kubernetes/apps/music-assistant/kustomization.yaml

@@ -5,5 +5,6 @@ resources:
   - network-attachment.yaml
   - configmap-net-reconcile.yaml
   - deployment.yaml
+  - po-token-server.yaml
   - ingress.yaml
   - kumamonitors.yaml

kubernetes/apps/music-assistant/po-token-server.yaml

@@ -0,0 +1,114 @@
+# PO token server for the Music Assistant YouTube Music provider.
+# MA installs the bgutil-ytdlp-pot-provider yt-dlp plugin unpinned at runtime
+# (latest from PyPI), so the server tracks the same major via image automation.
+# Unauthenticated by design; reachable only from the MA pod (CNP below).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: po-token-server
+  namespace: music-assistant
+  labels:
+    app.kubernetes.io/name: po-token-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: po-token-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: po-token-server
+    spec:
+      enableServiceLinks: false
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: po-token-server
+          image: docker.io/brainicism/bgutil-ytdlp-pot-provider:2.0.2 # {"$imagepolicy": "flux-system:bgutil-pot-provider"}
+          ports:
+            - name: http
+              containerPort: 4416
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 30
+            timeoutSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 20m
+              memory: 128Mi
+            limits:
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: po-token-server
+  namespace: music-assistant
+spec:
+  selector:
+    app.kubernetes.io/name: po-token-server
+  ports:
+    - name: http
+      port: 4416
+      targetPort: http
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: po-token-server
+  namespace: music-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: po-token-server
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": music-assistant
+            app.kubernetes.io/name: music-assistant
+      toPorts:
+        - ports:
+            - port: "4416"
+              protocol: TCP
+    # Kubelet probes.
+    - fromEntities:
+        - host
+        - remote-node
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    # YouTube BotGuard challenge fetch.
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP

kubernetes/infrastructure/image-automation/README.md

@@ -37,6 +37,7 @@ existing `flux-system` GitRepository whose Secret was created by
 | paperless-ngx | `2.x` | |
 | audiobookshelf | `2.x` | |
 | music-assistant | `2.x` | |
+| bgutil-pot-provider | `2.x` | Bare-semver filter (node flavor); major follows MA's unpinned PyPI plugin |
 | immich-server / immich-machine-learning | `2.x` | v-prefix filter; bump in lockstep |
 | home-assistant | `2026.x` | Calver — bump range each year |
 | matter-server | `8.x` | Pre-release filter |

kubernetes/infrastructure/image-automation/bgutil-pot-provider.yaml

@@ -0,0 +1,23 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: bgutil-pot-provider
+  namespace: flux-system
+spec:
+  image: docker.io/brainicism/bgutil-ytdlp-pot-provider
+  interval: 1h
+---
+# Bare semver tags are the node flavor; -node/-deno/sha-* variants excluded.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: bgutil-pot-provider
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: bgutil-pot-provider
+  filterTags:
+    pattern: '^\d+\.\d+\.\d+$'
+  policy:
+    semver:
+      range: "2.x"

kubernetes/infrastructure/image-automation/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
   - audiobookshelf.yaml
   - authentik-gate-sync.yaml
   - backup-verify.yaml
+  - bgutil-pot-provider.yaml
   - ceph.yaml
   - cloudflare-lb-sync.yaml
   - cnpg-barman-plugin.yaml