feat(mqtt): HiluX DS8 unit 12 on its own account, one unit first (REN-1017)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.woodpecker/ci-manifests-test.yml

@@ -199,7 +199,7 @@ steps:
   # separately rather than one this step quietly implies is covered.
   - name: shellcheck
     depends_on: [] # see note above `steps:`
-    image: koalaman/shellcheck-alpine:v0.11.0
+    image: koalaman/shellcheck-alpine:v0.11.0@sha256:9955be09ea7f0dbf7ae942ac1f2094355bb30d96fffba0ec09f5432207544002
     commands:
       - |
         set -eu
@@ -319,7 +319,7 @@ steps:
   # writes its stripped mirror under mktemp and never into the workspace.
   - name: promtool
     depends_on: [] # see note above `steps:`
-    image: prom/prometheus:v3.15.0
+    image: prom/prometheus:v3.15.0@sha256:efd719c99d83b060d9daefdcf00360461adf279f45ef5391f8d111892118753e
     commands:
       - sh scripts/ci/promtool-rules.sh
 

.woodpecker/security-scan.yml

@@ -18,12 +18,12 @@ when:
 
 steps:
   - name: iac-scan
-    image: aquasec/trivy:latest
+    image: aquasec/trivy:latest@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa
     commands:
       - trivy fs --format json -o trivy-iac.json --severity CRITICAL,HIGH --ignore-unfixed .
 
   - name: image-scans
-    image: aquasec/trivy:latest
+    image: aquasec/trivy:latest@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa
     commands:
       - trivy image --download-db-only
       - |

kubernetes/apps/gitea/statefulset.yaml

@@ -37,7 +37,7 @@ spec:
           # both handled as explicit steps in MIGRATION-gitea-woodpecker.md. Pinned
           # to match the LXC for a clean SQLite lift; no imagepolicy marker (an
           # auto-bump across versions on live SQLite data must never be applied).
-          image: gitea/gitea:1.21.4-rootless
+          image: gitea/gitea:1.21.4-rootless@sha256:600f1f1e1d090c763866db16882b5eac5c6a80b7664ee53bec0806c656c0033f
           env:
             - name: GITEA_WORK_DIR
               value: /var/lib/gitea

kubernetes/apps/home-assistant/deployment.yaml

@@ -253,7 +253,7 @@ spec:
         # in the PVC's remote URL; reload auth uses a dedicated long-lived token.
         # Runs as root to match HA's root-owned /config files. See config-sync.sh.
         - name: config-sync
-          image: alpine/git:2.54.0
+          image: alpine/git:2.54.0@sha256:a4bb51f1a3553df194ce679fc1db721d8bfba2046fa1a88fe9d4ac551ffbce25
           command: ["/bin/sh", "/scripts/sync.sh"]
           env:
             - name: SYNC_BRANCH

