# How to Perform One-Click Cluster Provisioning with CubeSandbox Terraform Deployment

> Unlock one-click cluster provisioning with CubeSandbox Terraform deployment. Automate Tencent Cloud environment setup, including VPC, TKE cluster, and workloads, via a single terraform apply command.

- Repository: [Tencent Cloud/CubeSandbox](https://github.com/TencentCloud/CubeSandbox)
- Tags: how-to-guide
- Published: 2026-07-16

---

**CubeSandbox provides a production-ready Terraform module under `deploy/one-click/terraform/tencentcloud` that automates the creation of a complete Tencent Cloud environment—including VPC networking, security groups, jump servers, managed MySQL and Redis, a TKE Kubernetes cluster, and all CubeSandbox workloads—enabling full cluster deployment with a single `terraform apply` command.**

The TencentCloud/CubeSandbox repository simplifies infrastructure deployment through comprehensive Terraform automation. By utilizing the module located at `deploy/one-click/terraform/tencentcloud`, operators can achieve **one-click cluster provisioning with CubeSandbox Terraform deployment**, creating isolated, secure environments for sandbox workloads without manual resource configuration.

## Infrastructure Components Created by Terraform

### Network Foundation and Security

The module establishes a dedicated VPC (`10.0.0.0/16`) using `tencentcloud_vpc.cluster`, accompanied by primary and zone-specific subnets via `tencentcloud_subnet.cluster` and `tencentcloud_subnet.cvm`. Internet access is routed through `tencentcloud_nat_gateway.cluster`. Security is enforced through four distinct security groups defined in `main.tf`: `tencentcloud_security_group.jumpserver` for bastion access, `tencentcloud_security_group.compute` for worker nodes, `tencentcloud_security_group.tke_pod` for Kubernetes pods, and `tencentcloud_security_group.clb` for load balancers, each restricting traffic to required ports only.

### Compute Resources and SSH Access

Secure access is provided by `tencentcloud_key_pair.cluster` and a jump-server instance (`tencentcloud_instance.jumpserver`) configured for SSH-over-TLS on port 443. Optional compute CVMs (`tencentcloud_instance.compute`) can be provisioned with dedicated 200 GB CBS data disks mounted at `/data/cubelet`, with the count controlled by the `compute_node_count` variable.

### Managed Data Services

The deployment includes high-availability MySQL (`tencentcloud_mysql_instance.mysql`) and Redis (`tencentcloud_redis_instance.redis`) instances, along with optional Tencent Container Registry (`tencentcloud_tcr_instance.cluster`) and Cloud File Storage (`tencentcloud_cfs_file_system.cubemaster_data`) for shared persistence layers.

### Kubernetes Cluster and Workloads

The `tencentcloud_kubernetes_cluster.tke` resource provisions a managed TKE control plane within the VPC. The `tke-addons.tf` file then deploys all CubeSandbox components—including `cube-master`, `cube-api`, `cube-proxy`, `web-ui`, and `lifecycle-manager`—using native Terraform Kubernetes resources (`kubernetes_deployment` and `kubernetes_service`), eliminating the need for manual `kubectl` operations.

## Configuring Public Network Access

The `enable_public_network` variable in `variables.tf` (default `false`) controls whether Cluster Load Balancers (CLBs) expose services internally or on the public internet. When modified, a `null_resource.network_mode_trigger` with the `replace_triggered_by` lifecycle meta-argument forces CLB recreation to safely handle VIP changes between internal and internet-facing modes.

## Step-by-Step Deployment Guide

1. Clone the repository and navigate to the Terraform module:

```bash
git clone https://github.com/TencentCloud/CubeSandbox.git
cd CubeSandbox/deploy/one-click/terraform/tencentcloud

```

2. Configure deployment variables (recommended for production):

```bash
cat > .env <<'EOF'
TF_VAR_mysql_root_password=VerySecretPass123!
TF_VAR_redis_password=AnotherSecret!
TF_VAR_enable_public_network=true
TF_VAR_compute_node_count=3
EOF

```

3. Initialize Terraform and review the plan:

```bash
terraform init
terraform plan -var-file=.env

```

4. Apply the configuration:

```bash
terraform apply -auto-approve -var-file=.env

```

Alternatively, use the interactive wrapper script:

```bash
./deploy/one-click/create.sh

```

## Accessing the Cluster After Deployment

After `terraform apply` completes, the module outputs critical connection details including `jumpserver_public_ip`, `jumpserver_ssh_command`, and `tke_cluster_endpoint`. The TKE kubeconfig is written to `./.kube/config`.

Connect to the jump server:

```bash
ssh -i .//.ssh/id_rsa -p 443 -o StrictHostKeyChecking=no root@<jumpserver_public_ip>

```

Configure local kubectl access:

```bash
export KUBECONFIG=$(pwd)/.kube/config
kubectl get pods -n cubesandbox

```

If `enable_public_network=true`, access the CubeSandbox API at `http://<tke_cube_api_clb_ip>:3000`.

## Summary

- The Terraform module at `deploy/one-click/terraform/tencentcloud` in the TencentCloud/CubeSandbox repository provides complete infrastructure automation.
- It provisions VPC networking, four security groups, jump servers, optional compute nodes, managed MySQL/Redis, optional CFS/TCR, and a managed TKE cluster.
- Kubernetes workloads (cube-master, cube-api, cube-proxy, web-ui, lifecycle-manager) are deployed automatically via `tke-addons.tf` without requiring `kubectl`.
- The `enable_public_network` variable controls public exposure, triggering CLB recreation via lifecycle meta-arguments.
- Post-deployment outputs include SSH commands and the kubeconfig file for immediate cluster access.

## Frequently Asked Questions

### What specific resources does the CubeSandbox Terraform module create?

The module creates a complete environment including VPC (`tencentcloud_vpc.cluster`), subnets, NAT gateway, four security groups (jumpserver, compute, TKE-pod, CLB), an RSA key pair, jump-server CVM (`tencentcloud_instance.jumpserver`), optional compute nodes, MySQL (`tencentcloud_mysql_instance.mysql`) and Redis (`tencentcloud_redis_instance.redis`) instances, optional CFS and TCR, a managed TKE cluster (`tencentcloud_kubernetes_cluster.tke`), and all Kubernetes Deployments and Services for CubeSandbox components.

### How do I enable public internet access to the CubeSandbox API and UI?

Set `TF_VAR_enable_public_network=true` before running Terraform. This modifies the Service annotations in `tke-addons.tf` to use internet-facing CLBs instead of internal ones. Note that changing this value after initial deployment triggers a `replace_triggered_by` lifecycle event, recreating the CLBs and changing their VIPs.

### Can I deploy the infrastructure without immediately installing the Kubernetes workloads?

Yes. The module supports phased deployment through the `deploy_addons` local variable, which evaluates `var.create_tke && var.deploy_tke_addons`. You can initially apply with `deploy_tke_addons=false` to provision VPC, security groups, and databases, then run a second apply with `deploy_tke_addons=true` after the TKE control plane is ready.

### Where is the Kubernetes kubeconfig stored after Terraform completes?

The module automatically writes the TKE cluster's intranet kubeconfig to `./.kube/config` in your working directory. Use this file by running `export KUBECONFIG=$(pwd)/.kube/config` or reference the `tke_cluster_endpoint` output for manual authentication configuration.