^\d+\.\d+\.\d+$' + policy: + semver: + range: "2.x" diff --git a/kubernetes/infrastructure/image-automation/kustomization.yaml b/kubernetes/infrastructure/image-automation/kustomization.yaml index c76ef75c..389e8982 100644 --- a/kubernetes/infrastructure/image-automation/kustomization.yaml +++ b/kubernetes/infrastructure/image-automation/kustomization.yaml @@ -5,6 +5,7 @@ resources: - audiobookshelf.yaml - authentik-gate-sync.yaml - backup-verify.yaml + - bgutil-pot-provider.yaml - ceph.yaml - cloudflare-lb-sync.yaml - cnpg-barman-plugin.yaml -- 2.54.0