dumpnet-argo/terraform/main.tf

# EIP - created fresh, managed by Terraform
resource "aws_eip" "controlplane" {
  domain = "vpc"
  tags = {
    Name = "${var.cluster_name}-controlplane"
  }
}

# Generate Talos machine secrets (CA, tokens, etc)
resource "talos_machine_secrets" "this" {}

data "talos_machine_configuration" "controlplane" {
  cluster_name       = var.cluster_name
  cluster_endpoint   = "https://${aws_eip.controlplane.public_ip}:6443"
  machine_type       = "controlplane"
  machine_secrets    = talos_machine_secrets.this.machine_secrets
  talos_version      = "v1.8.2"
  kubernetes_version = "v1.31.2"

  config_patches = [
    yamlencode({
      machine = {
        certSANs = [aws_eip.controlplane.public_ip]
        install = {
          disk                = "/dev/xvda"
          grubUseUKICmdline   = null
        }
        time = {
          servers = ["169.254.169.123"]
        }
      }
      cluster = {
        apiServer = {
          certSANs = [aws_eip.controlplane.public_ip]
        }
        allowSchedulingOnControlPlanes = true
      }
    })
  ]
}

data "talos_client_configuration" "this" {
  cluster_name         = var.cluster_name
  client_configuration = talos_machine_secrets.this.client_configuration
  endpoints            = [aws_eip.controlplane.public_ip]
  nodes                = [aws_eip.controlplane.public_ip]
}

# Network interface (prevents auto-assign public IP)
resource "aws_network_interface" "controlplane" {
  subnet_id       = aws_subnet.talos.id
  security_groups = [aws_security_group.talos.id]

  tags = {
    Name = "${var.cluster_name}-controlplane"
  }
}

# Associate EIP with network interface
resource "aws_eip_association" "controlplane" {
  instance_id   = aws_instance.controlplane.id
  allocation_id = aws_eip.controlplane.id
}

# Launch control plane instance
resource "aws_instance" "controlplane" {
  ami                  = var.ami_id
  instance_type        = var.instance_type
  iam_instance_profile = aws_iam_instance_profile.node.name

  network_interface {
    network_interface_id = aws_network_interface.controlplane.id
    device_index         = 0
  }

  user_data = data.talos_machine_configuration.controlplane.machine_configuration

  tags = {
    Name = "${var.cluster_name}-controlplane"
  }

  lifecycle {
    ignore_changes = [user_data]
  }
}

# Apply machine configuration to the control plane node
resource "talos_machine_configuration_apply" "controlplane" {
  client_configuration        = talos_machine_secrets.this.client_configuration
  machine_configuration_input = data.talos_machine_configuration.controlplane.machine_configuration
  endpoint                    = aws_eip.controlplane.public_ip
  node                        = aws_instance.controlplane.private_ip

  depends_on = [aws_eip_association.controlplane]
}

# Bootstrap the cluster
resource "talos_machine_bootstrap" "this" {
  client_configuration = talos_machine_secrets.this.client_configuration
  endpoint             = aws_eip.controlplane.public_ip
  node                 = aws_instance.controlplane.private_ip

  depends_on = [talos_machine_configuration_apply.controlplane]
}

# Retrieve kubeconfig
resource "talos_cluster_kubeconfig" "this" {
  client_configuration = talos_machine_secrets.this.client_configuration
  endpoint             = aws_eip.controlplane.public_ip
  node                 = aws_instance.controlplane.private_ip

  depends_on = [talos_machine_bootstrap.this]
}