Initial commit

apps/home-assistant/manifests/envoy-route.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: home-assistant
+  namespace: home-assistant
+spec:
+  parentRefs:
+    - name: edge
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - homeassistant.kube.huskypup.net
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: home-assistant
+          port: 8123

apps/home-assistant/manifests/external-secret.yaml

@@ -0,0 +1,31 @@
+---
+# Home Assistant OIDC Credentials - External Secret
+# 
+# This ExternalSecret syncs Home Assistant OIDC credentials from Vault
+# Credentials are stored in Vault by the sync-homeassistant-oauth.sh script
+# after Authentik blueprint creates the OAuth provider
+#
+# The secret is used by Home Assistant's hass-openid integration
+# to authenticate users via Authentik OIDC
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: homeassistant-oauth
+  namespace: home-assistant
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: homeassistant-oidc-secret
+    creationPolicy: Owner
+  refreshInterval: 1h
+  data:
+    - secretKey: client_id
+      remoteRef:
+        key: secret/homeassistant-oauth
+        property: client-id
+    - secretKey: client_secret
+      remoteRef:
+        key: secret/homeassistant-oauth
+        property: client-secret

apps/home-assistant/manifests/istio-virtualservice.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: home-assistant
+  namespace: home-assistant
+spec:
+  hosts:
+    - homeassistant.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    - timeout: 3600s
+      route:
+        - destination:
+            host: home-assistant.home-assistant.svc.cluster.local
+            port:
+              number: 8123

apps/home-assistant/manifests/oidc-config.yaml

@@ -0,0 +1,24 @@
+---
+# Home Assistant OIDC Configuration ConfigMap
+# 
+# This ConfigMap contains the OIDC configuration snippet that gets appended
+# to Home Assistant's configuration.yaml file during bootstrap
+#
+# The configuration enables hass-openid integration for Authentik OIDC auth
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: homeassistant-oidc-config
+  namespace: home-assistant
+data:
+  oidc.yaml: |
+    # OIDC Authentication via Authentik
+    # Users authenticate via Authentik and are auto-created in Home Assistant
+    openid:
+      client_id: !secret oidc_client_id
+      client_secret: !secret oidc_client_secret
+      configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
+      scope: "openid profile email"
+      username_field: "preferred_username"
+      create_user: true
+      block_login: false