@flui-cloud/cli 0.0.1 → 0.2.0

package/lib/cli/src/commands/env/set-master-protection.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const nest_app_1 = require("../../lib/nest-app");
+const context_banner_1 = require("../../lib/context-banner");
+const cli_control_cluster_service_1 = require("../../services/cli-control-cluster.service");
+const cli_cluster_repository_1 = require("../../lib/repositories/cli-cluster.repository");
+const cli_ssh_service_1 = require("../../services/cli-ssh.service");
+const CP_LABEL = 'node-role.kubernetes.io/control-plane';
+const APPLY_CMD = `kubectl taint nodes -l ${CP_LABEL} ${CP_LABEL}=:NoSchedule --overwrite`;
+const REMOVE_CMD = `kubectl taint nodes -l ${CP_LABEL} ${CP_LABEL}:NoSchedule- 2>/dev/null || true`;
+const TAINT_KEYS_CMD = `kubectl get nodes -l ${CP_LABEL} -o jsonpath='{.items[*].spec.taints[*].key}'`;
+const WORKER_COUNT_CMD = `kubectl get nodes -l '!${CP_LABEL}' --no-headers 2>/dev/null | wc -l`;
+class EnvSetMasterProtection extends core_1.Command {
+    async run() {
+        const { args } = await this.parse(EnvSetMasterProtection);
+        (0, context_banner_1.printContextBanner)();
+        const spinner = (0, ora_1.default)('Resolving control cluster...').start();
+        try {
+            const app = await (0, nest_app_1.getNestApp)();
+            const controlService = app.get(cli_control_cluster_service_1.CliControlClusterService);
+            const clusterRepo = app.get(cli_cluster_repository_1.CliClusterRepository);
+            const ssh = app.get(cli_ssh_service_1.CliSshService);
+            const cluster = await controlService.getControlCluster();
+            if (!cluster) {
+                spinner.fail('No control cluster found');
+                this.exit(1);
+            }
+            const masterIp = cluster.masterIpAddress;
+            if (!masterIp) {
+                spinner.fail('Control cluster has no masterIpAddress stored');
+                this.exit(1);
+            }
+            // Worker count comes from the live cluster, not the local profile (which
+            // can drift out of sync with the backend).
+            const workers = await this.countWorkers(ssh, masterIp);
+            if (args.action === 'show') {
+                await this.showState(spinner, ssh, cluster, masterIp, workers);
+                return;
+            }
+            if (args.action === 'on') {
+                await this.turnOn(spinner, ssh, clusterRepo, cluster, masterIp, workers);
+                return;
+            }
+            await this.turnOff(spinner, ssh, clusterRepo, cluster, masterIp);
+        }
+        catch (error) {
+            spinner.fail('set-master-protection failed');
+            console.log(chalk_1.default.red(`\n❌ ${error instanceof Error ? error.message : String(error)}\n`));
+            this.exit(1);
+        }
+        finally {
+            await (0, nest_app_1.closeNestApp)();
+        }
+    }
+    async countWorkers(ssh, masterIp) {
+        const out = await ssh.sshExec(masterIp, WORKER_COUNT_CMD);
+        return Number.parseInt(out.trim(), 10) || 0;
+    }
+    async masterTainted(ssh, masterIp) {
+        const out = await ssh.sshExec(masterIp, TAINT_KEYS_CMD);
+        return out.includes(CP_LABEL);
+    }
+    protectionLabel(workers, tainted) {
+        if (workers === 0)
+            return chalk_1.default.dim('n/a (single-node)');
+        return tainted ? chalk_1.default.green('on (master tainted)') : chalk_1.default.yellow('off');
+    }
+    async showState(spinner, ssh, cluster, masterIp, workers) {
+        const tainted = await this.masterTainted(ssh, masterIp);
+        spinner.stop();
+        const flag = cluster.metadata?.masterProtection;
+        console.log(chalk_1.default.cyan('\n  Master protection\n'));
+        console.log(`  State:        ${this.protectionLabel(workers, tainted)}`);
+        console.log(`  Stored flag:  ${flag === undefined ? chalk_1.default.dim('unset') : String(flag)}`);
+        console.log(`  Workers:      ${workers}\n`);
+    }
+    async turnOn(spinner, ssh, clusterRepo, cluster, masterIp, workers) {
+        if (workers === 0) {
+            spinner.fail('Cannot protect the master on a single-node cluster — it would block all scheduling. Add a worker first.');
+            this.exit(1);
+        }
+        spinner.text = 'Tainting master via SSH...';
+        await ssh.sshExec(masterIp, APPLY_CMD);
+        await this.persist(clusterRepo, cluster, true);
+        spinner.succeed('Master protection enabled');
+        console.log(chalk_1.default.dim('\n  New pods will schedule on workers. Existing pods on the master are not evicted.\n'));
+    }
+    async turnOff(spinner, ssh, clusterRepo, cluster, masterIp) {
+        spinner.text = 'Removing master taint via SSH...';
+        await ssh.sshExec(masterIp, REMOVE_CMD);
+        await this.persist(clusterRepo, cluster, false);
+        spinner.succeed('Master protection disabled');
+        console.log(chalk_1.default.dim('\n  The master is schedulable again for new pods.\n'));
+    }
+    async persist(clusterRepo, cluster, enabled) {
+        cluster.metadata = { ...cluster.metadata, masterProtection: enabled };
+        await clusterRepo.save(cluster);
+    }
+}
+EnvSetMasterProtection.description = 'Taint the control-cluster master so new pods schedule on workers (on), ' +
+    'remove it (off), or report current state (show).';
+EnvSetMasterProtection.examples = [
+    '<%= config.bin %> <%= command.id %> on',
+    '<%= config.bin %> <%= command.id %> off',
+    '<%= config.bin %> <%= command.id %> show',
+];
+EnvSetMasterProtection.args = {
+    action: core_1.Args.string({
+        description: 'on | off | show',
+        required: true,
+        options: ['on', 'off', 'show'],
+    }),
+};
+exports.default = EnvSetMasterProtection;

