From a0071415c49288859fa2e942607aeaed6d6a8b8f Mon Sep 17 00:00:00 2001 From: gitops_test Date: Thu, 8 Oct 2026 16:24:03 +0000 Subject: [PATCH] terraform: created terraform-configurations/9111/configuration-9111.tf --- .../9111/configuration-9111.tf | 82 +++++++++++++++++++ .../9111/credentials-9111_override.tf | 8 ++ .../9111/providers-9111.tf | 17 ++++ 3 files changed, 107 insertions(+) create mode 100644 terraform-configurations/9111/configuration-9111.tf create mode 100644 terraform-configurations/9111/credentials-9111_override.tf create mode 100644 terraform-configurations/9111/providers-9111.tf diff --git a/terraform-configurations/9111/configuration-9111.tf b/terraform-configurations/9111/configuration-9111.tf new file mode 100644 index 0000000..7d1bab2 --- /dev/null +++ b/terraform-configurations/9111/configuration-9111.tf @@ -0,0 +1,82 @@ +############################################################################## +# Deployment Script: HPC cluster (OVHcloud) +# +# Thin root calling the provisioner owned "hpc" catalog module. The module +# provisions a complete HPC cluster: one head node (the single entry point, +# running the Slurm controller, munge, the NFS shared home and the submission +# tools, reachable through a floating ip) and N compute nodes (private +# network only, Slurm execution daemon and OpenMPI, internet egress through a +# managed gateway). Every node is bootstrapped by cloud-init at first boot; +# the cluster forms itself with no manual step. +# +# The module generates the consumer password and the management SSH keypair +# and writes them to Vault under the existing path contract; only the Vault +# path is returned in the provisioning response. The response carries +# strictly the head node access information: compute nodes never appear in +# outputs or notifications. Credential renewal follows the standard catalog +# module rotation flow and re-applies the consumer password on the head node +# without touching any instance. +# +# No terraform/required_providers and no provider blocks are needed: the +# catalog module carries its own provider requirements, the cloud provider +# is configured from the runner environment and the Vault provider file is +# generated by the provisioner. +# +# Placeholders (all filled by the provisioner, never typed by the user): +# - the module source placeholder resolves to the hpc module of the +# cloudProvider sent in the request headers +# - 9111 is the scriptTriggerId of the request +# - development-test is the value of the cloudAccount header +# - 4db617f3-61f3-4d98-8d17-cef3fd125824 is the value of the requesterUniqueId header +############################################################################## + +module "hpc" { + source = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//hpc/ovh?ref=3.3.0-F-feature-simpl-33565.773.825d7dcb" + deployment_id = "9111" + cloud_account = "development-test" + requester_unique_id = "4db617f3-61f3-4d98-8d17-cef3fd125824" + + # OVHcloud region for the instances and the private network, for example + # SBG5 or GRA11 (the datacenter suffixed region, unlike managed databases). + region = "SBG5" + + # OVH public cloud project id. Unlike the other catalog modules this one + # needs it explicitly: its flavors/images data sources do not fall back to + # the runner environment, and resolving the project from the credential + # requires a read grant the scoped account keys usually lack. + project_id = "" + + # Cluster sizing: number of compute nodes, flavors per role and the + # schedulable CPUs per compute node declared to the Slurm controller + # (must not exceed the vCPUs of compute_flavor). + compute_node_count = 2 + head_flavor = "b3-8" + compute_flavor = "b3-8" + compute_cpus = 2 + + # Private cluster network: CIDR and a vRack VLAN id unused in the project. + # The head node takes host 50 and compute nodes host 60 onward; the lower + # pool addresses stay free for the DHCP agent ports. + cluster_cidr = "192.168.100.0/24" + vlan_id = 212 +} + +output "head_node_ip" { + value = module.hpc.head_node_ip +} + +output "head_node_hostname" { + value = module.hpc.head_node_hostname +} + +output "ssh_port" { + value = module.hpc.ssh_port +} + +output "vmIps" { + value = module.hpc.vmIps +} + +output "credentials_ref" { + value = module.hpc.credentials_ref +} diff --git a/terraform-configurations/9111/credentials-9111_override.tf b/terraform-configurations/9111/credentials-9111_override.tf new file mode 100644 index 0000000..cf0f0ef --- /dev/null +++ b/terraform-configurations/9111/credentials-9111_override.tf @@ -0,0 +1,8 @@ +// Generated by the provisioner. Credential rotation marker for the catalog +// modules of this deployment: the credential renewal workflow rewrites the +// version value to rotate the generated credentials. Terraform merges these +// blocks into the module blocks of the deployment script through the +// override file mechanism, so the deployment script never declares them. +module "hpc" { + credentials_version = "1" +} diff --git a/terraform-configurations/9111/providers-9111.tf b/terraform-configurations/9111/providers-9111.tf new file mode 100644 index 0000000..9e1841c --- /dev/null +++ b/terraform-configurations/9111/providers-9111.tf @@ -0,0 +1,17 @@ +// Generated by the provisioner. Vault provider configuration for catalog +// modules that store generated credentials. Authentication is the Kubernetes +// service account of the Terraform runner, exchanged for a Vault token +// through the Kubernetes auth method, never a value from this file or the +// user body. +provider "vault" { + address = "https://secrets.common01.dev-sandbox-ionos.simpl-europe.eu" + skip_child_token = true + + auth_login { + path = "auth/kubernetes/login" + parameters = { + role = "provisioner-role" + jwt = file("/var/run/secrets/kubernetes.io/serviceaccount/token") + } + } +}