From 20aaf42a0aaeaf5e135a3d3492a6c17012adc81e Mon Sep 17 00:00:00 2001
From: "a.kazantsev" <a.kazantsev@gigacoms.ru>
Date: Mon, 20 Jul 2026 17:28:35 +0300
Subject: [PATCH] refactor(uyuni): comment out unused storageClass and
 duplicate mode setting

- Disable `global.persistence.storageClass` in defaults to use cluster default
- Remove redundant commented `mode: 256` line in helm task for clarity
---
 .../plans/1784555016343-calm-falcon.md        | 63 ++++++++++++++++
 playbooks/setup_homeassistant.yml             |  6 ++
 roles/homeassistant/defaults/main.yml         | 40 ++++++++++
 roles/homeassistant/meta/main.yml             | 11 +++
 roles/homeassistant/tasks/helm.yml            | 34 +++++++++
 roles/homeassistant/tasks/kubernetes.yml      | 73 ++++++++++++++++++
 roles/homeassistant/tasks/main.yml            |  6 ++
 roles/homeassistant/tasks/namespace.yml       | 10 +++
 .../templates/homeassistant-configmap.yml.j2  | 21 ++++++
 .../templates/homeassistant-deployment.yml.j2 | 57 ++++++++++++++
 .../templates/homeassistant-pvc.yml.j2        | 16 ++++
 .../templates/homeassistant-service.yml.j2    | 18 +++++
 .../templates/homeassistant-values.yml.j2     | 74 +++++++++++++++++++
 roles/uyuni/defaults/main.yml                 |  2 +-
 roles/uyuni/tasks/helm.yml                    |  1 -
 15 files changed, 430 insertions(+), 2 deletions(-)
 create mode 100644 .gigacode_vsc/plans/1784555016343-calm-falcon.md
 create mode 100644 playbooks/setup_homeassistant.yml
 create mode 100644 roles/homeassistant/defaults/main.yml
 create mode 100644 roles/homeassistant/meta/main.yml
 create mode 100644 roles/homeassistant/tasks/helm.yml
 create mode 100644 roles/homeassistant/tasks/kubernetes.yml
 create mode 100644 roles/homeassistant/tasks/main.yml
 create mode 100644 roles/homeassistant/tasks/namespace.yml
 create mode 100644 roles/homeassistant/templates/homeassistant-configmap.yml.j2
 create mode 100644 roles/homeassistant/templates/homeassistant-deployment.yml.j2
 create mode 100644 roles/homeassistant/templates/homeassistant-pvc.yml.j2
 create mode 100644 roles/homeassistant/templates/homeassistant-service.yml.j2
 create mode 100644 roles/homeassistant/templates/homeassistant-values.yml.j2

diff --git a/.gigacode_vsc/plans/1784555016343-calm-falcon.md b/.gigacode_vsc/plans/1784555016343-calm-falcon.md
new file mode 100644
index 0000000..d058af5
--- /dev/null
+++ b/.gigacode_vsc/plans/1784555016343-calm-falcon.md
@@ -0,0 +1,63 @@
+# Uyuni Role Issue Analysis
+
+## Problem
+Uyuni role is failing when deployed. Based on code review, there are several potential configuration issues:
+
+## Issues Found
+
+### 1. Missing Dependencies
+The uyuni role requires:
+- **cert-manager** to be installed first (creates Issuer and Certificates)
+- **longhorn** storage class (configured as `longhorn-xfs` in defaults)
+- **traefik** ingress controller (used for Ingress and IngressRouteTCP resources)
+
+If cert-manager is not installed before uyuni, the role will fail at creating the Issuer and Certificate resources.
+
+### 2. Certificate Secret References Mismatch
+In `roles/uyuni/tasks/helm.yml:877`, the db deployment references:
+```yaml
+secretName: db-cert
+```
+
+But in `roles/uyuni/defaults/main.yml:31`, the certificate is defined as:
+```yaml
+secretName: db-cert
+```
+
+This looks correct, but need to verify the actual secret name being created.
+
+### 3. Missing PostgreSQL Exporter Middleware
+In `roles/uyuni/tasks/helm.yml:1745`, the strip-prefixes middleware references `/saline` which doesn't exist in the codebase - this might be a typo.
