kubefirst/kubefirst

The Kubefirst Open Source Platform

GitOps Infrastructure & Application Delivery Platform

Install |  Twitter |  LinkedIn |  Slack |  Blog

---

Kubefirst CLI

The Kubefirst CLI creates instant GitOps platforms that integrate some of the best tools in cloud native from scratch in minutes.

Each of our platforms have install guides that detail the prerequesites, commands, and resulting platform that you'll receive.

• k3d (local)
• AWS
• Civo
• DigitalOcean

In beta:

• Google Cloud
• Vultr
• Akamai (docs coming soon) kubefirst beta akamai create --help
• K3s (docs coming soon) kubefirst beta k3s create --help

Overview

https://docs.kubefirst.io

Feed K-Ray

Feed K-Ray a GitHub star ⭐ above to bookmark our project and keep K-Ray happy!!

kubefirst's Issues

terraformed users should have automatic membership to kubefirst project in gitlab

the terraformed users in the gitops repo are automatically added to either the admin or developer group in gitlab.

that setup should be extended such that:

• admin group is added to the kubefirst group as owner
• developer group is aded to the kubefirst group as developer

m1 mac issue reported on kubefirst init command

context: reported in community slack
https://kubefirst.slack.com/archives/C01KVTDT0UC/p1659022006876609

active diagnosis is underway

version bump cwft in argo workflows needs to work with github as well

version bump is currently doing patch bumps and should be doing minor bumps

links from readme to docs site are broken

the recent transition to cloudfront imposed breaking changes on default document type

gitlab server 14 changed initial login process and broke nebulous

high priority:
kubefirst's opinion of floating on gitlab server versions backfired with some breaking changes in gitlab 14 that need to be accommodated. fortunately this includes some improvements to the overall provisioning secrets management piece so we can treat that part a little more normal.

in the meantime we should pin to latest gitlab 13.12.9-ce.0

cleanup the init script so flow controls are less in play for contributors

we should be leveraging the shared volume mount to more intelligently understand how far into the script we got and what we need to reexecute on retries. the bucket rand also needs an artifact stored so that tear down doesn't require that input.

reduce nebulous image size to bare minimum

right now we leverage the kubefirst-builder as a base image and its overkill

Error Processing gitlab.ChangeRegistryToGitLab - empty secret

panic: error creating argocd repository credentials template the object provided is unrecognized (must be of type Secret): couldn't get version/kind; json parse error: unexpected end of JSON input (<empty>)

goroutine 1 [running]:
log.Panicf({0x1ccfa77, 0x0}, {0xc0009874f8, 0x0, 0x0})
  /usr/local/go/src/log/log.go:361 +0x67
github.com/kubefirst/kubefirst/internal/gitlab.ChangeRegistryToGitLab(0x0)
  /home/developer/app/internal/gitlab/gitlab.go:430 +0x58e
github.com/kubefirst/kubefirst/cmd.glob..func6(0x2f6a100, {0x2fb7958, 0x0, 0x0})
  /home/developer/app/cmd/create.go:297 +0x2065
github.com/spf13/cobra.(*Command).execute(0x2f6a100, {0x2fb7958, 0x0, 0x0})
  /go/pkg/mod/github.com/spf13/[email protected]/command.go:860 +0x5f8
github.com/spf13/cobra.(*Command).ExecuteC(0x2f6a380)
  /go/pkg/mod/github.com/spf13/[email protected]/command.go:974 +0x3bc
github.com/spf13/cobra.(*Command).Execute(...)
  /go/pkg/mod/github.com/spf13/[email protected]/command.go:902
github.com/kubefirst/kubefirst/cmd.Execute()
  /home/developer/app/cmd/root.go:26 +0x25
main.main()
  /home/developer/app/main.go:65 +0x425

