Commands

Every command below is either a Terramate script defined in a workflows.tm.hcl file, a script in scripts/, or a standard flux/kubectl/bao invocation.

Terramate / OpenTofu

terramate script run init            # Initialize all stacks
terramate script run preview         # Preview changes
terramate script run deploy          # Deploy platform
terramate script run drift detect    # Check drift

# Individual stack
cd opentofu/<stack>   # network, eks/init, eks/configure, openbao/cluster, openbao/management, llm-platform
tofu plan -var-file=variables.tfvars
tofu apply -var-file=variables.tfvars

EKS deploy (two-stage bootstrap)

Defined in opentofu/eks/init/workflows.tm.hcl. Stage 1 creates the cluster with the temporary VPC-CNI; Stage 2 (run from the same script) disables it, installs Cilium, then Flux.

cd opentofu/eks/init
terramate script run deploy                     # both stages
terramate script run deploy-stage1               # Stage 1 only

# Feature-branch testing — point Flux at a branch instead of main
TF_VAR_flux_git_ref='refs/heads/my-branch' terramate script run deploy

EKS Full Destroy runs the reverse order: prepare-destroy → stage2-destroy-addons → stage1-destroy-cluster.

Opt-in stacks

opentofu/llm-platform/ is tagged opt-in (see opentofu/llm-platform/workflows.tm.hcl): its deploy/preview/drift detect/destroy scripts no-op unless enabled.

# Default: skipped
terramate script run deploy

# Opt-in for one invocation, any depth
TM_LLM_PLATFORM_ENABLED=true terramate script run deploy

# Target only this stack
TM_LLM_PLATFORM_ENABLED=true terramate -C opentofu/llm-platform script run deploy

# CI / audit path — filter by tag, no env var needed
terramate script run --no-tags=opt-in deploy
terramate script run --tags=opt-in    deploy

The Kubernetes side of the LLM platform has its own gate — see Repository Layout § Opt-in surfaces.

EKS cluster

aws eks update-kubeconfig --region eu-west-3 --name mycluster-0
flux get all
flux suspend kustomization --all
flux resume kustomization --all

OpenBao

export VAULT_ADDR=https://bao.priv.cloud.ogenki.io:8200
export VAULT_CACERT=opentofu/openbao/management/.tls/ca.pem   # written by openbao-config.sh ca
bao status
bao login -method=userpass username=admin

# The admin password is generated by the management stack:
aws secretsmanager get-secret-value \
  --secret-id openbao/cloud-native-ref/users/admin \
  --query SecretString --output text | jq

Validation (run these before claiming anything is done)

tofu validate
trivy config --exit-code=1 --ignorefile=./.trivyignore.yaml .
./scripts/validate-manifests.sh   # renders the repo the way Flux does, then gates it
./scripts/validate-links.sh       # resolves every relative Markdown link
kubectl get nodes && kubectl get pods --all-namespaces
flux get all

See CI Workflows for what each gate actually checks.

Scripts (`scripts/`)

Script	Purpose
`validate-manifests.sh`	Renders the repo (Kustomize + `helm template`) and gates it with `flux schema validate` + Polaris
`validate-links.sh`	Resolves every relative Markdown link in the repository
`verify-doc-paths.sh`	Checks the documentation site’s structural conventions
`openbao-config.sh`	OpenBao CA / config helper (`ca`, and other subcommands)
`openbao-snapshot.sh`	OpenBao Raft snapshot automation
`eks-prepare-destroy.sh`	Pre-destroy cleanup (drains leaked CSI volumes, etc.) before an EKS teardown
`eks-recycle-bootstrap-nodes.sh`	Recycles Stage 1 node-group nodes so they pick up Cilium prefix delegation
`export-diagrams.sh`	Exports `.drawio` architecture diagrams to PNG
`cleanup-benchmark-images.sh`	Cleans up images left behind by the image-gallery/benchmark scripts
`image-gallery-benchmark.sh`	Benchmarks the image-gallery demo path
`test-flux-schema.sh`	Exercises the Flux schema-validation setup
`test-vector-vrl.sh` / `validate-vector-vrl.sh` / `vector-vrl-tests/`	Validate the Vector log-parsing configuration

Technology Stack CI Workflows