How dxctor-sl3ep/sefam-devops-toolkit-migration-k3s works
SEFAM DevOps Toolkit is a containerized OpenTofu and Ansible workspace for provisioning and configuring infrastructure. Operators start a stack-specific environment; OpenTofu manages foundation, identity, and regional nodes, while CI applies node changes and runs Ansible against a dynamic inventory. Ansible configures hosts, beginning with base configuration. The repository also documents SSH-certificate access through a bastion. Relationships for these product stages are based on the README; the SSH signer’s internal calls are supported by sampled source, while unsampled implementation links are omitted.
Main entry points: aws Regional node stack · handlers.py SSH CA handlers · entrypoint.sh DevOps Toolkit · 00_preflight.yml Ansible playbooks
Components 22
Infrastructure provisioning
- DevOps Toolkit
src/entrypoint.sh - Foundation stack
tofu/foundation/aws - Regional node stack
tofu/node/aws - Network modules
tofu/modules/network - Instance modules
tofu/modules/instance - Volume modules
tofu/modules/volume - Public IP modules
tofu/modules/public-ip
Identity and access
- Identity stack
tofu/identity/aws - SSH access policy
tofu/identity/aws/modules/ssh-access/main.tf
Host configuration
- Dynamic inventory
ansible/inventory - Ansible playbooks
ansible/00_preflight.yml - Base configuration
ansible/roles/base_conf/tasks/main.yml - Account management
ansible/roles/accounts/tasks/main.yml - GitLab services
ansible/roles/gitlab/tasks/main.yml - GitLab Runner
ansible/roles/gitlab_runner/tasks/main.yml
SSH certificate signer
- SSH CA handlers
tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py - Caller policy
tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/policy.py - Certificate signing
tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/cert.py
Other components
- Operator
- GitLab CI
- AWS
- Secrets Manager
Connections 19
- Operator → DevOps Toolkit: starts stack
README.md - DevOps Toolkit → Foundation stack: opens workspace
README.md - DevOps Toolkit → Identity stack: opens workspace
README.md - DevOps Toolkit → Regional node stack: opens workspace
README.md - GitLab CI → Regional node stack: applies nodes
README.md - Regional node stack → Network modules: uses modules
README.md - Regional node stack → Instance modules: uses modules
README.md - Regional node stack → Volume modules: uses modules
README.md - Regional node stack → Public IP modules: uses modules
README.md - GitLab CI → Dynamic inventory: connects to hosts
README.md - GitLab CI → Ansible playbooks: runs playbooks
README.md - Ansible playbooks → Base configuration: includes role
README.md - Operator → Identity stack: manages access
README.md - GitLab CI → SSH CA handlers: requests certificate
- SSH CA handlers → Caller policy: checks caller
tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py - SSH CA handlers → Certificate signing: signs key
tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py - SSH CA handlers → Secrets Manager: reads CA key
tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py - Operator → SSH CA handlers: requests certificate
- AWS → Regional node stack: hosts resources
README.md