Forte/launchpad
6
0
Fork 0
Code Issues Pull Requests Actions Packages Wiki Activity

strip cluster bootstraps
All checks were successful
AI Code Review / ai-review (pull_request) Successful in 59s
Details

Browse Source
This commit is contained in:
Danijel Simeunovic
2026-04-27 21:34:11 +02:00
parent 0353803d4f
commit 96dde22884
42 changed files with 65 additions and 2338 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.tofu/platforms/aks/dev/.terraform.tfstate.lock.info
View File

@@ -1 +0,0 @@
{"ID":"7c7a5ed8-5425-abc4-53ed-9cbf76e65e05","Operation":"OperationTypePlan","Info":"","Who":"danijels@PF44RC05","Version":"1.11.6","Created":"2026-04-27T19:11:57.353171472Z","Path":"terraform.tfstate"}

23
.tofu/platforms/aks/dev/main.tf
View File

@@ -1,33 +1,14 @@
module "cluster" {
source = "../modules/cluster"
prefix = "devhub-dev"
prefix = "clst-dev"
location = "norwayeast"
resource_group_name = "devhub-dev-rg"
resource_group_name = "clst-dev-rg"
# AKS — small dev nodes
aks_node_vm_size = "Standard_B2s"
aks_node_count = 2
# PostgreSQL — burstable tier for dev
pg_sku_name = "B_Standard_B1ms"
pg_version = "16"
pg_storage_mb = 32768
pg_backup_retention_days = 7
pg_ha_mode = "Disabled"
# Redis — Basic C0 (250 MB) for dev
redis_sku_name = "Basic"
redis_family = "C"
redis_capacity = 0
# Blob storage — locally-redundant for dev
storage_replication = "LRS"
# DNS — must match an existing Azure DNS zone
domain = "dev.example.com" # TODO: set to your actual domain
# dns_zone_resource_group = "my-dns-rg" # uncomment if DNS zone is in a separate RG
enable_delete_lock = false
tags = {

73
.tofu/platforms/aks/dev/outputs.tf
View File

@@ -16,76 +16,11 @@ output "location" {
value = module.cluster.location
}
# ─── PostgreSQL ───────────────────────────────────────────────────────
output "pg_host" {
value = module.cluster.pg_host
output "oidc_issuer_url" {
value = module.cluster.oidc_issuer_url
}
output "pg_port" {
value = module.cluster.pg_port
}
output "pg_admin_login" {
value = module.cluster.pg_admin_login
}
output "pg_admin_password" {
value = module.cluster.pg_admin_password
sensitive = true
}
output "pg_keycloak_password" {
value = module.cluster.pg_keycloak_password
sensitive = true
}
output "pg_gitlab_password" {
value = module.cluster.pg_gitlab_password
sensitive = true
}
# ─── Redis ────────────────────────────────────────────────────────────
output "redis_host" {
value = module.cluster.redis_host
}
output "redis_port" {
value = module.cluster.redis_port
}
output "redis_password" {
value = module.cluster.redis_password
sensitive = true
}
# ─── Blob Storage ─────────────────────────────────────────────────────
output "storage_account_name" {
value = module.cluster.storage_account_name
}
output "storage_primary_access_key" {
value = module.cluster.storage_primary_access_key
sensitive = true
}
output "gitlab_identity_client_id" {
value = module.cluster.gitlab_identity_client_id
}
# ─── Entra ID ────────────────────────────────────────────────────────
output "entra_tenant_id" {
value = module.cluster.entra_tenant_id
}
output "entra_keycloak_client_id" {
value = module.cluster.entra_keycloak_client_id
}
output "entra_keycloak_client_secret" {
value = module.cluster.entra_keycloak_client_secret
output "kubeconfig" {
value = module.cluster.kubeconfig
sensitive = true
}

12
.tofu/platforms/aks/dev/providers.tf
View File

@@ -6,14 +6,6 @@ terraform {
source = "hashicorp/azurerm"
version = "~> 4.0"
}
azuread = {
source = "hashicorp/azuread"
version = "~> 3.0"
}
random = {
source = "hashicorp/random"
version = "~> 3.0"
}
}
}
@@ -23,7 +15,3 @@ provider "azurerm" {
# ARM_SUBSCRIPTION_ID, ARM_TENANT_ID, ARM_CLIENT_ID, ARM_CLIENT_SECRET
# Or: az login (uses your Azure CLI session)
}
provider "azuread" {
# Uses same Azure CLI session or ARM_TENANT_ID env var
}

