Files
harmony/examples
Jean-Gabriel Gill-Couture 89e5e104dc
All checks were successful
Run Check Script / check (push) Successful in 2m14s
Compile and package harmony_composer / package_harmony_composer (push) Successful in 8m22s
harmony-fleet-operator — release / release (push) Successful in 3m17s
feat(fleet): unify deploy config, switch CLI to tracing, fix OCI chart name collision
fleet-deploy:
- Rename harmony-fleet-release binary to harmony-fleet-publish
- Route all deploy settings through ConfigClient (env → OpenBao → prompt)
  instead of bespoke flags; seed FleetDeploySecrets via OpenBao
- Rename HARMONY_SECRET_NAMESPACE to HARMONY_CONFIG_NAMESPACE
- Append -chart to the Helm chart artifact name so it no longer collides
  with the Docker image in Harbor (application/vnd.cncf.helm.config.v1+json)

harmony_cli:
- Switch from log to tracing for structured output
- Defer topology prep so --list and declined runs are no-ops
- Drop ANSI colour codes around log emojis
- Init cli logger in fleet deploy binary

openbao:
- Scope unseal-keys cache file per instance
- Example gains setup capability and updated README

roadmap:
- Add unified CLI design document (ROADMAP/13-unified-cli.md)
- Update v0.3 fleet platform plan

Squashed commit of the following:

commit 36d9d9aaec
Merge: 12c8d9cf e7148aa8
Author: johnride <jg@nationtech.io>
Date:   Mon Jun 1 15:42:56 2026 +0000

    Merge pull request 'fix: fleet operator chart name was conflicting with the container name. Append -chart to the chart name' (#317) from fix/fleet-operator-chart-name into chore/rename-release-to-publish

    Reviewed-on: #317

commit e7148aa85f
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Mon Jun 1 11:35:15 2026 -0400

    fix: fleet operator chart name was conflicting with the container name. Append -chart to the chart name

commit 12c8d9cfa0
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Mon Jun 1 11:12:23 2026 -0400

    feat: Init cli logger in fleet deploy

commit edb62668b6
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sun May 31 12:56:36 2026 -0400

    doc: Roadmap entry for cli design and implementation

commit f2ecccb4ab
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sun May 31 12:32:19 2026 -0400

    refactor(fleet-deploy): rename harmony-fleet-release to harmony-fleet-publish

    Deploy/publish wording is more intuitive than deploy/release.

commit 2e9052b217
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sun May 31 10:12:54 2026 -0400

    fix(openbao): remove extra blank line in example

    Pre-existing formatting issue caught by cargo fmt --check.

commit f7299ebe2b
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sun May 31 09:13:39 2026 -0400

    refactor(fleet-deploy): rename HARMONY_SECRET_NAMESPACE to HARMONY_CONFIG_NAMESPACE

    The env var name was a misnomer — ConfigClient resolves both config and
    secrets, not just secrets. The struct field was already config_namespace.
    Legacy SecretManager keeps the old var; this forces migration to
    ConfigClient for new code.

commit d39aa15152
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sun May 31 09:06:20 2026 -0400

    feat: fleet deploy uses configuration from configclient for all settings, update the 0_3 plan

commit 57d056fced
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sat May 30 11:07:03 2026 -0400

    fix(openbao): scope unseal-keys cache file per instance

    The root token + unseal keys were written to a single fixed
    `~/.local/share/harmony/openbao/unseal-keys.json`, so deploying a second
    OpenBao instance (different namespace/release) overwrote the first's keys —
    after which the first could never be unsealed. Key the file by
    namespace+release (`unseal-keys-<ns>-<release>.json`); `cached_root_token`
    now takes the `OpenbaoInstance` to read the right one.

commit 44aa83199a
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sat May 30 11:05:30 2026 -0400

    fix(harmony_cli): drop ANSI colour codes around log emojis

    `console::style(emoji).green()/.yellow()/.red()/.blue()` embedded raw ANSI
    escapes in the message string. `console` force-emits them off its own TTY
    detection, which disagrees with the tracing writer, so they leaked as literal
    `\x1b[..m` garbage around the emoji. Emit plain emojis — the glyph already
    conveys status and the tracing fmt layer still colours the level.

