# afinsky/terraform-k8s-helm-prometheus architecture

> Architecture diagram of the GitHub repository afinsky/terraform-k8s-helm-prometheus, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/afinsky/terraform-k8s-helm-prometheus
- Repository: https://github.com/afinsky/terraform-k8s-helm-prometheus

## Overview

This repository provisions a live AWS/EKS homelab using Terraform modules wrapped in Terragrunt account layers. The documented apply order is Identity Center, cluster infrastructure, then Kubernetes workloads; the workloads layer consumes cluster outputs and is destroyed first. The README documents the principal capabilities and dependencies, but no source excerpts were provided, so the graph omits undocumented internal call wiring.

Main entry points: [`modules/eks-workloads/main.tf`](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/main.tf) (Workload provisioning), [`modules/eks-cluster/main.tf`](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-cluster/main.tf) (Cluster provisioning), [`modules/identity-center/main.tf`](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/main.tf) (Identity Center provisioning), [`accounts/workloads-dev/us-east-1/terragrunt.stack.hcl`](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/accounts/workloads-dev/us-east-1/terragrunt.stack.hcl) (Account stack definition)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_layers["Account Layers"]
  node_account_stack["Account stack definition"]
  node_identity_unit["Identity Center unit<br/>[terragrunt.hcl]"]
  node_cluster_unit["EKS cluster unit<br/>[terragrunt.hcl]"]
  node_workloads_unit["EKS workloads unit<br/>[terragrunt.hcl]"]
end

subgraph group_identity["Identity Services"]
  node_identity_module["Identity Center provisioning<br/>[main.tf]"]
  node_org_sso["Organization and SSO<br/>[organization.tf]"]
  node_permission_sets["Groups and permissions<br/>[permission_sets.tf]"]
  node_github_oidc["GitHub OIDC<br/>[github_oidc.tf]"]
  node_ecr["Container registry<br/>[ecr.tf]"]
end

subgraph group_cluster["Cluster Infrastructure"]
  node_cluster_module["Cluster provisioning<br/>[main.tf]"]
  node_vpc["VPC networking<br/>[vpc.tf]"]
  node_eks["EKS and access<br/>[eks.tf]"]
  node_acm["TLS certificate<br/>[acm.tf]"]
end

subgraph group_workloads["Kubernetes Workloads"]
  node_workloads_module["Workload provisioning<br/>[main.tf]"]
  node_irsa["IRSA controllers"]
  node_lb_controller["Load balancer controller"]
  node_ingress["Ingress NGINX<br/>[ingress-nginx.tf]"]
  node_rbac["Cluster admin RBAC<br/>[rbac.tf]"]
  node_sample_apps["Sample applications<br/>[app.tf]"]
  node_boutique["Online Boutique<br/>[online-boutique.tf]"]
  node_manifests["Application manifests"]
end

node_operator(("Infrastructure operator"))
node_aws{{"AWS Organization"}}
node_kube{{"Kubernetes API"}}

node_operator -->|"applies first"| node_identity_unit
node_operator -->|"applies next"| node_cluster_unit
node_operator -->|"applies after"| node_workloads_unit
node_account_stack -->|"instantiates"| node_identity_unit
node_account_stack -->|"instantiates"| node_cluster_unit
node_account_stack -->|"instantiates"| node_workloads_unit
node_identity_unit -->|"uses module"| node_identity_module
node_cluster_unit -->|"uses module"| node_cluster_module
node_workloads_unit -->|"uses module"| node_workloads_module
node_identity_module -->|"provisions"| node_org_sso
node_identity_module -->|"defines"| node_permission_sets
node_identity_module -->|"configures"| node_github_oidc
node_identity_module -->|"creates"| node_ecr
node_org_sso -->|"creates organization"| node_aws
node_cluster_module -->|"provisions"| node_vpc
node_cluster_module -->|"provisions"| node_eks
node_cluster_module -->|"provisions"| node_acm
node_cluster_module -->|"creates AWS resources"| node_aws
node_workloads_module -->|"reads outputs"| node_cluster_module
node_workloads_module -->|"provisions"| node_irsa
node_workloads_module -->|"provisions"| node_lb_controller
node_workloads_module -->|"provisions"| node_ingress
node_workloads_module -->|"provisions"| node_rbac
node_workloads_module -->|"deploys"| node_sample_apps
node_workloads_module -->|"deploys"| node_boutique
node_boutique -->|"applies YAML"| node_manifests
node_irsa -->|"configures controllers"| node_kube
node_ingress -->|"deploys"| node_kube
node_rbac -->|"configures access"| node_kube
node_sample_apps -->|"deploys"| node_kube
node_boutique -->|"deploys"| node_kube
node_lb_controller -->|"fronts"| node_ingress