306
.tofu/platforms/aks/modules/cluster/main.tf
View File

@@ -35,22 +35,6 @@ resource "azurerm_subnet" "aks" {
address_prefixes = [var.aks_subnet_cidr]
}
# PostgreSQL Flexible Server requires a delegated subnet
resource "azurerm_subnet" "postgresql" {
name = "${var.prefix}-pg-subnet"
resource_group_name = azurerm_resource_group.main.name
virtual_network_name = azurerm_virtual_network.main.name
address_prefixes = [var.pg_subnet_cidr]
delegation {
name = "postgresql-delegation"
service_delegation {
name = "Microsoft.DBforPostgreSQL/flexibleServers"
actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
}
}
}
# ─── AKS Cluster ──────────────────────────────────────────────────────
resource "azurerm_kubernetes_cluster" "main" {
@@ -86,293 +70,3 @@ resource "azurerm_kubernetes_cluster" "main" {
oidc_issuer_enabled = true
workload_identity_enabled = true
}
# ─── PostgreSQL Flexible Server ───────────────────────────────────────
# Private DNS zone: required for VNet-integrated Flexible Server
resource "azurerm_private_dns_zone" "postgresql" {
name = "${replace(var.prefix, "-", "")}.postgres.database.azure.com"
resource_group_name = azurerm_resource_group.main.name
tags = var.tags
}
resource "azurerm_private_dns_zone_virtual_network_link" "postgresql" {
name = "${var.prefix}-pg-dns-link"
private_dns_zone_name = azurerm_private_dns_zone.postgresql.name
resource_group_name = azurerm_resource_group.main.name
virtual_network_id = azurerm_virtual_network.main.id
}
resource "random_password" "pg_admin" {
length = 32
special = false
}
# Passwords for application DB users.
# NOTE: The users themselves must be created post-provision — Azure PostgreSQL
# Flexible Server has no Terraform resource for local user creation. Use
# setup scripts to run: CREATE USER keycloak/gitlab WITH PASSWORD '...';
resource "random_password" "pg_keycloak" {
length = 32
special = false
}
resource "random_password" "pg_gitlab" {
length = 32
special = false
}
resource "azurerm_postgresql_flexible_server" "main" {
name = "${var.prefix}-postgresql"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
version = var.pg_version
sku_name = var.pg_sku_name
storage_mb = var.pg_storage_mb
backup_retention_days = var.pg_backup_retention_days
administrator_login = "pgadmin"
administrator_password = random_password.pg_admin.result
delegated_subnet_id = azurerm_subnet.postgresql.id
private_dns_zone_id = azurerm_private_dns_zone.postgresql.id
tags = var.tags
dynamic "high_availability" {
for_each = var.pg_ha_mode != "Disabled" ? [1] : []
content {
mode = var.pg_ha_mode
standby_availability_zone = var.pg_standby_zone
}
}
depends_on = [azurerm_private_dns_zone_virtual_network_link.postgresql]
}
resource "azurerm_postgresql_flexible_server_database" "keycloak" {
name = "keycloak"
server_id = azurerm_postgresql_flexible_server.main.id
collation = "en_US.utf8"
charset = "UTF8"
}
resource "azurerm_postgresql_flexible_server_database" "gitlab" {
name = "gitlabhq_production"
server_id = azurerm_postgresql_flexible_server.main.id
collation = "en_US.utf8"
charset = "UTF8"
}
# ─── Azure Cache for Redis ────────────────────────────────────────────
resource "azurerm_redis_cache" "main" {
name = "${var.prefix}-redis"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
sku_name = var.redis_sku_name
family = var.redis_family
capacity = var.redis_capacity
non_ssl_port_enabled = false
minimum_tls_version = "1.2"
tags = var.tags
}
# ─── Blob Storage ─────────────────────────────────────────────────────
locals {
# Storage account name: 3-24 chars, lowercase alphanumeric only
storage_account_name = substr(replace(lower(var.prefix), "-", ""), 0, 19)
}
resource "azurerm_storage_account" "main" {
name = "${local.storage_account_name}store"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
account_tier = "Standard"
account_replication_type = var.storage_replication
min_tls_version = "TLS1_2"
# Enable hierarchical namespace for better performance (optional, uncomment for Premium)
# is_hns_enabled = false
tags = var.tags
}
# GitLab storage containers — native Azure Blob (provider: AzureRM)
# No S3 shim required: GitLab CE Helm chart supports Azure Blob natively
resource "azurerm_storage_container" "gitlab_artifacts" {
name = "gitlab-artifacts"
storage_account_id = azurerm_storage_account.main.id
container_access_type = "private"
}
resource "azurerm_storage_container" "gitlab_uploads" {
name = "gitlab-uploads"
storage_account_id = azurerm_storage_account.main.id
container_access_type = "private"
}
resource "azurerm_storage_container" "gitlab_packages" {
name = "gitlab-packages"
storage_account_id = azurerm_storage_account.main.id
container_access_type = "private"
}
resource "azurerm_storage_container" "gitlab_lfs" {
name = "gitlab-lfs"
storage_account_id = azurerm_storage_account.main.id
container_access_type = "private"
}
resource "azurerm_storage_container" "gitlab_registry" {
name = "gitlab-registry"
storage_account_id = azurerm_storage_account.main.id
container_access_type = "private"
}
resource "azurerm_storage_container" "gitlab_backups" {
name = "gitlab-backups"
