bex: Skill for Claude Code

Bring up the local mock of the Hetzner substrate and deploy the bex operator into it.

If $ARGUMENTS is scale N: just run bash scripts/mock-cluster.sh scale N, then show kubectl get nodes (with KUBECONFIG=infra/local/bex.kubeconfig) and stop.

Otherwise, run the full bring-up:

1. bash scripts/mock-cluster.sh — kind infra cluster + Cluster API + CAPD app cluster, plus the app-cluster baseline the operator needs: Calico, coredns/calico-kube-controllers control-plane pins, local-path default StorageClass, cert-manager (prod's pinned version; make deploy's webhook cert requires it). This can take several minutes; it writes the app-cluster kubeconfig to infra/local/bex.kubeconfig.
2. Use that kubeconfig for every following command: export KUBECONFIG=$PWD/infra/local/bex.kubeconfig (or --kubeconfig). Never print its contents.
3. Build and load the operator image (CAPD nodes can't pull local-only images):
   • ( cd lego/operator && make docker-build IMG=bex-operator:dev )
   • docker save bex-operator:dev -o /tmp/bex-op.tar
   • For each node (strip the node/ prefix — kubectl get nodes -o name returns node/<name> but docker cp/docker exec need the bare container name):

     for n in $(kubectl get nodes -o name | cut -d/ -f2); do
       docker cp /tmp/bex-op.tar "$n":/op.tar && docker exec "$n" ctr -n k8s.io images import /op.tar
     done
     

4. ( cd lego/operator && make deploy IMG=bex-operator:dev ) — deploys to ns bex-system with BEX_RUNTIME=kubernetes. The bex-ssh-gateway IngressRouteTCP fails without Traefik CRDs — expected and harmless on the mock; everything else applies. Then kubectl apply -f deploy/gitops/base/operator-apps-rbac.yaml — the apps-namespace bex-operator-apps Role/RoleBinding is Argo-managed in prod and absent from the operator's kustomize config; without it the manager crashloops on "failed to wait for … caches to sync" (its namespace-scoped Secret/Job watches in default are forbidden; w1/043).
5. Local-CAPD-only fixes (re-apply all three after every make deploy — it reverts them; w1/043):
   • Label the control-plane node into the platform pool (the manifest's nodeSelector is bex.co/pool=platform, and the operator must sit on the control-plane node because OrbStack/Calico can't route cross-node pod→apiserver; see docs/ADR004-app-deployment.md): kubectl label node <control-plane-node> bex.co/pool=platform --overwrite
   • Pin the operator to the control-plane node:

     kubectl -n bex-system patch deploy bex-controller-manager --type merge -p \
      '{"spec":{"template":{"spec":{"nodeSelector":{"node-role.kubernetes.io/control-plane":""},
       "tolerations":[{"key":"node-role.kubernetes.io/control-plane","effect":"NoSchedule"}]}}}}'
     

   • The manifest sets imagePullPolicy: Always, which can never be satisfied by the ctr-imported local image (ErrImagePull) — override it:

     kubectl -n bex-system patch deploy bex-controller-manager --type strategic -p \
      '{"spec":{"template":{"spec":{"containers":[{"name":"manager","imagePullPolicy":"IfNotPresent"}]}}}}'
     

6. kubectl -n bex-system rollout status deploy/bex-controller-manager — wait for Ready.

Finish by reporting: node list, operator pod status, and the one-liners to deploy an App (/deploy-app) and to scale machines (/mock-cluster scale N).