diff --git a/terraform-configurations/b74abeed-7afd-4be7-880f-de610bbb02c8/configuration-b74abeed-7afd-4be7-880f-de610bbb02c8.tf b/terraform-configurations/b74abeed-7afd-4be7-880f-de610bbb02c8/configuration-b74abeed-7afd-4be7-880f-de610bbb02c8.tf
new file mode 100644
index 0000000..378e403
--- /dev/null
+++ b/terraform-configurations/b74abeed-7afd-4be7-880f-de610bbb02c8/configuration-b74abeed-7afd-4be7-880f-de610bbb02c8.tf
@@ -0,0 +1,77 @@
+##############################################################################
+# Deployment Script: Managed Kubernetes cluster (OVHcloud)
+#
+# Thin root calling the provisioner owned "kubernetes" catalog module. The
+# module provisions an OVH Managed Kubernetes (MKS) cluster with one node
+# pool and generates the access credentials: the consumer receives a scoped
+# ServiceAccount kubeconfig with a non expiring token, valid until a
+# credential renewal is requested; day 2 renewal uses a dedicated root
+# kubeconfig. All credential material is written by the
+# module to Vault under the existing path contract; only the Vault path is
+# returned in the provisioning response. The OVH admin certificates are
+# never delivered.
+#
+# No terraform/required_providers and no provider blocks are needed: the
+# catalog module carries its own provider requirements, the cloud provider
+# is configured from the runner environment and the Vault provider file is
+# generated by the provisioner.
+#
+# Placeholders (all filled by the provisioner, never typed by the user):
+#   - the module source placeholder resolves to the kubernetes module of the
+#     cloudProvider sent in the request headers
+#   - b74abeed-7afd-4be7-880f-de610bbb02c8 is the scriptTriggerId of the request
+#   - development-test is the value of the cloudAccount header
+#   - 12689585-5a76-402b-9a7d-4d56a4a008d2 is the value of the requesterUniqueId header
+##############################################################################
+
+module "kubernetes" {
+  source              = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//kubernetes/ovh?ref=3.2.0-F-feature-simpl-31672.683.51d1d4ae"
+  deployment_id       = "b74abeed-7afd-4be7-880f-de610bbb02c8"
+  cloud_account       = "development-test"
+  requester_unique_id = "12689585-5a76-402b-9a7d-4d56a4a008d2"
+
+  # OVHcloud region. Must support Managed Kubernetes (OVH API:
+  # /cloud/project/{id}/capabilities/kube/regions). The project itself is not
+  # set here: the provider resolves it from the cloud account configuration
+  # of the environment (OVH_CLOUD_PROJECT_SERVICE in the runner environment).
+  region = "SBG5"
+
+  # Cluster: version must be one of the versions currently supported by OVH
+  # MKS; update_policy is ALWAYS_UPDATE, MINIMAL_DOWNTIME or NEVER_UPDATE.
+  k8s_version       = "1.32"
+  k8s_update_policy = "ALWAYS_UPDATE"
+
+  # Node pool sizing. Set nodepool_autoscale = true to enable the OVH managed
+  # cluster autoscaler between min and max nodes.
+  nodepool_flavor        = "b3-8"
+  nodepool_desired_nodes = 3
+  nodepool_min_nodes     = 1
+  nodepool_max_nodes     = 5
+  nodepool_autoscale     = false
+
+  # Optional private mode: attach the worker nodes to an existing vRack
+  # network of the same project. Leave unset for a public cluster.
+  # private_network_id = "<openstack network id>"
+  # nodes_subnet_id    = "<subnet id>"
+  # gateway_ip         = "<vrack gateway ip>"
+}
+
+output "cluster_id" {
+  value = module.kubernetes.cluster_id
+}
+
+output "cluster_name" {
+  value = module.kubernetes.cluster_name
+}
+
+output "cluster_url" {
+  value = module.kubernetes.cluster_url
+}
+
+output "cluster_version" {
+  value = module.kubernetes.cluster_version
+}
+
+output "credentials_ref" {
+  value = module.kubernetes.credentials_ref
+}
diff --git a/terraform-configurations/b74abeed-7afd-4be7-880f-de610bbb02c8/credentials-b74abeed-7afd-4be7-880f-de610bbb02c8_override.tf b/terraform-configurations/b74abeed-7afd-4be7-880f-de610bbb02c8/credentials-b74abeed-7afd-4be7-880f-de610bbb02c8_override.tf
new file mode 100644
index 0000000..93fe85b
--- /dev/null
+++ b/terraform-configurations/b74abeed-7afd-4be7-880f-de610bbb02c8/credentials-b74abeed-7afd-4be7-880f-de610bbb02c8_override.tf
@@ -0,0 +1,8 @@
+// Generated by the provisioner. Credential rotation marker for the catalog
+// modules of this deployment: the credential renewal workflow rewrites the
+// version value to rotate the generated credentials. Terraform merges these
+// blocks into the module blocks of the deployment script through the
+// override file mechanism, so the deployment script never declares them.
+module "kubernetes" {
+  credentials_version = "1"
+}
diff --git a/terraform-configurations/b74abeed-7afd-4be7-880f-de610bbb02c8/providers-b74abeed-7afd-4be7-880f-de610bbb02c8.tf b/terraform-configurations/b74abeed-7afd-4be7-880f-de610bbb02c8/providers-b74abeed-7afd-4be7-880f-de610bbb02c8.tf
new file mode 100644
index 0000000..9e1841c
--- /dev/null
+++ b/terraform-configurations/b74abeed-7afd-4be7-880f-de610bbb02c8/providers-b74abeed-7afd-4be7-880f-de610bbb02c8.tf
@@ -0,0 +1,17 @@
+// Generated by the provisioner. Vault provider configuration for catalog
+// modules that store generated credentials. Authentication is the Kubernetes
+// service account of the Terraform runner, exchanged for a Vault token
+// through the Kubernetes auth method, never a value from this file or the
+// user body.
+provider "vault" {
+  address          = "https://secrets.common01.dev-sandbox-ionos.simpl-europe.eu"
+  skip_child_token = true
+
+  auth_login {
+    path = "auth/kubernetes/login"
+    parameters = {
+      role = "provisioner-role"
+      jwt  = file("/var/run/secrets/kubernetes.io/serviceaccount/token")
+    }
+  }
+}