storage_account_id = azurerm_storage_account.main.id
container_access_type = "private"
}
# ─── Entra ID Identity Provider for Keycloak ─────────────────────────
#
# Keycloak federates with Entra ID — users authenticate via "Sign in with
# Microsoft" through Keycloak, which remains the single OIDC issuer for all
# services. This keeps the auth layer portable across clouds (UpCloud, GCP, AWS).
#
# Three App Roles are defined (devops-admins, developers, viewers). Assign
# Entra ID users or security groups to these roles in the Azure portal or
# via the azuread_app_role_assignment resource.
#
# The redirect URI is set to a placeholder here; setup-keycloak.sh updates it
# to the real domain (https://keycloak.<domain>/realms/devops/broker/entra/endpoint)
# using `az ad app update` after the domain is known.
resource "azuread_application" "keycloak_idp" {
display_name = "${var.prefix}-keycloak-idp"
web {
redirect_uris = ["https://placeholder.invalid/realms/devops/broker/entra/endpoint"]
}
required_resource_access {
resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph
resource_access {
id = "37f7f235-527c-4136-accd-4a02d197296e" # openid
type = "Scope"
}
resource_access {
id = "64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0" # email
type = "Scope"
}
resource_access {
id = "14dad69e-099b-42c9-810b-d002981feec1" # profile
type = "Scope"
}
}
# App Roles map to Keycloak groups via setup-keycloak.sh IdP mappers.
# Assign Entra ID users/groups to these roles in the Azure portal.
app_role {
allowed_member_types = ["User"]
description = "Full access to DevOps platform administration"
display_name = "DevOps Admins"
enabled = true
id = "a1b2c3d4-0001-4000-8000-de0ad1000001" # stable GUID
value = "devops-admins"
}
app_role {
allowed_member_types = ["User"]
description = "Developer access to DevOps platform services"
display_name = "Developers"
enabled = true
id = "a1b2c3d4-0002-4000-8000-de0e10be0002" # stable GUID
value = "developers"
}
app_role {
allowed_member_types = ["User"]
description = "Read-only access to DevOps platform services"
display_name = "Viewers"
enabled = true
id = "a1b2c3d4-0003-4000-8000-00e0e0000003" # stable GUID
value = "viewers"
}
}
resource "azuread_service_principal" "keycloak_idp" {
client_id = azuread_application.keycloak_idp.client_id
app_role_assignment_required = var.entra_require_assignment
}
resource "azuread_application_password" "keycloak_idp" {
application_id = azuread_application.keycloak_idp.id
display_name = "keycloak-idp-secret"
end_date = "2099-01-01T00:00:00Z"
}
# ─── Workload Identity for GitLab ─────────────────────────────────────
#
# Allows GitLab pods (webservice, sidekiq) to access Blob Storage without
# a storage account key. The K8s service account "gitlab" in the "gitlab"
# namespace exchanges its projected OIDC token for an Azure AD token.
#
# AKS must have oidc_issuer_enabled and workload_identity_enabled (set above).
resource "azurerm_user_assigned_identity" "gitlab" {
name = "${var.prefix}-gitlab-identity"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
tags = var.tags
}
# Grant the identity read/write access to all blob containers in the storage account
resource "azurerm_role_assignment" "gitlab_storage" {
scope = azurerm_storage_account.main.id
role_definition_name = "Storage Blob Data Contributor"
principal_id = azurerm_user_assigned_identity.gitlab.principal_id
}
# Federated credential: trusts tokens from the AKS OIDC issuer for the
# "gitlab" service account in the "gitlab" namespace.
# The GitLab Helm chart creates this SA when global.serviceAccount.enabled=true.
resource "azurerm_federated_identity_credential" "gitlab" {
name = "${var.prefix}-gitlab-fedcred"
resource_group_name = azurerm_resource_group.main.name
parent_id = azurerm_user_assigned_identity.gitlab.id
audience = ["api://AzureADTokenExchange"]
issuer = azurerm_kubernetes_cluster.main.oidc_issuer_url
subject = "system:serviceaccount:gitlab:gitlab"
}
# ─── External-DNS Workload Identity ──────────────────────────────────
# Allows external-dns to manage Azure DNS records for the cluster's domain.
# The K8s service account "external-dns/external-dns" uses the federated credential.
data "azurerm_dns_zone" "main" {
name = var.domain
resource_group_name = var.dns_zone_resource_group != "" ? var.dns_zone_resource_group : azurerm_resource_group.main.name
}
resource "azurerm_user_assigned_identity" "external_dns" {
name = "${var.prefix}-external-dns-identity"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
tags = var.tags
}
resource "azurerm_role_assignment" "external_dns_dns_contributor" {
scope = data.azurerm_dns_zone.main.id
role_definition_name = "DNS Zone Contributor"
principal_id = azurerm_user_assigned_identity.external_dns.principal_id
}
resource "azurerm_federated_identity_credential" "external_dns" {
name = "${var.prefix}-external-dns-fedcred"
resource_group_name = azurerm_resource_group.main.name
parent_id = azurerm_user_assigned_identity.external_dns.id
audience = ["api://AzureADTokenExchange"]
issuer = azurerm_kubernetes_cluster.main.oidc_issuer_url
subject = "system:serviceaccount:external-dns:external-dns"
}

