The infrastructure stack is layered: OpenTofu provisions cloud resources, Ansible configures them, Zarf packages for air-gap, Tilt enables dev iteration, and OPA policies provide guardrails.
Layer Tool Directory Purpose
Provisioning OpenTofu infra/aws/tofu/AWS VPC, EC2, S3, Cloudflare Tunnel Configuration Ansible infra/aws/ansible/RKE2 install, Dask, services, ingress Packaging Zarf zarf/Air-gap Kubernetes deployment Dev Iteration Tilt tilt/, TiltfileLive-reload development on RKE2/k3d Policy OPA/Conftest policy/IaC and K8s guardrails
For air-gap environments, the Ansible flow uses the zarf-deploy role instead of individual service roles.
Role Purpose
commonBase node setup: packages, kernel modules, sysctl, data volumes rke2-serverControl plane installation with token propagation rke2-agentWorker installation with automatic token fetch daskHelm-based Dask operator + DaskCluster CRD jupyterhubHelm-based JupyterHub with Dask integration signals-enginegRPC engine deployment + service cloudflare-tunnelcloudflared with config-driven ingress routing zarf-deploy4-phase air-gap orchestrator (stage/init/deploy/verify)
Playbook Description
site.ymlFull stack: RKE2 + Dask + Engine + JupyterHub + Ingress dask-only.ymlStandalone Dask operator deploy airgap-deploy.ymlAir-gap deployment via Zarf teardown.ymlRemove workloads, preserve RKE2 cluster validate.ymlPost-deployment health checks
Task Description
k8s:provisionCreate k3d cluster k8s:statusCheck cluster connectivity k8s:deploy-daskDeploy Dask operator + cluster k8s:deploy-jupyterDeploy JupyterHub k8s:forwardPort-forward services k8s:destroyDelete k3d cluster
Task Description
aws:provisionOpenTofu apply (VPC, EC2, S3) aws:inventoryGenerate Ansible inventory from Tofu state aws:deployFull stack: RKE2 + Dask + services aws:verifyPost-deployment health checks aws:sshSSH to bastion host aws:destroyDestroy infrastructure (preserves S3) aws:teardownFull teardown including S3