nilsandClaude Opus 5.5
5473ab1c2b
- k8s/grafana.yaml: Grafana 13.2.3 with a 1Gi PVC, sign-up and
anonymous access off. The InfluxDB datasource (URL and token from the
environment) and three dashboards — Live, Consumption, Charging — are
provisioned from k8s/grafana/ via kustomize-generated ConfigMaps.
- server.yaml for the Go server (port 8080, UID 65532, smaller limits),
image tag 2.0.0. The NetworkPolicy now admits Grafana to InfluxDB.
- ingress.yaml: IngressRoutes for car.stinnesbeck.com and Grafana
(placeholder host car-grafana.stinnesbeck.com) with tls: {}, using
Traefik's default certificate; the cert-manager Certificate is gone.
- secrets.example.yaml: drops the dashboard secrets, adds grafana-admin.
- AGENTS.md loses its Next.js block; SPECS.md describes the new setup.
The removal of web/ (the Next.js app) and of the stale .next/ cache
upstream had committed already landed in 51e6f6f, which was staged
together with the Go server by mistake.
Checked end to end in podman (Go server + InfluxDB 2.7.12 + Grafana
13.2.3): all 25 dashboard queries return the expected data, and the
dashboards were rendered with headless Chromium. Manifests validated
offline with kustomize and kubeconform. Nothing applied to a cluster.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
46 lines
2.4 KiB
Markdown
46 lines
2.4 KiB
Markdown
# Kubernetes manifests — car.stinnesbeck.com
|
|
|
|
Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here
|
|
is applied automatically. Apply them yourself.
|
|
|
|
| File | What |
|
|
|---|---|
|
|
| `namespace.yaml` | Namespace `mg4` |
|
|
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
|
|
| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
|
|
| `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
|
|
| `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
|
|
| `ingress.yaml` | Traefik `IngressRoute`s for car.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
|
|
| `secrets.example.yaml` | **Template** for the Secrets; not in `kustomization.yaml` |
|
|
| `kustomization.yaml` | Everything except the Secrets; pins the server image, generates the Grafana ConfigMaps |
|
|
|
|
## Before the first apply
|
|
|
|
1. **Check `ingress.yaml`:** the ingress class (placeholder `traefik-external` for the public
|
|
Traefik) and Grafana's host (placeholder `car-grafana.stinnesbeck.com`). Both hosts must be
|
|
covered by Traefik's default certificate.
|
|
2. **Create the Secrets.** Copy `secrets.example.yaml` outside the repository, replace every
|
|
`CHANGE-ME` (`openssl rand -hex 32`), then apply the copy: `influxdb-auth`, `mg4-server`
|
|
(ingest token, your ABRP API key and user token) and `grafana-admin`.
|
|
3. **Registry access.** If the `mg4-server` package on git.stinnesbeck.com is private, create the
|
|
`git-stinnesbeck-registry` pull secret (command in `secrets.example.yaml`); if it is public,
|
|
delete `imagePullSecrets` from `server.yaml`.
|
|
|
|
## Apply
|
|
|
|
```sh
|
|
kubectl apply -f k8s/namespace.yaml
|
|
kubectl apply -f <your filled-in secrets file>
|
|
kubectl apply -k k8s/
|
|
```
|
|
|
|
## Notes
|
|
|
|
- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
|
|
does not change the token inside InfluxDB.
|
|
- The server and Grafana use the InfluxDB admin token. A token scoped to the `mg4` bucket (read
|
|
for Grafana, read/write for the server) can replace it later.
|
|
- The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
|
|
ConfigMap name changes with its content, which rolls Grafana.
|
|
- To upgrade the server, push a new image tag and change `newTag` in `kustomization.yaml`.
|