feat: deploy k8s vms with Terraform and Ansible(#8)

Reviewed-on: #8

ansible/kubernetes/README.md

@@ -0,0 +1,97 @@
+# Ansible – Kubernetes nodes
+
+Prepares the Kubernetes VM nodes provisioned by the
+[`kubernetes_vms` Terraform project](../../terraform/projects/kubernetes_vms/).
+
+## What it does
+
+The `k8s_node` playbook configures each node for `kubeadm`/`kubelet`:
+
+1. **System** – disables swap (runtime + fstab), loads `overlay` and `br_netfilter`,
+   persists kernel modules, applies the Kubernetes `sysctl` settings.
+2. **Packages** – installs prerequisites, adds the official Kubernetes apt repo/key,
+   installs and holds `kubeadm` and `kubelet`.
+3. **containerd** – installs it, generates the default config, enables the
+   `SystemdCgroup` driver, starts and enables the service.
+4. **Firewall** – configures UFW per role: SSH + common Kubernetes ports from the admin
+   subnet, control-plane ports (`2379:2380`, `10257`, `10259`) on masters, worker ports
+   (`10256`, `30000:32767`) on workers, default deny incoming.
+
+Group membership (who is a `master` / `worker`) is resolved from the Terraform inventory,
+so the role-specific firewall rules apply automatically.
+
+> Cluster bootstrap (`kubeadm init` / `kubeadm join`) is **not** part of this playbook
+> and is done manually per the migration roadmap.
+
+## Inventory
+
+The inventory is generated from Terraform state via the `cloud.terraform` inventory
+plugin:
+
+```yaml
+# inventories/tf_k8s_vms.yml
+---
+plugin: cloud.terraform.terraform_provider
+project_path:
+  - /tmp/semaphore/project_1/repository_1_template_7/terraform/projects/kubernetes_vms
+```
+
+> The `project_path` is a Semaphore runtime checkout path. If you run locally, point it
+> at your own `terraform/projects/kubernetes_vms` directory. The same `ansible` provider
+> that writes the inventory is used by Terraform, so hosts/groups are always in sync with
+> the applied VMs.
+
+## Requirements
+
+Install the collections referenced by `collections/requirements.yml`:
+
+```bash
+ansible-galaxy collection install -r collections/requirements.yml
+```
+
+- `cloud.terraform` – Terraform inventory plugin
+- `community.general` – `ufw` module
+
+## Usage
+
+```bash
+# Connectivity check
+ansible-playbook -i inventories/tf_k8s_vms.yml ping.yml
+
+# Prepare all Kubernetes nodes
+ansible-playbook -i inventories/tf_k8s_vms.yml k8s_node.yml
+```
+
+Both playbooks target `all`; the inventory plugin runs from the Terraform project path.
+
+## Role variables
+
+Defined in `roles/k8s_node/defaults/main.yml` (override as needed):
+
+| Variable                        | Default                      | Description                            |
+| ------------------------------- | ---------------------------- | -------------------------------------- |
+| `k8s_version`                   | `1.37`                       | Kubernetes minor version               |
+| `k8s_repo`                      | `pkgs.k8s.io` core v<ver>    | Kubernetes apt repository              |
+| `k8s_repo_key`                  | matching `Release.key` URL   | Repository signing key                 |
+| `k8s_packages`                  | `kubelet`, `kubeadm`         | Packages installed and held            |
+| `k8s_prerequisite_packages`     | `apt-transport-https`, `ca-certificates`, `curl`, `gnupg` | Build deps for the repo   |
+| `k8s_firewall_admin_subnet`     | `192.168.66.0/24`            | Subnet allowed through UFW             |
+| `k8s_firewall_ssh_port`         | `22`                         | SSH port                               |
+| `k8s_firewall_common_ports`     | `6443`, `10250`              | Ports open on all nodes                |
+| `k8s_firewall_master_ports`     | `2379:2380`, `10257`, `10259` | Ports open on masters                |
+| `k8s_firewall_worker_ports`     | `10256`, `30000:32767`       | Ports open on workers                  |
+
+## File reference
+
+| Path                                     | Purpose                              |
+| ---------------------------------------- | ------------------------------------ |
+| `k8s_node.yml`                           | Main playbook (role `k8s_node`)      |
+| `ping.yml`                               | Connectivity smoke-test playbook     |
+| `inventories/tf_k8s_vms.yml`             | Terraform-backed inventory           |
+| `collections/requirements.yml`           | Required Ansible collections         |
+| `roles/k8s_node/tasks/main.yml`          | Task dispatcher                      |
+| `roles/k8s_node/tasks/system.yml`        | Swap, kernel modules, sysctl         |
+| `roles/k8s_node/tasks/packages.yml`      | Kubernetes repo + kubeadm/kubelet    |
+| `roles/k8s_node/tasks/containerd.yml`    | containerd install/config            |
+| `roles/k8s_node/tasks/firewall.yml`      | Per-role UFW rules                   |
+| `roles/k8s_node/defaults/main.yml`       | Role defaults                        |

