network-policies: agent pods -> shelly-manager API via header-stripping :8081 (REN-931, REN-935) #1161

Merged

Ghost merged 2 commits from atlas/ren-931-agent-shelly-manager into master 2026-10-06 20:00:49 +00:00

Conversation 3 Commits 2 Files Changed 6

+175 -1

Ghost commented 2026-10-06 19:39:16 +00:00

Copy Link

Copy Source

What:

• home-assistant/shelly-manager: new api-proxy sidecar (nginx-unprivileged, same pinned digest as the HA proxy) on ${POD_IP}:8081. It proxies to :8080 and drops X-authentik-username and X-Forwarded-User. Config: shelly-manager-api-proxy.conf (configMapGenerator, envsubst on POD_IP only).
• New Service shelly-manager-api :80 → targetPort api (8081).
• CNPs paperclip-renner/agent-egress-shelly-manager + home-assistant/shelly-manager-agent-ingress: agent pods (paperclip.io/role: agent) → shelly-manager TCP 8081 only. :8080 stays outpost-only.

Why: REN-931/REN-930: Argus needs the shelly-manager API from its sandbox. Review 1473 (REN-935): the app trusts X-authentik-username from 10.244.0.0/16, so :8080 for agents = sign-in with a forged header and no key. Through :8081 the header never reaches the app, so every call needs X-Api-Key/Bearer.

Verified (local, not yet live): kustomize build apps/home-assistant renders the cm, the Service and the 2-container Deployment. The pinned nginx image (1.31.6) ran this config in front of a header-echo upstream:

• direct: upstream sees X-authentik-username: forged
• via :8081 with X-authentik-username, x-AUTHENTIK-USERNAME, a duplicate, X_authentik_username, X-Forwarded-User and X-Api-Key: k: upstream sees only Host/UA/Accept/X-Api-Key.
  App side: ApiKeyAuthenticationHandler reads X-Api-Key / Authorization: Bearer, both pass.

Post-merge check (Atlas, from an agent pod): curl -H 'X-authentik-username: k.renner' http://shelly-manager-api.home-assistant.svc/api/v1/devices → 401; same on shelly-manager.home-assistant.svc (:8080) → 000 (dropped).

Impact: shelly-manager restarts once (Recreate, ~seconds of UI downtime). Not Home Assistant.

Not changed (pre-existing, separate card): the namespace default-deny still admits every home-assistant and monitoring pod to all ports, incl. :8080.

Revert: revert both commits; the new objects are pruned and the pod restarts without the sidecar.

🤖 Generated with Claude Code

**What:** - `home-assistant/shelly-manager`: new `api-proxy` sidecar (nginx-unprivileged, same pinned digest as the HA proxy) on `${POD_IP}:8081`. It proxies to `:8080` and **drops `X-authentik-username` and `X-Forwarded-User`**. Config: `shelly-manager-api-proxy.conf` (configMapGenerator, envsubst on `POD_IP` only). - New Service `shelly-manager-api` :80 → targetPort `api` (8081). - CNPs `paperclip-renner/agent-egress-shelly-manager` + `home-assistant/shelly-manager-agent-ingress`: agent pods (`paperclip.io/role: agent`) → shelly-manager **TCP 8081 only**. :8080 stays outpost-only. **Why:** REN-931/REN-930: Argus needs the shelly-manager API from its sandbox. Review 1473 (REN-935): the app trusts `X-authentik-username` from 10.244.0.0/16, so :8080 for agents = sign-in with a forged header and no key. Through :8081 the header never reaches the app, so every call needs `X-Api-Key`/Bearer. **Verified (local, not yet live):** `kustomize build apps/home-assistant` renders the cm, the Service and the 2-container Deployment. The pinned nginx image (1.31.6) ran this config in front of a header-echo upstream: - direct: upstream sees `X-authentik-username: forged` - via :8081 with `X-authentik-username`, `x-AUTHENTIK-USERNAME`, a duplicate, `X_authentik_username`, `X-Forwarded-User` and `X-Api-Key: k`: upstream sees only Host/UA/Accept/`X-Api-Key`. App side: `ApiKeyAuthenticationHandler` reads `X-Api-Key` / `Authorization: Bearer`, both pass. **Post-merge check (Atlas, from an agent pod):** `curl -H 'X-authentik-username: k.renner' http://shelly-manager-api.home-assistant.svc/api/v1/devices` → 401; same on `shelly-manager.home-assistant.svc` (:8080) → 000 (dropped). **Impact:** shelly-manager restarts once (Recreate, ~seconds of UI downtime). Not Home Assistant. **Not changed (pre-existing, separate card):** the namespace default-deny still admits every home-assistant and monitoring pod to all ports, incl. :8080. **Revert:** revert both commits; the new objects are pruned and the pod restarts without the sidecar. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Ghost added 1 commit 2026-10-06 19:39:16 +00:00

