Skip to main content

Infrastructure

The cluster itself is provisioned by Terraform on OVH-managed Kubernetes. Source lives in infastructure/terraform/.

What's provisioned​

  • ovh_cloud_project_kube — the Kubernetes cluster, in region DE1, named oym_k8s_cluster.
  • ovh_cloud_project_kube_nodepool — two node pools:
    • oym-node-pool-2 — flavor b3-16 (4 vCPU / 16 GB), autoscaled between 4 and 6 nodes. Runs application workloads and the Percona MySQL cluster.
    • oym-node-pool-system — flavor b3-8 (2 vCPU / 8 GB), fixed at 3 nodes, tainted dedicated=system:NoSchedule. Runs platform components (Traefik, cert-manager, monitoring, ArgoCD, Kyverno, Crossplane, Kargo, external-secrets, Velero, NFS provisioner, etc.), which target it via nodeSelector: {nodepool: oym-node-pool-system} plus a matching toleration. The taint keeps everything else off; app and database workloads need no scheduling config of their own.
  • ovh_cloud_project_kube_oidc — OIDC integration with Auth0 (tde.eu.auth0.com) for kubectl access. Username and group claims are namespaced (https://onyourmarks.tech/claims/*) and prefixed auth0: in the cluster.
  • MySQL backups — ovh_k8s_backups-mysql.tf and ovh_k8s_backups.tf set up backup buckets.

Outputs​

kubeconfig_file — the cluster kubeconfig, marked sensitive. The generated file lives in infastructure/terraform/kubeconfig/.

State​

State and lockfiles (terraform.tfstate, terraform.tfstate.backup) are stored in-tree. Treat them as sensitive — they contain the kubeconfig and account IDs.

warning

The directory is infastructure/ (note the spelling — missing the r). Don't rename it without coordinating; CI paths and references depend on this name.