ansible/kubernetes/collections/requirements.yml

@@ -0,0 +1,4 @@
+---
+collections:
+  - name: cloud.terraform
+  - name: community.general

ansible/kubernetes/inventories/tf_k8s_vms.yml

@@ -0,0 +1,4 @@
+---
+plugin: cloud.terraform.terraform_provider
+project_path:
+  - /tmp/semaphore/project_1/repository_1_template_7/terraform/projects/kubernetes_vms

ansible/kubernetes/k8s_node.yml

@@ -0,0 +1,6 @@
+---
+- name: Prepare Kubernetes nodes
+  hosts: all
+
+  roles:
+    - role: k8s_node

ansible/kubernetes/ping.yml

@@ -0,0 +1,5 @@
+---
+- name: Prepare Kubernetes nodes
+  hosts: all
+  tasks:
+    - ansible.builtin.ping:

ansible/kubernetes/roles/k8s_node/defaults/main.yml

@@ -0,0 +1,32 @@
+---
+k8s_version: "1.37"
+
+k8s_repo: "https://pkgs.k8s.io/core:/stable:/v{{ k8s_version }}/deb"
+k8s_repo_key: "https://pkgs.k8s.io/core:/stable:/v{{ k8s_version }}/deb/Release.key"
+
+k8s_packages:
+  - kubelet
+  - kubeadm
+
+k8s_prerequisite_packages:
+  - apt-transport-https
+  - ca-certificates
+  - curl
+  - gnupg
+
+k8s_firewall_admin_subnet: "192.168.88.0/24"
+k8s_firewall_ssh_port: "22"
+k8s_firewall_common_ports:
+  - "6443"
+  - "10250"
+k8s_firewall_master_ports:
+  - "2379:2380"
+  - "10257"
+  - "10259"
+k8s_firewall_worker_ports:
+  - "10256"
+  - "30000:32767"
+k8s_firewall_cilium_udp_ports:
+  - "8472"
+k8s_firewall_cilium_tcp_ports:
+  - "4240"

ansible/kubernetes/roles/k8s_node/tasks/containerd.yml

@@ -0,0 +1,34 @@
+---
+- name: Install containerd
+  ansible.builtin.apt:
+    name: containerd
+    state: present
+    update_cache: true
+  become: yes
+
+- name: Create containerd configuration directory
+  ansible.builtin.file:
+    path: /etc/containerd
+    state: directory
+    mode: "0755"
+  become: yes
+
+- name: Generate default containerd configuration
+  ansible.builtin.shell:
+    cmd: containerd config default > /etc/containerd/config.toml
+    creates: /etc/containerd/config.toml
+  become: yes
+
+- name: Enable systemd cgroup driver in containerd
+  ansible.builtin.replace:
+    path: /etc/containerd/config.toml
+    regexp: '^(\s*)SystemdCgroup(\s*=\s*)false'
+    replace: '\1SystemdCgroup\2true'
+  become: yes
+
+- name: Enable and start containerd
+  ansible.builtin.systemd:
+    name: containerd
+    state: restarted
+    enabled: true
+  become: yes

