# SSH key generation and distribution
ssh-keygen
ssh-copy-id somaz@10.77.101.57

# Configure /etc/hosts for hostname resolution
cat >> /etc/hosts << EOF
10.77.101.62 test-server
10.77.101.57 test-server-agent
EOF

# Verify SSH connectivity
ssh test-server-agent

# Install Python 3.10 (Critical for Kubespray compatibility)
sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt-get update
sudo apt install -y python3.10 python3-pip git python3.10-venv

# Verify Python version
python3.10 --version  # Should output: Python 3.10.13

# Clone Kubespray repository and setup environment
git clone https://github.com/kubernetes-sigs/kubespray.git

VENVDIR=kubespray-venv
KUBESPRAYDIR=kubespray
python3.10 -m venv $VENVDIR
source $VENVDIR/bin/activate
cd $KUBESPRAYDIR

# Install dependencies
pip install -U -r requirements.txt

# Prepare Ansible inventory
cp -rfp inventory/sample inventory/somaz-cluster

# Generate inventory with IP addresses
declare -a IPS=(10.77.101.62 10.77.101.57)
CONFIG_FILE=inventory/somaz-cluster/hosts.yaml python3 contrib/inventory_builder/inventory.py ${IPS[@]}

# Verify Ansible connectivity
ansible all -i inventory/somaz-cluster/inventory.ini -m ping

# Optional: Update apt cache on all nodes
ansible all -i inventory/somaz-cluster/inventory.ini -m apt -a 'update_cache=yes' --become

# Execute the deployment playbook
ansible-playbook -i inventory/somaz-cluster/inventory.ini cluster.yml --become

# Configure kubectl access
mkdir ~/.kube
sudo cp /etc/kubernetes/admin.conf ~/.kube/config
sudo chown $USER:$USER ~/.kube/config

# Set up kubectl completion and aliases
echo '# kubectl completion and alias' >> ~/.bashrc
echo 'source <(kubectl completion bash)' >> ~/.bashrc
echo 'alias k=kubectl' >> ~/.bashrc
echo 'complete -F __start_kubectl k' >> ~/.bashrc
source ~/.bashrc

# Verify cluster status
kubectl get nodes
kubectl cluster-info
kubectl get pods -n kube-system

# Download and install Cilium CLI
curl -LO https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz
sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin
rm cilium-linux-amd64.tar.gz

# Verify Cilium status
cilium status

# Set up Cilium pod aliases for easier management
CILIUMPOD0=$(kubectl get pods -n kube-system -l k8s-app=cilium --field-selector spec.nodeName=test-server -o jsonpath='{.items[0].metadata.name}')
CILIUMPOD1=$(kubectl get pods -n kube-system -l k8s-app=cilium --field-selector spec.nodeName=test-server-agent -o jsonpath='{.items[0].metadata.name}')

# Create convenient aliases for Cilium CLI access
alias c0="kubectl exec -it $CILIUMPOD0 -n kube-system -- cilium"
alias c1="kubectl exec -it $CILIUMPOD1 -n kube-system -- cilium"

# Examine IP cache mappings
c0 map get cilium_ipcache

# View endpoint configurations
c0 endpoint list

# Monitor network policies
c0 bpf policy list

# Check endpoint health
c0 endpoint health <endpoint-id>

# Example IPCache output analysis
c0 map get cilium_ipcache
# Key                Value                                                                  State   Error
# 0.0.0.0/0          identity=2 encryptkey=0 tunnelendpoint=0.0.0.0 nodeid=0                sync
# 10.233.64.153/32   identity=4 encryptkey=0 tunnelendpoint=10.77.101.57 nodeid=12111       sync
# 10.77.101.62/32    identity=1 encryptkey=0 tunnelendpoint=0.0.0.0 nodeid=0                sync

