Import manifests reverse-engineered from live cluster

Captured 2026-07-26 from rpi-master (k3s v1.30.3) and cleaned of runtime fields. Six apps as per-app kustomizations: vaultwarden, searxng, home-assistant, nginx, pihole(+unbound), unified-streaming. Intentional divergences from live state: - pihole WEBPASSWORD and USP_LICENSE_KEY moved from inline plaintext env to secretKeyRef (secrets gitignored; templates in secret.example.yaml) - HA ingress defaultBackend fixed (pointed at nonexistent service) - unifiedstreaming-svc kept as ClusterIP (LoadBalancer could never bind port 80 behind svclb-traefik) Validated against the live cluster with kubectl apply --dry-run=server: no immutable-field conflicts; one-time kubectl replace procedure for the two env->secretKeyRef migrations documented in README. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-26 02:13:56 -07:00
parent ec9b422f87
commit 8afac39d03
40 changed files with 1179 additions and 1 deletions
@@ -0,0 +1,74 @@
+# Originally installed via helm chart home-assistant-13.3.0 (release record no
+# longer in cluster); managed as a raw manifest since. Selector labels are
+# immutable — do not change them.
+# NOTE: /config/configuration.yaml (on the PV, not in git) must keep
+# http.trusted_proxies: [10.42.0.0/16] so traefik can reach HA from any node.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: home-assistant
+  namespace: home-assistant
+  labels:
+    app.kubernetes.io/instance: home-assistant
+    app.kubernetes.io/name: home-assistant
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: home-assistant
+      app.kubernetes.io/name: home-assistant
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: home-assistant
+        app.kubernetes.io/name: home-assistant
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: cpu
+                    operator: In
+                    values:
+                      - arm
+                  - key: controller
+                    operator: NotIn
+                    values:
+                      - "true"
+      containers:
+        - name: home-assistant
+          image: ghcr.io/home-assistant/home-assistant:stable
+          imagePullPolicy: Always
+          env:
+            - name: TZ
+              value: UTC
+          ports:
+            - name: http
+              containerPort: 8123
+              protocol: TCP
+          startupProbe:
+            tcpSocket:
+              port: 8123
+            failureThreshold: 30
+            periodSeconds: 5
+          livenessProbe:
+            tcpSocket:
+              port: 8123
+            failureThreshold: 3
+            periodSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: 8123
+            failureThreshold: 3
+            periodSeconds: 10
+          volumeMounts:
+            - name: config
+              mountPath: /config
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: home-assistant
@@ -0,0 +1,37 @@
+# NOTE: the live object's defaultBackend pointed at a service named
+# "home-assistant", which does not exist (the real service is
+# "home-assistant-svc"). Fixed here — this is the one intentional divergence
+# from the cluster state captured 2026-07-26.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: home-assistant
+  namespace: home-assistant
+spec:
+  ingressClassName: traefik
+  defaultBackend:
+    service:
+      name: home-assistant-svc
+      port:
+        number: 80
+  rules:
+    - host: ha.wittyoneoff.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: home-assistant-svc
+                port:
+                  number: 80
+    - host: ha-origin.wittyoneoff.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: home-assistant-svc
+                port:
+                  number: 80
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - storage.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: home-assistant
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: home-assistant-svc
+  namespace: home-assistant
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/instance: home-assistant
+    app.kubernetes.io/name: home-assistant
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8123
+      protocol: TCP
@@ -0,0 +1,30 @@
+# /config lives on GlusterFS (/mnt/gvolume0 mounted on every node).
+# Known risk: HA recorder DB on gluster + non-atomic renames → occasional
+# .storage write errors. See homelab notes.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: home-assistant-pv
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+  hostPath:
+    path: /mnt/gvolume0/home-assistant
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: home-assistant
+  namespace: home-assistant
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: ""
+  volumeName: home-assistant-pv