This service applies bridge PVIDs on wifi-qcom-ac CAPs. CAPsMAN supplies the SSID and MAC address for each Wi-Fi interface. The local CAP supplies the Wi-Fi interface and bridge port. The reconciler matches by MAC address, chooses the single enabled local interface when a stale disabled duplicate exists, disables the CAPsMAN interface before changing a wrong bridge port, writes the PVID, reads the port back, and only then enables CAPsMAN again. It exports distinct Prometheus metrics for API write failures and VLANs still wrong after readback.

chart/ is the portable Kubernetes contract. The deployed cluster chooses its CAP hostnames, SSID mapping, and existing Secret in GitOps values. The Secret contains mktxp.conf format credentials for a dedicated API account with api,read,write policies. No IP addresses or credentials belong in the chart.

The service is intentionally one replica. Running two reconcilers against the same CAPsMAN interfaces could race. /metrics and /healthz are exposed on port 9808. For a portable install, run ./install.sh values.yaml with a values file that names an existing credential Secret.

For this homelab, bootstrap_credentials.py creates a dedicated API user on each hostname in the GitOps values file using administrator SSH, then creates the Kubernetes Secret. It keeps the generated per-device passwords in a private state file only until all devices and the Secret are ready. If provisioning stops midway, rerun with the same state file so already configured devices retain their password. The monitoring account and its Secret are not changed.