professional-service-best-practices/professional-service
20
1
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions

example(ske): add example on how to use ephemeral kubeconfig #18

Open
mauritz.uphoff wants to merge 1 commit from example/kubeconfig-ephemeral-resource into main
pull from: example/kubeconfig-ephemeral-resource
merge into: professional-service-best-practices:main
Conversation 2 Commits 1 Files changed 6 +223
mauritz.uphoff commented 2026-05-11 08:58:22 +00:00
Owner
Copy link

Description

Checklist

  • The CI pipeline passed successfully.
## Description <!-- **Please link some issue here describing what you are trying to achieve.** --> ## Checklist - [ ] The CI pipeline passed successfully.
example(ske): add example on how to use ephemeral kubeconfig
All checks were successful
Default CI / Secret Scanner (TruffleHog) (pull_request) Successful in 1m20s
Details
Default CI / Pre-Commit Hooks (pull_request) Successful in 2m57s
Details
ead6bbfd5a
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from ead6bbfd5a to c5a0475c15 2026-05-11 08:58:45 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from c5a0475c15 to ea59db386f 2026-05-11 09:07:00 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from ea59db386f to 2a4ff9fd2b 2026-05-11 09:14:29 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from 2a4ff9fd2b to 02fe26d9eb 2026-05-12 08:28:36 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from 02fe26d9eb to d4b312c16d 2026-05-12 08:36:20 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from d4b312c16d to 5d06a16899 2026-05-13 11:44:07 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from 5d06a16899 to 7bc8bc61f2 2026-05-13 11:59:34 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from 7bc8bc61f2 to 66470a0202 2026-06-23 11:40:20 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from 66470a0202 to e354ed5f30 2026-06-23 11:42:07 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from e354ed5f30 to 4252c7520a 2026-06-23 14:17:43 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from 4252c7520a to 369e668d48 2026-07-27 14:29:35 +00:00 Compare
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from 369e668d48 to 61322fb3f0 2026-08-03 11:34:39 +00:00 Compare
forgejo-actions commented 2026-08-03 11:36:35 +00:00
Copy link

πŸ€– AI PR Review

Reviewing changes up to 61322fb3

πŸ“ Spelling & Grammar

βœ… No spelling or grammar issues found.

πŸ—οΈ Infrastructure Changes
  • Creates StackIT SKE cluster named "ske-test" with 1 Flatcar node pool (g2i.4, 20GB storage)
  • Generates ephemeral kubeconfig for cluster access (expires in 30 minutes)
  • Creates Kubernetes namespace "test01" using the ephemeral kubeconfig
  • Configures Kubernetes and Helm providers to use the ephemeral kubeconfig
  • Requires project_id and stackit_service_account_key_path variables
  • Uses StackIT provider with default region "eu01"
πŸ”’ Security Review

βœ… No security issues found.

πŸ“ Example Consistency
  • Variable project_id lacks a description attribute.
variable "project_id" {
  type        = string
  description = "The project ID where the SKE cluster will be created."
}
  • Variable stackit_service_account_key_path lacks a description attribute.
variable "stackit_service_account_key_path" {
  type        = string
  description = "Path to the Stackit service account key file used for authentication."
}
  • The provider "kubernetes" block references ephemeral.stackit_ske_kubeconfig.this.kube_config which may not be available during provider configuration; consider using data or locals for dynamic values or ensure proper ordering.
# Consider using a local or data source if possible, or ensure ephemeral resource is created first.
# Example using local (if static or precomputed):
locals {
  kubeconfig = yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config)
}

provider "kubernetes" {
  host                   = local.kubeconfig.clusters[0].cluster.server
  client_certificate     = base64decode(local.kubeconfig.users[0].user["client-certificate-data"])
  client_key             = base64decode(local.kubeconfig.users[0].user["client-key-data"])
  cluster_ca_certificate = base64decode(local.kubeconfig.clusters[0].cluster["certificate-authority-data"])
}
  • The provider "helm" block has the same issue as kubernetes β€” it references ephemeral resource output during provider configuration.
provider "helm" {
  kubernetes = {
    host                   = local.kubeconfig.clusters[0].cluster.server
    client_certificate     = base64decode(local.kubeconfig.users[0].user["client-certificate-data"])
    client_key             = base64decode(local.kubeconfig.users[0].user["client-key-data"])
    cluster_ca_certificate = base64decode(local.kubeconfig.clusters[0].cluster["certificate-authority-data"])
  }
}
  • The .terraform.lock.hcl file lists hashicorp/kubernetes with both version and constraints, which is redundant and may cause confusion. Use only version or only constraints, not both.
# In .terraform.lock.hcl, for kubernetes provider, remove constraints if version is fixed:
provider "registry.terraform.io/hashicorp/kubernetes" {
  version = "3.1.0"
  hashes = [
    "h1:G9QqKNpcztBRqrywtlNylFJSpGzDfRFtO8hcWLdkvRY=",
    # ... other hashes
  ]
}
  • The example uses 000-provider.tf, which violates the 3-digit numeric prefix convention (should start with 010-). Rename to 010-provider.tf.
# Rename the file:
mv examples/ske-ephemeral-kubeconfig/000-provider.tf examples/ske-ephemeral-kubeconfig/010-provider.tf
  • The example is missing a 030- or later file; consider adding a 030-output.tf or similar to complete the sequence if needed, though not strictly required if no outputs are intended.
πŸ“š Example README
  • The README.md is too sparse: it lacks a usage section showing how to run the example (e.g., terraform init, terraform apply), which is required.
  • The directory name ske-ephemeral-kubeconfig is clear and descriptive, following kebab-case and accurately reflecting the example’s purpose β€” no naming issue.
πŸ“š Module Variable & Output Coverage