Logs

LOG: 2022/08/04 00:12:19.362648 /home/developer/app/internal/gitlab/gitlab.go:638: successfully pushed metaphor to gitlab
LOG: 2022/08/04 00:12:20.378060 /home/developer/app/cmd/createUtils.go:295: Adding the registry application registered against gitlab
LOG: 2022/08/04 00:12:20.381526 /home/developer/app/internal/gitlab/gitlab.go:425: error unmarshalling yaml during argocd repository secret create error converting YAML to JSON: yaml: line 2: found character that cannot start any token
LOG: 2022/08/04 00:12:20.978156 /home/developer/app/internal/gitlab/gitlab.go:430: error creating argocd repository credentials template the object provided is unrecognized (must be of type Secret): couldn't get version/kind; json parse error: unexpected end of JSON input (<empty>)

init with metaphor repo

similar to issue #5 , the manual addition of the metaphor repo is a small burden that increases the barrier of entry/fun. when nebulous runs, we should instead be init-ing with a metaphor repo that is a fork from our public metaphor repo. this will allow for users to have a fully-functioning metaphor repository with cicd without any clicks and give their default installation the ability to pull from origin with relative ease.

Fix repos: URL

Better TUI Setup to support multiple flavors of installs

Improve how the handoff screen is created, to support a set of small configs, instead of a big config.

Support multiple install setup.

		clusterData := reports.CreateHandOff{
			AwsAccountId:      viper.GetString("aws.accountid"),
			AwsHostedZoneName: viper.GetString("aws.hostedzonename"),
			AwsRegion:         viper.GetString("aws.region"),

			ClusterName: viper.GetString("cluster-name"),

			GitlabURL:      fmt.Sprintf("https://gitlab.%s", viper.GetString("aws.hostedzonename")),
			GitlabUser:     "root",
			GitlabPassword: viper.GetString("gitlab.root.password"),

			RepoGitops:   fmt.Sprintf("https://gitlab.%s/kubefirst/gitops", viper.GetString("aws.hostedzonename")),
			RepoMetaphor: fmt.Sprintf("https://gitlab.%s/kubefirst/metaphor", viper.GetString("aws.hostedzonename")),

			VaultUrl:   fmt.Sprintf("https://vault.%s", viper.GetString("aws.hostedzonename")),
			VaultToken: viper.GetString("vault.token"),

			ArgoCDUrl:      fmt.Sprintf("https://argocd.%s", viper.GetString("aws.hostedzonename")),
			ArgoCDUsername: viper.GetString("argocd.admin.username"),
			ArgoCDPassword: viper.GetString("argocd.admin.password"),

			ArgoWorkflowsUrl: fmt.Sprintf("https://argo.%s", viper.GetString("aws.hostedzonename")),
			AtlantisUrl:      fmt.Sprintf("https://atlantis.%s", viper.GetString("aws.hostedzonename")),
			ChartMuseumUrl:   fmt.Sprintf("https://chartmuseum.%s", viper.GetString("aws.hostedzonename")),

			MetaphorDevUrl:        fmt.Sprintf("https://metaphor-development.%s", viper.GetString("aws.hostedzonename")),
			MetaphorStageUrl:      fmt.Sprintf("https://metaphor-staging.%s", viper.GetString("aws.hostedzonename")),
			MetaphorPr
``

To improve logic of resume/re-run to recreate or override this secret "creds-gitlab"

After a re-run, if this secret exist, installation halts on this point on a "Re-run".

LOG: 2022/08/03 19:45:59.858973 /home/developer/app/cmd/create.go:241: creating vault configured secret
LOG: 2022/08/03 19:45:59.859591 /home/developer/app/cmd/kubernetes.go:108: vault secret already created
LOG: 2022/08/03 19:45:59.860080 /home/developer/app/cmd/createUtils.go:295: Vault  secret created
LOG: 2022/08/03 19:46:01.862967 /home/developer/app/cmd/createUtils.go:295: Adding the registry application registered against gitlab
LOG: 2022/08/03 19:46:02.469819 /home/developer/app/internal/gitlab/gitlab.go:429: error creating argocd repository credentials template secrets "creds-gitlab" already exists

need to adopt external-secrets-operator

the external-secrets app is being sunset and replaced by the external-secrets-operator. this will change the structure of all externalsecrets that are provisioned with the kubefirst platform. this will also impact metaphor's secret use case.

gitlab registration token collection process broken during nebulous install

upstream gitlab update broke registration token collection process - needs fix asap.