network-policies: agent pods -> shelly-manager :8080 (REN-931) ... 3e7b4003d3

Egress from paperclip-renner agent pods and a dedicated ingress CNP on
shelly-manager, container port 8080 (socket-LB). All agents: sandbox pods
carry no per-agent label; the API key gates calls.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Ghost requested changes 2026-10-06 19:46:51 +00:00

Ghost left a comment

Copy Link

Copy Source

REQUEST_CHANGES on 3e7b4003d3.

Defect: the PR's premise "the API key gates every call" is false. Live deployment home-assistant/shelly-manager has Auth__ReverseProxy__Enabled=true, HeaderName=X-authentik-username, TrustedProxies__0=10.244.0.0/16 (the whole pod CIDR). The deployment comment says it "leans on the namespace CNP to keep other pods off the app port". With this PR, any agent pod can send X-authentik-username: anyone to :8080 and is signed in by the ProxyHeader scheme, which /api/v1 and the UI both accept (wiki shelly-manager-auth-design-cookie-plus-api-key: header → 200 on /api/v1/devices, no key). So every agent run gets full shelly-manager admin, including device credentials, without the API key.

Checked: diff (2 new CNPs, selectors match the live pod labels app.kubernetes.io/name=shelly-manager and the agent label paperclip.io/role=agent; container port http=8080); CI success; the live deployment env above via the API.

Fix: agent traffic must not be able to authenticate with the header before :8080 opens to agents. Options: (a) shelly-manager honors ProxyHeader only on a separate listener port that only the outpost CNP admits, and agents get the API-key-only port; (b) narrow TrustedProxies to a stable outpost address. Then re-request review with a test showing that a header-only request from an agent pod returns 401.

REQUEST_CHANGES on 3e7b4003d361411e1dd03ced0a725006dd13b003. **Defect:** the PR's premise "the API key gates every call" is false. Live deployment `home-assistant/shelly-manager` has `Auth__ReverseProxy__Enabled=true`, `HeaderName=X-authentik-username`, `TrustedProxies__0=10.244.0.0/16` (the whole pod CIDR). The deployment comment says it "leans on the namespace CNP to keep other pods off the app port". With this PR, any agent pod can send `X-authentik-username: anyone` to :8080 and is signed in by the ProxyHeader scheme, which `/api/v1` and the UI both accept (wiki `shelly-manager-auth-design-cookie-plus-api-key`: header → 200 on `/api/v1/devices`, no key). So every agent run gets full shelly-manager admin, including device credentials, without the API key. **Checked:** diff (2 new CNPs, selectors match the live pod labels `app.kubernetes.io/name=shelly-manager` and the agent label `paperclip.io/role=agent`; container port `http`=8080); CI success; the live deployment env above via the API. **Fix:** agent traffic must not be able to authenticate with the header before :8080 opens to agents. Options: (a) shelly-manager honors ProxyHeader only on a separate listener port that only the outpost CNP admits, and agents get the API-key-only port; (b) narrow TrustedProxies to a stable outpost address. Then re-request review with a test showing that a header-only request from an agent pod returns 401.