kubernetes/apps/home-assistant/mqtt-account-controller.yaml

@@ -47,8 +47,8 @@ subjects:
 ---
 # Per deliver.namespace: manage the account Certificates there (server-side
 # apply = patch, which creates through `create`). One Role + RoleBinding per
-# namespace that appears as `deliver.namespace` in the register: home-assistant
-# and evcc.
+# namespace that appears as `deliver.namespace` in the register: home-assistant,
+# evcc and paperclip.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -103,6 +103,7 @@ rules:
       - mqtt-test-cert-tls
       - mqtt-mosquitto-probe-tls
       - mqtt-zigbee2mqtt-bridge-tls
+      - mqtt-home-assistant-tls
     verbs: ["delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -156,6 +157,41 @@ subjects:
     name: mqtt-account-controller
     namespace: home-assistant
 ---
+# deliver.namespace paperclip (account agents-read): its Certificate, and its
+# Secret by name for revocation.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: mqtt-account-controller-certificates
+  namespace: paperclip
+  labels:
+    app.kubernetes.io/name: mqtt-account-controller
+rules:
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["get", "create", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames:
+      - mqtt-agents-read-tls
+    verbs: ["delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: mqtt-account-controller-certificates
+  namespace: paperclip
+  labels:
+    app.kubernetes.io/name: mqtt-account-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: mqtt-account-controller-certificates
+subjects:
+  - kind: ServiceAccount
+    name: mqtt-account-controller
+    namespace: home-assistant
+---
 # The controller's own MQTT identity: CN = Dynamic Security admin client
 # (ADMIN_USER). Not labelled managed-by, so the controller never treats it
 # as an account certificate and never revokes it. Re-read on every TLS
@@ -187,6 +223,10 @@ metadata:
   namespace: home-assistant
   labels:
     app.kubernetes.io/name: mqtt-account-controller
+  annotations:
+    # The controller reads the shelly-manager API key once at start; the
+    # quarterly rotation of shelly-manager-auth must restart it too.
+    secret.reloader.stakater.com/reload: shelly-manager-auth
 spec:
   replicas: 1
   # One writer at a time: two controllers would race on rotations and the
@@ -212,10 +252,17 @@ spec:
         - name: controller
           # Woodpecker builds main-<sha> on every merge to main; no sortable
           # tag, so bumps are manual (same as ical-proxy).
-          image: gitea.renner.uno/konairius/mqtt-account-controller:main-b3d5cbb
+          image: gitea.renner.uno/konairius/mqtt-account-controller:main-a307693@sha256:4f58b900783148ad043201b1d787f0914e9c17ba011a88d23b6e68223b6bab74
           env:
             - name: BROKER_URL
               value: ssl://mosquitto.home-assistant.svc.cluster.local:8884
+            # Password push to Shellies (accounts with deliver.shelly-manager).
+            # The API-key-only Service (api-proxy sidecar, :8081), like the
+            # agents; same namespace, so the default-deny allows it.
+            - name: SHELLY_MANAGER_URL
+              value: http://shelly-manager-api.home-assistant.svc.cluster.local
+            - name: SHELLY_MANAGER_API_KEY_FILE
+              value: /etc/shelly-manager/api-key
             # Not :8080: several :8080 ingress grants in the home-assistant
             # default-deny apply to every pod in the namespace.
             - name: LISTEN
@@ -243,6 +290,9 @@ spec:
             - name: tls
               mountPath: /etc/mqtt-tls
               readOnly: true
+            - name: shelly-manager-key
+              mountPath: /etc/shelly-manager
+              readOnly: true
           resources:
             requests:
               cpu: 5m
@@ -258,3 +308,10 @@ spec:
         - name: tls
           secret:
             secretName: mqtt-account-controller-tls
+        # Only the api-key item, not the shelly-manager admin password.
+        - name: shelly-manager-key
+          secret:
+            secretName: shelly-manager-auth
+            items:
+              - key: api-key
+                path: api-key