commit 4fef957edb
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sat May 30 08:40:54 2026 -0400

    feat: Example openbao now can do openbao  setup and better readme

commit af3205d353
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sat May 30 05:55:49 2026 -0400

    refactor(harmony_cli): defer topology prep so --list/declined runs are no-ops

    `Maestro::initialize` (hence `topology.ensure_ready()`) ran before `init`'s
    `--list` / confirmation short-circuits, so merely listing a binary's scores —
    or declining to run them — still prepared the topology (cert-manager install,
    etc.). Build the maestro unprepared and call `prepare_topology()` only once we
    commit to interpreting. Expose `Maestro::prepare_topology`; add tests proving
    `--list` skips prep while the run path triggers it.

commit 199e285e52
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Sat May 30 05:04:34 2026 -0400

    feat: Use tracing instead of logger in harmon_cli and  work on fleet_staging_install refactor to use harmony_cli properly, still some more work to do

commit fac83d853d
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Fri May 29 22:39:39 2026 -0400

    refactor(fleet-staging): use tracing instead of println for output

    Swap env_logger for tracing_subscriber (its fmt bridges the framework's
    log:: deploy-progress output) and route the install banner + step logs
    through tracing::info! — no raw println.

commit 0400e9d454
Author: Jean-Gabriel Gill-Couture <jg@nationtech.io>
Date:   Fri May 29 20:25:22 2026 -0400

    feat(fleet-staging): add OpenBao + seed FleetDeploySecrets; route operator creds through the deploy crate

    fleet_staging_install now deploys OpenBao (co-located in fleet-staging,
    cert-manager TLS at secrets-stg.<base>), configures it (fleet-deployer
    read policy), and seeds the operator's FleetDeploySecrets so the operator
    can be upgraded alone via 'harmony-fleet-deploy --from-tag'. Behavior of
    the existing bring-up is unchanged.

    Credential-TOML construction moved out of the example into
    OperatorCredentials::zitadel_jwt (deploy crate) so all callers share it.
    New openbao::cached_root_token() lets the seed reuse the root token setup
    already cached. Seeding mirrors the harmony_sso port-forward pattern.
2026-06-01 11:51:11 -04:00
..
2026-05-11 16:48:52 -04:00
2026-05-11 16:48:52 -04:00
2026-05-04 09:03:35 -04:00
2026-05-11 16:48:52 -04:00
2026-05-11 16:48:52 -04:00
2026-01-09 17:30:51 -05:00
2026-05-11 16:48:52 -04:00
2026-04-21 16:03:42 -04:00
2026-05-11 16:48:52 -04:00

Examples

This directory contains runnable examples demonstrating Harmony's capabilities. Each example is a self-contained program that can be run with cargo run -p example-<name>.

Quick Reference

Example Description Local K3D Existing Cluster Hardware Needed
postgresql Deploy a PostgreSQL cluster
ntfy Deploy ntfy notification server
tenant Create a multi-tenant namespace
cert_manager Provision TLS certificates
node_health Check Kubernetes node health
monitoring Deploy Prometheus alerting
monitoring_with_tenant Monitoring + tenant isolation
operatorhub_catalog Install OperatorHub catalog
validate_ceph_cluster_health Verify Ceph cluster health Rook/Ceph
remove_rook_osd Remove a Rook OSD Rook/Ceph
brocade_snmp_server Configure Brocade switch SNMP Brocade switch
opnsense_node_exporter Node exporter on OPNsense OPNsense firewall
opnsense_vm_integration Full OPNsense firewall automation (11 Scores) KVM/libvirt
opnsense_pair_integration OPNsense HA pair with CARP failover KVM/libvirt
okd_pxe PXE boot configuration for OKD
okd_installation Full OKD bare-metal install
okd_cluster_alerts OKD cluster monitoring alerts OKD cluster
multisite_postgres Multi-site PostgreSQL failover Multi-cluster
nats Deploy NATS messaging Multi-cluster
nats-supercluster NATS supercluster across sites Multi-cluster
lamp LAMP stack deployment
openbao Deploy OpenBao vault
zitadel Deploy Zitadel identity provider
try_rust_webapp Rust webapp with packaging Submodule
rust Rust webapp with full monitoring
rhob_application_monitoring RHOB monitoring setup
sttest Full OKD stack test
application_monitoring_with_tenant App monitoring + tenant OKD cluster
kube-rs Direct kube-rs client usage
k8s_drain_node Drain a Kubernetes node
k8s_write_file_on_node Write files to K8s nodes
harmony_inventory_builder Discover hosts via subnet scan
cli CLI tool with inventory discovery
tui Terminal UI demonstration

