@ariestools/cli 0.1.16 → 0.1.17

package/dist/terraform/cluster-gcp/outputs.tf

@@ -0,0 +1,70 @@
+output "cluster_name" {
+  description = "GKE cluster name."
+  value       = google_container_cluster.main.name
+}
+
+output "cluster_id" {
+  description = "Fully-qualified GKE cluster id (`projects/<id>/locations/<region>/clusters/<name>`)."
+  value       = google_container_cluster.main.id
+}
+
+output "cluster_endpoint" {
+  description = "GKE control-plane endpoint (HTTPS host)."
+  value       = google_container_cluster.main.endpoint
+}
+
+output "cluster_certificate_authority_data" {
+  description = "Base64-encoded cluster CA cert."
+  value       = google_container_cluster.main.master_auth[0].cluster_ca_certificate
+  sensitive   = true
+}
+
+output "workload_identity_pool" {
+  description = "Workload Identity pool (`<project>.svc.id.goog`). Bind GCP SAs to KSAs via this."
+  value       = "${var.project_id}.svc.id.goog"
+}
+
+output "project_id" {
+  description = "GCP project id the cluster lives in."
+  value       = var.project_id
+}
+
+output "project_number" {
+  description = "GCP project number (useful in Workload Identity subjects)."
+  value       = data.google_project.main.number
+}
+
+output "vpc_id" {
+  description = "Dedicated VPC the cluster runs in."
+  value       = google_compute_network.main.id
+}
+
+output "subnet_id" {
+  description = "Subnet hosting the cluster."
+  value       = google_compute_subnetwork.main.id
+}
+
+output "kubeconfig_path" {
+  description = "Path to the rendered kubeconfig (relative to the working dir)."
+  value       = local_sensitive_file.kubeconfig.filename
+}
+
+output "region" {
+  description = "GCP region the cluster lives in."
+  value       = var.region
+}
+
+# The Tier-3 service plane reads this to construct its `ServiceTarget(kubernetes)`.
+output "service_target" {
+  description = "Tier-2 → Tier-3 hand-off shape. The CLI projects this into ~/.aries/cluster/<name>/cluster.yaml."
+  value = {
+    kind          = "kubernetes"
+    cloud         = "gcp"
+    cluster_name  = google_container_cluster.main.name
+    region        = var.region
+    namespace     = "aries-datalake"
+    ingress_class = "nginx"
+    storage_class = "standard-rwo"
+    kubeconfig    = local_sensitive_file.kubeconfig.filename
+  }
+}

package/dist/terraform/cluster-gcp/providers.tf

@@ -0,0 +1,14 @@
+# Auth: the provider picks up Application Default Credentials (ADC) from
+# your local environment. Run `gcloud auth application-default login` once
+# before `aries cluster gcp up`. Optionally point the provider at a
+# specific service-account JSON via `GOOGLE_CREDENTIALS=/path/to/sa.json`.
+#
+# Default labels go on every resource that supports them so it's easy to
+# find — and bulk-delete — the entire stack.
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+
+  default_labels = local.common_labels
+}

package/dist/terraform/cluster-gcp/terraform.tfvars.example

@@ -0,0 +1,17 @@
+project_id  = "xyo-datalake"        # required — your GCP project id
+region      = "us-central1"
+environment = "staging"
+project     = "aries-datalake"
+
+# cluster_name defaults to `${project}-${environment}` when empty.
+# cluster_name = "aries-datalake-staging"
+
+# release_channel = "REGULAR"        # one of RAPID, REGULAR, STABLE
+
+# vpc_cidr      = "10.44.0.0/16"     # nodes
+# pods_cidr     = "10.48.0.0/14"     # secondary range for pods
+# services_cidr = "10.52.0.0/20"     # secondary range for Services
+
+# master_authorized_networks = [
+#   { cidr_block = "203.0.113.4/32", display_name = "office" },
+# ]

