Five workloads attach a macvlan on ens19 (v30iot) with DHCP IPAM:
shelly-manager and the mDNS relay (inside the home-assistant Kustomization),
matter-server, music-assistant and otbr. On a node without that VLAN the CNI
add fails and the pod never starts.
- k8s-1..3 carry net.renner.uno/iot-vlan: "true"; each of them declares
ens19 in its VLANConfig. The five Deployments select on it. The comments
they replace described the retired k8s-edge taint.
- shelly-manager and the mDNS relay move to apps/home-assistant-iot, with a
Kustomization of their own (depends on gitea, home-assistant and the
infrastructure Kustomizations). home-assistant's wait: true no longer
covers them, so HA and everything waiting on it (evcc, trmnl,
zone-configurator, speech-to-phrase) are Ready without the VLAN, and a
broken IoT bridge no longer holds them back in production either.
- shelly-manager-auth stays in apps/home-assistant: mqtt-account-controller
mounts it too, and that Kustomization comes first. Moved with
shelly-manager, mqtt-account-controller would wait for a Secret that only
the later Kustomization creates.
- The probes-blackbox and authentik blueprint comments name the new paths.
On a site without the label the IoT Kustomizations fail at their timeout,
naming the Pending pods; nothing else depends on them.
Production rollout:
1. Label the nodes first (talosctl patch the nodeLabels), or the five pods go
Pending.
2. home-assistant must run with prune: false (the stack's first PR) when
this merges, so it drops shelly-manager and the mDNS relay from its
inventory without deleting them and home-assistant-iot adopts them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude-botandClaude Opus 5.5
7f1d7ac777