pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/aws_eks_cluster/resource.rb

@@ -1,165 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/resources/base'
-require 'pangea/resources/reference'
-require 'pangea/resources/aws_eks_cluster/types'
-require 'pangea/resource_registry'
-
-module Pangea
-  module Resources
-    module AWS
-      # Create an AWS EKS Cluster with type-safe attributes
-      #
-      # @param name [Symbol] The resource name
-      # @param attributes [Hash] EKS cluster attributes
-      # @option attributes [String] :name Custom cluster name (optional, defaults to resource name)
-      # @option attributes [String] :role_arn IAM role ARN for the cluster (required)
-      # @option attributes [Hash] :vpc_config VPC configuration (required)
-      # @option attributes [String] :version Kubernetes version (defaults to 1.28)
-      # @option attributes [Array<String>] :enabled_cluster_log_types Log types to enable
-      # @option attributes [Array<Hash>] :encryption_config Encryption configuration
-      # @option attributes [Hash] :kubernetes_network_config Kubernetes network config
-      # @option attributes [Hash] :tags Resource tags
-      # @return [ResourceReference] Reference object with outputs and computed properties
-      #
-      # @example Basic EKS cluster
-      #   cluster = aws_eks_cluster(:main, {
-      #     role_arn: eks_cluster_role.arn,
-      #     version: "1.28",
-      #     vpc_config: {
-      #       subnet_ids: [subnet_a.id, subnet_b.id],
-      #       endpoint_private_access: true,
-      #       endpoint_public_access: true,
-      #       public_access_cidrs: ["10.0.0.0/8"]
-      #     }
-      #   })
-      #
-      # @example EKS cluster with logging and encryption
-      #   cluster = aws_eks_cluster(:production, {
-      #     role_arn: cluster_role.arn,
-      #     version: "1.29",
-      #     vpc_config: {
-      #       subnet_ids: private_subnet_ids,
-      #       security_group_ids: [cluster_sg.id],
-      #       endpoint_private_access: true,
-      #       endpoint_public_access: false
-      #     },
-      #     enabled_cluster_log_types: ["api", "audit", "authenticator"],
-      #     encryption_config: [{
-      #       resources: ["secrets"],
-      #       provider: { key_arn: kms_key.arn }
-      #     }],
-      #     kubernetes_network_config: {
-      #       service_ipv4_cidr: "172.20.0.0/16",
-      #       ip_family: "ipv4"
-      #     },
-      #     tags: {
-      #       Environment: "production",
-      #       ManagedBy: "terraform"
-      #     }
-      #   })
-      def aws_eks_cluster(name, attributes = {})
-        # Validate attributes using dry-struct
-        cluster_attrs = AWS::Types::Types::EksClusterAttributes.new(attributes)
-        
-        # Generate terraform resource block via terraform-synthesizer
-        resource(:aws_eks_cluster, name) do
-          # Use custom name if provided, otherwise use resource name
-          __send__(:name, cluster_attrs.name) if cluster_attrs.name
-          
-          # Required attributes
-          role_arn cluster_attrs.role_arn
-          version cluster_attrs.version
-          
-          # VPC configuration block
-          vpc_config do
-            subnet_ids cluster_attrs.vpc_config.subnet_ids
-            security_group_ids cluster_attrs.vpc_config.security_group_ids if cluster_attrs.vpc_config.security_group_ids.any?
-            endpoint_private_access cluster_attrs.vpc_config.endpoint_private_access
-            endpoint_public_access cluster_attrs.vpc_config.endpoint_public_access
-            public_access_cidrs cluster_attrs.vpc_config.public_access_cidrs if cluster_attrs.vpc_config.endpoint_public_access
-          end
-          
-          # Logging configuration
-          if cluster_attrs.enabled_cluster_log_types.any?
-            enabled_cluster_log_types cluster_attrs.enabled_cluster_log_types
-          end
-          
-          # Encryption configuration
-          if cluster_attrs.encryption_config.any?
