@ariestools/cli 0.1.16 → 0.1.18

package/dist/node/datalake.mjs

@@ -368,10 +368,12 @@ function clearDefaultDatalake() {
 	const filePath = getDefaultDatalakePath();
 	if (existsSync(filePath)) unlinkSync(filePath);
 }
-function extractOrigin(urlWithPossiblePath) {
+function extractRequestBase(urlWithPossiblePath) {
 	try {
 		const parsed = new URL(urlWithPossiblePath);
-		return `${parsed.protocol}//${parsed.host}`;
+		const markerIndex = parsed.pathname.indexOf(`/v1/datalakes`);
+		const prefix = markerIndex === -1 ? parsed.pathname.replace(/\/$/, "") : parsed.pathname.slice(0, markerIndex);
+		return `${parsed.protocol}//${parsed.host}${prefix}`;
 	} catch {
 		return urlWithPossiblePath.replace(/\/$/, "");
 	}
@@ -380,9 +382,9 @@ var RestPayloadsClient = class {
 	authToken;
 	datalakeId;
 	fetchImpl;
-	origin;
+	requestBase;
 	constructor(options) {
-		this.origin = extractOrigin(options.baseUrl);
+		this.requestBase = extractRequestBase(options.baseUrl);
 		this.datalakeId = options.datalakeId;
 		this.authToken = options.authToken;
 		this.fetchImpl = options.fetchImpl ?? fetch;
@@ -451,7 +453,7 @@ var RestPayloadsClient = class {
 			headers["content-type"] = "application/json";
 			init.body = JSON.stringify(options.body);
 		}
-		const response = await this.fetchImpl(`${this.origin}${path4}`, init);
+		const response = await this.fetchImpl(`${this.requestBase}${path4}`, init);
 		if (response.status === 204) return {
 			data: void 0,
 			headers: response.headers

package/dist/terraform/cluster-aws/cluster.tf

@@ -0,0 +1,61 @@
+resource "aws_security_group" "cluster" {
+  name        = "${local.name_prefix}-cluster"
+  description = "EKS cluster control-plane SG"
+  vpc_id      = aws_vpc.main.id
+
+  egress {
+    description = "All egress"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = { Name = "${local.name_prefix}-cluster-sg" }
+}
+
+resource "aws_eks_cluster" "main" {
+  name     = local.cluster_name
+  version  = var.k8s_version
+  role_arn = aws_iam_role.cluster.arn
+
+  vpc_config {
+    subnet_ids = concat(
+      [for s in aws_subnet.public : s.id],
+      [for s in aws_subnet.private : s.id],
+    )
+    endpoint_public_access  = var.endpoint_public_access
+    endpoint_private_access = true
+    public_access_cidrs     = var.endpoint_public_access_cidrs
+    security_group_ids      = [aws_security_group.cluster.id]
+  }
+
+  # Plug control-plane logs into CloudWatch so the SRE team isn't blind on day 1.
+  enabled_cluster_log_types = [
+    "api",
+    "audit",
+    "authenticator",
+    "controllerManager",
+    "scheduler",
+  ]
+
+  # EKS uses the cluster role + the worker node groups' instance profiles
+  # for default permissions. Additional access entries (e.g. promoting the
+  # human running `aries cluster aws up` to cluster admin) are wired below
+  # via aws_eks_access_entry / access_policy_association.
+
+  access_config {
+    authentication_mode                         = "API"
+    bootstrap_cluster_creator_admin_permissions = true
+  }
+
+  depends_on = [
+    aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy,
+    aws_iam_role_policy_attachment.cluster_AmazonEKSVPCResourceController,
+  ]
+}
+
+resource "aws_cloudwatch_log_group" "cluster" {
+  name              = "/aws/eks/${local.cluster_name}/cluster"
+  retention_in_days = 30
+}

