Initial commit

apps/home-assistant/values.yaml

@@ -0,0 +1,152 @@
+# Disable Istio sidecar on home-assistant pod because the init container
+# (install-hass-openid) needs unrestricted network access to git clone.
+# Istio CNI redirects traffic to the proxy port during init, but the proxy
+# isn't running yet, causing TLS/connection failures.
+# ESPHome (same namespace) still gets sidecar injection normally.
+podAnnotations:
+  sidecar.istio.io/inject: "false"
+
+image:
+  repository: ghcr.io/home-assistant/home-assistant
+  tag: "2025.1.2"
+  pullPolicy: IfNotPresent
+
+initContainers:
+  install-hass-openid:
+    image: docker.io/alpine/git:2.47.2
+    command:
+      - /bin/sh
+      - -c
+      - |
+        set -e
+        apk add --no-cache git
+
+        # Install hass-openid custom integration
+        mkdir -p /config/custom_components /config/includes
+        cd /tmp
+        git clone --depth 1 https://github.com/cavefire/hass-openid.git
+        cp -r hass-openid/custom_components/openid /config/custom_components/
+        rm -rf hass-openid
+
+        # Write MQTT addons config
+        printf 'mqtt:\n  broker: mqtt.kube.huskypup.net\n  port: 1883\n  username: homeassistant\n  password: YOUR_MQTT_PASSWORD' > /config/includes/ha-addons.yaml
+
+        # Write OIDC credentials to secrets.yaml (from mounted k8s secret)
+        if [ -f /oidc-secret/client_id ] && [ -f /oidc-secret/client_secret ]; then
+          CLIENT_ID=$(cat /oidc-secret/client_id)
+          CLIENT_SECRET=$(cat /oidc-secret/client_secret)
+          # Preserve existing secrets, update OIDC entries
+          if [ -f /config/secrets.yaml ]; then
+            sed -i '/^oidc_client_id:/d' /config/secrets.yaml
+            sed -i '/^oidc_client_secret:/d' /config/secrets.yaml
+          fi
+          echo "oidc_client_id: \"${CLIENT_ID}\"" >> /config/secrets.yaml
+          echo "oidc_client_secret: \"${CLIENT_SECRET}\"" >> /config/secrets.yaml
+          echo "OIDC credentials written to secrets.yaml"
+        else
+          echo "WARNING: OIDC secret not mounted, skipping secrets.yaml"
+        fi
+
+        # Ensure OIDC config is in configuration.yaml
+        if [ ! -f /config/configuration.yaml ]; then
+          echo "Creating configuration.yaml with OIDC config..."
+          cat > /config/configuration.yaml <<'OIDCEOF'
+        # Home Assistant Configuration
+        default_config:
+
+        # OIDC Authentication via Authentik
+        openid:
+          client_id: !secret oidc_client_id
+          client_secret: !secret oidc_client_secret
+          configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
+          scope: "openid profile email"
+          username_field: "preferred_username"
+          create_user: true
+          block_login: false
+        OIDCEOF
+        elif ! grep -q "^openid:" /config/configuration.yaml; then
+          echo "Appending OIDC config to existing configuration.yaml..."
+          cat >> /config/configuration.yaml <<'OIDCEOF'
+
+        # OIDC Authentication via Authentik
+        openid:
+          client_id: !secret oidc_client_id
+          client_secret: !secret oidc_client_secret
+          configure_url: "https://auth.kube.huskypup.net/application/o/home-assistant/.well-known/openid-configuration"
+          scope: "openid profile email"
+          username_field: "preferred_username"
+          create_user: true
+          block_login: false
+        OIDCEOF
+        else
+          echo "OIDC config already present in configuration.yaml"
+        fi
+    volumeMounts:
+      - name: config
+        mountPath: /config
+      - name: oidc-secret
+        mountPath: /oidc-secret
+        readOnly: true
+
+env:
+  TZ: America/New_York
+
+service:
+  main:
+    ports:
+      http:
+        port: 8123
+
+# Ingress disabled - Istio VirtualService handles routing
+ingress:
+  main:
+    enabled: false
+
+persistence:
+  config:
+    enabled: true
+    storageClass: rook-ceph-block
+    accessMode: ReadWriteOnce
+    size: 10Gi
+    retain: true
+  oidc-secret:
+    enabled: true
+    type: secret
+    name: homeassistant-oidc-secret
+    mountPath: /oidc-secret
+    readOnly: true
+
+securityContext:
+  privileged: false
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 512Mi
+  limits:
+    cpu: 1000m
+    memory: 2Gi
+
+probes:
+  liveness:
+    enabled: true
+  readiness:
+    enabled: true
+  startup:
+    enabled: true
+
+mariadb:
+  enabled: false
+
+postgresql:
+  enabled: false
+
+influxdb:
+  enabled: false
+
+metrics:
+  enabled: false