58 lines
2.2 KiB
Markdown
58 lines
2.2 KiB
Markdown
|
# How To Land Sky Lattice in a Customer Environment
|
|||
|
|
|
|||
|
|
This guide is for operators bringing Sky Lattice to a new customer Snowflake account.
|
|||
|
|
|
|||
|
|
## Prerequisites
|
|||
|
|
|
|||
|
|
- Customer Snowflake account (or ability to create one)
|
|||
|
|
- Customer git host (GitHub/GitLab) or agreement that you host the customer project
|
|||
|
|
- Place to store secrets (CI secrets / Vault)
|
|||
|
|
- Optional: Cursor for skill-based UX
|
|||
|
|
|
|||
|
|
## Steps
|
|||
|
|
|
|||
|
|
1. **Bootstrap automation identity (one-time, manual)**
|
|||
|
|
As `ACCOUNTADMIN`, create a Terraform/service user with key-pair auth and roles sufficient for platform objects (typically a dedicated automation role; avoid day-to-day ACCOUNTADMIN after bootstrap).
|
|||
|
|
|
|||
|
|
2. **Store secrets**
|
|||
|
|
Put the private key and account identifiers in the customer’s secret store / CI secrets. Never commit keys.
|
|||
|
|
|
|||
|
|
3. **Create the customer project**
|
|||
|
|
On your operator machine:
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
platformctl init <customer> --mode greenfield # or brownfield
|
|||
|
|
platformctl wizard --path customers/<customer>
|
|||
|
|
platformctl validate --path customers/<customer>
|
|||
|
|
platformctl plan --path customers/<customer>
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
4. **Push to customer git**
|
|||
|
|
Push `customers/<customer>/` to their repository (or your managed repo per contract).
|
|||
|
|
|
|||
|
|
5. **Wire CI**
|
|||
|
|
The template workflow under `.github/workflows/terraform.yml` is a starting point. Add credentials, remote TF state backend, and real `terraform plan/apply` gates.
|
|||
|
|
|
|||
|
|
6. **First apply**
|
|||
|
|
Run through CI or `platformctl apply` once credentials and provider resources are wired.
|
|||
|
|
|
|||
|
|
7. **Hand off**
|
|||
|
|
Point customer admins at recipes: add domain, grant patterns, drift. Approvers only need to read Terraform/plan summaries.
|
|||
|
|
|
|||
|
|
## Expected results
|
|||
|
|
|
|||
|
|
- Customer repo holds intent + decisions + terraform
|
|||
|
|
- CI can plan changes via PRs
|
|||
|
|
- Blueprint remains pinned by version; full blueprint source stays with you unless air-gapped vendoring is required
|
|||
|
|
|
|||
|
|
## Troubleshooting
|
|||
|
|
|
|||
|
|
- **No intent.yaml** — run from the customer project or pass `--path`
|
|||
|
|
- **Policy errors on overrides** — add `platformctl decision add` and link `decision_id`
|
|||
|
|
- **terraform missing** — fine for v0 graph apply; install Terraform when enabling live provider apply
|
|||
|
|
|
|||
|
|
## Related
|
|||
|
|
|
|||
|
|
- [Bring-up checklist](CHECKLIST.md)
|
|||
|
|
- Recipes under `docs/recipes/`
|