   Window
    ✓ logs in with root user (4580ms)
    ✓ sets up a personal access token (2676ms)
    1) gets the runner registration token


  2 passing (13s)
  1 failing

  1) Window
       gets the runner registration token:
     CypressError: Timed out retrying after 4050ms: `cy.click()` failed because this element is not visible:

`<use href="/assets/icons-74e006cef5a76d001c81e4dda159833de67bd6dbd16e42db899bbe43f2a76cf2.svg#eye"></use>`

This element `<use>` is not visible because its parent `<ul.dropdown-menu.gl-w-auto!.dropdown-menu-right>` has CSS property: `display: none`

Fix this problem, or use `{force: true}` to disable error checking.

https://on.cypress.io/element-cannot-be-interacted-with
      at $Cy.ensureVisibility (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:161294:24)
      at runAllChecks (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:150169:14)
      at retryActionability (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:150223:16)
      at tryCatcher (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:10609:23)
      at Function.Promise.attempt.Promise.try (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:7883:29)
      at tryFn (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:165787:21)
      at whenStable (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:165825:12)
      at https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:165320:16
      at tryCatcher (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:10609:23)
      at Promise._settlePromiseFromHandler (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:8544:31)
      at Promise._settlePromise (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:8601:18)
      at Promise._settlePromise0 (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:8646:10)
      at Promise._settlePromises (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:8726:18)
      at Promise._fulfill (https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:8670:18)
      at https://gitlab.kubeshop.kubefirst.com/__cypress/runner/cypress_runner.js:10284:46
  From Your Spec Code:
      at Context.eval (https://gitlab.kubeshop.kubefirst.com/__cypress/tests?p=cypress/integration/gitlab-init.spec.js:124:44)




  (Results)

  ┌────────────────────────────────────────────────────────────────────────────────────────────────┐
  │ Tests:        3                                                                                │
  │ Passing:      2                                                                                │
  │ Failing:      1                                                                                │
  │ Pending:      0                                                                                │
  │ Skipped:      0                                                                                │
  │ Screenshots:  1                                                                                │
  │ Video:        true                                                                             │
  │ Duration:     12 seconds                                                                       │
  │ Spec Ran:     gitlab-init.spec.js                                                              │
  └────────────────────────────────────────────────────────────────────────────────────────────────┘


  (Screenshots)

  -  /git/gitops/terraform/cypress/cypress/screenshots/gitlab-init.spec.js/Window --      (1280x720)
     gets the runner registration token (failed).png                                                


  (Video)

  -  Started processing:  Compressing to 32 CRF                                                     
  -  Finished processing: /git/gitops/terraform/cypress/cypress/videos/gitlab-init.sp     (1 second)
                          ec.js.mp4                                                                 


====================================================================================================

  (Run Finished)


       Spec                                              Tests  Passing  Failing  Pending  Skipped  
  ┌────────────────────────────────────────────────────────────────────────────────────────────────┐
  │ ✖  gitlab-init.spec.js                      00:12        3        2        1        -        - │
  └────────────────────────────────────────────────────────────────────────────────────────────────┘
    ✖  1 of 1 failed (100%)                     00:12        3        2        1        -        -  

init with terraform gitlab repo

summary

the nebulous repo includes terraform iac that should be made available in the gitlab server on init.

proposal

during the init process of the nebulous container execution, some terraform code is executed to provision the intro environment from a terraform directory in the nebulous repo. that very directory should be automatically uploaded to the private gitlab server during the setup process. this would allow for a very straightforward path to have automated source driven iac.

having the iac repo ready in turnkey fashion like that would allow for very low barrier of entry demo space for videos and tutorials.

details

when running nebulous, the /terraform directory:
https://github.com/kubefirst/nebulous/tree/master/terraform
gets copied into the container at location /terraform as shown here
https://github.com/kubefirst/nebulous/blob/master/Dockerfile#L4

we want to add a new terraform git repository to the new gitlab server as part of the initialization process.

questions

we currently code against the api
https://github.com/kubefirst/nebulous/blob/master/scripts/nebulous/init.sh#L166-L168

it might be more valuable to our open source users to establish a gitlab repo in terraform so they can manage repos as iac if they so choose.

terraform code would look like this
https://registry.terraform.io/providers/gitlabhq/gitlab/latest/docs/resources/group

argo workflows crontemplate for nebulous

ssh key generated from nebulous init needs to get added to vault instance

let's get it added to ci-secrets so we can start shifting our cwfts from access tokens to ssh keys

replace soft-serve and gitlab process when git provider is github

related #158;

When the git provider is GitHub we need to remove GitLab and soft-serve of the provisioning process.

