mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Initial commit
This commit is contained in:
Scooby Husky
@@ -0,0 +1,20 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: esphome
|
||||
namespace: home-assistant
|
||||
spec:
|
||||
parentRefs:
|
||||
- name: edge
|
||||
namespace: gateway
|
||||
sectionName: https
|
||||
hostnames:
|
||||
- esphome.kube.huskypup.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- name: esphome
|
||||
port: 6052
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: esphome
|
||||
namespace: home-assistant
|
||||
spec:
|
||||
hosts:
|
||||
- esphome.kube.huskypup.net
|
||||
gateways:
|
||||
- istio-system/edge
|
||||
http:
|
||||
- route:
|
||||
- destination:
|
||||
host: esphome.home-assistant.svc.cluster.local
|
||||
port:
|
||||
number: 6052
|
||||
@@ -0,0 +1,57 @@
|
||||
# ESPHome Helm Chart Values
|
||||
# Deployed in home-assistant namespace as a companion to Home Assistant
|
||||
#
|
||||
# FEATURES:
|
||||
# ✓ ESPHome Dashboard for managing ESP devices
|
||||
# ✓ Persistent storage via Rook-Ceph
|
||||
# ✓ TLS certificates via cert-manager
|
||||
# ✓ Ingress via Istio VirtualService
|
||||
|
||||
image:
|
||||
repository: ghcr.io/esphome/esphome
|
||||
tag: "2024.11.3"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: 6052
|
||||
|
||||
# Ingress disabled - Istio VirtualService handles routing
|
||||
ingress:
|
||||
main:
|
||||
enabled: false
|
||||
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
storageClass: rook-ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
retain: true
|
||||
|
||||
env:
|
||||
TZ: America/New_York
|
||||
ESPHOME_DASHBOARD_USE_PING: "true"
|
||||
|
||||
securityContext:
|
||||
privileged: false
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
readiness:
|
||||
enabled: true
|
||||
startup:
|
||||
enabled: true
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: home-assistant
|
||||
namespace: home-assistant
|
||||
spec:
|
||||
parentRefs:
|
||||
- name: edge
|
||||
namespace: gateway
|
||||
sectionName: https
|
||||
hostnames:
|
||||
- homeassistant.kube.huskypup.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- name: home-assistant
|
||||
port: 8123
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
# Home Assistant OIDC Credentials - External Secret
|
||||
#
|
||||
# This ExternalSecret syncs Home Assistant OIDC credentials from Vault
|
||||
# Credentials are stored in Vault by the sync-homeassistant-oauth.sh script
|
||||
# after Authentik blueprint creates the OAuth provider
|
||||
#
|
||||
# The secret is used by Home Assistant's hass-openid integration
|
||||
# to authenticate users via Authentik OIDC
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: homeassistant-oauth
|
||||
namespace: home-assistant
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault-backend
|
||||
target:
|
||||
name: homeassistant-oidc-secret
|
||||
creationPolicy: Owner
|
||||
refreshInterval: 1h
|
||||
data:
|
||||
- secretKey: client_id
|
||||
remoteRef:
|
||||
key: secret/homeassistant-oauth
|
||||
property: client-id
|
||||
- secretKey: client_secret
|
||||
remoteRef:
|
||||
key: secret/homeassistant-oauth
|
||||
property: client-secret
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: home-assistant
|
||||
namespace: home-assistant
|
||||
spec:
|
||||
hosts:
|
||||
- homeassistant.kube.huskypup.net
|
||||
gateways:
|
||||
- istio-system/edge
|
||||
http:
|
||||
- timeout: 3600s
|
||||
route:
|
||||
- destination:
|
||||
host: home-assistant.home-assistant.svc.cluster.local
|
||||
port:
|
||||
number: 8123
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
# Home Assistant OIDC Configuration ConfigMap
|
||||
#
|
||||
# This ConfigMap contains the OIDC configuration snippet that gets appended
|
||||
# to Home Assistant's configuration.yaml file during bootstrap
|
||||
#
|
||||
# The configuration enables hass-openid integration for Authentik OIDC auth
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: homeassistant-oidc-config
|
||||
namespace: home-assistant
|
||||
data:
|
||||
oidc.yaml: |
|
||||
# OIDC Authentication via Authentik
|
||||
# Users authenticate via Authentik and are auto-created in Home Assistant
|
||||
openid:
|
||||
client_id: !secret oidc_client_id
|
||||
client_secret: !secret oidc_client_secret
|
||||
configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
|
||||
scope: "openid profile email"
|
||||
username_field: "preferred_username"
