@ariestools/cli 0.1.16 → 0.1.17

package/dist/terraform/cluster-aws/versions.tf

@@ -0,0 +1,18 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.70"
+    }
+    tls = {
+      source  = "hashicorp/tls"
+      version = "~> 4.0"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.5"
+    }
+  }
+}

package/dist/terraform/cluster-azure/cluster.tf

@@ -0,0 +1,83 @@
+resource "azurerm_kubernetes_cluster" "main" {
+  name                = local.cluster_name
+  resource_group_name = azurerm_resource_group.main.name
+  location            = azurerm_resource_group.main.location
+  dns_prefix          = local.cluster_name
+  kubernetes_version  = length(var.k8s_version) > 0 ? var.k8s_version : null
+
+  tags = local.common_tags
+
+  # System node pool — runs kube-system workloads (CoreDNS, metrics-server,
+  # CSI controllers, etc.). One node is enough for shared-cluster workloads
+  # in MVP; scale up via the auto_scaling block on the user pool below.
+  default_node_pool {
+    name           = "system"
+    vm_size        = var.system_node_vm_size
+    node_count     = 1
+    vnet_subnet_id = azurerm_subnet.nodes.id
+
+    only_critical_addons_enabled = true # taint: CriticalAddonsOnly=true:NoSchedule
+
+    upgrade_settings {
+      max_surge = "10%"
+    }
+  }
+
+  # System-assigned managed identity. The principal id below is what we'd
+  # grant RBAC to if the cluster needed read-only access to a key vault, etc.
+  identity {
+    type = "SystemAssigned"
+  }
+
+  # CNI Overlay mode — pod IPs come from `pod_cidr` rather than the VNet,
+  # which means we don't burn IPv4 space on pod density. Service IPs come
+  # from `service_cidr`.
+  network_profile {
+    network_plugin      = "azure"
+    network_plugin_mode = "overlay"
+    pod_cidr            = var.pod_cidr
+    service_cidr        = var.service_cidr
+    dns_service_ip      = var.dns_service_ip
+    load_balancer_sku   = "standard"
+  }
+
+  # Workload Identity Federation (IRSA equivalent). Both flags must be on
+  # for pods to assume Azure SPs via service-account annotations.
+  oidc_issuer_enabled       = true
+  workload_identity_enabled = true
+
+  # Local accounts stay enabled in MVP — that's what makes
+  # `kube_admin_config_raw` work without `kubelogin`. Production should
+  # disable this and switch to AAD-backed kubeconfig.
+  local_account_disabled = false
+
+  # AKS clusters get auto-upgrade by default in patch channel. Surface it
+  # so the operator knows.
+  automatic_upgrade_channel = "patch"
+
+  role_based_access_control_enabled = true
+}
+
+# User node pool — where the service plane (and large-tier datalake
+# workloads) actually run. Autoscaling on, taint-free so pods land here
+# rather than the tainted system pool.
+resource "azurerm_kubernetes_cluster_node_pool" "user" {
+  name                  = "user"
+  kubernetes_cluster_id = azurerm_kubernetes_cluster.main.id
+  vm_size               = var.node_vm_size
+  vnet_subnet_id        = azurerm_subnet.nodes.id
+
+  auto_scaling_enabled = true
+  min_count            = var.node_min_count
+  max_count            = var.node_max_count
+
+  node_labels = {
+    "aries.xylabs.com/pool" = "shared"
+  }
+
+  upgrade_settings {
+    max_surge = "33%"
+  }
+
+  tags = local.common_tags
+}

package/dist/terraform/cluster-azure/encryption.tofu.example

@@ -0,0 +1,37 @@
+# OpenTofu state encryption — opt-in.
+#
+# Encrypts `terraform.tfstate` and any saved plan files at rest using
+# AES-GCM with a key derived from `var.tfstate_passphrase` via PBKDF2.
+#
+# To enable:
+#   1. cp encryption.tofu.example encryption.tofu     (in the working dir)
+#   2. export TF_VAR_tfstate_passphrase='at-least-16-characters'
+#   3. tofu init -reconfigure
+#
+# Notes:
+#   - This file uses the `.tofu` extension so Terraform does NOT load it.
+#     Only OpenTofu engages encryption. Terraform users skip this block.
+#   - AKS state contains the kubelet identity object id, OIDC issuer URL,
+#     and (when `kube_admin_config_raw` is used) the cluster's admin
+#     certificate bundle. Keep it encrypted for anything beyond throwaway
+#     staging.
+
+terraform {
+  encryption {
+    key_provider "pbkdf2" "default" {
+      passphrase = var.tfstate_passphrase
+    }
+
+    method "aes_gcm" "default" {
+      keys = key_provider.pbkdf2.default
+    }
+
+    state {
+      method = method.aes_gcm.default
+    }
+
+    plan {
+      method = method.aes_gcm.default
+    }
+  }
+}