No relevant changes to review.

πŸ’¬ Commit Messages

βœ… Commit messages are descriptive.

Generated automatically β€” treat as a hint, not a gate.

## πŸ€– AI PR Review > Reviewing changes up to [`61322fb3`](https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/commit/61322fb3f0157e4b375ddff91db4520f35c6042c) <details> <summary>πŸ“ Spelling & Grammar</summary> βœ… No spelling or grammar issues found. </details> <details> <summary>πŸ—οΈ Infrastructure Changes</summary> - Creates StackIT SKE cluster named "ske-test" with 1 Flatcar node pool (g2i.4, 20GB storage) - Generates ephemeral kubeconfig for cluster access (expires in 30 minutes) - Creates Kubernetes namespace "test01" using the ephemeral kubeconfig - Configures Kubernetes and Helm providers to use the ephemeral kubeconfig - Requires `project_id` and `stackit_service_account_key_path` variables - Uses StackIT provider with default region "eu01" </details> <details> <summary>πŸ”’ Security Review</summary> βœ… No security issues found. </details> <details> <summary>πŸ“ Example Consistency</summary> - Variable `project_id` lacks a description attribute. ```terraform variable "project_id" { type = string description = "The project ID where the SKE cluster will be created." } ``` - Variable `stackit_service_account_key_path` lacks a description attribute. ```terraform variable "stackit_service_account_key_path" { type = string description = "Path to the Stackit service account key file used for authentication." } ``` - The `provider "kubernetes"` block references `ephemeral.stackit_ske_kubeconfig.this.kube_config` which may not be available during provider configuration; consider using `data` or `locals` for dynamic values or ensure proper ordering. ```terraform # Consider using a local or data source if possible, or ensure ephemeral resource is created first. # Example using local (if static or precomputed): locals { kubeconfig = yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config) } provider "kubernetes" { host = local.kubeconfig.clusters[0].cluster.server client_certificate = base64decode(local.kubeconfig.users[0].user["client-certificate-data"]) client_key = base64decode(local.kubeconfig.users[0].user["client-key-data"]) cluster_ca_certificate = base64decode(local.kubeconfig.clusters[0].cluster["certificate-authority-data"]) } ``` - The `provider "helm"` block has the same issue as `kubernetes` β€” it references ephemeral resource output during provider configuration. ```terraform provider "helm" { kubernetes = { host = local.kubeconfig.clusters[0].cluster.server client_certificate = base64decode(local.kubeconfig.users[0].user["client-certificate-data"]) client_key = base64decode(local.kubeconfig.users[0].user["client-key-data"]) cluster_ca_certificate = base64decode(local.kubeconfig.clusters[0].cluster["certificate-authority-data"]) } } ``` - The `.terraform.lock.hcl` file lists `hashicorp/kubernetes` with both `version` and `constraints`, which is redundant and may cause confusion. Use only `version` or only `constraints`, not both. ```terraform # In .terraform.lock.hcl, for kubernetes provider, remove constraints if version is fixed: provider "registry.terraform.io/hashicorp/kubernetes" { version = "3.1.0" hashes = [ "h1:G9QqKNpcztBRqrywtlNylFJSpGzDfRFtO8hcWLdkvRY=", # ... other hashes ] } ``` - The example uses `000-provider.tf`, which violates the 3-digit numeric prefix convention (should start with 010-). Rename to `010-provider.tf`. ```bash # Rename the file: mv examples/ske-ephemeral-kubeconfig/000-provider.tf examples/ske-ephemeral-kubeconfig/010-provider.tf ``` - The example is missing a `030-` or later file; consider adding a `030-output.tf` or similar to complete the sequence if needed, though not strictly required if no outputs are intended. </details> <details> <summary>πŸ“š Example README</summary> - The README.md is too sparse: it lacks a usage section showing how to run the example (e.g., `terraform init`, `terraform apply`), which is required. - The directory name `ske-ephemeral-kubeconfig` is clear and descriptive, following kebab-case and accurately reflecting the example’s purpose β€” no naming issue. </details> <details> <summary>πŸ“š Module Variable & Output Coverage</summary> _No relevant changes to review._ </details> <details> <summary>πŸ’¬ Commit Messages</summary> βœ… Commit messages are descriptive. </details> --- _Generated automatically β€” treat as a hint, not a gate._
mauritz.uphoff force-pushed example/kubeconfig-ephemeral-resource from 61322fb3f0 to 88d5b8bc67 2026-08-03 12:41:15 +00:00 Compare
forgejo-actions commented 2026-08-03 12:44:26 +00:00
Copy link

πŸ€– AI PR Review

Reviewing changes up to 88d5b8bc

πŸ“ Spelling & Grammar

βœ… No spelling or grammar issues found.