-            cluster_attrs.encryption_config.each do |enc_config|
-              encryption_config do
-                resources enc_config.resources
-                provider do
-                  key_arn enc_config.provider.key_arn
-                end
-              end
-            end
-          end
-          
-          # Kubernetes network configuration
-          if cluster_attrs.kubernetes_network_config
-            kubernetes_network_config do
-              service_ipv4_cidr cluster_attrs.kubernetes_network_config.service_ipv4_cidr if cluster_attrs.kubernetes_network_config.service_ipv4_cidr
-              ip_family cluster_attrs.kubernetes_network_config.ip_family
-            end
-          end
-          
-          # Tags
-          if cluster_attrs.tags.any?
-            tags cluster_attrs.tags
-          end
-        end
-        
-        # Return resource reference with available outputs
-        # Create resource reference
-        ref = ResourceReference.new(
-          type: 'aws_eks_cluster',
-          name: name,
-          resource_attributes: cluster_attrs.to_h,
-          outputs: {
-            id: "${aws_eks_cluster.#{name}.id}",
-            arn: "${aws_eks_cluster.#{name}.arn}",
-            name: "${aws_eks_cluster.#{name}.name}",
-            endpoint: "${aws_eks_cluster.#{name}.endpoint}",
-            platform_version: "${aws_eks_cluster.#{name}.platform_version}",
-            version: "${aws_eks_cluster.#{name}.version}",
-            status: "${aws_eks_cluster.#{name}.status}",
-            role_arn: "${aws_eks_cluster.#{name}.role_arn}",
-            vpc_config: "${aws_eks_cluster.#{name}.vpc_config}",
-            identity: "${aws_eks_cluster.#{name}.identity}",
-            certificate_authority: "${aws_eks_cluster.#{name}.certificate_authority}",
-            certificate_authority_data: "${aws_eks_cluster.#{name}.certificate_authority[0].data}",
-            created_at: "${aws_eks_cluster.#{name}.created_at}"
-          }
-        )
-        
-        # Add computed properties via method delegation
-        ref.define_singleton_method(:encryption_enabled?) { cluster_attrs.encryption_enabled? }
-        ref.define_singleton_method(:logging_enabled?) { cluster_attrs.logging_enabled? }
-        ref.define_singleton_method(:private_endpoint?) { cluster_attrs.private_endpoint? }
-        ref.define_singleton_method(:public_endpoint?) { cluster_attrs.public_endpoint? }
-        ref.define_singleton_method(:log_types) { cluster_attrs.enabled_cluster_log_types }
-        
-        ref
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_eks_cluster/types.rb

@@ -1,195 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    module AWS
-      module Types
-        # EKS cluster encryption configuration
-        class EncryptionConfig < Dry::Struct
-          transform_keys(&:to_sym)
-          
-          attribute :resources, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).constrained(
-            min_size: 1,
-            max_size: 1
-          ).default(['secrets'].freeze)
-          
-          # Provider configuration for encryption
-          class Provider < Dry::Struct
-            transform_keys(&:to_sym)
-            
-            attribute :key_arn, Pangea::Resources::Types::String.constrained(
-              format: /\Aarn:aws:kms:[a-z0-9-]+:\d{12}:key\/[a-f0-9-]+\z/
-            )
-            
-            def to_h
-              { key_arn: key_arn }
-            end
-          end
-          
-          attribute :provider, Provider
-          
-          def to_h
-            {
-              resources: resources,
-              provider: provider.to_h
-            }
-          end
-        end
-        
-        # VPC configuration for EKS cluster
-        class VpcConfig < Dry::Struct
-          transform_keys(&:to_sym)
-          
-          attribute :subnet_ids, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).constrained(
-            min_size: 2
-          )
-          attribute :security_group_ids, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).default([].freeze)
-          attribute :endpoint_private_access, Pangea::Resources::Types::Bool.default(false)
-          attribute :endpoint_public_access, Pangea::Resources::Types::Bool.default(true)
-          attribute :public_access_cidrs, Pangea::Resources::Types::Array.of(
-            Pangea::Resources::Types::String.constrained(format: /\A\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}\z/)
-          ).default(['0.0.0.0/0'].freeze)
-          
-          def self.new(attributes)
-            attrs = attributes.is_a?(Hash) ? attributes : {}
-            
-            # Validate subnet count
-            if attrs[:subnet_ids] && attrs[:subnet_ids].size < 2
-              raise Dry::Struct::Error, "EKS cluster requires at least 2 subnets in different availability zones"
-            end
-            
-            # Validate public access configuration
-            if attrs[:endpoint_public_access] == false && attrs[:endpoint_private_access] == false
-              raise Dry::Struct::Error, "At least one of endpoint_public_access or endpoint_private_access must be true"
-            end
-            
-            super(attrs)
-          end
-          
-          def to_h
-            hash = {
-              subnet_ids: subnet_ids,
-              endpoint_private_access: endpoint_private_access,
-              endpoint_public_access: endpoint_public_access
-            }
-            
-            hash[:security_group_ids] = security_group_ids if security_group_ids.any?