+
+### 4. Potential Issues in Defaults Configuration
+The defaults have commented out lines that might be needed:
+- `db.postgresql.persistence.subPath: postgres-data`
+- `db.env.PGDATA: /var/lib/pgsql/data/postgres-data`
+
+These might be required for proper PostgreSQL persistence.
+
+## Recommended Actions
+
+1. **Verify cert-manager is deployed before uyuni** - check if `setup_cert_manager.yml` is run before `setup_uyuni.yml`
+
+2. **Add explicit dependency** in uyuni role to ensure cert-manager is available
+
+3. **Fix the `/saline` reference** in middleware - likely should be `/server` or removed
+
+4. **Review and potentially uncomment** the PostgreSQL persistence configuration
+
+5. **Check storage class** - ensure `longhorn-xfs` storage class exists in the cluster
+
+6. **Verify Traefik entrypoints** exist for:
+   - `websecure` (HTTPS)
+   - `web` (HTTP)  
+   - `reportdb-pgsql` (TCP)
+   - `salt-publish` (TCP)
+   - `salt-request` (TCP)
+
+## Questions for User
+
+1. Is cert-manager deployed in the cluster before running uyuni role?
+2. What specific error are you seeing? (logs would help identify the exact issue)
+3. Do you have the required Traefik entrypoints configured?
+4. Is the `longhorn-xfs` storage class available?
diff --git a/playbooks/setup_homeassistant.yml b/playbooks/setup_homeassistant.yml
new file mode 100644
index 0000000..8f9aac6
--- /dev/null
+++ b/playbooks/setup_homeassistant.yml
@@ -0,0 +1,6 @@
+---
+- name: Deploy Home Assistant to Kubernetes
+  hosts: manager_nodes
+  become: false
+  roles:
+    - homeassistant
diff --git a/roles/homeassistant/defaults/main.yml b/roles/homeassistant/defaults/main.yml
new file mode 100644
index 0000000..46d2c79
--- /dev/null
+++ b/roles/homeassistant/defaults/main.yml
@@ -0,0 +1,40 @@
+---
+homeassistant_chart_version: "15.2.2"
+homeassistant_namespace: homeassistant
+homeassistant_release_name: homeassistant
+
+homeassistant_home_assistant:
+  repository: ghcr.io/home-assistant/home-assistant
+  tag: stable
+  pullPolicy: IfNotPresent
+
+homeassistant_persistence_enabled: true
+homeassistant_persistence_path: /homeassistant
+homeassistant_persistence_accessMode: ReadWriteOnce
+homeassistant_persistence_size: 5Gi
+
+homeassistant_services:
+  - type: ClusterIP
+    port: 8123
+
+homeassistant_environment: []
+
+homeassistant_resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 256Mi
+
+homeassistant_node_selector: {}
+
+homeassistant_affinity: {}
+
+homeassistant_tolerations: []
+
+homeassistant_kubeconfig: "/home/{{ ansible_user }}/.kube/config"
+homeassistant_storage_class: longhorn
+homeassistant_replica_count: 1
+
+
diff --git a/roles/homeassistant/meta/main.yml b/roles/homeassistant/meta/main.yml
new file mode 100644
index 0000000..2944ede
--- /dev/null
+++ b/roles/homeassistant/meta/main.yml
@@ -0,0 +1,11 @@
+---
+galaxy_info:
+  role_name: homeassistant
+  author: ops
+  description: Deploys Home Assistant to Kubernetes cluster via Helm chart
+  license: MIT
+  min_ansible_version: "2.14"
+  platforms:
+    - name: EL
+      versions:
+        - "9"
diff --git a/roles/homeassistant/tasks/helm.yml b/roles/homeassistant/tasks/helm.yml
new file mode 100644
index 0000000..8ec7e85
--- /dev/null
+++ b/roles/homeassistant/tasks/helm.yml
@@ -0,0 +1,34 @@
+---
+- name: Helm | Update chart repositories
+  ansible.builtin.command: helm repo update
+  environment:
+    KUBECONFIG: "{{ homeassistant_kubeconfig }}"
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  changed_when: false
+  ignore_errors: true
+
+- name: Helm | Render Home Assistant values
+  ansible.builtin.template:
+    src: homeassistant-values.yml.j2
+    dest: /tmp/homeassistant-values.yml
+    mode: "0600"
+
+- name: Helm | Install or upgrade Home Assistant
+  ansible.builtin.command: >
+    helm upgrade --install {{ homeassistant_release_name }}
+    oci://ghcr.io/home-assistant/charts
