Scaleway auth in entrypoint and explicit provider config

Author: pst

.github/workflows/main.yml

@@ -206,11 +206,17 @@ jobs:
         sed -i 's/# max_node_count = 3/max_node_count = 3/g' gke_zero_cluster.tf || true
 
         # SCW: set region
-        sed -i 's/# region = "fr-par"/region = "fr-par"/g' scw_zero_cluster.tf || true
+        sed -i 's/region = ""/region = "fr-par"/g' scw_zero_cluster.tf || true
 
         # SCW: set zones
         sed -i 's/# zones = \["fr-par-1", "fr-par-2", "fr-par-3"\]/zones = ["fr-par-1", "fr-par-2", "fr-par-3"]/g' scw_zero_cluster.tf || true
 
+        # SCW: set organization_id
+        sed -i 's/organization_id = ""/organization_id = "c3d17bc8-d7a3-48ac-b6e2-d8135e76ceb7"/g' scw_zero_providers.tf || true
+
+        # SCW: set project_id
+        sed -i 's/project_id      = ""/project_id      = "b2bf9427-9ca5-4320-9fb3-ea9a33451338"/g' scw_zero_providers.tf || true
+
     - name: "OpenTofu init"
       working-directory: ./kubestack-starter-${{ matrix.starter }}
       run: |
@@ -241,11 +247,13 @@ jobs:
         KBST_AUTH_AWS: ${{ secrets.KBST_AUTH_AWS }}
         KBST_AUTH_AZ: ${{ secrets.KBST_AUTH_AZ }}
         KBST_AUTH_GCLOUD: ${{ secrets.KBST_AUTH_GCLOUD }}
+        KBST_AUTH_SCW: ${{ secrets.KBST_AUTH_SCW }}
       run: |
         docker run --rm \
           -e KBST_AUTH_AWS \
           -e KBST_AUTH_AZ \
           -e KBST_AUTH_GCLOUD \
+          -e KBST_AUTH_SCW \
           -v `pwd`:/infra \
           -v /var/run/docker.sock:/var/run/docker.sock \
           test-image:${{ github.sha }} \

AGENTS.md

@@ -174,6 +174,15 @@ Node-pool modules MUST additionally expose a configuration attribute for Kuberne
 - All configuration attribute names SHOULD mirror the respective provider resource attribute names.
 - Provider resource blocks containing nested arguments SHOULD be reflected as nested configuration object attributes.
 
+#### Scaleway Provider Alias
+
+Every `provider "scaleway"` alias block in a quickstart (one per Scaleway cluster) MUST explicitly set both `organization_id` and `project_id`.
+Unlike other supported providers, the Scaleway Terraform provider falls back to reading these values from the CLI config file or `SCW_DEFAULT_ORGANIZATION_ID` / `SCW_DEFAULT_PROJECT_ID` environment variables when they are absent from the provider block.
+Relying on that fallback means the target organization and project are determined by whatever auth context happens to be active at plan/apply time, rather than being captured in IaC.
+Setting them explicitly in the provider block makes the intended scope unambiguous and auditable.
+
+Both values MUST be represented as commented-out example lines in the quickstart provider file (see Quickstart Placeholder and CI Injection Pattern), and activated by corresponding `sed` lines in the **"Configure Kubestack"** CI step.
+
 ## Repository and Module Layout
 
 ### Directory Structure

oci/entrypoint_user

@@ -57,9 +57,25 @@ if [ -x "$(command -v gcloud)" ]; then
   fi
 fi
 
+#
+#
+# Scaleway auth
+# only if scw cli is installed
+if [ -x "$(command -v scw)" ]; then
+  SCW_CONFIG_PATH=~/.config/scw
+  mkdir -p $SCW_CONFIG_PATH
+
+  # handle base64 encoded SCW credentials
+  if [ ! -z "$KBST_AUTH_SCW" ]; then
+    echo "$KBST_AUTH_SCW" | base64 --decode > $SCW_CONFIG_PATH/config.yaml
+    scw config validate
+  fi
+fi
+
 # do not have KBST_AUTH_* env vars set in runtime env
 unset KBST_AUTH_AWS
 unset KBST_AUTH_AZ
 unset KBST_AUTH_GCLOUD
+unset KBST_AUTH_SCW
 
 exec "$@"

quickstart/src/configurations/multi-cloud/scw_zero_providers.tf

@@ -1,7 +1,7 @@
 provider "scaleway" {
-  # region is read from SCW_DEFAULT_REGION environment variable
-  # or can be set explicitly, e.g.:
-  # region = "fr-par"
+  region          = ""
+  organization_id = ""
+  project_id      = ""
 }
 
 provider "kustomization" {

quickstart/src/configurations/scw/scw_zero_providers.tf

@@ -1,7 +1,7 @@
 provider "scaleway" {
-  # region is read from SCW_DEFAULT_REGION environment variable
-  # or can be set explicitly, e.g.:
-  # region = "fr-par"
+  region          = ""
+  organization_id = ""
+  project_id      = ""
 }
 
 provider "kustomization" {