# Kubernetes manifests — car.k8s.stinnesbeck.com

Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here
is applied automatically. Apply them yourself.

| File | What |
|---|---|
| `namespace.yaml` | Namespace `mg4` |
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
| `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
| `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
| `ingress.yaml` | Traefik `IngressRoute`s for car.k8s.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
| `secrets/secrets.example.yaml` | **Template** for the Secrets; placeholders only, not in `kustomization.yaml` |
| `secrets/secrets.yaml` | Your filled-in copy — **gitignored**, never committed |
| `kustomization.yaml` | Everything except the Secrets; generates the Grafana ConfigMaps |

## Before the first apply

1. **Check `ingress.yaml`:** Grafana's host (placeholder `car-grafana.k8s.stinnesbeck.com`).
   Both routes use the `traefik-internal` class, and both hosts must be
   covered by Traefik's default certificate.
2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace
   every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
   approval password for pairing), `grafana-admin` and
   `grafana-influx` (see below). Keep the template itself on placeholders only.
3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
   secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.

## Apply

```sh
kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/secrets/secrets.yaml
kubectl apply -k k8s/
```

Use **`-k`**, not `-f k8s/`: plain `-f` applies the files without kustomize, so the Grafana
ConfigMaps (datasource and dashboards) are never created and Grafana does not start.

## Grafana's InfluxDB token

Grafana reads InfluxDB with a token that can only read the `mg4` bucket, from the
`grafana-influx` Secret. InfluxDB has to create that token, so it is a step of its own:

1. With InfluxDB running, create the token. The `influx` CLI in the pod is already signed in
   as admin:

   ```sh
   kubectl -n mg4 exec influxdb-0 -- sh -c \
     'influx auth create --org mg4 --description grafana-read-only --json \
        --read-bucket "$(influx bucket find --name mg4 --hide-headers | cut -f1)"'
   ```

2. Copy the `"token"` value from the output into `grafana-influx` → `token` in
   `k8s/secrets/secrets.yaml`, apply that file, and restart Grafana:
   `kubectl -n mg4 rollout restart deployment/grafana`.

Until the Secret exists, Grafana does not start (the container waits for the missing Secret).
On a fresh install, apply everything once without Grafana working, create the token, then
apply the Secret.

## App updates

The server relays the app's releases from the private repository to the car's updater
(`OTA.md`). It reads them with `FORGE_TOKEN` from the `mg4-server` Secret: create a token in
the forge that can only **read** the `nils/mg4` repository, put it there, apply the Secret and
restart the server. Without it, updates are off (the car's updater gets a 404). `FORGE_URL`
and `FORGE_REPO` are set in `server.yaml`.

## Notes

- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
  does not change the token inside InfluxDB.
- The server uses the InfluxDB admin token; a token scoped to read/write on the `mg4` bucket can
  replace it later. Grafana has its own read-only token (below).
- The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
  ConfigMap name changes with its content, which rolls Grafana.
- The server image is pinned by digest in `server.yaml`. To upgrade, push a new tag and put its
  digest there (`skopeo inspect docker://git.stinnesbeck.com/nils/mg4-server:<tag>`).