diff --git a/terraform-configurations/9191/configuration-9191.tf b/terraform-configurations/9191/configuration-9191.tf new file mode 100644 index 0000000..a6343dc --- /dev/null +++ b/terraform-configurations/9191/configuration-9191.tf @@ -0,0 +1,77 @@ +############################################################################## +# Deployment Script: Managed Kubernetes cluster (OVHcloud) +# +# Thin root calling the provisioner owned "kubernetes" catalog module. The +# module provisions an OVH Managed Kubernetes (MKS) cluster with one node +# pool and generates the access credentials: the consumer receives a scoped +# ServiceAccount kubeconfig with a non expiring token, valid until a +# credential renewal is requested; day 2 renewal uses a dedicated root +# kubeconfig. All credential material is written by the +# module to Vault under the existing path contract; only the Vault path is +# returned in the provisioning response. The OVH admin certificates are +# never delivered. +# +# No terraform/required_providers and no provider blocks are needed: the +# catalog module carries its own provider requirements, the cloud provider +# is configured from the runner environment and the Vault provider file is +# generated by the provisioner. +# +# Placeholders (all filled by the provisioner, never typed by the user): +# - the module source placeholder resolves to the kubernetes module of the +# cloudProvider sent in the request headers +# - 9191 is the scriptTriggerId of the request +# - development-test is the value of the cloudAccount header +# - test_1 is the value of the requesterUniqueId header +############################################################################## + +module "kubernetes" { + source = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//kubernetes/ovh?ref=3.2.0-F-feature-simpl-31668.652.99e22161" + deployment_id = "9191" + cloud_account = "development-test" + requester_unique_id = "test_1" + + # OVHcloud region. Must support Managed Kubernetes (OVH API: + # /cloud/project/{id}/capabilities/kube/regions). The project itself is not + # set here: the provider resolves it from the cloud account configuration + # of the environment (OVH_CLOUD_PROJECT_SERVICE in the runner environment). + region = "SBG5" + + # Cluster: version must be one of the versions currently supported by OVH + # MKS; update_policy is ALWAYS_UPDATE, MINIMAL_DOWNTIME or NEVER_UPDATE. + k8s_version = "1.32" + k8s_update_policy = "ALWAYS_UPDATE" + + # Node pool sizing. Set nodepool_autoscale = true to enable the OVH managed + # cluster autoscaler between min and max nodes. + nodepool_flavor = "b3-8" + nodepool_desired_nodes = 3 + nodepool_min_nodes = 1 + nodepool_max_nodes = 5 + nodepool_autoscale = false + + # Optional private mode: attach the worker nodes to an existing vRack + # network of the same project. Leave unset for a public cluster. + # private_network_id = "" + # nodes_subnet_id = "" + # gateway_ip = "" +} + +output "cluster_id" { + value = module.kubernetes.cluster_id +} + +output "cluster_name" { + value = module.kubernetes.cluster_name +} + +output "cluster_url" { + value = module.kubernetes.cluster_url +} + +output "cluster_version" { + value = module.kubernetes.cluster_version +} + +output "credentials_ref" { + value = module.kubernetes.credentials_ref +} diff --git a/terraform-configurations/9191/providers-9191.tf b/terraform-configurations/9191/providers-9191.tf new file mode 100644 index 0000000..00a6d10 --- /dev/null +++ b/terraform-configurations/9191/providers-9191.tf @@ -0,0 +1,7 @@ +// Generated by the provisioner. Vault provider configuration for catalog +// modules that store generated credentials. Authentication comes from the +// runner environment (VAULT_TOKEN), never from this file or the user body. +provider "vault" { + address = "https://secrets.common01.dev-sandbox-ionos.simpl-europe.eu" + skip_child_token = true +}