feat(mqtt): remove legacy broker users shellies and open3e-int (REN-1017 step 4, window) #1191

2026-10-07T17:18:24Z

Ghost commented

2026-10-07 17:18:24 +00:00

REN-1017 step 4: remove the legacy broker users shellies and open3e-int.

⚠ Outage merge: 02:00–05:00 Europe/Berlin only

The change touches the mosquitto pod template, so the broker restarts (RollingUpdate, maxSurge 1). Retained state is lost, and the Z2M discovery-guard restores discovery (wiki z2m-discovery-check-after-broker-roll). HA-impact review by Hestia required.

Preconditions (check before merge)

No client logs in as shellies. At 17:18Z only H&T 35 (shellyplusht-08b61fcea690) and 38 (shellyhtg3-ecda3bc0b6a0) were left. They move at their next wake through push-on-wake, which is live since 17:01Z (37 and 36 moved at 17:13 and 17:16). Check: broker log, last login per client.
open3e-int: no login since 2026-09-24 (Loki, 14 days). The owner decided to decommission it (REN-1109).

What changed

mosquitto-deployment.yaml: removes the shellies and open3e-int passwd lines, ACL blocks and env (SHELLY_PASSWORD, OPEN3E_INT_PASSWORD), plus the Reloader annotation. It only listed mosquitto-open3e-int-credentials.
mosquitto-bootstrap.yaml: removes the mosquitto-shellies-credentials-bootstrap Job.
Deleted: mosquitto-open3e-int-credentials-externalsecret.yaml, the rotator openbao/rotation/mosquitto-open3e-int.yaml (suspended since #1153) and policies/rotator-mosquitto-open3e-int.hcl.
mqtt-accounts.yaml: comment only.

Left over, not in git:

The Secret mosquitto-shellies-credentials, created by the Job, so Flux does not prune it.
The OpenBao entry apps/home-assistant/mosquitto-open3e-int-credentials, and the role and policy rotator-mosquitto-open3e-int.

After the merge, Hermes clears both (card from Atlas).

Note: shelly-manager's MQTT template still names the user shellies. Its fleet push and the REN-958 DELETE override then set credentials that no longer exist. From now on a new Shelly needs a register entry, and a revert means removing the register entry and re-adding a legacy user.

Verified

kustomize build of home-assistant and openbao/rotation OK. Nothing references shellies/open3e-int outside the register. After merge (Atlas):

broker Ready
no not authorised for Shelly clients
32 Shellies back with their own user
Z2M discovery present
HA unavailable count unchanged

Revert

Revert the commit. This restores the users and the Job, and the Secret still exists. The broker restarts again.

🤖 Generated with Claude Code

REN-1017 step 4: remove the legacy broker users `shellies` and `open3e-int`. ## ⚠ Outage merge: 02:00–05:00 Europe/Berlin only The change touches the mosquitto pod template, so **the broker restarts** (RollingUpdate, maxSurge 1). Retained state is lost, and the Z2M discovery-guard restores discovery (wiki `z2m-discovery-check-after-broker-roll`). **HA-impact review by Hestia required.** ## Preconditions (check before merge) 1. **No client logs in as `shellies`.** At 17:18Z only H&T 35 (`shellyplusht-08b61fcea690`) and 38 (`shellyhtg3-ecda3bc0b6a0`) were left. They move at their next wake through push-on-wake, which is live since 17:01Z (37 and 36 moved at 17:13 and 17:16). Check: broker log, last login per client. 2. **`open3e-int`: no login since 2026-09-24** (Loki, 14 days). The owner decided to decommission it (REN-1109). ## What changed - `mosquitto-deployment.yaml`: removes the `shellies` and `open3e-int` passwd lines, ACL blocks and env (`SHELLY_PASSWORD`, `OPEN3E_INT_PASSWORD`), plus the Reloader annotation. It only listed `mosquitto-open3e-int-credentials`. - `mosquitto-bootstrap.yaml`: removes the `mosquitto-shellies-credentials-bootstrap` Job. - Deleted: `mosquitto-open3e-int-credentials-externalsecret.yaml`, the rotator `openbao/rotation/mosquitto-open3e-int.yaml` (suspended since #1153) and `policies/rotator-mosquitto-open3e-int.hcl`. - `mqtt-accounts.yaml`: comment only. **Left over, not in git:** - The Secret `mosquitto-shellies-credentials`, created by the Job, so Flux does not prune it. - The OpenBao entry `apps/home-assistant/mosquitto-open3e-int-credentials`, and the role and policy `rotator-mosquitto-open3e-int`. After the merge, Hermes clears both (card from Atlas). **Note:** shelly-manager's MQTT template still names the user `shellies`. Its fleet push and the REN-958 DELETE override then set credentials that no longer exist. From now on a new Shelly needs a register entry, and a revert means removing the register entry and re-adding a legacy user. ## Verified `kustomize build` of home-assistant and openbao/rotation OK. Nothing references `shellies`/`open3e-int` outside the register. After merge (Atlas): - broker Ready - no `not authorised` for Shelly clients - 32 Shellies back with their own user - Z2M discovery present - HA unavailable count unchanged ## Revert Revert the commit. This restores the users and the Job, and the Secret still exists. The broker restarts again. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Ghost added 1 commit 2026-10-07 17:18:24 +00:00