package/lib/cli/src/commands/env/status.d.ts

@@ -1,6 +1,6 @@
 import { Command } from '@oclif/core';
 export default class EnvStatus extends Command {
-    static readonly description = "Check observability cluster status";
+    static readonly description = "Check control cluster status";
     static readonly examples: string[];
     run(): Promise<void>;
     private renderObservabilityHealth;

package/lib/cli/src/commands/env/status.js

@@ -7,7 +7,7 @@ const core_1 = require("@oclif/core");
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const nest_app_1 = require("../../lib/nest-app");
-const cli_observability_cluster_service_1 = require("../../services/cli-observability-cluster.service");
+const cli_control_cluster_service_1 = require("../../services/cli-control-cluster.service");
 const cli_endpoint_resolver_service_1 = require("../../services/cli-endpoint-resolver.service");
 const cluster_entity_1 = require("../../../../src/modules/infrastructure/clusters/entities/cluster.entity");
 const context_banner_1 = require("../../lib/context-banner");
@@ -19,12 +19,12 @@ class EnvStatus extends core_1.Command {
         let spinner = (0, ora_1.default)('Checking cluster status...').start();
         try {
             const app = await (0, nest_app_1.getNestApp)();
-            const observabilityService = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
+            const controlService = app.get(cli_control_cluster_service_1.CliControlClusterService);
             const resolver = app.get(cli_endpoint_resolver_service_1.CliEndpointResolverService);
-            const cluster = await observabilityService.getObservabilityCluster();
+            const cluster = await controlService.getControlCluster();
             if (!cluster) {
-                spinner.fail('No observability cluster found');
-                console.log(chalk_1.default.yellow('\n⚠️  No observability cluster exists.\n'));
+                spinner.fail('No control cluster found');
+                console.log(chalk_1.default.yellow('\n⚠️  No control cluster exists.\n'));
                 console.log(chalk_1.default.dim('Create one with:'));
                 console.log(`   ${chalk_1.default.cyan('flui env create')}\n`);
                 return;
@@ -37,7 +37,7 @@ class EnvStatus extends core_1.Command {
                     storage.saveApiUrl(derived);
                 }
             }
-            console.log(chalk_1.default.cyan('\n📋 Observability Cluster Status\n'));
+            console.log(chalk_1.default.cyan('\n📋 Control Cluster Status\n'));
             console.log(`   ${chalk_1.default.bold('Name:')}       ${cluster.name}`);
             console.log(`   ${chalk_1.default.bold('ID:')}         ${cluster.id}`);
             console.log(`   ${chalk_1.default.bold('Status:')}     ${this.formatStatus(cluster.status)}`);
@@ -58,7 +58,7 @@ class EnvStatus extends core_1.Command {
                 }
             }
             if (cluster.status === cluster_entity_1.ClusterStatus.READY && cluster.masterIpAddress) {
-                spinner = await this.renderObservabilityHealth(observabilityService, cluster.masterIpAddress, cluster.nipHostnameToken, spinner);
+                spinner = await this.renderObservabilityHealth(controlService, cluster.masterIpAddress, cluster.nipHostnameToken, spinner);
             }
             else if (cluster.status === cluster_entity_1.ClusterStatus.STOPPED) {
                 console.log(chalk_1.default.cyan('\n💤 Cluster Status:\n'));
@@ -88,11 +88,11 @@ class EnvStatus extends core_1.Command {
             await (0, nest_app_1.closeNestApp)();
         }
     }
-    async renderObservabilityHealth(observabilityService, masterIp, nipHostnameToken, initialSpinner) {
+    async renderObservabilityHealth(controlService, masterIp, nipHostnameToken, initialSpinner) {
         initialSpinner.stop();
         const spinner = (0, ora_1.default)('Checking observability services...').start();
         try {
-            const servicesHealth = await observabilityService.checkObservabilityServices(masterIp, nipHostnameToken);
+            const servicesHealth = await controlService.checkObservabilityServices(masterIp, nipHostnameToken);
             spinner.succeed('Services health checked');
             console.log(chalk_1.default.cyan('\n📊 Observability Services Status:\n'));
             const note = chalk_1.default.dim('(deployment ready)');
@@ -177,6 +177,6 @@ class EnvStatus extends core_1.Command {
         }
     }
 }
-EnvStatus.description = 'Check observability cluster status';
+EnvStatus.description = 'Check control cluster status';
 EnvStatus.examples = ['<%= config.bin %> <%= command.id %>'];
 exports.default = EnvStatus;