package/dist/terraform/cluster-azure/identity.tf

@@ -0,0 +1,9 @@
+# System-assigned managed identity for the cluster. AKS uses this to call
+# Azure APIs (e.g., manage the load balancer for ingress-nginx Services,
+# attach managed disks for PVCs). Equivalent to the EKS cluster role.
+#
+# We declare the identity inline on the cluster resource (`identity` block)
+# rather than as a separate resource — that's the simpler pattern for the
+# common case. Workload Identity Federation (the IRSA-equivalent for pods)
+# is enabled via `workload_identity_enabled` on the cluster resource and
+# bound per-pod via service-account annotations in the service plane.

package/dist/terraform/cluster-azure/kubeconfig.tf

@@ -0,0 +1,18 @@
+# Render the cluster's admin kubeconfig into the working dir. AKS produces
+# two kubeconfigs:
+#
+#   - `kube_admin_config_raw` — local-account auth with embedded certs.
+#     Works out of the box without `kubelogin` or `az` exec plugins.
+#   - `kube_config_raw` — Azure AD auth via `kubelogin`. Requires the
+#     AAD-RBAC block on the cluster and `kubelogin` on the user's PATH.
+#
+# MVP uses the admin kubeconfig. Production should flip
+# `local_account_disabled = true` on the cluster and switch to
+# `kube_config_raw` plus a `kubelogin` install.
+
+resource "local_sensitive_file" "kubeconfig" {
+  filename             = "${path.cwd}/kubeconfig"
+  content              = azurerm_kubernetes_cluster.main.kube_admin_config_raw
+  file_permission      = "0600"
+  directory_permission = "0700"
+}

package/dist/terraform/cluster-azure/network.tf

@@ -0,0 +1,23 @@
+resource "azurerm_resource_group" "main" {
+  name     = local.resource_group_name
+  location = var.location
+  tags     = local.common_tags
+}
+
+# Dedicated VNet for the cluster. We use Azure CNI Overlay mode (set on the
+# AKS cluster) so pod IPs come from `pod_cidr` rather than the VNet — the
+# subnet only needs to fit nodes, not pods.
+resource "azurerm_virtual_network" "main" {
+  name                = "${local.name_prefix}-vnet"
+  resource_group_name = azurerm_resource_group.main.name
+  location            = azurerm_resource_group.main.location
+  address_space       = [var.vnet_cidr]
+  tags                = local.common_tags
+}
+
+resource "azurerm_subnet" "nodes" {
+  name                 = "nodes"
+  resource_group_name  = azurerm_resource_group.main.name
+  virtual_network_name = azurerm_virtual_network.main.name
+  address_prefixes     = [var.node_subnet_cidr]
+}

package/dist/terraform/cluster-azure/outputs.tf

@@ -0,0 +1,69 @@
+output "cluster_name" {
+  description = "AKS cluster name."
+  value       = azurerm_kubernetes_cluster.main.name
+}
+
+output "cluster_id" {
+  description = "Fully-qualified AKS cluster resource id."
+  value       = azurerm_kubernetes_cluster.main.id
+}
+
+output "cluster_fqdn" {
+  description = "Public FQDN of the cluster's API server."
+  value       = azurerm_kubernetes_cluster.main.fqdn
+}
+
+output "resource_group_name" {
+  description = "Resource group containing the cluster."
+  value       = azurerm_resource_group.main.name
+}
+
+output "oidc_issuer_url" {
+  description = "OIDC issuer URL — used to federate Microsoft Entra Workload IDs onto Kubernetes ServiceAccounts."
+  value       = azurerm_kubernetes_cluster.main.oidc_issuer_url
+}
+
+output "kubelet_identity_object_id" {
+  description = "Object id of the kubelet identity (used when granting AcrPull etc. for ACR integration)."
+  value       = azurerm_kubernetes_cluster.main.kubelet_identity[0].object_id
+}
+
+output "vnet_id" {
+  description = "Dedicated VNet id."
+  value       = azurerm_virtual_network.main.id
+}
+
+output "node_subnet_id" {
+  description = "Subnet id the node pools live in."
+  value       = azurerm_subnet.nodes.id
+}
+
+output "kubeconfig_path" {
+  description = "Path to the rendered kubeconfig (relative to the working dir)."
+  value       = local_sensitive_file.kubeconfig.filename
+}
+
+output "location" {
+  description = "Azure region the cluster lives in."
+  value       = var.location
+}
+
+output "subscription_id" {
+  description = "Azure subscription id."
+  value       = var.subscription_id
+}
+
+# Tier-2 → Tier-3 hand-off shape. The CLI projects this into ~/.aries/cluster/<name>/cluster.yaml.
+output "service_target" {
+  description = "ServiceTarget(kubernetes) shape consumed by the Tier-3 service plane."
+  value = {
+    kind          = "kubernetes"
+    cloud         = "azure"
+    cluster_name  = azurerm_kubernetes_cluster.main.name
+    region        = var.location
+    namespace     = "aries-datalake"
+    ingress_class = "nginx"
+    storage_class = "managed-csi"
+    kubeconfig    = local_sensitive_file.kubeconfig.filename
+  }
+}

