fix: operator picks (#1463)

* feat(crd): add crd mode for operators (#1329)

* feat(operator): add base for zitadel operator

* fix(operator): changed pipeline to release operator

* fix(operator): fmt with only one parameter

* fix(operator): corrected workflow job name

* fix(zitadelctl): added restore and backuplist command

* fix(zitadelctl): scale for restore

* chore(container): use scratch for deploy container

* fix(zitadelctl): limit image to scratch

* fix(migration): added migration scripts for newer version

* fix(operator): changed handling of kubeconfig in operator logic

* fix(operator): changed handling of secrets in operator logic

* fix(operator): use new version of zitadel

* fix(operator): added path for migrations

* fix(operator): delete doublets of migration scripts

* fix(operator): delete subpaths and integrate logic into init container

* fix(operator): corrected path in dockerfile for local migrations

* fix(operator): added migrations for cockroachdb-secure

* fix(operator): delete logic for ambassador module

* fix(operator): added read and write secret commands

* fix(operator): correct and align operator pipeline with zitadel pipeline

* fix(operator): correct yaml error in operator pipeline

* fix(operator): correct action name in operator pipeline

* fix(operator): correct case-sensitive filename in operator pipeline

* fix(operator): upload artifacts from buildx output

* fix(operator): corrected attribute spelling error

* fix(operator): combined jobs for operator binary and image

* fix(operator): added missing comma in operator pipeline

* fix(operator): added codecov for operator image

* fix(operator): added codecov for operator image

* fix(testing): code changes for testing and several unit-tests (#1009)

* fix(operator): usage of interface of kubernetes client for testing and several unit-tests

* fix(operator): several unit-tests

* fix(operator): several unit-tests

* fix(operator): changed order for the operator logic

* fix(operator): added version of zitadelctl from semantic release

* fix(operator): corrected function call with version of zitadelctl

* fix(operator): corrected function call with version of zitadelctl

* fix(operator): add check output to operator release pipeline

* fix(operator): set --short length everywhere to 12

* fix(operator): zitadel setup in job instead of exec with several unit tests

* fix(operator): fixes to combine newest zitadel and testing branch

* fix(operator): corrected path in Dockerfile

* fix(operator): fixed unit-test that was ignored during changes

* fix(operator): fixed unit-test that was ignored during changes

* fix(operator): corrected Dockerfile to correctly use env variable

* fix(operator): quickfix takeoff deployment

* fix(operator): corrected the clusterrolename in the applied artifacts

* fix: update secure migrations

* fix(operator): migrations (#1057)

* fix(operator): copied migrations from orbos repository

* fix(operator): newest migrations

* chore: use cockroach-secure

* fix: rename migration

* fix: remove insecure cockroach migrations

Co-authored-by: Stefan Benz <stefan@caos.ch>

* fix: finalize labels

* fix(operator): cli logging concurrent and fixe deployment of operator during restore

* fix: finalize labels and cli commands

* fix: restore

* chore: cockroachdb is always secure

* chore: use orbos consistent-labels latest commit

* test: make tests compatible with new labels

* fix: default to sa token for start command

* fix: use cockroachdb v12.02

* fix: don't delete flyway user

* test: fix migration test

* fix: use correct table qualifiers

* fix: don't alter sequence ownership

* fix: upgrade flyway

* fix: change ownership of all dbs and tables to admin user

* fix: change defaultdb user

* fix: treat clientid status codes >= 400 as errors

* fix: reconcile specified ZITADEL version, not binary version

* fix: add ca-certs

* fix: use latest orbos code

* fix: use orbos with fixed race condition

* fix: use latest ORBOS code

* fix: use latest ORBOS code

* fix: make migration and scaling around restoring work

* fix(operator): move zitadel operator

* chore(migrations): include owner change migration

* feat(db): add code base for database operator

* fix(db): change used image registry for database operator

* fix(db): generated mock

* fix(db): add accidentally ignored file

* fix(db): add cockroachdb backup image to pipeline

* fix(db): correct pipeline and image versions

* fix(db): correct version of used orbos

* fix(db): correct database import

* fix(db): go mod tidy

* fix(db): use new version for orbos

* fix(migrations): include migrations into zitadelctl binary (#1211)

* fix(db): use statik to integrate migrations into binary

* fix(migrations): corrections unit tests and pipeline for integrated migrations into zitadelctl binary

* fix(migrations): correction in dockerfile for pipeline build

* fix(migrations): correction in dockerfile for pipeline build

* fix(migrations):  dockerfile changes for cache optimization

* fix(database): correct used part-of label in database operator

* fix(database): correct used selectable label in zitadel operator

* fix(operator): correct lables for user secrets in zitadel operator

* fix(operator): correct lables for service test in zitadel operator

* fix: don't enable database features for user operations (#1227)

