apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "home-assistant.fullname" . }} {{- if .Values.namespaceOverride }} namespace: {{ .Values.namespaceOverride }} {{- end }} annotations: version-source: github-release:home-assistant/core labels: {{- include "home-assistant.labels" . | nindent 4 }} spec: replicas: {{ .Values.replicaCount }} strategy: type: Recreate selector: matchLabels: {{- include "home-assistant.selectorLabels" . | nindent 6 }} template: metadata: labels: {{- include "home-assistant.selectorLabels" . | nindent 8 }} spec: {{- if .Values.hostNetwork }} hostNetwork: true dnsPolicy: ClusterFirstWithHostNet {{- end }} initContainers: - name: init-config image: busybox:latest command: - /bin/sh - -c - | # Clean up old log files from PVC rm -f /config/home-assistant.log /config/home-assistant.log.1 # Fix any corrupted \!include lines in configuration.yaml if [ -f /config/configuration.yaml ]; then sed -i 's/\\!/!/g' /config/configuration.yaml fi volumeMounts: - name: config mountPath: /config {{- if .Values.http.enabled }} # DEPRECATED: see http: comment in values.yaml. Removed once appVersion reaches 2027.7. - name: init-http image: busybox:latest env: - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP command: - /bin/sh - -c - | # Auto-detect pod and service CIDRs (zero last two octets for /16) SVC_CIDR=$(echo $KUBERNETES_SERVICE_HOST | sed -E 's/\.[0-9]+\.[0-9]+$/.0.0\/16/') POD_CIDR=$(echo $POD_IP | sed -E 's/\.[0-9]+\.[0-9]+$/.0.0\/16/') cat > /config/http.yaml << EOF server_port: {{ .Values.http.server_port }} ip_ban_enabled: {{ .Values.http.ip_ban_enabled }} login_attempts_threshold: {{ .Values.http.login_attempts_threshold }} use_x_forwarded_for: true trusted_proxies: - ${SVC_CIDR} - ${POD_CIDR} - 127.0.0.1 - "::1" {{- range .Values.http.extra_trusted_proxies }} - {{ . | quote }} {{- end }} EOF # Remove leading whitespace from heredoc sed -i 's/^ //' /config/http.yaml # Ensure configuration.yaml includes http.yaml if ! grep -q 'http.yaml' /config/configuration.yaml 2>/dev/null; then echo "" >> /config/configuration.yaml echo "http: !include http.yaml" >> /config/configuration.yaml fi volumeMounts: - name: config mountPath: /config {{- end }} {{- if .Values.haSecrets.enabled }} - name: init-secrets image: busybox:latest command: - /bin/sh - -c - | # Build secrets.yaml from mounted K8s secret echo "# Managed by Helm - do not edit manually" > /config/secrets.yaml for f in /ha-secrets/*; do key=$(basename "$f") val=$(cat "$f") echo "$key: \"$val\"" >> /config/secrets.yaml done volumeMounts: - name: config mountPath: /config - name: ha-secrets mountPath: /ha-secrets readOnly: true {{- end }} {{- if .Values.postgres.enabled }} - name: init-recorder image: busybox:latest command: - /bin/sh - -c - | # URL-encode password so special chars (/, @, :, #, ?, %, &, +) don't break the db_url ENCODED_PW=$(printf '%s' "$HA_POSTGRESQL_PASSWORD" | sed \ -e 's|%|%25|g' \ -e 's|/|%2F|g' \ -e 's|@|%40|g' \ -e 's|:|%3A|g' \ -e 's|#|%23|g' \ -e 's|?|%3F|g' \ -e 's|&|%26|g' \ -e 's|+|%2B|g' \ -e 's| |%20|g') # Build recorder.yaml with postgres connection string printf '%s\n' \ "db_url: \"postgresql://{{ .Values.postgres.user }}:${ENCODED_PW}@{{ .Values.postgres.host }}:{{ .Values.postgres.port }}/{{ .Values.postgres.db }}\"" \ "db_retry_wait: 15" \ "auto_purge: true" \ "purge_keep_days: {{ .Values.postgres.purgeKeepDays | default 30 }}" \ > /config/recorder.yaml # Ensure configuration.yaml includes recorder.yaml if ! grep -q 'recorder.yaml' /config/configuration.yaml 2>/dev/null; then echo "" >> /config/configuration.yaml echo "recorder: !include recorder.yaml" >> /config/configuration.yaml fi env: - name: HA_POSTGRESQL_PASSWORD valueFrom: secretKeyRef: name: {{ .Values.postgres.existingSecret }} key: {{ .Values.postgres.passwordKey }} volumeMounts: - name: config mountPath: /config {{- end }} containers: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} command: - /bin/sh - -c - | # Patch HA run script to disable file logging (logs go to stdout via s6) sed -i 's|exec python3 -m homeassistant --config /config|exec python3 -m homeassistant --config /config --log-file /dev/null|' /etc/services.d/home-assistant/run exec /init ports: - name: http containerPort: {{ .Values.http.server_port }} protocol: TCP {{- if .Values.homekit.enabled }} - name: homekit containerPort: {{ .Values.homekit.port }} protocol: TCP {{- end }} env: - name: TZ value: {{ .Values.timezone | quote }} volumeMounts: {{- if .Values.persistence.config.enabled }} - name: config mountPath: {{ .Values.persistence.config.mountPath }} {{- end }} {{- if .Values.persistence.media.enabled }} - name: media mountPath: {{ .Values.persistence.media.mountPath }} {{- end }} {{- if .Values.persistence.backups.enabled }} - name: backups mountPath: /config/backups subPath: homeassistant {{- end }} resources: {{- toYaml .Values.resources | nindent 12 }} volumes: {{- if .Values.persistence.config.enabled }} - name: config {{- if eq .Values.persistence.config.type "hostPath" }} hostPath: path: {{ .Values.persistence.config.hostPath }} type: DirectoryOrCreate {{- else }} persistentVolumeClaim: claimName: {{ .Values.persistence.config.existingClaim | default (include "home-assistant.fullname" .) }} {{- end }} {{- end }} {{- if .Values.persistence.media.enabled }} - name: media {{- if eq (.Values.persistence.media.type | default "hostPath") "hostPath" }} hostPath: path: {{ .Values.persistence.media.hostPath }} type: DirectoryOrCreate {{- else }} persistentVolumeClaim: claimName: {{ .Values.persistence.media.existingClaim | default (printf "%s-media" (include "home-assistant.fullname" .)) }} {{- end }} {{- end }} {{- if .Values.persistence.backups.enabled }} - name: backups persistentVolumeClaim: claimName: {{ .Values.persistence.backups.existingClaim | default (printf "%s-backups" (include "home-assistant.fullname" .)) }} {{- end }} {{- if .Values.haSecrets.enabled }} - name: ha-secrets secret: secretName: {{ .Values.haSecrets.existingSecret }} {{- end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }}