diff --git a/SPECS.md b/SPECS.md index c03218d..3eb0e69 100644 --- a/SPECS.md +++ b/SPECS.md @@ -109,6 +109,12 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does * INGEST_TOKEN) into git and pushed it. Commit amended and force-pushed; both values regenerated in the now gitignored `k8s/secrets.yaml` (since moved to `k8s/secrets/secrets.yaml`, outside `kubectl apply -f k8s/`). Filled-in secrets live only there from now on. +- 2026-10-18 — Grafana's read-only InfluxDB token without a manual step: an init container in + the Grafana pod creates it with the admin token at every start, deletes the previous one and + leaves only the read-only token in a memory volume; the datasource reads it with + `$__file{/run/influx/token}`. InfluxDB ignores chosen token values (tested), so it cannot come + from the Secret. The `grafana-influx` Secret is gone. Tested in podman: InfluxDB 2.7.12, the + script as the Grafana user (twice: rotates, no pile-up), Grafana 13.2.3 datasource healthy. - 2026-10-18 — App 2.16.0, server 2.6.0: over-the-air updates from this repository. `publish-car` creates the pre-release `car-` on the private forge with the APK and its `.sha256`; the server relays releases and attachments to the car (`/v1/app/…`, read with a read-only diff --git a/k8s/README.md b/k8s/README.md index fbad856..cefdaa7 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -22,8 +22,8 @@ is applied automatically. Apply them yourself. covered by Traefik's default certificate. 2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token, - approval password for pairing), `grafana-admin` and - `grafana-influx` (see below). Keep the template itself on placeholders only. + approval password for pairing, the forge token for app updates) and `grafana-admin`. + Keep the template itself on placeholders only. 3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`. @@ -40,25 +40,11 @@ ConfigMaps (datasource and dashboards) are never created and Grafana does not st ## Grafana's InfluxDB token -Grafana reads InfluxDB with a token that can only read the `mg4` bucket, from the -`grafana-influx` Secret. InfluxDB has to create that token, so it is a step of its own: - -1. With InfluxDB running, create the token. The `influx` CLI in the pod is already signed in - as admin: - - ```sh - kubectl -n mg4 exec influxdb-0 -- sh -c \ - 'influx auth create --org mg4 --description grafana-read-only --json \ - --read-bucket "$(influx bucket find --name mg4 --hide-headers | cut -f1)"' - ``` - -2. Copy the `"token"` value from the output into `grafana-influx` → `token` in - `k8s/secrets/secrets.yaml`, apply that file, and restart Grafana: - `kubectl -n mg4 rollout restart deployment/grafana`. - -Until the Secret exists, Grafana does not start (the container waits for the missing Secret). -On a fresh install, apply everything once without Grafana working, create the token, then -apply the Secret. +Grafana reads InfluxDB with a token that can only read the `mg4` bucket. Nothing to do: an init +container in the Grafana pod creates it at every start with the admin token, deletes the one +from the previous start, and hands Grafana only the read-only token (in a memory-backed volume). +The Grafana process itself never sees the admin token. InfluxDB generates every token but the +admin one itself, which is why this cannot be a value in the Secret. ## App updates @@ -73,7 +59,7 @@ and `FORGE_REPO` are set in `server.yaml`. - InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later does not change the token inside InfluxDB. - The server uses the InfluxDB admin token; a token scoped to read/write on the `mg4` bucket can - replace it later. Grafana has its own read-only token (below). + replace it later. Grafana has its own read-only token (above). - The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the ConfigMap name changes with its content, which rolls Grafana. - The server image is pinned by digest in `server.yaml`. To upgrade, push a new tag and put its diff --git a/k8s/grafana.yaml b/k8s/grafana.yaml index 0cc1911..6c8a9d7 100644 --- a/k8s/grafana.yaml +++ b/k8s/grafana.yaml @@ -1,6 +1,12 @@ # Grafana for the dashboards. The InfluxDB datasource and the three MG4 dashboards are # provisioned from k8s/grafana/ (ConfigMaps generated by kustomization.yaml); the dashboards # are read-only in the UI — change the JSON in git instead. +# +# Grafana reads InfluxDB with a token that can only