@build-astron-co/nimbus 0.2.0 → 0.4.0

package/dist/src/commands/gcp/gke.js

@@ -0,0 +1,357 @@
+/**
+ * GCP GKE CLI Commands
+ *
+ * Operations for Google Kubernetes Engine clusters
+ */
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { logger } from '../../utils';
+import { ui } from '../../wizard/ui';
+import { loadSafetyPolicy, evaluateSafety, } from '../../config/safety-policy';
+import { promptForApproval, displaySafetySummary } from '../../wizard/approval';
+const execFileAsync = promisify(execFile);
+/**
+ * Run GKE safety checks
+ */
+async function runGkeSafetyChecks(action, clusterName, options) {
+    const safetyPolicy = loadSafetyPolicy();
+    const context = {
+        operation: action,
+        type: 'gcp',
+        environment: options.project || 'default',
+        resources: [clusterName],
+        metadata: {
+            resourceType: 'gke-cluster',
+            resourceId: clusterName,
+        },
+    };
+    return evaluateSafety(context, safetyPolicy);
+}
+/**
+ * Main GKE command router
+ */
+export async function gkeCommand(action, args, options) {
+    logger.info('Running GCP GKE command', { action, args, options });
+    switch (action) {
+        case 'clusters':
+        case 'list':
+            await listClusters(options);
+            break;
+        case 'describe':
+            if (!args[0]) {
+                ui.error('Cluster name required');
+                return;
+            }
+            await describeCluster(args[0], options);
+            break;
+        case 'get-credentials':
+            if (!args[0]) {
+                ui.error('Cluster name required');
+                return;
+            }
+            await getCredentials(args[0], options);
+            break;
+        case 'node-pools':
+            if (!args[0]) {
+                ui.error('Cluster name required');
+                return;
+            }
+            await listNodePools(args[0], options);
+            break;
+        case 'resize':
+            if (args.length < 2) {
+                ui.error('Cluster name and node count required');
+                return;
+            }
+            await resizeCluster(args[0], parseInt(args[1], 10), options);
+            break;
+        case 'delete':
+            if (!args[0]) {
+                ui.error('Cluster name required');
+                return;
+            }
+            await deleteCluster(args[0], options);
+            break;
+        default:
+            showGkeHelp();
+            break;
+    }
+}
+/**
+ * List GKE clusters
+ */
+async function listClusters(options) {
+    ui.header('GKE Clusters');
+    ui.newLine();
+    const gcloudArgs = ['container', 'clusters', 'list', '--format=json'];
+    if (options.project) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    if (options.region) {
+        gcloudArgs.push(`--region=${options.region}`);
+    }
+    if (options.zone) {
+        gcloudArgs.push(`--zone=${options.zone}`);
+    }
+    try {
+        ui.startSpinner({ message: 'Fetching clusters...' });
+        const { stdout } = await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess('Clusters fetched');
+        const clusters = JSON.parse(stdout || '[]');
+        if (clusters.length === 0) {
+            ui.info('No clusters found');
+            return;
+        }
+        ui.print(`Found ${clusters.length} cluster(s)\n`);
+        // Display table
+        ui.print(ui.color(`${'Name'.padEnd(25) + 'Location'.padEnd(20) + 'Node Count'.padEnd(12) + 'Status'.padEnd(12)}Version`, 'cyan'));
+        ui.print('─'.repeat(90));
+        for (const cluster of clusters) {
+            const name = cluster.name?.substring(0, 24) || '';
+            const location = cluster.location?.substring(0, 19) || '';
+            const nodeCount = String(cluster.currentNodeCount || 0);
+            const status = cluster.status || '';
+            const version = cluster.currentMasterVersion || '';
+            const statusColor = status === 'RUNNING'
+                ? 'green'
+                : status === 'PROVISIONING'
+                    ? 'yellow'
+                    : status === 'ERROR'
+                        ? 'red'
+                        : 'white';
+            ui.print(`${name.padEnd(25)}${location.padEnd(20)}${nodeCount.padEnd(12)}${ui.color(status.padEnd(12), statusColor)}${version}`);
+        }
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to fetch clusters');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to list clusters', { error: message });
+        ui.error(`Failed to list clusters: ${message}`);
+    }
+}
+/**
+ * Describe a specific cluster
+ */
+async function describeCluster(clusterName, options) {
+    ui.header(`Cluster: ${clusterName}`);
+    ui.newLine();
+    const gcloudArgs = ['container', 'clusters', 'describe', clusterName, '--format=json'];