ansible/kubernetes/roles/k8s_node/tasks/firewall.yml

@@ -0,0 +1,62 @@
+---
+- name: Allow SSH from admin subnet
+  community.general.ufw:
+    rule: allow
+    port: "{{ k8s_firewall_ssh_port }}"
+    proto: tcp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+
+- name: Allow common Kubernetes ports from admin subnet
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+  loop: "{{ k8s_firewall_common_ports }}"
+
+- name: Allow etcd and control plane ports on control-plane nodes
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+  loop: "{{ k8s_firewall_master_ports }}"
+  when: inventory_hostname in groups['master']
+
+- name: Allow kube-proxy and NodePort ports on worker nodes
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+  loop: "{{ k8s_firewall_worker_ports }}"
+  when: inventory_hostname in groups['worker']
+
+- name: Allow Cilium VXLAN and health check UDP ports from admin subnet
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: udp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+  loop: "{{ k8s_firewall_cilium_udp_ports }}"
+
+- name: Allow Cilium health check TCP ports from admin subnet
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+    from_ip: "{{ k8s_firewall_admin_subnet }}"
+  become: yes
+  loop: "{{ k8s_firewall_cilium_tcp_ports }}"
+
+- name: Enable ufw and deny incoming by default
+  community.general.ufw:
+    state: enabled
+    policy: deny
+    direction: incoming
+  become: yes

ansible/kubernetes/roles/k8s_node/tasks/main.yml

@@ -0,0 +1,5 @@
+---
+- ansible.builtin.import_tasks: system.yml
+- ansible.builtin.import_tasks: packages.yml
+- ansible.builtin.import_tasks: containerd.yml
+- ansible.builtin.import_tasks: firewall.yml

ansible/kubernetes/roles/k8s_node/tasks/packages.yml

@@ -0,0 +1,36 @@
+---
+- name: Install prerequisite packages
+  ansible.builtin.apt:
+    name: "{{ k8s_prerequisite_packages }}"
+    state: present
+    update_cache: true
+  become: yes
+
+- name: Add Kubernetes apt key
+  ansible.builtin.apt_key:
+    url: "{{ k8s_repo_key }}"
+    keyring: /etc/apt/keyrings/kubernetes-apt-keyring.gpg
+    state: present
+  become: yes
+
+- name: Add Kubernetes apt repository
+  ansible.builtin.apt_repository:
+    repo: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] {{ k8s_repo }} /"
+    state: present
+    filename: kubernetes
+  become: yes
+
+- name: Install kubelet and kubeadm
+  ansible.builtin.apt:
+    name: "{{ k8s_packages }}"
+    state: present
+    update_cache: true
+  become: yes
+
+- name: Hold kubelet and kubeadm packages
+  ansible.builtin.command:
+    cmd: apt-mark hold {{ item }}
+  loop: "{{ k8s_packages }}"
+  register: _kube_hold
+  become: yes
+  changed_when: "'already set on hold' not in _kube_hold.stdout"

