The K8s demo runbook, line by line

set -gx is the fish-shell way of saying "create a global, exported variable" (the same as export in bash). STORE points at the folder that will hold your environment's saved state. HERE points at the folder containing the two JSON files that describe the demo.

So every command below can write $STORE / $HERE instead of repeating long paths — fewer typos, easier to read.

kind = "Kubernetes IN Docker." It runs a complete, throwaway Kubernetes cluster inside Docker containers on your machine — no cloud account needed. The first line creates the cluster gtc-demo; the second writes its connection details into your kubeconfig so kubectl knows how to reach it (and makes it the active context).

You need somewhere to deploy. kind is your local stand-in for a real cloud Kubernetes cluster, free and disposable. It's "one-time" because the cluster survives between demo runs.

First line downloads the latest :develop worker image from GitHub's container registry (ghcr.io) to your local Docker. Second line copies that image from your local Docker into the kind cluster's internal image cache.

:develop is a moving tag — it points at a different build every time someone publishes. Kubernetes, seeing a tag it already has cached, won't bother re-downloading it and would happily run a stale copy. Pulling fresh and side-loading guarantees the cluster runs today's worker code, not last week's.

env VAR=value cmd runs the command with one extra environment variable set — here, your bot token, passed in memory so it never gets written to a file. gtc-dev op is the Greentic operator CLI. It reads k8s.env.json (the "env-manifest" — your declared intent for the whole environment) and reconciles the store to match it: it creates the environment, seeds its trust root, binds the two packs (the K8s deployer + the dev-store for secrets), pulls the bundle once from its OCI address and verifies its digest, registers the Telegram endpoint, and saves the bot token. --yes skips the confirmation prompt.

This is the single declarative "describe everything" step. Instead of a dozen little setup commands, one manifest captures the desired state and apply makes the store match it. It's also the only place the bot token is needed — every later command is token-free.

Takes the environment named local from the store and applies it to the running cluster: it creates the namespace, a ConfigMap with the environment config, a Secret holding the bot token, a NetworkPolicy, and the worker Deployment. The worker pod then boots, pulls the bundle from ghcr, re-checks the digest, starts serving the chat flow, opens a public tunnel, and auto-registers the Telegram webhook.

Step 3 only updated your local store. This is the step that actually changes the cluster. Splitting them means you can review/author safely first, then deploy as a distinct action.

Line 1 asks Kubernetes for the worker Deployment's name and stores it in WORKER (string match '*worker*' is a fish filter that keeps the line containing "worker"). Line 2 waits — up to 4 minutes — for the worker to finish rolling out and become Ready. Line 3 connects your laptop's localhost:8081 straight to the pod's port 8081.

The webchat console is served only on the worker's loopback admin listener (port 8081), never on the public port. Port-forwarding is a direct laptop→pod tunnel that bypasses the public edge entirely — so you reach the console locally even while the public port is busy serving Telegram. Telegram itself needs nothing more: the worker already told Telegram where to send messages when it booted.

Kills the background port-forward process by matching its command line (the alternative is just Ctrl+C in its terminal).

The forward runs until you stop it; this frees port 8081 and ends the laptop→pod connection.

Removes the entire kind cluster (containers, node, cached images) and deletes the local store directory.

Full teardown — nothing keeps running or consuming disk/CPU after you're done.

Asks Telegram to drop the webhook URL it had on file for your bot.

That webhook pointed at the temporary tunnel address, which is gone now that the cluster is down. If you don't clear it, Telegram keeps retrying delivery to a dead URL. Pure hygiene — and it leaves the bot clean for next time.

Deletes just the gtc-local namespace (everything the demo created) and resets the store folder — keeping the kind cluster itself alive.

A lighter reset for re-running the demo from scratch without paying the cost of recreating the whole cluster. --ignore-not-found means "don't error if it's already gone"; --wait means "block until it's fully deleted" so the next run starts truly clean.