Skip to main content

Get Started with Infralib

Describe your platform in one config.yaml, run the Infralib agent, and get a network, a Kubernetes cluster and ArgoCD in your own cloud account. No Entigo Portal needed.

Infralib runs on AWS, Google Cloud, Oracle Cloud and Azure. This guide shows all four.

You need
  • An empty cloud account with full access: administrator on AWS, a service account with owner access on Google Cloud, an empty compartment and an administrator API key on Oracle Cloud, an empty subscription and a service principal with Owner on Azure
  • A public DNS zone in your cloud account. Your environment gets a subdomain under it.
  • Docker, kubectl and your cloud's CLI (aws, gcloud, oci or az with kubelogin)
You'll have
A network, a Kubernetes cluster and ArgoCD with core services in your own cloud account, kept up to date by the Infralib agent.
About 30 minutes for the first run
  1. 1Write the configuration
  2. 2Run the Infralib agent
  3. 3Check the result
  4. 4Add the platform APIs
  5. 5Keep it up to date
Want the full tour? The Infralib Quickstart goes deeper: bootstrapping, dependency injection, custom code, change management, updates and cleanup.Open↗

1. Write the configuration​

The whole platform is described in one config.yaml:

  • prefix names everything that gets created.
  • Each step becomes a pipeline.
  • Each module comes from the Infralib release and is wired to the others automatically.

Pick your cloud and copy the example. The choice applies to every step on this page.

Show the minimal config.yaml for AWS
sources:
  - url: oci://public.ecr.aws/entigolabs/entigo-infralib-release
prefix: dev
steps:
  - name: net
    type: terraform
    modules:
      - name: main
        source: aws/vpc
        inputs:
          vpc_cidr: 10.112.0.0/16
          one_nat_gateway_per_az: false
          elasticache_subnets: |
            []
          intra_subnets: |
            []
      - name: dns
        source: aws/route53
        inputs:
          create_private: false
          create_public: true
          parent_zone_id: REPLACEME
          public_subdomain_name: "{{ .config.prefix }}"
  - name: infra
    type: terraform
    vpc:
      attach: true
    modules:
      - name: eks
        source: aws/eks
        inputs:
          # Gives you admin access to the cluster. Use the role you sign in to AWS with,
          # or replace this line with: aws_auth_user: <your IAM user name>
          iam_admin_role: AWSReservedSSO_AWSAdministratorAccess_.*
          eks_cluster_public: true
          eks_main_min_size: 1
          eks_main_max_size: 3
          eks_main_volume_size: 100
          eks_tools_desired_size: 1
          eks_mon_max_size: 0
          cluster_enabled_log_types: |
            []
      - name: crossplane
        source: aws/crossplane
  - name: apps
    type: argocd-apps
    modules:
      - name: argocd
        source: argocd
        inputs:
          argocd:
            server:
              ingress:
                annotations:
                  alb.ingress.kubernetes.io/group.name: external
                  alb.ingress.kubernetes.io/scheme: internet-facing
      - name: aws-alb-{{ .config.prefix }}
        source: aws-alb
      - name: crossplane-system
        source: crossplane-core
      - name: crossplane-aws
        source: crossplane-aws
      - name: external-dns-{{ .config.prefix }}
        source: external-dns
      - name: istio-base
        source: istio-base
      - name: istio-system
        source: istio-istiod
      - name: aws-storageclass
        source: aws-storageclass
      - name: metrics-server
        source: metrics-server
      - name: external-secrets-{{ .config.prefix }}
        source: external-secrets
  • Replace REPLACEME with the ID of your public Route 53 zone.
  • Set iam_admin_role to the role you sign in with, or aws_auth_user to your IAM user. Without it, you cannot access the cluster.
Every option in the config fileConfiguration›
This creates billable resources

Use an empty account, so nothing else is affected. To remove everything again, see the destroy and delete commands.

2. Run the Infralib agent​

Run it from the directory that contains config.yaml:

docker run -it --pull always --rm -v "$(pwd)":"/conf" \
  -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e AWS_REGION \
  entigolabs/entigo-infralib-agent ei-agent run -c /conf/config.yaml

The first run takes about 30 to 60 minutes. This is what happens:

  1. Prepare

    Creates a bucket for its state, and one pipeline per step.

  2. Network

    The network. On AWS also the DNS zone and TLS certificate. On Oracle Cloud also the encryption keys, a private CA, the DNS zone and TLS certificate.

  3. Kubernetes cluster

    The cluster and its node groups.

  4. Applications

    ArgoCD and the core services, installed through ArgoCD.

To run it in your cloud account instead of on your machine, use the bootstrap command.

3. Check the result​

You now have:

  • NetworkVPC and subnets
  • DNS + TLSdev.<your domain>
  • KubernetesEKS, GKE, OKE or AKS cluster
  • ArgoCDWith the core services

Connect to your new cluster:

aws eks update-kubeconfig --region $AWS_REGION --name dev-infra-eks
kubectl get nodes

Sign in to ArgoCD as admin with the initial password:

kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d

4. Add the platform APIs​

To create Zones, databases and everything else in the Guides, add the platform APIs to the apps step and run the Infralib agent again. The platform APIs currently run on AWS only.

Show the changes to the apps step
  - name: apps
    type: argocd-apps
    modules:
      # ...modules from step 1...
      - name: crossplane-aws
        source: crossplane-aws
        inputs:
          global:
            createObservers: true
            createNamespacedObservers: true
      - name: external-secrets-{{ .config.prefix }}
        source: external-secrets
        inputs:
          global:
            createClusterSecretStore: true
      - name: kyverno
        source: kyverno
      - name: crossplane-sql
        source: crossplane-sql
      - name: platform-apis
        source: platform-apis

Change the existing crossplane-aws and external-secrets entries rather than adding second ones.

This unlocks:

ZonesOn by defaultPostgreSQLOn by defaultValkeyOn by defaultS3On by defaultRepositoryOn by defaultMariaDBTurn on firstRabbitMQTurn on firstKafkaTurn on first
What each API needs, and how to turn it onInfralib Requirements›

5. Keep it up to date​

Infralib releases tested updates several times a week. Apply them with the update command:

docker run -it --pull always --rm -v "$(pwd)":"/conf" \
  -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e AWS_REGION \
  entigolabs/entigo-infralib-agent ei-agent update -c /conf/config.yaml

By default:

  • Updates that remove resources wait for your approval in the pipeline.
  • All other updates apply automatically.
Change when updates need approval, per stepAuto approval logic› Update on a scheduleScheduling›
Read the release notes before you update

Breaking changes are announced in the Infralib release notes. Check them before updating, especially after skipping a few releases.

Next steps​