kubernetes/apps/home-assistant/mqtt-accounts.yaml

@@ -41,3 +41,129 @@
   auth: cert
   deliver: {namespace: evcc}
   acl: ["read open3e/#", "readwrite evcc/#", "read energy/#"]
+# Home Assistant, via the ghostunnel sidecar `mqtt-tls` in its pod (HA keeps
+# client certificates only as uploaded PEMs in its config entry, so a renewal
+# could not reach it without a reconfigure). Same ACL as the legacy user
+# `homeassistant`; not named like it, so it cannot shadow that login (REN-953).
+- name: home-assistant
+  auth: cert
+  deliver: {namespace: home-assistant}
+  acl: ["readwrite #"]
+# Read-only account for agents (REN-953). One account for all of them: the
+# agents share sandboxes, so per-agent separation would be nominal. The
+# Secret lands in `paperclip`; agents fetch it per run with their kubectl
+# identity (Role mqtt-agents-read in apps/paperclip/agent-kubectl-rbac.yaml),
+# so a renewal needs no restart. Network path: agent sandbox pods ->
+# mosquitto :8884 only.
+- name: agents-read
+  auth: cert
+  deliver: {namespace: paperclip}
+  acl: ["read open3e/#", "read zigbee2mqtt/#", "read homeassistant/#"]
+# Shellies (REN-1017): one password account per device, pushed by the
+# controller through shelly-manager's per-device API. Name shelly-<id> =
+# shelly-manager device id. Same ACL as the legacy user `shellies`, which
+# keeps working until every device has moved. Gen2+ devices reboot once
+# when their password is pushed.
+- name: shelly-5               # Plus i4, the API test device of REN-929
+  auth: password
+  deliver: {shelly-manager: 5}
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+# Only devices that log in as `shellies` today. A device with MQTT off never
+# reports connected, so the controller would push (and reboot it) again
+# every ROTATE_GRACE.
+- name: shelly-6
+  auth: password
+  deliver: {shelly-manager: 6}  # Plus i4 90380c3808b8
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-29
+  auth: password
+  deliver: {shelly-manager: 29}  # Plus i4 b8d61a8c7f24
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-3
+  auth: password
+  deliver: {shelly-manager: 3}  # Pro 3EM ac15186d43c0
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-42
+  auth: password
+  deliver: {shelly-manager: 42}  # 3EM-63 G3 d885ac1c5ab4
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-43
+  auth: password
+  deliver: {shelly-manager: 43}  # 3EM-63 G3 d885ac1ab274
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-10
+  auth: password
+  deliver: {shelly-manager: 10}  # Plug S Gen1 4382e5
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-22
+  auth: password
+  deliver: {shelly-manager: 22}  # Plug S Gen1 87e961
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-25
+  auth: password
+  deliver: {shelly-manager: 25}  # Plug S Gen1 1c1a8f
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-15
+  auth: password
+  deliver: {shelly-manager: 15}  # Plug S G3 8cbfea910578
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-16
+  auth: password
+  deliver: {shelly-manager: 16}  # Plug S G3 b08184a63ef0
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-14
+  auth: password
+  deliver: {shelly-manager: 14}  # Plus 1PM Mini 348518e0be40
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-27
+  auth: password
+  deliver: {shelly-manager: 27}  # Plus 1PM Mini 348518e06c04
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-13
+  auth: password
+  deliver: {shelly-manager: 13}  # Plus 2PM 48551997e624
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-19
+  auth: password
+  deliver: {shelly-manager: 19}  # Plus 2PM 48551999a790
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-21
+  auth: password
+  deliver: {shelly-manager: 21}  # Plus 2PM 0cdc7efa8d00
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-34
+  auth: password
+  deliver: {shelly-manager: 34}  # Plus 2PM 3ce90e2f2d7c
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-2
+  auth: password
+  deliver: {shelly-manager: 2}  # Wall Display 00082266e106
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-26
+  auth: password
+  deliver: {shelly-manager: 26}  # Power Strip G4 206ef102a6cc
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-1
+  auth: password
+  deliver: {shelly-manager: 1}  # Pro 4PM 9454c5b9c954
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-4
+  auth: password
+  deliver: {shelly-manager: 4}  # Pro 4PM ac15186ca578
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-32
+  auth: password
+  deliver: {shelly-manager: 32}  # Pro 4PM 30c6f7834ec4
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+- name: shelly-33
+  auth: password
+  deliver: {shelly-manager: 33}  # Pro 3 fce8c0db5f28
+  acl: ["readwrite shellies/#", "write homeassistant/#"]
+# HiluX DS8: HA drives them over MQTT only, and their firmware can hang in
+# the MQTT reconnect path until a power cycle (wiki
+# shelly-hilux-ds8-mqtt-reconnect-hang-bug). One unit at a time; 12 is a
+# bathroom mesh receiver, so its wall switch works without MQTT.
+- name: shelly-12
+  auth: password
+  deliver: {shelly-manager: 12}  # HiluX DS8 34b7da890cfc, Bad Spiegel Rechts
+  acl: ["readwrite shellies/#", "write homeassistant/#"]

