From 6f57351866c193f90cc5ca34372cb3f9e0861e76 Mon Sep 17 00:00:00 2001 From: Nils Stinnesbeck Date: Sat, 17 Oct 2026 18:16:52 +0200 Subject: [PATCH] Use the traefik-internal ingress class Both IngressRoutes (server and Grafana) now use traefik-internal, like the rest of *.k8s.stinnesbeck.com, instead of the traefik-external placeholder. README and SPECS updated. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki --- SPECS.md | 3 +-- k8s/README.md | 4 ++-- k8s/ingress.yaml | 10 ++++------ 3 files changed, 7 insertions(+), 10 deletions(-) diff --git a/SPECS.md b/SPECS.md index 0a4df47..7272a3c 100644 --- a/SPECS.md +++ b/SPECS.md @@ -41,8 +41,7 @@ car ──live telemetry───▶ car.k8s.stinnesbeck.com (Go) ──▶ ABRP - [x] Car app 2.4.0 (pairing by QR): unit tests pass; **not yet tried on the car**. - [x] Image `mg4-server:2.1.0` (with pairing) pushed to git.stinnesbeck.com (public; pinned by digest `sha256:e5f6e2d2…` in `k8s/kustomization.yaml`). -- [ ] Check in `k8s/ingress.yaml`: the Traefik ingress class (placeholder `traefik-external`) and - Grafana's host (placeholder `car-grafana.k8s.stinnesbeck.com`). +- [ ] Check Grafana's host in `k8s/ingress.yaml` (placeholder `car-grafana.k8s.stinnesbeck.com`). - [ ] First pairing and drive with 2.4.0: telemetry arrives in InfluxDB, Grafana and ABRP. ## To do diff --git a/k8s/README.md b/k8s/README.md index d448687..27b4bd2 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -17,8 +17,8 @@ is applied automatically. Apply them yourself. ## Before the first apply -1. **Check `ingress.yaml`:** the ingress class (placeholder `traefik-external` for the public - Traefik) and Grafana's host (placeholder `car-grafana.k8s.stinnesbeck.com`). Both hosts must be +1. **Check `ingress.yaml`:** Grafana's host (placeholder `car-grafana.k8s.stinnesbeck.com`). + Both routes use the `traefik-internal` class, and both hosts must be covered by Traefik's default certificate. 2. **Create the Secrets.** `cp k8s/secrets.example.yaml k8s/secrets.yaml` (gitignored), replace every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token, diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml index 9e86840..335dc03 100644 --- a/k8s/ingress.yaml +++ b/k8s/ingress.yaml @@ -1,14 +1,12 @@ -# Public routes. TLS uses Traefik's default certificate, so there is no per-host -# Certificate here. +# Routes on the traefik-internal class, like the rest of *.k8s.stinnesbeck.com. TLS uses +# Traefik's default certificate, so there is no per-host Certificate here. apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: mg4-server namespace: mg4 annotations: - # CHECK: the class of your public-facing Traefik. Your internal example uses - # "traefik-internal"; these hosts must be served by the external one. - kubernetes.io/ingress.class: traefik-external + kubernetes.io/ingress.class: traefik-internal spec: entryPoints: - websecure @@ -28,7 +26,7 @@ metadata: name: grafana namespace: mg4 annotations: - kubernetes.io/ingress.class: traefik-external # CHECK, as above + kubernetes.io/ingress.class: traefik-internal spec: entryPoints: - websecure