95 lines
3.8 KiB
Makefile
95 lines
3.8 KiB
Makefile
.PHONY: init plan apply destroy clean kubeconfig talosconfig argocd-password bootstrap decrypt post-apply build-mcp-auth-proxy
|
|
|
|
SECRET ?= dumpnet
|
|
FORGEJO_REGISTRY ?= forge.keane.sh
|
|
FORGEJO_USER ?= ian
|
|
MCP_AUTH_PROXY_IMAGE=$(FORGEJO_REGISTRY)/$(FORGEJO_USER)/mcp-auth-proxy
|
|
TF_DIR=terraform
|
|
SOPS_FILES=controlplane.yaml worker.yaml talosconfig
|
|
|
|
# Cluster infrastructure
|
|
init:
|
|
cd $(TF_DIR) && terraform init
|
|
|
|
plan:
|
|
cd $(TF_DIR) && terraform plan
|
|
|
|
apply:
|
|
cd $(TF_DIR) && terraform apply -target=talos_cluster_kubeconfig.this
|
|
@echo "==> Waiting 60s for Kubernetes API to be ready..."
|
|
@sleep 60
|
|
cd $(TF_DIR) && terraform apply
|
|
|
|
destroy:
|
|
cd $(TF_DIR) && terraform destroy
|
|
|
|
# Full clean slate - run before destroy when recreating from scratch
|
|
# Removes resources that block terraform from recreating cleanly
|
|
clean:
|
|
@echo "==> Force-deleting Secrets Manager secret..."
|
|
-aws secretsmanager delete-secret --secret-id $(SECRET) --force-delete-without-recovery 2>/dev/null || true
|
|
@echo "==> Clearing stale kubeconfig contexts..."
|
|
-kubectl config delete-context admin@dumpnet 2>/dev/null || true
|
|
-kubectl config delete-cluster dumpnet 2>/dev/null || true
|
|
-kubectl config delete-user admin@dumpnet 2>/dev/null || true
|
|
@echo "==> Clearing stale talosctl contexts..."
|
|
-talosctl config remove dumpnet 2>/dev/null || true
|
|
-talosctl config remove dumpnet-1 2>/dev/null || true
|
|
@echo "==> Done. Run 'make destroy' then 'make apply' to rebuild from scratch."
|
|
|
|
# Bootstrap ArgoCD app of apps (run once after cluster is up)
|
|
bootstrap:
|
|
kubectl apply -f apps/apps.yaml
|
|
@echo "ArgoCD will now manage apps/ directory - future group changes are self-healing via git push"
|
|
|
|
# Images
|
|
build-mcp-auth-proxy:
|
|
@echo "==> Logging into Forgejo registry..."
|
|
$(eval REGISTRY_TOKEN=$(shell aws secretsmanager get-secret-value --secret-id $(SECRET) --query SecretString --output text | python3 -c "import sys,json; print(json.load(sys.stdin)['forgejo']['registry_token'])"))
|
|
echo "$(REGISTRY_TOKEN)" | docker login $(FORGEJO_REGISTRY) --username $(FORGEJO_USER) --password-stdin
|
|
docker build -t $(MCP_AUTH_PROXY_IMAGE):latest images/mcp-auth-proxy/
|
|
docker push $(MCP_AUTH_PROXY_IMAGE):latest
|
|
@echo "Pushed mcp-auth-proxy to $(MCP_AUTH_PROXY_IMAGE):latest"
|
|
|
|
# Credentials
|
|
talosconfig:
|
|
aws secretsmanager get-secret-value --secret-id $(SECRET) \
|
|
--query SecretString --output text | python3 -c \
|
|
"import sys,json; print(json.load(sys.stdin)['cluster']['talosconfig'])" \
|
|
> /tmp/talosconfig-dumpnet
|
|
talosctl config merge /tmp/talosconfig-dumpnet
|
|
rm /tmp/talosconfig-dumpnet
|
|
talosctl config context dumpnet
|
|
|
|
kubeconfig:
|
|
-kubectl config delete-context admin@dumpnet 2>/dev/null || true
|
|
-kubectl config delete-cluster dumpnet 2>/dev/null || true
|
|
-kubectl config delete-user admin@dumpnet 2>/dev/null || true
|
|
aws secretsmanager get-secret-value --secret-id $(SECRET) \
|
|
--query SecretString --output text | python3 -c \
|
|
"import sys,json; print(json.load(sys.stdin)['cluster']['kubeconfig'])" \
|
|
> /tmp/kubeconfig-dumpnet
|
|
KUBECONFIG=~/.kube/config:/tmp/kubeconfig-dumpnet kubectl config view --flatten > /tmp/merged
|
|
mv /tmp/merged ~/.kube/config
|
|
rm /tmp/kubeconfig-dumpnet
|
|
kubectl config use-context admin@dumpnet
|
|
|
|
argocd-password:
|
|
@aws secretsmanager get-secret-value --secret-id $(SECRET) \
|
|
--query SecretString --output text | python3 -c \
|
|
"import sys,json; print(json.load(sys.stdin)['cluster']['argocd_admin_password'])"
|
|
|
|
# Decrypt sensitive files to /tmp for one-off talosctl use
|
|
# Files are never decrypted in the repo directory
|
|
decrypt:
|
|
@for f in $(SOPS_FILES); do \
|
|
if [ -f $$f ]; then \
|
|
echo "Decrypting $$f to /tmp/$$f..."; \
|
|
sops -d $$f > /tmp/$$f; \
|
|
fi; \
|
|
done
|
|
@echo "Decrypted files are in /tmp/ - they will not persist after reboot"
|
|
|
|
# Run all post-apply steps (run once after fresh cluster creation)
|
|
post-apply:
|
|
scripts/post-apply.sh
|