nilsandClaude Opus 5.5
c253876ed2
Namespace, InfluxDB 2.7.12 StatefulSet with PVC and a NetworkPolicy that admits only the server, the server Deployment (non-root, read-only root filesystem), a cert-manager Certificate from letsencrypt-prod and a Traefik IngressRoute. Secrets are a template only. Nothing is applied; k8s/README.md has the steps. Server version bumped to 1.1.0. Validated offline with kustomize and kubeconform (including the cert-manager and Traefik CRD schemas). The InfluxDB container was tested locally as UID 1000 with no capabilities. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
45 lines
2.2 KiB
Markdown
45 lines
2.2 KiB
Markdown
# Kubernetes manifests — car.stinnesbeck.com
|
|
|
|
Plain manifests for the car server and its InfluxDB 2. They are only files: nothing here is
|
|
applied automatically. Apply them yourself.
|
|
|
|
| File | What |
|
|
|---|---|
|
|
| `namespace.yaml` | Namespace `mg4` |
|
|
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy allowing only the server |
|
|
| `server.yaml` | Server Deployment (1 replica, non-root, read-only root filesystem) and Service |
|
|
| `ingress.yaml` | cert-manager `Certificate` from `letsencrypt-prod`, Traefik `IngressRoute` on `websecure` |
|
|
| `secrets.example.yaml` | **Template** for the two Secrets; not in `kustomization.yaml` |
|
|
| `kustomization.yaml` | Everything except the Secrets; pins the server image tag |
|
|
|
|
## Before the first apply
|
|
|
|
1. **Check the ingress class** in `ingress.yaml`. It is set to `traefik-external` as a
|
|
placeholder; use the class of your public-facing Traefik.
|
|
2. **Create the Secrets.** Copy `secrets.example.yaml` outside the repository, replace every
|
|
`CHANGE-ME` (`openssl rand -hex 32` for tokens), then apply the copy:
|
|
`influxdb-auth` (InfluxDB admin password and token) and `mg4-server` (ingest token,
|
|
session secret, dashboard password, your ABRP API key and user token).
|
|
3. **Registry access.** If the `mg4-server` package on git.stinnesbeck.com is private, create
|
|
the `git-stinnesbeck-registry` pull secret (command in `secrets.example.yaml`); if it is
|
|
public, delete `imagePullSecrets` from `server.yaml`.
|
|
|
|
## Apply
|
|
|
|
```sh
|
|
kubectl apply -f k8s/namespace.yaml
|
|
kubectl apply -f <your filled-in secrets file>
|
|
kubectl apply -k k8s/
|
|
```
|
|
|
|
The Let's Encrypt HTTP-01 challenge needs car.stinnesbeck.com to resolve to the public
|
|
Traefik before the certificate can be issued; check with `kubectl -n mg4 get certificate`.
|
|
|
|
## Notes
|
|
|
|
- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret
|
|
later does not change the token inside InfluxDB.
|
|
- The server uses the InfluxDB admin token. A token scoped to the `mg4` bucket can replace it
|
|
later (`influx auth create --read-bucket … --write-bucket …`).
|
|
- To upgrade the server, push a new image tag and change `newTag` in `kustomization.yaml`.
|