mirror of
https://github.com/shadoll/helm-charts.git
synced 2026-08-28 11:33:17 +00:00
shaandClaude Sonnet 5
c66bac4714
HA core has migrated the http: config (server_port, ip_ban_enabled, login_attempts_threshold, use_x_forwarded_for, trusted_proxies) out of configuration.yaml, causing "already been migrated and is now being ignored" warnings. Disable http.enabled by default on home-assistant-dev, mark the section deprecated in both charts, and document removal planned for appVersion 2027.7. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
230 lines
8.7 KiB
YAML
230 lines
8.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "home-assistant.fullname" . }}
|
|
{{- if .Values.namespaceOverride }}
|
|
namespace: {{ .Values.namespaceOverride }}
|
|
{{- end }}
|
|
annotations:
|
|
version-source: github-release:home-assistant/core
|
|
labels:
|
|
{{- include "home-assistant.labels" . | nindent 4 }}
|
|
spec:
|
|
replicas: {{ .Values.replicaCount }}
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
{{- include "home-assistant.selectorLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "home-assistant.selectorLabels" . | nindent 8 }}
|
|
spec:
|
|
{{- if .Values.hostNetwork }}
|
|
hostNetwork: true
|
|
dnsPolicy: ClusterFirstWithHostNet
|
|
{{- end }}
|
|
initContainers:
|
|
- name: init-config
|
|
image: busybox:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
# Clean up old log files from PVC
|
|
rm -f /config/home-assistant.log /config/home-assistant.log.1
|
|
# Fix any corrupted \!include lines in configuration.yaml
|
|
if [ -f /config/configuration.yaml ]; then
|
|
sed -i 's/\\!/!/g' /config/configuration.yaml
|
|
fi
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config
|
|
{{- if .Values.http.enabled }}
|
|
# DEPRECATED: see http: comment in values.yaml. Removed once appVersion reaches 2027.7.
|
|
- name: init-http
|
|
image: busybox:latest
|
|
env:
|
|
- name: POD_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
# Auto-detect pod and service CIDRs (zero last two octets for /16)
|
|
SVC_CIDR=$(echo $KUBERNETES_SERVICE_HOST | sed -E 's/\.[0-9]+\.[0-9]+$/.0.0\/16/')
|
|
POD_CIDR=$(echo $POD_IP | sed -E 's/\.[0-9]+\.[0-9]+$/.0.0\/16/')
|
|
cat > /config/http.yaml << EOF
|
|
server_port: {{ .Values.http.server_port }}
|
|
ip_ban_enabled: {{ .Values.http.ip_ban_enabled }}
|
|
login_attempts_threshold: {{ .Values.http.login_attempts_threshold }}
|
|
use_x_forwarded_for: true
|
|
trusted_proxies:
|
|
- ${SVC_CIDR}
|
|
- ${POD_CIDR}
|
|
- 127.0.0.1
|
|
- "::1"
|
|
{{- range .Values.http.extra_trusted_proxies }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
EOF
|
|
# Remove leading whitespace from heredoc
|
|
sed -i 's/^ //' /config/http.yaml
|
|
# Ensure configuration.yaml includes http.yaml
|
|
if ! grep -q 'http.yaml' /config/configuration.yaml 2>/dev/null; then
|
|
echo "" >> /config/configuration.yaml
|
|
echo "http: !include http.yaml" >> /config/configuration.yaml
|
|
fi
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config
|
|
{{- end }}
|
|
{{- if .Values.haSecrets.enabled }}
|
|
- name: init-secrets
|
|
image: busybox:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
# Build secrets.yaml from mounted K8s secret
|
|
echo "# Managed by Helm - do not edit manually" > /config/secrets.yaml
|
|
for f in /ha-secrets/*; do
|
|
key=$(basename "$f")
|
|
val=$(cat "$f")
|
|
echo "$key: \"$val\"" >> /config/secrets.yaml
|
|
done
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config
|
|
- name: ha-secrets
|
|
mountPath: /ha-secrets
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.postgres.enabled }}
|
|
- name: init-recorder
|
|
image: busybox:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
