bakery-admin/bakery-ia
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Imporve the infra

Browse Source
This commit is contained in:
Urtzi Alfaro
2026-01-02 21:33:23 +01:00
parent 4e4a48bf03
commit b91979b840
5 changed files with 343 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
Tiltfile
View File

@@ -6,8 +6,20 @@
# - Strong 32-character passwords with PersistentVolumeClaims
# - PostgreSQL pgcrypto extension and audit logging
# - Organized resource dependencies and live-reload capabilities
# - Local registry for faster image builds and deployments
# =============================================================================
# =============================================================================
# TILT CONFIGURATION
# =============================================================================
# Ensure we're running in the correct context
allow_k8s_contexts('kind-bakery-ia-local')
# Use local registry for faster builds and deployments
# This registry is created by kubernetes_restart.sh script
default_registry('localhost:5001')
# =============================================================================
# SECURITY & INITIAL SETUP
# =============================================================================
@@ -94,6 +106,32 @@ local_resource(
labels=['00-security']
)
# Install and verify cert-manager
local_resource(
'cert-manager-install',
cmd='''
echo "📦 Installing cert-manager..."
# Check if cert-manager CRDs already exist
if kubectl get crd certificates.cert-manager.io >/dev/null 2>&1; then
echo " ✅ cert-manager CRDs already installed"
else
echo " Installing cert-manager v1.13.2..."
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.2/cert-manager.yaml
echo " Waiting for cert-manager to be ready..."
kubectl wait --for=condition=available --timeout=120s deployment/cert-manager -n cert-manager
kubectl wait --for=condition=available --timeout=120s deployment/cert-manager-webhook -n cert-manager
echo " ✅ cert-manager installed and ready"
fi
echo "✅ cert-manager verification complete"
''',
labels=['00-security'],
auto_init=True
)
# =============================================================================
# LOAD KUBERNETES MANIFESTS
# =============================================================================

29
infrastructure/kubernetes/overlays/dev/cluster-issuer-staging.yaml Normal file
View File

@@ -0,0 +1,29 @@
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned-issuer
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
# The ACME server URL (Let's Encrypt staging)
server: https://acme-staging-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: admin@bakery-ia.local # Change this to your email
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-staging
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
class: nginx
podTemplate:
spec:
nodeSelector:
"kubernetes.io/os": linux

2
infrastructure/kubernetes/overlays/dev/kustomization.yaml
View File

@@ -14,7 +14,7 @@ resources:
- dev-ingress.yaml
# Dev-Prod Parity: Enable HTTPS with self-signed certificates
- dev-certificate.yaml
- ../../base/components/cert-manager/cluster-issuer-staging.yaml
- cluster-issuer-staging.yaml
# Exclude nominatim from dev to save resources
# Using scale to 0 for StatefulSet to prevent pod creation