package/dist/terraform/cluster-gcp/variables.tf

@@ -0,0 +1,86 @@
+variable "project_id" {
+  type        = string
+  description = "GCP project id the cluster lives in. Must already exist; create with `gcloud projects create` if needed."
+}
+
+variable "region" {
+  type        = string
+  description = "GCP region for the GKE Autopilot cluster. Autopilot is regional only — multi-zone HA is automatic."
+  default     = "us-central1"
+}
+
+variable "environment" {
+  type        = string
+  description = "Environment name (staging, prod, etc.). Goes into resource labels + names."
+  default     = "staging"
+}
+
+variable "project" {
+  type        = string
+  description = "Project label (analog of AWS `Project` tag). Distinct from `project_id` — this is a human-readable category."
+  default     = "aries-datalake"
+}
+
+variable "cluster_name" {
+  type        = string
+  description = "GKE cluster name. Defaults to `${var.project}-${var.environment}`."
+  default     = ""
+}
+
+variable "release_channel" {
+  type        = string
+  description = "GKE release channel: RAPID / REGULAR / STABLE. REGULAR is the recommended default."
+  default     = "REGULAR"
+  validation {
+    condition     = contains(["RAPID", "REGULAR", "STABLE"], var.release_channel)
+    error_message = "release_channel must be one of RAPID, REGULAR, STABLE."
+  }
+}
+
+variable "vpc_cidr" {
+  type        = string
+  description = "Primary subnet CIDR for the cluster's nodes. Must not overlap any existing VPC you intend to peer with — or compute-aws (10.42.0.0/16) and cluster-aws (10.43.0.0/16) if both stacks live in the same VPN/Interconnect topology."
+  default     = "10.44.0.0/16"
+}
+
+variable "pods_cidr" {
+  type        = string
+  description = "Secondary range for pod IPs (Autopilot needs a /14 or so to scale freely)."
+  default     = "10.48.0.0/14"
+}
+
+variable "services_cidr" {
+  type        = string
+  description = "Secondary range for Kubernetes Services."
+  default     = "10.52.0.0/20"
+}
+
+variable "master_authorized_networks" {
+  type = list(object({
+    cidr_block   = string
+    display_name = string
+  }))
+  description = "CIDRs allowed to reach the public GKE control plane. Defaults to anywhere; tighten to your office IP for prod."
+  default = [
+    { cidr_block = "0.0.0.0/0", display_name = "anywhere" },
+  ]
+}
+
+variable "tfstate_passphrase" {
+  type        = string
+  description = "Passphrase for OpenTofu state encryption. See encryption.tofu.example."
+  default     = ""
+  sensitive   = true
+}
+
+locals {
+  cluster_name = length(var.cluster_name) > 0 ? var.cluster_name : "${var.project}-${var.environment}"
+  name_prefix  = "${var.project}-${var.environment}-cluster"
+
+  common_labels = {
+    project     = var.project
+    environment = var.environment
+    component   = "cluster"
+    managed-by  = "opentofu"
+  }
+}

package/dist/terraform/cluster-gcp/versions.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 6.10"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.5"
+    }
+  }
+}