# URL-encode password so special chars (/, @, :, #, ?, %, &, +) don't break the db_url
|
|
ENCODED_PW=$(printf '%s' "$HA_POSTGRESQL_PASSWORD" | sed \
|
|
-e 's|%|%25|g' \
|
|
-e 's|/|%2F|g' \
|
|
-e 's|@|%40|g' \
|
|
-e 's|:|%3A|g' \
|
|
-e 's|#|%23|g' \
|
|
-e 's|?|%3F|g' \
|
|
-e 's|&|%26|g' \
|
|
-e 's|+|%2B|g' \
|
|
-e 's| |%20|g')
|
|
# Build recorder.yaml with postgres connection string
|
|
printf '%s\n' \
|
|
"db_url: \"postgresql://{{ .Values.postgres.user }}:${ENCODED_PW}@{{ .Values.postgres.host }}:{{ .Values.postgres.port }}/{{ .Values.postgres.db }}\"" \
|
|
"db_retry_wait: 15" \
|
|
"auto_purge: true" \
|
|
"purge_keep_days: {{ .Values.postgres.purgeKeepDays | default 30 }}" \
|
|
> /config/recorder.yaml
|
|
# Ensure configuration.yaml includes recorder.yaml
|
|
if ! grep -q 'recorder.yaml' /config/configuration.yaml 2>/dev/null; then
|
|
echo "" >> /config/configuration.yaml
|
|
echo "recorder: !include recorder.yaml" >> /config/configuration.yaml
|
|
fi
|
|
env:
|
|
- name: HA_POSTGRESQL_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.postgres.existingSecret }}
|
|
key: {{ .Values.postgres.passwordKey }}
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config
|
|
{{- end }}
|
|
containers:
|
|
- name: {{ .Chart.Name }}
|
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
# Patch HA run script to disable file logging (logs go to stdout via s6)
|
|
sed -i 's|exec python3 -m homeassistant --config /config|exec python3 -m homeassistant --config /config --log-file /dev/null|' /etc/services.d/home-assistant/run
|
|
exec /init
|
|
ports:
|
|
- name: http
|
|
containerPort: {{ .Values.http.server_port }}
|
|
protocol: TCP
|
|
{{- if .Values.homekit.enabled }}
|
|
- name: homekit
|
|
containerPort: {{ .Values.homekit.port }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
env:
|
|
- name: TZ
|
|
value: {{ .Values.timezone | quote }}
|
|
volumeMounts:
|
|
{{- if .Values.persistence.config.enabled }}
|
|
- name: config
|
|
mountPath: {{ .Values.persistence.config.mountPath }}
|
|
{{- end }}
|
|
{{- if .Values.persistence.media.enabled }}
|
|
- name: media
|
|
mountPath: {{ .Values.persistence.media.mountPath }}
|
|
{{- end }}
|
|
{{- if .Values.persistence.backups.enabled }}
|
|
- name: backups
|
|
mountPath: /config/backups
|
|
subPath: homeassistant
|
|
{{- end }}
|
|
resources:
|
|
{{- toYaml .Values.resources | nindent 12 }}
|
|
volumes:
|
|
{{- if .Values.persistence.config.enabled }}
|
|
- name: config
|
|
{{- if eq .Values.persistence.config.type "hostPath" }}
|
|
hostPath:
|
|
path: {{ .Values.persistence.config.hostPath }}
|
|
type: DirectoryOrCreate
|
|
{{- else }}
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Values.persistence.config.existingClaim | default (include "home-assistant.fullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.persistence.media.enabled }}
|
|
- name: media
|
|
{{- if eq (.Values.persistence.media.type | default "hostPath") "hostPath" }}
|
|
hostPath:
|
|
path: {{ .Values.persistence.media.hostPath }}
|
|
type: DirectoryOrCreate
|
|
{{- else }}
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Values.persistence.media.existingClaim | default (printf "%s-media" (include "home-assistant.fullname" .)) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.persistence.backups.enabled }}
|
|
- name: backups
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Values.persistence.backups.existingClaim | default (printf "%s-backups" (include "home-assistant.fullname" .)) }}
|
|
{{- end }}
|
|
{{- if .Values.haSecrets.enabled }}
|
|
- name: ha-secrets
|
|
secret:
|
|
secretName: {{ .Values.haSecrets.existingSecret }}
|
|
{{- end }}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|