nilsandClaude Opus 5.5
c253876ed2
Namespace, InfluxDB 2.7.12 StatefulSet with PVC and a NetworkPolicy that admits only the server, the server Deployment (non-root, read-only root filesystem), a cert-manager Certificate from letsencrypt-prod and a Traefik IngressRoute. Secrets are a template only. Nothing is applied; k8s/README.md has the steps. Server version bumped to 1.1.0. Validated offline with kustomize and kubeconform (including the cert-manager and Traefik CRD schemas). The InfluxDB container was tested locally as UID 1000 with no capabilities. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
1009 B
YAML
38 lines
1009 B
YAML
# TLS certificate from cert-manager. cert-manager does not watch Traefik IngressRoutes, so the
|
|
# certificate is requested explicitly and the IngressRoute references its Secret.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: car-stinnesbeck-com
|
|
namespace: mg4
|
|
spec:
|
|
secretName: car-stinnesbeck-com-tls
|
|
dnsNames:
|
|
- car.stinnesbeck.com
|
|
issuerRef:
|
|
kind: ClusterIssuer
|
|
name: letsencrypt-prod
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: mg4-server
|
|
namespace: mg4
|
|
annotations:
|
|
# CHECK: the class of your public-facing Traefik. Your internal example uses
|
|
# "traefik-internal"; this host must be served by the external one.
|
|
kubernetes.io/ingress.class: traefik-external
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- kind: Rule
|
|
match: Host(`car.stinnesbeck.com`)
|
|
services:
|
|
- kind: Service
|
|
name: mg4-server
|
|
namespace: mg4
|
|
port: 80
|
|
tls:
|
|
secretName: car-stinnesbeck-com-tls
|