my cluster

List all the available babashka tasks.

This is the primary home of most develoment commands and will reveal commands not listed here.

bb tasks

The .envrc.example file documents many of the variables available

Create an environment config from the example

cp .envrc.example .envrc

Allow the current environment config to be used.

For security, any change to the config must be explicitly whitelisted. Refer to direnv for mor information

direnv allow

If you already have a keepass database set up in a way identical to what I have, this will prepare that key for a new environment.

export KEEPASS_DB_PATH="${HOME}/keepass/passwords.kdbx"
export SECRET_PATH="/Kubernetes/Age-key"
mkdir -p ~/.config/sops/age
keepassxc-cli show -s -a Password ${KEEPASS_DB_PATH?} ${SECRET_PATH?} > ~/.config/sops/age/keys.txt

Create a private key for securing secrets

mkdir -p ~/.config/sops/age
age-keygen -o ~/.config/sops/age/keys.txt

This will fail if the file has already been created

This ensures all generated yaml is up to date on commit

This only applies to legacy edn-based config

bb apply-git-hooks

This assumes that you have placed the files tls.crt and tls.key at the root of the directory

All secrets are encrypted with that key

Secrets are ultimately stored in a Keepass database. The create-sealed-secrets command will read the secrets.edn file which describes the mappings between entries in that keepass database and secret to be encrypted.

You must create a file at secrets/secrets.yaml with all the required secrets and $DECRYPTED_SECRET_FILE should be pointing to it.

This turns the unencrypted yaml file into an encrypted version

# bb encrypt
sops -e secrets/secrets.yaml | save -f secrets/secrets.enc.yaml

To unencrypt the stored passwords

# bb decrypt
sops --decrypt secrets/secrets.enc.yaml > secrets/secrets.yaml

Compile all edn templates to yaml

bb build

Create a k3d registry for storing localally-built dev images

bbg k3d-create-registry

Create a k3d cluster

bbg k3d-create

See https://github.com/duck1123/dotfiles

Wait until all pods are running or completed

kubectl get pods -A

https://argo-cd.readthedocs.io/en/stable/getting_started/

Register Argo Helm Repo

helm repo add argo https://argoproj.github.io/argo-helm

Create namespace for argocd

kubectl create namespace argocd

Load ArgoCD helm chart

export DOMAIN="argocd.dev.kronkltd.net"
cat <<EOF | jet -o yaml | helm upgrade argocd argo/argo-cd \
  --install \
  --namespace argocd \
  --version 7.6.12 \
  -f -
{:domain "${DOMAIN?}"
 :configs {:params {"server.insecure" true}}
 :server
 {:ingress
   {:annotations
    {"cert-manager.io/cluster-issuer"           "letsencrypt-prod"
     "ingress.kubernetes.io/force-ssl-redirect" "true"}
    :enabled     true
    :tls         true
    :hostname    "${DOMAIN?}"}}}
EOF

Fetch the default argocd password. This will be used to log in the first time.

argocd admin initial-password -n argocd

Forward argocd interface ports.

Untill the main application installs the ingress controllers, the only way to access the argocd interface is by forwarding the ports.

kubectl port-forward svc/argocd-server -n argocd 8080:443

https://localhost:8080/

Registers the 00-master Application with argocd.

This will kick off argo installing all the other resources.

bb apply-master-application

Create cluster issuer record.

This will cause any ingress with the appropriate annotations to obtain a certificate from letsencrypt

This must be done after the cert-manager crds have been installed

replace EMAIL with your email

# Set to an email that will receive certificate expiration notices.
export EMAIL="duck@kronkltd.net"

cat <<EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ${EMAIL}
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: traefik
EOF

Ensure that 001-infra is properly healthy

Ensure that tls.crt and tls.key have been installed to the root of the directory. (from Keepass)

Create a secret from the keypair

bb install-sealed-key

Flag sealed secret key as active

bb apply-sealed-key-label

Completely destroy dev cluster

k3d cluster delete

Delete registry for locally-built images

k3d registry delete k3d-myregistry.localtest.me

Read argo workflow token from secret

echo "Bearer $(kubectl -n argo-workflows get secret duck.service-account-token -o=jsonpath='{.data.token}' | base64 --decode)"

Generate nixidy schemas from CRDs

nix run .#generate

Compile Nixidy config to YAML manifests

nixidy build .#dev