AwaitHostNTimes needs to use https client

AwaitHostNTimes (internal/gitlab) uses http.Get() that accepts HTTP or HTTPS when requesting HTTP. We should only accept valid HTTPS responses adding Go http default client: http.DefaultClient like we do on getArgoCDToken function.

refactor env vars out of destroy script into standalone script

see https://kubefirst-community.slack.com/archives/C01LDJ1RT2L/p1621810490011800

version mismatch on version 1.8.3

external-secrets needs to upgrade to operator implementation

Pre-mature fail of installer

Installer seems to fail at this point, it seems to be missing to wait a given event to proceed. (Sleep)

Output(STDOUT)

- deleting argocd-server pod
panic: interface conversion: interface {} is nil, not string

goroutine 1 [running]:
github.com/kubefirst/kubefirst/internal/argocd.GetArgocdAuthToken(0x89)
	/home/developer/app/internal/argocd/argocd.go:228 +0x72b
github.com/kubefirst/kubefirst/cmd.glob..func6(0x2f6a100, {0x2fb7958, 0x0, 0x0})
	/home/developer/app/cmd/create.go:333 +0x25b2
github.com/spf13/cobra.(*Command).execute(0x2f6a100, {0x2fb7958, 0x0, 0x0})
	/go/pkg/mod/github.com/spf13/[email protected]/command.go:860 +0x5f8
github.com/spf13/cobra.(*Command).ExecuteC(0x2f6a380)
	/go/pkg/mod/github.com/spf13/[email protected]/command.go:974 +0x3bc
github.com/spf13/cobra.(*Command).Execute(...)
	/go/pkg/mod/github.com/spf13/[email protected]/command.go:902
github.com/kubefirst/kubefirst/cmd.Execute()
	/home/developer/app/cmd/root.go:26 +0x25
main.main()
	/home/developer/app/main.go:65 +0x425
LOG: 2022/08/03 19:39:11.229926 /home/developer/app/pkg/shell.go:22: Commad Execution STDOUT: %s 
LOG: 2022/08/03 19:39:11.230448 /home/developer/app/pkg/shell.go:23: Commad Execution STDERR: %s No resources found in default namespace.

Logs:

LOG: 2022/08/03 19:39:11.230912 /home/developer/app/cmd/createUtils.go:91: argocd pods found, continuing
LOG: 2022/08/03 19:39:26.232189 /home/developer/app/cmd/createUtils.go:295: Port forwarding to new argocd-server pod
LOG: 2022/08/03 19:39:46.235249 /home/developer/app/cmd/create.go:328: sleeping for 40 seconds
LOG: 2022/08/03 19:40:26.236847 /home/developer/app/cmd/createUtils.go:295: Syncing the registry application
LOG: 2022/08/03 19:40:41.239163 /home/developer/app/internal/argocd/argocd.go:202: requesting auth token from argocd: attempt 1 of 3

nebulous project rebranded to kubefirst

need to be sure this rebrand is in alignment with cncf landscape at all times

metaphor deployment is failing due to expired certificate

https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

upstream gitlab adjustments causing instability on unpinned latest

we need to consider pinning the gitlab version and include upgrades as part of our maintenance release process. upstream adjustments are causing instability on the registration token collection process.

discuss app helm content location

lets have a discussion around where this content should live, i feel like components/apps could be a place for all helm chart content but up for debate
https://github.com/kubefirst/nebulous/tree/main/gitops/components/development/metaphor

create github account for internal service-account use

aws sdk is using v1 and v2 - need conformity on v2

kubectl get certificates not a supported resource

[root@ip-172-31-37-133 nebulous]# kubectl get certificates
error: the server doesn't have a resource type "certificates"

If someone could confirm on a completed installation that would be great, as my install is hung up at the gitlab stage.

kubefirst backupSSL stoped to work as expected

Bucket seems to not be created:

Bucket is missing on AWS console for the certs

Logs:

