From f059cbb62c6827a520bb3140a59026f6b76d9954 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 23:07:14 +0200 Subject: [PATCH] =?UTF-8?q?feat(home-assistant):=20evict=20HA=20from=20edg?= =?UTF-8?q?e=20=E2=80=94=20read=20meter=20via=20MQTT,=20drop=20privileged?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Home Assistant was pinned to k8s-edge solely for the USB power meter it read via edl21. edl21 is now replaced by the sml2mqtt bridge (publishes to Mosquitto), so HA: - drops nodeSelector zone=edge + the workload-class=pinned toleration → the heavy 8Gi pod schedules on the general cluster pool, off the soon-to-be-tiny edge box; - drops the /dev/stromzaehler USB hostPath mount + volume (bridge owns the device now); - drops securityContext.privileged — the USB device was its only justification. This also frees the serial fd the running HA process still held after edl21's removal (HA recreates without the device), giving the sml2mqtt bridge exclusive access to the meter. Meter data in HA resumes once the MQTT sensors (reusing the old sensor.smart_meter_* entity_ids for history continuity) land in the homeassistant repo — brief expected gap. Co-Authored-By: Claude Opus 4.8 --- .../apps/home-assistant/deployment.yaml | 20 ++++++------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/kubernetes/apps/home-assistant/deployment.yaml b/kubernetes/apps/home-assistant/deployment.yaml index 8ea3a6a6..7bb5c988 100644 --- a/kubernetes/apps/home-assistant/deployment.yaml +++ b/kubernetes/apps/home-assistant/deployment.yaml @@ -23,13 +23,10 @@ spec: # when that field was dropped from the manifest. Safe to remove # in a follow-up once SSA owns it with this value. serviceAccountName: default - nodeSelector: - topology.kubernetes.io/zone: edge - tolerations: - - key: workload-class - operator: Equal - value: pinned - effect: NoSchedule + # No nodeSelector/toleration: HA reads the power meter over MQTT now + # (sml2mqtt bridge owns the USB device on edge), so it no longer needs + # the edge USB device and schedules on the general cluster pool. This + # gets the heavy HA pod (8Gi) off the soon-to-be-tiny edge box. containers: - name: home-assistant image: ghcr.io/home-assistant/home-assistant:2026.6.4 # {"$imagepolicy": "flux-system:home-assistant"} @@ -43,8 +40,6 @@ spec: volumeMounts: - name: config mountPath: /config - - name: stromzaehler - mountPath: /dev/stromzaehler # Initial restore of a 1 GB encrypted HAOS backup runs single- # threaded inside HA's Python and exceeded the old liveness # window, getting SIGTERM'd mid-restore. Startup probe gives a @@ -78,8 +73,8 @@ spec: memory: 2Gi limits: memory: 8Gi - securityContext: - privileged: true + # No securityContext/privileged: the USB meter is gone (read via + # MQTT now), which was the only reason HA needed privileged. # Reverse-proxy sidecar. ingress-nginx → :8124 → 127.0.0.1:8123. # HA's TCP peer is always loopback, so http.trusted_proxies = # [127.0.0.1, ::1] is static and never has to change when @@ -171,9 +166,6 @@ spec: # (/etc/nginx/conf.d/default.conf rendered from the .template). - name: proxy-conf-d emptyDir: {} - - name: stromzaehler - hostPath: - path: /dev/serial/by-id/usb-FTDI_FT230X_Basic_UART_DK0E1GP5-if00-port0 # code-server's settings/extensions cache. Not on the config PVC # so installed extensions don't pollute HA's /config listing. # Trade-off: extensions reset across pod restarts. -- 2.54.0