openfaas
Migrate OFC from one environment to another (on Kubernetes)
Expected Behaviour
We need a strategy to migrate the community cluster from one Kubernetes cluster to another with as little impact as possible to users.
This includes:
- exporting the SealedSecrets public/private key pair
- reimporting them
- exporting the deployments/services
- reimporting them
- exporting / importing ingress etc.
Some of the work is covered by the ofc-bootstrap project.
exporting the SealedSecrets public/private key pair
@stefanprodan do you know how to approach the above point?
Instead of import/export I would copy the SealedSecrets master key and do the whole bootstrap as it were a fresh install.
If OFC is GitOps you should't have to import/export anything expect for the private key.
This is to deploy the whole installation. The private key is generated upon installation with Helm of SealedSecrets.
How do you pass a private key to the helm installation? Is that something you've done before and can comment?
To summarise the discussion on Slack:
-
Get the private key from the old cluster:
kubectl -n openfaas get secret sealed-secrets-key --export -oyaml > sealed-secrets-key.yaml -
Apply the private key on the new cluster:
kubectl apply -f sealed-secrets-key.yaml -
Install SealedSecrets with Helm:
helm install --namespace openfaas --name sealed-secrets stable/sealed-secrets