+    --namespace {{ homeassistant_namespace }}
+    --version {{ homeassistant_chart_version }}
+    --values /tmp/homeassistant-values.yml
+    --timeout 10m0s
+    --wait
+  environment:
+    KUBECONFIG: "{{ homeassistant_kubeconfig }}"
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _helm_install
+  changed_when: "'STATUS: deployed' in _helm_install.stdout or 'has been upgraded' in _helm_install.stdout"
+  ignore_errors: true
+
+- name: Kubernetes | Create Home Assistant resources
+  ansible.builtin.include_tasks: kubernetes.yml
+  when: _helm_install is failed or _helm_install is skipped
diff --git a/roles/homeassistant/tasks/kubernetes.yml b/roles/homeassistant/tasks/kubernetes.yml
new file mode 100644
index 0000000..23f72cb
--- /dev/null
+++ b/roles/homeassistant/tasks/kubernetes.yml
@@ -0,0 +1,73 @@
+---
+- name: Kubernetes | Create PersistentVolumeClaim
+  ansible.builtin.template:
+    src: homeassistant-pvc.yml.j2
+    dest: /tmp/homeassistant-pvc.yml
+    mode: "0600"
+
+- name: Kubernetes | Apply PersistentVolumeClaim
+  ansible.builtin.command: >
+    kubectl apply -f /tmp/homeassistant-pvc.yml
+    --kubeconfig {{ homeassistant_kubeconfig }}
+  environment:
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _pvc_apply
+  changed_when: "'configured' in _pvc_apply.stderr or 'created' in _pvc_apply.stderr"
+
+- name: Kubernetes | Create Home Assistant ConfigMap
+  ansible.builtin.template:
+    src: homeassistant-configmap.yml.j2
+    dest: /tmp/homeassistant-configmap.yml
+    mode: "0600"
+
+- name: Kubernetes | Apply Home Assistant ConfigMap
+  ansible.builtin.command: >
+    kubectl apply -f /tmp/homeassistant-configmap.yml
+    --kubeconfig {{ homeassistant_kubeconfig }}
+  environment:
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _configmap_apply
+  changed_when: "'configured' in _configmap_apply.stderr or 'created' in _configmap_apply.stderr"
+
+- name: Kubernetes | Create Home Assistant Deployment
+  ansible.builtin.template:
+    src: homeassistant-deployment.yml.j2
+    dest: /tmp/homeassistant-deployment.yml
+    mode: "0600"
+
+- name: Kubernetes | Apply Home Assistant Deployment
+  ansible.builtin.command: >
+    kubectl apply -f /tmp/homeassistant-deployment.yml
+    --kubeconfig {{ homeassistant_kubeconfig }}
+  environment:
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _deployment_apply
+  changed_when: "'configured' in _deployment_apply.stderr or 'created' in _deployment_apply.stderr"
+
+- name: Kubernetes | Create Home Assistant Service
+  ansible.builtin.template:
+    src: homeassistant-service.yml.j2
+    dest: /tmp/homeassistant-service.yml
+    mode: "0600"
+
+- name: Kubernetes | Apply Home Assistant Service
+  ansible.builtin.command: >
+    kubectl apply -f /tmp/homeassistant-service.yml
+    --kubeconfig {{ homeassistant_kubeconfig }}
+  environment:
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _service_apply
+  changed_when: "'configured' in _service_apply.stderr or 'created' in _service_apply.stderr"
+
+- name: Kubernetes | Wait for Home Assistant pods
+  ansible.builtin.command: >
+    kubectl wait --for=condition=Ready pod
+    -l app.kubernetes.io/name=homeassistant
+    -n {{ homeassistant_namespace }}
+    --timeout=300s
+    --kubeconfig {{ homeassistant_kubeconfig }}
+  environment:
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _pod_ready
+  changed_when: false
+  failed_when: false
diff --git a/roles/homeassistant/tasks/main.yml b/roles/homeassistant/tasks/main.yml
new file mode 100644
index 0000000..b90fc53
--- /dev/null
+++ b/roles/homeassistant/tasks/main.yml
@@ -0,0 +1,6 @@
+---
+- name: Create Home Assistant namespace
+  ansible.builtin.include_tasks: namespace.yml
+
+- name: Deploy Home Assistant via Helm
+  ansible.builtin.include_tasks: helm.yml
diff --git a/roles/homeassistant/tasks/namespace.yml b/roles/homeassistant/tasks/namespace.yml
new file mode 100644
index 0000000..30fca6d
