@leverege/build-tools 2.94.0 → 2.95.0

package/.vscode/launch.json

@@ -17,6 +17,20 @@
       "env": {
       },
       "outputCapture": "std"
+    },
+    {
+      "name": "service-man (launch)",
+      "type": "node",
+      "request": "launch",
+      "program": "${workspaceFolder}/src/service-man/service-man.mjs",
+      "args": ["--dump-configs","dbg-cfgs"],
+      "cwd": "/Users/john/Work/leverege/k8s/tst-builder",
+      "runtimeExecutable": "node",
+      "console": "integratedTerminal",
+      "skipFiles": ["<node_internals>/**"],
+      "env": {
+        "NODE_ENV": "development"
+      }
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.94.0",
+  "version": "2.95.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -40,6 +40,7 @@
     "getjson": "src/getjson.mjs",
     "git-tar": "src/git-tar.sh",
     "helm-audit": "src/helm-audit.mjs",
+    "helmboot": "src/helmup.sh",
     "helmcycle": "src/helmup.sh",
     "helmdn": "src/helmdn.sh",
     "helminit": "src/helmup.sh",
@@ -64,6 +65,7 @@
     "refresh-npm-token": "src/refresh-npm-token.mjs",
     "refresh-py-idx": "src/refresh-py-idx.sh",
     "send-to-slack": "src/send-to-slack.mjs",
+    "service-man": "src/service-man/service-man.mjs",
     "snapshot-cnpg": "src/snapshot-cnpg.mjs",
     "tag-release": "src/tag-release.mjs",
     "unleash": "src/unleash.mjs",
@@ -99,12 +101,13 @@
     "simple-git": "^3.30.0",
     "sloc": "^0.3.2",
     "superstruct": "^2.0.2",
+    "tmp": "^0.2.5",
     "toml": "^3.0.0",
     "zx": "^8.8.5"
   },
   "devDependencies": {
     "@leverege/eslint-config-leverege": "^5.1.1",
-    "chai": "^6.2.1",
+    "chai": "^6.2.2",
     "mocha": "^11.7.5",
     "npm": "^11.7.0"
   }

package/src/Docker.mjs

@@ -1,3 +1,4 @@
+/* eslint-disable security/detect-non-literal-fs-filename */
 import fs from 'node:fs'
 import path from 'node:path'
 import url from 'node:url'
@@ -23,7 +24,7 @@ const DIRNAME = path.dirname( url.fileURLToPath( import.meta.url ) )
 //
 // See the latest docker images here => https://hub.docker.com/_/node
 //
-const dockerfileNodeVersion = process.env.DOCKER_BUILD_NODE_VERSION || '22.21.1-alpine3.23' // TODO: 1/1/26 => '24.12.0-alpine3.23'
+const dockerfileNodeVersion = process.env.DOCKER_BUILD_NODE_VERSION || '24.12.0-alpine3.23'
 const dockerfileNpmVersion = process.env.DOCKER_BUILD_NPM_VERSION || '11.6.0'
 
 // The contents of these variables were initially located in files that live in
@@ -83,7 +84,7 @@ const generateDockerfile = async ( options ) => {
   const gitReference = await shellCmd( 'git rev-parse --short HEAD' )
   const settings = { gitReference, ...defaultSettings, ...options }
   const dockerTemplate = options.isNodeJsProject ? 'dockerfileTemplateNodeJs' : 'dockerfileTemplatePython'
-  const dockerfileTemplate = fs.readFileSync( path.join( DIRNAME, `./templates/${dockerTemplate}.hbs` ), 'utf8' ) // eslint-disable-line security/detect-non-literal-fs-filename
+  const dockerfileTemplate = fs.readFileSync( path.join( DIRNAME, `./templates/${dockerTemplate}.hbs` ), 'utf8' )
   
   // defaults to the current "official" version of node unless it gets
   // overridden in the leverege.nodeimg package.json stanza

package/src/Utils.mjs

@@ -39,11 +39,42 @@ export const warning = ( warningText ) => {
   console.error( `\n${chalk.yellow.bold( fullWarning )}` )
 }
 
