12-JUL-2025

1456

I set up a vault auto-chart, and will set up a vault-operator autochart, but I need to figure out how I’m storing all my helm charts first, I don’t like where they live now (in telperion south of the emerald.city VM folder), since they should be relatively agnostic.

I could store them in laurelin, but they aren’t going to be nix files so they are a little out of place.

I could store them in a new repo, and tbh that’s where I’m leaning, but it means if I need a secrets-repo for it I’ve added another narya, which I’d like to keep to a minimum.

I think they’re probably going to get split into their own repo, my plan is to largely have the k3s module in laurelin set up the initial state that the repo would expect, and then the repo will contain an ‘initialize’ script that runs through all the bootstrapping, and the rest will just be ‘normal’ helm-files with a parent ‘install/upgrade’ script.

Eventually I suspect I’ll build an operator for all my stuff, but today is not that day.

An alternative would be to have some of the bootstrap script contained in the module itself, since I’m going to have it minimally be able to set up:

1. Vault
2. Cert-manager
3. NFS
4. Longhorn

Then it could drop a bunch of systemd oneshots that depend on a parent job that does the initial install semi-automatically. You’d deploy a single node in ‘server’ mode, log in, run the script via systemctl start emerald-city-k8s-install or whatever, then it’d spit back the secret you need for all the other client machines.

The other chart repo would then just contain install files for the services on top of the substrate.

Right now I’m also using an ‘out of band’ docker registry, so it’d probably be good to add an option to run said registry and automatically generate the relevant trust files; the true ideal would be to run it within k8s and have it loop back, though I suspect that might be not recommended, because cool things rarely are.