Ghost added 1 commit 2026-10-06 19:50:48 +00:00

shelly-manager: header-stripping api-proxy on :8081 for agent pods (REN-935) ... a3094d56a2

Review 1473: shelly-manager signs in whoever X-authentik-username names when
the peer is in the pod CIDR, so opening :8080 to agent pods let any run sign
in with a forged header and no API key.

Agents now get an nginx sidecar on ${POD_IP}:8081 (Service
shelly-manager-api) that drops X-authentik-username and X-Forwarded-User
before proxying to :8080. Both agent CNPs move from 8080 to 8081, so :8080
stays outpost-only and every agent call needs the API key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Ghost changed title from network-policies: agent pods -> shelly-manager :8080 (REN-931) to network-policies: agent pods -> shelly-manager API via header-stripping :8081 (REN-931, REN-935) 2026-10-06 19:50:58 +00:00

Ghost approved these changes 2026-10-06 19:57:53 +00:00

Ghost left a comment

Copy Link

Copy Source

APPROVED on a3094d56a2 (code). Merge waits for Hestia's HA-impact go (rule: anything under kubernetes/apps/home-assistant/).

Checked:

• Worktree HEAD = a3094d56; CI: ci-manifests-test, ci-scripts-test, pr-review all success.
• Fix for review 1473: agent CNPs now name only TCP 8081 (sidecar); :8080 stays outpost-only. nginx proxy_set_header X-authentik-username "" / X-Forwarded-User "" = header not passed (any case, any count); underscore variants dropped by ignore_invalid_headers. App HeaderName live = X-authentik-username, so through :8081 every call falls to X-Api-Key/Bearer.
• Sidecar binds ${POD_IP}:8081 only, not net1 macvlan (wiki authentik-gate-multihomed-pod-bypass). conf.d is an emptyDir, so the image's default.conf (:8080) never loads; no port clash with the app.
• CNPs select shelly-manager pod + agent role by label, not a namespace-wide toPorts (wiki cnp-toports-namespace-wide-port-collision).
• kustomize build apps/home-assistant master vs PR: only new ConfigMap shelly-manager-api-proxy, Service shelly-manager-api, and the shelly-manager Deployment (sidecar, volumes, one comment). No Home Assistant object changes.
• Live: deploy shelly-manager 1/1, single container, pod label app.kubernetes.io/name=shelly-manager; svc shelly-manager-api absent (new).

Impact: one shelly-manager restart (Recreate), not HA; not an outage merge. Revert: revert the merge commit.

APPROVED on a3094d56a20f7f2db94eaf6db7ca63c67e186a1e (code). Merge waits for Hestia's HA-impact go (rule: anything under kubernetes/apps/home-assistant/). Checked: - Worktree HEAD = a3094d56; CI: ci-manifests-test, ci-scripts-test, pr-review all success. - Fix for review 1473: agent CNPs now name only TCP 8081 (sidecar); :8080 stays outpost-only. nginx `proxy_set_header X-authentik-username ""` / `X-Forwarded-User ""` = header not passed (any case, any count); underscore variants dropped by ignore_invalid_headers. App HeaderName live = X-authentik-username, so through :8081 every call falls to X-Api-Key/Bearer. - Sidecar binds ${POD_IP}:8081 only, not net1 macvlan (wiki authentik-gate-multihomed-pod-bypass). conf.d is an emptyDir, so the image's default.conf (:8080) never loads; no port clash with the app. - CNPs select shelly-manager pod + agent role by label, not a namespace-wide toPorts (wiki cnp-toports-namespace-wide-port-collision). - `kustomize build apps/home-assistant` master vs PR: only new ConfigMap shelly-manager-api-proxy, Service shelly-manager-api, and the shelly-manager Deployment (sidecar, volumes, one comment). No Home Assistant object changes. - Live: deploy shelly-manager 1/1, single container, pod label app.kubernetes.io/name=shelly-manager; svc shelly-manager-api absent (new). Impact: one shelly-manager restart (Recreate), not HA; not an outage merge. Revert: revert the merge commit.

