terraform: created terraform-configurations/9191/configuration-9191.tf

terraform-configurations/9191/configuration-9191.tf

@@ -0,0 +1,77 @@
+##############################################################################
+# Deployment Script: Managed Kubernetes cluster (OVHcloud)
+#
+# Thin root calling the provisioner owned "kubernetes" catalog module. The
+# module provisions an OVH Managed Kubernetes (MKS) cluster with one node
+# pool and generates the access credentials: the consumer receives a scoped
+# ServiceAccount kubeconfig with a non expiring token, valid until a
+# credential renewal is requested; day 2 renewal uses a dedicated root
+# kubeconfig. All credential material is written by the
+# module to Vault under the existing path contract; only the Vault path is
+# returned in the provisioning response. The OVH admin certificates are
+# never delivered.
+#
+# No terraform/required_providers and no provider blocks are needed: the
+# catalog module carries its own provider requirements, the cloud provider
+# is configured from the runner environment and the Vault provider file is
+# generated by the provisioner.
+#
+# Placeholders (all filled by the provisioner, never typed by the user):
+#   - the module source placeholder resolves to the kubernetes module of the
+#     cloudProvider sent in the request headers
+#   - 9191 is the scriptTriggerId of the request
+#   - development-test is the value of the cloudAccount header
+#   - test_1 is the value of the requesterUniqueId header
+##############################################################################
+
+module "kubernetes" {
+  source              = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//kubernetes/ovh?ref=3.2.0-F-feature-simpl-31668.650.242a7609"
+  deployment_id       = "9191"
+  cloud_account       = "development-test"
+  requester_unique_id = "test_1"
+
+  # OVHcloud region. Must support Managed Kubernetes (OVH API:
+  # /cloud/project/{id}/capabilities/kube/regions). The project itself is not
+  # set here: the provider resolves it from the cloud account configuration
+  # of the environment (OVH_CLOUD_PROJECT_SERVICE in the runner environment).
+  region = "SBG5"
+
+  # Cluster: version must be one of the versions currently supported by OVH
+  # MKS; update_policy is ALWAYS_UPDATE, MINIMAL_DOWNTIME or NEVER_UPDATE.
+  k8s_version       = "1.32"
+  k8s_update_policy = "ALWAYS_UPDATE"
+
+  # Node pool sizing. Set nodepool_autoscale = true to enable the OVH managed
+  # cluster autoscaler between min and max nodes.
+  nodepool_flavor        = "b3-8"
+  nodepool_desired_nodes = 3
+  nodepool_min_nodes     = 1
+  nodepool_max_nodes     = 5
+  nodepool_autoscale     = false
+
+  # Optional private mode: attach the worker nodes to an existing vRack
+  # network of the same project. Leave unset for a public cluster.
+  # private_network_id = "<openstack network id>"
+  # nodes_subnet_id    = "<subnet id>"
+  # gateway_ip         = "<vrack gateway ip>"
+}
+
+output "cluster_id" {
+  value = module.kubernetes.cluster_id
+}
+
+output "cluster_name" {
+  value = module.kubernetes.cluster_name
+}
+
+output "cluster_url" {
+  value = module.kubernetes.cluster_url
+}
+
+output "cluster_version" {
+  value = module.kubernetes.cluster_version
+}
+
+output "credentials_ref" {
+  value = module.kubernetes.credentials_ref
+}

terraform-configurations/9191/providers-9191.tf

@@ -0,0 +1,7 @@
+// Generated by the provisioner. Vault provider configuration for catalog
+// modules that store generated credentials. Authentication comes from the
+// runner environment (VAULT_TOKEN), never from this file or the user body.
+provider "vault" {
+  address          = "https://secrets.common01.dev-sandbox-ionos.simpl-europe.eu"
+  skip_child_token = true
+}