package/dist/terraform/cluster-azure/providers.tf

@@ -0,0 +1,16 @@
+# Auth: the provider uses your active `az login` session by default.
+# Set `ARM_*` env vars (ARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID,
+# ARM_SUBSCRIPTION_ID) to override with a service principal in CI.
+#
+# The `features {}` block is required by azurerm even when empty.
+
+provider "azurerm" {
+  subscription_id = var.subscription_id
+  tenant_id       = var.tenant_id != "" ? var.tenant_id : null
+
+  features {
+    resource_group {
+      prevent_deletion_if_contains_resources = false
+    }
+  }
+}

package/dist/terraform/cluster-azure/terraform.tfvars.example

@@ -0,0 +1,24 @@
+subscription_id = ""               # required — `az account show --query id -o tsv`
+# tenant_id     = ""               # leave empty to use the tenant from `az login`
+
+location    = "eastus"
+environment = "staging"
+project     = "aries-datalake"
+
+# cluster_name and resource_group_name default to the project+environment.
+# cluster_name        = "aries-datalake-staging"
+# resource_group_name = "aries-datalake-staging-rg"
+
+# k8s_version = "1.31"             # leave empty for the AKS regional default
+
+# vnet_cidr        = "10.45.0.0/16"
+# node_subnet_cidr = "10.45.0.0/22"
+# pod_cidr         = "10.244.0.0/16"
+# service_cidr     = "10.0.0.0/16"
+# dns_service_ip   = "10.0.0.10"
+
+# node_vm_size        = "Standard_D2s_v5"   # ~ t3.medium / e2-standard-2
+# system_node_vm_size = "Standard_D2s_v5"
+# node_count          = 2
+# node_min_count      = 1
+# node_max_count      = 4

package/dist/terraform/cluster-azure/variables.tf

@@ -0,0 +1,126 @@
+variable "subscription_id" {
+  type        = string
+  description = "Azure subscription id the cluster lives in."
+}
+
+variable "tenant_id" {
+  type        = string
+  description = "Azure tenant id. Leave empty to use the tenant from your active `az login`."
+  default     = ""
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region. Mirrors the `region` knob in cluster-aws / cluster-gcp."
+  default     = "eastus"
+}
+
+variable "environment" {
+  type        = string
+  description = "Environment name (staging, prod, etc.). Goes into resource tags + names."
+  default     = "staging"
+}
+
+variable "project" {
+  type        = string
+  description = "Project tag (analog of AWS `Project`)."
+  default     = "aries-datalake"
+}
+
+variable "cluster_name" {
+  type        = string
+  description = "AKS cluster name. Defaults to `${var.project}-${var.environment}`."
+  default     = ""
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group name. Defaults to `<cluster_name>-rg`. Always created by this module."
+  default     = ""
+}
+
+variable "k8s_version" {
+  type        = string
+  description = "Kubernetes version. Leave empty to pull the AKS default for the region."
+  default     = ""
+}
+
+variable "vnet_cidr" {
+  type        = string
+  description = "VNet CIDR block. Must not overlap compute-aws (10.42), cluster-aws (10.43), cluster-gcp (10.44) if you ever peer them."
+  default     = "10.45.0.0/16"
+}
+
+variable "node_subnet_cidr" {
+  type        = string
+  description = "Subnet CIDR within the VNet that hosts AKS nodes."
+  default     = "10.45.0.0/22"
+}
+
+variable "pod_cidr" {
+  type        = string
+  description = "Overlay CIDR for pod IPs (CNI Overlay mode). Doesn't need to live inside the VNet."
+  default     = "10.244.0.0/16"
+}
+
+variable "service_cidr" {
+  type        = string
+  description = "Kubernetes Services CIDR."
+  default     = "10.0.0.0/16"
+}
+
+variable "dns_service_ip" {
+  type        = string
+  description = "kube-dns IP — must be inside service_cidr."
+  default     = "10.0.0.10"
+}
+
+variable "node_vm_size" {
+  type        = string
+  description = "VM SKU for the default node pool. Standard_D2s_v5 ≈ t3.medium ≈ e2-standard-2."
+  default     = "Standard_D2s_v5"
+}
+
+variable "node_count" {
+  type        = number
+  description = "Starting node count for the default user pool."
+  default     = 2
+}
+
+variable "node_min_count" {
+  type        = number
+  description = "Autoscaler floor for the default user pool."
+  default     = 1
+}
+
+variable "node_max_count" {
+  type        = number
+  description = "Autoscaler ceiling for the default user pool."
+  default     = 4
+}
+
+variable "system_node_vm_size" {
+  type        = string
+  description = "VM SKU for the system node pool (kube-system workloads)."
+  default     = "Standard_D2s_v5"
+}
+
+variable "tfstate_passphrase" {
+  type        = string
+  description = "Passphrase for OpenTofu state encryption. See encryption.tofu.example."
+  default     = ""
+  sensitive   = true
+}
+
+locals {
+  cluster_name        = length(var.cluster_name) > 0 ? var.cluster_name : "${var.project}-${var.environment}"
+  resource_group_name = length(var.resource_group_name) > 0 ? var.resource_group_name : "${local.cluster_name}-rg"
+  name_prefix         = "${var.project}-${var.environment}-cluster"
+
+  common_tags = {
+    project     = var.project
+    environment = var.environment
+    component   = "cluster"
+    managed-by  = "opentofu"
+  }
+}

