From 0ad25fbe1a946e9103c32486d7f3f9d0edf0552e Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 22:58:36 +0200 Subject: [PATCH] feat(home-assistant): activate sml2mqtt bridge (privileged, stdout, replicas 1) edl21 has been disabled in HA, freeing the meter's serial port, so the bridge is activated for the cutover. Three fixes from bring-up testing: - logging.file: stdout (was ''). Empty string made sml2mqtt try to open the /sml2mqtt config dir as a log file (IsADirectoryError crash loop). 'stdout' routes logs to the container console for kubectl/Loki. - securityContext.privileged: true (with runAsUser 0). The meter device is root:root 0600, AND the device cgroup blocks a hostPath-mounted char device for non-privileged containers even as root. There is no device-plugin in the cluster; the existing USB pods (zwave-js, HA) use the same privileged pattern. User-approved. - replicas: 0 -> 1 (port is now free; no edl21 contention). Co-Authored-By: Claude Opus 4.8 --- .../apps/home-assistant/sml2mqtt-config.yaml | 2 +- .../home-assistant/sml2mqtt-deployment.yaml | 20 ++++++++++--------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/kubernetes/apps/home-assistant/sml2mqtt-config.yaml b/kubernetes/apps/home-assistant/sml2mqtt-config.yaml index 60a932cc..ae201af5 100644 --- a/kubernetes/apps/home-assistant/sml2mqtt-config.yaml +++ b/kubernetes/apps/home-assistant/sml2mqtt-config.yaml @@ -17,7 +17,7 @@ data: config.yml: | logging: level: INFO - file: '' # stdout -> kubectl logs / Loki + file: stdout # 'stdout' -> kubectl logs / Loki (NOT '' — that opens the dir) mqtt: connection: diff --git a/kubernetes/apps/home-assistant/sml2mqtt-deployment.yaml b/kubernetes/apps/home-assistant/sml2mqtt-deployment.yaml index a3930c3d..f14e5998 100644 --- a/kubernetes/apps/home-assistant/sml2mqtt-deployment.yaml +++ b/kubernetes/apps/home-assistant/sml2mqtt-deployment.yaml @@ -10,10 +10,9 @@ # # SERIAL EXCLUSIVITY: the meter's /dev/ttyUSB0 is a single serial stream; # edl21 (in the HA pod) and sml2mqtt cannot both read it without -# corrupting each other's SML framing. Therefore this Deployment ships at -# `replicas: 0` (dormant). The cutover is: disable edl21 in HA -> scale -# this to 1 -> add HA MQTT sensors -> evict HA from edge. Until then, -# merging this changes nothing at runtime. +# corrupting each other's SML framing. edl21 has now been disabled in HA, +# freeing the port, so this is activated (replicas: 1). Remaining cutover: +# add HA MQTT sensors reusing the old entity_ids -> evict HA from edge. apiVersion: apps/v1 kind: Deployment metadata: @@ -22,8 +21,7 @@ metadata: labels: app.kubernetes.io/name: sml2mqtt spec: - # Dormant until the edl21 -> MQTT cutover frees the serial port. See header. - replicas: 0 + replicas: 1 strategy: type: Recreate selector: @@ -82,9 +80,13 @@ spec: - name: stromzaehler mountPath: /dev/stromzaehler securityContext: - # The meter device is root:root 0600 on the node, so the - # process must run as root to open it. No `privileged` needed — - # owner-root + the hostPath device mount is sufficient. + # The meter device is root:root 0600 on the node. Opening it + # needs BOTH: runAsUser 0 (file DAC) AND privileged (the device + # cgroup blocks a hostPath-mounted char device for non-privileged + # containers even as root — there's no device-plugin here). This + # mirrors how the HA pod accesses the same device today; the win + # is that it's now a tiny pod instead of the 8Gi HA pod. + privileged: true runAsUser: 0 runAsGroup: 0 resources: -- 2.54.0