97
.tofu/platforms/aks/modules/cluster/outputs.tf
View File

@@ -20,98 +20,13 @@ output "location" {
value = azurerm_resource_group.main.location
}
# ─── PostgreSQL ───────────────────────────────────────────────────────
output "pg_host" {
description = "PostgreSQL Flexible Server FQDN (private, reachable from AKS)"
value = azurerm_postgresql_flexible_server.main.fqdn
output "oidc_issuer_url" {
description = "AKS OIDC issuer URL (for workload identity federation)"
value = azurerm_kubernetes_cluster.main.oidc_issuer_url
}
output "pg_port" {
description = "PostgreSQL port"
value = 5432
}
output "pg_admin_login" {
description = "PostgreSQL administrator login"
value = azurerm_postgresql_flexible_server.main.administrator_login
}
output "pg_admin_password" {
description = "PostgreSQL administrator password"
value = random_password.pg_admin.result
output "kubeconfig" {
description = "Kubeconfig for the AKS cluster"
value = azurerm_kubernetes_cluster.main.kube_config_raw
sensitive = true
}
output "pg_keycloak_password" {
description = "Pre-generated password for keycloak DB user — create user post-provision"
value = random_password.pg_keycloak.result
sensitive = true
}
output "pg_gitlab_password" {
description = "Pre-generated password for gitlab DB user — create user post-provision"
value = random_password.pg_gitlab.result
sensitive = true
}
# ─── Redis ────────────────────────────────────────────────────────────
output "redis_host" {
description = "Azure Cache for Redis hostname"
value = azurerm_redis_cache.main.hostname
}
output "redis_port" {
description = "Redis SSL port (6380)"
value = azurerm_redis_cache.main.ssl_port
}
output "redis_password" {
description = "Redis primary access key"
value = azurerm_redis_cache.main.primary_access_key
sensitive = true
}
# ─── Blob Storage ─────────────────────────────────────────────────────
output "storage_account_name" {
description = "Azure Storage Account name"
value = azurerm_storage_account.main.name
}
output "storage_primary_access_key" {
description = "Storage Account primary access key (used for registry; main GitLab storage uses managed identity)"
value = azurerm_storage_account.main.primary_access_key
sensitive = true
}
# ─── Entra ID ────────────────────────────────────────────────────────
output "entra_tenant_id" {
description = "Entra ID tenant ID — used in Keycloak IdP OIDC endpoint URLs"
value = data.azurerm_client_config.current.tenant_id
}
output "entra_keycloak_client_id" {
description = "App Registration client ID for the Keycloak IdP"
value = azuread_application.keycloak_idp.client_id
}
output "entra_keycloak_client_secret" {
description = "App Registration client secret for the Keycloak IdP"
value = azuread_application_password.keycloak_idp.value
sensitive = true
}
# ─── Workload Identity ────────────────────────────────────────────────
output "gitlab_identity_client_id" {
description = "Client ID of the GitLab managed identity — annotate the K8s service account with this value"
value = azurerm_user_assigned_identity.gitlab.client_id
}
output "external_dns_identity_client_id" {
description = "Client ID of the external-dns managed identity — written to config.yaml by sync-tofu-outputs.sh"
value = azurerm_user_assigned_identity.external_dns.client_id
}