package/dist/terraform/cluster-aws/encryption.tofu.example

@@ -0,0 +1,37 @@
+# OpenTofu state encryption — opt-in.
+#
+# Encrypts `terraform.tfstate` and any saved plan files at rest using
+# AES-GCM with a key derived from `var.tfstate_passphrase` via PBKDF2.
+#
+# To enable:
+#   1. cp encryption.tofu.example encryption.tofu     (in the working dir)
+#   2. export TF_VAR_tfstate_passphrase='at-least-16-characters'
+#   3. tofu init -reconfigure
+#
+# Notes:
+#   - This file uses the `.tofu` extension so Terraform does NOT load it.
+#     Only OpenTofu engages encryption. Terraform users skip this block.
+#   - If you lose the passphrase, the state is unrecoverable — keep it in
+#     a password manager / Secrets Manager / etc.
+#   - State encryption matters more here than in compute-aws because the
+#     EKS state file contains the cluster CA bundle and OIDC issuer URL.
+
+terraform {
+  encryption {
+    key_provider "pbkdf2" "default" {
+      passphrase = var.tfstate_passphrase
+    }
+
+    method "aes_gcm" "default" {
+      keys = key_provider.pbkdf2.default
+    }
+
+    state {
+      method = method.aes_gcm.default
+    }
+
+    plan {
+      method = method.aes_gcm.default
+    }
+  }
+}

package/dist/terraform/cluster-aws/iam.tf

@@ -0,0 +1,81 @@
+# --- EKS cluster role -------------------------------------------------------
+
+data "aws_iam_policy_document" "cluster_assume" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["eks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "cluster" {
+  name               = "${local.name_prefix}-cluster"
+  assume_role_policy = data.aws_iam_policy_document.cluster_assume.json
+}
+
+resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSClusterPolicy" {
+  role       = aws_iam_role.cluster.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
+}
+
+resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSVPCResourceController" {
+  role       = aws_iam_role.cluster.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
+}
+
+# --- Managed node group role ------------------------------------------------
+
+data "aws_iam_policy_document" "node_assume" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ec2.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "node" {
+  name               = "${local.name_prefix}-node"
+  assume_role_policy = data.aws_iam_policy_document.node_assume.json
+}
+
+resource "aws_iam_role_policy_attachment" "node_AmazonEKSWorkerNodePolicy" {
+  role       = aws_iam_role.node.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
+}
+
+resource "aws_iam_role_policy_attachment" "node_AmazonEKS_CNI_Policy" {
+  role       = aws_iam_role.node.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
+}
+
+resource "aws_iam_role_policy_attachment" "node_AmazonEC2ContainerRegistryReadOnly" {
+  role       = aws_iam_role.node.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
+}
+
+resource "aws_iam_role_policy_attachment" "node_AmazonSSMManagedInstanceCore" {
+  role       = aws_iam_role.node.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+}
+
+# --- IRSA (IAM Roles for Service Accounts) ----------------------------------
+#
+# EKS exposes an OIDC issuer URL; pairing it with an IAM OIDC provider lets
+# pods assume IAM roles via a service-account annotation. The service plane
+# (service-datalake) uses this to grant the data-plane pod S3 access on the
+# archive-tier bucket without storing AWS credentials anywhere.
+
+data "tls_certificate" "cluster_oidc" {
+  url = aws_eks_cluster.main.identity[0].oidc[0].issuer
+}
+
+resource "aws_iam_openid_connect_provider" "cluster" {
+  url             = aws_eks_cluster.main.identity[0].oidc[0].issuer
+  client_id_list  = ["sts.amazonaws.com"]
+  thumbprint_list = [data.tls_certificate.cluster_oidc.certificates[0].sha1_fingerprint]
+  tags            = { Name = "${local.name_prefix}-oidc" }
+}