click node_account_stack "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/accounts/workloads-dev/us-east-1/terragrunt.stack.hcl"
click node_identity_unit "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/units/identity-center/terragrunt.hcl"
click node_cluster_unit "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/units/eks-cluster/terragrunt.hcl"
click node_workloads_unit "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/units/eks-workloads/terragrunt.hcl"
click node_identity_module "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/main.tf"
click node_org_sso "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/organization.tf"
click node_permission_sets "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/permission_sets.tf"
click node_github_oidc "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/github_oidc.tf"
click node_ecr "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/ecr.tf"
click node_cluster_module "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-cluster/main.tf"
click node_vpc "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-cluster/vpc.tf"
click node_eks "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-cluster/eks.tf"
click node_acm "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-cluster/acm.tf"
click node_workloads_module "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/main.tf"
click node_irsa "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/external-secrets.tf"
click node_lb_controller "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/load-balancer-controller.tf"
click node_ingress "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/ingress-nginx.tf"
click node_rbac "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/rbac.tf"
click node_sample_apps "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/app.tf"
click node_boutique "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/online-boutique.tf"
click node_manifests "https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/k8s/manifests/online-boutique.yaml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_account_stack,node_identity_unit,node_cluster_unit,node_workloads_unit toneBlue
class node_identity_module,node_org_sso,node_permission_sets,node_github_oidc,node_ecr toneAmber
class node_cluster_module,node_vpc,node_eks,node_acm,node_kube toneMint
class node_workloads_module,node_irsa,node_lb_controller,node_ingress,node_rbac,node_sample_apps,node_boutique,node_manifests toneRose
class node_operator,node_aws toneIndigo
```

## Components

### Account Layers

- [Account stack definition](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/accounts/workloads-dev/us-east-1/terragrunt.stack.hcl): `accounts/workloads-dev/us-east-1/terragrunt.stack.hcl`
- [Identity Center unit](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/units/identity-center/terragrunt.hcl): `units/identity-center/terragrunt.hcl`
- [EKS cluster unit](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/units/eks-cluster/terragrunt.hcl): `units/eks-cluster/terragrunt.hcl`
- [EKS workloads unit](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/units/eks-workloads/terragrunt.hcl): `units/eks-workloads/terragrunt.hcl`

### Identity Services

- [Identity Center provisioning](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/main.tf): `modules/identity-center/main.tf`
- [Organization and SSO](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/organization.tf): `modules/identity-center/organization.tf`
- [Groups and permissions](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/permission_sets.tf): `modules/identity-center/permission_sets.tf`
- [GitHub OIDC](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/github_oidc.tf): `modules/identity-center/github_oidc.tf`
- [Container registry](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/identity-center/ecr.tf): `modules/identity-center/ecr.tf`

### Cluster Infrastructure

- [Cluster provisioning](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-cluster/main.tf): `modules/eks-cluster/main.tf`
- [VPC networking](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-cluster/vpc.tf): `modules/eks-cluster/vpc.tf`
- [EKS and access](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-cluster/eks.tf): `modules/eks-cluster/eks.tf`
- [TLS certificate](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-cluster/acm.tf): `modules/eks-cluster/acm.tf`

### Kubernetes Workloads

- [Workload provisioning](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/main.tf): `modules/eks-workloads/main.tf`
- [IRSA controllers](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/external-secrets.tf): `modules/eks-workloads/external-secrets.tf`
- [Load balancer controller](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/load-balancer-controller.tf): `modules/eks-workloads/load-balancer-controller.tf`
- [Ingress NGINX](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/ingress-nginx.tf): `modules/eks-workloads/ingress-nginx.tf`
- [Cluster admin RBAC](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/rbac.tf): `modules/eks-workloads/rbac.tf`
- [Sample applications](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/app.tf): `modules/eks-workloads/app.tf`
- [Online Boutique](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/modules/eks-workloads/online-boutique.tf): `modules/eks-workloads/online-boutique.tf`
- [Application manifests](https://github.com/afinsky/terraform-k8s-helm-prometheus/blob/main/k8s/manifests/online-boutique.yaml): `k8s/manifests/online-boutique.yaml`

### Other components

- **Infrastructure operator**
- **AWS Organization**
- **Kubernetes API**

## Connections

- Infrastructure operator → Identity Center unit: applies first
- Infrastructure operator → EKS cluster unit: applies next
- Infrastructure operator → EKS workloads unit: applies after
- Account stack definition → Identity Center unit: instantiates
- Account stack definition → EKS cluster unit: instantiates
- Account stack definition → EKS workloads unit: instantiates
- Identity Center unit → Identity Center provisioning: uses module
- EKS cluster unit → Cluster provisioning: uses module
- EKS workloads unit → Workload provisioning: uses module
- Identity Center provisioning → Organization and SSO: provisions
- Identity Center provisioning → Groups and permissions: defines
- Identity Center provisioning → GitHub OIDC: configures
- Identity Center provisioning → Container registry: creates
- Organization and SSO → AWS Organization: creates organization
- Cluster provisioning → VPC networking: provisions
- Cluster provisioning → EKS and access: provisions
- Cluster provisioning → TLS certificate: provisions
- Cluster provisioning → AWS Organization: creates AWS resources
- Workload provisioning → Cluster provisioning: reads outputs
- Workload provisioning → IRSA controllers: provisions
- Workload provisioning → Load balancer controller: provisions
- Workload provisioning → Ingress NGINX: provisions
- Workload provisioning → Cluster admin RBAC: provisions
- Workload provisioning → Sample applications: deploys
- Workload provisioning → Online Boutique: deploys
- Online Boutique → Application manifests: applies YAML
- IRSA controllers → Kubernetes API: configures controllers
- Ingress NGINX → Kubernetes API: deploys
- Cluster admin RBAC → Kubernetes API: configures access
- Sample applications → Kubernetes API: deploys
- Online Boutique → Kubernetes API: deploys
- Load balancer controller → Ingress NGINX: fronts