-            hash[:public_access_cidrs] = public_access_cidrs if endpoint_public_access
-            
-            hash
-          end
-        end
-        
-        # Kubernetes network configuration
-        class KubernetesNetworkConfig < Dry::Struct
-          transform_keys(&:to_sym)
-          
-          attribute :service_ipv4_cidr, Pangea::Resources::Types::String.optional.default(nil).constrained(
-            format: /\A10\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}\z|
-                    \A172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}\/\d{1,2}\z|
-                    \A192\.168\.\d{1,3}\.\d{1,3}\/\d{1,2}\z/
-          )
-          attribute :ip_family, Pangea::Resources::Types::String.default('ipv4').constrained(included_in: ['ipv4', 'ipv6'])
-          
-          def to_h
-            hash = { ip_family: ip_family }
-            hash[:service_ipv4_cidr] = service_ipv4_cidr if service_ipv4_cidr
-            hash
-          end
-        end
-        
-        # EKS cluster logging configuration
-        class ClusterLogging < Dry::Struct
-          transform_keys(&:to_sym)
-          
-          VALID_LOG_TYPES = %w[api audit authenticator controllerManager scheduler].freeze
-          
-          attribute :enabled_types, Pangea::Resources::Types::Array.of(
-            Pangea::Resources::Types::String.constrained(included_in: VALID_LOG_TYPES)
-          ).default([].freeze)
-          
-          def to_h
-            return {} if enabled_types.empty?
-            
-            {
-              enabled_cluster_log_types: enabled_types.map { |type| { types: [type], enabled: true } }
-            }
-          end
-        end
-        
-        # EKS cluster attributes with validation
-        class EksClusterAttributes < Dry::Struct
-          transform_keys(&:to_sym)
-          
-          SUPPORTED_VERSIONS = %w[1.24 1.25 1.26 1.27 1.28 1.29].freeze
-          
-          # Required attributes
-          attribute :name, Pangea::Resources::Types::String.optional.default(nil)
-          attribute :role_arn, Pangea::Resources::Types::String.constrained(
-            format: /\Aarn:aws:iam::\d{12}:role\/.+\z/
-          )
-          attribute :vpc_config, VpcConfig
-          
-          # Optional attributes
-          attribute :version, Pangea::Resources::Types::String.constrained(included_in: SUPPORTED_VERSIONS).default('1.28')
-          attribute :enabled_cluster_log_types, Pangea::Resources::Types::Array.of(
-            Pangea::Resources::Types::String.constrained(included_in: ClusterLogging::VALID_LOG_TYPES)
-          ).default([].freeze)
-          attribute :encryption_config, Pangea::Resources::Types::Array.of(EncryptionConfig).default([].freeze)
-          attribute :kubernetes_network_config, KubernetesNetworkConfig.optional.default(nil)
-          attribute :tags, Pangea::Resources::Types::Hash.default({}.freeze)
-          
-          # Computed properties
-          def encryption_enabled?
-            encryption_config.any?
