Cheat notes · Module 02 · Platform foundation

Clusters as code with Terraform

A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.

The idea

The inventory decides which clusters exist and Terraform makes it so: it creates the clusters, installs Argo CD on the hub and registers each spoke with labels copied from the inventory. Apply from main, never from a branch.

Remember

The bootstrap chain: inventory, clusters, Argo CD, cluster registration, then (module 03) the root app. Terraform owns the chain up to the point where Git takes over.
Inventory drives Terraform: infrastructure/kind reads every clusters/*.yaml with provider: kind. Add a file and terraform apply creates the cluster.
Declarative registration: a cluster is a Secret in argocd labelled argocd.argoproj.io/secret-type: cluster. Terraform writes it with fleet.gitops/environment, region and upgrade-wave labels from the inventory; ApplicationSets select clusters by them.
Stable addresses: kind nodes share a Docker network, so the hub reaches dev-control-plane:6443 by name. Rebuilds keep the address, and the API certificate is valid for it, so TLS verification stays on.
Read the plan before yes: here 3 clusters, Argo CD, 2 cluster Secrets and no root app.

Pitfalls

Applying from a branch: what runs is then something nobody reviewed. Merge first, apply from main.
A lost cluster is not a crisis: terraform plan shows it will be recreated, terraform apply brings it back with the same name and address and fresh credentials in the cluster Secret.
Using 127.0.0.1 for a spoke: the hub runs in its own container, so that address is the hub itself.

Commands

`cd infrastructure/kind && terraform init`	Download the providers (once)
`terraform plan`	Preview; changes nothing
`terraform apply`	Create or repair the fleet's infrastructure
`kubectl --context kind-platform -n argocd get secrets -l argocd.argoproj.io/secret-type=cluster --show-labels`	The clusters Argo CD knows, with their labels
`terraform output registered_clusters`	Terraform's view of the registrations
`kubectl --context kind-platform -n argocd port-forward svc/argocd-server 8080:443`	Reach the Argo CD UI on the hub

Test yourself

Answer in your head first, then open the answer.

Where do the labels on an Argo CD cluster Secret come from?

Terraform copies them from clusters/*.yaml.

Why did this module's plan not create the root app?

root-app.yaml was not in the repo yet; the fleet-hub module only applies it when it exists.

Why https://dev-control-plane:6443 and not your kubeconfig address?

It is reachable from the hub on the kind network, stable across rebuilds, and valid for the API certificate.

Where module 02 leaves you: Three kind clusters: a hub running Argo CD, plus dev and prod. Argo CD knows dev and prod, with labels copied from your inventory. Argo CD deploys nothing yet.