konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests Packages Projects Releases 1 Wiki Activity

feat(mqtt): register cert account zigbee2mqtt-bridge (REN-953) #1164

Merged
Ghost merged 1 commits from atlas/ren-953-z2m-account into master 2026-10-07 01:28:44 +00:00
Conversation 1 Commits 1 Files Changed 2
+9
Ghost commented 2026-10-07 00:48:42 +00:00
Copy Link
Copy Source

What

REN-953 step 2, part A: register entry zigbee2mqtt-bridge (auth: cert, delivered to home-assistant). ACL is identical to the legacy user zigbee2mqtt: readwrite zigbee2mqtt/#, write homeassistant/#, read homeassistant/status. Its Secret mqtt-zigbee2mqtt-bridge-tls is added to the controller's delete list (revocation).

Why separate, and why this name

  • Separate from the Z2M switch (part B, follow-up PR) so the Secret exists before Z2M restarts. Z2M uses Recreate; if both landed at once, Zigbee would sit in ContainerCreating for up to ~3 min (controller loop plus ConfigMap sync).
  • A different name from zigbee2mqtt, because a Dynamic Security client with a legacy username shadows that user's password login (seen in REN-953 step 1). This entry therefore cannot affect the running Z2M.

Outage merge: NO

Nothing restarts. The register ConfigMap has no hash suffix and is mounted without subPath, so the running controller reads it on its next loop (step 1: #1163 did the same at 00:44:25Z without a restart). The broker gets the client live over $CONTROL. Merge at once.

How verified

kustomize build kubernetes/apps/home-assistant passes. After the merge I check: controller log creating certificate client account=zigbee2mqtt-bridge, accounts:3, Certificate mqtt-zigbee2mqtt-bridge Ready, and Z2M still connected as u'zigbee2mqtt'.

Revert

Revert this PR. The controller deletes client, role, Certificate and Secret on its next loop. Nothing uses them until part B.

🤖 Generated with Claude Code

## What REN-953 step 2, part A: register entry `zigbee2mqtt-bridge` (auth: cert, delivered to `home-assistant`). ACL is identical to the legacy user `zigbee2mqtt`: `readwrite zigbee2mqtt/#`, `write homeassistant/#`, `read homeassistant/status`. Its Secret `mqtt-zigbee2mqtt-bridge-tls` is added to the controller's delete list (revocation). ## Why separate, and why this name - Separate from the Z2M switch (part B, follow-up PR) so the Secret exists **before** Z2M restarts. Z2M uses `Recreate`; if both landed at once, Zigbee would sit in ContainerCreating for up to ~3 min (controller loop plus ConfigMap sync). - A different name from `zigbee2mqtt`, because a Dynamic Security client with a legacy username shadows that user's password login (seen in REN-953 step 1). This entry therefore cannot affect the running Z2M. ## Outage merge: NO Nothing restarts. The register ConfigMap has no hash suffix and is mounted without subPath, so the running controller reads it on its next loop (step 1: #1163 did the same at 00:44:25Z without a restart). The broker gets the client live over `$CONTROL`. Merge at once. ## How verified `kustomize build kubernetes/apps/home-assistant` passes. After the merge I check: controller log `creating certificate client account=zigbee2mqtt-bridge`, `accounts:3`, Certificate `mqtt-zigbee2mqtt-bridge` Ready, and Z2M still connected as `u'zigbee2mqtt'`. ## Revert Revert this PR. The controller deletes client, role, Certificate and Secret on its next loop. Nothing uses them until part B. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Ghost added 1 commit 2026-10-07 00:48:43 +00:00
feat(mqtt): register cert account zigbee2mqtt-bridge (REN-953)
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
da3037cb24 
Adds the register entry for Zigbee2MQTT (same ACL as the legacy user
zigbee2mqtt, different name so it cannot shadow the running password login)
and its Secret to the controller's revocation list. Nothing restarts; the
controller picks the register up live and issues mqtt-zigbee2mqtt-bridge-tls
before the Z2M switch lands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ghost approved these changes 2026-10-07 00:51:36 +00:00
Ghost left a comment
Copy Link
Copy Source

Approved at da3037cb24 (REN-961).

Checked:

  • ACL is a 1:1 copy of the legacy user zigbee2mqtt block in mosquitto-deployment.yaml (readwrite zigbee2mqtt/#, write homeassistant/#, read homeassistant/status). The syntax is the controller README's own example.
  • RBAC: one named Secret mqtt-zigbee2mqtt-bridge-tls, verb delete only. No wildcard.
  • kustomize build kubernetes/apps/home-assistant passes. ConfigMap mqtt-accounts has no suffix (generatorOptions.disableNameSuffixHash), and it is not a subPath mount.
  • Premise checked live: #1163 added mosquitto-probe at 00:44:25Z. Controller pod started 00:14:23Z, 0 restarts, logs show accounts:2. No name clash with the existing Certificate zigbee2mqtt-tls.
  • Branch is level with master.

What breaks: only the new client. Z2M stays on its password login until part B. Who notices: the controller log and the Certificate status. Undo: revert, and the next 2-min loop deletes the client, role, Certificate and Secret.
Not an outage merge: nothing restarts. Merging once CI is green.

Approved at da3037cb2472cc4d3b93eccb8cdc6b7f9ccf717b (REN-961). Checked: - ACL is a 1:1 copy of the legacy `user zigbee2mqtt` block in mosquitto-deployment.yaml (readwrite zigbee2mqtt/#, write homeassistant/#, read homeassistant/status). The syntax is the controller README's own example. - RBAC: one named Secret `mqtt-zigbee2mqtt-bridge-tls`, verb delete only. No wildcard. - `kustomize build kubernetes/apps/home-assistant` passes. ConfigMap `mqtt-accounts` has no suffix (generatorOptions.disableNameSuffixHash), and it is not a subPath mount. - Premise checked live: #1163 added mosquitto-probe at 00:44:25Z. Controller pod started 00:14:23Z, 0 restarts, logs show `accounts:2`. No name clash with the existing Certificate `zigbee2mqtt-tls`. - Branch is level with master. What breaks: only the new client. Z2M stays on its password login until part B. Who notices: the controller log and the Certificate status. Undo: revert, and the next 2-min loop deletes the client, role, Certificate and Secret. Not an outage merge: nothing restarts. Merging once CI is green.
Ghost merged commit 9157a153a6 into master 2026-10-07 01:28:44 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Ghost
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#1164