89
.tofu/platforms/aks/modules/cluster/variables.tf
View File

@@ -27,12 +27,6 @@ variable "aks_subnet_cidr" {
default = "10.100.0.0/22"
}
variable "pg_subnet_cidr" {
description = "CIDR block for the PostgreSQL delegated subnet"
type = string
default = "10.100.4.0/24"
}
variable "aks_node_vm_size" {
description = "VM size for AKS worker nodes (e.g., Standard_B2s, Standard_D4s_v3)"
type = string
@@ -60,86 +54,3 @@ variable "tags" {
type = map(string)
default = {}
}
# ─── PostgreSQL Flexible Server ───────────────────────────────────────
variable "pg_sku_name" {
description = "PostgreSQL Flexible Server SKU (e.g., B_Standard_B1ms, GP_Standard_D2s_v3)"
type = string
}
variable "pg_version" {
description = "PostgreSQL major version"
type = string
default = "16"
}
variable "pg_storage_mb" {
description = "PostgreSQL storage in MB (minimum 32768)"
type = number
default = 32768
}
variable "pg_backup_retention_days" {
description = "PostgreSQL backup retention in days (7-35)"
type = number
default = 7
}
variable "pg_ha_mode" {
description = "PostgreSQL high availability mode: Disabled or ZoneRedundant"
type = string
default = "Disabled"
}
variable "pg_standby_zone" {
description = "Availability zone for PostgreSQL standby replica (used when pg_ha_mode = ZoneRedundant)"
type = string
default = "2"
}
# ─── Azure Cache for Redis ────────────────────────────────────────────
variable "redis_sku_name" {
description = "Azure Cache for Redis SKU: Basic, Standard, or Premium"
type = string
}
variable "redis_family" {
description = "Redis family: C (Basic/Standard) or P (Premium)"
type = string
}
variable "redis_capacity" {
description = "Redis cache size (0-6, meaning depends on SKU/family)"
type = number
}
# ─── Blob Storage ─────────────────────────────────────────────────────
variable "storage_replication" {
description = "Storage account replication type (LRS, ZRS, GRS, RAGRS)"
type = string
default = "LRS"
}
# ─── DNS ─────────────────────────────────────────────────────────────
variable "domain" {
description = "Public domain name for the cluster (e.g., dev.example.com) — must have an existing Azure DNS zone"
type = string
}
variable "dns_zone_resource_group" {
description = "Resource group containing the Azure DNS zone (defaults to the cluster resource group)"
type = string
default = ""
}
# ─── Entra ID (Azure AD) ──────────────────────────────────────────────
variable "entra_require_assignment" {
description = "Require explicit App Role assignment before users can authenticate via Entra ID"
type = bool
default = false # Set true for production to restrict access to assigned users only
}

