GitOps Deployment of ClusterAPI

[dajudge]

Hey all,

we're just setting up our first ClusterAPI installation and were wondering if there's a way to install ClusterAPI w/o using the clusterctl cmdline utility as we're using GitOps pretty much everywhere.

While it's certainly not a showstopper it would make us really happy to manage the ClusterAPI deployment directly from git...

[dajudge]

So from my experimentation (w/ the AWS infrastructure provider) I can tell the following:

The output of clusterctl generate (infrastructure, cluster-api, bootsrtap & control-plane) is almost suitable for gitops deployments. I'm rendering them into the templates directory of a helm chart - which can then be deployed w/ ArgoCD without a problem.

the only issue I had to work around is the secret containing the AWS credentials. I'm using kustomize to apply a post-processing patch to the infrastructure manifests which removes the AWS credentials secret. they can then be provided by a suitable secrets management mechanism (e.g. SealedSecrets) from the outside.

[PatrickLaabs]

Correct me if I am wrong, but if you generated your manifest with clusterctl, you can apply this manifest to your bootstrap or, in your case, to your management cluster.

Not sure if it works well using flux or Argo, but Jenkins or GHActions could make the job.

Maybe it's a funny test to manage the creation of your workload clusters with Jenkins, since it allows you to apply your manifest and after that connect your gitops repo (holding your application deployments) to the newly created workload cluster.

Have you already tried it?

Best
Patrick

[mubarak-j]

Here's a blog post by AWS, I'm hoping to test it out:
https://aws.amazon.com/blogs/containers/multi-cluster-management-for-kubernetes-with-cluster-api-and-argo-cd/

[ljtill]

This use case could be solved by the Cluster API Operator project which is currently in development.

[fabriziopandini]

There are ways to use cluster API with git ops (w/o clusterctl), and we have several community members doing this.
Unfortunately, we struggle to find someone volunteering to document this, but let's hope this will be quickly addressed