From ea58428a0c73d6bf8754031a1704e8cf69580a47 Mon Sep 17 00:00:00 2001 From: Ludovic Piot Date: Wed, 14 May 2025 22:05:59 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Slides=20now=20generate!=20=20?= =?UTF-8?q?=E2=99=BB=EF=B8=8F=20Move=20a=20slide?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- slides/k8s/a-company-scenario.md | 106 ++++++++++++++----------------- 1 file changed, 46 insertions(+), 60 deletions(-) diff --git a/slides/k8s/a-company-scenario.md b/slides/k8s/a-company-scenario.md index e8e83a8a..551bf364 100644 --- a/slides/k8s/a-company-scenario.md +++ b/slides/k8s/a-company-scenario.md @@ -271,26 +271,6 @@ What the _**🎸ROCKY**_ team has to do: --- -## Creating the dedicated `rocky` tenant - -- Using the `flux` _CLI_, we create the file configuring the tenant for the _**🎸ROCKY**_ team -- This is done in the global mutualized `base` configuration for both Kubernetes clusters - -.lab[ - -- Review the deployment manifest: - ```bash - -$ mkdir -p ./tenants/base/rocky -$ flux create tenant rocky \ - --with-namespace=rocky-ns \ - --cluster-role=rocky-full-access \ - --export > ./tenants/base/rocky/rbac.yaml ``` - -] - ---- - # T01- _**⚗️TEST**_ cluster creation @@ -373,7 +353,7 @@ On est dans le respect du _pattern_ roi dans `Kubernetes` : **la convergence ver - connectivité réseau - droits _RBAC_ ----- +--- ### Flux install - Checking prerequisites @@ -388,20 +368,20 @@ $ flux check ---pre ✔ prerequisites checks passed ``` ----- +--- ### Git repo to host Flux configuration - La CLI va créer un dépôt `fleet-infra` dans notre organisation `Github` : `one-kubernetes` - Elle a besoin d'un _token_ `Github` capable de _CRUD_ sur les dépôts. ----- +--- ### Github - Generate a personnal access token ![Generate a Github personnal access token](images/github_add_token.png) ----- +--- ### Github configuration by Flux @@ -410,7 +390,7 @@ $ flux check ---pre ![Teams in Github](images/github_teams.jpg) ----- +--- ### Disclaimer @@ -418,11 +398,11 @@ $ flux check ---pre - C'est tout l'avantage des sources de configuration multiples. ----- +--- ### T03- Creating dedicated `Github` repo to host Flux config -```bash [1-3|5-10] +```bash $ export GITHUB_TOKEN="" $ export GITHUB_USER="one-kubernetes" $ export GITHUB_REPO="fleet-infra" @@ -470,17 +450,17 @@ $ flux bootstrap github \ ✔ all components are healthy ``` ----- +--- ### Flux config files ![Flux config files](images/flux_config_files.jpg) ----- +--- ### 📄 gotk-sync.yaml -```yaml [2-14|15-27] +```yaml # This manifest was generated by flux. DO NOT EDIT. --- apiVersion: source.toolkit.fluxcd.io/v1beta1 @@ -510,7 +490,7 @@ spec: name: flux-system ``` ----- +--- ### 📄 kustomization.yaml @@ -522,7 +502,7 @@ resources: - gotk-sync.yaml ``` ----- +--- ### Cloning the git repo locally @@ -540,15 +520,15 @@ git clone https://github.com/${GITHUB_USER}/${GITHUB_REPO} 2. qui sera surchargée par une config. spécifique au _tenant_ - 💡Ça paraît compliqué, mais pas d'inquiétude : la _CLI_ `Flux` s'occupe de l'essentiel ----- +--- ![Multi-tenants clusters](images/cluster_multi_tenants.jpg) ----- +--- ### The command -```bash [1|2-8] +```bash $ cd ./fleet-infra $ flux create kustomization tenants \ --namespace=flux-system \ @@ -559,7 +539,7 @@ $ flux create kustomization tenants \ --export >> clusters/mycluster/tenants.yaml ``` ----- +--- ### 📄 tenants.yaml @@ -579,7 +559,7 @@ spec: name: flux-system ``` ----- +--- ### T04- Don't forget to commit! @@ -589,10 +569,15 @@ spec: # R01- Configuring _**🎸ROCKY**_ deployment with Flux ----- +--- ## Creating the _tenant_ dedicated to _**🎸ROCKY**_ team on _**⚗️TEST**_ cluster +- Using the `flux` _CLI_, we create the file configuring the tenant for the _**🎸ROCKY**_ team +- This is done in the global mutualized `base` configuration for both Kubernetes clusters + +.lab[ +- Review the deployment manifest: ```bash $ mkdir -p ./tenants/base/rocky $ flux create tenant rocky \ @@ -600,12 +585,13 @@ $ flux create tenant rocky \ --cluster-role=rocky-full-access \ --export > ./tenants/base/rocky/rbac.yaml ``` +] ----- +--- ### 📄 ./tenants/base/rocky/rbac.yaml -```yaml [1-7|9-16|18-36] +```yaml --- apiVersion: v1 kind: Namespace @@ -644,7 +630,7 @@ subjects: namespace: rocky-ns ``` ----- +--- ## _namespace_ isolation for _**🎸ROCKY**_ @@ -663,11 +649,11 @@ rules: EOF ``` ----- +--- ## Creating `Github` source in Flux for _**🎸ROCKY**_ git repository -```bash [1-5|6-10|11-13] +```bash $ flux create source git dev1-aspicot \ --namespace=rocky-ns \ --url=https://github.com/one-kubernetes/dev1-aspicot-app/ \ @@ -683,11 +669,11 @@ $ kustomize create --autodetect $ cd - ``` ----- +--- ### 📄 ./tenants/base/rocky/sync.yaml -```yaml [1-11|13-26] +```yaml --- apiVersion: source.toolkit.fluxcd.io/v1beta1 kind: GitRepository @@ -716,7 +702,7 @@ spec: name: dev1-aspicot ``` ----- +--- ### 📄 ./tenants/base/rocky/kustomization.yaml @@ -730,7 +716,7 @@ resources: ``` ----- +--- ### Synchronizing Flux config with its Github repo @@ -738,7 +724,7 @@ Après git commit && git push, on obtient cette arborescence. ![rocky config files](images/dev1_config_files.jpg) ----- +--- ## R02- Creating the kustomization in the ROCKY source code repository @@ -751,12 +737,12 @@ Après git commit && git push, on obtient cette arborescence. kustomize create --autodetect ``` ----- +--- ## Adding a kustomize patch for _**⚗️TEST**_ cluster deployment -```bash [1|2-10|11-20] +```bash $ mkdir -p ./tenants/test/rocky $ cat << EOF | tee ./tenants/test/rocky/rocky-patch.yaml apiVersion: kustomize.toolkit.fluxcd.io/v1beta1 @@ -779,19 +765,19 @@ patches: EOF ``` ----- +--- ## The whole configuration waterfall ![Flux configuration waterfall](images/flux_config_dependencies.jpg) ----- +--- ## Rocky app is deployed on _**⚗️TEST**_ cluster ![rocky Web site](images/dev1_website001.png) ----- +--- ## ⚠️ Limitations @@ -844,7 +830,7 @@ Créer le tenant dédié à _**🎻CLASSY**_ se fait de la même manière que po 2. création du _namespace_ 3. isolation du _namespace_ (ServiceAccount, RoleBinding, Role) ----- +--- ## Creating the `Helm` source in Flux for _**🎻CLASSY**_ Helm chart @@ -852,18 +838,18 @@ Créer le tenant dédié à _**🎻CLASSY**_ se fait de la même manière que po On ne se source plus depuis un dépôt `git` mais depuis un dépôt de _charts_ `Helm` -```bash [1-4] +```bash $ flux create source helm charts \ --url=https://one-kubernetes.github.io/classy-helm-charts \ --interval=3m \ --export > ./tenants/base/classy/sync.yaml ``` ----- +--- ## Creating the `HelmRelease` in Flux -```bash [1-7|9] +```bash $ flux create helmrelease dev2-carapuce \ --namespace=classy-ns \ --service-account=classy \ @@ -875,11 +861,11 @@ $ flux create helmrelease dev2-carapuce \ $ cd ./tenants/base/classy/ && kustomize create --autodetect ``` ----- +--- ### 📄 ./tenants/base/classy/sync.yaml -```yaml [1-9|11-16|17-27] +```yaml --- apiVersion: source.toolkit.fluxcd.io/v1beta1 kind: HelmRepository @@ -909,7 +895,7 @@ spec: serviceAccountName: classy ``` ----- +--- ### C03- Synchro avec le dépôt Github