socle

# clusters/prod.tfvars
socle_version = "0.1.0"   # the only line an upgrade touches

aws = {
  region             = "eu-west-3"
  cluster_name       = "acme-prod"
  kubernetes_version = "1.34"
}

kube = {
  argocd     = { domain = "argocd.acme.example" }
  monitoring = { traces = { enabled = true } }
}

• One applyA single OpenTofu root creates the cluster, installs Flux and hands the catalog over. Then OpenTofu steps away.
• One versionsocle_version pins the OpenTofu modules and the Flux artifact together. An upgrade is one line in your tfvars.
• Signed end to endBoth artifacts are signed keyless with cosign, and Flux checks the signature on every reconciliation.
• Mistakes fail at planA misspelt module or attribute is rejected by tofu plan, with the allowed values listed.
• No out-of-band scriptsA module that needs cloud access declares its own IAM through Crossplane. The foundations never change.
• Your values winEvery module takes any chart value in values. Secrets go in values_secret, never in the state.