k8s: work with `kubectl apply -f` as well as `-k`

nils/mg4

- The secrets template moves to k8s/secrets/, and the filled-in copy to
  k8s/secrets/secrets.yaml (gitignored). `kubectl apply -f k8s/` does
  not recurse, so neither the placeholder template nor the real secrets
  can be applied by accident.
- The server image digest is pinned in server.yaml instead of through
  kustomize's images override, which `-f` ignores (it would have pulled
  a nonexistent :latest).
- README and kustomization.yaml say to use `-k`: plain `-f` never
  creates the generated Grafana ConfigMaps.
- The IngressRoutes drop `tls: {}`, like the other routes on this
  Traefik: TLS is configured on the websecure entrypoint.

Manifests validated both ways (14 resources rendered with kustomize,
11 as plain files — the difference is the Grafana ConfigMaps).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

This commit is contained in:

nils

2026-10-17 21:36:17 +02:00

co-authored by

Claude Opus 5.5

parent 46dccee1de

commit 84fb3aac21

7 changed files with 26 additions and 24 deletions

.gitignore

+2 -1

View File

@@ -40,5 +40,6 @@ mise.local.toml
 /EVHardware/.gradle
 /EVHardware/**/build
 # Filled-in Kubernetes Secrets (copy of k8s/secrets.example.yaml). Never commit.
 # Filled-in Kubernetes Secrets (copy of k8s/secrets/secrets.example.yaml). Never commit.
 /k8s/secrets.yaml
 /k8s/secrets/secrets.yaml

k8s: work with kubectl apply -f as well as -k

k8s: work with `kubectl apply -f` as well as `-k`