k8s.leonid.sh

Personal Kubernetes environment for leonid.sh.

Prerequisites: authenticated yc, configured Terraform backend credentials, terraform, ansible-playbook, helm, kubectl, and argocd.

Provision cloud resources

cd cloud_resources/yc
terraform init -backend-config="access_key=$ACCESS_KEY" -backend-config="secret_key=$SECRET_KEY"
terraform apply

Before the first terraform init, configure remote state storage by following the Yandex Cloud Terraform state storage guide.

Fetch kubeconfig for the provisioned cluster with yc:

yc managed-kubernetes cluster get-credentials \
  --id "$(terraform output -raw cluster_id)" \
  --kubeconfig ~/.kube/k8s.leonid.sh.conf \
  --external \
  --force

Commit generated values

Read the values created by Terraform:

terraform output -raw gateway_public_ip
terraform output -raw cert_manager_lockbox_secret_id
terraform output -raw external_dns_lockbox_secret_id
terraform output -raw minecraft_disk_id

Copy them into:

• gateway.publicIP in argocd/platform/envoy-gateway/values.yaml
• externalSecret.lockboxSecretId in argocd/platform/cert-manager/values.yaml
• externalSecret.lockboxSecretId in argocd/platform/external-dns/values.yaml
• storage.diskId in argocd/minecraft/values.yaml

Commit and push these values before bootstrap because Argo CD reads its applications from master on GitHub:

cd ../..
git add argocd/platform/envoy-gateway/values.yaml \
  argocd/platform/cert-manager/values.yaml \
  argocd/platform/external-dns/values.yaml \
  argocd/minecraft/values.yaml
git commit -m "Configure platform cloud values"
git push origin master

Bootstrap the cluster

cd ansible
python3 -m pip install -r requirements.txt
ansible-galaxy collection install -r requirements.yml
ansible-playbook playbooks/bootstrap.yml

Ansible runs terraform output -json in cloud_resources/yc and reads the required values from the configured remote Terraform state. It uses them to fetch kubeconfig, seed the External Secrets and Git bootstrap credentials, install Argo CD, and sync the platform applications.

Destroy the environment

Run the decommission playbook while the Kubernetes cluster and ExternalDNS are still available. It removes the Argo CD workloads, ExternalDNS-managed records, and the dynamically provisioned Loki and Prometheus disks.

cd ansible
ansible-playbook playbooks/decommission.yml -e decommission_confirmation=DESTROY

cd ../cloud_resources/yc
terraform destroy