Terraform OKE Calico/VPP Setup

I already have a partial Terraform code-base that spins up an Oracle Cloud (OCI) OKE cluster, but the networking layer still needs polish. The main gap is a solid, production-grade CNI that combines Calico with the VPP dataplane and uses IPsec for in-cluster traffic encryption. The cluster itself is intended for active development and testing, yet I want the network stack hardened as if it were going straight into production.

Here is what I need from you:

• Refactor or extend my existing Terraform so it reliably provisions an OKE cluster where Calico is the CNI, VPP is the dataplane, and IPsec is enabled end-to-end.
• Keep the modules clean, parameterised, and aligned with Terraform best practices (state separation, variables, outputs, etc.).
• Validate the setup by deploying a sample namespace and confirming pod-to-pod traffic is routed through VPP and encrypted via IPsec.
• Supply concise run-books or comments in the code so I can reproduce the workflow in other environments or pipelines.

Acceptance criteria
– terraform apply completes without manual tweaks, producing a healthy OKE cluster visible in the OCI console.
– kubectl get pods ‑n kube-system shows Calico + VPP components in Running state with no CrashLoop events.
– ip xfrm or equivalent verification proves IPsec is active for pod traffic.
– README (or inline docs) explains required OCI IAM policies and any Calico/VPP tunables.

Tools & environment keywords: Terraform ≥1.5, OCI CLI, Kubernetes 1.27+, Calico, VPP, IPsec.

With these pieces in place I can concentrate on my application workloads instead of networking internals.