feat: Add persistent volume claim support for backups and update Helm chart version

2026-08-28 03:27:08 +00:00 · 2026-03-24 21:53:39 +02:00
parent 6b12ea1dc7
commit c567e1908e
6 changed files with 202 additions and 4 deletions
@@ -0,0 +1,116 @@
+# Home Assistant Helm Chart — Issues & Improvements
+
+## Defaults & Best Practices
+
+- [ ] **`hostNetwork: true` should default to `false`**
+  `hostNetwork` is only needed for HomeKit/mDNS discovery on the LAN. A clean install should not claim the host network by default. Users who need it can opt in via values.
+  File: `values.yaml` line 12, `deployment.yaml` lines 24-27
+
+- [ ] **HomeKit should default to disabled**
+  HomeKit is a specific integration, not a core feature. Default `homekit.enabled: false` and let users enable it when needed. Currently exposes port 21063 on every install.
+  File: `values.yaml` lines 16-18, `deployment.yaml` lines 105-109
+
+- [ ] **Timezone should default to `UTC`**
+  Currently hardcoded to `Europe/Kyiv`. Chart defaults should be locale-neutral. Users override via values for their deployment.
+  File: `values.yaml` line 14
+
+- [ ] **Resource limits too high for default**
+  CPU limit of 8 cores is excessive for a default install. Consider `cpu: 2` / `memory: 2Gi` as default limits, with `cpu: 100m` / `memory: 256Mi` as requests. Production users can increase as needed.
+  File: `values.yaml` lines 40-46
+
+- [ ] **`imagePullPolicy: Always` should be `IfNotPresent`**
+  For tagged images (not `latest`), `IfNotPresent` is the Kubernetes convention. `Always` causes unnecessary image pulls on every pod restart.
+  File: `values.yaml` line 5, `deployment.yaml` line 93
+
+## Security
+
+- [ ] **No `securityContext` defined**
+  The deployment has no pod or container security context. Should add at minimum:
+  ```yaml
+  securityContext:
+    runAsNonRoot: false  # HA needs root for s6 init
+    # But container-level:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: [ALL]
+      add: [NET_BIND_SERVICE]  # if needed for homekit
+  ```
+  Note: Home Assistant uses s6-overlay which requires root. Full non-root may not be feasible, but `capabilities` should still be restricted.
+  File: `deployment.yaml`
+
+- [ ] **No `ServiceAccount` created**
+  Chart should create a dedicated ServiceAccount with `automountServiceAccountToken: false` (HA doesn't need Kubernetes API access). This follows the principle of least privilege.
+  Files: new `templates/serviceaccount.yaml`, `deployment.yaml`
+
+## Reliability
+
+- [ ] **No liveness/readiness probes**
+  HA exposes HTTP on port 8123. The chart should define probes:
+  ```yaml
+  livenessProbe:
+    httpGet:
+      path: /
+      port: 8123
+    initialDelaySeconds: 60
+    periodSeconds: 30
+    failureThreshold: 5
+  readinessProbe:
+    httpGet:
+      path: /
+      port: 8123
+    initialDelaySeconds: 30
+    periodSeconds: 10
+  ```
+  `initialDelaySeconds` should be generous — HA can take 30-90s to start depending on integrations. Consider making these configurable via values.
+  File: `deployment.yaml`
+
+## Code Quality
+
+- [ ] **`busybox:latest` in init containers**
+  Init containers (`init-config`, `init-secrets`, `init-recorder`) use `busybox:latest` which is unpinned and not reproducible. Pin to a specific version, e.g. `busybox:1.37` and make it configurable via values.
+  File: `deployment.yaml` lines 31, 43, 63
+
+- [ ] **`version-source` annotation in deployment template**
+  The `version-source: github-release:home-assistant/core` annotation is for the `just app` CLI tooling in the k3s repo, not a chart concern. Should be removed from the template and added via HelmRelease annotations or values.
+  File: `deployment.yaml` lines 8-9
+
+## Future Enhancements
+
+- [ ] **Auto-generate `http.yaml` from chart values**
+  Same pattern as the recorder init container — generate `/config/http.yaml` and add `http: !include http.yaml` to `configuration.yaml`. This simplifies initial setup since `trusted_proxies` is required for Traefik/ingress to work and the values can be derived from the Kubernetes environment.
+  Generated file example:
+  ```yaml
+  server_port: 8123
+  use_x_forwarded_for: true
+  trusted_proxies:
+    - 10.42.0.0/16   # k8s pod CIDR (Traefik)
+    - 10.43.0.0/16   # k8s service CIDR
+  ```
+  Values structure:
+  ```yaml
+  http:
+    enabled: false
+    port: 8123
+    useXForwardedFor: true
+    trustedProxies: []
+      # - 10.42.0.0/16
+      # - 10.43.0.0/16
+  ```
+  File: `values.yaml`, `deployment.yaml` (new init container)
+
+- [ ] **S3 backup support**
+  Add optional S3 sync as a post-backup step in the CronJob. Write locally to PVC first (fast restore), then push to S3 for disaster recovery. Values structure:
+  ```yaml
+  backup:
+    s3:
+      enabled: false
+      endpoint: ""
+      bucket: ""
+      existingSecret: ""
+  ```
+
+- [ ] **NOTES.txt for post-install instructions**
+  Add `templates/NOTES.txt` to display useful info after install (URLs, first-time setup steps, how to access HA).
+
+- [ ] **Support `topologySpreadConstraints`**
+  For multi-node clusters, allow configuring topology spread via values (though HA is typically single-replica).