ansible/kubernetes/roles/k8s_node/tasks/system.yml

@@ -0,0 +1,51 @@
+---
+- name: Disable swap
+  ansible.builtin.shell:
+    cmd: swapoff -a
+  become: yes
+  changed_when: false
+
+- name: Comment out swap entries in fstab
+  ansible.builtin.replace:
+    path: /etc/fstab
+    regexp: '^(\s*[^#\s][^\s]*\s+swap\s+.*)$'
+    replace: '# \1'
+  become: yes
+
+- name: Load overlay kernel module
+  ansible.builtin.shell:
+    cmd: modprobe overlay
+  become: yes
+  changed_when: false
+  failed_when: false
+
+- name: Load br_netfilter kernel module
+  ansible.builtin.shell:
+    cmd: modprobe br_netfilter
+  become: yes
+  changed_when: false
+
+- name: Persist kernel modules
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/k8s.conf
+    content: |
+      overlay
+      br_netfilter
+    mode: "0644"
+  become: yes
+
+- name: Configure kernel network settings
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/k8s.conf
+    content: |
+      net.bridge.bridge-nf-call-iptables  = 1
+      net.bridge.bridge-nf-call-ip6tables = 1
+      net.ipv4.ip_forward                 = 1
+    mode: "0644"
+  become: yes
+
+- name: Apply kernel network settings
+  ansible.builtin.command:
+    cmd: sysctl --system
+  become: yes
+  changed_when: false

ansible/proxmox/update_proxmox.yml

@@ -104,6 +104,23 @@
               autoremove: true
               autoclean: true
 
+          - name: Check whether Proxmox subscription nag is already patched
+            ansible.builtin.shell:
+              cmd: >
+                grep -Fq
+                'return (typeof orig_cmd === "function" && (orig_cmd(), true));'
+                /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
+            register: proxmox_nag_patch
+            changed_when: false
+            failed_when: false
+
+          - name: Patch Proxmox subscription nag
+            ansible.builtin.lineinfile:
+              path: /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
+              insertafter: 'checked_command: function (orig_cmd) {'
+              line: '            return (typeof orig_cmd === "function" && (orig_cmd(), true));'
+            when: proxmox_nag_patch.rc != 0
+
           - name: Disable Ceph rebalancing
             ansible.builtin.command: ceph osd set noout
 