-export const errorExit = ( error, opts = {} ) => {
-  const { errorCode = 1 } = opts
-  console.error( `\n${chalk.red.bold( error )}\n` )
-  process.exit( errorCode )
+export const errorExit = ( arg, opts = {} ) => {
+  const exitCode =
+    typeof opts.exitCode === 'number' ? opts.exitCode :
+      ( arg && typeof arg.exitCode === 'number' ) ? arg.exitCode : 1
+
+  // lets figure out what to print
+  let message
+  let details
+
+  if ( arg instanceof Error ) {
+    message = arg.message || 'Error'
+    details = arg.stack
+  } else if ( typeof arg === 'string' ) {
+    message = arg
+  } else if ( arg && typeof arg === 'object' ) {
+    message = 'Error'
+    details = JSON.stringify( arg, null, 2 )
+  } else if ( arg != null ) {
+    message = String( arg )
+  }
+
+  console.error( `\n${chalk.red.bold( message )}\n` )
+  if ( details && details !== message ) {
+    console.error( `${details}\n` )
+  }
+
+  process.exit( exitCode )
+}
+
+/**
+ * Clears the screen and optionally homes the cursor.
+ */
+export const clear = ( home = true ) => {
+  log( `${home ? '\x1B[0f' : ''}\x1B[2J` )
 }
+
 /* eslint-enable no-console */
 
 export const isHex = ( hex ) => {
@@ -54,6 +85,22 @@ export const isString = ( s ) => {
   return typeof s === 'string' || s instanceof String
 }
 
+/**
+  *  * Sets first char to Upper
+  *   */
+export const capitalize = ( norm ) => {
+  return norm.charAt( 0 ).toUpperCase() + norm.slice( 1 )
+}
+
+/**
+ * A simple mS sleep delay.
+ */
+export const sleep = ( ms = 0 ) => {
+  return new Promise( ( resolve ) => {
+    setTimeout( resolve, ms )
+  } )
+}
+
 /**
  * General "yes" to proceed function.
  */
@@ -226,7 +273,7 @@ export const gitRepoIsDirty = async () => {
 
 export const parseYamlFile = async ( filePath ) => {
   try {
-    const fileContent = await fs.promises.readFile( filePath, 'utf8' )
+    const fileContent = await fs.promises.readFile( filePath, 'utf8' ) /* eslint-disable-line security/detect-non-literal-fs-filename */
     return YAML.load( fileContent )
   } catch ( error ) {
     throw new Error( `Failed to parse YAML file ${filePath}: ${error.message}` )
@@ -538,7 +585,7 @@ export const getRepositoryDescr = async () => {
   const helmChart = await parseHelmChart()
   const rootPackageJson = await parseJsonFile( `${gitRoot}/package.json` )
   const rootPyProjectToml = await parsePyProjectToml( `${gitRoot}/pyproject.toml` )
-  const isYarnProject = fs.existsSync( path.join( gitRoot, 'yarn.lock' ) ) || fs.existsSync( path.join( gitRoot, '.yarn' ) )
+  const isYarnProject = fs.existsSync( path.join( gitRoot, 'yarn.lock' ) ) || fs.existsSync( path.join( gitRoot, '.yarn' ) ) /* eslint-disable-line security/detect-non-literal-fs-filename */
 
   return {
     currentDir : process.cwd(),

package/src/artifacts/Utils.mjs

@@ -1,6 +1,6 @@
 import fs from 'node:fs'
 import path from 'node:path'
-import crypto from 'crypto'
+import crypto from 'node:crypto'
 
 import { validate } from 'superstruct'
 

package/src/bash-funcs

@@ -322,4 +322,4 @@ function commandChecker() {
   done
 }
 
-commandChecker git helm kubectl service-man
+commandChecker git helm jq kubectl service-man

package/src/git-tar.sh

@@ -3,7 +3,7 @@
 # Load the standard helper functions
 . `build-tools --bashfun`
 
-# If it isn't already set use the default ~/work/.gitar
+# If it isn't already set use the default ~/.gitar
 #
 [ -z $GITAR ] && GITAR="${HOME}/.gitar"
 

package/src/helm-charts/emailer/values-local.yaml

@@ -1,12 +1,5 @@
 image:
-  tag: # v3.7.0
+  tag: # v5.1.0
 
 config:
   LOG_CONFIG: '{"type":"pino","level":"warn"}'
-
-  API_UI_URL: "${PROJECT_ID}.web.app"
-  MAIL_GUN_DOMAIN: "${MAIL_GUN_DOMAIN}"
-  MAIL_GUN_DEFAULT_SENDER: "no-reply@${MAIL_GUN_DOMAIN}"
-
-serviceMonitor:
-  enabled: true