--- /dev/null
+++ b/roles/homeassistant/tasks/namespace.yml
@@ -0,0 +1,10 @@
+---
+- name: Namespace | Create Home Assistant namespace
+  ansible.builtin.command: >
+    kubectl create namespace {{ homeassistant_namespace }}
+    --kubeconfig {{ homeassistant_kubeconfig }}
+  environment:
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  register: _namespace_create
+  changed_when: "'created' in _namespace_create.stderr or 'created' in _namespace_create.stdout"
+  failed_when: _namespace_create.rc != 0 and 'already exists' not in _namespace_create.stderr
diff --git a/roles/homeassistant/templates/homeassistant-configmap.yml.j2 b/roles/homeassistant/templates/homeassistant-configmap.yml.j2
new file mode 100644
index 0000000..d2ac00b
--- /dev/null
+++ b/roles/homeassistant/templates/homeassistant-configmap.yml.j2
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: homeassistant-config
+  namespace: {{ homeassistant_namespace }}
+  labels:
+    app.kubernetes.io/name: homeassistant
+    app.kubernetes.io/instance: {{ homeassistant_release_name }}
+data:
+  configuration.yaml: |
+    http:
+      use_x_forwarded_for: true
+      trusted_proxies:
+        - 127.0.0.1
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
+      ip_ban_enabled: false
+      upload_limits:
+        media_source: 1572864000
+        file_upload: 1572864000
diff --git a/roles/homeassistant/templates/homeassistant-deployment.yml.j2 b/roles/homeassistant/templates/homeassistant-deployment.yml.j2
new file mode 100644
index 0000000..dcc59fe
--- /dev/null
+++ b/roles/homeassistant/templates/homeassistant-deployment.yml.j2
@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homeassistant
+  namespace: {{ homeassistant_namespace }}
+  labels:
+    app.kubernetes.io/name: homeassistant
+    app.kubernetes.io/instance: {{ homeassistant_release_name }}
+spec:
+  replicas: {{ homeassistant_replica_count }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: homeassistant
+      app.kubernetes.io/instance: {{ homeassistant_release_name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: homeassistant
+        app.kubernetes.io/instance: {{ homeassistant_release_name }}
+    spec:
+      securityContext:
+        runAsUser: 2000
+        runAsGroup: 2000
+        fsGroup: 2000
+      containers:
+        - name: homeassistant
+          image: {{ homeassistant_home_assistant.repository }}:{{ homeassistant_home_assistant.tag }}
+          imagePullPolicy: {{ homeassistant_home_assistant.pullPolicy }}
+          ports:
+            - containerPort: 8123
+              name: http
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: config-map
+              mountPath: /config/configuration.yaml
+              subPath: configuration.yaml
+              readOnly: true
+          resources:
+            limits:
+              cpu: {{ homeassistant_resources.limits.cpu }}
+              memory: {{ homeassistant_resources.limits.memory }}
+            requests:
+              cpu: {{ homeassistant_resources.requests.cpu }}
+              memory: {{ homeassistant_resources.requests.memory }}
+          securityContext:
+            privileged: true
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: homeassistant-pvc
+        - name: config-map
+          configMap:
+            name: homeassistant-config
+      nodeSelector: {}
+      tolerations: []
+      affinity: {}
diff --git a/roles/homeassistant/templates/homeassistant-pvc.yml.j2 b/roles/homeassistant/templates/homeassistant-pvc.yml.j2
new file mode 100644
index 0000000..9d5294b
--- /dev/null
+++ b/roles/homeassistant/templates/homeassistant-pvc.yml.j2
@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: homeassistant-pvc
+  namespace: {{ homeassistant_namespace }}
+  labels:
+    app.kubernetes.io/name: homeassistant
+    app.kubernetes.io/instance: {{ homeassistant_release_name }}
+spec:
+  accessModes:
