nilsandClaude Opus 5.5
59ee2cae3b
- kustomization pins mg4-server 2.1.0 by digest; server.yaml sets PUBLIC_URL for the pairing QR code; the secrets template gains APPROVAL_PASSWORD. - Filled-in Secrets now go into k8s/secrets.yaml, which is gitignored; the template stays on placeholders. This follows a leak where real values typed into the template were committed and pushed (amended and force-pushed since; both values regenerated). - SPECS.md records pairing and the incident. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
Kubernetes manifests — car.stinnesbeck.com
Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here is applied automatically. Apply them yourself.
| File | What |
|---|---|
namespace.yaml |
Namespace mg4 |
influxdb.yaml |
InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
server.yaml |
Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
grafana.yaml |
Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
grafana/ |
The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
ingress.yaml |
Traefik IngressRoutes for car.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
secrets.example.yaml |
Template for the Secrets; placeholders only, not in kustomization.yaml |
secrets.yaml |
Your filled-in copy — gitignored, never committed |
kustomization.yaml |
Everything except the Secrets; pins the server image, generates the Grafana ConfigMaps |
Before the first apply
- Check
ingress.yaml: the ingress class (placeholdertraefik-externalfor the public Traefik) and Grafana's host (placeholdercar-grafana.stinnesbeck.com). Both hosts must be covered by Traefik's default certificate. - Create the Secrets.
cp k8s/secrets.example.yaml k8s/secrets.yaml(gitignored), replace everyCHANGE-MEthere (openssl rand -hex 32):influxdb-auth,mg4-server(ingest token, approval password for pairing, your ABRP API key and user token) andgrafana-admin. Keepsecrets.example.yamlitself on placeholders only. - Registry access. The
mg4-serverpackage on git.stinnesbeck.com is public, so no pull secret is needed. If you make it private, add animagePullSecretsentry toserver.yaml.
Apply
kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/secrets.yaml
kubectl apply -k k8s/
Notes
- InfluxDB's setup mode runs only on an empty volume. Changing
admin-tokenin the Secret later does not change the token inside InfluxDB. - The server and Grafana use the InfluxDB admin token. A token scoped to the
mg4bucket (read for Grafana, read/write for the server) can replace it later. - The dashboards are read-only in Grafana's UI. Change the JSON in
grafana/dashboards/; the ConfigMap name changes with its content, which rolls Grafana. - The server image is pinned by digest in
kustomization.yaml. To upgrade, push a new tag and put its digest there (skopeo inspect docker://git.stinnesbeck.com/nils/mg4-server:<tag>).