kubernetes/apps/home-assistant/shelly-manager-deployment.yaml

@@ -61,7 +61,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/k.renner/shelly-manager:build.1791337222 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/k.renner/shelly-manager:build.1791365067 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

kubernetes/apps/llama-server/deployment.yaml

@@ -54,7 +54,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: llama-server
-          image: ghcr.io/ggml-org/llama.cpp:server-vulkan-b10731
+          image: ghcr.io/ggml-org/llama.cpp:server-vulkan-b10731@sha256:0262343f64f030e8efff15ec05ee8180b69b7f6745de2caa3af5148e0dcb8aba
           args:
             # The one place this model is named; llama-server resolves the repo
             # and downloads it itself, so there is nothing to keep in sync.

kubernetes/apps/llama-server/embed.yaml

@@ -43,7 +43,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: llama-embed
-          image: ghcr.io/ggml-org/llama.cpp:server-vulkan-b10731
+          image: ghcr.io/ggml-org/llama.cpp:server-vulkan-b10731@sha256:0262343f64f030e8efff15ec05ee8180b69b7f6745de2caa3af5148e0dcb8aba
           args:
             - --hf-repo
             - gpustack/bge-m3-GGUF:Q8_0

kubernetes/apps/llama-server/wiki-embed.yaml

@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: wiki-embed
-          image: ghcr.io/ggml-org/llama.cpp:server-vulkan-b10731
+          image: ghcr.io/ggml-org/llama.cpp:server-vulkan-b10731@sha256:0262343f64f030e8efff15ec05ee8180b69b7f6745de2caa3af5148e0dcb8aba
           args:
             - --hf-repo
             - gpustack/bge-m3-GGUF:Q8_0

kubernetes/apps/matrix/element.yaml

@@ -72,7 +72,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: element-web
-          image: ghcr.io/element-hq/element-web:v1.12.30
+          image: ghcr.io/element-hq/element-web:v1.12.30@sha256:3e7dbd4424de9e11c812bc740acf2725b2abe66ea0d0802023b56fd85d3fa09a
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

kubernetes/apps/matrix/mas.yaml

@@ -137,7 +137,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.26.0
+          image: ghcr.io/element-hq/matrix-authentication-service:1.26.0@sha256:e089f1048a1d4a9a492ed17b9fe759100f1bd619407b001f5927928d88b780c4
           # The server applies database migrations and syncs the upstream
           # providers from the config on start.
           args: ["server", "--config", "/config/config.yaml"]

kubernetes/apps/matrix/synapse.yaml

@@ -152,7 +152,7 @@ spec:
         # first. The marker on the data PVC makes later starts skip it.
         # Debug image: the plain one has no shell for the marker check.
         - name: migrate-to-mas
-          image: ghcr.io/element-hq/matrix-authentication-service:1.26.0-debug
+          image: ghcr.io/element-hq/matrix-authentication-service:1.26.0-debug@sha256:46f7480f5ea4243ccb6fd2c447ea859e0230c8b3c0e676ee285d4ae6ca344ee3
           command:
             - /busybox/sh
             - -ec
@@ -207,7 +207,7 @@ spec:
               mountPath: /data
       containers:
         - name: synapse
-          image: ghcr.io/element-hq/synapse:v1.162.0
+          image: ghcr.io/element-hq/synapse:v1.162.0@sha256:6b84a7bbac36f080b2d2e51e0289cf1b08b349598ea44a558df38d558f2c2311
           # Bypass /start.py: it expects to run as root and template a config
           # from env. Default mode is generate-missing-and-run, which creates
           # the signing key on first start.