package/dist/terraform/cluster-azure/versions.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 4.10"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.5"
+    }
+  }
+}

package/dist/terraform/cluster-gcp/cluster.tf

@@ -0,0 +1,71 @@
+resource "google_container_cluster" "main" {
+  name     = local.cluster_name
+  location = var.region
+
+  network    = google_compute_network.main.id
+  subnetwork = google_compute_subnetwork.main.id
+
+  # Autopilot: Google manages nodes, scales pools, autoscales node count,
+  # and enforces opinionated security defaults. Less knob surface, less to
+  # break — right call for "Atlas-style hosted datalake". Switch to
+  # Standard mode if a customer needs custom node-pool isolation that
+  # Autopilot's per-pod scheduling can't satisfy.
+  enable_autopilot = true
+
+  ip_allocation_policy {
+    cluster_secondary_range_name  = "pods"
+    services_secondary_range_name = "services"
+  }
+
+  release_channel {
+    channel = var.release_channel
+  }
+
+  # Workload Identity is on by default in Autopilot — pods assume a GCP
+  # service account via the `iam.gke.io/gcp-service-account` annotation on
+  # their KSA. Equivalent to AWS IRSA. The service plane will use this in
+  # phase 6 when the data plane talks to GCS for the archive tier.
+  workload_identity_config {
+    workload_pool = "${var.project_id}.svc.id.goog"
+  }
+
+  # Master endpoint stays public for now — same posture as cluster-aws.
+  # Tighten via master_authorized_networks_config below or flip to
+  # `enable_private_endpoint = true` when PrivateLink/IAP work lands.
+  master_authorized_networks_config {
+    dynamic "cidr_blocks" {
+      for_each = var.master_authorized_networks
+      content {
+        cidr_block   = cidr_blocks.value.cidr_block
+        display_name = cidr_blocks.value.display_name
+      }
+    }
+  }
+
+  # Surface control-plane logs & metrics to Cloud Logging / Monitoring so
+  # the SRE team isn't blind on day 1. Autopilot bills for these by default.
+  logging_config {
+    enable_components = ["SYSTEM_COMPONENTS", "WORKLOADS"]
+  }
+
+  monitoring_config {
+    enable_components = ["SYSTEM_COMPONENTS"]
+    managed_prometheus {
+      enabled = true
+    }
+  }
+
+  # Deletion protection defaults on for prod environments. Staging users
+  # can flip via the environment label.
+  deletion_protection = var.environment == "prod"
+
+  resource_labels = {
+    component = "cluster"
+  }
+}
+
+# Look up the project number — Workload Identity bindings use it in the
+# `serviceAccount:<project>.svc.id.goog[<namespace>/<ksa>]` subject form.
+data "google_project" "main" {
+  project_id = var.project_id
+}

