Home Assistant Helm Chart

The chart can render a Kubernetes Gateway API HTTPRoute. This is an alternative to traditional Ingress.

Prerequisites

This chart only renders the HTTPRoute resource. You must manually install:

1. Gateway API CRDs (e.g., via kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml).
2. A Gateway controller (e.g., Envoy Gateway, NGINX Gateway Fabric, or Istio) and a Gateway resource.

Configuration

• httpRoute.enabled: Enables the route.
• httpRoute.parentRefs: Required. Defines which Gateway the route attaches to.
• httpRoute.hostnames: List of hostnames for the route.
• httpRoute.matches: Defines custom path matching. If empty, it defaults to a PathPrefix: / match.

Enabling httpRoute automatically applies reverse-proxy settings (use_x_forwarded_for / trusted_proxies) to Home Assistant.

httpRoute:
  enabled: true
  parentRefs:
    - name: example-gateway
      namespace: gateway-system
  hostnames:
    - home-assistant.example.com
  matches:
    - path:
        type: PathPrefix
        value: /

The code-server addon can be enabled via addons.codeserver.enabled: true. While authentication is disabled by default, it is strongly recommended to enable it. You have four ways to configure authentication:

1. Existing Kubernetes Secret (Recommended for Production): Use a secret containing a password key.
2. Direct Password: Set the password directly in your Helm values.
3. Random Password: Let code-server generate one; retrieve it from the container logs.
4. Disable Authentication: (Not recommended for production).

To access the addon, you must also enable ingress (addons.codeserver.ingress.enabled: true) or set the service type to NodePort or LoadBalancer.

# Option 1: Using an existing secret
addons:
  codeserver:
    enabled: true
    auth:
      enabled: true
      existingSecret: "my-codeserver-secret"

# Option 2: Setting a password directly
addons:
  codeserver:
    enabled: true
    auth:
      enabled: true
      password: "my-secure-password"

# Option 3: Random password (retrieve via kubectl logs)
addons:
  codeserver:
    enabled: true
    auth:
      enabled: true

Starting with Home Assistant version 2026.8, the http: block in configuration.yaml is deprecated and will stop working in version 2027.2. Settings are now managed in /config/.storage/http via the UI.

How the chart handles this:

• For 2026.8+ (or non-semver tags like stable): If ingress or httpRoute is enabled, the chart's init script seeds /config/.storage/http with use_x_forwarded_for and configuration.trusted_proxies only on fresh installs. Existing installations are left untouched to preserve UI-managed settings.
• For versions older than 2026.8: The chart continues to render the http: block into configuration.yaml.

Important for existing users upgrading to 2026.8+:

1. Home Assistant will import your http: block into the UI once and raise a repair issue.
2. Verify the values in Settings > System > Network.
3. Manually delete the http: block from your /config/configuration.yaml (the chart will not do this for you).
4. Note that changing configuration.trusted_proxies in Helm values will not affect a running 2026.8+ instance; you must update proxies via the UI.

For advanced use cases like exposing IoT devices (e.g., DLNA) or specific webhook paths, use additionalIngresses.

Each additional ingress supports:

• name: Unique identifier (prefixed with <release>-home-assistant-).
• className: Ingress class name.
• rules: A list of rules containing host (optional) and paths.
• paths: Contains path, pathType (Exact, Prefix, or ImplementationSpecific), serviceName (defaults to main HA service), and servicePort (defaults to service.port).
• annotations and tls configurations.

# Example: Exposing a DLNA service via an additional ingress
additionalPorts:
  - name: dlna
    containerPort: 5555
    protocol: TCP

additionalServices:
  - name: dlna
    port: 5555
    targetPort: dlna
    type: ClusterIP
    protocol: TCP

additionalIngresses:
  - name: dlna
    annotations:
      nginx.ingress.kubernetes.io/ssl-redirect: "false"
    rules:
      - paths:
          - path: /notify
            pathType: Prefix
            serviceName: home-assistant-dlna
            servicePort: 5555