# README

## Get Started

1. install tools

    - pulumi [<https://www.pulumi.com/docs/get-started/aws/begin/>](https://www.pulumi.com/docs/get-started/aws/begin/#configure-pulumi-to-access-your-aws-account)
    - aws cli

2. configure pulumi to use S3 backend(S3 bucket has been manually created)

    - login to <https://pingcap.awsapps.com/start#/>
    - configure aws cli(set `~/.aws/credentials`)
    - `pulumi login s3://qa-test-infra/pulumi`

3. ready to go
    - `export PULUMI_CONFIG_PASSPHRASE=''`
    - `pulumi stack select eks`
    - `pulumi stack output kubeconfig > kubeconfig.yaml` to fetch kubeconfig
    - run `pulumi stack` you can see output like:

```sh
$ pulumi stack
Current stack is eks:
    Managed by laptop
    Last updated: 6 minutes ago (2022-04-24 17:43:37.079264958 +0800 CST)
    Pulumi version: 3.28.0

Current stack resources (27):
    TYPE                                                        NAME
    pulumi:pulumi:Stack                                         eks-eks
    ├─ aws:ec2/securityGroup:SecurityGroup                      test-infra-openvpn
    ├─ aws:iam/role:Role                                        test-infra-workerRole
    ├─ eks:index:Cluster                                        test-infra
    │  ├─ eks:index:ServiceRole                                 test-infra-eksRole
    │  │  ├─ aws:iam/role:Role                                  test-infra-eksRole-role
    │  │  ├─ aws:iam/rolePolicyAttachment:RolePolicyAttachment  test-infra-eksRole-4b490823
    │  │  └─ aws:iam/rolePolicyAttachment:RolePolicyAttachment  test-infra-eksRole-90eb1c99
    │  ├─ aws:ec2/securityGroup:SecurityGroup                   test-infra-eksClusterSecurityGroup
    │  ├─ aws:ec2/securityGroupRule:SecurityGroupRule           test-infra-eksClusterInternetEgressRule
    │  ├─ aws:eks/cluster:Cluster                               test-infra-eksCluster
    │  ├─ pulumi:providers:kubernetes                           test-infra-provider
    │  ├─ aws:ec2/securityGroup:SecurityGroup                   test-infra-nodeSecurityGroup
    │  ├─ pulumi:providers:kubernetes                           test-infra-eks-k8s
    │  ├─ eks:index:VpcCni                                      test-infra-vpc-cni
    │  ├─ aws:ec2/securityGroupRule:SecurityGroupRule           test-infra-eksClusterIngressRule
    │  ├─ aws:ec2/securityGroupRule:SecurityGroupRule           test-infra-eksNodeIngressRule
    │  ├─ kubernetes:core/v1:ConfigMap                          test-infra-nodeAccess
    │  ├─ kubernetes:storage.k8s.io/v1:StorageClass             test-infra-0
    │  ├─ aws:ec2/securityGroupRule:SecurityGroupRule           test-infra-eksExtApiServerClusterIngressRule
    │  ├─ aws:ec2/securityGroupRule:SecurityGroupRule           test-infra-eksNodeInternetEgressRule
    │  └─ aws:ec2/securityGroupRule:SecurityGroupRule           test-infra-eksNodeClusterIngressRule
    ├─ aws:iam/instanceProfile:InstanceProfile                  test-infra-instanceProfile
    ├─ pulumi:providers:aws                                     default
    ├─ pulumi:providers:eks                                     default
    ├─ pulumi:providers:pulumi                                  default
    └─ pulumi:providers:aws                                     default_4_38_1
```

## Deploy

-   Run `pulumi up` twice(because we need to create nodeSecurityGroupRule after nodeSecurityGroup is created).
-   [install CSI](https://docs.aws.amazon.com/eks/latest/userguide/ebs-csi.html) to use gp3 volume
    NOTE: the operation isn't idempotent, you might need to manually [delete cloudformation staff](https://github.com/weaveworks/eksctl/issues/3109#issuecomment-763228910) before rerun(otherwise rerun just useless).
-   install cluster-auto-scaler
      <!-- TODO: install by pulumi-->

    ```sh
      helm repo add autoscaler https://kubernetes.github.io/autoscaler
      helm repo update
      helm install cluster-auto-scaler autoscaler/cluster-autoscaler --version 9.13.1 -f cluster-auto-scaler.values.yaml --namespace kube-system
    ```

-   install cert-manager

    ```sh
      helm repo add jetstack https://charts.jetstack.io
      helm repo update
      helm install \
        cert-manager jetstack/cert-manager \
        --namespace cert-manager \
        --create-namespace \
        --version v1.8.2 \
        --set installCRDs=true
    ```