nilsandClaude Opus 5.5
4fe29189c0
mg4-server:2.0.0 is on git.stinnesbeck.com and pulls anonymously, so the Deployment no longer references a registry pull secret. The image is pinned by digest (sha256:6feea777…) so a re-pushed tag cannot change what the cluster runs. README and secrets template updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
46 lines
2.5 KiB
Markdown
46 lines
2.5 KiB
Markdown
# Kubernetes manifests — car.stinnesbeck.com
|
|
|
|
Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here
|
|
is applied automatically. Apply them yourself.
|
|
|
|
| File | What |
|
|
|---|---|
|
|
| `namespace.yaml` | Namespace `mg4` |
|
|
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
|
|
| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
|
|
| `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
|
|
| `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
|
|
| `ingress.yaml` | Traefik `IngressRoute`s for car.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
|
|
| `secrets.example.yaml` | **Template** for the Secrets; not in `kustomization.yaml` |
|
|
| `kustomization.yaml` | Everything except the Secrets; pins the server image, generates the Grafana ConfigMaps |
|
|
|
|
## Before the first apply
|
|
|
|
1. **Check `ingress.yaml`:** the ingress class (placeholder `traefik-external` for the public
|
|
Traefik) and Grafana's host (placeholder `car-grafana.stinnesbeck.com`). Both hosts must be
|
|
covered by Traefik's default certificate.
|
|
2. **Create the Secrets.** Copy `secrets.example.yaml` outside the repository, replace every
|
|
`CHANGE-ME` (`openssl rand -hex 32`), then apply the copy: `influxdb-auth`, `mg4-server`
|
|
(ingest token, your ABRP API key and user token) and `grafana-admin`.
|
|
3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
|
|
secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
|
|
|
|
## Apply
|
|
|
|
```sh
|
|
kubectl apply -f k8s/namespace.yaml
|
|
kubectl apply -f <your filled-in secrets file>
|
|
kubectl apply -k k8s/
|
|
```
|
|
|
|
## Notes
|
|
|
|
- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
|
|
does not change the token inside InfluxDB.
|
|
- The server and Grafana use the InfluxDB admin token. A token scoped to the `mg4` bucket (read
|
|
for Grafana, read/write for the server) can replace it later.
|
|
- The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
|
|
ConfigMap name changes with its content, which rolls Grafana.
|
|
- The server image is pinned by digest in `kustomization.yaml`. To upgrade, push a new tag and
|
|
put its digest there (`skopeo inspect docker://git.stinnesbeck.com/nils/mg4-server:<tag>`).
|