1.7 KiB
RouterOS Wi-Fi VLAN reconciler
This service applies bridge PVIDs on wifi-qcom-ac CAPs. CAPsMAN supplies the
SSID and MAC address for each Wi-Fi interface. The local CAP supplies the Wi-Fi
interface and bridge port. The reconciler matches by MAC address, chooses the
single enabled local interface when a stale disabled duplicate exists, writes
the local bridge PVID, and reads the port back. Static CAPsMAN interfaces are
disabled during a repair and enabled after verification; RouterOS cannot toggle
dynamic CAPsMAN interfaces, so their bridge ports are updated directly. It exports distinct
Prometheus metrics for API write failures and VLANs still wrong after readback.
chart/ is the portable Kubernetes contract. The deployed cluster chooses its
CAP hostnames, SSID mapping, and existing Secret in GitOps values. The Secret
contains mktxp.conf format credentials for a dedicated API account with
api,read,write policies. No IP addresses or credentials belong in the chart.
The service is intentionally one replica. Running two reconcilers against the
same CAPsMAN interfaces could race. /metrics and /healthz are exposed on
port 9808. For a portable install, run ./install.sh values.yaml with a values
file that names an existing credential Secret.
For this homelab, bootstrap_credentials.py creates a dedicated API user on
each hostname in the GitOps values file using administrator SSH, then creates
the Kubernetes Secret. It keeps the generated per-device passwords in a private
state file only until all devices and the Secret are ready. If provisioning
stops midway, rerun with the same state file so already configured devices
retain their password. The monitoring account and its Secret are not changed.