Changedetection on GKE Autopilot

changedetection.io is a self-hosted, open-source service that monitors web pages for changes and sends notifications when they occur. This module deploys changedetection.io on GKE Autopilot on top of the App_GKE foundation, which provisions and manages the shared Google Cloud and Kubernetes infrastructure.

This guide focuses on the cloud services changedetection.io uses and how to explore and operate them from the Google Cloud Console and the command line. For the mechanics that are common to every GKE application — Workload Identity, ingress, autoscaling, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC Service Controls, backups, and the deployment lifecycle — refer to the App_GKE foundation guide rather than repeating them here.

1. Overview

changedetection.io runs as a single Python/Flask web workload. The deployment wires together a deliberately small set of Google Cloud services — there is no database and no cache:

Capability	Google Cloud service	Notes
Compute	GKE Autopilot	Python/Flask pod, 1 vCPU / 1 GiB by default, listens on port 5000
Database	None	changedetection.io stores all state on disk, not in SQL
Persistent datastore	Block Persistent Disk (PVC) or Cloud Storage (GCS FUSE)	Mounted at `/datastore`; a block PVC via StatefulSet is strongly preferred
Cache & queue	None	Redis is not used; explicitly disabled
Secrets	Secret Manager	No app secret is injected; the REST API token is created in the web UI
Ingress	Cloud Load Balancing	`ClusterIP` Service behind a Kubernetes Ingress with a reserved static IP and managed certificate (custom domain enabled by default; a `nip.io` host is used when none is set)

Sensible defaults worth knowing up front:

No database, no Redis. changedetection.io is entirely self-contained. There is no Cloud SQL instance, no db-init job, and no schema migration step. Redis is disabled (enable_redis = false) and enable_cloudsql_volume = false.
Block PVC is the default for the datastore. changedetection.io writes a file-based datastore (watch JSON plus history snapshot files) that behaves best on a POSIX block volume, so stateful_pvc_enabled = true by default, mounting a 20Gi block PVC (via a StatefulSet) at /datastore. This automatically disables the GCS FUSE volume at the same path (enable_gcs_storage_volume = false) to avoid a double-mount.
GCS FUSE is the fallback. With stateful_pvc_enabled = false, the datastore GCS bucket is mounted at /datastore via GCS FUSE instead. This works but is less well-suited to the app's file-based writes than a block PVC.
Single replica by default. min_instance_count = 1 and max_instance_count = 1. The fetch scheduler runs in-process against a single datastore; running more than one replica against the same datastore risks concurrent-write corruption. Keep max_instance_count = 1.
No login by default. The dashboard ships with no login. Set a password in Settings → General immediately, and/or front the workload with IAP.
BASE_URL is not set automatically on GKE. Set BASE_URL (the notification-link host) to the external LoadBalancer or custom-domain URL via environment_variables after the external IP is known.
Version pinning. With application_version = "latest" the image build pins a known-good tag (0.50.19) via the app-specific CHANGEDETECTION_VERSION build arg.

2. Google Cloud Services & How to Explore Them

All commands assume you have run gcloud container clusters get-credentials <cluster> --region <region> --project <project> and that PROJECT, REGION, and NAMESPACE are set. The namespace and other identifiers are reported in the deployment Outputs.

A. GKE Autopilot — the changedetection.io workload

changedetection.io pods are scheduled on Autopilot, which bills for the CPU/memory the pods actually request. Since stateful_pvc_enabled = true by default, workload_type auto-resolves to a StatefulSet with a per-pod PVC; set stateful_pvc_enabled = false for a Deployment with a GCS FUSE volume instead.

Console: Kubernetes Engine → Workloads → select the changedetection workload to see pods and events. Kubernetes Engine → Services & Ingress shows the external IP.

CLI:

kubectl get pods,svc -n "$NAMESPACE"
kubectl get statefulset,pvc -n "$NAMESPACE"          # when stateful_pvc_enabled = true
kubectl logs -n "$NAMESPACE" <pod-name> --tail=100

See App_GKE for how Autopilot, scaling, and the workload type (Deployment vs StatefulSet) are managed.

B. Database — not used

changedetection.io uses no SQL database. database_type = NONE is fixed by Changedetection_Common; no Cloud SQL instance is created and there is no db-init initialization job. The db_name/db_user inputs exist only for Foundation compatibility and provision nothing. All persistent state lives in the datastore volume described below.

