# dxctor-sl3ep/sefam-devops-toolkit-migration-k3s architecture

> Architecture diagram of the GitHub repository dxctor-sl3ep/sefam-devops-toolkit-migration-k3s, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s
- Repository: https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s

## Overview

SEFAM DevOps Toolkit is a containerized OpenTofu and Ansible workspace for provisioning and configuring infrastructure. Operators start a stack-specific environment; OpenTofu manages foundation, identity, and regional nodes, while CI applies node changes and runs Ansible against a dynamic inventory. Ansible configures hosts, beginning with base configuration. The repository also documents SSH-certificate access through a bastion. Relationships for these product stages are based on the README; the SSH signer’s internal calls are supported by sampled source, while unsampled implementation links are omitted.

Main entry points: [`tofu/node/aws`](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/node/aws) (Regional node stack), [`tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py`](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py) (SSH CA handlers), [`src/entrypoint.sh`](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/src/entrypoint.sh) (DevOps Toolkit), [`ansible/00_preflight.yml`](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/00_preflight.yml) (Ansible playbooks)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_provision["Infrastructure provisioning"]
  node_toolkit["DevOps Toolkit<br/>[entrypoint.sh]"]
  node_foundation["Foundation stack"]
  node_node["Regional node stack"]
  node_network["Network modules"]
  node_instance["Instance modules"]
  node_volume["Volume modules"]
  node_publicip["Public IP modules"]
end

subgraph group_access["Identity and access"]
  node_identity["Identity stack"]
  node_sshaccess["SSH access policy<br/>[main.tf]"]
end

subgraph group_config["Host configuration"]
  node_inventory["Dynamic inventory"]
  node_playbooks["Ansible playbooks<br/>[00_preflight.yml]"]
  node_baseconf["Base configuration<br/>[main.yml]"]
  node_accounts["Account management<br/>[main.yml]"]
  node_gitlabrole["GitLab services<br/>[main.yml]"]
  node_runnerrole["GitLab Runner<br/>[main.yml]"]
end

subgraph group_signer["SSH certificate signer"]
  node_signer["SSH CA handlers<br/>[handlers.py]"]
  node_policy["Caller policy<br/>[policy.py]"]
  node_cert["Certificate signing<br/>[cert.py]"]
end

node_operator(("Operator"))
node_gitlab(("GitLab CI"))
node_aws{{"AWS"}}
node_secrets[("Secrets Manager")]

node_operator -->|"starts stack"| node_toolkit
node_toolkit -->|"opens workspace"| node_foundation
node_toolkit -->|"opens workspace"| node_identity
node_toolkit -->|"opens workspace"| node_node
node_gitlab -->|"applies nodes"| node_node
node_node -->|"uses modules"| node_network
node_node -->|"uses modules"| node_instance
node_node -->|"uses modules"| node_volume
node_node -->|"uses modules"| node_publicip
node_gitlab -->|"connects to hosts"| node_inventory
node_gitlab -->|"runs playbooks"| node_playbooks
node_playbooks -->|"includes role"| node_baseconf
node_operator -->|"manages access"| node_identity
node_gitlab -.->|"requests certificate"| node_signer
node_signer -->|"checks caller"| node_policy
node_signer -->|"signs key"| node_cert
node_signer -->|"reads CA key"| node_secrets
node_operator -.->|"requests certificate"| node_signer
node_aws -->|"hosts resources"| node_node