terraform/projects/kubernetes_vms/README.md

@@ -0,0 +1,93 @@
+# Terraform – Kubernetes VMs
+
+Provisions the Kubernetes node VMs on Proxmox for the homelab Kubernetes cluster.
+
+## Overview
+
+This Terraform project clones the `ubuntu-noble-cloud` template into virtual machines
+on the proxmox nodes, following a capacity-aware placement algorithm:
+
+1. **Control plane (master)** VMs are spread one per node, on the nodes with the most
+   free memory that still fit the role's `ram`.
+2. **Pack roles (worker)** are water-filled over the remaining capacity, most-available
+   node first, without a per-node limit.
+
+Each VM is tagged with the environment (`vm_env`) and registered in a Terraform-backed
+Ansible inventory (via the `ansible` provider), so the `k8s_node` playbook can target
+them by role group.
+
+## Placement details
+
+- Online Proxmox nodes are ordered by available memory (most available first, node name
+  as tie-break).
+- The control-plane role must fit entirely on distinct nodes with `free_mib >= ram`.
+- Workers are packed into residual capacity (`free_mib - ram_per_cp_vm_on_node`),
+  again most-available first.
+- Naming: `kub-<env>-m<NN>` for masters and `kub-<env>-w<NN>` for workers, e.g.
+  `kub-prod-m01`, `kub-prod-w01`.
+
+Deployment is blocked by `check` blocks when the fleet cannot be placed:
+
+- no online node is available,
+- not enough nodes have the free memory required for the control-plane role,
+- residual capacity cannot fit all worker VMs.
+
+## Prerequisites
+
+- Proxmox with:
+  - a cloneable template named `ubuntu-noble-cloud` (from the `pve_vm` module),
+  - a `ceph-workload` datastore,
+  - VLAN bridge `vlan<id>` (default `vlan66`),
+  - an API token and an SSH user/password with rights to create VMs on the nodes.
+- Terraform with the `bpg/proxmox` and `ansible/ansible` providers (init downloads them).
+
+## Input variables
+
+| Variable                     | Type     | Required | Default                      | Description                                        |
+| ---------------------------- | -------- | -------- | ---------------------------- | -------------------------------------------------- |
+| `proxmox_endpoint`           | string   | yes      | –                            | Proxmox API URL                                    |
+| `proxmox_api_token`          | string   | yes      | –                            | Proxmox API token (secret)                         |
+| `proxmox_ssh_username`       | string   | yes      | –                            | Proxmox SSH user for placement (secret)            |
+| `proxmox_ssh_password`       | string   | yes      | –                            | Proxmox SSH password (secret)                      |
+| `vm_env`                     | string   | no       | `"prod"`                     | Environment, part of the VM name and tags          |
+| `master_count`               | number   | no       | `null` → `vm_attr` default   | Number of master VMs                               |
+| `master_cpu`                 | number   | no       | `null` → `vm_attr` default   | vCPU cores for masters                             |
+| `master_ram`                 | number   | no       | `null` → `vm_attr` default   | Master RAM in **GiB** (converted to MiB internally)|
+| `master_vlan`                | number   | no       | `null` → `vm_attr` default   | VLAN for masters                                   |
+| `worker_count`               | number   | no       | `null` → `vm_attr` default   | Number of worker VMs                               |
+| `worker_cpu`                 | number   | no       | `null` → `vm_attr` default   | vCPU cores for workers                             |
+| `worker_ram`                 | number   | no       | `null` → `vm_attr` default   | Worker RAM in **GiB**                              |
+| `worker_vlan`                | number   | no       | `null` → `vm_attr` default   | VLAN for workers                                   |
+| `vm_attr`                    | map(… )  | no       | see below                    | Full per-role VM defaults                          |
+
+The `vm_attr` map holds the fallback attributes used when the corresponding
+`master_*`/`worker_*` override is `null`:
+
+```hcl
+vm_attr = {
+  master = { ram = 2048, cpu = 2, vlan = 66, count = 3 }
+  worker = { ram = 4096, cpu = 2, vlan = 66, count = 3 }
+}
+```
+
+> `ram` values inside `vm_attr` are MiB; the `master_ram` / `worker_ram` overrides are
+> set in GiB and converted internally (`× 1024`). The placement math always works in MiB.
+
+## Usage
+
+```bash
+terraform init
+terraform plan
+terraform apply
+```
+
+The `vm_ip` output maps VM name to assigned IP and feeds the Ansible inventory
+(`inventories/`) of the `k8s_node` playbook.
+
+## File reference
+
+| File         | Purpose                                                   |
+| ------------ | --------------------------------------------------------- |
+| `main.tf`    | Placement algorithm, `pve_vm` module wiring, checks       |
+| `variables.tf` | Clusters, Proxmox credentials, per-role defaults/overrides |
+| `provider.tf`  | `proxmox` and `ansible` provider configuration          |