* fix: don't enable database features for user operations

* fix: omit database feature for connection info adapter

* fix: use latest orbos version

* fix(crd): corrected logic to get database connection and other info

* fix(crd): corrected yaml tags and start for zitadel operator

* fix(crd): move some dependencies and use consistent structure

* fix(crd): corrected unit-tests

* fix(crd): corrected main files for debug starts

* chore(pipeline): use correct version for zitadelctl build

* fix(crd): correct calculating of current db state for zitadel operator

* fix(crd): use binary version for deployment of crd mode operators

* fix(crd): add gitops attribute for reconciling

* fix(crd): corrected crd with newest version

* fix(migration): collect cleanup functions and only use them if all jobs are successful

* fix(zitadelctl): import gcp auth to connect to gke cluster

* feat: Add read and writesecret options for crd mode (#1435)

* fix: don't require orbconfig for crd mode

* test: pass

* fix(zitadelctl): import gcp auth to connect to gke cluster

* feat: add read and writesecret option for crd mode

* test: fix

* fix: make all crd secrets writable

* fix: use in-cluster configs for in-cluster operators

* chore: remove unnecessary debug files

Co-authored-by: Stefan Benz <stefan@caos.ch>

* fix: Crdoperatormerge review (#1385)

* fix: don't require orbconfig for crd mode

* test: pass

* fix(zitadelctl): import gcp auth to connect to gke cluster

* fix: ensure caos-system namespace

* fix: apply orbconfig at takeoff

* docs: improve help for creating an orbconfig

* docs: describe orbconfig properties

* docs: add --gitops to help message example

* fix(pipeline): correct upload of artifacts in dev releases

* test: pass

Co-authored-by: Stefan Benz <stefan@caos.ch>

* fix(test): corrected falsely merged tests

* chore: update orbos library

* fix: only handle exactly named and namespaced crd resource

* fix: print errors, check correct crd namespace

* fix: validate bucket secret

* chore: compile

* fix(operator): corrected secret handling when unused secrets are not defined

* fix(operator): corrected handling of jobs

* fix: dont print logs when readsecret path is provided

* fix(operator): corrected handling of jobs and sort for mounted volumes

* fix(operator): sort for volumes

* fix(operator): change orboos import to newest release

Co-authored-by: Florian Forster <florian@caos.ch>
Co-authored-by: Elio Bischof <eliobischof@gmail.com>

(cherry picked from commit fa9bd5a8e7)

* fix(operator): Standard timeout handling (#1458)

* fix: always use standard time.Duration

* fix: give backup and restore more time

* fix: give backup and restore jobs more time

(cherry picked from commit 7468b7d1e8)

* fix go mod

Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
Co-authored-by: Elio Bischof <eliobischof@gmail.com>

cmd/database-debug/main.go

@@ -1,50 +0,0 @@
-package main
-
-import (
-	"flag"
-	"io/ioutil"
-
-	"github.com/caos/orbos/pkg/kubernetes"
-
-	"github.com/caos/zitadel/operator/start"
-
-	"github.com/caos/orbos/mntr"
-	"github.com/caos/zitadel/operator/helpers"
-)
-
-func main() {
-
-	orbconfig := flag.String("orbconfig", "~/.orb/config", "The orbconfig file to use")
-	kubeconfig := flag.String("kubeconfig", "~/.kube/config", "The kubeconfig file to use")
-	verbose := flag.Bool("verbose", false, "Print debug levelled logs")
-
-	flag.Parse()
-
-	monitor := mntr.Monitor{
-		OnInfo:   mntr.LogMessage,
-		OnChange: mntr.LogMessage,
-		OnError:  mntr.LogError,
-	}
-
-	if *verbose {
-		monitor = monitor.Verbose()
-	}
-
-	kc, err := ioutil.ReadFile(helpers.PruneHome(*kubeconfig))
-	if err != nil {
-		panic(err)
-	}
-
-	if err := start.Database(
-		monitor,
-		helpers.PruneHome(*orbconfig),
-		kubernetes.NewK8sClient(monitor, strPtr(string(kc))),
-		strPtr("database-development"),
-	); err != nil {
-		panic(err)
-	}
-}
-
-func strPtr(str string) *string {
-	return &str
-}