package/src/helm-charts/prom-operator/helmup.plugin

@@ -8,7 +8,7 @@ showInstalling "The Prometheus Operator (kube-prometheus-stack)"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="80.4.1"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="80.11.0"
 helm upgrade $NS --install prometheus-stack $OCI_CHART \
                  --values  prom-operator/prometheus-stack.yaml \
                  --version $PROMETHEUS_STACK_CHART_VERSION $HELM_WHAT

package/src/helm-charts/traefik/helmup.plugin

@@ -17,7 +17,7 @@ TRAEFIK_NAMESPACE="traefik"
 
 addHelmRepo traefik https://helm.traefik.io/traefik
 
-[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="37"
+[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="38"
 helm upgrade --install traefik traefik/traefik \
              --namespace $TRAEFIK_NAMESPACE --create-namespace \
              --values  traefik/values.yaml \

package/src/helm-charts/velero/README.md

@@ -0,0 +1,135 @@
+# Velero Deployment Notes
+
+## Why this document exists
+
+This document explains **why we had to change the Velero deployment process** and how we now safely manage **CRDs and Helm upgrades** without relying on Bitnami images or brittle Helm hook jobs.
+
+These changes were driven by:
+- Removal / breakage of Bitnami `kubectl` images referenced by the `vmware-tanzu/velero` Helm chart
+- Broadcom’s changes to Bitnami image access and licensing
+- The need for **deterministic, version-safe CRD management** on new and existing GKE clusters
+
+---
+
+## Background: What broke
+
+The Velero Helm chart (`vmware-tanzu/velero` >= 11.x) includes a Helm **hook job** that attempts to install or upgrade CRDs using an initContainer based on:
+
+```
+docker.io/bitnamilegacy/kubectl:<k8s-version>
+```
+
+On Kubernetes 1.34+ clusters, this image **no longer exists**, causing installs to fail with errors such as:
+
+```
+ErrImagePull: bitnamilegacy/kubectl:1.34 not found
+```
+
+Attempts to substitute other kubectl images failed due to hard assumptions in the hook job (e.g. `/tmp/sh`, shell paths, filesystem layout).
+
+Because this hook runs **before Helm considers the release successful**, it blocks both fresh installs and upgrades.
+
+---
+
+## Why we disabled Helm-based CRD upgrades
+
+Helm does not natively manage CRD upgrades well:
+- CRDs in `crds/` directories are only installed once
+- Schema upgrades require hooks or out-of-band logic
+- Hook jobs are fragile and opaque when they fail
+
+The Velero chart’s CRD hook job is effectively doing:
+
+```
+velero install --crds-only | kubectl apply
+```
+
+…but wrapped in a container that is now broken due to image dependencies.
+
+**Conclusion:** We disable the Helm CRD hook entirely and manage CRDs explicitly.
+
+---
+
+## Our current approach (high-level)
+
+1. **CRDs are managed explicitly**, outside Helm
+2. **CRDs are generated from the exact Velero version being deployed**
+3. Helm is used only for deploying/upgrading the Velero controller and configuration
+4. Helm CRD hooks are disabled (`upgradeCRDs=false`)
+
+This makes installs:
+- Reproducible
+- Debuggable
+- Independent of third-party image publishing decisions
+
+---
+
+## Version alignment is critical
+
+The command:
+
+```bash
+velero install --crds-only --dry-run -o yaml
+```
+
+**uses the local `velero` CLI version** to generate CRDs.
+
+If the CLI version does not match the Velero server version deployed by Helm, you can:
+- Apply incompatible CRD schemas
+- Introduce validation failures on existing custom resources
+
+### Our safeguard
+
+`helmup.plugin` now:
+- Reads the chart `appVersion` directly from Helm
+- Verifies the local `velero` CLI version matches exactly
+- Fails fast if versions are mismatched
+
+This guarantees CRDs and controllers stay in lockstep.
+
+---
+
+## When CRDs are applied
+
+CRDs are **not applied on every deploy**.
+
+They are applied only when:
+- Bootstrapping a new cluster
+- Upgrading the Velero chart to a version with a new `appVersion`
+
+This is controlled explicitly via:
+
+```bash
+VELERO_APPLY_CRDS=1 helmup velero
+```
+
+Normal configuration-only updates do **not** touch CRDs.
+
+---
+
+## Summary of changes
+
+| Area | Old behavior | New behavior |
+|-----|-------------|-------------|
+| CRD management | Helm hook job | Explicit, pinned CRD apply |
+| kubectl dependency | Bitnami legacy image | None |
+| Version safety | Implicit | Enforced |
+| Failure mode | Late, opaque | Early, explicit |
+| New cluster installs | Unreliable | Deterministic |
+
+---
+
+## Key takeaways
+
+- **CRDs are part of the API, not application config** — they must be versioned and applied intentionally
+- Helm hooks are not a reliable mechanism for critical cluster-scoped resources
+- Pinning tool versions eliminates an entire class of upgrade failures
+- This approach aligns with GitOps and production-safe Kubernetes practices
+
+---
+
+## References
+
+- Velero documentation: https://velero.io/docs/
+- Velero Helm charts: https://github.com/vmware-tanzu/helm-charts
+- Kubernetes CRD management: https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/

