This directory provisions one encrypted Flatcar EC2 host with a deliberately small network surface. It is a scaffold for the documented cloud path; the local k3d path remains the primary, cost-free portfolio demo.

The AWS account, region, Flatcar AMI, SSH key pair, and administrator CIDR are inputs, not repository values. Do not commit a real terraform.tfvars file or private keys. The security group intentionally exposes SSH and the Kubernetes API only to admin_cidr; add any public application ports explicitly when needed.

Example workflow:

cp terraform.tfvars.example terraform.tfvars
# Edit every replace-* value and set admin_cidr to your current IP /32.
terraform init
terraform validate
terraform plan
terraform apply
terraform output -raw public_ip

Then run ansible/bootstrap-k3s.yml against the output IP. Configure the Cilium API endpoint before installing Cilium. terraform destroy removes the lab resources when finished. This path is not required for the portfolio demo and is not invoked by CI.