-          end
-          
-          def logging_enabled?
-            enabled_cluster_log_types.any?
-          end
-          
-          def private_endpoint?
-            vpc_config.endpoint_private_access
-          end
-          
-          def public_endpoint?
-            vpc_config.endpoint_public_access
-          end
-          
-          def to_h
-            hash = {
-              role_arn: role_arn,
-              version: version,
-              vpc_config: vpc_config.to_h
-            }
-            
-            hash[:name] = name if name
-            hash[:enabled_cluster_log_types] = enabled_cluster_log_types if enabled_cluster_log_types.any?
-            hash[:encryption_config] = encryption_config.map(&:to_h) if encryption_config.any?
-            hash[:kubernetes_network_config] = kubernetes_network_config.to_h if kubernetes_network_config
-            hash[:tags] = tags if tags.any?
-            
-            hash
-          end
-        end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_eks_fargate_profile/CLAUDE.md

@@ -1,266 +0,0 @@
-# AWS EKS Fargate Profile Implementation
-
-## Overview
-
-The `aws_eks_fargate_profile` resource implements type-safe creation of EKS Fargate profiles with comprehensive validation for selectors, namespaces, labels, and IAM roles.
-
-## Type System Design
-
-### Core Types
-
-1. **EksFargateProfileAttributes**: Main attributes structure
-   - Enforces IAM role ARN format
-   - Validates selector count (1-5)
-   - Optional subnet specification
-
-2. **FargateSelector**: Pod selector configuration
-   - Required namespace field
-   - Optional label matching
-   - Kubernetes naming validation
-
-## Validation Rules
-
-### Selector Validation
-- Minimum 1, maximum 5 selectors per profile
-- Namespace is required for each selector
-- Labels are optional but validated if present
-- No duplicate namespace-only selectors
-
-### Namespace Validation
-- Cannot be empty or whitespace
-- Standard Kubernetes namespace rules apply
-- Must be unique if no labels specified
-
-### Label Validation
-- Keys must follow Kubernetes label format
-- Cannot have empty keys or values
-- Standard DNS subdomain rules
-
-### IAM Role Validation
-- Must be valid IAM role ARN format
-- Must have proper trust policy for Fargate
-
-## Terraform Synthesis
-
-The resource generates proper Terraform JSON structure:
-
-```hcl
-resource "aws_eks_fargate_profile" "example" {
-  cluster_name           = "my-cluster"
-  fargate_profile_name   = "example-profile"
-  pod_execution_role_arn = "arn:aws:iam::123456789012:role/fargate-pod-execution"
-  
-  subnet_ids = ["subnet-12345", "subnet-67890"]
-  
-  selector {
-    namespace = "production"
-    labels = {
-      compute = "fargate"
-      tier    = "web"
-    }
-  }
-  
-  selector {
-    namespace = "kube-system"
-    labels = {
-      k8s-app = "kube-dns"
-    }
-  }
-}
-```
-
-## Resource Outputs
-
-The resource provides outputs for integration:
-
-- **Identity**: ID, ARN, profile name
-- **Configuration**: Cluster name, role ARN
-- **Network**: Subnet IDs used
-- **Status**: Profile operational status
-- **Tags**: All tags including inherited
-
-## Computed Properties
-
-Properties for profile analysis:
-- `namespaces`: Unique namespace list
-- `has_labels`: Whether labels are used
-- `selector_count`: Number of selectors
-- `selectors`: Normalized selector data
-
-## Selector Matching Logic
-
-### How Fargate Selects Pods
-
-1. **Namespace Match**: Pod namespace must match selector
-2. **Label Match**: All selector labels must match pod labels
-3. **First Match Wins**: First matching selector applies
-4. **No Match**: Pod runs on EC2 nodes
-
-### Examples
-
-**Selector**:
-```ruby
-{
-  namespace: "production",
