Scaleway auth in entrypoint and explicit provider config

Author: pst

.github/workflows/main.yml

@@ -54,7 +54,7 @@ jobs:
     needs: [build-test-artifacts]
     strategy:
       matrix:
-        starter: ["multi-cloud", "aks", "eks", "gke"]
+        starter: ["multi-cloud", "aks", "eks", "gke", "scw"]
 
     permissions:
       id-token: write # required for keyless signing
@@ -117,7 +117,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        starter: ["multi-cloud", "aks", "eks", "gke"]
+        starter: ["multi-cloud", "aks", "eks", "gke", "scw"]
 
     steps:
     - name: "Download test-artifacts"
@@ -208,9 +208,21 @@ jobs:
         # SCW: set region
         sed -i 's/# region = "fr-par"/region = "fr-par"/g' scw_zero_cluster.tf || true
 
+        # SCW: set cluster_version (scw quickstart has this commented out; multi-cloud has it active already)
+        sed -i 's/# cluster_version = "1.35"/cluster_version = "1.35"/g' scw_zero_cluster.tf || true
+
         # SCW: set zones
         sed -i 's/# zones = \["fr-par-1", "fr-par-2", "fr-par-3"\]/zones = ["fr-par-1", "fr-par-2", "fr-par-3"]/g' scw_zero_cluster.tf || true
 
+        # SCW: set organization_id
+        sed -i 's/organization_id = ""/organization_id = "c3d17bc8-d7a3-48ac-b6e2-d8135e76ceb7"/g' scw_zero_providers.tf || true
+
+        # SCW: set project_id
+        sed -i 's/project_id      = ""/project_id      = "b2bf9427-9ca5-4320-9fb3-ea9a33451338"/g' scw_zero_providers.tf || true
+
+        # SCW: set provider region
+        sed -i 's/region = ""/region = "fr-par"/g' scw_zero_providers.tf || true
+
     - name: "OpenTofu init"
       working-directory: ./kubestack-starter-${{ matrix.starter }}
       run: |
@@ -241,23 +253,25 @@ jobs:
         KBST_AUTH_AWS: ${{ secrets.KBST_AUTH_AWS }}
         KBST_AUTH_AZ: ${{ secrets.KBST_AUTH_AZ }}
         KBST_AUTH_GCLOUD: ${{ secrets.KBST_AUTH_GCLOUD }}
+        KBST_AUTH_SCW: ${{ secrets.KBST_AUTH_SCW }}
       run: |
         docker run --rm \
           -e KBST_AUTH_AWS \
           -e KBST_AUTH_AZ \
           -e KBST_AUTH_GCLOUD \
+          -e KBST_AUTH_SCW \
           -v `pwd`:/infra \
           -v /var/run/docker.sock:/var/run/docker.sock \
           test-image:${{ github.sha }} \
-          tofu plan --target module.aks_zero --target module.eks_zero --target module.gke_zero
+          tofu plan --target module.aks_zero --target module.eks_zero --target module.gke_zero --target module.scw_zero
 
   publish-image:
     runs-on: ubuntu-latest
     needs: [test]
 
     strategy:
       matrix:
-        starter: ["multi-cloud", "aks", "eks", "gke"]
+        starter: ["multi-cloud", "aks", "eks", "gke", "scw"]
 
     steps:
     - name: "Download test-artifacts"
@@ -304,7 +318,7 @@ jobs:
 
     strategy:
       matrix:
-        starter: ["multi-cloud", "aks", "eks", "gke"]
+        starter: ["multi-cloud", "aks", "eks", "gke", "scw"]
 
     steps:
     - name: "Download test-artifacts"

AGENTS.md

@@ -174,6 +174,17 @@ Node-pool modules MUST additionally expose a configuration attribute for Kuberne
 - All configuration attribute names SHOULD mirror the respective provider resource attribute names.
 - Provider resource blocks containing nested arguments SHOULD be reflected as nested configuration object attributes.
 
