Manual component-based installation

export AWS_ACCESS_KEY_ID=<your-access-key-id>
export AWS_SECRET_ACCESS_KEY=<your-secret-access-key>
export AWS_SESSION_TOKEN=<your-session-token>

./bootstrap.sh install-tools --cloud aws

cd iac/aws/cluster/modules/00_backup_bucket

cluster_name                = "<cluster-name>" 
s3_bucket_name              = "<globally-unique-bucket-name>" 
kms_key_alias_name          = "alias/pty-backup-<cluster-name>-key" 
aws_region                  = "<region>" 

tofu init 
tofu plan          # review the role assignments that will be created
tofu apply         # type "yes" when prompted

# Navigate to the bootstrap-scripts directory
cd <package-root>/bootstrap-scripts

# Run the script to sync the backup data to the S3 bucket
./sync-backup-bucket-state-to-s3.sh

cd iac/aws/cluster/modules/01_iam_roles

aws_region            = "<region>"          
eks_cluster_name      = "<cluster-name>"
backup_bucket         = "<s3-bucket-name>"
backup_bucket_kms_arn = "<kms-key-arn>"    

tofu init 
tofu plan          # review the role assignments that will be created
tofu apply         # type "yes" when prompted

aws iam list-roles --query "Roles[?contains(RoleName, 'doc-test')].[RoleName, Arn]" --output table

cd iac/aws/cluster/modules/02_eks_cluster

aws_region          = "<region>"
eks_cluster_name    = "<cluster-name>"
backup_bucket       = "<s3-bucket-name>" 

# --- Networking ---
vpc_id              = "<vpc-id>" 
security_group_name = "<security-group-name>" 
private_subnet_ids  = [
  "<subnet-a>",
  "<subnet-b>"
]

# --- Tagging ---
owner_email = "<owner_email>"

# --- Access Entries (optional) ---
# Add IAM users/roles that need kubectl / tofu access beyond the original installer.
additional_access_entries = [
  # {
  #   principal_arn = "<principal-arn>"
  # },
]

tofu init 
tofu plan          # review the role assignments that will be created
tofu apply         # type "yes" when prompted

# Confirm the cluster is ACTIVE
aws eks describe-cluster --name <cluster-name> --region <region> \
  --query "cluster.{Name:name, Status:status, Version:version, Endpoint:endpoint}" \
  --output table
 
# Verify kubectl can reach the API server
kubectl get nodes          # expected: no nodes yet (node group is Stage 03)
 
# Verify the worker security group exists
aws ec2 describe-security-groups \
  --filters "Name=group-name,Values=<security-group-name>*" \
  --region <region> \
  --query "SecurityGroups[].{Name:GroupName, ID:GroupId}" \
  --output table
 
# Verify VPC CNI and kube-proxy add-ons are ACTIVE
aws eks list-addons --cluster-name <cluster-name> --region <region> --output table

cd iac/aws/cluster/modules/03_node_group

aws_region       = "<region>" 
eks_cluster_name = "<cluster-name>" 
backup_bucket    = "<s3-bucket-name>" 

# --- System Node Group ---
node_group_name    = "<node-group-name>" 
private_subnet_ids = [
  "<subnet-a>",
  "<subnet-b>"
]
architecture            = "<amd64/arm64>"
node_group_desired_size = 2      
node_group_max_size     = 2
node_group_min_size     = 1

tofu init 
tofu plan          # review the role assignments that will be created
tofu apply         # type "yes" when prompted

aws eks describe-nodegroup --cluster-name <cluster-name> --nodegroup-name <node-group-name> --query "nodegroup.status"
kubectl get nodes

cd iac/aws/cluster/modules/04_eks_addons

aws_region       = "<region>"
eks_cluster_name = "<cluster-name>"
backup_bucket    = "<s3-bucket-name>" # 

# --- Upgrade mode only ---
# Set to "~/.kube/config" when upgrading an existing cluster;
# leave empty ("") for a fresh install.
kubeconfig_path  = ""

tofu init 
tofu plan          # review the role assignments that will be created
tofu apply         # type "yes" when prompted

# List all EKS add-ons and confirm they are ACTIVE
aws eks list-addons --cluster-name <cluster-name> --region <region> --output table
 
# Check add-on health details
for addon in coredns metrics-server aws-ebs-csi-driver snapshot-controller eks-pod-identity-agent; do
  echo "--- $addon ---"
  aws eks describe-addon --cluster-name <cluster-name> --addon-name $addon --region <region> \
    --query "addon.{Name:addonName, Status:status, Version:addonVersion}" --output table
done
 
# Verify the default storage class exists
kubectl get storageclass
 
# Confirm CoreDNS and Metrics Server pods are running
kubectl get pods -n kube-system -l k8s-app=kube-dns
kubectl get pods -n kube-system -l k8s-app=metrics-server

cd iac/aws/cluster/modules/05_helm_releases

kubectl get nodes -o jsonpath='{.items[0].status.nodeInfo.osImage}'; echo

aws_region            = "<region>"
eks_cluster_name      = "<cluster-name>"
backup_bucket         = "<s3-bucket-name>" 
backup_bucket_kms_arn = "<kms-key-arn>"
architecture          = "<amd64/arm64>"
node_os               = "<node-os>"

# --- Registry ---
global_image_reg = "<registry-endpoint>"
harbor_secret    = "harbor-secret" 

# --- Ingress ---
ingress_fqdn = "<fqdn>" 

# --- Owner ---
owner_email = "<owner-email>" 

# --- Networking (used to derive internal proxy CIDRs) ---
vpc_cidr_block = "<cidr>" 

# --- Envoy Gateway (LoadBalancer subnet discovery) ---
# Populated automatically by bootstrap.sh from stage 02 state.
private_subnet_ids = []

# --- Restore ---
restore              = false                               
backup_name          = "authnz-postgresql-schedule-backup" 
insight_backup_name  = ""                                  

# --- Upgrade mode only ---
# Set to "~/.kube/config" when upgrading an existing cluster;
# leave empty ("") for a fresh install.
kubeconfig_path = ""
is_upgrade      = false
skip_validations = false

export TF_VAR_username="<registry-username>"
export TF_VAR_password="<registry-password>"

tofu init 
tofu plan          # review the role assignments that will be created
tofu apply         # type "yes" when prompted

# Confirm all Helm releases are deployed
helm list -A
 
# Verify Karpenter controller is running
kubectl get pods -n karpenter
 
# Verify Karpenter NodePool and EC2NodeClass exist
kubectl get nodepools
kubectl get ec2nodeclasses
 
# Verify Velero is running
kubectl get pods -n pty-backup-recovery
 
# Verify PPC platform pods
kubectl get pods -A 
 
# Verify Insight pods
kubectl get pods -n pty-insight
 
# Verify Envoy Gateway
kubectl get pods -n api-gateway
 
# Check all pods across the cluster are healthy
kubectl get pods -A --field-selector=status.phase!=Running,status.phase!=Succeeded

kubectl get nodes
kubectl get pods -A