plexsphere

Appearance

Seed tenancy Domains ​

plexsphere-bootstrap is the one-shot binary that seeds the initial Domain aggregates and, optionally, their IdPBinding aggregates from an operator-supplied manifest. It is not a plexctl command — it runs as a Kubernetes Job (or a local binary) ahead of first use.

Prerequisites ​

  • A reachable Postgres, with the migrate Job already applied.
  • The plexsphere-bootstrap:dev image (side-loaded by the kind dev stack) or a local build: go build -o ./bin/plexsphere-bootstrap ./cmd/plexsphere-bootstrap.

Steps ​

Author the manifest ​

yaml
domains:
  - slug: acme-corp
    display_name: Acme Corp
    mesh_cidr: 10.64.0.0/12

idp_bindings:
  - domain_slug: acme-corp
    issuer: https://dex.example.com
    client_id: plexsphere
    client_secret_ref: secret://dev/plexsphere-dex-public

IdP bindings (idp_bindings:) ​

The optional top-level idp_bindings: block binds each seeded Domain to an OIDC IdP at seed time. On the dev overlay the dev-only secret reference is the sentinel secret://dev/plexsphere-dex-public.

IdPBinding seeding (post-manifest). Bindings not in the manifest are created afterwards via plexctl domain-idp create — see Manage IdP bindings.

Run the binary ​

shell
plexsphere-bootstrap --manifest ./bootstrap.yaml --database-url "${DATABASE_URL}"
# domain-created slug=acme-corp id=… mesh_cidr=10.64.0.0/12
# idp-binding-created domain_slug=acme-corp issuer=https://dex.example.com binding_id=…
# seed-complete domains_created=1 domains_skipped=0
# binding-seed-complete bindings_created=1 bindings_skipped=0

In-cluster this is the bootstrap Job; it is idempotent and safe to re-run — a re-run reports domain-skipped … reason=already-exists instead of domain-created.

Read the seeded UUIDs ​

The seeded Domain and IdP-binding UUIDs live in Postgres; read them directly when you need them, for example to drive plexctl login. On the kind dev stack the bootstrap Job seeds acme-corp, beta-llc, and gamma-coop; read their UUIDs from the dev Postgres StatefulSet:

shell
kubectl exec statefulset/postgres -- \
  env PGPASSWORD=plexsphere psql -U plexsphere -d plexsphere -tAc \
  "SELECT d.slug, d.id, b.id
     FROM plexsphere.domains d
     JOIN plexsphere.idp_bindings b
       ON b.domain_id = d.id AND b.status = 'active'
    ORDER BY d.slug"
# acme-corp|0192f2f6-…|0192f2f7-…
# beta-llc|0192f2f8-…|0192f2f9-…
# gamma-coop|0192f2fa-…|0192f2fb-…

The three columns are the Domain slug, the domain_id, and the active idp_binding_id.

Verification ​

shell
psql "${DATABASE_URL}" -c "SELECT slug FROM domains ORDER BY slug;"
#    slug
# -----------
#  acme-corp
# (1 row)

See also ​