homeassistant-k8s-supervisor/ha-k8s-supervised.yaml at main · shantur/homeassistant-k8s-supervisor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
# Home Assistant Supervisor (Kubernetes runtime mode)
#
# Change these before applying:
# - VIP / internal gateway address: SUPERVISOR_K8S_INTERNAL_GATEWAY_ADDRESS (default: 192.168.100.130)
# - Storage class: PVC .spec.storageClassName + SUPERVISOR_K8S_SHARED_PVC_STORAGE_CLASS (default: cephfs)
# - Storage size: PVC .spec.resources.requests.storage + SUPERVISOR_K8S_SHARED_PVC_SIZE (default: 50Gi)
#
# This manifest is designed to be deployable with a namespace-scoped ServiceAccount
# kubeconfig. That means it does NOT create:
# - Namespace
# - ServiceAccount
# - Role / RoleBinding
#
# Supporting resources (Home Assistant core workloads, add-ons, internal L4 proxy) are
# created/managed dynamically by Supervisor at runtime and therefore are not included here.
#
# Prerequisites (provided by cluster admin/GitOps):
# - Namespace `home-assistant` exists
# - ServiceAccount `home-assistant/supervisor` exists
# - RBAC grants that ServiceAccount permissions to manage the namespaced resources
#   Supervisor needs (deployments/services/configmaps/secrets/pods/log/pvcs, etc.)
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ha-shared-rwx
  namespace: home-assistant
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: cephfs
  resources:
    requests:
      storage: 50Gi
---
apiVersion: v1
kind: Service
metadata:
  name: supervisor
  namespace: home-assistant
spec:
  type: ClusterIP
  selector:
    app: supervisor
  ports:
    - name: http
      port: 80
      targetPort: http
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: supervisor
  namespace: home-assistant
spec:
  serviceName: supervisor
  replicas: 1
  selector:
    matchLabels:
      app: supervisor
  template:
    metadata:
      labels:
        app: supervisor
    spec:
      serviceAccountName: supervisor
      containers:
        - name: supervisor
          image: shantur/homeassistant-kubernetes-supervisor:2026.01.2-1
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 80
          readinessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 2
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 6
          livenessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 6
          env:
            - name: SUPERVISOR_RUNTIME
              value: kubernetes
            - name: SUPERVISOR_NAME
              value: supervisor
            - name: SUPERVISOR_SHARE
              value: /data
            - name: SUPERVISOR_MACHINE
              value: generic-x86-64
            - name: SUPERVISOR_K8S_STORAGE_MODE
              value: shared_pvc
            - name: SUPERVISOR_K8S_SHARED_PVC_CLAIM
              value: ha-shared-rwx
            - name: SUPERVISOR_K8S_SHARED_PVC_STORAGE_CLASS
              value: cephfs
            - name: SUPERVISOR_K8S_SHARED_PVC_SIZE
              value: 50Gi
            - name: SUPERVISOR_K8S_INTERNAL_GATEWAY_ADDRESS
              value: 192.168.100.130
            - name: SUPERVISOR_K8S_INTERNAL_GATEWAY_NAME
              value: ha-internal
            - name: SUPERVISOR_K8S_INTERNAL_GATEWAY_CLASS
              value: cilium
            - name: SUPERVISOR_K8S_MANAGE_PUBLIC_GATEWAY
              value: "false"
            # Comma-separated list of CIDRs/IPs that Home Assistant should trust
            # as reverse proxies when Supervisor manages the HA workload.
            # Default k3s PodCIDR is 10.42.0.0/16.
            - name: SUPERVISOR_K8S_HA_TRUSTED_PROXIES
              value: 10.42.0.0/16
          volumeMounts:
            - name: shared-data
              mountPath: /data
      volumes:
        - name: shared-data
          persistentVolumeClaim:
            claimName: ha-shared-rwx