package/src/helm-charts/velero/helmup.bootstrap

@@ -4,6 +4,7 @@
 function installVeleroEnvironment() {
   # Follows instructions => https://github.com/vmware-tanzu/velero-plugin-for-gcp
   showInstalling "Velero Backup Management"
+
   createNamespaceIfNeeded velero
 
   # Do we need to => gcloud auth application-default

package/src/helm-charts/velero/helmup.plugin

@@ -2,10 +2,36 @@
 #
 showInstalling "Velero Backup System"
 
+# We use a specific version for the velero chart because we need to control
+# the version of the locally installed velero client application.
+#
+VELERO_CHART_VERSION="11.3.1"
+EXPECTED_CLIENT_VERSION="v1.17.1"
+
 addHelmRepo vmware-tanzu https://vmware-tanzu.github.io/helm-charts
 
-[ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="11"
+commandChecker velero # verify the velero client is installed
+
+local client_version="$(velero version --client-only 2>/dev/null | awk -F': ' '/Version:/ {print $2; exit}')"
+
+if [[ "$client_version" != "$EXPECTED_CLIENT_VERSION" ]]; then
+  cat<<WRONG_VELERO_APP_VERSION
+
+  ERROR: velero CLI version mismatch.
+    Expected: `color g "${EXPECTED_CLIENT_VERSION}"`
+    Found:    `color r "${client_version}"`
+  
+  Fix => `color y "install velero ${EXPECTED_CLIENT_VERSION}"`
+WRONG_VELERO_APP_VERSION
+  exit 1
+fi
+
+# If the CRDs need to be updated set VELERO_APPLY_CRDS!
 #
+if [[ "${VELERO_APPLY_CRDS:-0}" == "1" ]]; then
+  velero install --crds-only --dry-run -o yaml | kubectl apply -f - --validate=false
+fi
+
 # Build the bucket, region and SA email variables and use --set to mod the
 # chart values as opposed to using an ${label} approach. This eliminates
 # the need for an overwhelm generated values.yaml file which also contains
@@ -13,7 +39,7 @@ addHelmRepo vmware-tanzu https://vmware-tanzu.github.io/helm-charts
 #
 # Note: GCP_PROJECT_ID is passed down from helmup's environment.
 #
-GCE_BUCKET="$GCP_PROJECT_ID-velero-$VELERO_CHART_VERSION"
+GCE_BUCKET="$GCP_PROJECT_ID-velero-${VELERO_CHART_VERSION%%.*}"
 GCE_REGION=`overwhelm -k GCE_REGION`
 GCE_SA_EMAIL="velero@${GCP_PROJECT_ID}.iam.gserviceaccount.com"
 
@@ -27,6 +53,7 @@ helm upgrade \
      --namespace velero --create-namespace \
      --values velero/values-local.yaml \
      --version $VELERO_CHART_VERSION $HELM_WHAT \
+     --set upgradeCRDs=false \
      --set configuration.backupStorageLocation[0].bucket="$GCE_BUCKET" \
      --set configuration.backupStorageLocation[0].config.serviceAccount="$GCE_SA_EMAIL" \
      --set configuration.volumeSnapshotLocation[0].config.snapshotLocation="$GCE_REGION"

package/src/helm-charts/velero/values-local.yaml

@@ -137,7 +137,7 @@ nodeSelector: {}
 # See => https://github.com/vmware-tanzu/velero-plugin-for-gcp
 initContainers:
   - name: velero-plugin-for-gcp
-    image: velero/velero-plugin-for-gcp:v1.10.0
+    image: velero/velero-plugin-for-gcp:v1.13.1
     volumeMounts:
       - mountPath: /target
         name: plugins

