github.com/caos/orbos@v1.5.14-0.20221103111702-e6cd0cea7ad4/README.md (about) 1 :warning: ORBOS is in maintenance mode and not actively developed anymore. Generally, important fixes are done and pull requests are reviewed and merged. 2 3 4 # ORBOS - GitOps everything 5 6  7 8 [](https://github.com/semantic-release/semantic-release) 9 [](https://github.com/caos/orbos/actions) 10 [](https://github.com/caos/orbos/blob/master/LICENSE) 11 [](https://github.com/caos/orbos/releases) 12 [](https://goreportcard.com/report/github.com/caos/orbos) 13 [](https://codecov.io/gh/caos/orbos) 14 15 ## [ORBOS explained](docs/explained.md) 16 17 ### [ORBITER](docs/orbiter/orbiter.md) 18 19 ### [BOOM](docs/boom/boom.md) 20 21 ## Getting Started on Google Compute Engine 22 23 In the following example we will create a `kubernetes` cluster on a `GCEProvider`. All the `GCEProvider` needs besides a writable Git Repository is a billable Google Cloud Project and a Google Service Account with sufficient permissions. 24 25 ### Initialize A Git Repository 26 27 Copy the files [orbiter.yml](examples/orbiter/gce/orbiter.yml) and [boom.yml](examples/boom/boom.yml) to the root of a new git Repository. 28 29 ### Configure your local environment 30 31 ```bash 32 # Install the latest orbctl 33 curl -s https://api.github.com/repos/caos/orbos/releases/latest | grep "browser_download_url.*orbctl-$(uname)-$(uname -m)" | cut -d '"' -f 4 | sudo wget -i - -O /usr/local/bin/orbctl 34 sudo chmod +x /usr/local/bin/orbctl 35 sudo chown $(id -u):$(id -g) /usr/local/bin/orbctl 36 37 # Create an orb file at ${HOME}/.orb/config 38 MY_GIT_REPO="git@github.com:me/my-orb.git" 39 orbctl --gitops configure --repourl ${MY_GIT_REPO} --masterkey "$(openssl rand -base64 21)" 40 ``` 41 42 ### Configure a billable Google Cloud Platform project of your choice 43 44 ```bash 45 MY_GCE_PROJECT="$(gcloud config get-value project)" 46 ORBOS_SERVICE_ACCOUNT_NAME=orbiter-system 47 ORBOS_SERVICE_ACCOUNT=${ORBOS_SERVICE_ACCOUNT_NAME}@${MY_GCE_PROJECT}.iam.gserviceaccount.com 48 49 # Create a service account for the ORBITER user 50 gcloud iam service-accounts create ${ORBOS_SERVICE_ACCOUNT_NAME} \ 51 --description="${ORBOS_SERVICE_ACCOUNT_NAME}" \ 52 --display-name="${ORBOS_SERVICE_ACCOUNT_NAME}" 53 54 # Assign the service account the roles `Compute Admin`, `IAP-secured Tunnel User` and `Service Usage Admin` 55 gcloud projects add-iam-policy-binding ${MY_GCE_PROJECT} \ 56 --member=serviceAccount:${ORBOS_SERVICE_ACCOUNT} \ 57 --role=roles/compute.admin 58 gcloud projects add-iam-policy-binding ${MY_GCE_PROJECT} \ 59 --member=serviceAccount:${ORBOS_SERVICE_ACCOUNT} \ 60 --role=roles/iap.tunnelResourceAccessor 61 gcloud projects add-iam-policy-binding ${MY_GCE_PROJECT} \ 62 --member=serviceAccount:${ORBOS_SERVICE_ACCOUNT} \ 63 --role=roles/serviceusage.serviceUsageAdmin 64 gcloud projects add-iam-policy-binding ${MY_GCE_PROJECT} \ 65 --member=serviceAccount:${ORBOS_SERVICE_ACCOUNT} \ 66 --role=roles/iam.serviceAccountUser 67 68 69 # Create a JSON key for the service account 70 gcloud iam service-accounts keys create /tmp/key.json \ 71 --iam-account ${ORBOS_SERVICE_ACCOUNT} 72 73 # Encrypt and write the created JSON key to the orbiter.yml 74 orbctl --gitops writesecret orbiter.gce.jsonkey --file /tmp/key.json 75 rm -f /tmp/key.json 76 ``` 77 78 ### Bootstrap your Kubernetes cluster on GCE 79 80 ```bash 81 orbctl --gitops takeoff 82 ``` 83 84 As soon as the Orbiter has deployed itself to the