Files
harmony/examples
johnride 27accb399e
Some checks failed
Run Check Script / check (push) Failing after 2m9s
Build and push harmony-fleet-operator image / build_and_push (push) Successful in 2m2s
Compile and package harmony_composer / package_harmony_composer (push) Failing after 2m0s
Merge pull request 'feat(fleet): IoT walking skeleton + deploy-architecture refactor' (#264) from feat/iot-walking-skeleton into master
Large merge: 209 commits, +47k/-5k across 428 files. Five clusters
of work, plus a deliberate behavior change and a known-deferred
backlog spelled out below.
1. IoT walking skeleton — harmony-reconciler-contracts crate,
   harmony-fleet-operator (Deployment CRD → NATS KV), harmony-fleet-
   agent reconciling PodmanV0Score into containers, K8sBareTopology,
   maud+htmx operator frontend, request/reply commands over NATS.
2. NATS auth callout + from-scratch nats/jwt crate (algorithm,
   claims, builders, xkey). nats/callout maps Zitadel roles to
   NATS permissions; harmony-fleet-auth holds the shared credential
   plumbing.
3. Zitadel deepening — setup.rs rewritten (cross-org admin,
   persisted admin password, device-code OIDC, OKD-compat values).
   New harmony_zitadel_auth crate (axum login flow, JWKS, sessions).
   Agent gets a JWT-bearer credential source.
4. Deploy-architecture refactor per ADR-023 — Scores everywhere,
   new harmony-fleet-deploy crate, harmony-fleet-e2e harness
   covering Pod target plus VM target (aarch64 production +
   x86_64 fast iteration). First Score companion lands:
   AgentObservation (ADR-023 P7).
5. Device enrollment via Zitadel SSO + aarch64 KVM support (AAVMF
   firmware, per-VM NVRAM, TCG perf overrides), IotDeviceSetupScore
   /FleetDeviceSetupScore SSH apply, fleet-sso-login example.
Behavior change worth flagging in this merge:
  harmony_secret now panics on an unknown SECRET_STORE value
  instead of silently defaulting to Infisical. No in-tree caller
  hits this; a typo in the env var is now loud rather than
  mysterious.
Deferred (not merge blockers — file as issues post-merge):
- CI is red on master because hub.nationtech.io/harmony/
  harmony_composer:latest is missing libvirt-dev + pkg-config,
  which `cargo check --all-features` requires once harmony's `kvm`
  feature is unified. Local `build/check.sh` is green. Fix is a
  two-line Dockerfile edit + rebuild of the composer image; top
  priority post-merge so master goes green again.
- Smoke-test contract (ADR-023 P4) — the principle is locked but
  the trait/struct shape is open. Each Score implements its own
  readiness today; harmony-fleet-e2e has `wait_until_ready` as a
  per-test stand-in.
- Rust equivalents for smoke-a1.sh / smoke-a4.sh (smoke-a3* are
  superseded by the new VM e2e tests).
- Five #[ignore]'d tests in examples/fleet_e2e_demo and nats/
  integration-test-callout — waiting on a CI runner with libvirt
  + k3d + podman.
- ADR-024 (capability decomposition) — kept as draft under
  docs/adr/drafts/024- pending more conviction.
2026-05-22 22:16:16 +00:00
..
2026-05-11 16:48:52 -04:00
2026-05-11 16:48:52 -04:00
2026-05-04 09:03:35 -04:00
2026-05-11 16:48:52 -04:00
2026-05-11 16:48:52 -04:00
2026-05-11 16:48:52 -04:00
2026-01-09 17:30:51 -05:00
2026-05-11 16:48:52 -04:00
2026-04-21 16:03:42 -04:00
2026-05-11 16:48:52 -04:00

Examples

This directory contains runnable examples demonstrating Harmony's capabilities. Each example is a self-contained program that can be run with cargo run -p example-<name>.

