How to Perform One-Click Cluster Provisioning with CubeSandbox Terraform Deployment

CubeSandbox provides a production-ready Terraform module under deploy/one-click/terraform/tencentcloud that automates the creation of a complete Tencent Cloud environment—including VPC networking, security groups, jump servers, managed MySQL and Redis, a TKE Kubernetes cluster, and all CubeSandbox workloads—enabling full cluster deployment with a single terraform apply command.

The TencentCloud/CubeSandbox repository simplifies infrastructure deployment through comprehensive Terraform automation. By utilizing the module located at deploy/one-click/terraform/tencentcloud, operators can achieve one-click cluster provisioning with CubeSandbox Terraform deployment, creating isolated, secure environments for sandbox workloads without manual resource configuration.

Infrastructure Components Created by Terraform

Network Foundation and Security

The module establishes a dedicated VPC (10.0.0.0/16) using tencentcloud_vpc.cluster, accompanied by primary and zone-specific subnets via tencentcloud_subnet.cluster and tencentcloud_subnet.cvm. Internet access is routed through tencentcloud_nat_gateway.cluster. Security is enforced through four distinct security groups defined in main.tf: tencentcloud_security_group.jumpserver for bastion access, tencentcloud_security_group.compute for worker nodes, tencentcloud_security_group.tke_pod for Kubernetes pods, and tencentcloud_security_group.clb for load balancers, each restricting traffic to required ports only.

Compute Resources and SSH Access

Secure access is provided by tencentcloud_key_pair.cluster and a jump-server instance (tencentcloud_instance.jumpserver) configured for SSH-over-TLS on port 443. Optional compute CVMs (tencentcloud_instance.compute) can be provisioned with dedicated 200 GB CBS data disks mounted at /data/cubelet, with the count controlled by the compute_node_count variable.

Managed Data Services

The deployment includes high-availability MySQL (tencentcloud_mysql_instance.mysql) and Redis (tencentcloud_redis_instance.redis) instances, along with optional Tencent Container Registry (tencentcloud_tcr_instance.cluster) and Cloud File Storage (tencentcloud_cfs_file_system.cubemaster_data) for shared persistence layers.

Kubernetes Cluster and Workloads

The tencentcloud_kubernetes_cluster.tke resource provisions a managed TKE control plane within the VPC. The tke-addons.tf file then deploys all CubeSandbox components—including cube-master, cube-api, cube-proxy, web-ui, and lifecycle-manager—using native Terraform Kubernetes resources (kubernetes_deployment and kubernetes_service), eliminating the need for manual kubectl operations.

Configuring Public Network Access

The enable_public_network variable in variables.tf (default false) controls whether Cluster Load Balancers (CLBs) expose services internally or on the public internet. When modified, a null_resource.network_mode_trigger with the replace_triggered_by lifecycle meta-argument forces CLB recreation to safely handle VIP changes between internal and internet-facing modes.

Step-by-Step Deployment Guide

1. Clone the repository and navigate to the Terraform module:

git clone https://github.com/TencentCloud/CubeSandbox.git
cd CubeSandbox/deploy/one-click/terraform/tencentcloud

2. Configure deployment variables (recommended for production):

cat > .env <<'EOF'
TF_VAR_mysql_root_password=VerySecretPass123!
TF_VAR_redis_password=AnotherSecret!
TF_VAR_enable_public_network=true
TF_VAR_compute_node_count=3
EOF

3. Initialize Terraform and review the plan:

terraform init
terraform plan -var-file=.env

4. Apply the configuration:

terraform apply -auto-approve -var-file=.env

Alternatively, use the interactive wrapper script:

./deploy/one-click/create.sh

Accessing the Cluster After Deployment

After terraform apply completes, the module outputs critical connection details including jumpserver_public_ip, jumpserver_ssh_command, and tke_cluster_endpoint. The TKE kubeconfig is written to ./.kube/config.

Connect to the jump server:

ssh -i .//.ssh/id_rsa -p 443 -o StrictHostKeyChecking=no root@<jumpserver_public_ip>

Configure local kubectl access:

export KUBECONFIG=$(pwd)/.kube/config
kubectl get pods -n cubesandbox

If enable_public_network=true, access the CubeSandbox API at http://<tke_cube_api_clb_ip>:3000.

Summary

• The Terraform module at deploy/one-click/terraform/tencentcloud in the TencentCloud/CubeSandbox repository provides complete infrastructure automation.
• It provisions VPC networking, four security groups, jump servers, optional compute nodes, managed MySQL/Redis, optional CFS/TCR, and a managed TKE cluster.
• Kubernetes workloads (cube-master, cube-api, cube-proxy, web-ui, lifecycle-manager) are deployed automatically via tke-addons.tf without requiring kubectl.
• The enable_public_network variable controls public exposure, triggering CLB recreation via lifecycle meta-arguments.
• Post-deployment outputs include SSH commands and the kubeconfig file for immediate cluster access.

Frequently Asked Questions

What specific resources does the CubeSandbox Terraform module create?

The module creates a complete environment including VPC (tencentcloud_vpc.cluster), subnets, NAT gateway, four security groups (jumpserver, compute, TKE-pod, CLB), an RSA key pair, jump-server CVM (tencentcloud_instance.jumpserver), optional compute nodes, MySQL (tencentcloud_mysql_instance.mysql) and Redis (tencentcloud_redis_instance.redis) instances, optional CFS and TCR, a managed TKE cluster (tencentcloud_kubernetes_cluster.tke), and all Kubernetes Deployments and Services for CubeSandbox components.

How do I enable public internet access to the CubeSandbox API and UI?

Set TF_VAR_enable_public_network=true before running Terraform. This modifies the Service annotations in tke-addons.tf to use internet-facing CLBs instead of internal ones. Note that changing this value after initial deployment triggers a replace_triggered_by lifecycle event, recreating the CLBs and changing their VIPs.

Can I deploy the infrastructure without immediately installing the Kubernetes workloads?

Yes. The module supports phased deployment through the deploy_addons local variable, which evaluates var.create_tke && var.deploy_tke_addons. You can initially apply with deploy_tke_addons=false to provision VPC, security groups, and databases, then run a second apply with deploy_tke_addons=true after the TKE control plane is ready.

Where is the Kubernetes kubeconfig stored after Terraform completes?

The module automatically writes the TKE cluster's intranet kubeconfig to ./.kube/config in your working directory. Use this file by running export KUBECONFIG=$(pwd)/.kube/config or reference the tke_cluster_endpoint output for manual authentication configuration.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}