cmd/operator-debug/main.go

@@ -1,47 +0,0 @@
-package main
-
-import (
-	"flag"
-	"io/ioutil"
-
-	"github.com/caos/orbos/mntr"
-	"github.com/caos/orbos/pkg/kubernetes"
-	"github.com/caos/zitadel/operator/helpers"
-	"github.com/caos/zitadel/operator/start"
-)
-
-func main() {
-	orbconfig := flag.String("orbconfig", "~/.orb/config", "The orbconfig file to use")
-	kubeconfig := flag.String("kubeconfig", "~/.kube/config", "The kubeconfig file to use")
-	verbose := flag.Bool("verbose", false, "Print debug levelled logs")
-
-	flag.Parse()
-
-	monitor := mntr.Monitor{
-		OnInfo:   mntr.LogMessage,
-		OnChange: mntr.LogMessage,
-		OnError:  mntr.LogError,
-	}
-
-	if *verbose {
-		monitor = monitor.Verbose()
-	}
-
-	kc, err := ioutil.ReadFile(helpers.PruneHome(*kubeconfig))
-	if err != nil {
-		panic(err)
-	}
-
-	if err := start.Operator(
-		monitor,
-		helpers.PruneHome(*orbconfig),
-		kubernetes.NewK8sClient(monitor, strPtr(string(kc))),
-		strPtr("local-debugging"),
-	); err != nil {
-		panic(err)
-	}
-}
-
-func strPtr(str string) *string {
-	return &str
-}

cmd/zitadelctl/cmds/backup.go

@@ -1,14 +1,15 @@
 package cmds
 
 import (
+	"io/ioutil"
+
 	"github.com/caos/orbos/pkg/kubernetes"
 	"github.com/caos/zitadel/operator/api"
-	"github.com/caos/zitadel/operator/start"
+	"github.com/caos/zitadel/operator/crtlgitops"
 	"github.com/spf13/cobra"
-	"io/ioutil"
 )
 
-func BackupCommand(rv RootValues) *cobra.Command {
+func BackupCommand(getRv GetRootValues) *cobra.Command {
 	var (
 		kubeconfig string
 		backup     string
@@ -24,14 +25,19 @@ func BackupCommand(rv RootValues) *cobra.Command {
 	flags.StringVar(&backup, "backup", "", "Name used for backup folder")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
-		_, monitor, orbConfig, gitClient, version, errFunc, err := rv()
+		rv, err := getRv()
 		if err != nil {
 			return err
 		}
 		defer func() {
-			err = errFunc(err)
+			err = rv.ErrFunc(err)
 		}()
 
+		monitor := rv.Monitor
+		orbConfig := rv.OrbConfig
+		gitClient := rv.GitClient
+		version := rv.Version
+
 		if err := gitClient.Configure(orbConfig.URL, []byte(orbConfig.Repokey)); err != nil {
 			return err
 		}
@@ -55,7 +61,7 @@ func BackupCommand(rv RootValues) *cobra.Command {
 
 			k8sClient := kubernetes.NewK8sClient(monitor, &kubeconfigStr)
 			if k8sClient.Available() {
-				if err := start.Backup(
+				if err := crtlgitops.Backup(
 					monitor,
 					orbConfig.Path,
 					k8sClient,

cmd/zitadelctl/cmds/backuplist.go

@@ -8,7 +8,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-func BackupListCommand(rv RootValues) *cobra.Command {
+func BackupListCommand(getRv GetRootValues) *cobra.Command {
 	var (
 		cmd = &cobra.Command{
 			Use:   "backuplist",
@@ -18,14 +18,18 @@ func BackupListCommand(rv RootValues) *cobra.Command {
 	)
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		_, monitor, orbConfig, gitClient, _, errFunc, err := rv()
+		rv, err := getRv()
 		if err != nil {
 			return err
 		}
 		defer func() {
-			err = errFunc(err)
+			err = rv.ErrFunc(err)
 		}()
 
+		monitor := rv.Monitor
+		orbConfig := rv.OrbConfig
+		gitClient := rv.GitClient
+
 		if err := gitClient.Configure(orbConfig.URL, []byte(orbConfig.Repokey)); err != nil {
 			monitor.Error(err)
 			return nil

cmd/zitadelctl/cmds/readsecret.go

@@ -3,12 +3,15 @@ package cmds
 import (
 	"os"
 
-	"github.com/caos/orbos/pkg/secret"
+	"github.com/caos/orbos/pkg/kubernetes/cli"
+
 	"github.com/caos/zitadel/operator/secrets"
+
+	"github.com/caos/orbos/pkg/secret"
 	"github.com/spf13/cobra"
 )
 
-func ReadSecretCommand(rv RootValues) *cobra.Command {
+func ReadSecretCommand(getRv GetRootValues) *cobra.Command {
 	return &cobra.Command{
 		Use:     "readsecret [path]",
 		Short:   "Print a secrets decrypted value to stdout",
@@ -16,32 +19,33 @@ func ReadSecretCommand(rv RootValues) *cobra.Command {
 		Args:    cobra.MaximumNArgs(1),
 		Example: `zitadelctl readsecret zitadel.emailappkey > ~/emailappkey`,
 		RunE: func(cmd *cobra.Command, args []string) error {
-
-			_, monitor, orbConfig, gitClient, _, errFunc, err := rv()
+			rv, err := getRv()
 			if err != nil {
 				return err
 			}
 			defer func() {
-				err = errFunc(err)
+				err = rv.ErrFunc(err)
 			}()
-			if err := gitClient.Configure(orbConfig.URL, []byte(orbConfig.Repokey)); err != nil {
-				return err
-			}
 
