Deployment Phases

Phase 0: Bootstrap

bash git clone git@github.com:loic-roux-404/plateforme.git cd plateforme bash scripts/bootstrap.sh nix develop # or: direnv allow

Update .sops.yaml with your Age public key printed by bootstrap.

Phase 1: Secret Setup

```bash

Create plaintext YAML, then encrypt:

cat > /tmp/cluster-local.yaml <<EOF node_token: "$(openssl rand -hex 32)" EOF

sops --encrypt \ --age $(grep 'public key' ~/.config/sops/age/keys.txt | awk '{print $4}') \ /tmp/cluster-local.yaml > secrets/local/cluster.sops.yaml

Verify:

sops --decrypt secrets/local/cluster.sops.yaml ```

Phase 2: Network

bash bash scripts/plan.sh local network bash scripts/apply.sh local network

Phase 3: Control Plane

bash bash scripts/plan.sh local control-plane bash scripts/apply.sh local control-plane virsh list --all # verify VMs are running

Phase 4: Platform Services

bash bash scripts/kubeconfig.sh local kubectl get nodes # must show Ready bash scripts/plan.sh local platform-services bash scripts/apply.sh local platform-services

Phase 5: Kubernetes Base Manifests

bash kubectl apply -k kubernetes/clusters/local kubectl get ns # verify namespaces created

Phase 6: App Delivery

Deploy applications to kubernetes/apps/ and configure Flux or Argo CD to watch that path. See kubernetes/operators/flux/ for bootstrap.

Cloud Environment

Repeat phases 2–6 with env=cloud. Requires: - CONFIRM_CLOUD_APPLY=true - Remote backend configured (TF_VAR_backend_bucket, TF_VAR_backend_region) - Cloud provider credentials in environment