From 0627510f10ffc06671721f369ec4dd1f8d5f5a2b Mon Sep 17 00:00:00 2001
From: Jacques ROUSSEL <jacques.roussel@rouaje.com>
Date: Thu, 28 Nov 2024 16:55:57 +0100
Subject: [PATCH] =?UTF-8?q?=E2=99=BB=EF=B8=8F(tilt)=20simplify=20the=20loc?=
 =?UTF-8?q?al=20stack?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit solves few issues:
- sharing the relevant certificates with minio so when triggering the webhook
notification, the minio pod can verify our backend domain certificates.
- making sure everything spawn in the right namespace (LiveKit and the Egress)
without relying on a dirty fix in the make start-tilt.

all these fixes were made by @rouja, I don't fully understand them yet.
He simplified the stack, removing two Kind nodes to make it lightweight.

thx @rouja.
---
 Makefile               |  1 -
 bin/Tiltfile           |  1 -
 bin/start-kind.sh      | 13 +++++++------
 src/helm/helmfile.yaml |  7 +++++++
 4 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/Makefile b/Makefile
index 5d52587d..ef87bd04 100644
--- a/Makefile
+++ b/Makefile
@@ -302,7 +302,6 @@ build-k8s-cluster: ## build the kubernetes cluster using kind
 .PHONY: build-k8s-cluster
 
 start-tilt: ## start the kubernetes cluster using kind
-	kubectl config set-context --current --namespace=meet
 	tilt up -f ./bin/Tiltfile
 .PHONY: build-k8s-cluster
 
diff --git a/bin/Tiltfile b/bin/Tiltfile
index 46b150e6..72d79ba6 100644
--- a/bin/Tiltfile
+++ b/bin/Tiltfile
@@ -1,7 +1,6 @@
 load('ext://uibutton', 'cmd_button', 'bool_input', 'location')
 load('ext://namespace', 'namespace_create', 'namespace_inject')
 namespace_create('meet')
-
 docker_build(
     'localhost:5001/meet-backend:latest',
     context='..',
diff --git a/bin/start-kind.sh b/bin/start-kind.sh
index 99595407..2d1f46bc 100755
--- a/bin/start-kind.sh
+++ b/bin/start-kind.sh
@@ -29,7 +29,7 @@ echo "2. Create kind cluster with containerd registry config dir enabled"
 # https://github.com/kubernetes-sigs/kind/issues/2875
 # https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
 # See: https://github.com/containerd/containerd/blob/main/docs/hosts.md
-cat <<EOF | kind create cluster --config=-
+cat <<EOF | kind create cluster --name visio --config=-
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 containerdConfigPatches:
@@ -52,10 +52,6 @@ nodes:
   - containerPort: 443
     hostPort: 443
     protocol: TCP
-- role: worker
-  image: kindest/node:v1.27.3
-- role: worker
-  image: kindest/node:v1.27.3
 EOF
 
 echo "3. Add the registry config to the nodes"
@@ -68,7 +64,7 @@ echo "3. Add the registry config to the nodes"
 # We want a consistent name that works from both ends, so we tell containerd to
 # alias localhost:${reg_port} to the registry container when pulling images
 REGISTRY_DIR="/etc/containerd/certs.d/localhost:${reg_port}"
-for node in $(kind get nodes); do
+for node in $(kind get nodes --name visio); do
 	docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
 	cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
 [host."http://${reg_name}:5000"]
@@ -136,3 +132,8 @@ echo "6. Install ingress-nginx"
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
 kubectl -n ingress-nginx create secret tls mkcert --key /tmp/127.0.0.1.nip.io+1-key.pem --cert /tmp/127.0.0.1.nip.io+1.pem
 kubectl -n ingress-nginx patch deployments.apps ingress-nginx-controller --type 'json' -p '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--default-ssl-certificate=ingress-nginx/mkcert"}]'
+
+echo "7. Setup namespace"
+kubectl create ns meet
+kubectl config set-context --current --namespace=meet
+kubectl -n meet create secret generic mkcert --from-file=rootCA.pem="$(mkcert -CAROOT)/rootCA.pem"
diff --git a/src/helm/helmfile.yaml b/src/helm/helmfile.yaml
index 7347e54a..c691344c 100644
--- a/src/helm/helmfile.yaml
+++ b/src/helm/helmfile.yaml
@@ -66,6 +66,13 @@ releases:
           annotations:
             nginx.ingress.kubernetes.io/proxy-body-size: "0"
             kubernetes.io/ingress.class: nginx
+        extraVolumes:
+          - name: mkcert
+            secret:
+              secretName: mkcert
+        extraVolumeMounts:
+          - mountPath: /certs/CAs/
+            name: mkcert
 
   - name: redis
     installed: {{ eq .Environment.Name "dev" | toYaml }}