cluster, you can decrypt the generated admin kubeconfig 85 86 ```bash 87 mkdir -p ~/.kube 88 orbctl --gitops readsecret orbiter.k8s.kubeconfig > ~/.kube/config 89 ``` 90 91 Wait for grafana to become running 92 93 ```bash 94 kubectl --namespace caos-system get po -w 95 ``` 96 97 Open your browser at `http://localhost:8080` to show your new clusters dashboards. Default username and password are both `admin` 98 99 ```bash 100 kubectl --namespace caos-system port-forward svc/grafana 8080:80 101 ``` 102 103 Delete everything created by Orbiter 104 105 ```bash 106 # Remove all GCE compute resources 107 orbctl --gitops destroy 108 109 # Unassign all service account roles 110 gcloud projects remove-iam-policy-binding ${MY_GCE_PROJECT} \ 111 --member=serviceAccount:${ORBOS_SERVICE_ACCOUNT} \ 112 --role=roles/compute.admin 113 gcloud projects remove-iam-policy-binding ${MY_GCE_PROJECT} \ 114 --member=serviceAccount:${ORBOS_SERVICE_ACCOUNT} \ 115 --role=roles/iap.tunnelResourceAccessor 116 gcloud projects remove-iam-policy-binding ${MY_GCE_PROJECT} \ 117 --member=serviceAccount:${ORBOS_SERVICE_ACCOUNT} \ 118 --role=roles/serviceusage.serviceUsageAdmin 119 120 # Remove service account 121 gcloud iam service-accounts delete --quiet ${ORBOS_SERVICE_ACCOUNT} 122 ``` 123 124 ## Offerings 125 126 The usage of our open source code is and stays completely free. Below you will find our base offerings without Service Level. If you'd like to operate ORBOS in production we recommend you to get in touch with us to arrange a Service Level Agreement and benefit from guaranteed availability and response times. For further information or if you need something else, contact us now at orbos@caos.ch. 127 128 ### Support 129 130 You run an maintain your Orbs yourself. Your incidents are treated with a high priority. In return, we charge you with a price from CHF 250 per Orb and Month, decreasing to CHF 100. 131 132 ### Dedicated Orbs 133 134 We run and maintain your Orbs on a supported provider of your choice. Your incidents are treated with a high priority. In return, we charge you with a price from CHF 500 per Orb and Month, decreasing to CHF 100. 135 136 ## Usage Data 137 138 ORBOS components send errors and usage data to CAOS Ltd., so that we are able to identify code improvement potential. If you don't want to send this data or don't have an internet connection, pass the global flag `--disable-analytics` when using orbctl. For disabling ingestion for already-running components, execute the takeoff command again with the `--disable-analytics` flag. 139 140 We try to distinguishing the environments from which events come from. As environment identifier, we defer the environment identifier from your git repository URL if the --gitops flag is passed. 141 142 Besides from errors that don't clearly come from misconfiguration or cli misuage, we send an inital event when any binary is started. This is a "<component> invoked" event along with the flags that are passed to it, except secret values of course. 143 ## License 144 145 The full functionality of the operator is and stays open source and free to use for everyone. We pay our wages by using ORBOS for selling further workload enterprise services like support, monitoring and forecasting, IAM, CI/CD, secrets management etc. Visit our [website](https://caos.ch) and get in touch. 146 147 See the exact licensing terms [here](./LICENSE) 148 149 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.