From 0efe6162887d497bb0299e9920a43072e3ec8448 Mon Sep 17 00:00:00 2001
From: Konstantin Renner <konstantin@renner.uno>
Date: Tue, 5 May 2026 18:23:40 +0200
Subject: [PATCH] home-assistant: patch core.config_entries for InfluxDB, not
 yaml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HA writes to InfluxDB via the HACS community integration, which is a
UI-config integration stored in `.storage/core.config_entries` with
`domain: "influxdb"` — not the built-in yaml `influxdb:` block I was
patching in configuration.yaml. The `core.config_entries` entry has
`url`/`token`/`bucket`/`organization`/`api_version`/`verify_ssl`/
`ssl_ca_cert` (and was pointed at the legacy
`http://influxdb.srv.renner.uno:8086` with the legacy
"Write buckets home_assistant" token).

Replace the configuration.yaml yq-patch with a reconcile_entry call
matching the existing pattern used for matter / otbr / zwave_js /
wyoming. Shallow-merge preserves ssl_ca_cert and any other HA-managed
fields. api_version is a string here ("2"), matching the shape HA
serializes in core.config_entries.
---
 .../apps/home-assistant/deployment.yaml       | 56 +++++++------------
 1 file changed, 19 insertions(+), 37 deletions(-)

diff --git a/kubernetes/apps/home-assistant/deployment.yaml b/kubernetes/apps/home-assistant/deployment.yaml
index 326f09c1..643cfee4 100644
--- a/kubernetes/apps/home-assistant/deployment.yaml
+++ b/kubernetes/apps/home-assistant/deployment.yaml
@@ -430,44 +430,26 @@ spec:
                   fi
                 fi
 
-                # InfluxDB recorder reconcile. Top-level `influxdb:`
-                # block in configuration.yaml gets repointed at the
-                # in-cluster InfluxDB. Skipped when INFLUX_TOKEN is
-                # empty (Job in influxdb namespace hasn't populated
-                # the cross-namespace Secret yet). Once the token
-                # appears, the next loop iteration patches and
-                # self-deletes the pod for a clean rollover. Only the
-                # connection+auth keys are touched; HA-managed
-                # include/exclude/tags filters are left intact.
+                # InfluxDB integration (HACS / UI-config; stored in
+                # core.config_entries with domain "influxdb"). Repoint
+                # the legacy http://influxdb.srv.renner.uno:8086 URL +
+                # legacy write-bucket token at the in-cluster
+                # InfluxDB. Token comes from the ha-influxdb-token
+                # Secret created cross-namespace by the
+                # influxdb-ha-token Job; skipped when INFLUX_TOKEN is
+                # empty (Secret not yet populated). Shallow-merge via
+                # reconcile_entry preserves any HA-managed fields
+                # (e.g. ssl_ca_cert).
                 if [ -n "${INFLUX_TOKEN:-}" ]; then
-                  desired_influx=$(jq -ncS \
-                    --arg token "$INFLUX_TOKEN" \
-                    '{api_version: 2,
-                      host: "influxdb-influxdb2.influxdb.svc.cluster.local",
-                      port: 8086,
-                      ssl: false,
-                      verify_ssl: false,
-                      organization: "renner",
-                      bucket: "suedstr28",
-                      token: $token}')
-                  current_influx=$(yq -o=json '.influxdb // {}' "$CONFIG" 2>/dev/null \
-                    | jq -cS --argjson d "$desired_influx" \
-                        'with_entries(select(.key as $k | $d | has($k)))' \
-                    || echo '{}')
-                  if [ "$desired_influx" != "$current_influx" ]; then
-                    echo "influxdb config drift; patching"
-                    yq -i '
-                      .influxdb.api_version = 2 |
-                      .influxdb.host = "influxdb-influxdb2.influxdb.svc.cluster.local" |
-                      .influxdb.port = 8086 |
-                      .influxdb.ssl = false |
-                      .influxdb.verify_ssl = false |
-                      .influxdb.organization = "renner" |
-                      .influxdb.bucket = "suedstr28" |
-                      .influxdb.token = strenv(INFLUX_TOKEN)
-                    ' "$CONFIG"
-                    drift=1
-                  fi
+                  reconcile_entry '.domain=="influxdb"' \
+                    "$(jq -ncS --arg t "$INFLUX_TOKEN" '{
+                        url: "http://influxdb-influxdb2.influxdb.svc.cluster.local:8086",
+                        token: $t,
+                        bucket: "suedstr28",
+                        organization: "renner",
+                        api_version: "2",
+                        verify_ssl: false}')" \
+                    "influxdb"
                 fi
 
                 # Sibling-app integrations: HAOS supervisor addon names