114
kubernetes_restart.sh
View File

@@ -84,6 +84,16 @@ cleanup() {
print_status "Kind cluster bakery-ia-local not found"
fi
# Stop local registry
print_status "Stopping local registry..."
if docker ps -a | grep -q "kind-registry"; then
docker stop kind-registry 2>/dev/null || true
docker rm kind-registry 2>/dev/null || true
print_success "Local registry removed"
else
print_status "Local registry not found"
fi
# Stop Colima
print_status "Stopping Colima..."
if colima list | grep -q "k8s-local"; then
@@ -119,6 +129,92 @@ check_config_files() {
print_success "Configuration files check completed"
}
# Function to create local registry
create_local_registry() {
local reg_name='kind-registry'
local reg_port='5001'
print_status "Setting up local Docker registry..."
# Create registry container unless it already exists
if [ "$(docker inspect -f '{{.State.Running}}' "${reg_name}" 2>/dev/null || true)" != 'true' ]; then
print_status "Creating registry container on port ${reg_port}..."
docker run \
-d --restart=always \
-p "127.0.0.1:${reg_port}:5000" \
--name "${reg_name}" \
registry:2
if [ $? -eq 0 ]; then
print_success "Local registry created at localhost:${reg_port}"
else
print_error "Failed to create local registry"
exit 1
fi
else
print_success "Local registry already running at localhost:${reg_port}"
fi
# Store registry info for later use
echo "${reg_name}:${reg_port}"
}
# Function to connect registry to Kind
connect_registry_to_kind() {
local reg_name='kind-registry'
local reg_port='5001'
print_status "Connecting registry to Kind network..."
# Connect the registry to the cluster network if not already connected
if [ "$(docker inspect -f='{{json .NetworkSettings.Networks.kind}}' "${reg_name}")" = 'null' ]; then
docker network connect "kind" "${reg_name}"
print_success "Registry connected to Kind network"
else
print_success "Registry already connected to Kind network"
fi
# Configure containerd in the Kind node to use the registry
print_status "Configuring containerd to use local registry..."
# Create the registry config directory
docker exec bakery-ia-local-control-plane mkdir -p /etc/containerd/certs.d/localhost:${reg_port}
# Add registry configuration
docker exec bakery-ia-local-control-plane sh -c "cat > /etc/containerd/certs.d/localhost:${reg_port}/hosts.toml <<EOF
server = \"http://localhost:${reg_port}\"
[host.\"http://${reg_name}:5000\"]
capabilities = [\"pull\", \"resolve\", \"push\"]
skip_verify = true
EOF"
# Restart containerd to pick up new configuration
docker exec bakery-ia-local-control-plane systemctl restart containerd
print_success "Containerd configured for local registry"
# Document the local registry
print_status "Documenting local registry in cluster..."
kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
name: local-registry-hosting
namespace: kube-public
data:
localRegistryHosting.v1: |
host: "localhost:${reg_port}"
help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
EOF
if [ $? -eq 0 ]; then
print_success "Registry documented in cluster"
else
print_warning "Failed to document registry (non-critical)"
fi
}
# Function to handle setup
setup() {
print_status "Starting setup process..."
@@ -137,11 +233,14 @@ setup() {
exit 1
fi
# 2. Create Kind cluster using existing configuration
print_status "Creating Kind cluster with existing configuration..."
# 2. Create local registry before Kind cluster
create_local_registry
# 3. Create Kind cluster using existing configuration with registry support
print_status "Creating Kind cluster with registry configuration..."
if [ -f kind-config.yaml ]; then
print_status "Using existing kind-config.yaml file"
print_status "Using kind-config.yaml with local registry support"
# Extract cluster name from config for verification
CLUSTER_NAME=$(grep -E "name:\s*" kind-config.yaml | head -1 | sed 's/name:\s*//' | tr -d '[:space:]' || echo "bakery-ia-local")
@@ -160,6 +259,9 @@ setup() {
exit 1
fi
# 4. Connect registry to Kind network
connect_registry_to_kind
# 3. Install NGINX Ingress Controller
print_status "Installing NGINX Ingress Controller..."
@@ -220,6 +322,7 @@ setup() {
print_status "Cluster Information:"
echo " - Colima profile: k8s-local"
echo " - Kind cluster: $CLUSTER_NAME"
echo " - Local registry: localhost:5001"
echo " - Direct port mappings (from kind-config.yaml):"
echo " Frontend: localhost:3000 -> container:30300"
echo " Gateway: localhost:8000 -> container:30800"
@@ -234,6 +337,11 @@ setup() {
echo " - Use Ingress via: http://localhost:${HTTP_HOST_PORT}"
echo " - Direct NodePort: http://localhost:30080"
echo "----------------------------------------"
print_status "Local Registry Information:"
echo " - Registry URL: localhost:5001"
echo " - Images will be pushed to: localhost:5001/bakery/<service>"
echo " - Update your Tiltfile with: default_registry('localhost:5001')"
echo "----------------------------------------"
}
# Function to show usage

