# Kubernetes manifests — car.stinnesbeck.com

Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here
is applied automatically. Apply them yourself.

| File | What |
|---|---|
| `namespace.yaml` | Namespace `mg4` |
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
| `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
| `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
| `ingress.yaml` | Traefik `IngressRoute`s for car.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
| `secrets.example.yaml` | **Template** for the Secrets; not in `kustomization.yaml` |
| `kustomization.yaml` | Everything except the Secrets; pins the server image, generates the Grafana ConfigMaps |

## Before the first apply

1. **Check `ingress.yaml`:** the ingress class (placeholder `traefik-external` for the public
   Traefik) and Grafana's host (placeholder `car-grafana.stinnesbeck.com`). Both hosts must be
   covered by Traefik's default certificate.
2. **Create the Secrets.** Copy `secrets.example.yaml` outside the repository, replace every
   `CHANGE-ME` (`openssl rand -hex 32`), then apply the copy: `influxdb-auth`, `mg4-server`
   (ingest token, your ABRP API key and user token) and `grafana-admin`.
3. **Registry access.** If the `mg4-server` package on git.stinnesbeck.com is private, create the
   `git-stinnesbeck-registry` pull secret (command in `secrets.example.yaml`); if it is public,
   delete `imagePullSecrets` from `server.yaml`.

## Apply

```sh
kubectl apply -f k8s/namespace.yaml
kubectl apply -f <your filled-in secrets file>
kubectl apply -k k8s/
```

## Notes

- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
  does not change the token inside InfluxDB.
- The server and Grafana use the InfluxDB admin token. A token scoped to the `mg4` bucket (read
  for Grafana, read/write for the server) can replace it later.
- The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
  ConfigMap name changes with its content, which rolls Grafana.
- To upgrade the server, push a new image tag and change `newTag` in `kustomization.yaml`.