nils/mg4

Files

T

nilsandClaude Opus 5.5 9226616261 Grafana's read-only InfluxDB token is made automatically

The read-only token for Grafana needed a manual influx command and a
Secret. InfluxDB generates every token but the admin one and ignores a
chosen value (tested on 2.7.12), so it cannot be preset in a Secret.

Instead an init container in the Grafana pod creates it at every start
with the admin token, deletes the one from the previous start, and
writes only the read-only token to a memory-backed volume; the
provisioned datasource reads it with $__file{/run/influx/token}. The
Grafana process never sees the admin token. The grafana-influx Secret
is gone from the template and the README.

Tested in podman: InfluxDB 2.7.12, the script run twice as the Grafana
user (the old token is replaced, not piled up), and Grafana 13.2.3
reporting the datasource healthy with the file-based token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

2026-10-18 19:05:58 +02:00

3.7 KiB

Raw Blame History

Kubernetes manifests — car.k8s.stinnesbeck.com

Plain manifests for the car server, InfluxDB 2 and Grafana. They are only files: nothing here is applied automatically. Apply them yourself.

File	What
`namespace.yaml`	Namespace `mg4`
`influxdb.yaml`	InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana
`server.yaml`	Go server Deployment (1 replica, non-root, read-only root filesystem) and Service
`grafana.yaml`	Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned
`grafana/`	The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging)
`ingress.yaml`	Traefik `IngressRoute`s for car.k8s.stinnesbeck.com and Grafana, TLS from Traefik's default certificate
`secrets/secrets.example.yaml`	Template for the Secrets; placeholders only, not in `kustomization.yaml`
`secrets/secrets.yaml`	Your filled-in copy — gitignored, never committed
`kustomization.yaml`	Everything except the Secrets; generates the Grafana ConfigMaps

Before the first apply

Check ingress.yaml: Grafana's host (placeholder car-grafana.k8s.stinnesbeck.com). Both routes use the traefik-internal class, and both hosts must be covered by Traefik's default certificate.
Create the Secrets. cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml (gitignored), replace every CHANGE-ME there (openssl rand -hex 32): influxdb-auth, mg4-server (ingest token, approval password for pairing, the forge token for app updates) and grafana-admin. Keep the template itself on placeholders only.
Registry access. The mg4-server package on git.stinnesbeck.com is public, so no pull secret is needed. If you make it private, add an imagePullSecrets entry to server.yaml.

Apply

kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/secrets/secrets.yaml
kubectl apply -k k8s/

Use -k, not -f k8s/: plain -f applies the files without kustomize, so the Grafana ConfigMaps (datasource and dashboards) are never created and Grafana does not start.

Grafana's InfluxDB token

Grafana reads InfluxDB with a token that can only read the mg4 bucket. Nothing to do: an init container in the Grafana pod creates it at every start with the admin token, deletes the one from the previous start, and hands Grafana only the read-only token (in a memory-backed volume). The Grafana process itself never sees the admin token. InfluxDB generates every token but the admin one itself, which is why this cannot be a value in the Secret.

App updates

The server relays the app's releases from the private repository to the car's updater (OTA.md). It reads them with FORGE_TOKEN from the mg4-server Secret: create a token in the forge that can only read the nils/mg4 repository, put it there, apply the Secret and restart the server. Without it, updates are off (the car's updater gets a 404). FORGE_URL and FORGE_REPO are set in server.yaml.

Notes

InfluxDB's setup mode runs only on an empty volume. Changing admin-token in the Secret later does not change the token inside InfluxDB.
The server uses the InfluxDB admin token; a token scoped to read/write on the mg4 bucket can replace it later. Grafana has its own read-only token (above).
The dashboards are read-only in Grafana's UI. Change the JSON in grafana/dashboards/; the ConfigMap name changes with its content, which rolls Grafana.
The server image is pinned by digest in server.yaml. To upgrade, push a new tag and put its digest there (skopeo inspect docker://git.stinnesbeck.com/nils/mg4-server:<tag>).

3.7 KiB Raw Blame History