package/src/helmup.sh

@@ -447,35 +447,50 @@ BAD_SECRETS
   fi
 }
 
-function getServiceAndChartVersion() {
+function findChartLocation() {
+  local service_name="$1"
+  local output
+
+  # check the compass for a chart location
+  if output="$(chart-compass --service "$service_name")";
+  then
+    # chart exists in local chart-compass.yaml
+    local chart_location="oci://$output"
+  else
+    # nope - fallback to using the legacy museum location
+    local chart_location="leverege/$service_name"
+  fi
+
+  echo "$chart_location"
+}
+
+function getServiceAndChartInfo() {
   SERVICE=
+  CHARTLOC=
   CHARTVER=
   FROM_VERSIONS=
+
+  local input="${1:-}"
+  local versions_file="./Versions.json"
+
   # Allows chart version from command line via <deployment>/<x.y.z>
   IFS="/" read SERVICE CHARTVER <<< "$1"
 
-  # Allows chart version as <deployment>/Chart-x.y.z*>
-  [ ! -z "$CHARTVER" ] && return # service and chart version from CLI
+  [[ -z "$SERVICE" ]] && return 1
 
-  # force the move away from the old approach
-  LCL_CHART=`compgen -G $SERVICE/Chart-?*.?*.?*` &> $DEVNULL
-  if [ ! -z "$LCL_CHART" ];
-  then
-    CHARTVER=${LCL_CHART#*/Chart-}
-    cat<<DEPRECATED_CHART
-    $YELO_WARN The use of $SERVICE/$LCL_CHART to lock the chart version has
-    been deprecated. Create a top level `color g "Versions.json"` file instead:
+  CHARTLOC="$(findChartLocation $SERVICE)"
 
-DEPRECATED_CHART
-    exit 1
+  # Allows chart version as <deployment>/x.y.z>
+  if [[ -n "$CHARTVER" ]]; then
+    return 0 # service and chart version from CLI
   fi
 
   # check for the top level Versions.json file
-  local VERSIONS="./Versions.json"
-  if [ -f "$VERSIONS" ];
-  then
-    CHARTVER=`node -e "charts=require('$VERSIONS');console.log( charts['$SERVICE']?.chart || '' )"`
-    [ ! -z "${CHARTVER}" ] && FROM_VERSIONS=1
+  if [[ -f "$versions_file" ]]; then
+    CHARTVER=$(jq -r --arg svc "$SERVICE" '.[$svc].chart // ""' "$versions_file")
+    if [[ -n "$CHARTVER" ]]; then
+      FROM_VERSIONS=1
+    fi
   fi
 }
 
@@ -516,23 +531,6 @@ $BANNER_TXT
 HELMUP_BANNER
 }
 
-findChartLocation() {
-  local service_name="$1"
-  local output
-
-  # check the compass for a chart location
-  if output="$(chart-compass --service "$service_name")";
-  then
-    # chart exists in local chart-compass.yaml
-    local chart_location="oci://$output"
-  else
-    # nope - fallback to using the legacy museum location
-    local chart_location="leverege/$service_name"
-  fi
-
-  echo "$chart_location"
-}
-
 function doHelmup() {
   local culprit="--set helmup.culprit=\"$(gcloud config get account)\""
   local deployT="--set helmup.deployT=\"$(date -u +'%Y-%m-%dT%H:%M:%SZ')\""
@@ -551,8 +549,9 @@ function doHelmup() {
   esac
 }
 
-# not a fan of global vars but bash forced me to - set by getServiceAndChartVersion
+# not a fan of global vars but bash forced me to - set by getServiceAndChartInfo
 SERVICE=
+CHARTLOC=
 CHARTVER=
 FROM_VERSIONS=
 function doInstall() {
@@ -562,7 +561,7 @@ function doInstall() {
   for PARAM in "$@";
   do
     # Allows chart version from command line via <deployment>/<x.y.z>
-    getServiceAndChartVersion "$PARAM"
+    getServiceAndChartInfo "$PARAM"
     #printf "SVC=[$SERVICE] CHT=[$CHARTVER]\n"
 