package/lib/cli/src/commands/env/stop.d.ts

@@ -1,6 +1,6 @@
 import { Command } from '@oclif/core';
 export default class EnvStop extends Command {
-    static readonly description = "Shutdown observability cluster servers (saves costs while preserving data)";
+    static readonly description = "Shutdown control cluster servers (saves costs while preserving data)";
     static readonly examples: string[];
     run(): Promise<void>;
 }

package/lib/cli/src/commands/env/stop.js

@@ -7,7 +7,7 @@ const core_1 = require("@oclif/core");
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const nest_app_1 = require("../../lib/nest-app");
-const cli_observability_cluster_service_1 = require("../../services/cli-observability-cluster.service");
+const cli_control_cluster_service_1 = require("../../services/cli-control-cluster.service");
 const hetzner_provider_service_1 = require("../../../../src/modules/providers/services/hetzner-provider.service");
 const cluster_entity_1 = require("../../../../src/modules/infrastructure/clusters/entities/cluster.entity");
 const cli_cluster_repository_1 = require("../../lib/repositories/cli-cluster.repository");
@@ -20,14 +20,14 @@ class EnvStop extends core_1.Command {
             // Bootstrap NestJS and get services
             const app = await (0, nest_app_1.getNestApp)();
             spinner.succeed('Initialized');
-            console.log(chalk_1.default.cyan('\n💤 Stopping Observability Cluster\n'));
+            console.log(chalk_1.default.cyan('\n💤 Stopping Control Cluster\n'));
             spinner = (0, ora_1.default)('Finding cluster...').start();
-            const observabilityService = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
-            // Get observability cluster
-            const cluster = await observabilityService.getObservabilityCluster();
+            const controlService = app.get(cli_control_cluster_service_1.CliControlClusterService);
+            // Get control cluster
+            const cluster = await controlService.getControlCluster();
             if (!cluster) {
-                spinner.fail('No observability cluster found');
-                console.log(chalk_1.default.yellow('\n⚠️  No observability cluster exists.\n'));
+                spinner.fail('No control cluster found');
+                console.log(chalk_1.default.yellow('\n⚠️  No control cluster exists.\n'));
                 console.log(`Create one with: ${chalk_1.default.cyan('flui env create')}\n`);
                 return;
             }
@@ -142,6 +142,6 @@ class EnvStop extends core_1.Command {
         }
     }
 }
-EnvStop.description = 'Shutdown observability cluster servers (saves costs while preserving data)';
+EnvStop.description = 'Shutdown control cluster servers (saves costs while preserving data)';
 EnvStop.examples = ['<%= config.bin %> <%= command.id %>'];
 exports.default = EnvStop;

