From ce23f9282c94acb0a3b7310975f6f9e8750a7986 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Tue, 10 Mar 2026 05:59:23 -0500 Subject: [PATCH] Fix prometheus secret namespace and frigate capabilities - Revert talos-client-cert secret to prometheus namespace (prometheus pods mount this secret, not kube-system pods) - Add CHOWN/DAC_OVERRIDE/SETUID/SETGID capabilities to frigate (s6-overlay needs chown for log directories) Co-Authored-By: Claude Opus 4.6 --- apps/frigate/values.yaml | 5 +++++ .../prometheus/manifests/talos-client-cert-secret.yaml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/apps/frigate/values.yaml b/apps/frigate/values.yaml index c753dd0..4a17d32 100644 --- a/apps/frigate/values.yaml +++ b/apps/frigate/values.yaml @@ -154,6 +154,11 @@ tmpfs: securityContext: privileged: false capabilities: + add: + - CHOWN + - DAC_OVERRIDE + - SETUID + - SETGID drop: - ALL diff --git a/infrastructure/prometheus/manifests/talos-client-cert-secret.yaml b/infrastructure/prometheus/manifests/talos-client-cert-secret.yaml index 67e67af..62bce9d 100644 --- a/infrastructure/prometheus/manifests/talos-client-cert-secret.yaml +++ b/infrastructure/prometheus/manifests/talos-client-cert-secret.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Secret metadata: name: talos-client-cert - namespace: kube-system + namespace: prometheus type: Opaque data: ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBelVmaHJ2MW5uS21DcHVLTW90MUhOakFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNVE13TVRrME56UXlXaGNOTXpVeE1USTRNVGswTnpReVdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQUpWWThDUDAyN0ZQWnJONzJPMlZkaGRCYjY3Z0plaUFINloxClNlUDAvWFlBbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRk1zbmNVTVo4ZGZhVlR3Ugo3RVVZNEl1TjZCZEJNQVVHQXl0bGNBTkJBTjlkK2laekxVdjJXQXNxNWdPbDh2bmhzSHhRMXY3SU1zOGtEZFNHClNUTVZSa1hvTzNKZmdqNUZ4QUMrN2JmV3hGZytzdW9rU3dWdWVBZ1VJTzFrUXdFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==