     # slap additional helm syntax in there if the version is set
@@ -593,6 +592,17 @@ CATBACKUP
       fi
     fi
 
+    if [[ "$INVOKED_AS" == "helmboot" ]]; then
+      local BOOTSTRAP="$SERVICE/helmup.bootstrap"
+      cat<<REBOOTSTRAP
+
+  Rerunning service bootstrap script => `color g "$BOOTSTRAP"`
+
+REBOOTSTRAP
+      [[ -x "$BOOTSTRAP" ]] && . "$BOOTSTRAP"
+      exit 0
+    fi
+
     if [ "$INVOKED_AS" == "helmcycle" ];
     then
       helmdn $SERVICE
@@ -602,8 +612,6 @@ CATBACKUP
     # during initial install then do so here
     ifPluggedInOrBootstrapped $SERVICE && continue
 
-    local CHART_LOCATION="$(findChartLocation $SERVICE)"
-
     case "$SERVICE" in
       "platform")
         doPlatormPreInstallChecks
@@ -647,7 +655,7 @@ CATBACKUP
       transponder-*)
         # transponders use the same chart but different deployment name
         [ ! -d $SERVICE ] && bootstrapLocalSetup $SERVICE
-        HELMUP="helm upgrade --install $SERVICE leverege/transponder --values $SERVICE/values.yaml $CHARTVER $HELM_WHAT"
+        HELMUP="helm upgrade --install $SERVICE $CHARTLOC --values $SERVICE/values.yaml $CHARTVER $HELM_WHAT"
         doHelmup "$HELMUP"
         ;;
         
@@ -692,7 +700,7 @@ NO_SERVICE_MAN
 
         checkUpgradeNotes $SERVICE
 
-        HELMUP="helm upgrade --install $SERVICE $CHART_LOCATION -f $SERVICE/values.yaml $CHARTVER $HELM_WHAT"
+        HELMUP="helm upgrade --install $SERVICE $CHARTLOC -f $SERVICE/values.yaml $CHARTVER $HELM_WHAT"
 
         doHelmup $HELMUP
         SAVERR=$?

package/src/service-man/ServiceMan.mjs

@@ -0,0 +1,75 @@
+import chalk from 'chalk'
+
+import { log, } from '../Utils.mjs'
+
+import { CommandLine, Config, } from './config/index.mjs'
+import {
+  RolesManager,
+  SecretsManager,
+  ServiceAccountManager,
+  VersionManager,
+} from './gcloud-k8s/index.mjs'
+
+const showKubernetesConfig = ( svcCfg ) => {
+  log( chalk.green`
+  Current k8s / gcloud settings:
+
+    Project => `, chalk.yellow( svcCfg.getK8sProject() ), chalk.green`
+    Cluster => `, chalk.yellow( svcCfg.getK8sCluster() ), `
+`
+  )
+}
+
+const start = async ( options ) => {
+
+  const CLI = await new CommandLine( options ).init()
+  const serviceManCfg = await new Config( options ).init( CLI )
+
+  // also let user know which gke/gcp context is going to be used
+  showKubernetesConfig( serviceManCfg )
+
+  if ( CLI.args.dumpConfigs ) {
+    await serviceManCfg.dump( CLI.args.dumpConfigs )
+    process.exit( 0 )
+  }
+
+  // create an unbound service account
+  if ( CLI.args.createSa ) {
+    await new ServiceAccountManager( serviceManCfg ).createServiceAccount( CLI.args.createSa, serviceManCfg.k8sProject )
+  }
+
+  // check for a service account and create it if needed
+  if ( CLI.args.createService ) {
+    await new ServiceAccountManager( serviceManCfg ).createBoundServiceAccount( CLI.args.createService )
+  }
+
+  // retrieve image and chart versions of all deployments on the cluster
+  if ( CLI.args.fetchVersions ) {
+    await new VersionManager( serviceManCfg ).start()
+    process.exit( 0 )
+  }
+
+  // create or update the custom IAM roles on the project
+  if ( CLI.args.setupRoles ) {
+    await new RolesManager( serviceManCfg ).start()
+  }
+
+  // build the service accounts
+  if ( CLI.args.setupServices ) {
+    await new ServiceAccountManager( serviceManCfg ).start( CLI )
+  }
+
+  // inject the randomly generated secrets
+  if ( CLI.args.setupSecrets ) {
+    await new SecretsManager( serviceManCfg ).start()
+  }
+
+  // synchronize a secret manager secret to its k8s secret counterpart
+  if ( CLI.args.syncSecrets ) {
+    await new SecretsManager( serviceManCfg ).synchronize()
+  }
+}
+
+export default {
+  start
+}