-			if err := gitClient.Clone(); err != nil {
-				return err
-			}
+			monitor := rv.Monitor
+			orbConfig := rv.OrbConfig
+			gitClient := rv.GitClient
 
 			path := ""
 			if len(args) > 0 {
 				path = args[0]
 			}
 
+			k8sClient, _, err := cli.Client(monitor, orbConfig, gitClient, rv.Kubeconfig, rv.Gitops)
+			if err != nil && !rv.Gitops {
+				return err
+			}
+
 			value, err := secret.Read(
-				monitor,
-				gitClient,
+				k8sClient,
 				path,
-				secrets.GetAllSecretsFunc(orbConfig))
+				secrets.GetAllSecretsFunc(monitor, path == "", rv.Gitops, gitClient, k8sClient, orbConfig),
+			)
 			if err != nil {
 				monitor.Error(err)
 				return nil

cmd/zitadelctl/cmds/restore.go

@@ -4,19 +4,20 @@ import (
 	"errors"
 	"io/ioutil"
 
+	"github.com/caos/zitadel/operator/crtlgitops"
 	"github.com/caos/zitadel/operator/helpers"
 
 	"github.com/caos/orbos/pkg/kubernetes"
-	"github.com/caos/zitadel/operator/start"
 	"github.com/caos/zitadel/pkg/databases"
 	"github.com/manifoldco/promptui"
 	"github.com/spf13/cobra"
 )
 
-func RestoreCommand(rv RootValues) *cobra.Command {
+func RestoreCommand(getRv GetRootValues) *cobra.Command {
 	var (
 		backup     string
 		kubeconfig string
+		gitOpsMode bool
 		cmd        = &cobra.Command{
 			Use:   "restore",
 			Short: "Restore from backup",
@@ -27,16 +28,22 @@ func RestoreCommand(rv RootValues) *cobra.Command {
 	flags := cmd.Flags()
 	flags.StringVar(&backup, "backup", "", "Backup used for db restore")
 	flags.StringVar(&kubeconfig, "kubeconfig", "~/.kube/config", "Kubeconfig for ZITADEL operator deployment")
+	flags.BoolVar(&gitOpsMode, "gitops", false, "defines if the operator should run in gitops mode")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		_, monitor, orbConfig, gitClient, version, errFunc, err := rv()
+		rv, err := getRv()
 		if err != nil {
 			return err
 		}
 		defer func() {
-			err = errFunc(err)
+			err = rv.ErrFunc(err)
 		}()
 
+		monitor := rv.Monitor
+		orbConfig := rv.OrbConfig
+		gitClient := rv.GitClient
+		version := rv.Version
+
 		kubeconfig = helpers.PruneHome(kubeconfig)
 
 		if err := gitClient.Configure(orbConfig.URL, []byte(orbConfig.Repokey)); err != nil {
@@ -89,7 +96,7 @@ func RestoreCommand(rv RootValues) *cobra.Command {
 				return nil
 			}
 
-			if err := start.Restore(monitor, gitClient, orbConfig, k8sClient, backup, &version); err != nil {
+			if err := crtlgitops.Restore(monitor, gitClient, orbConfig, k8sClient, backup, gitOpsMode, &version); err != nil {
 				monitor.Error(err)
 			}
 			return nil

cmd/zitadelctl/cmds/root.go

@@ -2,6 +2,7 @@ package cmds
 
 import (
 	"context"
+
 	"github.com/caos/orbos/mntr"
 	"github.com/caos/orbos/pkg/git"
 	"github.com/caos/orbos/pkg/orb"
@@ -9,64 +10,92 @@ import (
 	"github.com/spf13/cobra"
 )
 
-type RootValues func() (context.Context, mntr.Monitor, *orb.Orb, *git.Client, string, errFunc, error)
+type RootValues struct {
+	Ctx        context.Context
+	Monitor    mntr.Monitor
+	Version    string
+	Gitops     bool
+	OrbConfig  *orb.Orb
+	GitClient  *git.Client
+	Kubeconfig string
+	ErrFunc    errFunc
+}
+
+type GetRootValues func() (*RootValues, error)
 
 type errFunc func(err error) error
 
-func RootCommand(version string) (*cobra.Command, RootValues) {
+func RootCommand(version string) (*cobra.Command, GetRootValues) {
 