package/dist/terraform/serverless-aws/alb.tf

@@ -0,0 +1,127 @@
+resource "aws_lb" "main" {
+  name               = "${local.name_prefix}-alb"
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.alb.id]
+  subnets            = [for s in aws_subnet.public : s.id]
+
+  drop_invalid_header_fields = true
+  enable_http2               = true
+}
+
+resource "aws_lb_target_group" "control" {
+  name        = "${local.name_prefix}-control"
+  port        = 8787
+  protocol    = "HTTP"
+  target_type = "ip"
+  vpc_id      = aws_vpc.main.id
+
+  health_check {
+    enabled             = true
+    path                = "/v1/health"
+    matcher             = "200"
+    healthy_threshold   = 2
+    unhealthy_threshold = 3
+    interval            = 15
+    timeout             = 5
+  }
+
+  deregistration_delay = 30
+}
+
+resource "aws_lb_target_group" "plane" {
+  name        = "${local.name_prefix}-plane"
+  port        = 8788
+  protocol    = "HTTP"
+  target_type = "ip"
+  vpc_id      = aws_vpc.main.id
+
+  health_check {
+    enabled             = true
+    path                = "/v1/health"
+    matcher             = "200"
+    healthy_threshold   = 2
+    unhealthy_threshold = 3
+    interval            = 15
+    timeout             = 5
+  }
+
+  deregistration_delay = 30
+}
+
+resource "aws_lb_listener" "http" {
+  load_balancer_arn = aws_lb.main.arn
+  port              = 80
+  protocol          = "HTTP"
+
+  dynamic "default_action" {
+    for_each = local.has_domain ? [1] : []
+    content {
+      type = "redirect"
+      redirect {
+        port        = "443"
+        protocol    = "HTTPS"
+        status_code = "HTTP_301"
+      }
+    }
+  }
+
+  dynamic "default_action" {
+    for_each = local.has_domain ? [] : [1]
+    content {
+      type             = "forward"
+      target_group_arn = aws_lb_target_group.control.arn
+    }
+  }
+}
+
+resource "aws_lb_listener" "https" {
+  count             = local.has_domain ? 1 : 0
+  load_balancer_arn = aws_lb.main.arn
+  port              = 443
+  protocol          = "HTTPS"
+  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
+  certificate_arn   = aws_acm_certificate_validation.main[0].certificate_arn
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.control.arn
+  }
+}
+
+# Host-based routing: data.<domain> → data plane TG.
+resource "aws_lb_listener_rule" "data_https" {
+  count        = local.has_domain ? 1 : 0
+  listener_arn = aws_lb_listener.https[0].arn
+  priority     = 100
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.plane.arn
+  }
+
+  condition {
+    host_header {
+      values = [local.data_fqdn]
+    }
+  }
+}
+
+# When no domain is configured, expose the plane on /plane/* on the same HTTP
+# listener so smoke testing the ALB DNS name still reaches both planes.
+resource "aws_lb_listener_rule" "data_http_path" {
+  count        = local.has_domain ? 0 : 1
+  listener_arn = aws_lb_listener.http.arn
+  priority     = 100
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.plane.arn
+  }
+
+  condition {
+    path_pattern {
+      values = ["/plane/*"]
+    }
+  }
+}

package/dist/terraform/serverless-aws/database.tf

@@ -0,0 +1,70 @@
+resource "random_password" "db_master" {
+  length  = 32
+  special = false
+}
+
+data "aws_rds_engine_version" "postgres" {
+  engine  = "postgres"
+  version = var.db_engine_version
+  latest  = true
+}
+
+resource "aws_db_subnet_group" "main" {
+  name       = "${local.name_prefix}-db"
+  subnet_ids = [for s in aws_subnet.private : s.id]
+  tags       = { Name = "${local.name_prefix}-db-subnets" }
+}
+
+resource "aws_db_instance" "main" {
+  identifier              = "${local.name_prefix}-db"
+  engine                  = "postgres"
+  engine_version          = data.aws_rds_engine_version.postgres.version_actual
+  instance_class          = var.db_instance_class
+  allocated_storage       = var.db_allocated_storage
+  storage_type            = "gp3"
+  storage_encrypted       = true
+  db_name                 = "aries_datalake"
+  username                = "aries"
+  password                = random_password.db_master.result
+  db_subnet_group_name    = aws_db_subnet_group.main.name
+  vpc_security_group_ids  = [aws_security_group.database.id]
+  publicly_accessible     = false
+  multi_az                = false
+  backup_retention_period = 7
+  skip_final_snapshot     = var.environment != "prod"
+  deletion_protection     = var.environment == "prod"
+  apply_immediately       = var.environment != "prod"
+
+  tags = { Name = "${local.name_prefix}-db" }
+}
+
+locals {
+  database_url = "postgresql://aries:${random_password.db_master.result}@${aws_db_instance.main.address}:5432/aries_datalake?sslmode=require&uselibpqcompat=true"
+}
+
+resource "aws_secretsmanager_secret" "database_url" {
+  name                    = "${local.name_prefix}/database-url"
+  description             = "Postgres connection string for the Aries datalake control plane"
+  recovery_window_in_days = 7
+}
+
+resource "aws_secretsmanager_secret_version" "database_url" {
+  secret_id     = aws_secretsmanager_secret.database_url.id
+  secret_string = local.database_url
+}
+
+resource "random_password" "token_signing_secret" {
+  length  = 64
+  special = false
+}
+
+resource "aws_secretsmanager_secret" "token_signing" {
+  name                    = "${local.name_prefix}/token-signing-secret"
+  description             = "HMAC signing secret shared between the control and data planes"
+  recovery_window_in_days = 7
+}
+
+resource "aws_secretsmanager_secret_version" "token_signing" {
+  secret_id     = aws_secretsmanager_secret.token_signing.id
+  secret_string = random_password.token_signing_secret.result
+}

