feat(provision): one-command automation for runbook steps 2, 4, 5 - #171
Merged
Conversation
Three idempotent scripts so go-live is copy-paste once the cluster and domain exist (the only parts that need human accounts): - install_addons.sh <email>: ingress-nginx + cert-manager (+ Let's Encrypt ClusterIssuer, webhook-retry) + sealed-secrets + namespace, waits for readiness, prints the ingress IP for the DNS records. - make_sealed_secrets.sh: generates strong values for all five app secrets and seals them against the live cluster — plaintext never touches disk; writes committable manifests + kustomization under k8s/overlays/production/sealed/. Prints the ghcr pull-secret command (the PAT is the user's to create). - wire_github_and_deploy.sh <tag>: confirms the kubectl context, sets the KUBE_CONFIG repo secret via gh, tags, and pushes — firing the full CD run; prints the bootstrap_admin follow-up. Runbook sections 2/5/7 now lead with the script and keep the manual flow as reference. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The go-live runbook's cluster-side steps were copy-paste-heavy. These scripts collapse each to one command, so the human work shrinks to exactly what needs human accounts: create the cluster, point DNS, create a ghcr PAT.
What
scripts/provision/install_addons.sh <acme-email>— ingress-nginx, cert-manager + ClusterIssuer (with webhook retry), sealed-secrets, namespace; waits for readiness and prints the ingress IP for DNS.scripts/provision/make_sealed_secrets.sh— generates strong values for the five application secrets and seals them against the live cluster (plaintext never written to disk), emitting committable manifests + kustomization underk8s/overlays/production/sealed/. Prints the ghcr pull-secret command for the user's PAT.scripts/provision/wire_github_and_deploy.sh <tag>— confirms the kubectl context interactively, setsKUBE_CONFIGviagh secret set, tags and pushes → fires the full CD deploy; prints thebootstrap_adminfollow-up.All three are idempotent and
bash -nclean; the runbook's sections 2/5/7 now lead with them.No behavior change to CI/CD or the app — scripts + docs only.
🤖 Generated with Claude Code