# Create a dedicated namespace for network policy testing
kubectl create namespace network-policy-test

# Deploy a basic CiliumNetworkPolicy
cat <<EOF > frontend-backend-policy.yaml
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "allow-frontend"
  namespace: network-policy-test
spec:
  endpointSelector:
    matchLabels:
      role: frontend
  ingress:
  - fromEndpoints:
    - matchLabels:
        role: backend
    toPorts:
    - ports:
      - port: "80"
        protocol: TCP
EOF

kubectl apply -f frontend-backend-policy.yaml

# Test connectivity from backend to frontend (should work)
kubectl exec -n network-policy-test -it backend -- wget -qO- http://frontend

# Create a test pod without the backend label (should be blocked)
kubectl run test-pod --image=busybox --namespace=network-policy-test -- sleep 3600

# Test connectivity from test-pod to frontend (should fail)
kubectl exec -n network-policy-test -it test-pod -- wget -qO- http://frontend

# View applied policies
c0 policy get

# Monitor policy enforcement in real-time
c0 monitor --type policy-verdict

# Check policy statistics
c0 bpf policy list <endpoint-id>

# Verify policy compilation
c0 policy validate <policy-file.yaml>

# Configure Hubble UI as NodePort for external access
kubectl patch -n kube-system svc hubble-ui -p '{"spec": {"type": "NodePort"}}'

# Verify service configuration
kubectl get svc -n kube-system hubble-ui

# Configure firewall rules (if needed)
# Add the NodePort to your firewall configuration

# Access Hubble UI via browser
# http://<node-ip>:<nodeport>

# Install Hubble CLI
HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt)
curl -L --remote-name-all https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-amd64.tar.gz{,.sha256sum}
sha256sum --check hubble-linux-amd64.tar.gz.sha256sum
sudo tar xzvfC hubble-linux-amd64.tar.gz /usr/local/bin
rm hubble-linux-amd64.tar.gz{,.sha256sum}

# Port forward to Hubble Relay
kubectl port-forward -n kube-system svc/hubble-relay 4245:443 &

# Query flow data
hubble observe
hubble observe --namespace network-policy-test
hubble observe --pod frontend
hubble observe --protocol tcp --port 80

# Service topology
hubble observe --output json | jq '.flow.source.namespace,.flow.destination.namespace'

# Security policy violations
hubble observe --verdict DENIED

# Create a network debugging pod for detailed analysis
cat <<EOF | kubectl create -n network-policy-test -f -
apiVersion: v1
kind: Pod
metadata:
  name: netpod
  labels:
    app: netpod
spec:
  nodeName: test-server-agent
  containers:
  - name: netshoot-pod
    image: nicolaka/netshoot
    command: ["tail"]
    args: ["-f", "/dev/null"]
  terminationGracePeriodSeconds: 0
EOF

# Get pod IP for testing
NETPODIP=$(kubectl get pods netpod -n network-policy-test -o jsonpath='{.status.podIP}')

# Create alias for easy access
alias p0="kubectl exec -n network-policy-test -it netpod -- "

# Analyze network interfaces and routing
p0 ip -c route
p0 ip -c addr show
p0 ss -tulpn

# Check Cilium cluster CIDR configuration
kubectl get configmap -n kube-system cilium-config -o yaml | grep cluster-pool-ipv4-cidr

# Verify endpoint assignments
c1 endpoint list

# Analyze service mappings
c0 service list

# Monitor real-time traffic
c0 monitor --type trace

# Monitor Cilium performance metrics
kubectl top pods -n kube-system -l k8s-app=cilium

# Check eBPF program performance
c0 bpf metrics list

# Analyze memory usage
c0 map list

# Monitor datapath latency
c0 monitor --type trace -v

# Service load balancing statistics
c0 service list --output json | jq '.[] | {id: .id, frontend: .frontend, backends: .backends}'

# Comprehensive health check
cilium status --verbose

# Network connectivity testing
cilium connectivity test

# Policy troubleshooting
cilium policy trace --src-endpoint <src-id> --dst-endpoint <dst-id>

# BPF program debugging
cilium bpf prog list
cilium bpf map list
cilium bpf policy get <endpoint-id>

# Log analysis
kubectl logs -n kube-system daemonset/cilium -f
kubectl logs -n kube-system deployment/cilium-operator -f

# Performance analysis
cilium monitor --type drop
cilium monitor --type trace -v
cilium metrics list