Cloud Deploy Skill

Purpose

Provides safe, consistent methods for deploying to the mono Kubernetes cluster and managing cloud infrastructure via Spacelift.

When to Use

Use this skill when the user requests:

• "Deploy to the cluster"
• "Deploy the k8s manifests"
• "Check cluster status"
• "Apply changes to k8s"
• "Check Spacelift status"
• "What's running in the cluster?"

Architecture Overview

Infrastructure (cloud/terraform/):

• Managed by Spacelift mono/cloud stack
• Auto-deploys on push to main
• DO NOT manually run tofu apply

Kubernetes (cloud/k8s/):

• Deployed manually via scripts
• System components in cloud/k8s/system/
• Applications in cloud/k8s/apps/

Scripts

All scripts are in cloud/scripts/:

k8s-deploy.sh - Main Deploy Script

# Deploy everything (system + apps)
./cloud/scripts/k8s-deploy.sh

# Deploy only system components
./cloud/scripts/k8s-deploy.sh system

# Deploy only apps
./cloud/scripts/k8s-deploy.sh apps

# Deploy specific app
./cloud/scripts/k8s-deploy.sh apps/dagger

k8s-kubeconfig.sh - Fetch Kubeconfig

# Fetch and export kubeconfig
eval $(./cloud/scripts/k8s-kubeconfig.sh)

k8s-kubectl.sh - Kubectl Wrapper

# Run kubectl commands against the cluster
./cloud/scripts/k8s-kubectl.sh get pods -A
./cloud/scripts/k8s-kubectl.sh logs -n n8n deployment/n8n

Deployment Order

System components MUST be deployed in this order:

1. gvisor (container runtime)
2. network-policies (security)
3. ingress-nginx (ingress controller)
4. cert-manager (TLS certificates)

Apps can be deployed in any order after system components.

Common Operations

Check Cluster Status

./cloud/scripts/k8s-kubectl.sh get nodes
./cloud/scripts/k8s-kubectl.sh get pods -A
./cloud/scripts/k8s-kubectl.sh get ingress -A

Deploy New App

1. Create manifests in cloud/k8s/apps/<app-name>/
2. Run ./cloud/scripts/k8s-deploy.sh apps/<app-name>

Check Spacelift Status

mise x -- fnox exec -- spacectl stack list
mise x -- fnox exec -- spacectl stack run list --id mono-cloud-01

View Spacelift Logs

mise x -- fnox exec -- spacectl stack logs --id mono-cloud-01 --run <run-id>

Safety Rules

NEVER DO:

• Modify ssh_keys in terraform (destroys server!)
• Run tofu apply manually (use Spacelift)
• Commit secrets to the repo
• Delete namespaces without confirmation

ALWAYS DO:

• Use the deploy scripts (not raw kubectl)
• Check cluster status after deploys
• Commit manifest changes before deploying
• Wait for Spacelift runs to complete before making more infra changes

Troubleshooting

Kubeconfig Issues

# Re-fetch kubeconfig
rm ~/.kube/mono-config
./cloud/scripts/k8s-kubeconfig.sh

Pod Not Starting

./cloud/scripts/k8s-kubectl.sh describe pod <pod-name> -n <namespace>
./cloud/scripts/k8s-kubectl.sh logs <pod-name> -n <namespace>

Ingress Not Working

# Check ingress-nginx
./cloud/scripts/k8s-kubectl.sh get pods -n ingress-nginx
./cloud/scripts/k8s-kubectl.sh logs -n ingress-nginx deployment/ingress-nginx-controller

Cert-Manager Issues

# Check certificate status
./cloud/scripts/k8s-kubectl.sh get certificates -A
./cloud/scripts/k8s-kubectl.sh describe certificate <name> -n <namespace>

Server Access

SSH to the mono server:

ssh [email protected]

K3s kubeconfig is at /etc/rancher/k3s/k3s.yaml on the server.