28 lines
1.0 KiB
Markdown
28 lines
1.0 KiB
Markdown
# Optional production-style path
|
|
|
|
This directory provisions one encrypted Flatcar EC2 host with a deliberately
|
|
small network surface. It is a scaffold for the documented cloud path; the
|
|
local k3d path remains the primary, cost-free portfolio demo.
|
|
|
|
The AWS account, region, Flatcar AMI, SSH key pair, and administrator CIDR are inputs,
|
|
not repository values. Do not commit a real `terraform.tfvars` file or private
|
|
keys. The security group intentionally exposes SSH and the Kubernetes API only
|
|
to `admin_cidr`; add any public application ports explicitly when needed.
|
|
|
|
Example workflow:
|
|
|
|
```bash
|
|
cp terraform.tfvars.example terraform.tfvars
|
|
# Edit every replace-* value and set admin_cidr to your current IP /32.
|
|
terraform init
|
|
terraform validate
|
|
terraform plan
|
|
terraform apply
|
|
terraform output -raw public_ip
|
|
```
|
|
|
|
Then run `ansible/bootstrap-k3s.yml` against the output IP. Configure the
|
|
Cilium API endpoint before installing Cilium. `terraform destroy`
|
|
removes the lab resources when finished. This path is not required for the
|
|
portfolio demo and is not invoked by CI.
|