fix: [alert] TargetDown (home-assistant) (#1084 )

2026-10-01 04:43:14 +00:00
3 changed files with 8 additions and 3 deletions
@@ -4,7 +4,7 @@ metadata:
  name: home-assistant-config-sync-token
  namespace: home-assistant
 spec:
-  refreshInterval: 1h
+  refreshInterval: 1m # rotator revokes the old LLAT immediately — see prometheus-token-externalsecret.yaml
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao
@@ -4,7 +4,12 @@ metadata:
  name: home-assistant-prometheus-token
  namespace: home-assistant
 spec:
-  refreshInterval: 1h
+  # 1m, not 1h: the ha-token rotator (infrastructure/openbao/rotation/
+  # home-assistant.yaml) revokes the old LLAT right after storing the new one,
+  # so consumers hold a revoked token until ESO re-reads. At 1h that was ~35 min
+  # of 401s (TargetDown + HomeAssistantDown, zone-configurator crashloop, #1084).
+  # Same for config-sync-token and shelly-manager-llat.
+  refreshInterval: 1m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao
@@ -4,7 +4,7 @@ metadata:
  name: shelly-manager-llat
  namespace: home-assistant
 spec:
-  refreshInterval: 1h
+  refreshInterval: 1m # rotator revokes the old LLAT immediately — see prometheus-token-externalsecret.yaml
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao