Terraform all resources, update encryption scheme, add ingress

terraform/main.tf

@@ -0,0 +1,112 @@
+# EIP - created fresh, managed by Terraform
+resource "aws_eip" "controlplane" {
+  domain = "vpc"
+  tags = {
+    Name = "${var.cluster_name}-controlplane"
+  }
+}
+
+# Generate Talos machine secrets (CA, tokens, etc)
+resource "talos_machine_secrets" "this" {}
+
+data "talos_machine_configuration" "controlplane" {
+  cluster_name       = var.cluster_name
+  cluster_endpoint   = "https://${aws_eip.controlplane.public_ip}:6443"
+  machine_type       = "controlplane"
+  machine_secrets    = talos_machine_secrets.this.machine_secrets
+  talos_version      = "v1.8.2"
+  kubernetes_version = "v1.31.2"
+
+  config_patches = [
+    yamlencode({
+      machine = {
+        certSANs = [aws_eip.controlplane.public_ip]
+        install = {
+          disk                = "/dev/xvda"
+          grubUseUKICmdline   = null
+        }
+        time = {
+          servers = ["169.254.169.123"]
+        }
+      }
+      cluster = {
+        apiServer = {
+          certSANs = [aws_eip.controlplane.public_ip]
+        }
+        allowSchedulingOnControlPlanes = true
+      }
+    })
+  ]
+}
+
+data "talos_client_configuration" "this" {
+  cluster_name         = var.cluster_name
+  client_configuration = talos_machine_secrets.this.client_configuration
+  endpoints            = [aws_eip.controlplane.public_ip]
+  nodes                = [aws_eip.controlplane.public_ip]
+}
+
+# Network interface (prevents auto-assign public IP)
+resource "aws_network_interface" "controlplane" {
+  subnet_id       = aws_subnet.talos.id
+  security_groups = [aws_security_group.talos.id]
+
+  tags = {
+    Name = "${var.cluster_name}-controlplane"
+  }
+}
+
+# Associate EIP with network interface
+resource "aws_eip_association" "controlplane" {
+  instance_id   = aws_instance.controlplane.id
+  allocation_id = aws_eip.controlplane.id
+}
+
+# Launch control plane instance
+resource "aws_instance" "controlplane" {
+  ami           = var.ami_id
+  instance_type = var.instance_type
+
+  network_interface {
+    network_interface_id = aws_network_interface.controlplane.id
+    device_index         = 0
+  }
+
+  user_data = data.talos_machine_configuration.controlplane.machine_configuration
+
+  tags = {
+    Name = "${var.cluster_name}-controlplane"
+  }
+
+  lifecycle {
+    ignore_changes = [user_data]
+  }
+}
+
+# Apply machine configuration to the control plane node
+resource "talos_machine_configuration_apply" "controlplane" {
+  client_configuration        = talos_machine_secrets.this.client_configuration
+  machine_configuration_input = data.talos_machine_configuration.controlplane.machine_configuration
+  endpoint                    = aws_eip.controlplane.public_ip
+  node                        = aws_instance.controlplane.private_ip
+
+  depends_on = [aws_eip_association.controlplane]
+}
+
+# Bootstrap the cluster
+resource "talos_machine_bootstrap" "this" {
+  client_configuration = talos_machine_secrets.this.client_configuration
+  endpoint             = aws_eip.controlplane.public_ip
+  node                 = aws_instance.controlplane.private_ip
+
+  depends_on = [talos_machine_configuration_apply.controlplane]
+}
+
+# Retrieve kubeconfig
+resource "talos_cluster_kubeconfig" "this" {
+  client_configuration = talos_machine_secrets.this.client_configuration
+  endpoint             = aws_eip.controlplane.public_ip
+  node                 = aws_instance.controlplane.private_ip
+
+  depends_on = [talos_machine_bootstrap.this]
+}