Admin: Add Navbox deployment template before Related (via update-page on MediaWiki MCP Server)

2026-07-06T04:02:28Z

Add Navbox deployment template before Related (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 09:32, 6 July 2026
Line 111:		Line 111:

	Once Care is running, see [[Deployment/Kubernetes/Day-2 operations\|Day-2 operations]] for backups, monitoring, and ongoing maintenance.		Once Care is running, see [[Deployment/Kubernetes/Day-2 operations\|Day-2 operations]] for backups, monitoring, and ongoing maintenance.

			{{Navbox deployment}}

	{{Related}}		{{Related}}

Admin: OHC identity seed

2026-07-04T23:07:54Z

OHC identity seed

New page

{{Doc header
|type=guide
|domain=deployment
|title=Deploying Care onto the cluster
|order=5
}}

With a Kubernetes cluster provisioned (see [[Deployment/Kubernetes/Provisioning the cluster|Provisioning the cluster]]), Care and its supporting services are rolled out module by module from the [<nowiki/>https://github.com/ohcnetwork/deployment-k8 deployment-k8] repository. This page describes the deployer workflow and the order in which modules are applied.

{{Info|1=The exact commands, variable values, and manifests live in the [<nowiki/>https://github.com/ohcnetwork/deployment-k8 deployment-k8] repo and evolve over time. Treat the commands below as the canonical ''shape'' of each step; always run them from a checkout of the repo so you pick up the current modules and values. A few steps are still being automated — the repo carries <code>TODO</code> markers for a database migrations job and the terminology server — so expect to perform those manually for now.}}

== The deployer model ==

Deployments are driven by <code>deployer.py</code>, a [<nowiki/>https://typer.tiangolo.com/ Typer] CLI in the root of the repo, with a <code>Makefile</code> that proxies the same commands. Both forms are equivalent — use whichever you prefer.

Per-environment configuration lives under <code>environments/<env>/</code>:

{| class="wikitable"
|-
! File
! Purpose
|-
| <code>config.json</code>
| Holds <code>KUBECONFIG_PATH</code> — the kubeconfig the deployer uses to talk to the cluster.
|-
| <code>variables.tfvars</code>
| The OpenTofu variables for that environment.
|}

Select the active environment, then inspect what the deployer will use:

<syntaxhighlight lang="bash"># Select the active environment
python deployer.py set-current-env <env>
# or
make set-current-env <env>

# Inspect the current selection and its resolved config
python deployer.py show-current-env
python deployer.py show-defaults</syntaxhighlight>
<code>set-current-env</code> writes the choice to <code>.current-env.json</code>, and every subsequent <code>apply-tofu</code> / <code>apply-k8</code> command reads <code>environments/<env>/</code> from there. You can sanity-check connectivity to the selected cluster at any time:

<syntaxhighlight lang="bash">python deployer.py check-k8-cluster</syntaxhighlight>
== Two operations per module ==

Each module is applied in up to two phases:

{| class="wikitable"
|-
! Operation
! What it does
|-
| <code>apply-tofu <module></code>
| Provisions infrastructure and Helm releases for the module via OpenTofu (<code>tofu init</code> + <code>tofu apply</code> against <code>infra/<module>/</code>).
|-
| <code>apply-k8 <module></code>
| Applies the Kubernetes manifests generated under <code>infra/<module>/resources/</code> with <code>kubectl apply</code>.
|}

Both have a <code>make</code> proxy. The two forms for a module are:

<syntaxhighlight lang="bash"># OpenTofu provisioning
python deployer.py apply-tofu <module>
make apply-tofu-<module>

# Kubernetes manifests
python deployer.py apply-k8 <module>
make apply-k8-<module></syntaxhighlight>
{{Note|1=Not every module needs the <code>apply-k8</code> phase — some are fully provisioned by <code>apply-tofu</code>. Run <code>apply-k8 <module></code> only where the module ships manifests under <code>infra/<module>/resources/</code> (for example <code>volumes</code>, <code>networking</code>, and <code>database</code>). The deployer will tell you if the resources directory is missing.}}

== Module rollout order ==

Apply the modules in the order below. Several steps require manual configuration in between (creating secrets, pushing images, creating buckets), so do not batch them blindly.

