nilsandClaude Opus 5.5
eebe840b6a
A finished signal recording goes to an outbox and is sent gzipped with
the car's token (PUT /v1/logs/{name}); the service retries every 2
minutes while the car is offline. The server keeps the newest 200 on a
new volume (LOGS_DIR); reading takes a token of its own (LOGS_TOKEN).
fetch-logs in the dev shell fetches new ones into logs/.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6
82 lines
4.6 KiB
Markdown
82 lines
4.6 KiB
Markdown
# Kubernetes manifests — car.k8s.stinnesbeck.com
|
|
|
|
Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here
|
|
is applied automatically. Apply them yourself.
|
|
|
|
| File | What |
|
|
|---|---|
|
|
| `namespace.yaml` | Namespace `mg4` |
|
|
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
|
|
| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem), Service, and two 1Gi PVCs: the map tile cache and the logs the car sends |
|
|
| `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
|
|
| `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
|
|
| `ingress.yaml` | Traefik `IngressRoute`s for car.k8s.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
|
|
| `secrets/secrets.example.yaml` | **Template** for the Secrets; placeholders only, not in `kustomization.yaml` |
|
|
| `secrets/secrets.yaml` | Your filled-in copy — **gitignored**, never committed |
|
|
| `kustomization.yaml` | Everything except the Secrets; generates the Grafana ConfigMaps |
|
|
|
|
## Before the first apply
|
|
|
|
1. **Check `ingress.yaml`:** Grafana's host (placeholder `car-grafana.k8s.stinnesbeck.com`).
|
|
Both routes use the `traefik-internal` class, and both hosts must be
|
|
covered by Traefik's default certificate.
|
|
2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace
|
|
every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
|
|
approval password for pairing, the forge token for app updates, the token that reads the
|
|
car's logs) and `grafana-admin`.
|
|
Keep the template itself on placeholders only.
|
|
3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
|
|
secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
|
|
|
|
## Apply
|
|
|
|
```sh
|
|
kubectl apply -f k8s/namespace.yaml
|
|
kubectl apply -f k8s/secrets/secrets.yaml
|
|
kubectl apply -k k8s/
|
|
```
|
|
|
|
Use **`-k`**, not `-f k8s/`: plain `-f` applies the files without kustomize, so the Grafana
|
|
ConfigMaps (datasource and dashboards) are never created and Grafana does not start.
|
|
|
|
## Grafana's InfluxDB token
|
|
|
|
Grafana reads InfluxDB with a token that can only read the `mg4` bucket. Nothing to do: an init
|
|
container in the Grafana pod creates it at every start with the admin token, deletes the one
|
|
from the previous start, and hands Grafana only the read-only token (in a memory-backed volume).
|
|
The Grafana process itself never sees the admin token. InfluxDB generates every token but the
|
|
admin one itself, which is why this cannot be a value in the Secret.
|
|
|
|
## App updates
|
|
|
|
The server relays the app's releases from the private repository to the car's updater
|
|
(`OTA.md`). It reads them with `FORGE_TOKEN` from the `mg4-server` Secret: create a token in
|
|
the forge that can only **read** the `nils/mg4` repository, put it there, apply the Secret and
|
|
restart the server. Without it, updates are off (the car's updater gets a 404). `FORGE_URL`
|
|
and `FORGE_REPO` are set in `server.yaml`.
|
|
|
|
## Logs from the car
|
|
|
|
The car sends its signal recordings to the server (`server/README.md`, "Logs from the car"),
|
|
which keeps them on the `mg4-server-logs` volume at `LOGS_DIR`. Reading them needs `LOGS_TOKEN`
|
|
from the `mg4-server` Secret: `openssl rand -hex 32`, put it there (it must differ from
|
|
`INGEST_TOKEN`), apply the Secret and restart the server. For `fetch-logs` on your machine, put
|
|
the same value in `~/.config/nilsmg4/logs-token`. Without it the car still sends; nobody can read.
|
|
|
|
## Agent access
|
|
|
|
[`agent-access/`](agent-access/README.md) creates a service account limited to the `mg4`
|
|
namespace (read-only by default, no Secrets, no exec) and a script that writes a kubeconfig with a
|
|
time-limited token for it. Applied separately, with `kubectl apply -k k8s/agent-access/`.
|
|
|
|
## Notes
|
|
|
|
- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
|
|
does not change the token inside InfluxDB.
|
|
- The server uses the InfluxDB admin token; a token scoped to read/write on the `mg4` bucket can
|
|
replace it later. Grafana has its own read-only token (above).
|
|
- The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
|
|
ConfigMap name changes with its content, which rolls Grafana.
|
|
- The server image is pinned by digest in `server.yaml`. To upgrade, push a new tag and put its
|
|
digest there (`skopeo inspect docker://git.stinnesbeck.com/nils/mg4-server:<tag>`).
|