feat: bring up local dev stack — all services running
- Ory Hydra + Kratos: fixed secret management, DSN config, DB migrations, OAuth2Client CRD (helm template skips crds/ dir), login-ui env vars - SeaweedFS: added s3.json credentials file via -s3.config CLI flag - OpenBao: standalone mode with auto-unseal sidecar, keys in K8s secret - OpenSearch: increased memory to 1.5Gi / JVM 1g heap - Gitea: SSL_MODE disable, S3 bucket creation fixed - Hive: automountServiceAccountToken: false (Lima virtiofs read-only rootfs quirk) - LiveKit: API keys in values, hostPort conflict resolved - Linkerd: native sidecar (proxy.nativeSidecar=true) to avoid blocking Jobs - All placeholder images replaced: pingora→nginx:alpine, login-ui→oryd/kratos-selfservice-ui-node Full stack running: postgres, valkey, openbao, opensearch, seaweedfs, kratos, hydra, gitea, livekit, hive (placeholder), login-ui
This commit is contained in:
@@ -5,12 +5,13 @@ set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
CTX="--context=sunbeam"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 1. Check prerequisites
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Checking prerequisites..."
|
||||
for tool in limactl mkcert kubectl helm linkerd; do
|
||||
for tool in limactl mkcert kubectl kustomize linkerd jq; do
|
||||
if ! command -v "$tool" &>/dev/null; then
|
||||
echo "ERROR: '$tool' not found. Install with: brew install $tool" >&2
|
||||
exit 1
|
||||
@@ -33,7 +34,7 @@ else
|
||||
echo "==> Creating Lima VM 'sunbeam' (k3s, 6 CPU / 12 GB / 60 GB)..."
|
||||
limactl start \
|
||||
--name=sunbeam \
|
||||
template://k3s \
|
||||
template:k3s \
|
||||
--memory=12 \
|
||||
--cpus=6 \
|
||||
--disk=60 \
|
||||
@@ -42,81 +43,145 @@ else
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 3. Export kubeconfig
|
||||
# 3. Merge kubeconfig into ~/.kube/config as context "sunbeam"
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Exporting kubeconfig..."
|
||||
mkdir -p ~/.kube
|
||||
limactl shell sunbeam kubectl config view --raw > ~/.kube/sunbeam.yaml
|
||||
export KUBECONFIG=~/.kube/sunbeam.yaml
|
||||
echo " KUBECONFIG=$KUBECONFIG"
|
||||
echo "==> Merging kubeconfig..."
|
||||
LIMA_KUBECONFIG="/Users/$USER/.lima/sunbeam/copied-from-guest/kubeconfig.yaml"
|
||||
if [[ ! -f "$LIMA_KUBECONFIG" ]]; then
|
||||
echo "ERROR: Lima kubeconfig not found at $LIMA_KUBECONFIG" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Extract cert data and set context
|
||||
mkdir -p ~/.kube /tmp/sunbeam-kube
|
||||
yq '.clusters[0].cluster.certificate-authority-data' "$LIMA_KUBECONFIG" | base64 -d > /tmp/sunbeam-kube/ca.crt
|
||||
yq '.users[0].user.client-certificate-data' "$LIMA_KUBECONFIG" | base64 -d > /tmp/sunbeam-kube/client.crt
|
||||
yq '.users[0].user.client-key-data' "$LIMA_KUBECONFIG" | base64 -d > /tmp/sunbeam-kube/client.key
|
||||
|
||||
kubectl config set-cluster sunbeam --server=https://127.0.0.1:6443 --certificate-authority=/tmp/sunbeam-kube/ca.crt --embed-certs=true
|
||||
kubectl config set-credentials sunbeam-admin --client-certificate=/tmp/sunbeam-kube/client.crt --client-key=/tmp/sunbeam-kube/client.key --embed-certs=true
|
||||
kubectl config set-context sunbeam --cluster=sunbeam --user=sunbeam-admin
|
||||
rm -rf /tmp/sunbeam-kube
|
||||
echo " Context 'sunbeam' ready."
