mg4/k8s/README.md

Kubernetes manifests — car.stinnesbeck.com

Plain manifests for the car server and its InfluxDB 2. They are only files: nothing here is applied automatically. Apply them yourself.

File	What
namespace.yaml	Namespace mg4
influxdb.yaml	InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy allowing only the server
server.yaml	Server Deployment (1 replica, non-root, read-only root filesystem) and Service
ingress.yaml	cert-manager Certificate from letsencrypt-prod, Traefik IngressRoute on websecure
secrets.example.yaml	Template for the two Secrets; not in kustomization.yaml
kustomization.yaml	Everything except the Secrets; pins the server image tag

Before the first apply

1. Check the ingress class in ingress.yaml. It is set to traefik-external as a placeholder; use the class of your public-facing Traefik.
2. Create the Secrets. Copy secrets.example.yaml outside the repository, replace every CHANGE-ME (openssl rand -hex 32 for tokens), then apply the copy: influxdb-auth (InfluxDB admin password and token) and mg4-server (ingest token, session secret, dashboard password, your ABRP API key and user token).
3. Registry access. If the mg4-server package on git.stinnesbeck.com is private, create the git-stinnesbeck-registry pull secret (command in secrets.example.yaml); if it is public, delete imagePullSecrets from server.yaml.

Apply

kubectl apply -f k8s/namespace.yaml
kubectl apply -f <your filled-in secrets file>
kubectl apply -k k8s/

The Let's Encrypt HTTP-01 challenge needs car.stinnesbeck.com to resolve to the public Traefik before the certificate can be issued; check with kubectl -n mg4 get certificate.

Notes

• InfluxDB's setup mode runs only on an empty volume. Changing admin-token in the Secret later does not change the token inside InfluxDB.
• The server uses the InfluxDB admin token. A token scoped to the mg4 bucket can replace it later (influx auth create --read-bucket … --write-bucket …).
• To upgrade the server, push a new image tag and change newTag in kustomization.yaml.