Terraform

Files

File	Purpose
ovh_account.tf	OVH cloud project / account wiring
ovh_k8s_cluster.tf	The Kubernetes cluster + node pool + OIDC
ovh_k8s_backups.tf	Cluster backup setup
ovh_k8s_backups-mysql.tf	MySQL-specific backup buckets
variables.tf	Input variables
versions.tf	Provider pinning
terraform.tfvars	Local values (real)
terraform.tfvars.example	Template you copy to terraform.tfvars

Applying

cd infastructure/terraform
cp terraform.tfvars.example terraform.tfvars   # then fill it in
terraform init
terraform plan
terraform apply

Pulling kubeconfig

The cluster kubeconfig comes out of terraform output -raw kubeconfig_file. There's also a kubeconfig/ directory used by the bootstrap scripts in argocd/.

Resizing the node pools

Edit ovh_k8s_cluster.tf:

resource "ovh_cloud_project_kube_nodepool" "node_pool_2" {
  min_nodes = 4    # ← change these; the autoscaler owns desired_nodes
  max_nodes = 6
  ...
}

Then terraform plan / apply.

The system pool

oym-node-pool-system (fixed 3× b3-8, no autoscaling) is dedicated to platform components. It carries a node taint set through the pool's template block:

template {
  metadata {
    annotations = {}
    finalizers  = []
    labels      = {}
  }
  spec {
    taints = [
      {
        key    = "dedicated"
        value  = "system"
        effect = "NoSchedule"
      }
    ]
    unschedulable = false
  }
}

All template subfields must be present (empty where unused) — the OVH provider otherwise produces a perpetual diff. After changing the template, run terraform plan a second time and confirm it comes back clean.

OVH labels every node with nodepool=<pool name> automatically; system components schedule with that label as nodeSelector plus a toleration for the taint. DaemonSets that must cover all nodes (node-exporter, Velero's node-agent) carry only the toleration.

The pool flavor is immutable. To change it, add a new pool resource, terraform apply, cordon and drain the old nodes one at a time (single-replica pods behind a minAvailable: 1 PDB block eviction and must be deleted directly; let each PXC member rejoin before draining the next node), then remove the old pool resource and apply again.