02 · Terraform deploy

Provision the AWS resources OpenBox binds to using the reference snippets shipped in website/static/terraform-snippets/.

Reference examples only

The snippets are not a versioned Terraform module. Copy them into your own repo and adapt tags, naming, and VPC references to match your standards. Openbox will not backward-compat these files.

Copy the snippets

Download from your local checkout of this repo, or the built site:

# From the docs site (once deployed):
curl -sSLO https://deploy-docs.openbox.ai/terraform-snippets/01-eks-cluster.tf
curl -sSLO https://deploy-docs.openbox.ai/terraform-snippets/02-kms-cmk.tf
curl -sSLO https://deploy-docs.openbox.ai/terraform-snippets/03-s3-opa-bundles.tf
curl -sSLO https://deploy-docs.openbox.ai/terraform-snippets/04-iam-irsa-roles.tf
curl -sSLO https://deploy-docs.openbox.ai/terraform-snippets/05-optional-rds-elasticache-ecr.tf

# Or copy from repo:
cp -r website/static/terraform-snippets/*.tf ./openbox-infra/

Place them in the same directory as your backend.tf (from 01 · AWS account setup).

What each snippet provisions

File	Resource	Required?
01-eks-cluster.tf	EKS cluster + node group	Required
02-kms-cmk.tf	KMS CMK + alias for envelope encryption	Required
03-s3-opa-bundles.tf	S3 bucket for OPA policy bundles (SSE-KMS)	Required
04-iam-irsa-roles.tf	IRSA roles for openbox-backend + openbox-core	Required
05-optional-rds-elasticache-ecr.tf	RDS Postgres + ElastiCache Redis + ECR (all count-gated)	Optional

Configure variables

Create terraform.tfvars:

aws_region       = "us-east-1"
cluster_name     = "openbox-prod"
vpc_id           = "vpc-0xxxxxxx"          # your existing VPC
private_subnets  = ["subnet-0a...", "subnet-0b...", "subnet-0c..."]

# Optional managed services
enable_rds          = true
enable_elasticache  = true
enable_ecr          = false

tags = {
  Environment = "prod"
  Owner       = "platform-team"
  CostCenter  = "eng"
}

Run

terraform init
terraform plan -out openbox.tfplan   # review carefully
terraform apply openbox.tfplan

Expected time: 8–15 min (EKS cluster creation dominates).

Capture outputs for Helm

After apply, the snippets emit outputs you'll feed to values-prod.yaml:

terraform output -json > outputs.json

# Individually:
terraform output cluster_endpoint
terraform output cluster_ca_data
terraform output kms_key_arn
terraform output s3_opa_bundles_bucket
terraform output rds_endpoint          # if enable_rds=true
terraform output elasticache_endpoint  # if enable_elasticache=true

Configure kubectl

aws eks update-kubeconfig \
  --name "$(terraform output -raw cluster_name)" \
  --region "$(terraform output -raw aws_region)"

kubectl get nodes    # expect 2-3 nodes Ready

Next

03 · Helm install →

Rollback

terraform destroy
# NOTE: destroys ALL resources including RDS storage. Take a final snapshot first if you have data.