fix: harden cluster rebuild determinism

terraform/.terraform.lock.hcl

@@ -0,0 +1,44 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/bpg/proxmox" {
+  version     = "0.103.0"
+  constraints = "~> 0.103.0"
+  hashes = [
+    "h1:jC9kBUJj9zUCLmM3ApA7OzZXHE1G+DcqxqdRR1fesGc=",
+    "zh:03ffc90757ed3827bbe50997664ed3ddf6d9b6419723a8091c5d5f81d65f8066",
+    "zh:1aef5db248cf68976fc0b5c032e1da7fca0a3c2ea6e9074aebb99828a561a898",
+    "zh:3deab5284c81c92524203a93a0dd21509eb89b867911a3612b0524f05f400740",
+    "zh:6b44e3293475d528e7a0fd298880652fa6283093ea368e227ebffaa00c3b8821",
+    "zh:739246a7653ae7052e0398bdb53d07a103aa018de5d7547d423ff5cca8b4a973",
+    "zh:74adb0f6936460318b3f0af14e11fa6483b7a8551ee592d24e2c855bf952f9ee",
+    "zh:8eac58a1d8c571bc9e997f21473fd140d8e89ff631b538e3f614dd8aa2fb2cfa",
+    "zh:ab4415f2ecafa81df3208a940ddf6efc24a661001b5003b04ba5c08b35e98b4c",
+    "zh:b6a551cf318a6e02fc04f9c817bb53ba6ab39ff7c3fa9a222529ddde7870cbad",
+    "zh:c1e4c97e079139420d9b158cb6a1008951a3b2f0280fdbe517c3026d413c71d9",
+    "zh:c2b6ac65a9d78a7558b573279a7c6afd130c9d1b6edd7819786b3eb77183f95f",
+    "zh:c8544a696504cdae6e3739e6b74372fe57b19ac081232970db8348519e23c4d5",
+    "zh:ccf3cee3bd04d339380db00b7d35eedf329c42e9441ff06e4e58682a1cccc42e",
+    "zh:f26e0763dbe6a6b2195c94b44696f2110f7f55433dc142839be16b9697fa5597",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/local" {
+  version     = "2.8.0"
+  constraints = "~> 2.8.0"
+  hashes = [
+    "h1:KCuj8nPbNP/ofQrAoQIuQ3CP6k+ADpULvxr7dw2PrpM=",
+    "zh:05f18164beab4a84753e5fedf463771ee0c6eca8e90346b8766f1e1c186dec1e",
+    "zh:563a0702e3711e25ba8930120899b681378b50cbb957fd204b37745c7c9b5f40",
+    "zh:5b56ab2ed70ed92721febb4a070af0837f1084c44825c18e4b95f7efb1d45d26",
+    "zh:6cbedc09b67a5cdb9501ff1b18a315fa46a38e0530424cab1c7f4b3acc75f489",
+    "zh:71b3bd50f89fb385a42a436ba2ce2b8e00f9de53535ce956deff1477b0b117dc",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:9d45ac0a00b85cabdd398b859349d17f124c598b6e6bf272f1bb01321ce708a8",
+    "zh:a453efe8641a8f31fe806b597bf2b34d7b78b971a8e3919061ea89d61fda7b8d",
+    "zh:ac692bacb8c3dca8b5b37e5383168aca1f87d3cd7b40615efd300defb76494f5",
+    "zh:bda9e90c8547d90c9c573206985c5675cc1406047605af037a5069942c3c5966",
+    "zh:c30a1967de040d00f5038086dd53cdbfb78cc05d1dbc75037410f011bf2a20d8",
+    "zh:c80bbd1c3f56b3c836d80cf93ac0e8809305c2642f0c98b54bf5d05d3b12718c",
+  ]
+}

terraform/main.tf

@@ -4,12 +4,12 @@ terraform {
   required_providers {
     local = {
       source  = "hashicorp/local"
-      version = "~> 2.5"
+      version = "~> 2.8.0"
     }
 
     proxmox = {
       source  = "bpg/proxmox"
-      version = ">= 0.60.0"
+      version = "~> 0.103.0"
     }
   }
 }

terraform/outputs.tf

@@ -62,3 +62,18 @@ output "kube_api_lb_ip" {
   description = "Load Balancer private IP for Kubernetes API (used for cluster joins)"
   value       = var.kube_api_vip
 }
+
+output "proxmox_target_vms" {
+  description = "Proxmox VM targets managed by Terraform, used by rebuild cleanup checks"
+  value = [
+    for name, node in local.nodes : {
+      name               = name
+      vm_id              = node.vm_id
+      role               = node.role
+      node_name          = var.proxmox_node_name
+      cloud_init_storage = var.proxmox_cloud_init_storage_pool
+      tags               = ["terraform", var.cluster_name, node.role]
+      description        = "Managed by Terraform for ${var.cluster_name}"
+    }
+  ]
+}

terraform/variables.tf

@@ -20,6 +20,11 @@ variable "control_plane_count" {
   description = "Number of control plane nodes"
   type        = number
   default     = 3
+
+  validation {
+    condition     = var.control_plane_count > 0
+    error_message = "control_plane_count must be greater than zero."
+  }
 }
 
 variable "control_plane_cores" {
@@ -44,6 +49,11 @@ variable "worker_count" {
   description = "Number of worker nodes"
   type        = number
   default     = 5
+
+  validation {
+    condition     = var.worker_count >= 0
+    error_message = "worker_count must be zero or greater."
+  }
 }
 
 variable "worker_cores" {
@@ -193,24 +203,44 @@ variable "control_plane_ips" {
   description = "Static IPv4 addresses for control plane VMs"
   type        = list(string)
   default     = ["10.27.27.30", "10.27.27.31", "10.27.27.32"]
+
+  validation {
+    condition     = length(var.control_plane_ips) == length(distinct(var.control_plane_ips))
+    error_message = "control_plane_ips must be unique."
+  }
 }
 
 variable "worker_ips" {
   description = "Static IPv4 addresses for worker VMs"
   type        = list(string)
   default     = ["10.27.27.41", "10.27.27.42", "10.27.27.43", "10.27.27.44", "10.27.27.45"]
+
+  validation {
+    condition     = length(var.worker_ips) == length(distinct(var.worker_ips))
+    error_message = "worker_ips must be unique."
+  }
 }
 
 variable "control_plane_vm_ids" {
   description = "Fixed VMIDs for control plane VMs"
   type        = list(number)
   default     = [200, 201, 202]
+
+  validation {
+    condition     = length(var.control_plane_vm_ids) == length(distinct(var.control_plane_vm_ids))
+    error_message = "control_plane_vm_ids must be unique."
+  }
 }
 
 variable "worker_vm_ids" {
   description = "Fixed VMIDs for worker VMs"
   type        = list(number)
   default     = [210, 211, 212, 213, 214]
+
+  validation {
+    condition     = length(var.worker_vm_ids) == length(distinct(var.worker_vm_ids))
+    error_message = "worker_vm_ids must be unique."
+  }
 }
 
 variable "kube_api_vip" {