From f6f5033b148ce0b9b06d3e2ebb0fb90e9dc2dc3e Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Thu, 16 Jul 2026 17:50:35 +0200 Subject: [PATCH] feat(shelly-manager): wire Home Assistant onboarding (BaseUrl + admin token) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Enables the single-click HA onboarding shipped in shelly-manager PR #41: shelly-manager registers a provisioned Shelly into HA's native integration by driving HA's config-flow + device-registry API. - shelly-manager-llat ExternalSecret projects the full-admin HA LLAT from OpenBao (apps/home-assistant/shelly-manager-llat, key 'token'). - HomeAssistant__BaseUrl = http://home-assistant (in-namespace svc :80 → nginx sidecar → HA :8123; nginx forwards the WS upgrade, so both the REST config- flow and the device-registry websocket work). Reachability confirmed: same- namespace ingress is allowed by the default-deny-ingress CNP's home-assistant rule (probed :80 → 401 = reachable). - HomeAssistant__Token from the new secret. Co-Authored-By: Claude Fable 5 --- .../apps/home-assistant/kustomization.yaml | 1 + .../shelly-manager-deployment.yaml | 14 ++++++++++++++ .../shelly-manager-llat-externalsecret.yaml | 18 ++++++++++++++++++ 3 files changed, 33 insertions(+) create mode 100644 kubernetes/apps/home-assistant/shelly-manager-llat-externalsecret.yaml diff --git a/kubernetes/apps/home-assistant/kustomization.yaml b/kubernetes/apps/home-assistant/kustomization.yaml index 2f434c58..706de8ba 100644 --- a/kubernetes/apps/home-assistant/kustomization.yaml +++ b/kubernetes/apps/home-assistant/kustomization.yaml @@ -24,6 +24,7 @@ resources: - shelly-manager-firmware-rbac.yaml - shelly-ble-proxy-key-externalsecret.yaml - shelly-manager-auth-externalsecret.yaml + - shelly-manager-llat-externalsecret.yaml - shelly-manager-deployment.yaml - shelly-manager-service.yaml - shelly-manager-gate-service.yaml diff --git a/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml b/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml index 3215e7cd..3db8b287 100644 --- a/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml +++ b/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml @@ -118,6 +118,20 @@ spec: value: X-authentik-username - name: Auth__ReverseProxy__TrustedProxies__0 value: 10.244.0.0/16 + # Home Assistant onboarding: single-click provisioning also registers + # the device in HA's native Shelly integration (with the admin + # password shelly-manager set) by driving HA's config-flow + device- + # registry WS API. BaseUrl is the in-namespace HA service (:80 → the + # nginx sidecar → HA :8123; nginx forwards the websocket upgrade, so + # both the config-flow REST and the device-registry WS work). Token is + # a full-admin HA LLAT from OpenBao (apps/home-assistant/shelly-manager-llat). + - name: HomeAssistant__BaseUrl + value: http://home-assistant + - name: HomeAssistant__Token + valueFrom: + secretKeyRef: + name: shelly-manager-llat + key: token volumeMounts: - name: data mountPath: /data diff --git a/kubernetes/apps/home-assistant/shelly-manager-llat-externalsecret.yaml b/kubernetes/apps/home-assistant/shelly-manager-llat-externalsecret.yaml new file mode 100644 index 00000000..e08a4312 --- /dev/null +++ b/kubernetes/apps/home-assistant/shelly-manager-llat-externalsecret.yaml @@ -0,0 +1,18 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: shelly-manager-llat + namespace: home-assistant +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: openbao + target: + name: shelly-manager-llat + # A Home Assistant admin long-lived access token. HA has no fine-grained + # tokens, so this is full-admin — shelly-manager uses it only to drive the + # config-flow API (create/verify/delete the Shelly entries it provisions). + dataFrom: + - extract: + key: apps/home-assistant/shelly-manager-llat -- 2.54.0