Building an environment

In this chapter, I will describe how to build an environment in which we will build hscloud services.

Requirements

You need git and curl. On Ubuntu you can install them with:

sudo apt install git curl

Clone the repository with the source code of the cloud services:

git clone "https://gerrit.hackerspace.pl/hscloud"
cd hscloud

Steps

We can configure the environment using nix-shell. To do this, we install nix:

sh <(curl -L https://nixos.org/nix/install) --daemon

And we start it (from inside the hscloud folder):

nix-shell

(alternatively, you can skip whole nix shell config and just install dependencies):

sudo apt-get -y install default-jre default-jdk python3-dev build-essential clang wget libpq-dev zip git
wget https://github.com/bazelbuild/bazelisk/releases/download/v1.18.0/bazelisk-linux-amd64 -O /usr/bin/bazel
chmod +x /usr/bin/bazel

We now use the bazel tool to build and run the necessary services, including prodaccess and kubecfg:

bazel build //tools:install
bazel run //tools:install

Now we can request to grant us access to the hscloud cluster through the prodaccess tool. In place of $hs_username insert the username in SSO hackerspace:

hs_username=$USER # if your username is the same as your SSO username
prodaccess -username $hs_username

If you do not have access to the cluster, contact someone within Matrix #infra channel.

To check if we have access to the cluster, we can run the command:

# shows the Kubernetes version
kubectl version

# shows the statistics of the cluster
kubectl top nodes

We can also call the public Docker image (again, in place of $hs_username, insert the username in SSO hackerspace):

# to create an instance of (sub) alpine
kubectl -n personal-$hs_username run --image=alpine:latest -it foo

If you want to delete the instance, run:

# to delete an instance (sub) of alpine
kubectl -n personal-$hs_username delete pod foo

Using prodaccess with a password manager

Credentials fetched with prodaccess only last for a couple of hours (by design). To make re-authentications more ^R-friendly, pipe your user password from a password manager CLI:

get-password | prodaccess -password-stdin

By default, prodaccess stores user credentials (certificate and key) unencrypted in ~/.kube/config. You can instead save kubernetes credentials in your password manager:

get-password | prodaccess -password-stdin -output-credentials | save-credentials-json

Then point kubernetes tools to the password manager (this step only needs to be done once):

kubectl config delete-user $hs_username@k1.hswaw.net
kubectl config set-credentials $hs_username@k1.hswaw.net \
  --exec-api-version=client.authentication.k8s.io/v1beta1
  --exec-command /your/password/manager
  --exec-arg=get
  --exec-arg=credentials
  --exec-arg=json

Repeat for k0.hswaw.net if needed.

Next step

Next step: Building Flask web app