+    if (options.project) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    if (options.region) {
+        gcloudArgs.push(`--region=${options.region}`);
+    }
+    if (options.zone) {
+        gcloudArgs.push(`--zone=${options.zone}`);
+    }
+    try {
+        ui.startSpinner({ message: 'Fetching cluster details...' });
+        const { stdout } = await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess('Details fetched');
+        const cluster = JSON.parse(stdout);
+        ui.print(ui.bold('Basic Information:'));
+        ui.print(`  Name:            ${cluster.name}`);
+        ui.print(`  Location:        ${cluster.location}`);
+        ui.print(`  Status:          ${cluster.status}`);
+        ui.print(`  Master Version:  ${cluster.currentMasterVersion}`);
+        ui.print(`  Node Count:      ${cluster.currentNodeCount}`);
+        ui.print(`  Endpoint:        ${cluster.endpoint}`);
+        ui.newLine();
+        ui.print(ui.bold('Node Config:'));
+        const nodeConfig = cluster.nodeConfig || {};
+        ui.print(`  Machine Type:    ${nodeConfig.machineType}`);
+        ui.print(`  Disk Size:       ${nodeConfig.diskSizeGb} GB`);
+        ui.print(`  Disk Type:       ${nodeConfig.diskType}`);
+        ui.newLine();
+        ui.print(ui.bold('Networking:'));
+        ui.print(`  Network:         ${cluster.network}`);
+        ui.print(`  Subnetwork:      ${cluster.subnetwork}`);
+        ui.print(`  Cluster CIDR:    ${cluster.clusterIpv4Cidr}`);
+        ui.print(`  Services CIDR:   ${cluster.servicesIpv4Cidr}`);
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to fetch details');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to describe cluster', { error: message });
+        ui.error(`Failed to describe cluster: ${message}`);
+    }
+}
+/**
+ * Get cluster credentials for kubectl
+ */
+async function getCredentials(clusterName, options) {
+    const gcloudArgs = ['container', 'clusters', 'get-credentials', clusterName];
+    if (options.project) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    if (options.region) {
+        gcloudArgs.push(`--region=${options.region}`);
+    }
+    if (options.zone) {
+        gcloudArgs.push(`--zone=${options.zone}`);
+    }
+    try {
+        ui.startSpinner({ message: `Getting credentials for ${clusterName}...` });
+        await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess(`Credentials configured for cluster ${clusterName}`);
+        ui.info('You can now use kubectl to interact with this cluster');
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to get credentials');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to get credentials', { error: message });
+        ui.error(`Failed to get credentials: ${message}`);
+    }
+}
+/**
+ * List node pools in a cluster
+ */
+async function listNodePools(clusterName, options) {
+    ui.header(`Node Pools in ${clusterName}`);
+    ui.newLine();
+    const gcloudArgs = ['container', 'node-pools', 'list', '--cluster', clusterName, '--format=json'];
+    if (options.project) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    if (options.region) {
+        gcloudArgs.push(`--region=${options.region}`);
+    }
+    if (options.zone) {
+        gcloudArgs.push(`--zone=${options.zone}`);
+    }
+    try {
+        ui.startSpinner({ message: 'Fetching node pools...' });
+        const { stdout } = await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess('Node pools fetched');
+        const nodePools = JSON.parse(stdout || '[]');
+        if (nodePools.length === 0) {
+            ui.info('No node pools found');
+            return;
+        }
+        ui.print(`Found ${nodePools.length} node pool(s)\n`);
+        // Display table
+        ui.print(ui.color(`${'Name'.padEnd(25) + 'Machine Type'.padEnd(20) + 'Node Count'.padEnd(12)}Version`, 'cyan'));
+        ui.print('─'.repeat(75));
+        for (const pool of nodePools) {
+            const name = pool.name?.substring(0, 24) || '';
+            const machineType = pool.config?.machineType?.substring(0, 19) || '';
+            const nodeCount = String(pool.initialNodeCount || 0);
+            const version = pool.version || '';
+            ui.print(`${name.padEnd(25)}${machineType.padEnd(20)}${nodeCount.padEnd(12)}${version}`);
+        }
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to fetch node pools');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to list node pools', { error: message });
+        ui.error(`Failed to list node pools: ${message}`);
+    }
+}
+/**
+ * Resize cluster node pool
+ */
+async function resizeCluster(clusterName, nodeCount, options) {
+    // Run safety checks
+    const safetyResult = await runGkeSafetyChecks('resize', clusterName, options);
+    displaySafetySummary({
+        operation: `resize ${clusterName} to ${nodeCount} nodes`,
