Scaleway auth in entrypoint and explicit provider config

Author: pst

.github/workflows/main.yml

@@ -54,7 +54,7 @@ jobs:
     needs: [build-test-artifacts]
     strategy:
       matrix:
-        starter: ["multi-cloud", "aks", "eks", "gke"]
+        starter: ["multi-cloud", "aks", "eks", "gke", "scw"]
 
     permissions:
       id-token: write # required for keyless signing
@@ -117,7 +117,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        starter: ["multi-cloud", "aks", "eks", "gke"]
+        starter: ["multi-cloud", "aks", "eks", "gke", "scw"]
 
     steps:
     - name: "Download test-artifacts"
@@ -211,6 +211,15 @@ jobs:
         # SCW: set zones
         sed -i 's/# zones = \["fr-par-1", "fr-par-2", "fr-par-3"\]/zones = ["fr-par-1", "fr-par-2", "fr-par-3"]/g' scw_zero_cluster.tf || true
 
+        # SCW: set organization_id
+        sed -i 's/organization_id = ""/organization_id = "c3d17bc8-d7a3-48ac-b6e2-d8135e76ceb7"/g' scw_zero_providers.tf || true
+
+        # SCW: set project_id
+        sed -i 's/project_id      = ""/project_id      = "b2bf9427-9ca5-4320-9fb3-ea9a33451338"/g' scw_zero_providers.tf || true
+
+        # SCW: set provider region
+        sed -i 's/region = ""/region = "fr-par"/g' scw_zero_providers.tf || true
+
     - name: "OpenTofu init"
       working-directory: ./kubestack-starter-${{ matrix.starter }}
       run: |
@@ -241,23 +250,25 @@ jobs:
         KBST_AUTH_AWS: ${{ secrets.KBST_AUTH_AWS }}
         KBST_AUTH_AZ: ${{ secrets.KBST_AUTH_AZ }}
         KBST_AUTH_GCLOUD: ${{ secrets.KBST_AUTH_GCLOUD }}
+        KBST_AUTH_SCW: ${{ secrets.KBST_AUTH_SCW }}
       run: |
         docker run --rm \
           -e KBST_AUTH_AWS \
           -e KBST_AUTH_AZ \
           -e KBST_AUTH_GCLOUD \
+          -e KBST_AUTH_SCW \
           -v `pwd`:/infra \
           -v /var/run/docker.sock:/var/run/docker.sock \
           test-image:${{ github.sha }} \
-          tofu plan --target module.aks_zero --target module.eks_zero --target module.gke_zero
+          tofu plan --target module.aks_zero --target module.eks_zero --target module.gke_zero --target module.scw_zero
 
   publish-image:
     runs-on: ubuntu-latest
     needs: [test]
 
     strategy:
       matrix:
-        starter: ["multi-cloud", "aks", "eks", "gke"]
+        starter: ["multi-cloud", "aks", "eks", "gke", "scw"]
 
     steps:
     - name: "Download test-artifacts"
@@ -304,7 +315,7 @@ jobs:
 
     strategy:
       matrix:
-        starter: ["multi-cloud", "aks", "eks", "gke"]
+        starter: ["multi-cloud", "aks", "eks", "gke", "scw"]
 
     steps:
     - name: "Download test-artifacts"

AGENTS.md

@@ -173,6 +173,7 @@ Node-pool modules MUST additionally expose a configuration attribute for Kuberne
 - Region, zones, instance type, and `min`/`max` node counts MUST be exposed as required configuration attributes in every module, using provider-specific attribute names. Modules MUST NOT set defaults for these values.
 - All configuration attribute names SHOULD mirror the respective provider resource attribute names.
 - Provider resource blocks containing nested arguments SHOULD be reflected as nested configuration object attributes.
+- Scope-defining attributes — including but not limited to account, project, organization, subscription, and region — MUST always be specified explicitly in code, either on the provider block or as a module configuration attribute, following the best practice for the respective cloud provider. They MUST NOT be left implicit so that they are inferred from CLI defaults, environment variables, or the active authentication context. This ensures the intended scope of every cluster is unambiguous, auditable, and reproducible regardless of the local environment running the plan.
 