package/dist/terraform/cluster-gcp/encryption.tofu.example

@@ -0,0 +1,35 @@
+# OpenTofu state encryption — opt-in.
+#
+# Encrypts `terraform.tfstate` and any saved plan files at rest using
+# AES-GCM with a key derived from `var.tfstate_passphrase` via PBKDF2.
+#
+# To enable:
+#   1. cp encryption.tofu.example encryption.tofu     (in the working dir)
+#   2. export TF_VAR_tfstate_passphrase='at-least-16-characters'
+#   3. tofu init -reconfigure
+#
+# Notes:
+#   - This file uses the `.tofu` extension so Terraform does NOT load it.
+#     Only OpenTofu engages encryption. Terraform users skip this block.
+#   - GKE state contains the cluster CA bundle and project number — keep
+#     it encrypted for anything beyond throwaway staging.
+
+terraform {
+  encryption {
+    key_provider "pbkdf2" "default" {
+      passphrase = var.tfstate_passphrase
+    }
+
+    method "aes_gcm" "default" {
+      keys = key_provider.pbkdf2.default
+    }
+
+    state {
+      method = method.aes_gcm.default
+    }
+
+    plan {
+      method = method.aes_gcm.default
+    }
+  }
+}

package/dist/terraform/cluster-gcp/kubeconfig.tf

@@ -0,0 +1,47 @@
+# Render a kubeconfig into the working dir. The `exec` block delegates
+# auth to `gke-gcloud-auth-plugin`, which is the supported way to talk to
+# GKE after kubectl 1.26+. Users must install it once:
+#
+#   gcloud components install gke-gcloud-auth-plugin
+#
+# Like the EKS kubeconfig, this carries no long-lived secrets — the plugin
+# refreshes tokens from the user's gcloud auth state on every call.
+
+locals {
+  kubeconfig_yaml = yamlencode({
+    apiVersion      = "v1"
+    kind            = "Config"
+    current-context = "aries-${local.cluster_name}"
+    clusters = [{
+      name = "aries-${local.cluster_name}"
+      cluster = {
+        server                       = "https://${google_container_cluster.main.endpoint}"
+        "certificate-authority-data" = google_container_cluster.main.master_auth[0].cluster_ca_certificate
+      }
+    }]
+    contexts = [{
+      name = "aries-${local.cluster_name}"
+      context = {
+        cluster = "aries-${local.cluster_name}"
+        user    = "aries-${local.cluster_name}"
+      }
+    }]
+    users = [{
+      name = "aries-${local.cluster_name}"
+      user = {
+        exec = {
+          apiVersion         = "client.authentication.k8s.io/v1beta1"
+          command            = "gke-gcloud-auth-plugin"
+          provideClusterInfo = true
+        }
+      }
+    }]
+  })
+}
+
+resource "local_sensitive_file" "kubeconfig" {
+  filename             = "${path.cwd}/kubeconfig"
+  content              = local.kubeconfig_yaml
+  file_permission      = "0600"
+  directory_permission = "0700"
+}

package/dist/terraform/cluster-gcp/network.tf

@@ -0,0 +1,47 @@
+resource "google_compute_network" "main" {
+  name                    = "${local.name_prefix}-vpc"
+  auto_create_subnetworks = false
+  routing_mode            = "REGIONAL"
+}
+
+# One regional subnet with secondary IP ranges for pods + services — this
+# is the VPC-native ("alias-IP") setup GKE Autopilot requires. Public IPs
+# never get assigned to pods; egress goes through Cloud NAT below.
+resource "google_compute_subnetwork" "main" {
+  name          = "${local.name_prefix}-subnet"
+  network       = google_compute_network.main.id
+  region        = var.region
+  ip_cidr_range = var.vpc_cidr
+
+  private_ip_google_access = true
+
+  secondary_ip_range {
+    range_name    = "pods"
+    ip_cidr_range = var.pods_cidr
+  }
+  secondary_ip_range {
+    range_name    = "services"
+    ip_cidr_range = var.services_cidr
+  }
+}
+
+resource "google_compute_router" "main" {
+  name    = "${local.name_prefix}-router"
+  network = google_compute_network.main.id
+  region  = var.region
+}
+
+# Autopilot nodes have no external IPs by default — they need NAT to pull
+# container images, reach external APIs, etc.
+resource "google_compute_router_nat" "main" {
+  name                               = "${local.name_prefix}-nat"
+  router                             = google_compute_router.main.name
+  region                             = var.region
+  nat_ip_allocate_option             = "AUTO_ONLY"
+  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
+
+  log_config {
+    enable = true
+    filter = "ERRORS_ONLY"
+  }
+}