Infrastructure

Teabar provisions real infrastructure for your environments. Unlike container-based sandboxes, Teabar creates actual virtual machines, Kubernetes clusters, networks, and storage on cloud providers, giving participants production-like environments.

How Infrastructure Provisioning Works

When you launch an environment, Teabar:

1. Parses the blueprint to identify required resources (VMs, clusters, networks)
2. Generates Terraform configuration for the target cloud provider
3. Provisions resources via the provider’s API
4. Configures networking for isolation and access
5. Bootstraps services defined in the blueprint
6. Exposes access through the Teabar gateway

The entire process typically completes in 2-10 minutes depending on complexity.

Blueprint                    Terraform                   Cloud Provider
   │                            │                              │
   │  resources:                │  resource "hcloud_server"    │
   │    - type: vm              │    name = "env-participant"  │
   │      provider: hetzner  ───┼──► server_type = "cx21"   ───┼──► VM Created
   │      size: cx21            │    image = "ubuntu-22.04"    │
   │                            │                              │

Supported Providers

Provider Comparison

Resource Types

Teabar can provision these infrastructure resources:

Compute

Networking

Storage

DNS

Kubernetes Support

Teabar supports multiple Kubernetes distributions:

Networking Architecture

Each environment gets isolated networking:

┌─────────────────────────────────────────────────────────┐
│                    Environment Network                   │
│                      10.0.0.0/16                        │
│                                                         │
│  ┌─────────────────┐  ┌─────────────────────────────┐  │
│  │  Control Plane  │  │      Participant Subnet      │  │
│  │   10.0.1.0/24   │  │        10.0.10.0/24         │  │
│  │                 │  │                              │  │
│  │  ┌───────────┐  │  │  ┌─────┐ ┌─────┐ ┌─────┐   │  │
│  │  │ K8s API   │  │  │  │ P1  │ │ P2  │ │ P3  │   │  │
│  │  └───────────┘  │  │  └─────┘ └─────┘ └─────┘   │  │
│  └─────────────────┘  └─────────────────────────────┘  │
│                                                         │
│                    ┌─────────────┐                      │
│                    │  Firewall   │                      │
│                    └──────┬──────┘                      │
└───────────────────────────┼─────────────────────────────┘
                            │
                            ▼
                       Internet

Performance Targets

Cost Tracking

Teabar tracks infrastructure costs in real-time:

• Per-resource tracking - Know exactly what each VM, volume, or load balancer costs
• Per-environment aggregation - See total cost for each environment
• Organization rollups - Track spending across all environments
• Automatic cleanup - Prevent runaway costs with expiration and sleep policies

# View environment cost
teactl env get my-workshop --show-cost

# View organization spending
teactl org usage --period month

Security

Network Isolation

Every environment runs in its own isolated network:

• No cross-environment traffic - Environments cannot communicate with each other
• Default-deny firewalls - Only explicitly allowed traffic is permitted
• Egress controls - Optional internet access restrictions

Resource Labeling

All provisioned resources are tagged for tracking and auditing:

labels = {
  environment = "env-abc123"
  organization = "acme-corp"
  managed_by = "teabar"
}

Configuration

Provider Credentials

Configure provider credentials at the organization level:

# Set Hetzner API token
teactl org provider set hetzner --token <HCLOUD_TOKEN>

# Set AWS credentials
teactl org provider set aws 
  --access-key <AWS_ACCESS_KEY_ID> 
  --secret-key <AWS_SECRET_ACCESS_KEY> 
  --region us-east-1

# Set Azure credentials
teactl org provider set azure 
  --subscription <AZURE_SUBSCRIPTION_ID> 
  --tenant <AZURE_TENANT_ID> 
  --client-id <AZURE_CLIENT_ID> 
  --client-secret <AZURE_CLIENT_SECRET>

Default Provider

Set a default provider for your organization:

teactl org provider default hetzner

Next Steps