GREEN PACKAGE SKILL · KUBEADM · DIGITALOCEAN · FLUX

k8s

Provision a two-node kubeadm Kubernetes cluster with private node networking, constrained administrative access, DigitalOcean CCM, and Flux GitOps.

Two nodes
kubeadm
Private VPC
Acceptance tested

#Introduction

The K8s Package Skill creates one control plane and one worker in a deployment-owned DigitalOcean VPC. It installs containerd, kubeadm, Flannel, DigitalOcean’s cloud controller, and Flux, then verifies a GitOps-managed HTTPS application.

Safe first stepsbuild renders local files and create --dry-run prints the workflow without contacting providers. Review both before approving a real operation.

#Quick start

npx skills add getcolors/k8s
cp .agents/skills/package-k8s-green/green ./green
./green build
./green create --dry-run
# after approval:
./green create
./green kubectl get nodes

#Workflow architecture

create  start ─ infrastructure ─ ansible-local ─ ansible-remote ─ acceptance

delete  start ─ load state ─ remove Kubernetes LoadBalancer ─ cleanup ─ infrastructure

Delete removes the Kubernetes-managed load balancer before destroying the VPC. The infrastructure template is package-owned and fixed to one control plane and one worker.

#Desired state

Area	Required choices
Versions	Kubernetes, Flannel, Flux, and DigitalOcean CCM exact releases
Cluster	Pod and service CIDRs; one control plane and one worker
Compute	Region, sizes, Ubuntu image, existing SSH-key fingerprint
Network	Deployment VPC CIDR and operator source CIDRs
GitOps	Public HTTPS repository, branch, and relative path
DNS/TLS	Host, Cloudflare zone, owner ID, ACME environment

Validation reports all errors together. See the configuration reference.

#Networking

Node-to-node traffic stays on the private VPC. Flannel binds private eth1. Public SSH and TCP 6443 admit only configured operator CIDRs. DigitalOcean CCM creates the load balancer requested by ingress-nginx while backend traffic remains private.

#Bootstrap and acceptance

Flux reconciles the configured public source. Optional provider tokens are streamed into Kubernetes Secrets with Ansible no_log. Acceptance checks cluster readiness, GitOps reconciliation, DNS, TLS, and the HTTPS application before create succeeds.

#Command reference

Command	Effect
`./green build`	Render infrastructure, playbooks, and acceptance script
`./green create --dry-run`	Print workflow only
`./green create`	Provision, bootstrap, and verify
`./green kubectl …`	Use root-owned admin kubeconfig over SSH
`./green delete`	Remove load balancer, then guarded infrastructure

#State and output

.colors/<profile>/
├── k8s-infrastructure/
├── k8s-ansible-local/
├── k8s-ansible-remote/
└── k8s-acceptance/

Remote state is <profile>/k8s-infrastructure.tfstate. No kubeconfig or token is rendered.

#Credentials and safety

DigitalOcean: COLORS_PAR_DO_TOKEN.
Cloudflare and remote backend credentials use matching COLORS_PAR_* names.
Never export COLORS_PAR_PROFILE.
Keep compute-prevent-destroy: true.
Do not widen SSH or API CIDRs casually.

#Recovery and troubleshooting

Repeated create converges an intact cluster. If nodes are replaced, retain OpenTofu state and rerun create. If the API is damaged, restore SSH/API access before deletion so Kubernetes can remove its load-balancer finalizer; do not destroy the VPC around a remaining deployment-owned load balancer.