terraform: created terraform-configurations/9111/configuration-9111.tf

terraform-configurations/9111/configuration-9111.tf

@@ -0,0 +1,82 @@
+##############################################################################
+# Deployment Script: HPC cluster (OVHcloud)
+#
+# Thin root calling the provisioner owned "hpc" catalog module. The module
+# provisions a complete HPC cluster: one head node (the single entry point,
+# running the Slurm controller, munge, the NFS shared home and the submission
+# tools, reachable through a floating ip) and N compute nodes (private
+# network only, Slurm execution daemon and OpenMPI, internet egress through a
+# managed gateway). Every node is bootstrapped by cloud-init at first boot;
+# the cluster forms itself with no manual step.
+#
+# The module generates the consumer password and the management SSH keypair
+# and writes them to Vault under the existing path contract; only the Vault
+# path is returned in the provisioning response. The response carries
+# strictly the head node access information: compute nodes never appear in
+# outputs or notifications. Credential renewal follows the standard catalog
+# module rotation flow and re-applies the consumer password on the head node
+# without touching any instance.
+#
+# No terraform/required_providers and no provider blocks are needed: the
+# catalog module carries its own provider requirements, the cloud provider
+# is configured from the runner environment and the Vault provider file is
+# generated by the provisioner.
+#
+# Placeholders (all filled by the provisioner, never typed by the user):
+#   - the module source placeholder resolves to the hpc module of the
+#     cloudProvider sent in the request headers
+#   - 9111 is the scriptTriggerId of the request
+#   - development-test is the value of the cloudAccount header
+#   - 4db617f3-61f3-4d98-8d17-cef3fd125824 is the value of the requesterUniqueId header
+##############################################################################
+
+module "hpc" {
+  source              = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//hpc/ovh?ref=3.3.0-F-feature-simpl-33565.773.825d7dcb"
+  deployment_id       = "9111"
+  cloud_account       = "development-test"
+  requester_unique_id = "4db617f3-61f3-4d98-8d17-cef3fd125824"
+
+  # OVHcloud region for the instances and the private network, for example
+  # SBG5 or GRA11 (the datacenter suffixed region, unlike managed databases).
+  region = "SBG5"
+
+  # OVH public cloud project id. Unlike the other catalog modules this one
+  # needs it explicitly: its flavors/images data sources do not fall back to
+  # the runner environment, and resolving the project from the credential
+  # requires a read grant the scoped account keys usually lack.
+  project_id = "<project id>"
+
+  # Cluster sizing: number of compute nodes, flavors per role and the
+  # schedulable CPUs per compute node declared to the Slurm controller
+  # (must not exceed the vCPUs of compute_flavor).
+  compute_node_count = 2
+  head_flavor        = "b3-8"
+  compute_flavor     = "b3-8"
+  compute_cpus       = 2
+
+  # Private cluster network: CIDR and a vRack VLAN id unused in the project.
+  # The head node takes host 50 and compute nodes host 60 onward; the lower
+  # pool addresses stay free for the DHCP agent ports.
+  cluster_cidr = "192.168.100.0/24"
+  vlan_id      = 212
+}
+
+output "head_node_ip" {
+  value = module.hpc.head_node_ip
+}
+
+output "head_node_hostname" {
+  value = module.hpc.head_node_hostname
+}
+
+output "ssh_port" {
+  value = module.hpc.ssh_port
+}
+
+output "vmIps" {
+  value = module.hpc.vmIps
+}
+
+output "credentials_ref" {
+  value = module.hpc.credentials_ref
+}

terraform-configurations/9111/credentials-9111_override.tf

@@ -0,0 +1,8 @@
+// Generated by the provisioner. Credential rotation marker for the catalog
+// modules of this deployment: the credential renewal workflow rewrites the
+// version value to rotate the generated credentials. Terraform merges these
+// blocks into the module blocks of the deployment script through the
+// override file mechanism, so the deployment script never declares them.
+module "hpc" {
+  credentials_version = "1"
+}

terraform-configurations/9111/providers-9111.tf

@@ -0,0 +1,17 @@
+// Generated by the provisioner. Vault provider configuration for catalog
+// modules that store generated credentials. Authentication is the Kubernetes
+// service account of the Terraform runner, exchanged for a Vault token
+// through the Kubernetes auth method, never a value from this file or the
+// user body.
+provider "vault" {
+  address          = "https://secrets.common01.dev-sandbox-ionos.simpl-europe.eu"
+  skip_child_token = true
+
+  auth_login {
+    path = "auth/kubernetes/login"
+    parameters = {
+      role = "provisioner-role"
+      jwt  = file("/var/run/secrets/kubernetes.io/serviceaccount/token")
+    }
+  }
+}