Install the toolchain

Before this: Building blocks you will touch oriented EKS, Argo CD, Gatekeeper, gator, and MCP.

This page is install only — no policy walkthrough, no Kiro session. If tool names are still fuzzy, skim Concepts first (including the constraint set), then come back. Run every factory command in jajera/kiro-eks-argocd-migration, not in this docs repo.

You need a clone, pinned gatorgator
Gatekeeper offline CLI — runs `gator verify` against constraint suites without a live cluster (Lab A)., kustomizekustomize
Kubernetes config tool that builds base + overlay trees into deployable manifests without templates., and (for Lab C) KiroKiro
Amazon's agentic IDE — runs vibe or spec sessions against the factory's `.kiro/` steering, skills, and hooks.. You do not need a live EKSEKS
Amazon Elastic Kubernetes Service — the managed Kubernetes control plane this factory targets. API, Argo CDArgo CD
GitOps continuous delivery controller that syncs Kubernetes manifests from Git into the cluster. login, or cluster MCPMCP
Model Context Protocol adapters — docs MCP stays on; live cluster adapters stay off until a human intentionally enables them. adapters for Labs A–C.

1. Clone the factory repo

git clone https://github.com/jajera/kiro-eks-argocd-migration.git
cd kiro-eks-argocd-migration

Stay in that directory for every later lab command. This docs site has no runnable factory tree.

2. Install gator (Lab A)

./scripts/install-gator.sh "$HOME/.local/bin"
export PATH="$HOME/.local/bin:$PATH"
gator version

Expect gator CLI 3.22.0 (GATOR_VERSION default in scripts/install-gator.sh). The script is checksum-verified against the matching release — a different version means the pin was bumped upstream; check the factory README before assuming your install is broken.

Why gator and the vendored chart disagree on version

That pin differs from the GatekeeperGatekeeper
OPA Gatekeeper — Kubernetes admission controller that evaluates ConstraintTemplates against cluster objects. Helm chart version / appVersion 3.21.1 in infrastructure/gatekeeper/base/vendored/chart/gatekeeper/Chart.yaml. This is expected: the CLI and the chart are separate artifacts on their own release schedules. Gator’s constraint-testing behavior is compatible across that gap. Keep the CLI at 3.22.0 — do not downgrade it to match the chart. Bumping either pin is a deliberate edit to scripts/install-gator.sh (version + checksum map) and the README together.

Leaving the skew unexplained produces confusing gator verifygator verify
Offline Gatekeeper test runner that evaluates constraint suites and cases before any cluster exists. failures that look like a broken install — see Known scars if you hit that.

3. Confirm the rest of the toolchain

Tool	Needed for	Notes
kustomizekustomize Kubernetes config tool that builds base + overlay trees into deployable manifests without templates.	Labs A–C	Overlay builds and local verify
Node / npx	Local markdown / lint gates when factory scripts call them	Match whatever the factory README pins
KiroKiro Amazon's agentic IDE — runs vibe or spec sessions against the factory's `.kiro/` steering, skills, and hooks.	Lab C	Agent sessions against .kiro/
terraform	Reading iam.tf only	Not required to run Labs A–C; the factory drafts IAM, you do not need to apply it to follow along

Note

This is a starter toolchain for Labs A–C, not a closed inventory. Add Helm, kubectl, or AWS CLI when you move past offline labs — keep them out of the path until you need them so the offline story stays reproducible.

4. Placeholders and live AWS (skip for Labs A–C)

Offline labs run on the shape-valid dummies already in the factory. Skip this section until you intend to touch a real AWS account. Account IDs and region live in .kiro/steering/project-profile.md; ACM and WAFv2WAFv2
AWS WAFv2 — current WAF API; `k8singresswafv2` requires a valid regional Web ACL ARN on public Ingress. ARN dummies are written per overlay on each app’s Ingress (same shapes the skills scaffold).

Placeholder	Stands in for	Replace before
111122223333	Dev AWS account ID (dev-eks-1)	Live IAMIAM AWS Identity and Access Management — you still shrink roles to least privilege; the factory does not invent that judgement., ECRECR Amazon Elastic Container Registry — image registry used when the factory retags or pulls app images., Ingress ARNs
444455556666	Prod AWS account ID (prod-eks-1)	Live IAM, ECR pull, Ingress ARNs
ap-southeast-2	AWS region	Clusters, ECR, ARN region segments
arn:aws:acm:…:certificate/00000000-…-0001 (dev) / …-0002 (prod)	ACM certificate ARN on the ALB Ingress	Live HTTPS Ingress
arn:aws:wafv2:…:regional/webacl/<app>/00000000-…	Regional Web ACLWeb ACL WAFv2 Web ACL — the filter set attached to an ALB; internet-facing Ingress must reference a regional ARN. ARN (wafv2-acl-arn)	Live internet-facing Ingress; WAF policy stays dryrun until real ARNs exist

Dev and prod are separate accounts, so certificate and WAF ARNs always differ per overlay — they must not live in base. The zero-padded UUID dummies exist only so kustomize build and gator test --deny-only pass in Git; they are not deployable.

Image digests, hostnames, and AWS_PROFILE are filled per app or local credentials when you leave offline labs — not a one-shot edit during setup. This factory does not scaffold Cognito / ALB auth ARN placeholders today; if an app needs Cognito, supply real User Pool and client ARNs in the overlay when you add that pattern — do not invent a bare REPLACE_* token.

Caution

Replace placeholder accounts 111122223333 (dev / dev-eks-1) and 444455556666 (prod / prod-eks-1), region ap-southeast-2, and every dummy ACM / WAFv2 ARN before live IAMIAM
AWS Identity and Access Management — you still shrink roles to least privilege; the factory does not invent that judgement., ECRECR
Amazon Elastic Container Registry — image registry used when the factory retags or pulls app images., or Ingress work. Offline labs still run with the placeholders.

Ready checklist

• pwd is inside kiro-eks-argocd-migration
• gator version prints 3.22.0
• kustomize version works
• PATH includes the directory where you installed gator
• Kiro is installed if you will run Lab C
• You are not waiting on cluster credentials for Lab A

Next: Prove policy offline (Lab A) — offline gator verify and policy overlay builds.