 	var (
-		verbose       bool
-		orbConfigPath string
-	)
-
-	cmd := &cobra.Command{
-		Use:   "zitadelctl [flags]",
-		Short: "Interact with your IAM orbs",
-		Long: `zitadelctl launches zitadel and simplifies common tasks such as updating your kubeconfig.
-Participate in our community on https://github.com/caos/orbos
-and visit our website at https://caos.ch`,
-		Example: `$ mkdir -p ~/.orb
-$ cat > ~/.orb/myorb << EOF
-> url: git@github.com:me/my-orb.git
-> masterkey: "$(gopass my-secrets/orbs/myorb/masterkey)"
-> repokey: |
-> $(cat ~/.ssh/myorbrepo | sed s/^/\ \ /g)
-> EOF
-$ orbctl -f ~/.orb/myorb [command]
-`,
-	}
-
-	flags := cmd.PersistentFlags()
-	flags.StringVarP(&orbConfigPath, "orbconfig", "f", "~/.orb/config", "Path to the file containing the orbs git repo URL, deploy key and the master key for encrypting and decrypting secrets")
-	flags.BoolVar(&verbose, "verbose", false, "Print debug levelled logs")
-
-	return cmd, func() (context.Context, mntr.Monitor, *orb.Orb, *git.Client, string, errFunc, error) {
-
-		monitor := mntr.Monitor{
+		ctx     = context.Background()
+		monitor = mntr.Monitor{
 			OnInfo:   mntr.LogMessage,
 			OnChange: mntr.LogMessage,
 			OnError:  mntr.LogError,
 		}
+		rv = &RootValues{
+			Ctx:     ctx,
+			Version: version,
+			ErrFunc: func(err error) error {
+				if err != nil {
+					monitor.Error(err)
+				}
+				return nil
+			},
+		}
+		orbConfigPath string
+		verbose       bool
+	)
+	cmd := &cobra.Command{
+		Use:   "zitadelctl [flags]",
+		Short: "Interact with your IAM orbs",
+		Long: `zitadelctl launches zitadel and simplifies common tasks such as deploying operators or reading and writing secrets.
+Participate in our community on https://github.com/caos/orbos
+and visit our website at https://caos.ch`,
+		Example: `$ # For being able to use the --gitops flag, you need to create an orbconfig and add an SSH deploy key to your github project 
+$ # Create an ssh key pair
+$ ssh-keygen -b 2048 -t rsa -f ~/.ssh/myorbrepo -q -N ""
+$ # Create the orbconfig
+$ mkdir -p ~/.orb
+$ cat > ~/.orb/myorb << EOF
+> # this is the ssh URL to your git repository
+> url: git@github.com:me/my-orb.git
+> masterkey: "$(openssl rand -base64 21)" # used for encrypting and decrypting secrets
+> # the repokey is used to connect to your git repository
+> repokey: |
+> $(cat ~/.ssh/myorbrepo | sed s/^/\ \ /g)
+> EOF
+$ zitadelctl --gitops -f ~/.orb/myorb [command]
+`,
+	}
+
+	flags := cmd.PersistentFlags()
+	flags.BoolVar(&rv.Gitops, "gitops", false, "Run orbctl in gitops mode. Not specifying this flag is only supported for BOOM and Networking Operator")
+	flags.StringVarP(&orbConfigPath, "orbconfig", "f", "~/.orb/config", "Path to the file containing the orbs git repo URL, deploy key and the master key for encrypting and decrypting secrets")
+	flags.StringVarP(&rv.Kubeconfig, "kubeconfig", "k", "~/.kube/config", "Path to the kubeconfig file to the cluster orbctl should target")
+	flags.BoolVar(&verbose, "verbose", false, "Print debug levelled logs")
+
+	return cmd, func() (*RootValues, error) {
 
 		if verbose {
 			monitor = monitor.Verbose()
 		}
 
-		prunedPath := helpers.PruneHome(orbConfigPath)
-		orbConfig, err := orb.ParseOrbConfig(prunedPath)
-		if err != nil {
-			orbConfig = &orb.Orb{Path: prunedPath}
-			return nil, mntr.Monitor{}, nil, nil, "", nil, err
+		rv.Monitor = monitor
+		rv.Kubeconfig = helpers.PruneHome(rv.Kubeconfig)
+		rv.GitClient = git.New(ctx, monitor, "orbos", "orbos@caos.ch")
+
+		if rv.Gitops {
+			prunedPath := helpers.PruneHome(orbConfigPath)
+			orbConfig, err := orb.ParseOrbConfig(prunedPath)
+			if err != nil {
+				orbConfig = &orb.Orb{Path: prunedPath}
+				return nil, err
+			}
+			rv.OrbConfig = orbConfig
 		}
 
-		ctx := context.Background()
-
-		return ctx, monitor, orbConfig, git.New(ctx, monitor, "orbos", "orbos@caos.ch"), version, func(err error) error {
-			if err != nil {
-				monitor.Error(err)
-			}
-			return nil
-		}, nil
+		return rv, nil
 	}
 }

cmd/zitadelctl/cmds/start.go

@@ -1,81 +1,95 @@
 package cmds
 
 import (
-	"github.com/caos/orbos/pkg/kubernetes"
-	"github.com/caos/zitadel/operator/helpers"
-	"github.com/caos/zitadel/operator/start"
+	"github.com/caos/orbos/pkg/kubernetes/cli"
+
+	"github.com/caos/zitadel/operator/crtlcrd"
+	"github.com/caos/zitadel/operator/crtlgitops"
 	"github.com/spf13/cobra"
 )
 