click node_toolkit "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/src/entrypoint.sh"
click node_foundation "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/foundation/aws"
click node_node "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/node/aws"
click node_network "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/modules/network"
click node_instance "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/modules/instance"
click node_volume "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/modules/volume"
click node_publicip "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/modules/public-ip"
click node_identity "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/identity/aws"
click node_sshaccess "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/tofu/identity/aws/modules/ssh-access/main.tf"
click node_inventory "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/ansible/inventory"
click node_playbooks "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/00_preflight.yml"
click node_baseconf "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/roles/base_conf/tasks/main.yml"
click node_accounts "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/roles/accounts/tasks/main.yml"
click node_gitlabrole "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/roles/gitlab/tasks/main.yml"
click node_runnerrole "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/roles/gitlab_runner/tasks/main.yml"
click node_signer "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py"
click node_policy "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/policy.py"
click node_cert "https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/cert.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_toolkit,node_foundation,node_node,node_network,node_instance,node_volume,node_publicip toneBlue
class node_identity,node_sshaccess,node_secrets toneAmber
class node_inventory,node_playbooks,node_baseconf,node_accounts,node_gitlabrole,node_runnerrole toneMint
class node_signer,node_policy,node_cert toneRose
class node_operator,node_gitlab,node_aws toneIndigo
```

## Components

### Infrastructure provisioning

- [DevOps Toolkit](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/src/entrypoint.sh): `src/entrypoint.sh`
- [Foundation stack](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/foundation/aws): `tofu/foundation/aws`
- [Regional node stack](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/node/aws): `tofu/node/aws`
- [Network modules](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/modules/network): `tofu/modules/network`
- [Instance modules](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/modules/instance): `tofu/modules/instance`
- [Volume modules](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/modules/volume): `tofu/modules/volume`
- [Public IP modules](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/modules/public-ip): `tofu/modules/public-ip`

### Identity and access

- [Identity stack](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/tofu/identity/aws): `tofu/identity/aws`
- [SSH access policy](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/tofu/identity/aws/modules/ssh-access/main.tf): `tofu/identity/aws/modules/ssh-access/main.tf`

### Host configuration

- [Dynamic inventory](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/tree/main/ansible/inventory): `ansible/inventory`
- [Ansible playbooks](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/00_preflight.yml): `ansible/00_preflight.yml`
- [Base configuration](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/roles/base_conf/tasks/main.yml): `ansible/roles/base_conf/tasks/main.yml`
- [Account management](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/roles/accounts/tasks/main.yml): `ansible/roles/accounts/tasks/main.yml`
- [GitLab services](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/roles/gitlab/tasks/main.yml): `ansible/roles/gitlab/tasks/main.yml`
- [GitLab Runner](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/ansible/roles/gitlab_runner/tasks/main.yml): `ansible/roles/gitlab_runner/tasks/main.yml`

### SSH certificate signer

- [SSH CA handlers](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py): `tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py`
- [Caller policy](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/policy.py): `tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/policy.py`
- [Certificate signing](https://github.com/dxctor-sl3ep/sefam-devops-toolkit-migration-k3s/blob/main/tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/cert.py): `tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/cert.py`

### Other components

- **Operator**
- **GitLab CI**
- **AWS**
- **Secrets Manager**

## Connections

- Operator → DevOps Toolkit: starts stack (evidence: `README.md`)
- DevOps Toolkit → Foundation stack: opens workspace (evidence: `README.md`)
- DevOps Toolkit → Identity stack: opens workspace (evidence: `README.md`)
- DevOps Toolkit → Regional node stack: opens workspace (evidence: `README.md`)
- GitLab CI → Regional node stack: applies nodes (evidence: `README.md`)
- Regional node stack → Network modules: uses modules (evidence: `README.md`)
- Regional node stack → Instance modules: uses modules (evidence: `README.md`)
- Regional node stack → Volume modules: uses modules (evidence: `README.md`)
- Regional node stack → Public IP modules: uses modules (evidence: `README.md`)
- GitLab CI → Dynamic inventory: connects to hosts (evidence: `README.md`)
- GitLab CI → Ansible playbooks: runs playbooks (evidence: `README.md`)
- Ansible playbooks → Base configuration: includes role (evidence: `README.md`)
- Operator → Identity stack: manages access (evidence: `README.md`)
- GitLab CI → SSH CA handlers: requests certificate
- SSH CA handlers → Caller policy: checks caller (evidence: `tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py`)
- SSH CA handlers → Certificate signing: signs key (evidence: `tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py`)
- SSH CA handlers → Secrets Manager: reads CA key (evidence: `tofu/foundation/aws/modules/ssh-ca/aws/function/ssh_ca/handlers.py`)
- Operator → SSH CA handlers: requests certificate
- AWS → Regional node stack: hosts resources (evidence: `README.md`)