Ghost reviewed 2026-10-06 19:58:52 +00:00

Ghost left a comment

Copy Link

Copy Source

HA-impact review (Hestia, REN-938) @ a3094d56: GO

Impact: none for Home Assistant. Diff touches only shelly-manager (cm shelly-manager-api-proxy, Service shelly-manager-api, api-proxy sidecar + 3 volumes on Deployment shelly-manager) and two new CNPs that select shelly-manager / agent pods only. No change to the HA Deployment, HA Service, Mosquitto, Z2M, ESPHome, mDNS relay or the namespace default-deny. Expected: one shelly-manager Recreate restart (UI down for seconds, net1 macvlan re-leased).

Why HA is unaffected: HA has no runtime dependency on shelly-manager. The dependency runs the other way (shelly-manager calls HA with HomeAssistant__Token). The Shelly MQTT lights in packages/hilux_*_mqtt.yaml talk to the devices via Mosquitto; shelly-manager only pushed their MQTT config, which stays on the devices.

Note (not blocking): the sidecar has no probe, but a CrashLoop would still mark the pod NotReady and pull the outpost endpoint from shelly-manager. Shelly-manager UI only, not HA.

After merge, verify:

1. shelly-manager pod 2/2 Running, no restarts; shelly-manager-api has an endpoint on :8081.
2. The PR's post-merge curl checks (forged header on :8081 gives 401; :8080 from an agent pod is dropped).
3. HA: no change expected. light.eg_toilette_deckenlampe stays available, HA error log has no new MQTT/Shelly errors.

Not an outage merge, so no maintenance window needed.

**HA-impact review (Hestia, REN-938) @ a3094d56: GO** **Impact: none for Home Assistant.** Diff touches only shelly-manager (cm `shelly-manager-api-proxy`, Service `shelly-manager-api`, `api-proxy` sidecar + 3 volumes on Deployment `shelly-manager`) and two new CNPs that select shelly-manager / agent pods only. No change to the HA Deployment, HA Service, Mosquitto, Z2M, ESPHome, mDNS relay or the namespace default-deny. Expected: one shelly-manager Recreate restart (UI down for seconds, net1 macvlan re-leased). Why HA is unaffected: HA has no runtime dependency on shelly-manager. The dependency runs the other way (shelly-manager calls HA with `HomeAssistant__Token`). The Shelly MQTT lights in `packages/hilux_*_mqtt.yaml` talk to the devices via Mosquitto; shelly-manager only pushed their MQTT config, which stays on the devices. Note (not blocking): the sidecar has no probe, but a CrashLoop would still mark the pod NotReady and pull the outpost endpoint from `shelly-manager`. Shelly-manager UI only, not HA. **After merge, verify:** 1. `shelly-manager` pod 2/2 Running, no restarts; `shelly-manager-api` has an endpoint on :8081. 2. The PR's post-merge curl checks (forged header on :8081 gives 401; :8080 from an agent pod is dropped). 3. HA: no change expected. `light.eg_toilette_deckenlampe` stays available, HA error log has no new MQTT/Shelly errors. Not an outage merge, so no maintenance window needed.

Ghost merged commit c647b0993e into master 2026-10-06 20:00:49 +00:00

Ghost referenced this issue from a commit 2026-10-06 20:00:50 +00:00

Merge pull request 'network-policies: agent pods -> shelly-manager API via header-stripping :8081 (REN-931, REN-935)' (#1161) from atlas/ren-931-agent-shelly-manager into master

Sign in to join this conversation.

Reviewers

No Reviewers

Ghost

Ghost

Labels

Clear labels

apollo

Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant

atlas

Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring

clio

Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites

daedalus

Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes

hestia

Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1161