-func StartOperator(rv RootValues) *cobra.Command {
+func StartOperator(getRv GetRootValues) *cobra.Command {
 	var (
-		kubeconfig string
-		cmd        = &cobra.Command{
+		metricsAddr string
+		cmd         = &cobra.Command{
 			Use:   "operator",
 			Short: "Launch a ZITADEL operator",
 			Long:  "Ensures a desired state of ZITADEL",
 		}
 	)
 	flags := cmd.Flags()
-	flags.StringVar(&kubeconfig, "kubeconfig", "", "Kubeconfig for ZITADEL operator deployment")
+	flags.StringVar(&metricsAddr, "metrics-addr", "", "The address the metric endpoint binds to.")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		_, monitor, orbConfig, _, version, errFunc, err := rv()
+		rv, err := getRv()
 		if err != nil {
 			return err
 		}
 		defer func() {
-			err = errFunc(err)
+			err = rv.ErrFunc(err)
 		}()
 
-		kubeconfig = helpers.PruneHome(kubeconfig)
+		monitor := rv.Monitor
+		orbConfig := rv.OrbConfig
+		version := rv.Version
 
-		k8sClient, err := kubernetes.NewK8sClientWithPath(monitor, kubeconfig)
-		if err != nil {
-			monitor.Error(err)
-			return nil
-		}
+		if rv.Gitops {
+			k8sClient, _, err := cli.Client(monitor, orbConfig, rv.GitClient, rv.Kubeconfig, rv.Gitops)
+			if err != nil {
+				return err
+			}
 
-		if k8sClient.Available() {
-			if err := start.Operator(monitor, orbConfig.Path, k8sClient, &version); err != nil {
-				monitor.Error(err)
-				return nil
+			return crtlgitops.Operator(monitor, orbConfig.Path, k8sClient, &version, rv.Gitops)
+		} else {
+			if err := crtlcrd.Start(monitor, version, metricsAddr, crtlcrd.Zitadel); err != nil {
+				return err
 			}
 		}
+
 		return nil
 	}
 	return cmd
 }
 
-func StartDatabase(rv RootValues) *cobra.Command {
+func StartDatabase(getRv GetRootValues) *cobra.Command {
 	var (
-		kubeconfig string
-		cmd        = &cobra.Command{
+		kubeconfig  string
+		metricsAddr string
+		cmd         = &cobra.Command{
 			Use:   "database",
 			Short: "Launch a database operator",
 			Long:  "Ensures a desired state of the database",
 		}
 	)
 	flags := cmd.Flags()
-	flags.StringVar(&kubeconfig, "kubeconfig", "", "kubeconfig used by zitadel operator")
+	flags.StringVar(&kubeconfig, "kubeconfig", "", "kubeconfig used by database operator")
+	flags.StringVar(&metricsAddr, "metrics-addr", "", "The address the metric endpoint binds to.")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
-		_, monitor, orbConfig, _, version, errFunc, err := rv()
+		rv, err := getRv()
 		if err != nil {
 			return err
 		}
 		defer func() {
-			err = errFunc(err)
+			err = rv.ErrFunc(err)
 		}()
 
-		k8sClient, err := kubernetes.NewK8sClientWithPath(monitor, kubeconfig)
-		if err != nil {
-			return err
+		monitor := rv.Monitor
+		orbConfig := rv.OrbConfig
+		version := rv.Version
+
+		if rv.Gitops {
+			k8sClient, _, err := cli.Client(monitor, orbConfig, rv.GitClient, rv.Kubeconfig, rv.Gitops)
+			if err != nil {
+				return err
+			}
+			return crtlgitops.Database(monitor, orbConfig.Path, k8sClient, &version, rv.Gitops)
+		} else {
+			if err := crtlcrd.Start(monitor, version, metricsAddr, crtlcrd.Database); err != nil {
+				return err
+			}
 		}
 
-		if k8sClient.Available() {
-			return start.Database(monitor, orbConfig.Path, k8sClient, &version)
-		}
 		return nil
 	}
 	return cmd

cmd/zitadelctl/cmds/takeoff.go

@@ -1,23 +1,25 @@
 package cmds
 
 import (
-	orbdb "github.com/caos/zitadel/operator/database/kinds/orb"
-	"io/ioutil"
+	"github.com/caos/orbos/pkg/kubernetes/cli"
+	"github.com/ghodss/yaml"
 
-	"github.com/caos/zitadel/operator/helpers"
+	orbdb "github.com/caos/zitadel/operator/database/kinds/orb"
 