package/dist/terraform/cluster-aws/irsa_ebs_csi.tf

@@ -0,0 +1,37 @@
+# IRSA role for the EBS CSI driver. The addon needs to attach EBS volumes
+# to nodes (CreateVolume, AttachVolume, etc.) — those permissions belong
+# to a per-cluster role tied to the cluster's OIDC issuer.
+#
+# Created here (not in service-datalake) because EBS CSI is cluster-level
+# infra: PVCs of any kind require it. `aries cluster addons install`
+# passes the role ARN below into `aws eks create-addon`.
+
+data "aws_iam_policy_document" "ebs_csi_assume" {
+  statement {
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+    principals {
+      type        = "Federated"
+      identifiers = [aws_iam_openid_connect_provider.cluster.arn]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "${replace(aws_iam_openid_connect_provider.cluster.url, "https://", "")}:sub"
+      values   = ["system:serviceaccount:kube-system:ebs-csi-controller-sa"]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "${replace(aws_iam_openid_connect_provider.cluster.url, "https://", "")}:aud"
+      values   = ["sts.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "ebs_csi" {
+  name               = "${local.name_prefix}-ebs-csi"
+  assume_role_policy = data.aws_iam_policy_document.ebs_csi_assume.json
+}
+
+resource "aws_iam_role_policy_attachment" "ebs_csi" {
+  role       = aws_iam_role.ebs_csi.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
+}

package/dist/terraform/cluster-aws/kubeconfig.tf

@@ -0,0 +1,49 @@
+# Render a standard EKS kubeconfig into the working dir. The `exec` block
+# delegates auth to the user's local `aws` CLI (`aws eks get-token`), so
+# the kubeconfig itself carries no long-lived secrets — perfect for
+# checking in to ~/.aries/cluster/<name>/ alongside cluster.yaml.
+
+locals {
+  kubeconfig_yaml = yamlencode({
+    apiVersion      = "v1"
+    kind            = "Config"
+    current-context = "aries-${local.cluster_name}"
+    clusters = [{
+      name = aws_eks_cluster.main.arn
+      cluster = {
+        server                       = aws_eks_cluster.main.endpoint
+        "certificate-authority-data" = aws_eks_cluster.main.certificate_authority[0].data
+      }
+    }]
+    contexts = [{
+      name = "aries-${local.cluster_name}"
+      context = {
+        cluster = aws_eks_cluster.main.arn
+        user    = aws_eks_cluster.main.arn
+      }
+    }]
+    users = [{
+      name = aws_eks_cluster.main.arn
+      user = {
+        exec = {
+          apiVersion = "client.authentication.k8s.io/v1beta1"
+          command    = "aws"
+          args = [
+            "--region", var.region,
+            "--profile", var.aws_profile,
+            "eks", "get-token",
+            "--cluster-name", local.cluster_name,
+            "--output", "json",
+          ]
+        }
+      }
+    }]
+  })
+}
+
+resource "local_sensitive_file" "kubeconfig" {
+  filename             = "${path.cwd}/kubeconfig"
+  content              = local.kubeconfig_yaml
+  file_permission      = "0600"
+  directory_permission = "0700"
+}