+        risks: safetyResult.risks,
+        passed: safetyResult.passed,
+    });
+    if (safetyResult.requiresApproval) {
+        const result = await promptForApproval({
+            title: 'Resize GKE Cluster',
+            operation: `gcloud container clusters resize ${clusterName} --num-nodes=${nodeCount}`,
+            risks: safetyResult.risks,
+        });
+        if (!result.approved) {
+            ui.warning('Operation cancelled');
+            return;
+        }
+    }
+    const gcloudArgs = [
+        'container',
+        'clusters',
+        'resize',
+        clusterName,
+        `--num-nodes=${nodeCount}`,
+        '--quiet',
+    ];
+    if (options.project) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    if (options.region) {
+        gcloudArgs.push(`--region=${options.region}`);
+    }
+    if (options.zone) {
+        gcloudArgs.push(`--zone=${options.zone}`);
+    }
+    try {
+        ui.startSpinner({ message: `Resizing cluster ${clusterName} to ${nodeCount} nodes...` });
+        await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess(`Cluster ${clusterName} resized to ${nodeCount} nodes`);
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to resize cluster');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to resize cluster', { error: message });
+        ui.error(`Failed to resize cluster: ${message}`);
+    }
+}
+/**
+ * Delete a cluster (requires safety approval)
+ */
+async function deleteCluster(clusterName, options) {
+    // Run safety checks
+    const safetyResult = await runGkeSafetyChecks('delete', clusterName, options);
+    displaySafetySummary({
+        operation: `delete cluster ${clusterName}`,
+        risks: safetyResult.risks,
+        passed: safetyResult.passed,
+    });
+    if (safetyResult.requiresApproval) {
+        const result = await promptForApproval({
+            title: 'Delete GKE Cluster',
+            operation: `gcloud container clusters delete ${clusterName}`,
+            risks: safetyResult.risks,
+        });
+        if (!result.approved) {
+            ui.warning('Operation cancelled');
+            return;
+        }
+    }
+    const gcloudArgs = ['container', 'clusters', 'delete', clusterName, '--quiet'];
+    if (options.project) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    if (options.region) {
+        gcloudArgs.push(`--region=${options.region}`);
+    }
+    if (options.zone) {
+        gcloudArgs.push(`--zone=${options.zone}`);
+    }
+    try {
+        ui.startSpinner({ message: `Deleting cluster ${clusterName}...` });
+        await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess(`Cluster ${clusterName} deleted`);
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to delete cluster');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to delete cluster', { error: message });
+        ui.error(`Failed to delete cluster: ${message}`);
+    }
+}
+/**
+ * Show GKE help
+ */
+function showGkeHelp() {
+    ui.print(ui.bold('GKE Commands:'));
+    ui.print('  clusters                     List all GKE clusters');
+    ui.print('  describe <name>              Show cluster details');
+    ui.print('  get-credentials <name>       Configure kubectl for cluster');
+    ui.print('  node-pools <cluster>         List node pools in cluster');
+    ui.print('  resize <cluster> <count>     Resize cluster (requires approval)');
+    ui.print('  delete <name>                Delete cluster (requires approval)');
+}

package/dist/src/commands/gcp/iam.js

@@ -0,0 +1,295 @@
+/**
+ * GCP IAM CLI Commands
+ *
+ * Operations for IAM service accounts and roles
+ */
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { logger } from '../../utils';
+import { ui } from '../../wizard/ui';
+const execFileAsync = promisify(execFile);
+/**
+ * Main IAM command router
+ */
+export async function iamCommand(action, args, options) {
+    logger.info('Running GCP IAM command', { action, args, options });
+    switch (action) {
+        case 'service-accounts':
+        case 'sa':
+            await listServiceAccounts(options);
+            break;
+        case 'describe-sa':
+            if (!args[0]) {
+                ui.error('Service account email required');
+                return;
+            }
+            await describeServiceAccount(args[0], options);
+            break;
+        case 'roles':
+            await listRoles(options);
+            break;
+        case 'describe-role':
+            if (!args[0]) {
+                ui.error('Role name required');
+                return;
+            }
+            await describeRole(args[0], options);
+            break;
+        case 'bindings':
+            await listBindings(options);
+            break;
+        default:
+            showIamHelp();
+            break;
+    }
+}
+/**