<ol style="list-style-type: decimal;">
<li>'''volumes''' — installs Longhorn for volume management. After Longhorn is up, configure nodes and storage classes, create the Longhorn S3 backup-target secret, then <code>apply-k8 volumes</code>. Wait a couple of minutes for Longhorn to detect the volumes before continuing.</li>
<li>'''networking''' — installs the ingress controllers, then routing. '''TLS secrets are created per namespace''' (<code>care-be</code>, <code>care-fe</code>, <code>odoo</code>, <code>rustfs</code>, <code>metabase</code>) before <code>apply-k8 networking</code>:
<syntaxhighlight lang="bash">kubectl create secret tls lets-encrypt-cert \
--cert=fullchain.pem --key=privkey.pem -n <namespace></syntaxhighlight></li>
<li>'''registry''' — provisions the container registry used to store all application images. '''Then build and push images''' to the registry using the scripts in <code>build_scripts/</code> (which has <code>care_be/</code>, <code>care_fe/</code>, <code>odoo/</code>, and <code>snowstorm/</code> builders).</li>
<li>'''database''' — provisions PostgreSQL via the CloudNativePG operator together with Redis/Valkey. Set up WAL archive storage and the required secrets/operator plugins, then <code>apply-k8 database</code> to create the catalogs, secrets, roles, and databases.</li>
<li>'''objectstore''' — provisions RustFS. '''Then create the required buckets''': <code>chunks</code>, <code>ruler</code>, <code>admin</code>, <code>care-facility</code>, <code>care-fileupload</code>.</li>
<li>'''monitoring''' — installs the monitoring stack (Grafana/Loki). Once stable, log in to Grafana and add the Loki datasource and any dashboards you need.</li>
<li>'''care''' — deploys the Care backend and frontend.</li>
<li>'''odoo''' — deploys Odoo. Perform addon configuration, then update the Care secrets and re-apply the Care config as needed.</li>
<li>'''opensearch''' — installs the OpenSearch controller, then '''apply the cluster manifest''':
<syntaxhighlight lang="bash">kubectl apply -f infra/opensearch/cluster.yaml</syntaxhighlight></li>
<li>'''metabase''' — deploys Metabase.</li>
<li>'''snowstorm''' — deploys Snowstorm (the terminology server backing).</li></ol>

{{Warning|1=Before deploying <code>care</code>, confirm that '''all images have been written to the registry''' (step 3). The backend and frontend pods pull from the registry provisioned earlier, and a missing image will leave pods in <code>ImagePullBackOff</code>.}}

== Image build and push ==

The <code>registry</code> module only provisions the registry — it does not populate it. Building and pushing images is a separate, explicit step that uses the per-application build scripts under <code>build_scripts/</code>:

<syntaxhighlight lang="text">build_scripts/
├── care_be/ # Care backend image
├── care_fe/ # Care frontend image
├── odoo/ # Odoo image
└── snowstorm/ # Snowstorm image</syntaxhighlight>
Run the relevant builders after the <code>registry</code> module is up and before deploying the modules that consume those images (<code>care</code>, <code>odoo</code>, <code>snowstorm</code>).

== Known gaps ==

The repo is explicit about steps that are not yet fully automated. Until they land, handle them manually:

* '''Database migrations''' — a job to run Care migrations and post-deploy cleanups after the <code>care</code> module is still a <code>TODO</code>. Run migrations manually until it is wired up.
* '''Terminology server''' — the terminology-server configuration section is a <code>TODO</code>. The <code>snowstorm</code> module deploys the service, but end-to-end configuration is still being documented.

== Next steps ==

Once Care is running, see [[Deployment/Kubernetes/Day-2 operations|Day-2 operations]] for backups, monitoring, and ongoing maintenance.

{{Related}}

Deployment/Kubernetes/Deploying Care onto the cluster - Revision history

Admin: Add Navbox deployment template before Related (via update-page on MediaWiki MCP Server)

Admin: OHC identity seed