package/dist/terraform/cluster-aws/network.tf

@@ -0,0 +1,108 @@
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+locals {
+  azs = slice(data.aws_availability_zones.available.names, 0, var.availability_zone_count)
+
+  public_subnet_cidrs  = [for i, _ in local.azs : cidrsubnet(var.vpc_cidr, 8, i)]
+  private_subnet_cidrs = [for i, _ in local.azs : cidrsubnet(var.vpc_cidr, 8, i + 16)]
+}
+
+resource "aws_vpc" "main" {
+  cidr_block           = var.vpc_cidr
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = { Name = "${local.name_prefix}-vpc" }
+}
+
+resource "aws_internet_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+  tags   = { Name = "${local.name_prefix}-igw" }
+}
+
+# Public subnets host the NAT gateway and external LBs (when the service
+# plane installs ingress controllers later). EKS requires the
+# `kubernetes.io/role/elb` tag for AWS Load Balancer Controller to pick
+# the subnet for public ALBs/NLBs.
+resource "aws_subnet" "public" {
+  for_each = { for i, az in local.azs : az => i }
+
+  vpc_id                  = aws_vpc.main.id
+  availability_zone       = each.key
+  cidr_block              = local.public_subnet_cidrs[each.value]
+  map_public_ip_on_launch = true
+
+  tags = {
+    Name                                          = "${local.name_prefix}-public-${each.key}"
+    Tier                                          = "public"
+    "kubernetes.io/role/elb"                      = "1"
+    "kubernetes.io/cluster/${local.cluster_name}" = "shared"
+  }
+}
+
+# Private subnets host the EKS managed node group + internal LBs. The
+# `kubernetes.io/role/internal-elb` tag lets the LB controller place
+# internal NLBs/ALBs here.
+resource "aws_subnet" "private" {
+  for_each = { for i, az in local.azs : az => i }
+
+  vpc_id            = aws_vpc.main.id
+  availability_zone = each.key
+  cidr_block        = local.private_subnet_cidrs[each.value]
+
+  tags = {
+    Name                                          = "${local.name_prefix}-private-${each.key}"
+    Tier                                          = "private"
+    "kubernetes.io/role/internal-elb"             = "1"
+    "kubernetes.io/cluster/${local.cluster_name}" = "shared"
+  }
+}
+
+resource "aws_eip" "nat" {
+  domain = "vpc"
+  tags   = { Name = "${local.name_prefix}-nat" }
+}
+
+resource "aws_nat_gateway" "main" {
+  allocation_id = aws_eip.nat.id
+  subnet_id     = aws_subnet.public[local.azs[0]].id
+
+  tags       = { Name = "${local.name_prefix}-nat" }
+  depends_on = [aws_internet_gateway.main]
+}
+
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.main.id
+  }
+
+  tags = { Name = "${local.name_prefix}-public-rt" }
+}
+
+resource "aws_route_table" "private" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block     = "0.0.0.0/0"
+    nat_gateway_id = aws_nat_gateway.main.id
+  }
+
+  tags = { Name = "${local.name_prefix}-private-rt" }
+}
+
+resource "aws_route_table_association" "public" {
+  for_each       = aws_subnet.public
+  subnet_id      = each.value.id
+  route_table_id = aws_route_table.public.id
+}
+
+resource "aws_route_table_association" "private" {
+  for_each       = aws_subnet.private
+  subnet_id      = each.value.id
+  route_table_id = aws_route_table.private.id
+}

package/dist/terraform/cluster-aws/nodegroup.tf

@@ -0,0 +1,42 @@
+resource "aws_eks_node_group" "default" {
+  cluster_name    = aws_eks_cluster.main.name
+  node_group_name = "${local.cluster_name}-default"
+  node_role_arn   = aws_iam_role.node.arn
+  subnet_ids      = [for s in aws_subnet.private : s.id]
+
+  instance_types = var.node_instance_types
+  capacity_type  = var.node_capacity_type
+  disk_size      = var.node_disk_size_gb
+
+  scaling_config {
+    desired_size = var.node_desired_size
+    min_size     = var.node_min_size
+    max_size     = var.node_max_size
+  }
+
+  update_config {
+    max_unavailable_percentage = 33
+  }
+
+  # Default labels make it easy for Helm charts / NetworkPolicies to pin
+  # workloads to the shared pool. Phase 2b adds an `aries-tier=large`
+  # taint + dedicated node group for large-tier datalakes.
+  labels = {
+    "aries.xylabs.com/pool" = "shared"
+  }
+
+  tags = {
+    Name = "${local.cluster_name}-default"
+  }
+
+  depends_on = [
+    aws_iam_role_policy_attachment.node_AmazonEKSWorkerNodePolicy,
+    aws_iam_role_policy_attachment.node_AmazonEKS_CNI_Policy,
+    aws_iam_role_policy_attachment.node_AmazonEC2ContainerRegistryReadOnly,
+    aws_iam_role_policy_attachment.node_AmazonSSMManagedInstanceCore,
+  ]
+
+  lifecycle {
+    ignore_changes = [scaling_config[0].desired_size]
+  }
+}