package/dist/terraform/serverless-aws/dns.tf

@@ -0,0 +1,80 @@
+data "aws_route53_zone" "existing" {
+  count        = local.has_domain && !var.create_route53_zone ? 1 : 0
+  name         = var.domain_name
+  private_zone = false
+}
+
+resource "aws_route53_zone" "main" {
+  count = local.has_domain && var.create_route53_zone ? 1 : 0
+  name  = var.domain_name
+}
+
+locals {
+  zone_id = local.has_domain ? (
+    var.create_route53_zone ? aws_route53_zone.main[0].zone_id : data.aws_route53_zone.existing[0].zone_id
+  ) : ""
+
+  api_fqdn  = local.has_domain ? "api.${var.domain_name}" : ""
+  data_fqdn = local.has_domain ? "data.${var.domain_name}" : ""
+}
+
+resource "aws_acm_certificate" "main" {
+  count             = local.has_domain ? 1 : 0
+  domain_name       = local.api_fqdn
+  subject_alternative_names = [local.data_fqdn]
+  validation_method = "DNS"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_route53_record" "cert_validation" {
+  for_each = local.has_domain ? {
+    for option in aws_acm_certificate.main[0].domain_validation_options :
+    option.domain_name => {
+      name   = option.resource_record_name
+      record = option.resource_record_value
+      type   = option.resource_record_type
+    }
+  } : {}
+
+  allow_overwrite = true
+  name            = each.value.name
+  records         = [each.value.record]
+  ttl             = 60
+  type            = each.value.type
+  zone_id         = local.zone_id
+}
+
+resource "aws_acm_certificate_validation" "main" {
+  count                   = local.has_domain ? 1 : 0
+  certificate_arn         = aws_acm_certificate.main[0].arn
+  validation_record_fqdns = [for r in aws_route53_record.cert_validation : r.fqdn]
+}
+
+resource "aws_route53_record" "api" {
+  count   = local.has_domain ? 1 : 0
+  zone_id = local.zone_id
+  name    = local.api_fqdn
+  type    = "A"
+
+  alias {
+    name                   = aws_lb.main.dns_name
+    zone_id                = aws_lb.main.zone_id
+    evaluate_target_health = true
+  }
+}
+
+resource "aws_route53_record" "data" {
+  count   = local.has_domain ? 1 : 0
+  zone_id = local.zone_id
+  name    = local.data_fqdn
+  type    = "A"
+
+  alias {
+    name                   = aws_lb.main.dns_name
+    zone_id                = aws_lb.main.zone_id
+    evaluate_target_health = true
+  }
+}

package/dist/terraform/serverless-aws/ecr.tf

@@ -0,0 +1,63 @@
+resource "aws_ecr_repository" "control" {
+  count                = var.create_ecr_repos ? 1 : 0
+  name                 = "${local.name_prefix}-control"
+  image_tag_mutability = "MUTABLE"
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+
+  encryption_configuration {
+    encryption_type = "AES256"
+  }
+}
+
+resource "aws_ecr_repository" "plane" {
+  count                = var.create_ecr_repos ? 1 : 0
+  name                 = "${local.name_prefix}-plane"
+  image_tag_mutability = "MUTABLE"
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+
+  encryption_configuration {
+    encryption_type = "AES256"
+  }
+}
+
+resource "aws_ecr_lifecycle_policy" "control" {
+  count      = var.create_ecr_repos ? 1 : 0
+  repository = aws_ecr_repository.control[0].name
+
+  policy = jsonencode({
+    rules = [{
+      rulePriority = 1
+      description  = "Keep last 20 images"
+      selection = {
+        tagStatus   = "any"
+        countType   = "imageCountMoreThan"
+        countNumber = 20
+      }
+      action = { type = "expire" }
+    }]
+  })
+}
+
+resource "aws_ecr_lifecycle_policy" "plane" {
+  count      = var.create_ecr_repos ? 1 : 0
+  repository = aws_ecr_repository.plane[0].name
+
+  policy = jsonencode({
+    rules = [{
+      rulePriority = 1
+      description  = "Keep last 20 images"
+      selection = {
+        tagStatus   = "any"
+        countType   = "imageCountMoreThan"
+        countNumber = 20
+      }
+      action = { type = "expire" }
+    }]
+  })
+}