nilsandClaude Opus 5.5
c253876ed2
Namespace, InfluxDB 2.7.12 StatefulSet with PVC and a NetworkPolicy that admits only the server, the server Deployment (non-root, read-only root filesystem), a cert-manager Certificate from letsencrypt-prod and a Traefik IngressRoute. Secrets are a template only. Nothing is applied; k8s/README.md has the steps. Server version bumped to 1.1.0. Validated offline with kustomize and kubeconform (including the cert-manager and Traefik CRD schemas). The InfluxDB container was tested locally as UID 1000 with no capabilities. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
# TEMPLATE ONLY — not part of kustomization.yaml. Copy it outside the repository, fill in
|
|
# real values, and apply that copy yourself. Never commit the filled-in file.
|
|
#
|
|
# openssl rand -hex 32 for every token and secret below
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: influxdb-auth
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
admin-password: CHANGE-ME-at-least-8-characters
|
|
admin-token: CHANGE-ME-openssl-rand-hex-32
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: mg4-server
|
|
namespace: mg4
|
|
type: Opaque
|
|
stringData:
|
|
# The car's write token, entered in the app. At least 24 characters.
|
|
INGEST_TOKEN: CHANGE-ME-openssl-rand-hex-32
|
|
SESSION_SECRET: CHANGE-ME-openssl-rand-hex-32
|
|
DASHBOARD_PASSWORD: CHANGE-ME-at-least-8-characters
|
|
# Your ABRP credentials. Leave either empty to switch forwarding off.
|
|
ABRP_API_KEY: CHANGE-ME
|
|
ABRP_USER_TOKEN: CHANGE-ME
|
|
ABRP_MIN_INTERVAL_SECONDS: "5"
|
|
---
|
|
# Pull secret for a private image on git.stinnesbeck.com. Easier to create with:
|
|
# kubectl -n mg4 create secret docker-registry git-stinnesbeck-registry \
|
|
# --docker-server=git.stinnesbeck.com --docker-username=<user> --docker-password=<token>
|
|
# If the package is public, remove imagePullSecrets from server.yaml instead.
|