feat: switch from terraform to hetzner-k3s

[mrsimonemms]

Description

Related Issue(s)

Fixes #

How to test

[github-actions]

Execution result of "run-all plan" in "stacks/prod"

time=2024-12-16T11:29:24Z level=info msg=The stack at /github/workspace/stacks/prod will be processed in the following order for command plan:
Group 1
- Module /github/workspace/stacks/prod/hetzner

Group 2
- Module /github/workspace/stacks/prod/kubernetes


time=2024-12-16T11:29:24Z level=info msg=Downloading Terraform configurations from file:///github/workspace/modules/hetzner into /github/workspace/stacks/prod/hetzner/.terragrunt-cache/7n5v_ZVOv4gLIvn-SLBHuU7F7OI/B-HSI5LUu0nLTnyopQYP4SLEkoU prefix=[/github/workspace/stacks/prod/hetzner] 
Initializing the backend...

Successfully configured the backend "remote"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing modules...
Downloading git::https://github.com/mrsimonemms/terraform-module-k3s.git for k3s...
- k3s in .terraform/modules/k3s
Initializing provider plugins...
- Reusing previous version of hetznercloud/hcloud from the dependency lock file
- Reusing previous version of hashicorp/local from the dependency lock file
- Reusing previous version of loafoe/ssh from the dependency lock file
- Installing hetznercloud/hcloud v1.48.0...
- Installed hetznercloud/hcloud v1.48.0 (signed by a HashiCorp partner, key ID 5219EACB3A77198B)
- Installing hashicorp/local v2.5.1...
- Installed hashicorp/local v2.5.1 (signed by HashiCorp)
- Installing loafoe/ssh v2.7.0...
- Installed loafoe/ssh v2.7.0 (self-signed, key ID C0E4EB79E9E6A23D)
Partner and community providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://www.terraform.io/docs/cli/plugins/signing.html

Terraform has been successfully initialized!
hcloud_network.network: Refreshing state... [id=10450405]
hcloud_ssh_key.server: Refreshing state... [id=25470100]
hcloud_placement_group.managers[0]: Refreshing state... [id=435853]
hcloud_load_balancer.k3s_manager[0]: Refreshing state... [id=2216184]
hcloud_network_subnet.subnet: Refreshing state... [id=10450405-10.0.0.0/16]
hcloud_firewall.firewall: Refreshing state... [id=1791909]
hcloud_load_balancer_network.k3s_manager[0]: Refreshing state... [id=2216184-10450405]
hcloud_load_balancer_service.k3s_manager[0]: Refreshing state... [id=2216184__6443]
hcloud_load_balancer_target.k3s_manager[0]: Refreshing state... [id=lb-label-selector-tgt-f13103f1b53f748a64e813b07b8a0a70830ba59574b0885e6b5f98eac68e9d58-2216184]
hcloud_server.manager[0]: Refreshing state... [id=57514830]
hcloud_server.manager[1]: Refreshing state... [id=57514828]
hcloud_server.manager[2]: Refreshing state... [id=57514827]
ssh_resource.manager_ready[2]: Refreshing state... [id=485939443034857097]
ssh_resource.manager_ready[0]: Refreshing state... [id=6387643183444380621]
ssh_resource.manager_ready[1]: Refreshing state... [id=2114671585054001821]
module.k3s.ssh_resource.initial_manager: Refreshing state... [id=7874766205231490794]
module.k3s.ssh_sensitive_resource.join_token: Refreshing state... [id=2601839593514969138]
module.k3s.ssh_sensitive_resource.kubeconfig: Refreshing state... [id=9017648876876848976]
module.k3s.ssh_resource.additional_managers["prod-k3s-manager-1"]: Refreshing state... [id=455786700003009396]
module.k3s.ssh_resource.additional_managers["prod-k3s-manager-2"]: Refreshing state... [id=1824332216746966711]
local_sensitive_file.kubeconfig: Refreshing state... [id=1867d3d02a8a162be5e687d0f709e525bb947ba2]
module.k3s.ssh_resource.drain_managers["prod-k3s-manager-1"]: Refreshing state... [id=8873005755387765223]
module.k3s.ssh_resource.drain_managers["prod-k3s-manager-2"]: Refreshing state... [id=6493647296127044723]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_sensitive_file.kubeconfig will be created
  + resource "local_sensitive_file" "kubeconfig" {
      + content              = (sensitive value)
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0755"
      + file_permission      = "0600"
      + filename             = "/github/workspace/.kubeconfig"
      + id                   = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
time=2024-12-16T11:29:31Z level=info msg=Downloading Terraform configurations from file:///github/workspace/modules/kubernetes into /github/workspace/stacks/prod/kubernetes/.terragrunt-cache/-HGVTuUtXSFDQCN7IIesL6CulRY/z4vfL_CY3720zQ-fo9fFtb8YbxA prefix=[/github/workspace/stacks/prod/kubernetes] 
Initializing the backend...