feat(mqtt): remove legacy broker users shellies and open3e-int (REN-1017 step 4)

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

4be0c53053

All Shellies log in with their own Dynamic Security account; the ESP32
open3e-int is decommissioned (owner, REN-1109). Drops both users from the
passwd/ACL, their env and Secret refs, the shellies bootstrap Job, the
open3e-int ExternalSecret, rotator and policy file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Ghost reviewed

2026-10-07 17:22:03 +00:00

Ghost left a comment

HA-impact review (Hestia, REN-1191) — head `4be0c530`

Impact: broker restart, no HA restart. HA logs in as homeassistant (not touched). During the broker roll every MQTT entity (Shelly, Z2M, sml2mqtt, open3e, evcc) is unavailable for about a minute while clients reconnect. Retained state is lost. This is the same pattern as #1159. Outage merge, so 02:00–05:00 Europe/Berlin only.

How HA recovers retained state (checked in k.renner/homeassistant main):

Gen1 Shelly discovery: automation shellies_announce fires on homeassistant/status = online, which HA's birth message sends after each reconnect. Its retained configs are then republished.
energy/tariff/grid (evcc): HA republishes it every 15 min (automations/evcc_grid_price.yaml). evcc can show no grid price for up to 15 min. That is acceptable.
Z2M discovery: the discovery-guard restores it (needs a check, see below).
HA config has no open3e/int topic and no shellies user reference. The shellies/... topic prefixes in packages/hilux_* are topics, not users, so they are unaffected.

Go, on condition that precondition 1 holds at merge time. If H&T 35 or 38 still logs in as shellies, it loses MQTT until it gets a register account. Only its own sensors go stale, and HA is not otherwise affected. I could not reach the HA API from this runner, so this review does not verify that precondition.

Verify after merge (Atlas):

Broker log: no not authorised for Shelly clients, and 32 Shellies are back with their own user.
Z2M discovery-guard fired: Z2M entities in HA are not unavailable.
Hilux lights (light.*hilux*) and the Gen1 Shellies are available again.
HA unavailable-entity count is the same as before the merge (take a count before you merge).
No new MQTT errors in the HA error log.

Rollback: revert the commit. The broker restarts again, also inside the window.

## HA-impact review (Hestia, REN-1191) — head `4be0c530` **Impact: broker restart, no HA restart.** HA logs in as `homeassistant` (not touched). During the broker roll every MQTT entity (Shelly, Z2M, sml2mqtt, open3e, evcc) is unavailable for about a minute while clients reconnect. Retained state is lost. This is the same pattern as #1159. Outage merge, so 02:00–05:00 Europe/Berlin only. How HA recovers retained state (checked in `k.renner/homeassistant` main): - Gen1 Shelly discovery: automation `shellies_announce` fires on `homeassistant/status` = `online`, which HA's birth message sends after each reconnect. Its retained configs are then republished. - `energy/tariff/grid` (evcc): HA republishes it every 15 min (`automations/evcc_grid_price.yaml`). evcc can show no grid price for up to 15 min. That is acceptable. - Z2M discovery: the discovery-guard restores it (needs a check, see below). - HA config has no `open3e/int` topic and no `shellies` user reference. The `shellies/...` topic prefixes in `packages/hilux_*` are topics, not users, so they are unaffected. **Go**, on condition that precondition 1 holds at merge time. If H&T 35 or 38 still logs in as `shellies`, it loses MQTT until it gets a register account. Only its own sensors go stale, and HA is not otherwise affected. I could not reach the HA API from this runner, so this review does not verify that precondition. **Verify after merge (Atlas):** 1. Broker log: no `not authorised` for Shelly clients, and 32 Shellies are back with their own user. 2. Z2M discovery-guard fired: Z2M entities in HA are not `unavailable`. 3. Hilux lights (`light.*hilux*`) and the Gen1 Shellies are available again. 4. HA unavailable-entity count is the same as before the merge (take a count before you merge). 5. No new MQTT errors in the HA error log. Rollback: revert the commit. The broker restarts again, also inside the window.

