Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0081

ADR-0081: Provisioners create topology only by generating Terraform

← ADR-0080 · ADR-0082 →

The record

Status: Accepted (Mohamed, 2026-10-09 — verbatim; see Provenance) · Date: 2026-10-09

Context

ADR-0077 put terraform in charge of topology (projects, bridges, ACLs, containers); its recorded consequence had deploy/provision_environments.sh and provision_test_fleet.sh stop creating topology and keep only in-container service install and Raft enrollment. That reading strands the provisioners' provisioning knowledge — the scripts know WHAT a fresh environment needs; terraform knows HOW to materialize it.

Decision (Mohamed, verbatim)

"privisioners cab create topology by generating terrafrm"

— the provisioners may create topology, but only by GENERATING .tf configuration; tofu plan/apply remains the sole path that materializes it. Imperative incus topology calls in the provisioners are still retired; the in-container service install and Raft enrollment halves stay.

Alternatives rejected

• ADR-0077's original reading (provisioners never create topology): strands the provisioning knowledge and forces hand edits of .tf for every new environment — Mohamed overrode it in-session.
• Provisioners keep imperative incus calls alongside terraform: two topology writers, the exact drift ADR-0077 killed.

Consequences

• The provisioner rewrite (pending execution): each provisioner emits or updates .tf under infra/terraform/; applying is always tofu.
• A generated-.tf review habit: the provisioner's output is diffed and applied through the same plan gate as hand edits.

Provenance

Mohamed, 2026-10-09, in the Kimi Code session, answering the ADR-0077 consequence presentation. First recorded in infra/README.md; this ADR is the recoverable home (ADR-0085's rule).

Related ADRs

• Also mentioned: ADR-0077, ADR-0085

Rulings cited

None.

Specs cited

None (or no spec page exists for the ones named).