 	"github.com/caos/orbos/mntr"
 	"github.com/caos/orbos/pkg/git"
 	"github.com/caos/orbos/pkg/kubernetes"
 	"github.com/caos/zitadel/operator/api"
-	"github.com/caos/zitadel/operator/zitadel/kinds/orb"
+	orbzit "github.com/caos/zitadel/operator/zitadel/kinds/orb"
 	"github.com/spf13/cobra"
+	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
 )
 
-func TakeoffCommand(rv RootValues) *cobra.Command {
+func TakeoffCommand(getRv GetRootValues) *cobra.Command {
 	var (
-		kubeconfig string
-		cmd        = &cobra.Command{
+		gitOpsZitadel  bool
+		gitOpsDatabase bool
+		cmd            = &cobra.Command{
 			Use:   "takeoff",
 			Short: "Launch a ZITADEL operator on the orb",
 			Long:  "Ensures a desired state of the resources on the orb",
@@ -25,39 +27,57 @@ func TakeoffCommand(rv RootValues) *cobra.Command {
 	)
 
 	flags := cmd.Flags()
-	flags.StringVar(&kubeconfig, "kubeconfig", "~/.kube/config", "Kubeconfig for ZITADEL operator deployment")
+	flags.BoolVar(&gitOpsZitadel, "gitops-zitadel", false, "defines if the zitadel operator should run in gitops mode")
+	flags.BoolVar(&gitOpsDatabase, "gitops-database", false, "defines if the database operator should run in gitops mode")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		_, monitor, orbConfig, gitClient, _, errFunc, err := rv()
+		rv, err := getRv()
 		if err != nil {
 			return err
 		}
 		defer func() {
-			err = errFunc(err)
+			err = rv.ErrFunc(err)
 		}()
-		kubeconfig = helpers.PruneHome(kubeconfig)
 
-		if err := gitClient.Configure(orbConfig.URL, []byte(orbConfig.Repokey)); err != nil {
-			monitor.Error(err)
-			return nil
-		}
+		monitor := rv.Monitor
+		orbConfig := rv.OrbConfig
+		gitClient := rv.GitClient
 
-		if err := gitClient.Clone(); err != nil {
-			monitor.Error(err)
-			return nil
-		}
-
-		value, err := ioutil.ReadFile(kubeconfig)
+		k8sClient, _, err := cli.Client(
+			monitor,
+			orbConfig,
+			gitClient,
+			rv.Kubeconfig,
+			gitOpsZitadel || gitOpsDatabase,
+		)
 		if err != nil {
-			monitor.Error(err)
-			return nil
+			return err
+		}
+
+		if err := kubernetes.EnsureCaosSystemNamespace(monitor, k8sClient); err != nil {
+			monitor.Info("failed to apply common resources into k8s-cluster")
+			return err
+		}
+
+		if gitOpsZitadel || gitOpsDatabase {
+
+			orbConfigBytes, err := yaml.Marshal(orbConfig)
+			if err != nil {
+				return err
+			}
+
+			if err := kubernetes.EnsureOrbconfigSecret(monitor, k8sClient, orbConfigBytes); err != nil {
+				monitor.Info("failed to apply configuration resources into k8s-cluster")
+				return err
+			}
 		}
-		kubeconfigStr := string(value)
 
 		if err := deployOperator(
 			monitor,
 			gitClient,
-			&kubeconfigStr,
+			k8sClient,
+			rv.Version,
+			rv.Gitops || gitOpsZitadel,
 		); err != nil {
 			monitor.Error(err)
 		}
@@ -65,7 +85,9 @@ func TakeoffCommand(rv RootValues) *cobra.Command {
 		if err := deployDatabase(
 			monitor,
 			gitClient,
-			&kubeconfigStr,
+			k8sClient,
+			rv.Version,
+			rv.Gitops || gitOpsDatabase,
 		); err != nil {
 			monitor.Error(err)
 		}
@@ -74,53 +96,85 @@ func TakeoffCommand(rv RootValues) *cobra.Command {
 	return cmd
 }
 
-func deployOperator(monitor mntr.Monitor, gitClient *git.Client, kubeconfig *string) error {
-	found, err := api.ExistsZitadelYml(gitClient)
-	if err != nil {
-		return err
-	}
-	if !found {
-		monitor.Info("No ZITADEL operator deployed as no zitadel.yml present")
-		return nil
-	}
+func deployOperator(monitor mntr.Monitor, gitClient *git.Client, k8sClient kubernetes.ClientInt, version string, gitops bool) error {
+	if gitops {
+		found, err := api.ExistsZitadelYml(gitClient)
+		if err != nil {
+			return err
+		}
+		if found {
 
