Level 3 (Detail) — The 6 reusable Terraform modules for cluster provisioning.
Concept#
Each Terragrunt layer maps to a Terraform module under clusters/tazlab-k8s/modules/. Modules are reusable across clusters; cluster-specific configuration comes from live/env.hcl.
Module Inventory#
1. secrets-fetcher#
| Field | Value |
|---|
| Layer | secrets (Layer 1) |
| Purpose | Fetch bootstrap secrets from operator environment (env vars da Vault o ~/secrets/) |
| Key inputs | PROXMOX_TOKEN_ID, PROXMOX_TOKEN_SECRET, TALOS_SECRETBOX_KEY (from env vars) |
| Key outputs | PROXMOX_TOKEN, TALOS_SECRETBOX_KEY |
2. proxmox-talos#
| Field | Value |
|---|
| Layer | platform (Layer 2) |
| Purpose | Create Proxmox VMs, bootstrap Talos cluster |
| Key inputs | Proxmox token, Talos config |
| Key outputs | Kubeconfig, talosconfig |
3. k8s-engine#
| Field | Value |
|---|
| Layer | engine (Layer 3) |
| Purpose | Bootstrap namespaces e bootstrap secrets per secret delivery (ESO + VSO), PGO user secrets pre-seed |
| Key inputs | vault_ca_cert, vault_eso_token, tailscale_client_id, tailscale_client_secret (stringhe dirette da env vars, non file path) + 4 PGO password vars |
| Key outputs | vault-ca-cert Secret (2 namespace), vault-eso-token Secret, tailscale-operator-oauth Secret, 4 PGO user Secrets |
Il modulo crea 4 K8s Secret Opaque bootstrap (senza ExternalSecret nè VSO):
vault-ca-cert (ca.crt) in external-secrets — per ESO ClusterSecretStore TLS validation (dormant)vault-ca-cert (ca.crt) in vso-system — per VSO VaultConnection TLS verification (attivo)vault-eso-token (token) in external-secrets — per ESO authentication su Vault (dormant)tailscale-operator-oauth (clientId + clientSecret) in tailscale — per Tailscale Operator join tailnet
Crea inoltre 4 PGO user Secrets nel namespace tazlab-db per adozione utenti PostgreSQL (tazlab-db-pguser-{tazlab-admin,grafana,mnemosyne,pgadmin}).
Nota: ESO e installato e gestito da Flux (HelmRelease), non da questo modulo. ESO e dormiente — Vault Secrets Operator (VSO) e l’operatore attivo per secret delivery via CRD VaultStaticSecret/VaultPKISecret/VaultDynamicSecret. Questo modulo prepara il namespace vso-system e il seed vault-ca-cert per VSO, ma VSO stesso e deployato da Flux in tazlab-k8s/infrastructure/operators/vso/.
4. k8s-networking#
| Field | Value |
|---|
| Layer | networking (Layer 4a) |
| Purpose | Install MetalLB v0.14.8, IPAddressPool, memberlist secret |
| Key inputs | MetalLB IP range (192.168.1.240-250) |
| Key outputs | LoadBalancer IP assignment |
5. k8s-flux#
| Field | Value |
|---|
| Layer | gitops (Layer 4b) |
| Purpose | Create cluster-vars ConfigMap, bootstrap Flux |
| Key inputs | GitHub token, Flux repo URL |
| Key outputs | Flux reconciliation of tazlab-k8s |
6. k8s-storage#
| Field | Value |
|---|
| Layer | storage (Layer 5) |
| Purpose | Install Longhorn v1.7.2, StorageClass, S3 backup |
| Key inputs | S3 bucket credentials (da Vault via ExternalSecret) |
| Key outputs | tazlab-storage StorageClass |
Build Order#
1. secrets ──► 2. platform ──► 3. engine ──► 4a. networking ──► 5. storage
└► 4b. gitops (parallel to networking)
6. gcp-services (standalone)
See Also#