jklein
55f5aefdbe
Home Assistant reads configuration.yaml, http-config.yaml and recorder-config.yaml from a 1Password-backed Secret, mounted with subPath. Two different gaps hide behind that, and only one of them can be closed. Repointing secrets.configSecretRef at a different vault item used to leave the running pod on the old configuration. That is now covered: the pod template carries checksum/secret-ref over the rendered OnePasswordItem. The annotation is named apart from checksum/config on purpose - it only promises that the config source changed, not the config itself - matching the pattern minecraft-server introduced. Changing the CONTENT of the item in the vault still does not restart anything, and cannot: Helm never sees the content, so there is nothing to hash. The operator's own auto-restart annotation is no way out either - onepassword- operator 1.12.0 enumerates exactly one workload type in its secret-update handler (appsv1.DeploymentList) and this workload is a StatefulSet, so the annotation would be a silent no-op advertising a guarantee it cannot keep. It is deliberately not set. values.yaml states the limitation and the manual rollout restart it requires; the README guideline records the operator finding, the annotation precedence trap, and the checksum/secret-ref pattern so neither is rediscovered the hard way. Major bump: runtime behavior changes - changing the secret reference now costs a restart. For this release the effect is preventive, since it currently runs at zero replicas via scaleDown.
12 lines
266 B
YAML
12 lines
266 B
YAML
apiVersion: v2
|
|
name: homeassistant
|
|
description: A Helm chart to deploy Home Assistant on Kubernetes
|
|
icon: https://www.home-assistant.io/images/home-assistant-logo.svg
|
|
type: application
|
|
|
|
version: 5.0.0+up2026.8.3
|
|
|
|
appVersion: "2026.8.3"
|
|
|
|
maintainers:
|
|
- name: jklein |