kubernetes/apps/monitoring/smartctl-exporter.yaml

@@ -27,7 +27,7 @@ spec:
           effect: NoSchedule
       containers:
         - name: smartctl-exporter
-          image: quay.io/prometheuscommunity/smartctl-exporter:v0.14.0
+          image: quay.io/prometheuscommunity/smartctl-exporter:v0.14.0@sha256:cfe22c36d7d2fac48ebf619707305acb65eb0fb670656eb80f356e606d782bc1
           # No --smartctl.device: the exporter scans and rescans on its own.
           # Device names are not stable across these machines.
           args:

kubernetes/apps/navidrome/lidarr.yaml

@@ -93,7 +93,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: lidarr
-          image: lscr.io/linuxserver/lidarr:3.1.0.4875-ls42 # {"$imagepolicy": "flux-system:lidarr"}
+          image: lscr.io/linuxserver/lidarr:3.1.0.4875-ls43 # {"$imagepolicy": "flux-system:lidarr"}
           env:
             - name: PUID
               value: "1000"
@@ -140,7 +140,7 @@ spec:
               drop: ["ALL"]
               add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
         - name: reconcile
-          image: lscr.io/linuxserver/lidarr:3.1.0.4875-ls42 # {"$imagepolicy": "flux-system:lidarr"}
+          image: lscr.io/linuxserver/lidarr:3.1.0.4875-ls43 # {"$imagepolicy": "flux-system:lidarr"}
           command: ["sh", "/scripts/reconcile.sh"]
           volumeMounts:
             - name: config

kubernetes/apps/otbr/deployment.yaml

@@ -48,7 +48,7 @@ spec:
         #
         # Hence socat is installed at startup and run inside this container.
         - name: otbr
-          image: openthread/otbr:latest
+          image: openthread/otbr:latest@sha256:49b352ce39dd6514b486af7397356c5cf07ed3f090a48ca3006cb72ec45a46f8
           command:
             - bash
             - -c

kubernetes/apps/paperclip/agent-kubectl-rbac.yaml

@@ -212,3 +212,47 @@ subjects:
   - kind: ServiceAccount
     name: agent-hermes
     namespace: paperclip
+---
+# MQTT read access for agents (REN-953): `get` on the one Secret that holds
+# the agents-read client certificate (issued by mqtt-account-controller,
+# renewed by cert-manager). Agents fetch it per run, so a renewal needs no
+# restart. The certificate can only read open3e/#, zigbee2mqtt/# and
+# homeassistant/# on the broker (register mqtt-accounts.yaml). Hermes is not
+# bound: it issues kubeconfigs and has no MQTT task.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: mqtt-agents-read
+  namespace: paperclip
+  labels:
+    app.kubernetes.io/name: paperclip
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: ["mqtt-agents-read-tls"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: mqtt-agents-read
+  namespace: paperclip
+  labels:
+    app.kubernetes.io/name: paperclip
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: mqtt-agents-read
+subjects:
+  - kind: ServiceAccount
+    name: agent-atlas
+    namespace: paperclip
+  - kind: ServiceAccount
+    name: agent-iris
+    namespace: paperclip
+  - kind: ServiceAccount
+    name: agent-hestia
+    namespace: paperclip
+  - kind: ServiceAccount
+    name: agent-argus
+    namespace: paperclip

kubernetes/apps/paperclip/network-policy.yaml

@@ -74,6 +74,18 @@ spec:
         - ports:
             - port: "8443"
               protocol: TCP
+    # mosquitto mTLS listener (REN-953): agents that run in this pod read MQTT
+    # with the agents-read client certificate. :8884 only; the listener
+    # rejects any connection without an mqtt-ca certificate. Paired with
+    # mosquitto-agent-ingress in network-policies/home-assistant-ns.yaml.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": home-assistant
+            app.kubernetes.io/name: mosquitto
+      toPorts:
+        - ports:
+            - port: "8884"
+              protocol: TCP
     # Notes wiki API, authenticated by the paperclip API key.
     - toEndpoints:
         - matchLabels:

kubernetes/apps/uptime-monitor/deployment.yaml

@@ -57,7 +57,7 @@ spec:
           # Pinned, and deliberately NOT under Flux image automation. rbac.yaml
           # is derived from what this exact version calls; an automatic bump
           # could add a call the Role does not cover, silently.
-          image: ghcr.io/stakater/ingressmonitorcontroller:v2.2.13
+          image: ghcr.io/stakater/ingressmonitorcontroller:v2.2.13@sha256:3301afb61c10abc4e334deab9cd8601cef069e352b4d7f4dd0897787fca32eac
           command: ["/manager"]
           args:
             - --health-probe-bind-address=:8081

