helm-charts/homeassistant/values.yaml

# Scale the whole chart down without uninstalling it: scaleDown: true renders
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
# takes precedence over any per-workload replicas value. PVCs, Secrets and
# Services stay in place; scaleDown: false brings the workloads back up.
scaleDown: false

# Replica count for this workload; 0 is allowed and scales it down.
# The chart-global scaleDown flag takes precedence.
replicas: 1

# This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
service:
  # This sets the service type more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
  type: ClusterIP
  # This sets the ports more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#field-spec-ports
  port: 80

# This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
ingress:
  enabled: false
  # Ingress class; set to "" to omit ingressClassName from the rendered Ingress.
  className: nginx
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  hosts:
    - host: chart-example.local
      paths:
        - path: /
          pathType: ImplementationSpecific
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

# Documented deviation from the repo-wide hardening standard: the official
# Home Assistant container must start as root — it boots via the s6-overlay
# init system, which performs its setup as uid 0 (the image supports no
# non-root user), so runAsNonRoot/runAsUser are deliberately not set.
# Everything else is hardened: no privilege escalation, all capabilities
# dropped and a read-only root filesystem with writable emptyDirs for
# /tmp and /run (s6-overlay state). NET_RAW is added back because Home
# Assistant's device discovery (DHCP watcher, ping/arp integrations) uses
# raw sockets and logs "Operation not permitted" without it.
securityContext:
  pod: {}
  container:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop:
        - ALL
      add:
        - NET_RAW

resources:
  # Limits are optional: memory and ephemeral-storage limits default to
  # limitFactor x the request, an explicitly set limit always wins, and a
  # CPU limit is only set when configured explicitly under "limits".
  limitFactor: 3
  requests:
    cpu: 0.2
    memory: 512Mi
    ephemeralStorage: 128Mi

# This is to setup the liveness, readiness and startup probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
livenessProbe:
  httpGet:
    path: /
    port: http
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 3
readinessProbe:
  httpGet:
    path: /
    port: http
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 3
# The startup probe gates liveness/readiness. Home Assistant can take a while to
# start up, so grant a generous budget: 10s * 30 = 300s.
startupProbe:
  httpGet:
    path: /
    port: http
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 30

# Extra environment variables, appended to the ones the chart always sets.
# Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
# forms are supported.
env: []

# Additional volumes on the output Deployment definition.
volumes: []
# - name: foo
#   secret:
#     secretName: mysecret
#     optional: false

# Additional volumeMounts on the output Deployment definition.
volumeMounts: []
# - name: foo
#   mountPath: "/etc/foo"
#   readOnly: true

nodeSelector: {}

tolerations: []

affinity: {}

core:
  timezone: "UTC"
  storage:
    size: 5Gi
    storageClass: "default"

# Must include the following keys:
# - config
# - http-config
# - recorder-config
#
# Changing the op:// path below IS covered: the StatefulSet carries a
# checksum/secret-ref annotation over the rendered OnePasswordItem, so pointing
# this value at a different vault item restarts the pod.
#
# Known limitation (#82): changing the CONTENT of that item in the vault does
# NOT restart Home Assistant. The operator updates the Kubernetes Secret, but
# the running pod keeps the old files - they are mounted with subPath, which the
# kubelet never refreshes, and Home Assistant reads its configuration only at
# start. The change then takes effect at some unrelated later restart, possibly
# months afterwards, and a broken value surfaces long after the edit that caused
# it. That is especially likely for this release, which is currently kept at
# zero replicas via scaleDown: whoever brings it back up gets whatever the vault
# holds at that moment.
#
# The checksum/config mechanism the other charts use cannot close this gap:
# Helm never sees the content (the operator fills the Secret in-cluster after
# rendering), so there is nothing to hash. The operator's own
# "operator.1password.io/auto-restart" annotation does not close it either - it
# only ever restarts Deployments, never StatefulSets. Verified against
# onepassword-operator 1.12.0: pkg/onepassword/secret_update_handler.go lists
# exactly one workload type (appsv1.DeploymentList), and the PR adding
# StatefulSets is still open. Setting the annotation here would look like a fix
# and do nothing, so this chart deliberately does not set it.
#
# After changing the item, restart Home Assistant by hand:
#   kubectl rollout restart statefulset <release>-homeassistant-sfs
secrets:
  configSecretRef: null