LOG: 2022/08/05 17:38:29.644022 /home/developer/app/internal/aws/aws.go:340: createBucketCalled
LOG: 2022/08/05 17:38:29.654626 /home/developer/app/internal/aws/aws.go:344: creating bucket k1-6zray.kubefirst.tech
LOG: 2022/08/05 17:38:29.655408 /home/developer/app/internal/aws/aws.go:347: region is  us-east-1
LOG: 2022/08/05 17:38:30.515311 /home/developer/app/internal/ssl/ssl.go:92: getting certificates
LOG: 2022/08/05 17:38:30.523941 /home/developer/app/internal/ssl/ssl.go:50: getting resources
LOG: 2022/08/05 17:38:31.103843 /home/developer/app/internal/ssl/ssl.go:50: getting resources
LOG: 2022/08/05 17:38:31.268415 /home/developer/app/internal/ssl/ssl.go:50: getting resources
LOG: 2022/08/05 17:38:31.432316 /home/developer/app/internal/ssl/ssl.go:50: getting resources
LOG: 2022/08/05 17:38:31.597548 /home/developer/app/internal/ssl/ssl.go:50: getting resources
LOG: 2022/08/05 17:38:31.767541 /home/developer/app/internal/ssl/ssl.go:50: getting resources
LOG: 2022/08/05 17:38:31.935316 /home/developer/app/internal/ssl/ssl.go:99: /certs/argo-secret.yaml
LOG: 2022/08/05 17:38:32.668223 /home/developer/app/internal/ssl/ssl.go:99: /certs/argocd-server-tls.yaml
LOG: 2022/08/05 17:38:33.526801 /home/developer/app/internal/ssl/ssl.go:99: /certs/atlantis-tls.yaml
LOG: 2022/08/05 17:38:34.273413 /home/developer/app/internal/ssl/ssl.go:99: /certs/chartmuseum-tls.yaml
LOG: 2022/08/05 17:38:35.132499 /home/developer/app/internal/ssl/ssl.go:99: /certs/gitlab-tls.yaml
LOG: 2022/08/05 17:38:35.845872 /home/developer/app/internal/ssl/ssl.go:99: /certs/gitlab-webservice-tls.yaml
LOG: 2022/08/05 17:38:36.549832 /home/developer/app/internal/ssl/ssl.go:99: /certs/vault-tls.yaml
LOG: 2022/08/05 17:38:37.412884 /home/developer/app/internal/ssl/ssl.go:103: getting secrets
LOG: 2022/08/05 17:38:37.414269 /home/developer/app/internal/ssl/ssl.go:40: error: could not create directory "/home/developer/.k1/ssl" - it must exist to continue. error is: mkdir /home/developer/.k1/ssl: file exists
LOG: 2022/08/05 17:38:37.414812 /home/developer/app/internal/ssl/ssl.go:47: getting resources and filtering using jq
LOG: 2022/08/05 17:38:38.200210 /home/developer/app/internal/ssl/ssl.go:47: getting resources and filtering using jq
LOG: 2022/08/05 17:38:38.679316 /home/developer/app/internal/ssl/ssl.go:47: getting resources and filtering using jq
LOG: 2022/08/05 17:38:38.846992 /home/developer/app/internal/ssl/ssl.go:47: getting resources and filtering using jq
LOG: 2022/08/05 17:38:39.013635 /home/developer/app/internal/ssl/ssl.go:47: getting resources and filtering using jq
LOG: 2022/08/05 17:38:39.185069 /home/developer/app/internal/ssl/ssl.go:47: getting resources and filtering using jq
LOG: 2022/08/05 17:38:39.348537 /home/developer/app/internal/ssl/ssl.go:111: /secrets/argo-secret.yaml
LOG: 2022/08/05 17:38:40.433199 /home/developer/app/internal/ssl/ssl.go:111: /secrets/atlantis-tls.yaml
LOG: 2022/08/05 17:38:41.438624 /home/developer/app/internal/ssl/ssl.go:111: /secrets/chartmuseum-tls.yaml
LOG: 2022/08/05 17:38:42.507441 /home/developer/app/internal/ssl/ssl.go:111: /secrets/gitlab-tls.yaml
LOG: 2022/08/05 17:38:43.536052 /home/developer/app/internal/ssl/ssl.go:111: /secrets/gitlab-webservice-tls.yaml
LOG: 2022/08/05 17:38:44.549032 /home/developer/app/internal/ssl/ssl.go:111: /secrets/vault-tls.yaml
LOG: 2022/08/05 17:38:45.610422 /home/developer/app/internal/ssl/ssl.go:116: getting clusterissuers
LOG: 2022/08/05 17:38:45.611792 /home/developer/app/internal/ssl/ssl.go:40: error: could not create directory "/home/developer/.k1/ssl" - it must exist to continue. error is: mkdir /home/developer/.k1/ssl: file exists
LOG: 2022/08/05 17:38:45.612316 /home/developer/app/internal/ssl/ssl.go:50: getting resources
LOG: 2022/08/05 17:38:46.198009 /home/developer/app/internal/ssl/ssl.go:123: /clusterissuers/letsencrypt-prod.yaml
LOG: 2022/08/05 17:38:47.108252 /home/developer/app/internal/ssl/ssl.go:123: /clusterissuers/letsencrypt-staging.yaml