 ## Repository and Module Layout
 

oci/entrypoint_user

@@ -57,9 +57,25 @@ if [ -x "$(command -v gcloud)" ]; then
   fi
 fi
 
+#
+#
+# Scaleway auth
+# only if scw cli is installed
+if [ -x "$(command -v scw)" ]; then
+  SCW_CONFIG_PATH=~/.config/scw
+  mkdir -p $SCW_CONFIG_PATH
+
+  # handle base64 encoded SCW credentials
+  if [ ! -z "$KBST_AUTH_SCW" ]; then
+    echo "$KBST_AUTH_SCW" | base64 --decode > $SCW_CONFIG_PATH/config.yaml
+    scw config validate
+  fi
+fi
+
 # do not have KBST_AUTH_* env vars set in runtime env
 unset KBST_AUTH_AWS
 unset KBST_AUTH_AZ
 unset KBST_AUTH_GCLOUD
+unset KBST_AUTH_SCW
 
 exec "$@"

quickstart/src/configurations/multi-cloud/scw_zero_cluster.tf

@@ -22,8 +22,8 @@ module "scw_zero" {
       # region = "fr-par"
 
       # Kubernetes version for the cluster
-      # Use a minor version string to allow patch upgrades, e.g. "1.32"
-      cluster_version = "1.32"
+      # Use a minor version string to allow patch upgrades, e.g. "1.35"
+      cluster_version = "1.35"
 
       # Container Network Interface plugin
       # Options: "cilium", "calico", "weave", "flannel", "kilo"
@@ -39,6 +39,13 @@ module "scw_zero" {
         # Commercial node type — see `scw k8s node-pool list-available-types`
         node_type = "DEV1-M"
 
+        # Availability zones to distribute the default node pool across.
+        # One pool is created per zone. Must be explicitly specified.
+        # fr-par: zones = ["fr-par-1", "fr-par-2", "fr-par-3"]
+        # nl-ams: zones = ["nl-ams-1", "nl-ams-2", "nl-ams-3"]
+        # pl-waw: zones = ["pl-waw-1", "pl-waw-2", "pl-waw-3"]
+        # zones = ["fr-par-1", "fr-par-2", "fr-par-3"]
+
         # Initial number of nodes in the pool
         size = 1
 

quickstart/src/configurations/multi-cloud/scw_zero_providers.tf

@@ -1,7 +1,14 @@
 provider "scaleway" {
-  # region is read from SCW_DEFAULT_REGION environment variable
-  # or can be set explicitly, e.g.:
-  # region = "fr-par"
+  # The Scaleway provider requires organization_id and project_id to be set
+  # explicitly so the target scope is captured in IaC rather than inferred
+  # from the CLI config or SCW_DEFAULT_ORGANIZATION_ID / SCW_DEFAULT_PROJECT_ID
+  # environment variables.
+  organization_id = ""
+  project_id      = ""
+
+  # Region is also required. Set it to match the region configured in the
+  # cluster module, e.g. "fr-par", "nl-ams", "pl-waw".
+  region = ""
 }
 
 provider "kustomization" {

quickstart/src/configurations/scw/scw_zero_cluster.tf

@@ -21,6 +21,10 @@ module "scw_zero" {
       # Uncomment and set to your target region, e.g:
       # region = "fr-par"
 
+      # Kubernetes version for the cluster
+      # Use a minor version string to allow patch upgrades, e.g. "1.35"
+      cluster_version = "1.35"
+
       default_node_pool = {
         # Commercial node type — must be available in every zone listed below.
         # Run `scw k8s node-pool list-available-types` to list types per zone.

quickstart/src/configurations/scw/scw_zero_providers.tf

@@ -1,7 +1,14 @@
 provider "scaleway" {
-  # region is read from SCW_DEFAULT_REGION environment variable
-  # or can be set explicitly, e.g.:
-  # region = "fr-par"
+  # The Scaleway provider requires organization_id and project_id to be set
+  # explicitly so the target scope is captured in IaC rather than inferred
+  # from the CLI config or SCW_DEFAULT_ORGANIZATION_ID / SCW_DEFAULT_PROJECT_ID
+  # environment variables.
+  organization_id = ""
+  project_id      = ""
+
+  # Region is also required. Set it to match the region configured in the
+  # cluster module, e.g. "fr-par", "nl-ams", "pl-waw".
+  region = ""
 }
 
 provider "kustomization" {

tests/scw_zero_cluster.tf

@@ -9,7 +9,7 @@ module "scw_zero" {
 
       region = "nl-ams"
 
-      cluster_version = "1.34"
+      cluster_version = "1.35"
       cni             = "cilium"
 
       delete_additional_resources = false