nilsandClaude Opus 5.5
59ee2cae3b
- kustomization pins mg4-server 2.1.0 by digest; server.yaml sets PUBLIC_URL for the pairing QR code; the secrets template gains APPROVAL_PASSWORD. - Filled-in Secrets now go into k8s/secrets.yaml, which is gitignored; the template stays on placeholders. This follows a leak where real values typed into the template were committed and pushed (amended and force-pushed since; both values regenerated). - SPECS.md records pairing and the incident. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
48 lines
2.7 KiB
Markdown
48 lines
2.7 KiB
Markdown
# Kubernetes manifests — car.stinnesbeck.com
|
|
|
|
Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here
|
|
is applied automatically. Apply them yourself.
|
|
|
|
| File | What |
|
|
|---|---|
|
|
| `namespace.yaml` | Namespace `mg4` |
|
|
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
|
|
| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
|
|
| `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
|
|
| `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
|
|
| `ingress.yaml` | Traefik `IngressRoute`s for car.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
|
|
| `secrets.example.yaml` | **Template** for the Secrets; placeholders only, not in `kustomization.yaml` |
|
|
| `secrets.yaml` | Your filled-in copy — **gitignored**, never committed |
|
|
| `kustomization.yaml` | Everything except the Secrets; pins the server image, generates the Grafana ConfigMaps |
|
|
|
|
## Before the first apply
|
|
|
|
1. **Check `ingress.yaml`:** the ingress class (placeholder `traefik-external` for the public
|
|
Traefik) and Grafana's host (placeholder `car-grafana.stinnesbeck.com`). Both hosts must be
|
|
covered by Traefik's default certificate.
|
|
2. **Create the Secrets.** `cp k8s/secrets.example.yaml k8s/secrets.yaml` (gitignored), replace
|
|
every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
|
|
approval password for pairing, your ABRP API key and user token) and `grafana-admin`. Keep
|
|
`secrets.example.yaml` itself on placeholders only.
|
|
3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
|
|
secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
|
|
|
|
## Apply
|
|
|
|
```sh
|
|
kubectl apply -f k8s/namespace.yaml
|
|
kubectl apply -f k8s/secrets.yaml
|
|
kubectl apply -k k8s/
|
|
```
|
|
|
|
## Notes
|
|
|
|
- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
|
|
does not change the token inside InfluxDB.
|
|
- The server and Grafana use the InfluxDB admin token. A token scoped to the `mg4` bucket (read
|
|
for Grafana, read/write for the server) can replace it later.
|
|
- The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
|
|
ConfigMap name changes with its content, which rolls Grafana.
|
|
- The server image is pinned by digest in `kustomization.yaml`. To upgrade, push a new tag and
|
|
put its digest there (`skopeo inspect docker://git.stinnesbeck.com/nils/mg4-server:<tag>`).
|