2026-10-07 01:28:44 +00:00
2 changed files with 9 additions and 0 deletions
@@ -102,6 +102,7 @@ rules:
    resourceNames:
      - mqtt-test-cert-tls
      - mqtt-mosquitto-probe-tls
+      - mqtt-zigbee2mqtt-bridge-tls
    verbs: ["delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -26,3 +26,11 @@
  auth: cert
  deliver: {namespace: home-assistant}
  acl: ["readwrite health/#"]
+# Zigbee2MQTT and its two sidecars (discovery-guard, interview-watch), one
+# certificate for the pod. Same ACL as the legacy user `zigbee2mqtt`; not
+# named like it, so this entry cannot shadow the password login of a running
+# Z2M (REN-953).
+- name: zigbee2mqtt-bridge
+  auth: cert
+  deliver: {namespace: home-assistant}
+  acl: ["readwrite zigbee2mqtt/#", "write homeassistant/#", "read homeassistant/status"]