-  labels: { tier: "web", compute: "fargate" }
-}
-```
-
-**Matching Pod**:
-```yaml
-metadata:
-  namespace: production
-  labels:
-    tier: web
-    compute: fargate
-    app: nginx  # Extra labels are OK
-```
-
-**Non-Matching Pod**:
-```yaml
-metadata:
-  namespace: production
-  labels:
-    tier: web  # Missing compute: fargate
-```
-
-## Design Patterns
-
-### Environment Isolation
-```ruby
-# Separate profiles for environments
-environments = ["dev", "staging", "prod"]
-environments.each do |env|
-  aws_eks_fargate_profile(:"fargate_#{env}", {
-    cluster_name: cluster.name,
-    pod_execution_role_arn: role.arn,
-    selectors: [{ namespace: env }]
-  })
-end
-```
-
-### Workload Segregation
-```ruby
-# Different profiles for workload types
-workload_profiles = {
-  web: { namespace: "frontend", labels: { tier: "web" } },
-  api: { namespace: "backend", labels: { tier: "api" } },
-  jobs: { namespace: "jobs", labels: { type: "batch" } }
-}
-
-workload_profiles.each do |name, selector|
-  aws_eks_fargate_profile(:"fargate_#{name}", {
-    cluster_name: cluster.name,
-    pod_execution_role_arn: role.arn,
-    selectors: [selector]
-  })
-end
-```
-
-## Performance Considerations
-
-### Pod Startup Time
-- Initial image pulls can be slow
-- No image cache like EC2 nodes
-- Consider smaller images
-
-### Networking
-- Pod gets dedicated ENI
-- IP allocation from subnet
-- Security group per pod
-
-### Resource Allocation
-- CPU/memory automatically allocated
-- No overprovisioning
-- Billed per resource-second
-
-## Security Considerations
-
-1. **IAM Role**:
-   - Least privilege execution role
-   - No access to instance metadata
-   - Separate from node IAM roles
-
-2. **Network Isolation**:
-   - Dedicated ENI per pod
-   - Security group per pod
-   - No shared networking
-
-3. **Compute Isolation**:
-   - Dedicated compute resources
-   - No container breakout risk
-   - AWS-managed security patches
-
-## Cost Optimization
-
-1. **Profile Strategy**:
-   - Group similar workloads
-   - Minimize profile count
-   - Use labels effectively
-
-2. **Workload Selection**:
-   - Variable/bursty workloads
-   - Short-lived jobs
-   - Development environments
-
-3. **Resource Efficiency**:
-   - Right-size pod requests
-   - Avoid overprovisioning
-   - Monitor actual usage
-
-## Common Issues and Solutions
-
-1. **Pod Not Scheduling**:
-   - Issue: "No Fargate profile matches"
-   - Solution: Check namespace and labels
-
-2. **Subnet Capacity**:
-   - Issue: "InsufficientFreeAddresses"
-   - Solution: Use larger subnet CIDR
-
-3. **IAM Permissions**:
-   - Issue: "AccessDenied"
-   - Solution: Verify execution role
-
-## Testing Considerations
-
-1. **Unit Tests**:
-   - Validate selector structure
-   - Test label validation
-   - Verify namespace uniqueness
-
-2. **Integration Tests**:
-   - Test profile creation
-   - Verify pod scheduling
-   - Check network connectivity
-
-## Limitations and Workarounds
-
-### No DaemonSets
-- **Limitation**: Fargate doesn't support DaemonSets
-- **Workaround**: Use sidecar containers or init containers
-
-### No Host Access
-- **Limitation**: No hostNetwork, hostPID, hostIPC
-- **Workaround**: Use EC2 nodes for system workloads
-
-### Storage Limitations
-- **Limitation**: Only ephemeral storage
-- **Workaround**: Use EFS or external storage
-
-## Future Enhancements
-
-1. **Enhanced Validation**:
-   - Subnet availability checks
-   - Label format validation
-   - Namespace existence checks
-
-2. **Cost Estimation**:
-   - Profile cost prediction
-   - Workload analysis tools
-   - Optimization suggestions
-
-3. **Advanced Features**:
-   - Windows container support
-   - GPU support (future)
-   - Custom compute configurations