πŸ—οΈ Infrastructure Changes
  • Creates new Terraform provider configuration for STACKIT, Kubernetes, and Helm using ephemeral SKE kubeconfig
  • Adds required variables: project_id and stackit_service_account_key_path
  • Deploys a new STACKIT SKE cluster named "ske-test" with Flatcar OS, g2i.4 machine type, and auto-updates enabled
  • Generates ephemeral kubeconfig for cluster access (expires in 1800s)
  • Creates Kubernetes namespace "test01" using the ephemeral kubeconfig
  • ⚠️ No destructive changes detected β€” all resources are new creations
πŸ”’ Security Review

βœ… No security issues found.

πŸ“ Example Consistency

βœ… Example follows repository conventions.

πŸ“š Example README
  • The README.md is too sparse: it lacks a usage section showing how to run the example (e.g., terraform init / apply) and does not explain prerequisites or expected outputs.
  • The directory name "ske-ephemeral-kubeconfig" is acceptable as it clearly describes the use-case (SKE cluster with ephemeral kubeconfig), but the README should better reflect this by expanding the overview and adding usage instructions.
πŸ“š Module Variable & Output Coverage

No relevant changes to review.

πŸ’¬ Commit Messages

βœ… Commit messages are descriptive.

Generated automatically β€” treat as a hint, not a gate.

## πŸ€– AI PR Review > Reviewing changes up to [`88d5b8bc`](https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/commit/88d5b8bc671ca37fc723b73a38ac6c471d265f20) <details> <summary>πŸ“ Spelling & Grammar</summary> βœ… No spelling or grammar issues found. </details> <details> <summary>πŸ—οΈ Infrastructure Changes</summary> - Creates new Terraform provider configuration for STACKIT, Kubernetes, and Helm using ephemeral SKE kubeconfig - Adds required variables: `project_id` and `stackit_service_account_key_path` - Deploys a new STACKIT SKE cluster named "ske-test" with Flatcar OS, g2i.4 machine type, and auto-updates enabled - Generates ephemeral kubeconfig for cluster access (expires in 1800s) - Creates Kubernetes namespace "test01" using the ephemeral kubeconfig - ⚠️ No destructive changes detected β€” all resources are new creations </details> <details> <summary>πŸ”’ Security Review</summary> βœ… No security issues found. </details> <details> <summary>πŸ“ Example Consistency</summary> βœ… Example follows repository conventions. </details> <details> <summary>πŸ“š Example README</summary> - The README.md is too sparse: it lacks a usage section showing how to run the example (e.g., terraform init / apply) and does not explain prerequisites or expected outputs. - The directory name "ske-ephemeral-kubeconfig" is acceptable as it clearly describes the use-case (SKE cluster with ephemeral kubeconfig), but the README should better reflect this by expanding the overview and adding usage instructions. </details> <details> <summary>πŸ“š Module Variable & Output Coverage</summary> _No relevant changes to review._ </details> <details> <summary>πŸ’¬ Commit Messages</summary> βœ… Commit messages are descriptive. </details> --- _Generated automatically β€” treat as a hint, not a gate._
All checks were successful
AI PR Review / AI PR Review (pull_request) Successful in 3m15s
Details
Default CI / Check for Open TODOs (pull_request) Successful in 2m52s
Details
Default CI / Pre-Commit Hooks (pull_request) Successful in 19m3s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin example/kubeconfig-ephemeral-resource:example/kubeconfig-ephemeral-resource
git switch example/kubeconfig-ephemeral-resource

Merge

Merge the changes and update on STACKIT Git.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff example/kubeconfig-ephemeral-resource
git switch example/kubeconfig-ephemeral-resource
git rebase main
git switch main
git merge --ff-only example/kubeconfig-ephemeral-resource
git switch example/kubeconfig-ephemeral-resource
git rebase main
git switch main
git merge --no-ff example/kubeconfig-ephemeral-resource
git switch main
git merge --squash example/kubeconfig-ephemeral-resource
git switch main
git merge --ff-only example/kubeconfig-ephemeral-resource
git switch main
git merge example/kubeconfig-ephemeral-resource
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
professional-service-best-practices/professional-service!18
No description provided.