Status Legend

Symbol Meaning
Works out-of-the-box
Not applicable or requires specific setup

By Category

Data Services

  • postgresql — Deploy a PostgreSQL cluster via CloudNativePG
  • multisite_postgres — Multi-site PostgreSQL with failover
  • public_postgres — Public-facing PostgreSQL (⚠️ uses NationTech DNS)

Kubernetes Utilities

  • node_health — Check node health in a cluster
  • k8s_drain_node — Drain and reboot a node
  • k8s_write_file_on_node — Write files to nodes
  • validate_ceph_cluster_health — Verify Ceph/Rook cluster health
  • remove_rook_osd — Remove an OSD from Rook/Ceph
  • kube-rs — Direct Kubernetes client usage demo

Monitoring & Alerting

  • monitoring — Deploy Prometheus alerting with Discord webhooks
  • monitoring_with_tenant — Monitoring with tenant isolation
  • ntfy — Deploy ntfy notification server
  • okd_cluster_alerts — OKD-specific cluster alerts

Application Deployment

  • try_rust_webapp — Deploy a Rust webapp with packaging (⚠️ requires tryrust.org submodule)
  • rust — Rust webapp with full monitoring features
  • rhob_application_monitoring — Red Hat Observability Stack monitoring
  • lamp — LAMP stack deployment (⚠️ uses NationTech DNS)
  • application_monitoring_with_tenant — App monitoring with tenant isolation

Infrastructure & Bare Metal

  • opnsense_vm_integrationRecommended demo. Boot an OPNsense VM and configure it with 11 Scores (load balancer, DHCP, TFTP, VLANs, firewall rules, NAT, VIPs, LAGG). Fully automated, requires only KVM. See the detailed guide.
  • opnsense_pair_integration — Boot two OPNsense VMs and configure a CARP HA firewall pair with FirewallPairTopology and CarpVipScore. Demonstrates NIC link control for sequential bootstrap.
  • okd_installation — Full OKD cluster from scratch
  • okd_pxe — PXE boot configuration for OKD
  • sttest — Full OKD stack test with specific hardware
  • brocade_snmp_server — Configure Brocade switch via SNMP
  • opnsense_node_exporter — Node exporter on OPNsense firewall

Multi-Cluster

  • nats — NATS deployment on a cluster
  • nats-supercluster — NATS supercluster across multiple sites
  • multisite_postgres — PostgreSQL with multi-site failover

Identity & Secrets

  • openbao — Deploy OpenBao vault (⚠️ uses NationTech DNS)
  • zitadel — Deploy Zitadel identity provider (⚠️ uses NationTech DNS)

Cluster Services

  • cert_manager — Provision TLS certificates
  • tenant — Create a multi-tenant namespace
  • operatorhub_catalog — Install OperatorHub catalog sources

Development & Testing

  • cli — CLI tool with inventory discovery
  • tui — Terminal UI demonstration
  • harmony_inventory_builder — Host discovery via subnet scan

Running Examples

# Build first
cargo build --release

# Run any example
cargo run -p example-postgresql
cargo run -p example-ntfy
cargo run -p example-tenant

For examples that need an existing Kubernetes cluster:

export KUBECONFIG=/path/to/your/kubeconfig
export HARMONY_USE_LOCAL_K3D=false
export HARMONY_AUTOINSTALL=false

cargo run -p example-monitoring

Notes on Private Infrastructure

Some examples use NationTech-hosted infrastructure by default (DNS domains like *.nationtech.io, *.harmony.mcd). These are not suitable for public use without modification. See the Getting Started Guide for the recommended public examples.