ONE Discovery, Inc.

LightningIQ Deployment Scripts

This repository hosts the deployment scripts for LightningIQ, served from deploy.lightningiq.io and — for restricted-network customers — from install.lightningiq.io (the Nexus mirror).

Script	Purpose
`run`	Deploy or upgrade LightningIQ v1.7+ on a Kubernetes cluster
`pre-flight-check`	Dry-run of `run -d full`: probes SSH, sudo, DNS, registry reachability per host

Prerequisites
run — LightningIQ v1.7+ Deployer
Environment Variables Reference
Troubleshooting

Prerequisites

All scripts require the following tools installed and available in $PATH:

Tool	Purpose
`kubectl`	Kubernetes cluster management
`helm`	Kubernetes package manager (used for operator deployment)
`aws` CLI	ECR registry authentication
`curl`	Fetching remote imports and GitHub files
`git`	Cloning the deployer repository

For Kubernetes-level deployments (k/k8s, f/full), Ansible is used under the hood via the k8s-deployer child script. The req action installs all required tools (kubectl, helm, Ansible, and others) via ASDF.

`run` — LightningIQ v1.7+ Deployer

Overview

The run script is the primary entry point for deploying and managing LightningIQ v1.7+. It can be run directly from a local clone or piped from the remote host.

Usage

Remote (recommended):

export GH_TOKEN=ghp_xxx
export SSH_PASSWORD=<ssh_password>
export VAULT_PASSWORD=<vault_password>
export ENV_REPO_NAME=<client-repo-name>

curl -s https://deploy.lightningiq.io/run | bash -s -- \
  -r "v1.7.145" \
  -e <environment_name> \
  -d <action>

With all arguments inline:

curl -s https://deploy.lightningiq.io/run | bash -s -- \
  -r "v1.7.145" \
  -e prod-usw2 \
  -er client-repo \
  -d k8s \
  -t $GH_TOKEN \
  -s "<ssh_password>" \
  -vp "<vault_password>"

Local (for development/debugging):

export USE_LOCAL_IMPORTS=true
./run -r "v1.7.145" -e qa -er client-repo -d sync

Arguments

Flag	Long form	Required	Description
`-r`	`--release`	Yes	Release version tag, e.g. `v1.7.145`
`-e`	`--env`	Yes	Environment name, e.g. `prod-usw2` (or `ENV_NAME` env var)
`-er`	`--env-repo`	Yes	Client environment repository name (or `ENV_REPO_NAME` env var)
`-d`	`--deploy`	Yes	Action to perform (see Actions)
`-t`	`--token`	No*	GitHub token (or `GH_TOKEN` / `GITHUB_TOKEN` env var)
`-s`	`--ssh-password`	No*	SSH password for Ansible (or `SSH_PASSWORD` env var)
`-vp`	`--vault-password`	No*	Ansible vault password (or `VAULT_PASSWORD` env var)
`-v`	`--verbose`	No	Enable verbose mode, show Ansible task progress

* If not provided as a flag or environment variable, the script will interactively prompt for the value.

Actions

Action	Short	Description
`req`	`r`	Check and install prerequisites (runs Ansible req playbook)
`k8s`	`k`	Deploy the Kubernetes cluster (runs `req` first)
`sync`	`s`	Deploy/update LightningIQ applications via Helm (runs `req` first)
`full`	`f`	Full deployment: `req` → `k8s` → `sync`
`upgrade`	`u`	Upgrade the Kubernetes cluster version (requires `UPGRADE_VERSION`)

How It Works

Imports variables.sh and functions.sh from deploy.lightningiq.io (or locally).
Parses and validates arguments. Prompts interactively for any missing credentials.
Sources update_variables.sh to export runtime variables (inventory paths, ECR registry, etc.).
Clones OneDiscovery/k8s-deployer from the main branch into /tmp/k8s-deployer.
Clones the client environment repository into /tmp/<ENV_REPO_NAME>.
Detects ansible_become_method from the inventory’s connection_settings.yml to set SUDO.
Executes the selected action by delegating to the child script /tmp/k8s-deployer/run.sh.

The `sync` Action — Helm Deployment Detail

The sync (and full) action runs start_apps_deployment, which:

Prompts for AWS credentials if not already configured.
Authenticates with ECR: aws ecr get-login-password | helm registry login.
Reads values from /tmp/<ENV_REPO_NAME>/deploy/<environment>/values.yml.
Fresh install path: If lightningiq-operator Helm release does not exist, bootstraps the operator with cr.enabled=false first (registers the CRD), waits for the operator to be ready, then applies the full values with cr.spec.keycloak.initialAdminPassword=oned-pass.
Upgrade path: If the release already exists, runs helm upgrade --install with the environment values directly.