package/lib/cli/src/commands/env/storage-expand.js

@@ -8,7 +8,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const nest_app_1 = require("../../lib/nest-app");
 const context_banner_1 = require("../../lib/context-banner");
-const cli_observability_cluster_service_1 = require("../../services/cli-observability-cluster.service");
+const cli_control_cluster_service_1 = require("../../services/cli-control-cluster.service");
 const cluster_node_scaling_service_1 = require("../../../../src/modules/infrastructure/clusters/services/cluster-node-scaling.service");
 const cluster_storage_service_1 = require("../../../../src/modules/infrastructure/clusters/services/cluster-storage.service");
 const cluster_capacity_service_1 = require("../../../../src/modules/infrastructure/clusters/services/cluster-capacity.service");
@@ -20,13 +20,13 @@ class EnvStorageExpand extends core_1.Command {
         const spinner = (0, ora_1.default)('Inspecting current storage...').start();
         try {
             const app = await (0, nest_app_1.getNestApp)();
-            const observabilityService = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
+            const controlService = app.get(cli_control_cluster_service_1.CliControlClusterService);
             const storageService = app.get(cluster_storage_service_1.ClusterStorageService);
             const capacityService = app.get(cluster_capacity_service_1.ClusterCapacityService);
             const scalingService = app.get(cluster_node_scaling_service_1.ClusterNodeScalingService);
-            const cluster = await observabilityService.getObservabilityCluster();
+            const cluster = await controlService.getControlCluster();
             if (!cluster) {
-                spinner.fail('No observability cluster found');
+                spinner.fail('No control cluster found');
                 return;
             }
             const storage = await storageService.getStatus(cluster.id);

package/lib/cli/src/commands/env/storage.d.ts

@@ -1,6 +1,6 @@
 import { Command } from '@oclif/core';
 export default class EnvStorage extends Command {
-    static readonly description = "Show shared storage status (Volume + NFS export + PVC summary) for the current observability cluster";
+    static readonly description = "Show shared storage status (Volume + NFS export + PVC summary) for the current control cluster";
     static readonly examples: string[];
     run(): Promise<void>;
     private render;

package/lib/cli/src/commands/env/storage.js

@@ -7,7 +7,7 @@ const core_1 = require("@oclif/core");
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const nest_app_1 = require("../../lib/nest-app");
-const cli_observability_cluster_service_1 = require("../../services/cli-observability-cluster.service");
+const cli_control_cluster_service_1 = require("../../services/cli-control-cluster.service");
 const cluster_storage_service_1 = require("../../../../src/modules/infrastructure/clusters/services/cluster-storage.service");
 const cluster_storage_dto_1 = require("../../../../src/modules/infrastructure/clusters/dto/cluster-storage.dto");
 const context_banner_1 = require("../../lib/context-banner");
@@ -17,11 +17,11 @@ class EnvStorage extends core_1.Command {
         const spinner = (0, ora_1.default)('Inspecting shared storage...').start();
         try {
             const app = await (0, nest_app_1.getNestApp)();
-            const observabilityService = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
+            const controlService = app.get(cli_control_cluster_service_1.CliControlClusterService);
             const storageService = app.get(cluster_storage_service_1.ClusterStorageService);
-            const cluster = await observabilityService.getObservabilityCluster();
+            const cluster = await controlService.getControlCluster();
             if (!cluster) {
-                spinner.fail('No observability cluster found');
+                spinner.fail('No control cluster found');
                 console.log(chalk_1.default.yellow('\n⚠️  Create a cluster first: ' + chalk_1.default.cyan('flui env create\n')));
                 return;
             }
@@ -87,6 +87,6 @@ class EnvStorage extends core_1.Command {
         return (map[status] ?? chalk_1.default.white)(status);
     }
 }
-EnvStorage.description = 'Show shared storage status (Volume + NFS export + PVC summary) for the current observability cluster';
+EnvStorage.description = 'Show shared storage status (Volume + NFS export + PVC summary) for the current control cluster';
 EnvStorage.examples = ['<%= config.bin %> <%= command.id %>'];
 exports.default = EnvStorage;

