zeekayandHanzo Dev
0734789c4e
The Job that applies Lux's app graph was declared; the ConfigMap it mounts was not. `make iam-provision` built that ConfigMap with kubectl create --from-file, deleted the Job, applied it, and waited — all against do-sfo3-hanzo-k8s, written into the Makefile. So the document a converge actually read existed only in whichever cluster someone last typed at, and nothing could say whether it was provision.yaml at HEAD. infra/k8s/iam/kustomization.yaml declares both, with the name-suffix hash off because the Job mounts the ConfigMap by name. `kubectl diff -k infra/k8s/iam` now answers the question the imperative form could not be asked. It stays a manifest rather than becoming a deploy/ values file for two reasons, both structural: it runs on the cluster that answers lux.id, not the one this fleet is addressed to, and the app chart expresses Deployments, StatefulSets and DaemonSets — not one-shot Jobs. Co-authored-by: Hanzo Dev <[email protected]>
50 lines
2.1 KiB
YAML
50 lines
2.1 KiB
YAML
# Lux's IAM app graph, whole, in git.
|
|
#
|
|
# The Job and the document it reads used to be two different kinds of thing.
|
|
# provision-job.yaml was declared here; the ConfigMap it mounts was NOT — it was
|
|
# built at a terminal by `make iam-provision`, which ran
|
|
#
|
|
# kubectl create configmap lux-iam-provision --from-file=… | kubectl apply -f -
|
|
# kubectl delete job lux-iam-provision
|
|
# kubectl apply -f infra/k8s/iam/provision-job.yaml
|
|
#
|
|
# against a context hardcoded in the Makefile. So the input to a converge existed
|
|
# only in whatever cluster somebody last typed at, and nothing could tell you
|
|
# whether it matched provision.yaml at HEAD.
|
|
#
|
|
# A configMapGenerator is the same fact, declared. Both objects come from this
|
|
# directory now, and `kubectl diff -k` answers "does the cluster hold the
|
|
# document in git" — a question the imperative form could not be asked.
|
|
#
|
|
# NAME SUFFIX HASH OFF, deliberately. The Job mounts `lux-iam-provision` by name;
|
|
# a hashed name would mount nothing and the Job would fail on a missing volume.
|
|
# The upside a hash buys — a pod roll when the data changes — is not wanted here
|
|
# either: this is a Job, so a new run is a new pod by construction.
|
|
#
|
|
# Runs in ns hanzo on the cluster that answers lux.id, because that is where the
|
|
# IAM this converges lives and where its service token is stored — which is why
|
|
# it is not a deploy/ values file: this fleet's ApplicationSet is addressed to
|
|
# lux-cluster, and the app chart expresses Deployments, StatefulSets and
|
|
# DaemonSets, not one-shot Jobs.
|
|
#
|
|
# kubectl --context <ctx> diff -k infra/k8s/iam # always, first
|
|
# kubectl --context <ctx> apply -k infra/k8s/iam
|
|
# kubectl --context <ctx> -n hanzo logs job/lux-iam-provision --tail=100
|
|
#
|
|
# Re-running is a no-op by construction: the upsert keys on <org>-<app> and a
|
|
# request that omits clientSecret preserves the secret IAM already issued.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: hanzo
|
|
|
|
resources:
|
|
- provision-job.yaml
|
|
|
|
generatorOptions:
|
|
disableNameSuffixHash: true
|
|
|
|
configMapGenerator:
|
|
- name: lux-iam-provision
|
|
files:
|
|
- provision.yaml
|