## XAccount Development
### Development in the pod in dev-base-us-west-2

For xaccount development, `eks-provider` must run in the base cluster, you can use [ksync](https://github.com/ksync/ksync) to sync the code to the `eks-provider` pod for development.

Start ksync server on your local and you'll be able to open `localhost:8384` and see the progress.
```bash
ksync watch
ksync create --selector=app=eks-provider $(pwd) /root/go/src -n ${NAMESPECE}
ksync get
```

Exec into eks-provider pod
```bash
kubectl exec -it deploy/eks-provider -- zsh
```

`make pulumi-up` will create `apiserver`、`etcd` and `crssplane-plane` in base cluster. you only need exec it when CRD or crossplane changed.

To clean up the test environment, you can do:
```bash
make pulumi-down
```

`infra` cluster kubeconfig will be exported to `./kubeconfig`, you can do:
```bash
KUBECONFIG=kubeconfig kubectl cluster-info
```

### Run pulumi script in EKS
If your network environment can not run pulumi successfully, you can do it by running a pod in the base cluster
```bash
kubectl create ns {NAMESPACE}
kubectl apply -f pulumi/pulumi.yaml
kubectl exec -it pulumi -n {NAMESPACE}
```

## Create a sample network
Clone terraform code and create resources such as VPC、Bucket、KMS
```bash
git clone --depth=1 git@github.com:tidbcloud/eks-bootstrap.git
cd deploy/resources
terraform apply
```

```bash
cat <<EOF > network.yaml
apiVersion: cloud.pingcap.com/v1
kind: Network
metadata:
  annotations:
  labels:
    cloud.pingcap.com/provider-type: eks
  generateName: sample-network
  namespace: $(whoami)
spec:
  # Cidr value of vpc, default is 192.168.0.0/16
  cidr: 192.168.0.0/16
  forProvider:
    apiVersion: eks.infra.pingcap.com/v1alpha1
    # Value of external_id specified when bootstrap terraform script
    assumeExternalId: "123456"
    assumeRoleArn: $(terraform output assume_role_arn)
    kind: EKSProviderSpec
    nodeRoleArn: $(terraform output node_role_arn)
    securityGroupId: $(terraform output security_group_ids)
    serviceRoleArn: $(terraform output eks_role_arn)
    subnetIds:
    - $(terraform output -raw subnet_ids| awk '{split($0,ids,",");print ids[1]}')
    - $(terraform output -raw subnet_ids| awk '{split($0,ids,",");print ids[2]}')
    - $(terraform output -raw subnet_ids| awk '{split($0,ids,",");print ids[3]}')
    vpcId: $(terraform output vpc_id)
  provider: eks
  region: us-west-2
EOF

kubectl apply -f network.yaml
```

## Update configurations
To avoid checkin credentials, the pulumi config file Pulumi.xaccount-dev.yaml is skipped.
If you need to update and checkin the pulumi configs, you can do this:
```bash
git update-index --no-skip-worktree Pulumi.xaccount-dev.yaml
```

After commit, you need to ignore the file:
```
git update-index --skip-worktree Pulumi.xaccount-dev.yaml
```
And then you can set up pulumi credentials.

## Troubleshoot

### Prerequisite

1. Deploy a debug pod in base infra namespace alongside with eks-infra-provider by:

``` bash
kubectl apply -f hack/debug.yaml -n infra
```

2. Exec into the debug pod

``` bash
kubectl get po -n infra -lapp=debug
kubectl exec -it ${debug_pod_name} -n infra -- bash
```

### Accessing dataplane eks cluster

In debug pod, we can execute the following commands to access dataplane eks cluster

``` bash
# Retrieve kubeconfig for dataplane eks cluster
bash /hack/kuber.sh

# Accessing EKS cluster
export KUBECONFIG=/kubeconfig
k ctx # switch context
k get no
```

### Accessing infra-api

In debug pod, set KUBECONFIG env to access infra-api

``` bash
# Accessing infra-api
export KUBECONFIG=/.kube/config
k get clusters.eks.aws.crossplane.io
```

### Accessing tenant AWS account

In debug pod, we can specify AWS_PROFILE to access controlplane AWS account or dataplane AWS account

``` bash
aws sts get-caller-identity # The default is controlplane aws account
AWS_PROFILE=tenant aws sts get-caller-identity # Switch to dataplane AWS account
```

### Connect to X-Account EKS cluster

update `role_arn` and `external_id` values equals to your network spec.
```bash
kubectl apply -f hack/debug.yaml -n infra
kubectl exec -it $(kubectl get po --selector=app=debug -o=custom-columns=:metadata.name --no-headers) -- bash
# Will update /kubeconfig files
./hack/kuber.sh
export KUBECONFIG=/kubeconfig
```