From 83e9c35f19da302a09bc01a46abbf0139f56b6ba Mon Sep 17 00:00:00 2001
From: sHa <sha@shadoll.dev>
Date: Wed, 18 Mar 2026 14:37:28 +0200
Subject: [PATCH] feat: Add support for HA secrets management with init
 container and configuration options

---
 home-assistant/templates/deployment.yaml | 30 +++++++++++++++++++++++-
 home-assistant/values.yaml               |  5 ++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/home-assistant/templates/deployment.yaml b/home-assistant/templates/deployment.yaml
index aa162d5..9a75ba1 100644
--- a/home-assistant/templates/deployment.yaml
+++ b/home-assistant/templates/deployment.yaml
@@ -25,8 +25,30 @@ spec:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
       {{- end }}
-      {{- if .Values.postgres.enabled }}
+      {{- if or .Values.postgres.enabled .Values.haSecrets.enabled }}
       initContainers:
+        {{- if .Values.haSecrets.enabled }}
+        - name: init-secrets
+          image: busybox:latest
+          command:
+            - /bin/sh
+            - -c
+            - |
+              # Build secrets.yaml from mounted K8s secret
+              echo "# Managed by Helm - do not edit manually" > /config/secrets.yaml
+              for f in /ha-secrets/*; do
+                key=$(basename "$f")
+                val=$(cat "$f")
+                echo "$key: \"$val\"" >> /config/secrets.yaml
+              done
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: ha-secrets
+              mountPath: /ha-secrets
+              readOnly: true
+        {{- end }}
+        {{- if .Values.postgres.enabled }}
         - name: init-recorder
           image: busybox:latest
           command:
@@ -55,6 +77,7 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config
+        {{- end }}
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}
@@ -101,6 +124,11 @@ spec:
             path: {{ .Values.persistence.media.hostPath }}
             type: DirectoryOrCreate
         {{- end }}
+        {{- if .Values.haSecrets.enabled }}
+        - name: ha-secrets
+          secret:
+            secretName: {{ .Values.haSecrets.existingSecret }}
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/home-assistant/values.yaml b/home-assistant/values.yaml
index 24f66f0..798c42c 100644
--- a/home-assistant/values.yaml
+++ b/home-assistant/values.yaml
@@ -60,6 +60,11 @@ persistence:
     hostPath: /srv/data/home-assistant/media
     mountPath: /media
 
+haSecrets:
+  enabled: false
+  # K8s Secret containing key-value pairs to write as /config/secrets.yaml
+  existingSecret: ""
+
 postgres:
   enabled: false
   host: postgres-tcp.postgres.svc.cluster.local