terraform/projects/kubernetes_vms/main.tf

@@ -0,0 +1,198 @@
+module "pve_vm" {
+  source    = "../../modules/pve_vm"
+  for_each  = local.vm_list
+  node_name = each.value.node_name
+  vm_name   = each.key
+  vm_cpu    = each.value.vm_cpu
+  vm_ram    = each.value.vm_ram
+  vm_vlan   = each.value.vm_vlan
+  vm_tags   = ["${var.vm_env}"]
+}
+
+locals {
+  node_stats = [
+    for i, name in data.proxmox_virtual_environment_nodes.pve_nodes.names : {
+      name     = name
+      free_mib = floor(data.proxmox_virtual_environment_nodes.pve_nodes.memory_available[i] / 1024 / 1024)
+    }
+    if data.proxmox_virtual_environment_nodes.pve_nodes.online[i]
+  ]
+
+  max_free_mib = length(local.node_stats) > 0 ? max([for node in local.node_stats : node.free_mib]...) : 0
+
+  # Online nodes ordered by available memory, most available first (name as tie-break)
+  node_order = [
+    for key in sort([
+      for node in local.node_stats : "${format("%012d", local.max_free_mib - node.free_mib)}|${node.name}"
+    ]) : split("|", key)[1]
+  ]
+
+  node_free = { for node in local.node_stats : node.name => node.free_mib }
+
+  # Per-role simple overrides merged over vm_attr defaults (null keeps the default)
+  role_overrides = {
+    for role, cfg in var.vm_attr : role => lookup({
+      "master" = { count = var.master_count, ram = var.master_ram != null ? var.master_ram * 1024 : null, cpu = var.master_cpu, vlan = var.master_vlan }
+      "worker" = { count = var.worker_count, ram = var.worker_ram != null ? var.worker_ram * 1024 : null, cpu = var.worker_cpu, vlan = var.worker_vlan }
+    }, role, {})
+  }
+
+  # Internal placement rule: the control-plane role (master) sits one per node, pack roles are unlimited
+  cp_role_name      = "master"
+  role_max_per_node = { for role, cfg in var.vm_attr : role => role == local.cp_role_name ? 1 : 0 }
+
+  effective_vm_attr = {
+    for role, cfg in var.vm_attr : role => merge(cfg, {
+      for attr, value in local.role_overrides[role] : attr => value if value != null
+    }, { max_per_node = local.role_max_per_node[role] })
+  }
+
+  # Control plane (max_per_node = 1): one VM per node, only on nodes with enough free memory
+  cp_role = [for role, cfg in local.effective_vm_attr : role if cfg.max_per_node == 1][0]
+  cp_attr = local.effective_vm_attr[local.cp_role]
+
+  cp_feasible = [
+    for node in local.node_order : node
+    if local.node_free[node] >= local.cp_attr.ram
+  ]
+
+  cp_nodes = length(local.cp_feasible) >= local.cp_attr.count ? [
+    for i in range(local.cp_attr.count) : local.cp_feasible[i]
+  ] : []
+
+  cp_hosts = toset(local.cp_nodes)
+
+  # Residual capacity per node after control-plane VMs are reserved
+  residual_mib = {
+    for node in local.node_order :
+    node => local.node_free[node] - (contains(local.cp_hosts, node) ? local.cp_attr.ram : 0)
+  }
+
+  max_residual_mib = length(local.node_order) > 0 ? max([for node in local.node_order : local.residual_mib[node]]...) : 0
+
+  # Remaining roles (max_per_node != 1): pack nodes with residual capacity, most available first
+  pack_roles = [for role, cfg in local.effective_vm_attr : role if cfg.max_per_node != 1]
+
+  pack_slots = {
+    for role in local.pack_roles : role => {
+      for node in local.node_order :
+      node => min(
+        floor(local.residual_mib[node] / local.effective_vm_attr[role].ram),
+        local.effective_vm_attr[role].max_per_node == 0
+        ? floor(local.residual_mib[node] / local.effective_vm_attr[role].ram)
+        : local.effective_vm_attr[role].max_per_node
+      )
+    }
+  }
+
+  pack_precedence = {
