Dustin C. Hatch
8c605d0f9f
Moving the shell command to an external script allows me to update it without having to restart Home Assistant. Including the SSH private key in the Secret not only allows it to be managed by Kubernetes, but also works around a permissions issue when storing the key in the `/config` volume. The `ssh` command refuses to use a key file with write permission for the group or other fields, but the Kubelet sets `g=rw` when `fsGroup` is set on the pod.
81 lines
2.1 KiB
YAML
81 lines
2.1 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: home-assistant
|
|
|
|
labels:
|
|
- pairs:
|
|
app.kubernetes.io/instance: home-assistant
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- secrets.yaml
|
|
- home-assistant.yaml
|
|
- mosquitto-cert.yaml
|
|
- mosquitto.yaml
|
|
- zigbee2mqtt.yaml
|
|
- zwavejs2mqtt.yaml
|
|
- piper.yaml
|
|
- whisper.yaml
|
|
- ingress.yaml
|
|
|
|
configMapGenerator:
|
|
- name: home-assistant
|
|
files:
|
|
- configuration.yaml
|
|
- event-snapshot.sh
|
|
- groups.yaml
|
|
- restart-diddy-mopidy.sh
|
|
- shell-command.yaml
|
|
options:
|
|
disableNameSuffixHash: true
|
|
labels:
|
|
app.kubernetes.io/name: home-assistant
|
|
app.kubernetes.io/component: home-assistant
|
|
app.kubernetes.io/part-of: home-assistant
|
|
|
|
- name: mosquitto
|
|
files:
|
|
- mosquitto.conf
|
|
|
|
patches:
|
|
- patch: |-
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: home-assistant
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: home-assistant
|
|
env:
|
|
- name: RECORDER_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: home-assistant.homeassistant.default.credentials.postgresql.acid.zalan.do
|
|
key: password
|
|
- name: RECORDER_DB_USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: home-assistant.homeassistant.default.credentials.postgresql.acid.zalan.do
|
|
key: username
|
|
- name: RECORDER_DB_URL
|
|
value: postgresql://$(RECORDER_DB_USERNAME):$(RECORDER_DB_PASSWORD)@default.postgresql/homeassistant
|
|
volumeMounts:
|
|
- mountPath: /run/config
|
|
name: home-assistant-config
|
|
readOnly: true
|
|
- mountPath: /run/secrets/home-assistant
|
|
name: home-assistant-secrets
|
|
readOnly: true
|
|
volumes:
|
|
- name: home-assistant-config
|
|
configMap:
|
|
name: home-assistant
|
|
defaultMode: 0600
|
|
- name: home-assistant-secrets
|
|
secret:
|
|
secretName: home-assistant
|
|
defaultMode: 0640
|