26
.tofu/platforms/aks/prod/main.tf
View File

@@ -1,38 +1,16 @@
module "cluster" {
source = "../modules/cluster"
prefix = "devhub"
prefix = "clst"
location = "westeurope"
resource_group_name = "devhub-prod-rg"
resource_group_name = "clst-prod-rg"
# AKS — general-purpose nodes for production
aks_node_vm_size = "Standard_D4s_v3"
aks_node_count = 3
# PostgreSQL — general-purpose tier for production
pg_sku_name = "GP_Standard_D2s_v3"
pg_version = "16"
pg_storage_mb = 102400 # 100 GB
pg_backup_retention_days = 14
pg_ha_mode = "ZoneRedundant"
pg_standby_zone = "2"
# Redis — Standard C1 (1 GB) with replication for production
redis_sku_name = "Standard"
redis_family = "C"
redis_capacity = 1
# Blob storage — geo-redundant for production
storage_replication = "GRS"
# DNS — must match an existing Azure DNS zone
domain = "example.com" # TODO: set to your actual domain
# dns_zone_resource_group = "my-dns-rg" # uncomment if DNS zone is in a separate RG
enable_delete_lock = true
# api_server_authorized_ip_ranges = ["0.0.0.0/0"] # TODO: restrict to known CIDRs
tags = {
Environment = "prod"
ManagedBy = "tofu"

73
.tofu/platforms/aks/prod/outputs.tf
View File

@@ -16,76 +16,11 @@ output "location" {
value = module.cluster.location
}
# ─── PostgreSQL ───────────────────────────────────────────────────────
output "pg_host" {
value = module.cluster.pg_host
output "oidc_issuer_url" {
value = module.cluster.oidc_issuer_url
}
output "pg_port" {
value = module.cluster.pg_port
}
output "pg_admin_login" {
value = module.cluster.pg_admin_login
}
output "pg_admin_password" {
value = module.cluster.pg_admin_password
sensitive = true
}
output "pg_keycloak_password" {
value = module.cluster.pg_keycloak_password
sensitive = true
}
output "pg_gitlab_password" {
value = module.cluster.pg_gitlab_password
sensitive = true
}
# ─── Redis ────────────────────────────────────────────────────────────
output "redis_host" {
value = module.cluster.redis_host
}
output "redis_port" {
value = module.cluster.redis_port
}
output "redis_password" {
value = module.cluster.redis_password
sensitive = true
}
# ─── Blob Storage ─────────────────────────────────────────────────────
output "storage_account_name" {
value = module.cluster.storage_account_name
}
output "storage_primary_access_key" {
value = module.cluster.storage_primary_access_key
sensitive = true
}
output "gitlab_identity_client_id" {
value = module.cluster.gitlab_identity_client_id
}
# ─── Entra ID ────────────────────────────────────────────────────────
output "entra_tenant_id" {
value = module.cluster.entra_tenant_id
}
output "entra_keycloak_client_id" {
value = module.cluster.entra_keycloak_client_id
}
output "entra_keycloak_client_secret" {
value = module.cluster.entra_keycloak_client_secret
output "kubeconfig" {
value = module.cluster.kubeconfig
sensitive = true
}

12
.tofu/platforms/aks/prod/providers.tf
View File

@@ -6,14 +6,6 @@ terraform {
source = "hashicorp/azurerm"
version = "~> 4.0"
}
azuread = {
source = "hashicorp/azuread"
version = "~> 3.0"
}
random = {
source = "hashicorp/random"
version = "~> 3.0"
}
}
}
@@ -23,7 +15,3 @@ provider "azurerm" {
# ARM_SUBSCRIPTION_ID, ARM_TENANT_ID, ARM_CLIENT_ID, ARM_CLIENT_SECRET
# Or: az login (uses your Azure CLI session)
}
provider "azuread" {
# Uses same Azure CLI session or ARM_TENANT_ID env var
}

6
.tofu/platforms/aks/workload/main.tf
View File

@@ -15,9 +15,9 @@
# =============================================================================
variable "prefix" {
description = "Prefix for resource names (e.g., devhub-workload)"
description = "Prefix for resource names (e.g., clst-workload)"
type = string
default = "devhub-workload"
default = "clst-workload"
}
variable "location" {
@@ -29,7 +29,7 @@ variable "location" {
variable "resource_group_name" {
description = "Name of the Azure Resource Group to create"
type = string
default = "devhub-workload-rg"
default = "clst-workload-rg"
}
variable "vnet_address_space" {