+    - {{ homeassistant_persistence_accessMode }}
+  storageClassName: {{ homeassistant_storage_class }}
+  resources:
+    requests:
+      storage: {{ homeassistant_persistence_size }}
diff --git a/roles/homeassistant/templates/homeassistant-service.yml.j2 b/roles/homeassistant/templates/homeassistant-service.yml.j2
new file mode 100644
index 0000000..4dc592d
--- /dev/null
+++ b/roles/homeassistant/templates/homeassistant-service.yml.j2
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: homeassistant
+  namespace: {{ homeassistant_namespace }}
+  labels:
+    app.kubernetes.io/name: homeassistant
+    app.kubernetes.io/instance: {{ homeassistant_release_name }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ homeassistant_services[0].port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: homeassistant
+    app.kubernetes.io/instance: {{ homeassistant_release_name }}
diff --git a/roles/homeassistant/templates/homeassistant-values.yml.j2 b/roles/homeassistant/templates/homeassistant-values.yml.j2
new file mode 100644
index 0000000..3ec09c9
--- /dev/null
+++ b/roles/homeassistant/templates/homeassistant-values.yml.j2
@@ -0,0 +1,74 @@
+replicaCount: 1
+
+image:
+  repository: {{ homeassistant_home_assistant.repository }}
+  tag: {{ homeassistant_home_assistant.tag }}
+  pullPolicy: {{ homeassistant_home_assistant.pullPolicy }}
+
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  create: true
+  annotations: {}
+  name: ""
+
+podAnnotations: {}
+
+podSecurityContext:
+  fsGroup: 2000
+
+securityContext:
+  runAsUser: 2000
+  runAsNonRoot: true
+  runAsGroup: 2000
+
+service:
+  type: ClusterIP
+  port: 8123
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts:
+    - host: home-assistant.local
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls: []
+
+resources:
+  limits:
+    cpu: {{ homeassistant_resources.limits.cpu }}
+    memory: {{ homeassistant_resources.limits.memory }}
+  requests:
+    cpu: {{ homeassistant_resources.requests.cpu }}
+    memory: {{ homeassistant_resources.requests.memory }}
+
+nodeSelector: {% for key, value in homeassistant_node_selector.items() %}
+  {{ key }}: "{{ value }}"{% endfor %}
+
+tolerations: {% for item in homeassistant_tolerations %}{{ item | to_json }}{% if not loop.last %},{% endif %}{% endfor %}
+
+affinity: {% if homeassistant_affinity | length > 0 %}{{ homeassistant_affinity | to_json }}{% else %}{}{% endif %}
+
+persistence:
+  enabled: {{ homeassistant_persistence_enabled }}
+  storageClass: {{ homeassistant_storage_class }}
+  accessMode: {{ homeassistant_persistence_accessMode }}
+  size: {{ homeassistant_persistence_size }}
+  mountPath: /config
+
+env: {% for item in homeassistant_environment %}{{ item | to_json }}{% if not loop.last %},{% endif %}{% endfor %}
+
+initContainers: []
+
+extraContainers: []
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  targetMemoryUtilizationPercentage: 80
diff --git a/roles/uyuni/defaults/main.yml b/roles/uyuni/defaults/main.yml
index 351a46e..9428e4b 100644
--- a/roles/uyuni/defaults/main.yml
+++ b/roles/uyuni/defaults/main.yml
@@ -4,7 +4,7 @@ uyuni_namespace: uyuni-server
 uyuni_chart_version: 2026.6.0
 uyuni_kubeconfig: "/home/{{ ansible_user }}/.kube/config"
 uyuni_helm_values:
- global.persistence.storageClass: longhorn-xfs
+# global.persistence.storageClass: longhorn-xfs
  global.fqdn: uyuni.local.mrwho.ru
  ingress.enabled: true
  ingress.type: traefik
diff --git a/roles/uyuni/tasks/helm.yml b/roles/uyuni/tasks/helm.yml
index 382f39d..c394ae6 100644
--- a/roles/uyuni/tasks/helm.yml
+++ b/roles/uyuni/tasks/helm.yml
@@ -870,7 +870,6 @@
                   path: tls/certs/spacewalk.crt
                 - key: tls.key
                   mode: 0640
-#                  mode: 256
                   path: tls/private/pg-spacewalk.key
                 - key: ca.crt
                   path: trust/anchors/LOCAL-RHN-ORG-TRUSTED-SSL-CERT