package/dist/terraform/cluster-aws/outputs.tf

@@ -0,0 +1,80 @@
+output "cluster_name" {
+  description = "EKS cluster name."
+  value       = aws_eks_cluster.main.name
+}
+
+output "cluster_arn" {
+  description = "EKS cluster ARN."
+  value       = aws_eks_cluster.main.arn
+}
+
+output "cluster_endpoint" {
+  description = "EKS API server endpoint."
+  value       = aws_eks_cluster.main.endpoint
+}
+
+output "cluster_certificate_authority_data" {
+  description = "Base64-encoded cluster CA cert (for clients that don't use the rendered kubeconfig)."
+  value       = aws_eks_cluster.main.certificate_authority[0].data
+  sensitive   = true
+}
+
+output "oidc_provider_arn" {
+  description = "IAM OIDC provider ARN; bind workload IAM roles to this via IRSA."
+  value       = aws_iam_openid_connect_provider.cluster.arn
+}
+
+output "oidc_provider_url" {
+  description = "OIDC issuer URL (without the leading `https://`) for IRSA trust policies."
+  value       = replace(aws_eks_cluster.main.identity[0].oidc[0].issuer, "https://", "")
+}
+
+output "ebs_csi_role_arn" {
+  description = "IRSA role ARN for the EBS CSI driver addon. Pass to `aws eks create-addon --service-account-role-arn` so PVCs can attach EBS volumes."
+  value       = aws_iam_role.ebs_csi.arn
+}
+
+output "vpc_id" {
+  description = "Dedicated VPC the cluster runs in."
+  value       = aws_vpc.main.id
+}
+
+output "private_subnet_ids" {
+  description = "Subnets the managed node group runs in."
+  value       = [for s in aws_subnet.private : s.id]
+}
+
+output "public_subnet_ids" {
+  description = "Public subnets (host NAT and external LBs)."
+  value       = [for s in aws_subnet.public : s.id]
+}
+
+output "node_security_group_id" {
+  description = "Primary security group EKS attached to worker nodes."
+  value       = aws_eks_cluster.main.vpc_config[0].cluster_security_group_id
+}
+
+output "kubeconfig_path" {
+  description = "Path to the rendered kubeconfig (relative to the working dir)."
+  value       = local_sensitive_file.kubeconfig.filename
+}
+
+output "region" {
+  description = "AWS region the cluster lives in."
+  value       = var.region
+}
+
+# The Tier-3 service plane reads this to construct its `ServiceTarget(kubernetes)`.
+output "service_target" {
+  description = "Tier-2 → Tier-3 hand-off shape. The CLI projects this into ~/.aries/cluster/<name>/cluster.yaml."
+  value = {
+    kind          = "kubernetes"
+    cloud         = "aws"
+    cluster_name  = aws_eks_cluster.main.name
+    region        = var.region
+    namespace     = "aries-datalake"
+    ingress_class = "nginx"
+    storage_class = "gp3"
+    kubeconfig    = local_sensitive_file.kubeconfig.filename
+  }
+}

package/dist/terraform/cluster-aws/providers.tf

@@ -0,0 +1,7 @@
+provider "aws" {
+  region = var.region
+
+  default_tags {
+    tags = local.common_tags
+  }
+}

package/dist/terraform/cluster-aws/terraform.tfvars.example

@@ -0,0 +1,21 @@
+region      = "us-west-2"
+aws_profile = "xylabs-datalake"
+environment = "staging"
+project     = "aries-datalake"
+
+# cluster_name defaults to `${project}-${environment}` when empty.
+# cluster_name = "aries-datalake-staging"
+
+# k8s_version = "1.31"
+
+# vpc_cidr = "10.43.0.0/16"   # must not overlap compute-aws (10.42.0.0/16)
+
+# node_instance_types = ["t3.medium"]
+# node_desired_size   = 2
+# node_min_size       = 1
+# node_max_size       = 4
+# node_capacity_type  = "ON_DEMAND"  # or "SPOT" for ~70% cheaper non-prod
+# node_disk_size_gb   = 50
+
+# endpoint_public_access       = true
+# endpoint_public_access_cidrs = ["203.0.113.4/32"]   # tighten to your office IP for prod