kubernetes/infrastructure/multus/cni-plugins-installer.yaml

@@ -131,7 +131,7 @@ spec:
         # to run on every node (and re-run if the node reboots / the binary
         # is wiped). Pause image keeps memory near zero.
         - name: pause
-          image: registry.k8s.io/pause:3.10
+          image: registry.k8s.io/pause:3.10@sha256:ee6521f290b2168b6e0935a181d4cff9be1ac3f505666ef0e3c98fae8199917a
       terminationGracePeriodSeconds: 5
       volumes:
         - name: cnibin

kubernetes/infrastructure/multus/whereabouts-daemonset.yaml

@@ -167,7 +167,7 @@ spec:
               SLEEP=false source /install-cni.sh
               /token-watcher.sh &
               /ip-control-loop -log-level debug
-          image: ghcr.io/k8snetworkplumbingwg/whereabouts:v0.9.4
+          image: ghcr.io/k8snetworkplumbingwg/whereabouts:v0.9.4@sha256:f279fd7dc1124d7819330fb2e07357990b2b4c5d8733aef1b028573c29f05e14
           env:
             - name: NODENAME
               valueFrom:

kubernetes/infrastructure/multus/whereabouts-reconciler.yaml

@@ -51,7 +51,7 @@ spec:
           args:
             - -log-level
             - debug
-          image: ghcr.io/k8snetworkplumbingwg/whereabouts:v0.9.4
+          image: ghcr.io/k8snetworkplumbingwg/whereabouts:v0.9.4@sha256:f279fd7dc1124d7819330fb2e07357990b2b4c5d8733aef1b028573c29f05e14
           env:
             - name: WHEREABOUTS_NAMESPACE
               valueFrom:

kubernetes/infrastructure/network-policies/home-assistant-ns.yaml

@@ -439,3 +439,39 @@ spec:
         - ports:
             - port: "8081"
               protocol: TCP
+---
+# Agent sandbox pods -> mosquitto :8884 (REN-953). The listener requires a
+# client certificate from mqtt-ca; agents hold only agents-read, which may
+# read open3e/#, zigbee2mqtt/# and homeassistant/# and write nothing.
+# DEDICATED policy selecting mosquitto alone, like shelly-manager-agent-ingress.
+#
+# Revert: delete this document and agent-egress-mosquitto.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: mosquitto-agent-ingress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: mosquitto
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip-renner
+            paperclip.io/role: agent
+      toPorts:
+        - ports:
+            - port: "8884"
+              protocol: TCP
+    # The paperclip pod itself: most agent runs execute there, not in a
+    # sandbox (REN-1001). Egress side: paperclip-egress in
+    # apps/paperclip/network-policy.yaml.
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": paperclip
+            app.kubernetes.io/name: paperclip
+      toPorts:
+        - ports:
+            - port: "8884"
+              protocol: TCP

kubernetes/infrastructure/network-policies/paperclip-renner-ns.yaml

@@ -166,3 +166,28 @@ spec:
         - ports:
             - port: "8081"
               protocol: TCP
+---
+# Agent pods -> mosquitto mTLS listener :8884 (REN-953), for the read-only
+# certificate account agents-read. Not :1883/:8883: those take passwords, and
+# agents hold none. Matching ingress: mosquitto-agent-ingress in
+# home-assistant-ns.yaml. Not labelled `paperclip.io/managed-by`.
+#
+# Revert: delete this document and mosquitto-agent-ingress.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: agent-egress-mosquitto
+  namespace: paperclip-renner
+spec:
+  endpointSelector:
+    matchLabels:
+      paperclip.io/role: agent
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": home-assistant
+            app.kubernetes.io/name: mosquitto
+      toPorts:
+        - ports:
+            - port: "8884"
+              protocol: TCP