Initial commit

apps/teslamate/manifests/cnpg-cluster.yaml

@@ -0,0 +1,55 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pg-teslamate
+  namespace: teslamate
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  instances: 2
+
+  # Resource limits to prevent OOM
+  resources:
+    requests:
+      memory: "512Mi"
+      cpu: "25m"
+    limits:
+      memory: "2Gi"
+      cpu: "250m"
+
+  # Spread replicas across different nodes
+  affinity:
+    topologyKey: kubernetes.io/hostname
+
+  storage:
+    size: 10Gi
+    storageClass: rook-ceph-block
+
+  primaryUpdateStrategy: unsupervised
+  
+  # PostgreSQL configuration for better performance
+  postgresql:
+    parameters:
+      max_connections: "200"
+      shared_buffers: "512MB"
+      effective_cache_size: "1536MB"
+      maintenance_work_mem: "128MB"
+      checkpoint_completion_target: "0.9"
+      wal_buffers: "16MB"
+      default_statistics_target: "100"
+      random_page_cost: "1.1"
+      effective_io_concurrency: "200"
+      work_mem: "2621kB"
+      min_wal_size: "1GB"
+      max_wal_size: "4GB"
+
+  bootstrap:
+    initdb:
+      database: teslamate
+      owner: teslamate
+      postInitSQL:
+        - ALTER USER teslamate WITH SUPERUSER
+        - CREATE EXTENSION IF NOT EXISTS cube
+        - CREATE EXTENSION IF NOT EXISTS earthdistance
+
+  monitoring:
+    enablePodMonitor: true

apps/teslamate/manifests/cnpg-secrets.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: teslamate-cnpg-secret
+  namespace: teslamate
+spec:
+  length: 42
+  digits: 5
+  symbols: 5
+  symbolCharacters: "-_$@"
+  noUpper: false
+  allowRepeat: true
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: teslamate-cnpg-secret
+  namespace: teslamate
+spec:
+  # how often to rotate the DB password
+  refreshInterval: "24h"
+  target:
+    # This will merge the generated password into the existing pg-teslamate-app secret
+    name: pg-teslamate-app
+    creationPolicy: Merge
+    template:
+      metadata:
+        labels:
+          cnpg.io/reload: "true"
+      data:
+        # Override the password field with our ESO-generated password
+        password: "{{ .password }}"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: teslamate-cnpg-secret

apps/teslamate/manifests/envoy-route.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: teslamate
+  namespace: teslamate
+spec:
+  parentRefs:
+    - name: edge
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - teslamate.kube.huskypup.net
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: teslamate
+          port: 4000

apps/teslamate/manifests/external-secret.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: teslamate-config
+  namespace: teslamate
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: teslamate-config-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: encryption-key
+      remoteRef:
+        key: teslamate/config
+        property: encryption_key

apps/teslamate/manifests/istio-virtualservice.yaml

@@ -0,0 +1,16 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: teslamate
+  namespace: teslamate
+spec:
+  hosts:
+    - teslamate.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    - route:
+        - destination:
+            host: teslamate.teslamate.svc.cluster.local
+            port:
+              number: 4000

apps/teslamate/values.yaml

@@ -0,0 +1,112 @@
+# Teslamate - Tesla data logger
+# Uses CNPG PostgreSQL with auto-rotating passwords via ESO
+
+image:
+  repository: teslamate/teslamate
+  tag: 1.30.1
+  pullPolicy: IfNotPresent
+
+env:
+  TZ: America/Chicago
+  
+  # PostgreSQL configuration (uses CNPG-managed database)
+  DATABASE_HOST: pg-teslamate-rw.teslamate.svc
+  DATABASE_USER: teslamate
+  DATABASE_NAME: teslamate
+  
+  # Database password from CNPG-generated secret
+  DATABASE_PASS:
+    valueFrom:
+      secretKeyRef:
+        name: pg-teslamate-app
+        key: password
+  
+  # Encryption key from Vault
+  ENCRYPTION_KEY:
+    valueFrom:
+      secretKeyRef:
+        name: teslamate-config-secret
+        key: encryption-key
+  
+  # MQTT settings (disabled by default, can enable later)
+  DISABLE_MQTT: "true"
+  
+  # Virtual host for proper URL generation
+  VIRTUAL_HOST: teslamate.kube.huskypup.net
+  
+  # Port configuration
+  PORT: "4000"
+
+service:
+  main:
+    ports:
+      http:
+        port: 4000
+
+# Ingress disabled - Istio VirtualService handles routing
+ingress:
+  main:
+    enabled: false
+
+persistence:
+  import:
+    enabled: false
+
+# Disable built-in postgresql (we use CNPG)
+postgresql:
+  enabled: false
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+# Resource limits
+resources:
+  requests:
+    memory: "256Mi"
+    cpu: "50m"
+  limits:
+    cpu: "500m"
+    memory: "512Mi"
+
+# Health probes
+probes:
+  liveness:
+    enabled: true
+    custom: true
+    spec:
+      httpGet:
+        path: /
+        port: 4000
+      initialDelaySeconds: 10
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 3
+  readiness:
+    enabled: true
+    custom: true
+    spec:
+      httpGet:
+        path: /
+        port: 4000
+      initialDelaySeconds: 5
+      periodSeconds: 5
+      timeoutSeconds: 3
+      failureThreshold: 2
+  startup:
+    enabled: true
+    custom: true
+    spec:
+      httpGet:
+        path: /
+        port: 4000
+      initialDelaySeconds: 10
+      periodSeconds: 5
+      timeoutSeconds: 3
+      failureThreshold: 12
+
+# Reloader annotations for auto-restart on secret changes
+podAnnotations:
+  secret.reloader.stakater.com/reload: "pg-teslamate-app,teslamate-config-secret"