nilsandClaude Opus 5.5
84fb3aac21
- The secrets template moves to k8s/secrets/, and the filled-in copy to
k8s/secrets/secrets.yaml (gitignored). `kubectl apply -f k8s/` does
not recurse, so neither the placeholder template nor the real secrets
can be applied by accident.
- The server image digest is pinned in server.yaml instead of through
kustomize's images override, which `-f` ignores (it would have pulled
a nonexistent :latest).
- README and kustomization.yaml say to use `-k`: plain `-f` never
creates the generated Grafana ConfigMaps.
- The IngressRoutes drop `tls: {}`, like the other routes on this
Traefik: TLS is configured on the websecure entrypoint.
Manifests validated both ways (14 resources rendered with kustomize,
11 as plain files — the difference is the Grafana ConfigMaps).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
42 lines
1.0 KiB
YAML
42 lines
1.0 KiB
YAML
# Routes on the traefik-internal class, like the rest of *.k8s.stinnesbeck.com. No tls section
|
|
# and no per-host Certificate: TLS is configured on Traefik's websecure entrypoint, which serves
|
|
# the default certificate.
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: mg4-server
|
|
namespace: mg4
|
|
annotations:
|
|
kubernetes.io/ingress.class: traefik-internal
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- kind: Rule
|
|
match: Host(`car.k8s.stinnesbeck.com`)
|
|
services:
|
|
- kind: Service
|
|
name: mg4-server
|
|
namespace: mg4
|
|
port: 80
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: grafana
|
|
namespace: mg4
|
|
annotations:
|
|
kubernetes.io/ingress.class: traefik-internal
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- kind: Rule
|
|
# CHECK: placeholder host. It must be covered by Traefik's default certificate.
|
|
match: Host(`car-grafana.k8s.stinnesbeck.com`)
|
|
services:
|
|
- kind: Service
|
|
name: grafana
|
|
namespace: mg4
|
|
port: 80
|