cypress install should happen at dockerfile build time

allowing the npm install to occur during the init script risks the possibility that the latest cypress is unavailable for install. this occurred during a test overnight last night - the cypress published keys were invalid for download and an init failed to complete as a result. had cypress been baked into the nebulous image this wouldn't have occurred.

create new cli command for `kubefirst create github-cluster`

change entrypoint to init.sh

the init script is just bash - should be init so users can more install with less unnecessary friction

metaphor to `npm audit fix`

Update `metaphor` templates to support github actions

Add a translation of .gitlab-ci.yml to github actions.

Once detokenized, should the repo have github and gitlab files?

nebulous execution should have tests to verify end state after provisioning

test should probably run from within the init context so contributors have testing available to them as well.

tests should include

• metaphor dev, stage, prod
• atlantis pull request is ready
• argocd apps are in sync

remove dependency on environment variables

we should add default cli flags that can accommodate this so we dont need to explicitly set envs up front
AWS_PROFILE
AWS_REGION

github-actions runner running in kubernetes with access to argo submit workflow

see
https://github.com/kubefirst/builder-tmps/blob/main/.github/actions/argo-submit/action.yaml

introduce the kubefirst cli

Issues creating Argo Secret - from helm install

LOG: 2022/08/04 14:16:58.800072 /home/developer/app/cmd/createUtils.go:91: argocd pods found, continuing
LOG: 2022/08/04 14:17:13.801712 /home/developer/app/cmd/createUtils.go:295: ArgoCD Ready
LOG: 2022/08/04 14:17:14.803963 /home/developer/app/cmd/createUtils.go:295: ArgoCD available at http://localhost:8080
LOG: 2022/08/04 14:17:15.805516 /home/developer/app/cmd/createUtils.go:295: Setting argocd credentials
LOG: 2022/08/04 14:17:16.457608 /home/developer/app/cmd/kubernetes.go:135: error getting key: password from secret: argocd-initial-admin-secret secrets "argocd-initial-admin-secret" not found

establish k1 dir and .kubefirst file if it doesnt exist on init

currenlty we have to run kubefirst clean to generate the k1 dir and .kubefirst file - we should create these if they do not exist to prevent an error on the users first commands

spike: fusion auth for oidc feature parity with gitlab

Extra suffix on files on RestoreSSL

Logs:

