kubeadm init --config kubeadm-init.conf --upload-certs
# run control plane join command printed by kubeadm on additional masters

kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64  | tr -d '\n')&env.NO_MASQ_LOCAL=1"

kubectl taint nodes --all node-role.kubernetes.io/master-

kubectl get pod --all-namespaces -owide --watch

kubectl apply -f 00-namespace.yaml -f metallb-system

kubectl apply -f /path/to/kubeseal-secret-key
kubectl apply -f kube-system/kubeseal

kubectl apply -f flux
fluxctl --k8s-fwd-ns flux identity  # add key to GitHub with write access
# wait a bit for repo clone
fluxctl --k8s-fwd-ns flux sync

# Ignore
kubectl annotate <resource> "flux.weave.works/ignore"

# Unignore
kubectl annotate <resource> "flux.weave.works/ignore"-

# Ignore all in namespace
# (doesn't seem like there is --all-namespaces for this.)
kubectl -n default annotate all --all "flux.weave.works/ignore"

# Unignore all in namespace
kubectl -n default annotate all --all "flux.weave.works/ignore"-