From da3037cb2472cc4d3b93eccb8cdc6b7f9ccf717b Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Wed, 7 Oct 2026 00:48:42 +0000 Subject: [PATCH] feat(mqtt): register cert account zigbee2mqtt-bridge (REN-953) Adds the register entry for Zigbee2MQTT (same ACL as the legacy user zigbee2mqtt, different name so it cannot shadow the running password login) and its Secret to the controller's revocation list. Nothing restarts; the controller picks the register up live and issues mqtt-zigbee2mqtt-bridge-tls before the Z2M switch lands. Co-Authored-By: Claude Opus 5.5 --- .../apps/home-assistant/mqtt-account-controller.yaml | 1 + kubernetes/apps/home-assistant/mqtt-accounts.yaml | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml index 64eeb682..a14d97eb 100644 --- a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml +++ b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml @@ -102,6 +102,7 @@ rules: resourceNames: - mqtt-test-cert-tls - mqtt-mosquitto-probe-tls + - mqtt-zigbee2mqtt-bridge-tls verbs: ["delete"] --- apiVersion: rbac.authorization.k8s.io/v1 diff --git a/kubernetes/apps/home-assistant/mqtt-accounts.yaml b/kubernetes/apps/home-assistant/mqtt-accounts.yaml index 82b4bf14..bb2324d1 100644 --- a/kubernetes/apps/home-assistant/mqtt-accounts.yaml +++ b/kubernetes/apps/home-assistant/mqtt-accounts.yaml @@ -26,3 +26,11 @@ auth: cert deliver: {namespace: home-assistant} acl: ["readwrite health/#"] +# Zigbee2MQTT and its two sidecars (discovery-guard, interview-watch), one +# certificate for the pod. Same ACL as the legacy user `zigbee2mqtt`; not +# named like it, so this entry cannot shadow the password login of a running +# Z2M (REN-953). +- name: zigbee2mqtt-bridge + auth: cert + deliver: {namespace: home-assistant} + acl: ["readwrite zigbee2mqtt/#", "write homeassistant/#", "read homeassistant/status"] -- 2.54.0