read the mg4 bucket. InfluxDB generates +# every token but the admin one (a chosen value is ignored), so the init container makes it at +# each start: it alone gets the admin token, creates a fresh read-only token, deletes the one +# from the previous start, and leaves only the read-only token in a memory-backed volume for +# Grafana. Nothing to do by hand, and the Grafana process never sees the admin token. apiVersion: v1 kind: PersistentVolumeClaim metadata: @@ -44,6 +50,46 @@ spec: fsGroup: 472 seccompProfile: type: RuntimeDefault + initContainers: + - name: influx-read-token + image: docker.io/library/influxdb:2.7.12-alpine + command: + - sh + - -c + - | + set -eu + desc="grafana read-only (made by the Grafana pod at start)" + export INFLUX_CONFIGS_PATH=/tmp/influx-configs + bucket=$(influx bucket find --name mg4 --hide-headers | cut -f1) + old=$(influx auth list --hide-headers | awk -F'\t' -v d="$desc" '$2 == d { print $1 }') + token=$(influx auth create --description "$desc" --read-bucket "$bucket" --hide-headers | cut -f3) + [ -n "$token" ] || { echo "no token created" >&2; exit 1; } + printf '%s' "$token" > /run/influx/token + for id in $old; do influx auth delete --id "$id" > /dev/null; done + echo "read-only token for Grafana ready" + env: + - name: INFLUX_HOST + value: http://influxdb.mg4.svc:8086 + - name: INFLUX_ORG + value: mg4 + - name: INFLUX_TOKEN + valueFrom: + secretKeyRef: + name: influxdb-auth + key: admin-token + volumeMounts: + - name: influx-token + mountPath: /run/influx + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + memory: 128Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] containers: - name: grafana image: docker.io/grafana/grafana:13.2.3 @@ -68,16 +114,9 @@ spec: value: "false" - name: GF_ANALYTICS_CHECK_FOR_UPDATES value: "false" - # Read by datasources.yaml. + # Read by datasources.yaml; the token is the file the init container wrote. - name: INFLUX_URL value: http://influxdb.mg4.svc:8086 - # Read-only on the mg4 bucket; the dashboards never write (README, "Grafana's - # InfluxDB token"). - - name: INFLUX_TOKEN - valueFrom: - secretKeyRef: - name: grafana-influx - key: token volumeMounts: - name: data mountPath: /var/lib/grafana @@ -87,6 +126,9 @@ spec: mountPath: /etc/grafana/provisioning/dashboards - name: dashboards mountPath: /var/lib/grafana/dashboards/mg4 + - name: influx-token + mountPath: /run/influx + readOnly: true # The first start creates and migrates Grafana's database: measured 44 s at 0.5 CPU # and 3 minutes at 0.1 CPU. The startup probe allows up to 10 minutes for that, and # liveness/readiness only begin once it succeeded, so a slow first start is never @@ -136,6 +178,11 @@ spec: - name: dashboards configMap: name: grafana-dashboards + # The read-only InfluxDB token, in memory only; made anew at every start. + - name: influx-token + emptyDir: + medium: Memory + sizeLimit: 1Mi --- apiVersion: v1 kind: Service diff --git a/k8s/grafana/datasources.yaml b/k8s/grafana/datasources.yaml index 5d83a9a..cf0094e 100644 --- a/k8s/grafana/datasources.yaml +++ b/k8s/grafana/datasources.yaml @@ -1,5 +1,6 @@ -# Provisioned InfluxDB datasource. URL and token come from the Grafana container's -# environment (INFLUX_URL, INFLUX_TOKEN), so no credential is stored in this file. +# Provisioned InfluxDB datasource. The URL comes from the environment (INFLUX_URL); the token is +# a read-only one the Grafana pod's init container writes to /run/influx/token at each start +# (grafana.yaml). No credential is stored in this file. apiVersion: 1 datasources: - name: InfluxDB (mg4) @@ -14,4 +15,4 @@ datasources: organization: mg4 defaultBucket: mg4 secureJsonData: - token: $INFLUX_TOKEN + token: $__file{/run/influx/token} diff --git a/k8s/secrets/secrets.example.yaml b/k8s/secrets/secrets.example.yaml index b47a58d..1d20e10 100644 --- a/k8s/secrets/secrets.example.yaml +++ b/k8s/secrets/secrets.example.yaml @@ -41,14 +41,3 @@ stringData: # Grafana's admin login (user "admin"). Only read on first start: change it in Grafana # afterwards, or reset it with grafana cli. admin-password: CHANGE-ME ---- -apiVersion: v1 -kind: Secret -metadata: - name: grafana-influx - namespace: mg4 -type: Opaque -stringData: - # A read-only InfluxDB token for the mg4 bucket, not the admin token. InfluxDB makes it; - # the command is in k8s/README.md ("Grafana's InfluxDB token"). - token: CHANGE-ME-read-only-token-from-influx-auth-create