+    for role in local.pack_roles : role => [
+      for key in sort([
+        for node in local.node_order :
+        "${format("%012d", local.max_residual_mib - local.residual_mib[node])}|${node}"
+        if local.pack_slots[role][node] >= 1
+      ]) : split("|", key)[1]
+    ]
+  }
+
+  pack_slots_list = {
+    for role in local.pack_roles : role =>
+    [for node in local.pack_precedence[role] : local.pack_slots[role][node]]
+  }
+
+  # Water-fill: each node takes VMs until it runs out of capacity or demand is met
+  pack_placed = {
+    for role in local.pack_roles : role => [
+      for i in range(length(local.pack_precedence[role])) :
+      min(local.pack_slots_list[role][i], max(0, local.effective_vm_attr[role].count - try(sum([for j in range(i) : local.pack_slots_list[role][j]]), 0)))
+    ]
+  }
+
+  pack_prefix = {
+    for role in local.pack_roles : role => [
+      for i in range(length(local.pack_placed[role])) :
+      try(sum([for j in range(i) : local.pack_placed[role][j]]), 0)
+    ]
+  }
+
+  cp_placements = [
+    for i in range(length(local.cp_nodes)) : {
+      vm_name = "kub-${var.vm_env}-${substr(local.cp_role, 0, 1)}${format("%01d", i + 1)}"
+      vm_role = local.cp_role
+      vm_node = local.cp_nodes[i]
+    }
+  ]
+
+  pack_placements = flatten([
+    for role in local.pack_roles : [
+      for p in range(length(local.pack_precedence[role])) : [
+        for k in range(local.pack_placed[role][p]) : {
+          vm_name = "kub-${var.vm_env}-${substr(role, 0, 1)}${format("%01d", local.pack_prefix[role][p] + k + 1)}"
+          vm_role = role
+          vm_node = local.pack_precedence[role][p]
+        }
+      ]
+    ]
+  ])
+
+  vm_list = {
+    for vm in concat(local.cp_placements, local.pack_placements) :
+    vm.vm_name => {
+      node_name = vm.vm_node
+      vm_cpu    = local.effective_vm_attr[vm.vm_role].cpu
+      vm_ram    = local.effective_vm_attr[vm.vm_role].ram
+      vm_vlan   = local.effective_vm_attr[vm.vm_role].vlan
+      vm_role   = vm.vm_role
+    }
+  }
+
+  roles = toset([for vm in local.vm_list : vm.vm_role])
+}
+
+data "proxmox_virtual_environment_nodes" "pve_nodes" {}
+
+check "proxmox_nodes" {
+  assert {
+    condition     = length(local.node_order) > 0
+    error_message = "No online Proxmox node available for deployment."
+  }
+}
+
+check "control_plane_capacity" {
+  assert {
+    condition     = length(local.cp_nodes) == local.cp_attr.count
+    error_message = "Cannot place ${local.cp_attr.count} ${local.cp_role} VM(s): only ${length(local.cp_feasible)} online node(s) have at least ${local.cp_attr.ram} MiB free memory."
+  }
+}
+
+check "pack_capacity" {
+  assert {
+    condition = length(local.pack_roles) == 0 ? true : alltrue([
+      for role in local.pack_roles :
+      try(sum(local.pack_placed[role]), 0) == local.effective_vm_attr[role].count
+    ])
+    error_message = "Cannot place all pack VMs: ${join(", ", [
+      for role in local.pack_roles :
+      "${role} needs ${local.effective_vm_attr[role].count} VM(s) (${local.effective_vm_attr[role].ram} MiB each), residual free capacity fits only ${try(sum(local.pack_placed[role]), 0)} VM(s)."
+      if try(sum(local.pack_placed[role]), 0) != local.effective_vm_attr[role].count
+    ])}"
+  }
+}
+
+output "vm_ip" {
+  value = { for k, v in module.pve_vm : k => v.vm_ip }
+}
+
+resource "ansible_group" "vm_groups" {
+  for_each = local.roles
+  name     = each.key
+}
+
+resource "ansible_host" "vm_hosts" {
+  for_each = module.pve_vm
+  name     = each.key
+  variables = {
+    ansible_host = each.value.vm_ip
+  }
+  groups = [local.vm_list[each.key].vm_role]
+}