+ * List service accounts
+ */
+async function listServiceAccounts(options) {
+    ui.header('Service Accounts');
+    ui.newLine();
+    const gcloudArgs = ['iam', 'service-accounts', 'list', '--format=json'];
+    if (options.project) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    try {
+        ui.startSpinner({ message: 'Fetching service accounts...' });
+        const { stdout } = await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess('Service accounts fetched');
+        const accounts = JSON.parse(stdout || '[]');
+        if (accounts.length === 0) {
+            ui.info('No service accounts found');
+            return;
+        }
+        ui.print(`Found ${accounts.length} service account(s)\n`);
+        // Display table
+        ui.print(ui.color(`${'Display Name'.padEnd(30) + 'Email'.padEnd(50)}Disabled`, 'cyan'));
+        ui.print('─'.repeat(90));
+        for (const account of accounts) {
+            const displayName = account.displayName?.substring(0, 29) || '(no name)';
+            const email = account.email?.substring(0, 49) || '';
+            const disabled = account.disabled ? 'Yes' : 'No';
+            ui.print(`${displayName.padEnd(30)}${email.padEnd(50)}${disabled}`);
+        }
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to fetch service accounts');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to list service accounts', { error: message });
+        ui.error(`Failed to list service accounts: ${message}`);
+    }
+}
+/**
+ * Describe a specific service account
+ */
+async function describeServiceAccount(email, options) {
+    ui.header(`Service Account: ${email}`);
+    ui.newLine();
+    const gcloudArgs = ['iam', 'service-accounts', 'describe', email, '--format=json'];
+    if (options.project) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    try {
+        ui.startSpinner({ message: 'Fetching service account details...' });
+        const { stdout } = await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess('Details fetched');
+        const account = JSON.parse(stdout);
+        ui.print(ui.bold('Basic Information:'));
+        ui.print(`  Display Name:   ${account.displayName || '(none)'}`);
+        ui.print(`  Email:          ${account.email}`);
+        ui.print(`  Unique ID:      ${account.uniqueId}`);
+        ui.print(`  Disabled:       ${account.disabled ? 'Yes' : 'No'}`);
+        ui.print(`  Description:    ${account.description || '(none)'}`);
+        ui.newLine();
+        // Get keys
+        try {
+            const keysArgs = [
+                'iam',
+                'service-accounts',
+                'keys',
+                'list',
+                '--iam-account',
+                email,
+                '--format=json',
+            ];
+            if (options.project) {
+                keysArgs.push(`--project=${options.project}`);
+            }
+            const { stdout: keysOutput } = await execFileAsync('gcloud', keysArgs);
+            const keys = JSON.parse(keysOutput || '[]');
+            ui.print(ui.bold('Keys:'));
+            if (keys.length === 0) {
+                ui.print('  No keys found');
+            }
+            else {
+                for (const key of keys) {
+                    const keyId = key.name?.split('/').pop() || '';
+                    const keyType = key.keyType || '';
+                    const validAfter = key.validAfterTime || '';
+                    const validBefore = key.validBeforeTime || '';
+                    ui.print(`  Key ID:         ${keyId}`);
+                    ui.print(`    Type:         ${keyType}`);
+                    ui.print(`    Valid After:  ${validAfter}`);
+                    ui.print(`    Valid Before: ${validBefore}`);
+                    ui.newLine();
+                }
+            }
+        }
+        catch {
+            ui.print(ui.bold('Keys:'));
+            ui.print('  Unable to fetch keys');
+        }
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to fetch details');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to describe service account', { error: message });
+        ui.error(`Failed to describe service account: ${message}`);
+    }
+}
+/**
+ * List predefined roles
+ */
+async function listRoles(options) {
+    ui.header('IAM Roles');
+    ui.newLine();
+    // List project-level custom roles
+    const gcloudArgs = ['iam', 'roles', 'list', '--format=json'];
+    if (options.project) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    try {
+        ui.startSpinner({ message: 'Fetching roles...' });
+        const { stdout } = await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess('Roles fetched');
+        const roles = JSON.parse(stdout || '[]');
+        if (roles.length === 0) {
+            ui.info('No custom roles found. Use gcloud iam roles list --filter="stage=GA" to see predefined roles.');
