fix: [alert] HomeAssistantDown (home-assistant) (#1081 )

2026-10-01 02:44:10 +00:00
5 changed files with 13 additions and 3 deletions
@@ -4,7 +4,7 @@ metadata:
  name: home-assistant-config-sync-token
  namespace: home-assistant
 spec:
-  refreshInterval: 1h
+  refreshInterval: 1m # rotator revokes the old LLAT immediately — see prometheus-token-externalsecret.yaml
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao
@@ -1,10 +1,14 @@
+# refreshInterval is 1m: the rotator (openbao/rotation/home-assistant.yaml)
+# revokes the old LLAT seconds after storing the new one, so until ESO re-reads,
+# this Secret holds a DEAD token. At 1h that gap fired HomeAssistantDown (401
+# scrapes, issue #1081); 1m keeps it under the alert's `for: 5m`.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: home-assistant-prometheus-token
  namespace: home-assistant
 spec:
-  refreshInterval: 1h
+  refreshInterval: 1m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao
@@ -4,7 +4,7 @@ metadata:
  name: shelly-manager-llat
  namespace: home-assistant
 spec:
-  refreshInterval: 1h
+  refreshInterval: 1m # rotator revokes the old LLAT immediately — see prometheus-token-externalsecret.yaml
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao
@@ -4,6 +4,9 @@ metadata:
  name: speech-to-phrase
  labels:
    app.kubernetes.io/name: speech-to-phrase
+  annotations:
+    # The token is read once at startup (--hass-token); restart on quarterly rotation.
+    secret.reloader.stakater.com/reload: home-assistant-prometheus-token
 spec:
  replicas: 1
  strategy:
@@ -4,6 +4,9 @@ metadata:
  name: zone-configurator
  labels:
    app.kubernetes.io/name: zone-configurator
+  annotations:
+    # The token is read once at startup (env); restart on quarterly rotation.
+    secret.reloader.stakater.com/reload: home-assistant-prometheus-token
 spec:
  replicas: 1
  strategy: