Access to the SKE cluster(s) of this draft
Generated by StackToIT. StackToIT opens no connection and creates no credential: this is the preparation. Every step below is DEFINED; it is APPLIED once it has been carried out and VERIFIED once its result on STACKIT was checked. Nothing here is APPLIED or VERIFIED.
The manifests of this draft (listed below) are applied with the kubeconfig of the cluster each file names in its header (Target cluster:). The kubeconfig does not exist until the cluster does: run the steps after tofu apply of this draft has created the cluster.
| Cluster (draft address) | Name in the draft | Command that fetches its kubeconfig |
|---|---|---|
stackit_ske_cluster.retail_app_ecs_cluster | reta-7b7ce2 | stackit ske kubeconfig create reta-7b7ce2 --project-id <project-id> --filepath <file> --expiration 1h -y |
Manifest files: kubernetes/carts/manifests.yaml, kubernetes/catalog/manifests.yaml, kubernetes/checkout/manifests.yaml, kubernetes/orders/manifests.yaml, kubernetes/ui/manifests.yaml.
| # | Step | State |
|---|---|---|
| 1 | Wait until the cluster is created (tofu apply of this draft) and reports a healthy state in the STACKIT portal. <!-- kind: TARGET --> | DEFINED |
| 2 | Fetch an admin kubeconfig of the cluster with the STACKIT CLI, logged in to the project: the command in the table above (stackit ske kubeconfig create <cluster-name> --project-id <project-id> --filepath <file> --expiration 1h -y; the STACKIT professional-service examples use the short form without the last three flags). The CLI asks "Are you sure you want to update your kubeconfig for SKE cluster ...?" before it writes, also when --filepath is given; -y (--assume-yes) skips that prompt, which a script needs. Without --filepath (and without KUBECONFIG) the CLI merges the kubeconfig into the default kubeconfig file of your user; --filepath <file> keeps it apart, and a file that already exists is updated, not replaced. The default expiry is one hour (--expiration sets another); fetch a new one when it has expired. It is a credential of the cluster: keep it out of the repository and out of the Terraform state. (Behaviour as the help of STACKIT CLI 0.74.0 states it; the prompt as a run against an SKE cluster showed it.) <!-- kind: TARGET --> | DEFINED |
| 3 | Health verification: kubectl config current-context names the cluster, kubectl get nodes lists the nodes with the status Ready, and the number of Ready nodes of each node pool is within the minimum and the maximum of its node_pools entry in kubernetes.tf (a pool distributes its nodes over its zones). kubectl get pods -n kube-system shows the system pods running. A pool whose nodes do not become Ready is a failed apply of the cluster, not an access problem: look at the cluster in the STACKIT portal. <!-- kind: TARGET --> | DEFINED |
| 4 | Choose the namespace and create it: kubectl create namespace <namespace>. Every manifest file is applied into it with -n <namespace>. <!-- kind: TARGET --> | DEFINED |
| 5 | Create what the header of each manifest file lists under SECRETS TO CREATE, and the image pull secret it names where an image is pulled from a private registry, in that namespace, with the values read from the environment of the person who runs the command. No value is in this draft. <!-- kind: TARGET --> | DEFINED |
| 6 | Apply each manifest file after its required inputs are filled in: kubectl apply -n <namespace> -f <manifest file>. While a REQUIRED_ input stands, a Deployment (or DaemonSet) is held by a REQUIRED_ token in its number of pods (minReadySeconds), which the API server refuses; the token in a string field such as an image is accepted, so replace every REQUIRED_ token, the hold last, before applying. <!-- kind: TARGET --> | DEFINED |
| 7 | Follow the cutover and rollback steps in the header of each manifest file. <!-- kind: EXTERNAL --> | DEFINED |
| 8 | Rollback of the access: the kubeconfig expires and changes nothing in the cluster. To withdraw it earlier, delete the file passed with --filepath, or remove the context, cluster and user entries it added to your default kubeconfig (kubectl config get-contexts lists them; kubectl config delete-context <context>, kubectl config delete-cluster <cluster>, kubectl config unset users.<user>). Fetching a new one repeats the fetch step. The cluster itself is removed by changing this draft (remove its stackit_ske_cluster block and apply), only after nothing runs on it and any workload moved to it is switched back to the source. <!-- kind: TARGET --> | DEFINED |
Not drafted: a stackit_ske_kubeconfig resource. Its kube_config is a sensitive admin kubeconfig that the Terraform state would keep (the pinned provider, the STACKIT provider documentation of ske_kubeconfig (knowledge-base evidence, not in this folder); the default expiry is 3600 seconds and refresh = true writes a new one in place), so the credential is fetched by a person when it is needed. Kubernetes objects of the source that are not manifests of this draft (Kubernetes-provider resources, Helm releases) are not listed here: they are applied to the same cluster, with the same kubeconfig, after they are rewritten for it.