This service applies bridge PVIDs on wifi-qcom-ac CAPs. CAPsMAN supplies the SSID and MAC address for each Wi-Fi interface. The local CAP supplies the Wi-Fi interface and bridge port. The reconciler matches by MAC address, chooses the single enabled local interface when a stale disabled duplicate exists, writes the local bridge PVID, and reads the port back. Static CAPsMAN interfaces are disabled during a repair and enabled after verification; RouterOS cannot toggle dynamic CAPsMAN interfaces, so their bridge ports are updated directly. It exports distinct Prometheus metrics for API write failures and VLANs still wrong after readback.

chart/ is the portable Kubernetes contract. The deployed cluster chooses its CAP hostnames, SSID mapping, and existing Secret in GitOps values. The Secret contains mktxp.conf format credentials for a dedicated API account with api,read,write policies. No IP addresses or credentials belong in the chart.

The service is intentionally one replica. Running two reconcilers against the same CAPsMAN interfaces could race. /metrics and /healthz are exposed on port 9808. For a portable install, run ./install.sh values.yaml with a values file that names an existing credential Secret.

For this homelab, bootstrap_credentials.py creates a dedicated API user on each hostname in the GitOps values file using administrator SSH, then creates the Kubernetes Secret. It keeps the generated per-device passwords in a private state file only until all devices and the Secret are ready. If provisioning stops midway, rerun with the same state file so already configured devices retain their password. The monitoring account and its Secret are not changed.