+            return;
+        }
+        ui.print(`Found ${roles.length} custom role(s)\n`);
+        // Display table
+        ui.print(ui.color(`${'Name'.padEnd(40) + 'Title'.padEnd(35)}Stage`, 'cyan'));
+        ui.print('─'.repeat(85));
+        for (const role of roles) {
+            const name = role.name?.split('/').pop()?.substring(0, 39) || '';
+            const title = role.title?.substring(0, 34) || '';
+            const stage = role.stage || '';
+            ui.print(`${name.padEnd(40)}${title.padEnd(35)}${stage}`);
+        }
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to fetch roles');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to list roles', { error: message });
+        ui.error(`Failed to list roles: ${message}`);
+    }
+}
+/**
+ * Describe a specific role
+ */
+async function describeRole(roleName, options) {
+    ui.header(`Role: ${roleName}`);
+    ui.newLine();
+    const gcloudArgs = ['iam', 'roles', 'describe', roleName, '--format=json'];
+    if (options.project && !roleName.startsWith('roles/')) {
+        gcloudArgs.push(`--project=${options.project}`);
+    }
+    try {
+        ui.startSpinner({ message: 'Fetching role details...' });
+        const { stdout } = await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess('Details fetched');
+        const role = JSON.parse(stdout);
+        ui.print(ui.bold('Basic Information:'));
+        ui.print(`  Name:           ${role.name}`);
+        ui.print(`  Title:          ${role.title}`);
+        ui.print(`  Description:    ${role.description || '(none)'}`);
+        ui.print(`  Stage:          ${role.stage}`);
+        ui.print(`  ETag:           ${role.etag}`);
+        ui.newLine();
+        ui.print(ui.bold('Permissions:'));
+        const permissions = role.includedPermissions || [];
+        if (permissions.length === 0) {
+            ui.print('  No permissions');
+        }
+        else {
+            ui.print(`  Total: ${permissions.length} permission(s)`);
+            // Show first 20 permissions
+            const displayPerms = permissions.slice(0, 20);
+            for (const perm of displayPerms) {
+                ui.print(`    ${perm}`);
+            }
+            if (permissions.length > 20) {
+                ui.print(ui.dim(`    ... and ${permissions.length - 20} more`));
+            }
+        }
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to fetch details');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to describe role', { error: message });
+        ui.error(`Failed to describe role: ${message}`);
+    }
+}
+/**
+ * List IAM bindings for the project
+ */
+async function listBindings(options) {
+    ui.header('IAM Policy Bindings');
+    ui.newLine();
+    let projectId = options.project || '';
+    if (!projectId) {
+        // Get current project
+        try {
+            const { stdout: projectOut } = await execFileAsync('gcloud', [
+                'config',
+                'get-value',
+                'project',
+            ]);
+            projectId = projectOut.trim();
+        }
+        catch {
+            ui.error('Project not specified and no default project configured');
+            return;
+        }
+    }
+    const gcloudArgs = ['projects', 'get-iam-policy', projectId, '--format=json'];
+    try {
+        ui.startSpinner({ message: 'Fetching IAM policy...' });
+        const { stdout } = await execFileAsync('gcloud', gcloudArgs);
+        ui.stopSpinnerSuccess('Policy fetched');
+        const policy = JSON.parse(stdout);
+        const bindings = policy.bindings || [];
+        if (bindings.length === 0) {
+            ui.info('No IAM bindings found');
+            return;
+        }
+        ui.print(`Found ${bindings.length} binding(s)\n`);
+        for (const binding of bindings) {
+            ui.print(ui.bold(`Role: ${binding.role}`));
+            ui.print('  Members:');
+            for (const member of binding.members || []) {
+                ui.print(`    - ${member}`);
+            }
+            ui.newLine();
+        }
+    }
+    catch (error) {
+        ui.stopSpinnerFail('Failed to fetch policy');
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        logger.error('Failed to get IAM policy', { error: message });
+        ui.error(`Failed to get IAM policy: ${message}`);
+    }
+}
+/**
+ * Show IAM help
+ */
+function showIamHelp() {
+    ui.print(ui.bold('IAM Commands:'));
+    ui.print('  service-accounts           List all service accounts');
+    ui.print('  describe-sa <email>        Show service account details');
+    ui.print('  roles                      List custom roles');
+    ui.print('  describe-role <name>       Show role details');
+    ui.print('  bindings                   Show project IAM policy bindings');
+}