LOG: 2022/08/04 11:53:51.527125 /home/developer/app/internal/ssl/ssl.go:155: atlantis-tls.yaml
LOG: 2022/08/04 11:53:51.528020 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.528185 /home/developer/app/internal/ssl/ssl.go:155: atlantis-tls.yaml.clean
LOG: 2022/08/04 11:53:51.528979 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.529139 /home/developer/app/internal/ssl/ssl.go:155: atlantis-tls.yaml.clean.clean
LOG: 2022/08/04 11:53:51.529972 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.530137 /home/developer/app/internal/ssl/ssl.go:155: atlantis-tls.yaml.clean.clean.clean
LOG: 2022/08/04 11:53:51.530967 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.531129 /home/developer/app/internal/ssl/ssl.go:155: atlantis-tls.yaml.clean.clean.clean.clean
LOG: 2022/08/04 11:53:51.531892 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.532034 /home/developer/app/internal/ssl/ssl.go:155: chartmuseum-tls.yaml
LOG: 2022/08/04 11:53:51.532924 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.533082 /home/developer/app/internal/ssl/ssl.go:155: chartmuseum-tls.yaml.clean
LOG: 2022/08/04 11:53:51.533871 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.534018 /home/developer/app/internal/ssl/ssl.go:155: chartmuseum-tls.yaml.clean.clean
LOG: 2022/08/04 11:53:51.534848 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.535011 /home/developer/app/internal/ssl/ssl.go:155: chartmuseum-tls.yaml.clean.clean.clean
LOG: 2022/08/04 11:53:51.535895 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.536064 /home/developer/app/internal/ssl/ssl.go:155: chartmuseum-tls.yaml.clean.clean.clean.clean
LOG: 2022/08/04 11:53:51.536788 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.536996 /home/developer/app/internal/ssl/ssl.go:155: gitlab-tls.yaml
LOG: 2022/08/04 11:53:51.537945 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.538117 /home/developer/app/internal/ssl/ssl.go:155: gitlab-tls.yaml.clean
LOG: 2022/08/04 11:53:51.539011 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.539174 /home/developer/app/internal/ssl/ssl.go:155: gitlab-tls.yaml.clean.clean
LOG: 2022/08/04 11:53:51.540558 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.540968 /home/developer/app/internal/ssl/ssl.go:155: gitlab-tls.yaml.clean.clean.clean
LOG: 2022/08/04 11:53:51.541836 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.542057 /home/developer/app/internal/ssl/ssl.go:155: gitlab-tls.yaml.clean.clean.clean.clean
LOG: 2022/08/04 11:53:51.542959 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.543261 /home/developer/app/internal/ssl/ssl.go:155: gitlab-webservice-tls.yaml
LOG: 2022/08/04 11:53:51.544159 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.544398 /home/developer/app/internal/ssl/ssl.go:155: gitlab-webservice-tls.yaml.clean
LOG: 2022/08/04 11:53:51.545304 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.545533 /home/developer/app/internal/ssl/ssl.go:155: gitlab-webservice-tls.yaml.clean.clean
LOG: 2022/08/04 11:53:51.546421 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.546646 /home/developer/app/internal/ssl/ssl.go:155: gitlab-webservice-tls.yaml.clean.clean.clean
LOG: 2022/08/04 11:53:51.547545 /home/developer/app/internal/ssl/ssl.go:190: yaml cleaned written
LOG: 2022/08/04 11:53:51.547830 /home/developer/app/internal/ssl/ssl.go:155: gitlab-webservice-tls.yaml.clean.clean.clean.clean

GitLab repo bad end

Git Repo is appearing "double encoded":

		argocdRepoSecret := &v1.Secret{
			ObjectMeta: metaV1.ObjectMeta{
				Name:      "repo-gitlab",
				Namespace: "argocd",
				Labels: map[string]string{
					"argocd.argoproj.io/secret-type": "repository",
				},
				Annotations: map[string]string{
					"managed-by": "argocd.argoproj.io",
				},
			},
			Data: map[string][]byte{
				"project": []byte("ZGVmYXVsdA=="),
				"type":    []byte("Z2l0"),
				"url":     []byte(creds.FullURL),
			},
			Type: "Opaque",
		}

ci needed in github action for regular publish of nebulous image

Configure Github Runner into the Cluster Setup

After installation is completed from argo using github, a set of configurations need to be done to support github runner to act as desired.

Zerossl or Google's Acme Server should be supported providers

Just a suggestion, I always have issues with letsencrypt, and that seems to be the case here as well. It'd be great to have additional support for either https://zerossl.com, https://cloud.google.com/blog/products/identity-security/automate-public-certificate-lifecycle-management-via--acme-client-api, or both. Additional options are are a Good Thing imho! To clarify, the installation is stuck on "https://gitlab.example.com/help is not yet ready" and the reason is because the certificate is failing to be issued.

upgrade nebulous kubernetes clusters to 1.20

nebulous currently installs at a 1.17 which is almost end of life - this is the highest priority of the 1.5 release

add metaphor-go to the stack - feature paired with metaphor