| name | wsa-provisioning |
| description | How this repo drives the wsa CLI (workshop-setup-accelerator) for organizer provisioning — binary discovery, the wsa-spec-aws.yaml contract, account_count vs --attendees, Terraform path contract, secrets, the dispenser upload, and the clean/teardown gotchas that can silently leave attendee passwords live. Load when running or debugging `workshop build`/`clean`/`spec-validate` or editing wsa-spec-aws.yaml. |
WSA (organizer provisioning)
Provisioning and teardown are owned by wsa (confluentinc/workshop-setup-accelerator),
not a repo-local orchestrator. It still lives in a sibling checkout
(workshop-setup-accelerator/, per that repo's ONBOARDING.md "Local layout"), but
you no longer invoke it from there: uv run workshop spec-validate|build|clean
(scripts/workshop/wsa.py) finds the binary and injects -w <this-repo>/wsa-spec-aws.yaml.
- Binary discovery: four candidates in order —
$WSA_HOME/bin/wsa, a sibling
../workshop-setup-accelerator/bin/wsa, a sibling of the main checkout
(for linked-worktree use), and one on $PATH. Set $WSA_HOME if yours is
elsewhere.
- One command, not two:
workshop build runs wsa build and then feeds that
run's build-output.csv into workshop creds in-process, so the run-id is never
copied by hand. workshop clean resolves the newest non-cleaned run from
wsa-output/ instead of taking a --run-id.
- Spec:
wsa-spec-aws.yaml (repo root) — account_count: 5, but only as the
interactive default. is authoritative: it writes
into the derived spec. The shared Postgres host is fixed at 105
replication slots (95 supported accounts plus 10 spare); the exported
remains only for shared-infra compatibility. No file
needs editing to grow a workshop within that supported range. The old
ceiling that refused is gone; the real guard is
, which verifies each Console password exists in 1Password
and now bails after 3 misses. reaches wsa only as its check,
the "(N accounts)" banner, and the default account list supersedes.