Quick Reference

Example Description Local K3D Existing Cluster Hardware Needed
postgresql Deploy a PostgreSQL cluster
ntfy Deploy ntfy notification server
tenant Create a multi-tenant namespace
cert_manager Provision TLS certificates
node_health Check Kubernetes node health
monitoring Deploy Prometheus alerting
monitoring_with_tenant Monitoring + tenant isolation
operatorhub_catalog Install OperatorHub catalog
validate_ceph_cluster_health Verify Ceph cluster health Rook/Ceph
remove_rook_osd Remove a Rook OSD Rook/Ceph
brocade_snmp_server Configure Brocade switch SNMP Brocade switch
opnsense_node_exporter Node exporter on OPNsense OPNsense firewall
opnsense_vm_integration Full OPNsense firewall automation (11 Scores) KVM/libvirt
opnsense_pair_integration OPNsense HA pair with CARP failover KVM/libvirt
okd_pxe PXE boot configuration for OKD
okd_installation Full OKD bare-metal install
okd_cluster_alerts OKD cluster monitoring alerts OKD cluster
multisite_postgres Multi-site PostgreSQL failover Multi-cluster
nats Deploy NATS messaging Multi-cluster
nats-supercluster NATS supercluster across sites Multi-cluster
lamp LAMP stack deployment
openbao Deploy OpenBao vault
zitadel Deploy Zitadel identity provider
try_rust_webapp Rust webapp with packaging Submodule
rust Rust webapp with full monitoring
rhob_application_monitoring RHOB monitoring setup
sttest Full OKD stack test
application_monitoring_with_tenant App monitoring + tenant OKD cluster
kube-rs Direct kube-rs client usage
k8s_drain_node Drain a Kubernetes node
k8s_write_file_on_node Write files to K8s nodes
harmony_inventory_builder Discover hosts via subnet scan
cli CLI tool with inventory discovery
tui Terminal UI demonstration

Status Legend

Symbol Meaning
Works out-of-the-box
Not applicable or requires specific setup

By Category

Data Services

  • postgresql — Deploy a PostgreSQL cluster via CloudNativePG
  • multisite_postgres — Multi-site PostgreSQL with failover
  • public_postgres — Public-facing PostgreSQL (⚠️ uses NationTech DNS)

Kubernetes Utilities

  • node_health — Check node health in a cluster
  • k8s_drain_node — Drain and reboot a node
  • k8s_write_file_on_node — Write files to nodes
  • validate_ceph_cluster_health — Verify Ceph/Rook cluster health
  • remove_rook_osd — Remove an OSD from Rook/Ceph
  • kube-rs — Direct Kubernetes client usage demo

Monitoring & Alerting

  • monitoring — Deploy Prometheus alerting with Discord webhooks
  • monitoring_with_tenant — Monitoring with tenant isolation
  • ntfy — Deploy ntfy notification server
  • okd_cluster_alerts — OKD-specific cluster alerts

Application Deployment

  • try_rust_webapp — Deploy a Rust webapp with packaging (⚠️ requires tryrust.org submodule)
  • rust — Rust webapp with full monitoring features
  • rhob_application_monitoring — Red Hat Observability Stack monitoring
  • lamp — LAMP stack deployment (⚠️ uses NationTech DNS)
  • application_monitoring_with_tenant — App monitoring with tenant isolation

Infrastructure & Bare Metal

  • opnsense_vm_integrationRecommended demo. Boot an OPNsense VM and configure it with 11 Scores (load balancer, DHCP, TFTP, VLANs, firewall rules, NAT, VIPs, LAGG). Fully automated, requires only KVM. See the detailed guide.
  • opnsense_pair_integration — Boot two OPNsense VMs and configure a CARP HA firewall pair with FirewallPairTopology and CarpVipScore. Demonstrates NIC link control for sequential bootstrap.
  • okd_installation — Full OKD cluster from scratch
  • okd_pxe — PXE boot configuration for OKD
  • sttest — Full OKD stack test with specific hardware
  • brocade_snmp_server — Configure Brocade switch via SNMP
  • opnsense_node_exporter — Node exporter on OPNsense firewall

Multi-Cluster

  • nats — NATS deployment on a cluster
  • nats-supercluster — NATS supercluster across multiple sites
  • multisite_postgres — PostgreSQL with multi-site failover

Identity & Secrets

  • openbao — Deploy OpenBao vault (⚠️ uses NationTech DNS)
  • zitadel — Deploy Zitadel identity provider (⚠️ uses NationTech DNS)

Cluster Services

  • cert_manager — Provision TLS certificates
  • tenant — Create a multi-tenant namespace
  • operatorhub_catalog — Install OperatorHub catalog sources

Development & Testing

  • cli — CLI tool with inventory discovery
  • tui — Terminal UI demonstration
  • harmony_inventory_builder — Host discovery via subnet scan

Running Examples

# Build first
cargo build --release

# Run any example
cargo run -p example-postgresql
cargo run -p example-ntfy
cargo run -p example-tenant

For examples that need an existing Kubernetes cluster:

export KUBECONFIG=/path/to/your/kubeconfig
export HARMONY_USE_LOCAL_K3D=false
export HARMONY_AUTOINSTALL=false

cargo run -p example-monitoring

Notes on Private Infrastructure

Some examples use NationTech-hosted infrastructure by default (DNS domains like *.nationtech.io, *.harmony.mcd). These are not suitable for public use without modification. See the Getting Started Guide for the recommended public examples.