Successfully configured the backend "remote"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Reusing previous version of hashicorp/kubernetes from the dependency lock file
- Reusing previous version of hashicorp/helm from the dependency lock file
- Reusing previous version of infisical/infisical from the dependency lock file
- Installing infisical/infisical v0.12.4...
- Installed infisical/infisical v0.12.4 (self-signed, key ID 2513406FB39E8BB6)
- Installing hashicorp/kubernetes v2.31.0...
- Installed hashicorp/kubernetes v2.31.0 (signed by HashiCorp)
- Installing hashicorp/helm v2.14.1...
- Installed hashicorp/helm v2.14.1 (signed by HashiCorp)
Partner and community providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://www.terraform.io/docs/cli/plugins/signing.html

Terraform has been successfully initialized!
kubernetes_namespace_v1.metallb: Refreshing state... [id=metallb-system]
kubernetes_namespace_v1.argocd: Refreshing state... [id=argocd]
kubernetes_secret_v1.hcloud: Refreshing state... [id=kube-system/hcloud]
kubernetes_namespace_v1.external_secrets: Refreshing state... [id=external-secrets]
data.infisical_secrets.common_secrets: Reading...
kubernetes_secret_v1.infisical: Refreshing state... [id=external-secrets/infisical]
kubernetes_secret_v1.bitwarden: Refreshing state... [id=external-secrets/bitwarden]
helm_release.hcloud_ccm: Refreshing state... [id=hccm]
helm_release.hcloud_csi: Refreshing state... [id=hcsi]
data.infisical_secrets.common_secrets: Read complete after 0s
kubernetes_secret_v1.oidc_secret: Refreshing state... [id=argocd/oidc]
helm_release.argocd: Refreshing state... [id=argocd]
data.kubernetes_nodes.cluster: Reading...
data.kubernetes_nodes.cluster: Read complete after 0s [id=4bcd4d13ade92b8bf8182d0370b4e286f2595731f703cdb4572ea12b625c095f]
kubernetes_config_map_v1.metallb: Refreshing state... [id=metallb-system/nodes]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # kubernetes_secret_v1.oidc_secret will be updated in-place
  ~ resource "kubernetes_secret_v1" "oidc_secret" {
        id                             = "argocd/oidc"
        # (4 unchanged attributes hidden)

      ~ metadata {
          ~ annotations      = {
              - "argocd.argoproj.io/sync-wave"            = "10" -> null
              - "reconcile.external-secrets.io/data-hash" = "e00fa68f65771c11139b918505920fd8" -> null
            }
          ~ labels           = {
              - "argocd.argoproj.io/instance"              = "argocd-components" -> null
              - "reconcile.external-secrets.io/created-by" = "90873bbc804f7cdb791481efb85e3ecf" -> null
              - "reconcile.external-secrets.io/managed"    = "true" -> null
                # (1 unchanged element hidden)
            }
            name             = "oidc"
            # (5 unchanged attributes hidden)
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.