C. Persistent datastore (PVC or Cloud Storage)

All watch configuration, page snapshots, and change history live under /datastore.

Block PVC (default). With stateful_pvc_enabled = true (the default), a StatefulSet mounts a 20Gi block Persistent Disk at stateful_pvc_mount_path (/datastore).
```
kubectl get pvc -n "$NAMESPACE"
kubectl describe pvc -n "$NAMESPACE" <pvc-name>
```
GCS FUSE (fallback). With stateful_pvc_enabled = false, the datastore GCS bucket is mounted at /datastore via the GCS FUSE CSI driver.
```
gcloud storage buckets list --project "$PROJECT" --filter="name~storage"
gcloud storage ls gs://<data-bucket>/
```

See App_GKE for StatefulSet PVCs, CMEK options, and GCS FUSE mounts.

D. Cache & queue — not used

changedetection.io does not use Redis or any external queue; its watch scheduler is in-process. enable_redis = false is set explicitly (overriding the App_GKE default of true) and no Redis inputs are wired.

E. Secret Manager

No application secret is injected into the pod — the optional REST API token is generated inside the web UI (Settings → API), and the datastore uses no encryption key. Secret Manager is still available for any operator-supplied secret_environment_variables.

Console: Security → Secret Manager.

CLI:

gcloud secrets list --project "$PROJECT"
gcloud secrets versions access latest --secret=<secret-name> --project "$PROJECT"

See App_GKE for the Secret Store CSI integration and rotation.

F. Networking & ingress

By default the Kubernetes Service is ClusterIP (service_type = ClusterIP) and the workload is exposed through a Kubernetes Ingress with a reserved static IP and a Google-managed certificate (enable_custom_domain = true, reserve_static_ip = true). When no application_domains are set, a nip.io hostname derived from the reserved IP is used so HTTPS works out of the box.

Console: Network services → Load balancing; VPC network → IP addresses.

CLI:

kubectl get ingress,svc -n "$NAMESPACE"
gcloud compute addresses list --project "$PROJECT"

See App_GKE for custom domains, Cloud CDN, and static IP details.

G. Cloud Logging & Monitoring

Pod stdout/stderr flow to Cloud Logging; GKE metrics flow to Cloud Monitoring. Optional uptime checks and alert policies are available.

Console: Logging → Logs Explorer; Monitoring → Dashboards / Alerting.

CLI:

gcloud logging read 'resource.type="k8s_container" AND resource.labels.namespace_name="'"$NAMESPACE"'"' \
  --project "$PROJECT" --limit 50

3. changedetection.io Application Behaviour

No first-deploy database setup. There is no database and no init job. On first boot changedetection.io creates its datastore files (url-watches.json and per-watch history directories) under /datastore if they do not already exist.
No schema migrations. Datastore format upgrades are handled internally by the application on start; there is no separate migration step to run.
The datastore volume is the only stateful asset. Everything the app remembers — watches, snapshots, diff history, notification config, and any UI password — lives on the /datastore volume (block PVC or GCS bucket). Deleting the PVC/bucket wipes all state.
No login by default. The dashboard ships open. Set a password under Settings → General → Password immediately after first access, and/or enable IAP in front of the workload. There is no default admin account or credential.
REST API token is created in the UI. To use the REST API, generate a token under Settings → API and pass it as the x-api-key header. It is not injected via an environment variable.
Set BASE_URL after the external IP is known. Unlike the Cloud Run variant, the GKE wrapper does not inject a usable BASE_URL. Set it to the external URL so notification bodies contain working links:
```
kubectl set env -n "$NAMESPACE" statefulset/<name> \
  BASE_URL=https://changedetection.example.com
```
Or set environment_variables = { BASE_URL = "https://…" } in the module config.
Health path. Startup and liveness probes target / — the web UI, which returns HTTP 200 once the Flask server is ready. First boot is fast (no migrations); the default startup probe allows a 15-second initial delay plus a 10-retry window.
Scaling constraint. Keep max_instance_count = 1. Multiple replicas share the same datastore and would race on writes; the app has no distributed coordination.

Inspect the running environment:

kubectl exec -n "$NAMESPACE" <pod-name> -- env | grep -E 'DATASTORE_PATH|BASE_URL'

4. Configuration Variables

Variables are grouped exactly as they appear on the deployment platform. Only settings specific to or notable for changedetection.io are listed; every other input is inherited from App_GKE with its standard behaviour and defaults.