152
verify-registry.sh Executable file
View File

@@ -0,0 +1,152 @@
#!/bin/bash
# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color
# Function to print colored output
print_status() {
echo -e "${BLUE}[INFO]${NC} $1"
}
print_success() {
echo -e "${GREEN}[SUCCESS]${NC} $1"
}
print_warning() {
echo -e "${YELLOW}[WARNING]${NC} $1"
}
print_error() {
echo -e "${RED}[ERROR]${NC} $1"
}
echo "======================================="
echo "Registry Verification Script"
echo "======================================="
echo ""
# 1. Check if registry container is running
print_status "Checking if kind-registry container is running..."
if docker ps | grep -q "kind-registry"; then
print_success "Registry container is running"
REGISTRY_STATUS=$(docker ps --filter "name=kind-registry" --format "{{.Status}}")
echo " Status: $REGISTRY_STATUS"
else
print_error "Registry container is not running!"
echo " Run: ./kubernetes_restart.sh setup"
exit 1
fi
# 2. Check if registry is accessible on localhost:5001
print_status "Checking if registry is accessible on localhost:5001..."
if curl -s http://localhost:5001/v2/_catalog > /dev/null 2>&1; then
print_success "Registry is accessible"
CATALOG=$(curl -s http://localhost:5001/v2/_catalog)
echo " Catalog: $CATALOG"
else
print_error "Registry is not accessible on localhost:5001"
exit 1
fi
# 3. Check if registry is connected to Kind network
print_status "Checking if registry is connected to Kind network..."
NETWORK_CHECK=$(docker inspect -f='{{json .NetworkSettings.Networks.kind}}' kind-registry 2>/dev/null)
if [ "$NETWORK_CHECK" != "null" ] && [ -n "$NETWORK_CHECK" ]; then
print_success "Registry is connected to Kind network"
else
print_warning "Registry is not connected to Kind network"
print_status "Connecting registry to Kind network..."
docker network connect "kind" "kind-registry"
if [ $? -eq 0 ]; then
print_success "Registry connected successfully"
else
print_error "Failed to connect registry to Kind network"
exit 1
fi
fi
# 4. Check if Kind cluster exists
print_status "Checking if Kind cluster exists..."
if kind get clusters | grep -q "bakery-ia-local"; then
print_success "Kind cluster 'bakery-ia-local' exists"
else
print_error "Kind cluster 'bakery-ia-local' not found"
echo " Run: ./kubernetes_restart.sh setup"
exit 1
fi
# 5. Check if registry is documented in cluster
print_status "Checking if registry is documented in cluster..."
if kubectl get configmap -n kube-public local-registry-hosting &>/dev/null; then
print_success "Registry is documented in cluster"
REG_HOST=$(kubectl get configmap -n kube-public local-registry-hosting -o jsonpath='{.data.localRegistryHosting\.v1}' 2>/dev/null | grep -o 'host: "[^"]*"' | cut -d'"' -f2)
echo " Registry host: $REG_HOST"
else
print_warning "Registry ConfigMap not found in cluster"
print_status "Creating ConfigMap..."
kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
name: local-registry-hosting
namespace: kube-public
data:
localRegistryHosting.v1: |
host: "localhost:5001"
help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
EOF
if [ $? -eq 0 ]; then
print_success "ConfigMap created successfully"
fi
fi
# 6. Test pushing a test image
print_status "Testing image push to registry..."
print_status "Pulling busybox image..."
docker pull busybox:latest > /dev/null 2>&1
print_status "Tagging image for local registry..."
docker tag busybox:latest localhost:5001/test/busybox:latest
print_status "Pushing image to local registry..."
if docker push localhost:5001/test/busybox:latest > /dev/null 2>&1; then
print_success "Successfully pushed test image to registry"
else
print_error "Failed to push image to registry"
exit 1
fi
print_status "Verifying image in registry catalog..."
CATALOG=$(curl -s http://localhost:5001/v2/_catalog)
if echo "$CATALOG" | grep -q "test/busybox"; then
print_success "Test image found in registry catalog"
else
print_warning "Test image not found in catalog, but push succeeded"
fi
# 7. Clean up test image
print_status "Cleaning up test images..."
docker rmi localhost:5001/test/busybox:latest > /dev/null 2>&1
docker rmi busybox:latest > /dev/null 2>&1
echo ""
echo "======================================="
print_success "Registry verification completed!"
echo "======================================="
echo ""
print_status "Summary:"
echo " - Registry URL: localhost:5001"
echo " - Registry container: kind-registry"
echo " - Connected to Kind network: Yes"
echo " - Accessible from host: Yes"
echo " - Test push: Successful"
echo ""
print_status "Next steps:"
echo " 1. Ensure your Tiltfile has: default_registry('localhost:5001')"
echo " 2. Run: tilt up"
echo " 3. Images will be automatically pushed to localhost:5001/bakery/<service>"
echo ""