From 3c86f0970c03a48f800e746306ffa7448b90a9b7 Mon Sep 17 00:00:00 2001
From: Claude Bot <claude-bot@renner.uno>
Date: Sun, 25 Oct 2026 21:06:03 +0100
Subject: [PATCH] feat(mqtt): admin login as a register account

The controller (main-b1f294d, konairius/mqtt-account-controller#13)
delivers a password account to a namespace Secret. admin moves into the
register with its password in Secret mqtt-admin-password; Dynamic
Security is asked first, so it replaces the password_file login without
a broker restart. The controller gets get/create/patch/delete on that
Secret by name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../mqtt-account-controller.yaml              | 14 +++++++++----
 .../apps/home-assistant/mqtt-accounts.yaml    | 21 +++++++++++--------
 2 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml
index b8b04227..95078a22 100644
--- a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml
+++ b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml
@@ -5,9 +5,7 @@
 # mqtt-accounts.yaml, every INTERVAL (2m).
 #
 # Manages the production broker `mosquitto` over its mTLS listener :8884
-# (REN-802 step 2, REN-900). The broker's one password_file login, `admin`
-# (mosquitto-deployment.yaml), is not a Dynamic Security client, so the
-# controller never sees or touches it.
+# (REN-802 step 2, REN-900).
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -87,6 +85,9 @@ subjects:
 #     delivered to this namespace. Add the name with the register entry.
 #   mqtt-ha-cert-sync: sha256 of the client certificate last accepted by
 #     Home Assistant's MQTT config entry (HA cert sync, REN-953/REN-1284).
+#   mqtt-<name>-password: the login of a password account delivered to this
+#     namespace, written, rewritten and deleted on revocation. One entry per
+#     account.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -99,6 +100,11 @@ rules:
     resources: ["secrets"]
     resourceNames: ["mqtt-account-hashes", "mqtt-dynsec-seed", "mqtt-ha-cert-sync"]
     verbs: ["get", "create", "patch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames:
+      - mqtt-admin-password
+    verbs: ["get", "create", "patch", "delete"]
   - apiGroups: [""]
     resources: ["secrets"]
     resourceNames:
@@ -219,7 +225,7 @@ spec:
         - name: controller
           # Woodpecker builds main-<sha> on every merge to main; no sortable
           # tag, so bumps are manual (same as ical-proxy).
-          image: gitea.renner.uno/konairius/mqtt-account-controller:main-cb96b1a@sha256:9d9b9e83a9c0f9f567e57edacab11cf4c58e8c0e49e38e8d7b51421cd1242911
+          image: gitea.renner.uno/konairius/mqtt-account-controller:main-b1f294d@sha256:8081adfee171c36cfa83734e5e7ccc3aad3debf1c0154488de70143674cde85f
           env:
             - name: BROKER_URL
               value: ssl://mosquitto.home-assistant.svc.cluster.local:8884
diff --git a/kubernetes/apps/home-assistant/mqtt-accounts.yaml b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
index f6471c76..0b52fa14 100644
--- a/kubernetes/apps/home-assistant/mqtt-accounts.yaml
+++ b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
@@ -7,17 +7,20 @@
 # configMapGenerator in kustomization.yaml). An empty list is refused, so it
 # never revokes everyone.
 #
-# The controller manages the production broker `mosquitto` (REN-900). Every
-# client account is listed here except `admin`, the owner's workstation login
-# in the broker's password_file (mosquitto-deployment.yaml): a password
-# account can only be delivered to shelly-manager or an esp32 API, and a cert
-# account only works on the in-cluster listener :8884. An entry named `admin`
-# would replace that login. `test-cert` is the certificate test account from
-# REN-888.
+# The controller manages the production broker `mosquitto` (REN-900).
+# `test-cert` is the certificate test account from REN-888.
 #
-# A cert account needs its Secret `mqtt-<name>-tls` added to the
+# A cert account needs its Secret `mqtt-<name>-tls`, a password account
+# delivered to a namespace its Secret `mqtt-<name>-password`, added to the
 # `mqtt-account-controller-secrets-<namespace>` Role in
-# mqtt-account-controller.yaml, or revoking it fails with 403.
+# mqtt-account-controller.yaml, or writing or revoking it fails with 403.
+# The owner's workstation login over the LoadBalancer (1883/8883). Password in
+# the Secret mqtt-admin-password (home-assistant); deleting the Secret makes a
+# new one.
+- name: admin
+  auth: password
+  deliver: {namespace: home-assistant}
+  acl: ["readwrite #"]
 - name: test-cert
   auth: cert
   deliver: {namespace: home-assistant}
-- 
2.54.0