+#### Scaleway Provider Alias
+
+Every `provider "scaleway"` alias block in a quickstart (one per Scaleway cluster) MUST explicitly set both `organization_id` and `project_id`.
+Unlike other supported providers, the Scaleway Terraform provider falls back to reading these values from the CLI config file or `SCW_DEFAULT_ORGANIZATION_ID` / `SCW_DEFAULT_PROJECT_ID` environment variables when they are absent from the provider block.
+Relying on that fallback means the target organization and project are determined by whatever auth context happens to be active at plan/apply time, rather than being captured in IaC.
+Setting them explicitly in the provider block makes the intended scope unambiguous and auditable.
+
+Both values MUST be set as active empty-string assignments (`organization_id = ""`, `project_id = ""`) in the quickstart provider file, following the same pattern as `region = ""` for EKS and other providers that require values at the provider block level.
+The `region` attribute MUST also be set as an active empty-string assignment in the provider block so that it is visible and consistent with `organization_id` and `project_id`.
+Corresponding `sed` lines in the **"Configure Kubestack"** CI step MUST substitute the empty strings with real values before running `tofu validate` and `tofu plan`.
+
 ## Repository and Module Layout
 
 ### Directory Structure

oci/entrypoint_user

@@ -57,9 +57,25 @@ if [ -x "$(command -v gcloud)" ]; then
   fi
 fi
 
+#
+#
+# Scaleway auth
+# only if scw cli is installed
+if [ -x "$(command -v scw)" ]; then
+  SCW_CONFIG_PATH=~/.config/scw
+  mkdir -p $SCW_CONFIG_PATH
+
+  # handle base64 encoded SCW credentials
+  if [ ! -z "$KBST_AUTH_SCW" ]; then
+    echo "$KBST_AUTH_SCW" | base64 --decode > $SCW_CONFIG_PATH/config.yaml
+    scw config validate
+  fi
+fi
+
 # do not have KBST_AUTH_* env vars set in runtime env
 unset KBST_AUTH_AWS
 unset KBST_AUTH_AZ
 unset KBST_AUTH_GCLOUD
+unset KBST_AUTH_SCW
 
 exec "$@"

quickstart/src/configurations/multi-cloud/scw_zero_cluster.tf

@@ -39,6 +39,13 @@ module "scw_zero" {
         # Commercial node type — see `scw k8s node-pool list-available-types`
         node_type = "DEV1-M"
 
+        # Availability zones to distribute the default node pool across.
+        # One pool is created per zone. Must be explicitly specified.
+        # fr-par: zones = ["fr-par-1", "fr-par-2", "fr-par-3"]
+        # nl-ams: zones = ["nl-ams-1", "nl-ams-2", "nl-ams-3"]
+        # pl-waw: zones = ["pl-waw-1", "pl-waw-2", "pl-waw-3"]
+        # zones = ["fr-par-1", "fr-par-2", "fr-par-3"]
+
         # Initial number of nodes in the pool
         size = 1
 

quickstart/src/configurations/multi-cloud/scw_zero_providers.tf

@@ -1,7 +1,14 @@
 provider "scaleway" {
-  # region is read from SCW_DEFAULT_REGION environment variable
-  # or can be set explicitly, e.g.:
-  # region = "fr-par"
+  # The Scaleway provider requires organization_id and project_id to be set
+  # explicitly so the target scope is captured in IaC rather than inferred
+  # from the CLI config or SCW_DEFAULT_ORGANIZATION_ID / SCW_DEFAULT_PROJECT_ID
+  # environment variables.
+  organization_id = ""
+  project_id      = ""
+
+  # Region is also required. Set it to match the region configured in the
+  # cluster module, e.g. "fr-par", "nl-ams", "pl-waw".
+  region = ""
 }
 
 provider "kustomization" {

quickstart/src/configurations/scw/scw_zero_cluster.tf

@@ -21,6 +21,10 @@ module "scw_zero" {
       # Uncomment and set to your target region, e.g:
       # region = "fr-par"
 
+      # Kubernetes version for the cluster
+      # Use a minor version string to allow patch upgrades, e.g. "1.32"
+      # cluster_version = "1.32"
+
       default_node_pool = {
         # Commercial node type — must be available in every zone listed below.
         # Run `scw k8s node-pool list-available-types` to list types per zone.

quickstart/src/configurations/scw/scw_zero_providers.tf

@@ -1,7 +1,14 @@
 provider "scaleway" {
-  # region is read from SCW_DEFAULT_REGION environment variable
-  # or can be set explicitly, e.g.:
-  # region = "fr-par"
+  # The Scaleway provider requires organization_id and project_id to be set
+  # explicitly so the target scope is captured in IaC rather than inferred
+  # from the CLI config or SCW_DEFAULT_ORGANIZATION_ID / SCW_DEFAULT_PROJECT_ID
+  # environment variables.
+  organization_id = ""
+  project_id      = ""
+
+  # Region is also required. Set it to match the region configured in the
+  # cluster module, e.g. "fr-par", "nl-ams", "pl-waw".
+  region = ""
 }
 
 provider "kustomization" {