|
||||
create_user: true
|
||||
block_login: false
|
||||
@@ -0,0 +1,152 @@
|
||||
# Disable Istio sidecar on home-assistant pod because the init container
|
||||
# (install-hass-openid) needs unrestricted network access to git clone.
|
||||
# Istio CNI redirects traffic to the proxy port during init, but the proxy
|
||||
# isn't running yet, causing TLS/connection failures.
|
||||
# ESPHome (same namespace) still gets sidecar injection normally.
|
||||
podAnnotations:
|
||||
sidecar.istio.io/inject: "false"
|
||||
|
||||
image:
|
||||
repository: ghcr.io/home-assistant/home-assistant
|
||||
tag: "2025.1.2"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
initContainers:
|
||||
install-hass-openid:
|
||||
image: docker.io/alpine/git:2.47.2
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
apk add --no-cache git
|
||||
|
||||
# Install hass-openid custom integration
|
||||
mkdir -p /config/custom_components /config/includes
|
||||
cd /tmp
|
||||
git clone --depth 1 https://github.com/cavefire/hass-openid.git
|
||||
cp -r hass-openid/custom_components/openid /config/custom_components/
|
||||
rm -rf hass-openid
|
||||
|
||||
# Write MQTT addons config
|
||||
printf 'mqtt:\n broker: mqtt.kube.huskypup.net\n port: 1883\n username: homeassistant\n password: YOUR_MQTT_PASSWORD' > /config/includes/ha-addons.yaml
|
||||
|
||||
# Write OIDC credentials to secrets.yaml (from mounted k8s secret)
|
||||
if [ -f /oidc-secret/client_id ] && [ -f /oidc-secret/client_secret ]; then
|
||||
CLIENT_ID=$(cat /oidc-secret/client_id)
|
||||
CLIENT_SECRET=$(cat /oidc-secret/client_secret)
|
||||
# Preserve existing secrets, update OIDC entries
|
||||
if [ -f /config/secrets.yaml ]; then
|
||||
sed -i '/^oidc_client_id:/d' /config/secrets.yaml
|
||||
sed -i '/^oidc_client_secret:/d' /config/secrets.yaml
|
||||
fi
|
||||
echo "oidc_client_id: \"${CLIENT_ID}\"" >> /config/secrets.yaml
|
||||
echo "oidc_client_secret: \"${CLIENT_SECRET}\"" >> /config/secrets.yaml
|
||||
echo "OIDC credentials written to secrets.yaml"
|
||||
else
|
||||
echo "WARNING: OIDC secret not mounted, skipping secrets.yaml"
|
||||
fi
|
||||
|
||||
# Ensure OIDC config is in configuration.yaml
|
||||
if [ ! -f /config/configuration.yaml ]; then
|
||||
echo "Creating configuration.yaml with OIDC config..."
|
||||
cat > /config/configuration.yaml <<'OIDCEOF'
|
||||
# Home Assistant Configuration
|
||||
default_config:
|
||||
|
||||
# OIDC Authentication via Authentik
|
||||
openid:
|
||||
client_id: !secret oidc_client_id
|
||||
client_secret: !secret oidc_client_secret
|
||||
configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
|
||||
scope: "openid profile email"
|
||||
username_field: "preferred_username"
|
||||
create_user: true
|
||||
block_login: false
|
||||
OIDCEOF
|
||||
elif ! grep -q "^openid:" /config/configuration.yaml; then
|
||||
echo "Appending OIDC config to existing configuration.yaml..."
|
||||
cat >> /config/configuration.yaml <<'OIDCEOF'
|
||||
|
||||
# OIDC Authentication via Authentik
|
||||
openid:
|
||||
client_id: !secret oidc_client_id
|
||||
client_secret: !secret oidc_client_secret
|
||||
configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
|
||||
scope: "openid profile email"
|
||||
username_field: "preferred_username"
|
||||
create_user: true
|
||||
block_login: false
|
||||
OIDCEOF
|
||||
else
|
||||
echo "OIDC config already present in configuration.yaml"
|
||||
fi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: oidc-secret
|
||||
mountPath: /oidc-secret
|
||||
readOnly: true
|
||||
|
||||
env:
|
||||
TZ: America/New_York
|
||||
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: 8123
|
||||
|
||||
# Ingress disabled - Istio VirtualService handles routing
|
||||
ingress:
|
||||
main:
|
||||
enabled: false
|
||||
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
storageClass: rook-ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
retain: true
|
||||
oidc-secret:
|
||||
enabled: true
|
||||
type: secret
|
||||
name: homeassistant-oidc-secret
|
||||
mountPath: /oidc-secret
|
||||
readOnly: true
|
||||
|
||||
securityContext:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 2Gi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
readiness:
|
||||
enabled: true
|
||||
startup:
|
||||
enabled: true
|
||||
|
||||
mariadb:
|
||||
enabled: false
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
|
||||
influxdb:
|
||||
enabled: false
|
||||
|
||||
metrics:
|
||||
enabled: false
|
||||
Reference in New Issue
Block a user