package/lib/cli/src/commands/env/sync.js

@@ -42,7 +42,7 @@ const ora_1 = __importDefault(require("ora"));
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const nest_app_1 = require("../../lib/nest-app");
-const cli_observability_cluster_service_1 = require("../../services/cli-observability-cluster.service");
+const cli_control_cluster_service_1 = require("../../services/cli-control-cluster.service");
 const cli_endpoint_resolver_service_1 = require("../../services/cli-endpoint-resolver.service");
 const cli_ssh_service_1 = require("../../services/cli-ssh.service");
 const config_storage_1 = require("../../lib/config-storage");
@@ -56,13 +56,13 @@ class EnvSync extends core_1.Command {
         const spinner = (0, ora_1.default)('Connecting to cluster master via SSH...').start();
         try {
             const app = await (0, nest_app_1.getNestApp)();
-            const observabilityService = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
+            const controlService = app.get(cli_control_cluster_service_1.CliControlClusterService);
             const resolver = app.get(cli_endpoint_resolver_service_1.CliEndpointResolverService);
             const sshService = app.get(cli_ssh_service_1.CliSshService);
-            const cluster = await observabilityService.getObservabilityCluster();
+            const cluster = await controlService.getControlCluster();
             if (!cluster) {
-                spinner.fail('No observability cluster found');
-                console.log(chalk_1.default.yellow('\n⚠️  No observability cluster exists.\n'));
+                spinner.fail('No control cluster found');
+                console.log(chalk_1.default.yellow('\n⚠️  No control cluster exists.\n'));
                 console.log(chalk_1.default.dim('Create one with:'));
                 console.log(`   ${chalk_1.default.cyan('flui env create')}\n`);
                 return;

package/lib/cli/src/commands/env/uncordon.js

@@ -8,7 +8,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const nest_app_1 = require("../../lib/nest-app");
 const context_banner_1 = require("../../lib/context-banner");
-const cli_observability_cluster_service_1 = require("../../services/cli-observability-cluster.service");
+const cli_control_cluster_service_1 = require("../../services/cli-control-cluster.service");
 const cli_node_repository_1 = require("../../lib/repositories/cli-node.repository");
 const cluster_node_entity_1 = require("../../../../src/modules/infrastructure/clusters/entities/cluster-node.entity");
 const cli_ssh_service_1 = require("../../services/cli-ssh.service");
@@ -19,12 +19,12 @@ class EnvUncordon extends core_1.Command {
         const spinner = (0, ora_1.default)('Resolving node...').start();
         try {
             const app = await (0, nest_app_1.getNestApp)();
-            const observabilityService = app.get(cli_observability_cluster_service_1.CliObservabilityClusterService);
+            const controlService = app.get(cli_control_cluster_service_1.CliControlClusterService);
             const nodeRepo = app.get(cli_node_repository_1.CliNodeRepository);
             const ssh = app.get(cli_ssh_service_1.CliSshService);
-            const cluster = await observabilityService.getObservabilityCluster();
+            const cluster = await controlService.getControlCluster();
             if (!cluster) {
-                spinner.fail('No observability cluster found');
+                spinner.fail('No control cluster found');
                 return;
             }
             const nodes = await nodeRepo.find({ where: { clusterId: cluster.id } });

package/lib/cli/src/commands/env/update-firewall.d.ts

@@ -1,9 +1,21 @@
 import { Command } from '@oclif/core';
 export default class EnvUpdateFirewall extends Command {
-    static readonly description = "Create or update firewall IP ranges for observability cluster";
+    static readonly description: string;
     static readonly examples: string[];
     static readonly flags: {
         ip: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        add: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        remove: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        list: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /** Locate the cluster firewall, adopting/disambiguating unlinked ones by master attachment. */
+    private findFirewall;
+    private sshSourceOf;
+    private showAllowlist;
+    private resolveSourceCidrs;
+    /** Apply add/remove/replace to the SSH allowlist. Returns null when nothing was written. */
+    private updateAllowlist;
+    private createFirewall;
+    private printSummary;
 }