The `upgrade` Action

Requires UPGRADE_VERSION to be set; the script interactively prompts if it is not. Delegates to the child script’s Ansible playbook with -t upgrade, auto-detecting the cluster distribution from the env repo inventory (ansible/inventories/<env>/group_vars/all/cluster_settings.yml → cluster_distro, default kubeadm):

kubeadm — UPGRADE_VERSION is a Kubernetes minor (e.g. 1.35); passes -e common_k8s_ver=<version> (apt + kubeadm upgrade).
k0s — UPGRADE_VERSION is a full k0s version (e.g. v1.34.1+k0s.0); passes -e k0s_version=<version> (binary swap + restart, LG-1817). In single-domain mode (REGISTRY = the mirror) it also sets -e k0s_binary_base_url=https://<mirror>/binaries/k0s and fetches the published .sha256 sidecar into -e k0s_binary_sha256=<digest>, so the binary is served and verified from the mirror with no GitHub egress. Publish versions with scripts/nexus/publish-k0s.sh (k8s-deployer); see its ansible/K0S_UPGRADE.md.

Logs

Logs are written to /tmp/onediscovery-init-logs/init.log. The log directory is recreated fresh on each run.

Environment Variables Reference

Variable	Used By	Description
`GH_TOKEN` / `GITHUB_TOKEN`	All scripts	GitHub personal access token
`ENV_NAME`	`run`	Environment name (alternative to `-e` flag)
`ENV_REPO_NAME`	`run`	Client environment repo name
`SSH_PASSWORD`	`run`	SSH password for Ansible become
`VAULT_PASSWORD`	`run`	Ansible vault password
`UPGRADE_VERSION`	`run`	Target Kubernetes version for `upgrade` action
`SUDO`	`run`	Override become method (default: `sudo`)
`USE_LOCAL_IMPORTS`	All scripts	Set to `true` to source `imports/` from local files instead of `deploy.lightningiq.io`
`SHOW_PROGRESS`	`run`	Set to `true` to show Ansible task progress (same as `-v`)
`REGISTRY`	`run`	Registry host for the operator chart + images. Default ECR (DDC/internal). Set to `install.lightningiq.io` for customer/external deploys via the Nexus mirror — the operator image source cascades `imageRegistry`+`liqVersion`, so all LIQ images follow (LG-1813).
`NEXUS_ROBOT_PASS`	`run`	Nexus `liq-pull` robot password. Required when `REGISTRY` != ECR (used for `helm registry login` to the mirror).
`NEXUS_ROBOT_USER`	`run`	Nexus robot username (default: `liq-pull`).

Customer/external deploy (Nexus mirror): set REGISTRY=install.lightningiq.io and NEXUS_ROBOT_PASS=…. The deploy logs into Nexus, pulls the operator chart + images from the mirror, and the operator cascades the registry/version to every LIQ service image. DDC/internal deploys omit these and keep using ECR directly. (Non-LIQ images — prereq operators, operands, Keycloak, kubectl hook — flow through the mirror via the node containerd config; see LG-1816.)

Troubleshooting

`GH_TOKEN` / credentials not found

If any required credential is missing, the deployer scripts will prompt interactively via /dev/tty. Alternatively, set the corresponding environment variable before running.

`kubectl context` wrong cluster

Ensure the correct context is active before running:

kubectl config use-context <cluster-name>
kubectl config current-context

Operator or CR not becoming Ready

Check the operator and CR status:

kubectl -n lightning-iq get liq liq -o yaml
kubectl -n lightning-iq get pods
kubectl -n lightning-iq logs deployment/lightning-iq-operator

AWS ECR authentication failure

Ensure your AWS credentials are valid and have ecr:GetAuthorizationToken and ecr:BatchGetImage permissions for the 060147281721.dkr.ecr.us-east-1.amazonaws.com registry.

Local development with `USE_LOCAL_IMPORTS=true`

This bypasses the remote fetch of imports/ files and uses the local copies in ./imports/. Useful for testing changes to import files without publishing them:

export USE_LOCAL_IMPORTS=true
./run -r "v1.7.145" -e qa -er client-repo -d sync