-	if found {
-		k8sClient := kubernetes.NewK8sClient(monitor, kubeconfig)
-
-		if k8sClient.Available() {
 			desiredTree, err := api.ReadZitadelYml(gitClient)
 			if err != nil {
 				return err
 			}
-			if err := orb.Reconcile(monitor, desiredTree, true)(k8sClient); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-func deployDatabase(monitor mntr.Monitor, gitClient *git.Client, kubeconfig *string) error {
-	found, err := api.ExistsDatabaseYml(gitClient)
-	if err != nil {
-		return err
-	}
-	if found {
-		k8sClient := kubernetes.NewK8sClient(monitor, kubeconfig)
-
-		if k8sClient.Available() {
-			tree, err := api.ReadDatabaseYml(gitClient)
+			desired, err := orbzit.ParseDesiredV0(desiredTree)
 			if err != nil {
 				return err
 			}
+			spec := desired.Spec
+			spec.GitOps = gitops
 
-			if err := orbdb.Reconcile(
-				monitor,
-				tree)(k8sClient); err != nil {
+			// at takeoff the artifacts have to be applied
+			spec.SelfReconciling = true
+			if err := orbzit.Reconcile(monitor, spec)(k8sClient); err != nil {
 				return err
 			}
-		} else {
-			monitor.Info("Failed to connect to k8s")
+		}
+	} else {
+		// at takeoff the artifacts have to be applied
+		spec := &orbzit.Spec{
+			Version:         version,
+			SelfReconciling: true,
+			GitOps:          gitops,
+		}
+
+		if err := orbzit.Reconcile(monitor, spec)(k8sClient); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func deployDatabase(monitor mntr.Monitor, gitClient *git.Client, k8sClient kubernetes.ClientInt, version string, gitops bool) error {
+	if gitops {
+		found, err := api.ExistsDatabaseYml(gitClient)
+		if err != nil {
+			return err
+		}
+		if found {
+			desiredTree, err := api.ReadDatabaseYml(gitClient)
+			if err != nil {
+				return err
+			}
+			desired, err := orbdb.ParseDesiredV0(desiredTree)
+			if err != nil {
+				return err
+			}
+			spec := desired.Spec
+			spec.GitOps = gitops
+
+			// at takeoff the artifacts have to be applied
+			spec.SelfReconciling = true
+			if err := orbdb.Reconcile(
+				monitor,
+				spec)(k8sClient); err != nil {
+				return err
+			}
+		}
+	} else {
+		// at takeoff the artifacts have to be applied
+		spec := &orbdb.Spec{
+			Version:         version,
+			SelfReconciling: true,
+			GitOps:          gitops,
+		}
+
+		if err := orbdb.Reconcile(
+			monitor,
+			spec)(k8sClient); err != nil {
+			return err
 		}
 	}
 	return nil

cmd/zitadelctl/cmds/writesecret.go

@@ -2,15 +2,18 @@ package cmds
 
 import (
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"os"
 
+	"github.com/caos/orbos/pkg/kubernetes/cli"
+
 	"github.com/caos/orbos/pkg/secret"
 	"github.com/caos/zitadel/operator/secrets"
 	"github.com/spf13/cobra"
 )
 
-func WriteSecretCommand(rv RootValues) *cobra.Command {
+func WriteSecretCommand(getRv GetRootValues) *cobra.Command {
 
 	var (
 		value string
@@ -32,43 +35,43 @@ orbctl writesecret mygceprovider.google_application_credentials_value --value "$
 	flags.BoolVar(&stdin, "stdin", false, "Value to encrypt is read from standard input")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-
-		_, monitor, orbConfig, gitClient, _, errFunc, err := rv()
+		rv, err := getRv()
 		if err != nil {
 			return err
 		}
 		defer func() {
-			err = errFunc(err)
+			err = rv.ErrFunc(err)
 		}()
 
+		monitor := rv.Monitor
+		orbConfig := rv.OrbConfig
+		gitClient := rv.GitClient
+
 		s, err := key(value, file, stdin)
 		if err != nil {
 			monitor.Error(err)
 			return nil
 		}
 
-		if err := gitClient.Configure(orbConfig.URL, []byte(orbConfig.Repokey)); err != nil {
-			monitor.Error(err)
-			return nil
-		}
-
-		if err := gitClient.Clone(); err != nil {
-			monitor.Error(err)
-			return nil
-		}
-
 		path := ""
 		if len(args) > 0 {
 			path = args[0]
 		}
 
+		k8sClient, _, err := cli.Client(monitor, orbConfig, gitClient, rv.Kubeconfig, rv.Gitops)
+		if err != nil && !rv.Gitops {
+			return err
+		}
+
 		if err := secret.Write(
 			monitor,
-			gitClient,
+			k8sClient,
 			path,
 			s,
-			secrets.GetAllSecretsFunc(orbConfig),
-			secrets.PushFunc(),
+			"zitadelctl",
+			fmt.Sprintf(rv.Version),
+			secrets.GetAllSecretsFunc(monitor, path != "", rv.Gitops, gitClient, k8sClient, orbConfig),
+			secrets.PushFunc(monitor, rv.Gitops, gitClient, k8sClient),
 		); err != nil {
 			monitor.Error(err)
 		}