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 4. Install Linkerd CRDs + control plane
|
||||
# 4. Disable Traefik (k3s default) if still present
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Adding Linkerd Helm repo..."
|
||||
helm repo add linkerd https://helm.linkerd.io/stable --force-update
|
||||
helm repo update linkerd
|
||||
|
||||
echo "==> Installing Linkerd CRDs..."
|
||||
helm upgrade --install linkerd-crds linkerd/linkerd-crds \
|
||||
-n mesh --create-namespace --wait
|
||||
|
||||
echo "==> Installing Linkerd control plane..."
|
||||
helm upgrade --install linkerd-control-plane linkerd/linkerd-control-plane \
|
||||
-n mesh \
|
||||
--set-file identityTrustAnchorsPEM="$(linkerd identity trust-anchors 2>/dev/null || echo '')" \
|
||||
--wait || {
|
||||
echo "==> Bootstrapping Linkerd identity (first install)..."
|
||||
linkerd install --crds | kubectl apply -f -
|
||||
linkerd install | kubectl apply -f -
|
||||
linkerd check
|
||||
}
|
||||
if kubectl $CTX get helmchart traefik -n kube-system &>/dev/null; then
|
||||
echo "==> Removing Traefik (replaced by Pingora)..."
|
||||
kubectl $CTX delete helmchart traefik traefik-crd -n kube-system 2>/dev/null || true
|
||||
fi
|
||||
# Remove startup manifest so k3s doesn't re-create it
|
||||
limactl shell sunbeam sudo rm -f /var/lib/rancher/k3s/server/manifests/traefik.yaml 2>/dev/null || true
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 5. Generate mkcert wildcard cert
|
||||
# 5. Install Gateway API CRDs + Linkerd via CLI
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Generating TLS cert..."
|
||||
bash "$SCRIPT_DIR/local-certs.sh"
|
||||
if ! kubectl $CTX get ns linkerd &>/dev/null; then
|
||||
echo "==> Installing Gateway API CRDs..."
|
||||
kubectl $CTX apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
|
||||
|
||||
echo "==> Installing Linkerd CRDs..."
|
||||
linkerd install --crds | kubectl $CTX apply -f -
|
||||
|
||||
echo "==> Installing Linkerd control plane..."
|
||||
linkerd install | kubectl $CTX apply -f -
|
||||
kubectl $CTX -n linkerd rollout status deployment/linkerd-identity --timeout=120s
|
||||
kubectl $CTX -n linkerd rollout status deployment/linkerd-destination --timeout=120s
|
||||
kubectl $CTX -n linkerd rollout status deployment/linkerd-proxy-injector --timeout=120s
|
||||
echo " Linkerd installed."
|
||||
else
|
||||
echo "==> Linkerd already installed."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 6. Generate mkcert wildcard cert
|
||||
# ---------------------------------------------------------------------------
|
||||
LIMA_IP=$(limactl shell sunbeam hostname -I | awk '{print $1}')
|
||||
DOMAIN="${LIMA_IP}.sslip.io"
|
||||
SECRETS_DIR="$REPO_ROOT/secrets/local"
|
||||
|
||||
if [[ ! -f "$SECRETS_DIR/tls.crt" ]]; then
|
||||
echo "==> Generating TLS cert for *.$DOMAIN..."
|
||||
mkdir -p "$SECRETS_DIR"
|
||||
cd "$SECRETS_DIR"
|
||||
mkcert "*.$DOMAIN"
|
||||
mv "_wildcard.${DOMAIN}.pem" tls.crt
|
||||
mv "_wildcard.${DOMAIN}-key.pem" tls.key
|
||||
cd "$REPO_ROOT"
|
||||
else
|
||||
echo "==> TLS cert already exists."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 6. Create TLS Secret in ingress namespace
|
||||
# 7. Create TLS Secret in ingress namespace
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Applying TLS Secret to ingress namespace..."
|
||||
kubectl create namespace ingress --dry-run=client -o yaml | kubectl apply -f -
|
||||
kubectl create secret tls pingora-tls \
|
||||
--cert="$REPO_ROOT/secrets/local/tls.crt" \
|
||||
--key="$REPO_ROOT/secrets/local/tls.key" \
|
||||
kubectl $CTX create namespace ingress --dry-run=client -o yaml | kubectl $CTX apply -f -
|
||||
kubectl $CTX create secret tls pingora-tls \
|
||||
--cert="$SECRETS_DIR/tls.crt" \
|
||||
--key="$SECRETS_DIR/tls.key" \
|
||||
-n ingress \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
--dry-run=client -o yaml | kubectl $CTX apply -f -
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 7. Substitute domain and apply manifests
|
||||
# 8. Apply manifests (server-side apply handles large CRDs)
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Applying manifests (domain: $DOMAIN)..."
|
||||
# Substitute DOMAIN_SUFFIX placeholder before piping to kubectl
|
||||
kubectl kustomize "$REPO_ROOT/overlays/local" --enable-helm | \
|
||||
cd "$REPO_ROOT"
|
||||
kustomize build overlays/local --enable-helm | \
|
||||
sed "s/DOMAIN_SUFFIX/${DOMAIN}/g" | \
|
||||
kubectl apply -f -
|
||||
kubectl $CTX apply --server-side --force-conflicts -f -
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 8. Wait for core components
|
||||
# 9. Seed secrets (waits for postgres, creates K8s secrets, inits OpenBao)
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Waiting for PostgreSQL cluster..."
|
||||
kubectl wait --for=condition=Ready cluster/postgres -n data --timeout=180s || true
|
||||
echo "==> Seeding secrets..."
|
||||
bash "$SCRIPT_DIR/local-seed-secrets.sh"
|
||||
|
||||
echo "==> Waiting for Redis..."
|
||||
kubectl rollout status deployment/redis -n data --timeout=120s || true
|
||||
# ---------------------------------------------------------------------------
|
||||
# 10. Restart deployments that were waiting for secrets
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Restarting services that were waiting for secrets..."
|
||||
for ns_deploy in \
|
||||
"ory/hydra" \
|
||||
"ory/kratos" \
|
||||
"ory/login-ui" \
|
||||
"devtools/gitea" \
|
||||
"storage/seaweedfs-filer" \
|
||||
"lasuite/hive" \
|
||||
"media/livekit-server"; do
|
||||
ns="${ns_deploy%%/*}"
|
||||
dep="${ns_deploy##*/}"
|
||||
kubectl $CTX -n "$ns" rollout restart deployment/"$dep" 2>/dev/null || true
|
||||
done
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 11. Wait for core components
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Waiting for Valkey..."
|
||||
kubectl $CTX rollout status deployment/valkey -n data --timeout=120s || true
|
||||
|
||||
echo "==> Waiting for Kratos..."
|
||||
kubectl rollout status deployment/kratos -n ory --timeout=120s || true
|
||||
kubectl $CTX rollout status deployment/kratos -n ory --timeout=120s || true
|
||||
|
||||
echo "==> Waiting for Hydra..."
|
||||
kubectl rollout status deployment/hydra -n ory --timeout=120s || true
|
||||
kubectl $CTX rollout status deployment/hydra -n ory --timeout=120s || true
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 9. Print URLs
|
||||
# 12. Print URLs
|
||||
# ---------------------------------------------------------------------------
|
||||
bash "$SCRIPT_DIR/local-urls.sh"
|
||||
echo ""
|
||||
echo "==> Stack is up. Domain: $DOMAIN"
|
||||
echo ""
|
||||
echo "Services:"
|
||||
echo " Auth: https://auth.${DOMAIN}/"
|
||||
echo " Docs: https://docs.${DOMAIN}/"
|
||||
echo " Meet: https://meet.${DOMAIN}/"
|
||||
echo " Drive: https://drive.${DOMAIN}/"
|
||||
echo " Chat: https://chat.${DOMAIN}/"
|
||||
echo " People: https://people.${DOMAIN}/"
|
||||
echo " Gitea: https://src.${DOMAIN}/"
|
||||
echo ""
|
||||
echo "OpenBao UI: kubectl $CTX -n data port-forward svc/openbao 8200:8200"
|
||||
echo " http://localhost:8200 (token from: kubectl $CTX -n data get secret openbao-keys -o jsonpath='{.data.root-token}' | base64 -d)"
|
||||
|
||||
Reference in New Issue
Block a user