dev: add tiltfile for local development

[fmuyassarov]

This is initial version which is expected to iterate over to have more customization points such as, disabling auto update or continuing on top of metal3-dev-env prepared environment. Right now, it doesn't have and dependency nor connection to the way that metal3-dev-env prepares the dev environment but I plan to make it easier to integrate it in case developers want to continue modifying and testing their metal3 controllers on the environment prepared by metal3-dev-env (optionally).

[metal3-io-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign smoshiur1237 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[fmuyassarov]

/cc @Rozzii @Sunnatillo @lentzi90 @adilGhaffarDev

[tuminoid]

Default images run as non-root and with other security hardenings, which should prevent Tilt from updating the manager binaries when they change. I don't see that patched here, is it now handled differently? Ref: https://github.com/metal3-io/cluster-api-provider-metal3/blob/11189599fd7b84280e8c1ce0f56d44154cb86d80/Tiltfile#L4

[fmuyassarov]

Default images run as non-root and with other security hardenings, which should prevent Tilt from updating the manager binaries when they change. I don't see that patched here, is it now handled differently? Ref: https://github.com/metal3-io/cluster-api-provider-metal3/blob/11189599fd7b84280e8c1ce0f56d44154cb86d80/Tiltfile#L4

I'm not sure I understand what you mean, can you elaborate ?
Have you tested this? I didn't have any issues with live update across all repos.

[tuminoid]

Default images run as non-root and with other security hardenings, which should prevent Tilt from updating the manager binaries when they change. I don't see that patched here, is it now handled differently? Ref: https://github.com/metal3-io/cluster-api-provider-metal3/blob/11189599fd7b84280e8c1ce0f56d44154cb86d80/Tiltfile#L4

I'm not sure I understand what you mean, can you elaborate ? Have you tested this? I didn't have any issues with live update across all repos.

No, I did not test this, just noticed its different on this part. If you check the line referenced, it calls remove_sec_ctx.py which removes the securityContext from the yaml, to allow Tilt to update the manager binary on the running containers. It could be Tilt has been updated to workaround this then? Or is it deployed some other more permissive way?

[fmuyassarov]

Default images run as non-root and with other security hardenings, which should prevent Tilt from updating the manager binaries when they change. I don't see that patched here, is it now handled differently? Ref: https://github.com/metal3-io/cluster-api-provider-metal3/blob/11189599fd7b84280e8c1ce0f56d44154cb86d80/Tiltfile#L4

I'm not sure I understand what you mean, can you elaborate ? Have you tested this? I didn't have any issues with live update across all repos.

No, I did not test this, just noticed its different on this part. If you check the line referenced, it calls remove_sec_ctx.py which removes the securityContext from the yaml, to allow Tilt to update the manager binary on the running containers. It could be Tilt has been updated to workaround this then? Or is it deployed some other more permissive way?

Not sure to be honest. I'm trying to understand why would Tilt not be able to deploy k8s objects if they have some securityContext settings.

[tuminoid]

Default images run as non-root and with other security hardenings, which should prevent Tilt from updating the manager binaries when they change. I don't see that patched here, is it now handled differently? Ref: https://github.com/metal3-io/cluster-api-provider-metal3/blob/11189599fd7b84280e8c1ce0f56d44154cb86d80/Tiltfile#L4

I'm not sure I understand what you mean, can you elaborate ? Have you tested this? I didn't have any issues with live update across all repos.

No, I did not test this, just noticed its different on this part. If you check the line referenced, it calls remove_sec_ctx.py which removes the securityContext from the yaml, to allow Tilt to update the manager binary on the running containers. It could be Tilt has been updated to workaround this then? Or is it deployed some other more permissive way?

Not sure to be honest. I'm trying to understand why would Tilt not be able to deploy k8s objects if they have some securityContext settings.

SecurityContext might have readOnlyRoot: true or user: nobody and the manager binary is root owned etc.

[fmuyassarov]

Default images run as non-root and with other security hardenings, which should prevent Tilt from updating the manager binaries when they change. I don't see that patched here, is it now handled differently? Ref: https://github.com/metal3-io/cluster-api-provider-metal3/blob/11189599fd7b84280e8c1ce0f56d44154cb86d80/Tiltfile#L4

I'm not sure I understand what you mean, can you elaborate ? Have you tested this? I didn't have any issues with live update across all repos.

No, I did not test this, just noticed its different on this part. If you check the line referenced, it calls remove_sec_ctx.py which removes the securityContext from the yaml, to allow Tilt to update the manager binary on the running containers. It could be Tilt has been updated to workaround this then? Or is it deployed some other more permissive way?

Not sure to be honest. I'm trying to understand why would Tilt not be able to deploy k8s objects if they have some securityContext settings.

SecurityContext might have readOnlyRoot: true or user: nobody and the manager binary is root owned etc.

As discussed offline, let's leave this kind of build process optimization for later as follow up.

[tuminoid]

Default images run as non-root and with other security hardenings, which should prevent Tilt from updating the manager binaries when they change. I don't see that patched here, is it now handled differently? Ref: https://github.com/metal3-io/cluster-api-provider-metal3/blob/11189599fd7b84280e8c1ce0f56d44154cb86d80/Tiltfile#L4

I'm not sure I understand what you mean, can you elaborate ? Have you tested this? I didn't have any issues with live update across all repos.

No, I did not test this, just noticed its different on this part. If you check the line referenced, it calls remove_sec_ctx.py which removes the securityContext from the yaml, to allow Tilt to update the manager binary on the running containers. It could be Tilt has been updated to workaround this then? Or is it deployed some other more permissive way?

Not sure to be honest. I'm trying to understand why would Tilt not be able to deploy k8s objects if they have some securityContext settings.

SecurityContext might have readOnlyRoot: true or user: nobody and the manager binary is root owned etc.

As discussed offline, let's leave this kind of build process optimization for later as follow up.

And just for completeness sake, this is not an issue in the current form of PR as it does full container rebuild instead of binary replacement.

This support needs to be brought back later as it is making development cycle faster by avoiding full redeployment. We also have some other custom parts (like BMH creation button) that need to back added later.

[fmuyassarov]

For the docs, I wonder whether it’s better to add the details in the root markdown instead of in a separate document, which may never be read or may be easily overlooked.

[lentzi90]

I think it is good with a separate doc, but you may want to link to it from the main README.md.

A couple of things out of sync between code and docs below. Otherwise this looks ok to me. I have not tested it though.

[lentzi90]

Suggested change

	- Deploy cert-manager (by default v1.3.1)
	- Deploy cert-manager (by default v1.19.1)

[lentzi90]

Ah the Nordix comment still shows as resolved. Commenting here for visibility.

The Tiltfile now uses metal3-io but the doc still has Nordix in one place.