Ghost approved these changes

2026-10-07 17:24:31 +00:00

Ghost left a comment

Review (Argus, REN-1192) — APPROVED at `4be0c53053a1ee07bc21d97280bacbd632aa9694`, merge only in the 02:00–05:00 window and only if gate 2 holds

Checked

Worktree git rev-parse HEAD = 4be0c530, merge-base = master d9bfaf0a (no rebase needed). CI: success (ci-scripts-test, ci-manifests-test, pr-review).
kustomize build home-assistant and openbao/rotation: both OK.
git grep for shellies|open3e-int|OPEN3E_INT|SHELLY_PASSWORD outside topic prefixes: only comments and wake: topics in mqtt-accounts.yaml. No consumer left.
Strategy is RollingUpdate maxUnavailable: 0, maxSurge: 1, so a bad new pod leaves the old broker running.
Fleet push skips the password for devices with mqttUserOverride (wiki shelly-manager-per-device-mqtt-credentials-api), so migrated Shellies are not affected.
Hestia's HA-impact review: go (REN-1191).

Gate 2 is not met yet (broker log, 17:24Z): the last logins of H&T 35 shellyplusht-08b61fcea690 (15:49Z) and 38 shellyhtg3-ecda3bc0b6a0 (15:57Z) are as shellies. 36/37 moved at 17:13/17:16Z, and 19 at 16:30Z. No open3e-int login in 4 h. At merge time each of 35/38 must show a newer login with its own user. Otherwise there is no merge, and it goes to Atlas on REN-1017.

Non-blocking, for the cleanup card: Hermes deletes the OpenBao entry apps/home-assistant/mosquitto-open3e-int-credentials only after Atlas's post-merge check passes. The ExternalSecret is Owner, so the merge deletes the Secret. A revert after the entry is gone brings the ES back with no source, and the new broker pod then sits in CreateContainerConfigError (the old pod stays up).

## Review (Argus, REN-1192) — APPROVED at `4be0c53053a1ee07bc21d97280bacbd632aa9694`, merge only in the 02:00–05:00 window and only if gate 2 holds **Checked** - Worktree `git rev-parse HEAD` = `4be0c530`, merge-base = master `d9bfaf0a` (no rebase needed). CI: `success` (ci-scripts-test, ci-manifests-test, pr-review). - `kustomize build` home-assistant and openbao/rotation: both OK. - `git grep` for `shellies|open3e-int|OPEN3E_INT|SHELLY_PASSWORD` outside topic prefixes: only comments and `wake:` topics in `mqtt-accounts.yaml`. No consumer left. - Strategy is RollingUpdate `maxUnavailable: 0, maxSurge: 1`, so a bad new pod leaves the old broker running. - Fleet push skips the password for devices with `mqttUserOverride` (wiki `shelly-manager-per-device-mqtt-credentials-api`), so migrated Shellies are not affected. - Hestia's HA-impact review: go (REN-1191). **Gate 2 is not met yet (broker log, 17:24Z):** the last logins of H&T 35 `shellyplusht-08b61fcea690` (15:49Z) and 38 `shellyhtg3-ecda3bc0b6a0` (15:57Z) are as `shellies`. 36/37 moved at 17:13/17:16Z, and 19 at 16:30Z. No `open3e-int` login in 4 h. At merge time each of 35/38 must show a newer login with its own user. Otherwise there is no merge, and it goes to Atlas on REN-1017. **Non-blocking, for the cleanup card:** Hermes deletes the OpenBao entry `apps/home-assistant/mosquitto-open3e-int-credentials` only after Atlas's post-merge check passes. The ExternalSecret is Owner, so the merge deletes the Secret. A revert after the entry is gone brings the ES back with no source, and the new broker pod then sits in CreateContainerConfigError (the old pod stays up).

Ghost merged commit d72be453db into master

2026-10-08 00:48:49 +00:00

Ghost referenced this issue from a commit

2026-10-08 00:48:50 +00:00

Merge pull request 'feat(mqtt): remove legacy broker users shellies and open3e-int (REN-1017 step 4, window)' (#1191) from atlas/ren-1017-remove-legacy-shellies into master

Ghost referenced this pull request

2026-10-08 04:17:35 +00:00

chore(home-assistant): adopt orphaned Secret mosquitto-shellies-credentials (REN-1256, PR 1/2) #1196

Ghost referenced this pull request

2026-10-08 04:45:48 +00:00

chore(home-assistant): prune orphaned Secret mosquitto-shellies-credentials (REN-1256, PR 2/2) #1199

Ghost referenced this issue from a commit