terraform/projects/kubernetes_vms/provider.tf

@@ -0,0 +1,21 @@
+terraform {
+  required_providers {
+    proxmox = {
+      source = "bpg/proxmox"
+    }
+    ansible = {
+      source = "ansible/ansible"
+    }
+  }
+}
+
+provider "proxmox" {
+  endpoint  = var.proxmox_endpoint
+  api_token = var.proxmox_api_token
+  insecure  = false
+  ssh {
+    agent       = false
+    username    = var.proxmox_ssh_username
+    password    = var.proxmox_ssh_password
+  }
+}

terraform/projects/kubernetes_vms/variables.tf

@@ -0,0 +1,135 @@
+variable "proxmox_endpoint" {
+  description = "Proxmox URL endpoint"
+  type        = string
+}
+
+variable "proxmox_api_token" {
+  description = "Proxmox API token"
+  type        = string
+  sensitive   = true
+}
+
+variable "proxmox_ssh_username" {
+  description = "Proxmox SSH username"
+  type        = string
+  sensitive   = true
+}
+
+variable "proxmox_ssh_password" {
+  description = "Proxmox SSH password"
+  type        = string
+  sensitive   = true
+}
+
+variable "vm_attr" {
+  description = "VM attributes per role. The control-plane role (master) is placed one per node; other roles are packed without a per-node limit."
+  type = map(object({
+    ram   = number
+    cpu   = number
+    vlan  = number
+    count = number
+  }))
+  default = {
+    "master" = { ram = 2048, cpu = 2, vlan = 66, count = 3 }
+    "worker" = { ram = 4096, cpu = 2, vlan = 66, count = 3 }
+  }
+
+  validation {
+    condition     = alltrue([for v in values(var.vm_attr) : v.count >= 1])
+    error_message = "Each role must deploy at least 1 VM."
+  }
+}
+
+variable "master_count" {
+  description = "Master role VM count override. null keeps the vm_attr default."
+  type        = number
+  default     = null
+
+  validation {
+    condition     = var.master_count == null || var.master_count >= 1
+    error_message = "master_count must be null or at least 1."
+  }
+}
+
+variable "master_cpu" {
+  description = "Master role CPU override. null keeps the vm_attr default."
+  type        = number
+  default     = null
+
+  validation {
+    condition     = var.master_cpu == null || var.master_cpu >= 1
+    error_message = "master_cpu must be null or at least 1."
+  }
+}
+
+variable "master_ram" {
+  description = "Master role RAM override in GiB (converted to MiB internally). null keeps the vm_attr default."
+  type        = number
+  default     = null
+
+  validation {
+    condition     = var.master_ram == null || var.master_ram >= 1
+    error_message = "master_ram must be null or at least 1 GiB."
+  }
+}
+
+variable "master_vlan" {
+  description = "Master role VLAN override. null keeps the vm_attr default."
+  type        = number
+  default     = null
+
+  validation {
+    condition     = var.master_vlan == null || var.master_vlan >= 1
+    error_message = "master_vlan must be null or at least 1."
+  }
+}
+
+variable "worker_count" {
+  description = "Worker role VM count override. null keeps the vm_attr default."
+  type        = number
+  default     = null
+
+  validation {
+    condition     = var.worker_count == null || var.worker_count >= 1
+    error_message = "worker_count must be null or at least 1."
+  }
+}
+
+variable "worker_cpu" {
+  description = "Worker role CPU override. null keeps the vm_attr default."
+  type        = number
+  default     = null
+
+  validation {
+    condition     = var.worker_cpu == null || var.worker_cpu >= 1
+    error_message = "worker_cpu must be null or at least 1."
+  }
+}
+
+variable "worker_ram" {
+  description = "Worker role RAM override in GiB (converted to MiB internally). null keeps the vm_attr default."
+  type        = number
+  default     = null
+
+  validation {
+    condition     = var.worker_ram == null || var.worker_ram >= 1
+    error_message = "worker_ram must be null or at least 1 GiB."
+  }
+}
+
+variable "worker_vlan" {
+  description = "Worker role VLAN override. null keeps the vm_attr default."
+  type        = number
+  default     = null
+
+  validation {
+    condition     = var.worker_vlan == null || var.worker_vlan >= 1
+    error_message = "worker_vlan must be null or at least 1."
+  }
+}
+
+variable "vm_env" {
+  description = "VM environment"
+  type        = string
+  default     = "prod"
+}