From 1ed4fc4c33c39c6d145d3d5fa6495887fcd04f2a Mon Sep 17 00:00:00 2001 From: Janis Eccarius Date: Sat, 30 May 2026 14:30:44 +0200 Subject: [PATCH] feat(deploy): add scripts for k3d installation and SSH tunnel setup --- htwg-1/flux-apps/gitrepository.yaml | 4 +-- htwg-1/flux-apps/kustomization.yaml | 1 - htwg-1/flux-apps/namespaces.yaml | 5 +++ htwg-1/flux-apps/postgres-tunnel.yaml | 43 ++++++++++++++++-------- htwg-1/flux-apps/sources.yaml | 3 +- scripts/deploy-to-cluster-htwg-1.sh | 47 ++------------------------- scripts/install-k3d-htwg-1.sh | 3 +- secrets/htwg-1/kustomization.yaml | 2 +- 8 files changed, 44 insertions(+), 64 deletions(-) diff --git a/htwg-1/flux-apps/gitrepository.yaml b/htwg-1/flux-apps/gitrepository.yaml index d31fd0e..815663c 100644 --- a/htwg-1/flux-apps/gitrepository.yaml +++ b/htwg-1/flux-apps/gitrepository.yaml @@ -5,8 +5,6 @@ metadata: namespace: flux-system spec: interval: 1m - url: ssh://git@git.janis-eccarius.de/NowChess/GitOps.git + url: https://git.janis-eccarius.de/NowChess/GitOps.git ref: branch: main - secretRef: - name: gitops-ssh diff --git a/htwg-1/flux-apps/kustomization.yaml b/htwg-1/flux-apps/kustomization.yaml index c486311..f31d07d 100644 --- a/htwg-1/flux-apps/kustomization.yaml +++ b/htwg-1/flux-apps/kustomization.yaml @@ -7,7 +7,6 @@ resources: - cert-manager.yaml - ingress-nginx.yaml - sealed-secrets.yaml - - metrics-server.yaml - redis.yaml - argo-rollouts.yaml - nowchess.yaml diff --git a/htwg-1/flux-apps/namespaces.yaml b/htwg-1/flux-apps/namespaces.yaml index 6e3e40b..743b149 100644 --- a/htwg-1/flux-apps/namespaces.yaml +++ b/htwg-1/flux-apps/namespaces.yaml @@ -22,3 +22,8 @@ apiVersion: v1 kind: Namespace metadata: name: ingress-nginx +--- +apiVersion: v1 +kind: Namespace +metadata: + name: postgres diff --git a/htwg-1/flux-apps/postgres-tunnel.yaml b/htwg-1/flux-apps/postgres-tunnel.yaml index 5b473e2..e86c129 100644 --- a/htwg-1/flux-apps/postgres-tunnel.yaml +++ b/htwg-1/flux-apps/postgres-tunnel.yaml @@ -1,15 +1,32 @@ -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: - name: postgres-tunnel - namespace: flux-system + name: postgres + namespace: postgres spec: - interval: 10m - retryInterval: 2m - sourceRef: - kind: GitRepository - name: gitops - namespace: flux-system - path: ./postgres-tunnel/htwg-1 - prune: true - timeout: 3m + interval: 1h + chart: + spec: + chart: postgresql + version: "16.x" + sourceRef: + kind: HelmRepository + name: bitnami + namespace: flux-system + values: + auth: + database: nowchess + existingSecret: postgres-credentials + secretKeys: + adminPasswordKey: postgres-password + primary: + persistence: + enabled: true + size: 5Gi + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi diff --git a/htwg-1/flux-apps/sources.yaml b/htwg-1/flux-apps/sources.yaml index cd8a693..b0fe8ef 100644 --- a/htwg-1/flux-apps/sources.yaml +++ b/htwg-1/flux-apps/sources.yaml @@ -40,8 +40,9 @@ metadata: name: bitnami namespace: flux-system spec: + type: oci interval: 12h - url: https://charts.bitnami.com/bitnami + url: oci://registry-1.docker.io/bitnamicharts --- apiVersion: source.toolkit.fluxcd.io/v1 kind: HelmRepository diff --git a/scripts/deploy-to-cluster-htwg-1.sh b/scripts/deploy-to-cluster-htwg-1.sh index f65ecf0..fe3f76e 100755 --- a/scripts/deploy-to-cluster-htwg-1.sh +++ b/scripts/deploy-to-cluster-htwg-1.sh @@ -12,7 +12,6 @@ generate_flux_manifests() { echo " ⌛ Generate FluxCD manifests" echo " ⌛ Install FluxCD controllers" echo " ⌛ Setup Sealed Secrets" - echo " ⌛ Apply Git source secret" echo " ⌛ Bootstrap FluxCD" echo "----------------------------------------" @@ -39,7 +38,6 @@ install_flux() { echo " ✅ Generate FluxCD manifests" echo " ⌛ Install FluxCD controllers" echo " ⌛ Setup Sealed Secrets" - echo " ⌛ Apply Git source secret" echo " ⌛ Bootstrap FluxCD" echo "----------------------------------------" @@ -60,7 +58,6 @@ setup_sealed_secrets() { echo " ✅ Generate FluxCD manifests" echo " ✅ Install FluxCD controllers" echo " ⌛ Setup Sealed Secrets" - echo " ⌛ Apply Git source secret" echo " ⌛ Bootstrap FluxCD" echo "----------------------------------------" @@ -70,63 +67,26 @@ setup_sealed_secrets() { "$SCRIPT_DIR/sealed-secrets-key.sh" import "$KEY_FILE" echo "✅ Sealed-secrets key imported." else - echo "⚠️ Skipped. New sealed-secrets key will be generated after controller deploys." - echo "⚠️ All secrets in secrets/nowchess/htwg-1-prod/ and secrets/flux/ must be re-sealed with the new key." + echo "⚠️ Skipped. New key will be generated after controller deploys." + echo "⚠️ Re-seal all secrets in secrets/nowchess/htwg-1-prod/ with the new key." fi - # Install sealed-secrets now (before FluxCD bootstraps) so we can decrypt the gitops-ssh secret echo "🚀 Installing sealed-secrets controller..." + kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/sources.yaml" kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/sealed-secrets.yaml" echo "⏳ Waiting for sealed-secrets controller to be ready (this may take a few minutes)..." - kubectl -n kube-system wait helmrelease/sealed-secrets \ - --for=condition=ready --timeout=300s 2>/dev/null || \ kubectl -n kube-system rollout status deployment/sealed-secrets --timeout=300s echo "✅ Sealed-secrets controller ready!" } # ---- -apply_git_source_secret() { - clear - echo "----------------------------------------" - echo " ✅ Generate FluxCD manifests" - echo " ✅ Install FluxCD controllers" - echo " ✅ Setup Sealed Secrets" - echo " ⌛ Apply Git source secret" - echo " ⌛ Bootstrap FluxCD" - echo "----------------------------------------" - - echo "🔑 Applying gitops-ssh SealedSecret..." - GIT_SECRET="$REPO_ROOT/secrets/flux/gitops-ssh-htwg-1.yaml" - - if grep -q "REPLACE_WITH_SEALED_VALUE" "$GIT_SECRET"; then - echo "❌ $GIT_SECRET is a placeholder — seal it first:" - echo "" - echo " ssh-keygen -t ed25519 -f gitops-deploy-key -N \"\" -C \"flux-htwg-1\"" - echo " kubectl -n flux-system create secret generic gitops-ssh \\" - echo " --from-file=identity=./gitops-deploy-key \\" - echo " --from-literal=known_hosts=\"\$(ssh-keyscan -H git.janis-eccarius.de 2>/dev/null)\" \\" - echo " --dry-run=client -o yaml \\" - echo " | kubeseal --controller-namespace kube-system -o yaml > $GIT_SECRET" - echo "" - echo " Then add gitops-deploy-key.pub as a deploy key in Gitea:" - echo " https://git.janis-eccarius.de/NowChess/GitOps/settings/keys" - exit 1 - fi - - kubectl apply -f "$GIT_SECRET" - echo "✅ gitops-ssh secret applied and will be decrypted by sealed-secrets." -} - -# ---- - bootstrap_flux() { clear echo "----------------------------------------" echo " ✅ Generate FluxCD manifests" echo " ✅ Install FluxCD controllers" echo " ✅ Setup Sealed Secrets" - echo " ✅ Apply Git source secret" echo " ⌛ Bootstrap FluxCD" echo "----------------------------------------" @@ -151,7 +111,6 @@ bootstrap_flux() { generate_flux_manifests install_flux setup_sealed_secrets -apply_git_source_secret bootstrap_flux clear diff --git a/scripts/install-k3d-htwg-1.sh b/scripts/install-k3d-htwg-1.sh index 5dc387f..86d6db0 100755 --- a/scripts/install-k3d-htwg-1.sh +++ b/scripts/install-k3d-htwg-1.sh @@ -68,7 +68,8 @@ create_cluster() { --port "80:80@loadbalancer" \ --port "443:443@loadbalancer" \ --k3s-arg "--disable=traefik@server:0" \ - --k3s-arg "--disable=servicelb@server:0" + --k3s-arg "--disable=servicelb@server:0" \ + --k3s-arg "--disable=metrics-server@server:0" echo "✅ Cluster '${CLUSTER_NAME}' created!" } diff --git a/secrets/htwg-1/kustomization.yaml b/secrets/htwg-1/kustomization.yaml index f2f49be..d743079 100644 --- a/secrets/htwg-1/kustomization.yaml +++ b/secrets/htwg-1/kustomization.yaml @@ -9,4 +9,4 @@ resources: - ../nowchess/htwg-1-prod/ncs-db-secrets.yaml - ../nowchess/htwg-1-prod/ncs-internal-secret.yaml - ../nowchess/htwg-1-prod/remotek6-certs.yaml - - ../postgres-tunnel/secret.yaml + - ../postgres/credentials-htwg-1.yaml