package/dist/terraform/cluster-aws/variables.tf

@@ -0,0 +1,120 @@
+variable "region" {
+  type        = string
+  description = "AWS region to deploy the EKS cluster into."
+  default     = "us-west-2"
+}
+
+variable "aws_profile" {
+  type        = string
+  description = "Local AWS CLI profile the IaC engine should use. Must already be configured via `aws configure` or `aws sso login`."
+  default     = "xylabs-datalake"
+}
+
+variable "environment" {
+  type        = string
+  description = "Environment name (staging, prod, etc.). Goes into resource tags + names."
+  default     = "staging"
+}
+
+variable "project" {
+  type        = string
+  description = "Project name; goes into resource tags."
+  default     = "aries-datalake"
+}
+
+variable "cluster_name" {
+  type        = string
+  description = "EKS cluster name. Defaults to `${var.project}-${var.environment}`."
+  default     = ""
+}
+
+variable "k8s_version" {
+  type        = string
+  description = "Kubernetes version for the EKS control plane."
+  default     = "1.31"
+}
+
+variable "vpc_cidr" {
+  type        = string
+  description = "CIDR block for the dedicated VPC. Must not overlap any existing VPC you intend to peer with — and must not overlap the compute-aws VPC if both stacks live in the same account."
+  default     = "10.43.0.0/16"
+}
+
+variable "availability_zone_count" {
+  type        = number
+  description = "Number of AZs to span (>= 2 required by EKS)."
+  default     = 2
+}
+
+variable "node_instance_types" {
+  type        = list(string)
+  description = "EC2 instance types for the managed node group. The first type is preferred; subsequent types are fallbacks when capacity is scarce."
+  default     = ["t3.medium"]
+}
+
+variable "node_desired_size" {
+  type        = number
+  description = "Desired number of worker nodes."
+  default     = 2
+}
+
+variable "node_min_size" {
+  type        = number
+  description = "Minimum number of worker nodes."
+  default     = 1
+}
+
+variable "node_max_size" {
+  type        = number
+  description = "Maximum number of worker nodes."
+  default     = 4
+}
+
+variable "node_disk_size_gb" {
+  type        = number
+  description = "Root EBS volume size per node."
+  default     = 50
+}
+
+variable "node_capacity_type" {
+  type        = string
+  description = "`ON_DEMAND` or `SPOT`. Spot is dramatically cheaper but EKS will replace nodes on reclamation."
+  default     = "ON_DEMAND"
+}
+
+variable "endpoint_public_access" {
+  type        = bool
+  description = "Whether the EKS API server is reachable from the public internet. Required for `aws eks update-kubeconfig` from a developer laptop. Phase 4 (PrivateLink) flips this to false."
+  default     = true
+}
+
+variable "endpoint_public_access_cidrs" {
+  type        = list(string)
+  description = "CIDRs allowed to reach the public EKS API endpoint. Defaults to anywhere; tighten to your office IP for prod."
+  default     = ["0.0.0.0/0"]
+}
+
+variable "tfstate_passphrase" {
+  type        = string
+  description = "Passphrase for OpenTofu state encryption. See encryption.tofu.example."
+  default     = ""
+  sensitive   = true
+}
+
+variable "scope_tags" {
+  type        = map(string)
+  description = "Tags applied to every resource via the AWS provider's default_tags. Populated by the `aries compute add --infra ...` flow with the infra-uid + managed-by tag set; left empty when the legacy `aries cluster aws ...` commands invoke the module."
+  default     = {}
+}
+
+locals {
+  cluster_name = length(var.cluster_name) > 0 ? var.cluster_name : "${var.project}-${var.environment}"
+  name_prefix  = "${var.project}-${var.environment}-cluster"
+
+  common_tags = merge({
+    Project     = var.project
+    Environment = var.environment
+    Component   = "cluster"
+    ManagedBy   = "opentofu"
+  }, var.scope_tags)
+}