@flui-cloud/cli 0.0.1

package/lib/src/modules/infrastructure/clusters/services/cluster-capacity.service.js

@@ -0,0 +1,198 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ClusterCapacityService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterCapacityService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const cluster_entity_1 = require("../entities/cluster.entity");
+const cluster_node_entity_1 = require("../entities/cluster-node.entity");
+const kubernetes_service_1 = require("../../shared/services/kubernetes.service");
+const encryption_service_1 = require("../../../shared/encryption/services/encryption.service");
+const provider_factory_1 = require("../../../providers/services/provider.factory");
+const cluster_storage_service_1 = require("./cluster-storage.service");
+let ClusterCapacityService = ClusterCapacityService_1 = class ClusterCapacityService {
+    constructor(clusterRepository, nodeRepository, kubernetesService, encryptionService, providerFactory, clusterStorageService) {
+        this.clusterRepository = clusterRepository;
+        this.nodeRepository = nodeRepository;
+        this.kubernetesService = kubernetesService;
+        this.encryptionService = encryptionService;
+        this.providerFactory = providerFactory;
+        this.clusterStorageService = clusterStorageService;
+        this.logger = new common_1.Logger(ClusterCapacityService_1.name);
+    }
+    async getPlan(clusterId) {
+        const cluster = await this.clusterRepository.findOne({
+            where: { id: clusterId },
+        });
+        if (!cluster) {
+            throw new common_1.NotFoundException(`Cluster ${clusterId} not found`);
+        }
+        const masterNode = await this.nodeRepository.findOne({
+            where: { clusterId, nodeType: cluster_node_entity_1.NodeType.MASTER },
+        });
+        const provider = cluster.provider;
+        const providerService = this.providerFactory.getProvider(provider);
+        let currentServerType;
+        if (masterNode?.providerResourceId &&
+            providerService.getServerDetailsAsDto) {
+            try {
+                const details = await providerService.getServerDetailsAsDto(masterNode.providerResourceId);
+                currentServerType = details?.server_type;
+            }
+            catch (err) {
+                this.logger.warn(`Failed to fetch master server details for ${masterNode.providerResourceId}: ${err.message}`);
+            }
+        }
+        let sizes = [];
+        if (providerService.getNodeSizes) {
+            try {
+                sizes = await providerService.getNodeSizes(false);
+            }
+            catch (err) {
+                this.logger.warn(`Provider ${provider} getNodeSizes failed: ${err.message}`);
+            }
+        }
+        const currentSize = currentServerType
+            ? sizes.find((s) => s.name === currentServerType)
+            : undefined;
+        let master;
+        if (cluster.kubeconfigEncrypted) {
+            const kubeconfig = this.encryptionService.decrypt(cluster.kubeconfigEncrypted);
+            const cap = await this.kubernetesService.getMasterNodeCapacity(kubeconfig);
+            if (cap) {
+                master = {
+                    nodeName: cap.nodeName,
+                    serverType: currentServerType ?? 'unknown',
+                    allocatableCpuMillicores: cap.allocatable.cpu,
+                    allocatableMemoryMi: cap.allocatable.memory,
+                    usedCpuMillicores: cap.requested.cpu,
+                    usedMemoryMi: cap.requested.memory,
+                    freeCpuMillicores: cap.allocatable.cpu - cap.requested.cpu,
+                    freeMemoryMi: cap.allocatable.memory - cap.requested.memory,
+                    monthlyCostEur: this.pickFirstMonthlyPrice(currentSize),
+                };
+            }
+        }
+        const candidates = this.buildCandidates(sizes, currentSize);
+        let storage;
+        try {
+            const storageStatus = await this.clusterStorageService.getStatus(clusterId);
+            if (storageStatus.volume) {
+                storage = {
+                    volumeId: storageStatus.volume.volumeId,
+                    sizeGb: storageStatus.volume.sizeGb,
+                    requestedGb: storageStatus.pvcs?.requestedGb,
+                    pricePerGbMonthlyEur: currentSize?.blockStoragePricePerGbMonthly,
+                };
+            }
+        }
+        catch (err) {
+            this.logger.warn(`Storage status unavailable: ${err.message}`);
+        }
+        return {
+            clusterId,
+            provider,
+            master,
+            candidates,
+            storage,
+            message: this.buildMessage({
+                currentServerType,
+                sizesCount: sizes.length,
+            }),
+        };
+    }
+    buildCandidates(sizes, currentSize) {
+        if (!sizes.length)
+            return [];
+        const currentMonthly = this.parseMonthly(currentSize);
+        const candidates = sizes
+            .filter((s) => !s.deprecated)
+            .map((s) => {
+            const monthly = this.parseMonthly(s);
+            let direction;
+            if (s.name === currentSize?.name) {
+                direction = 'current';
+            }
+            else if (s.cores >= (currentSize?.cores ?? 0) &&
+                s.memory >= (currentSize?.memory ?? 0)) {
+                direction = 'upgrade';
+            }
+            else {
+                direction = 'downgrade';
+            }
+            return {
+                name: s.name,
+                direction,
+                cores: s.cores,
+                memoryGb: s.memory,
+                diskGb: s.disk,
+                monthlyCostEur: monthly === null ? 'n/a' : monthly.toFixed(2),
+                monthlyDeltaEur: monthly !== null && currentMonthly !== null
+                    ? (monthly - currentMonthly).toFixed(2)
+                    : 'n/a',
+                cpuType: s.cpuType,
+                deprecated: s.deprecated,
+            };
+        });
+        candidates.sort((a, b) => {
+            const da = Number.parseFloat(a.monthlyDeltaEur);
+            const db = Number.parseFloat(b.monthlyDeltaEur);
+            if (Number.isNaN(da) && Number.isNaN(db))
+                return a.name.localeCompare(b.name);
+            if (Number.isNaN(da))
+                return 1;
+            if (Number.isNaN(db))
+                return -1;
+            return da - db;
+        });
+        return candidates;
+    }
+    pickFirstMonthlyPrice(size) {
+        const price = size?.prices?.[0]?.priceMonthly?.net;
+        if (!price)
+            return undefined;
+        const parsed = Number.parseFloat(price);
+        return Number.isFinite(parsed) ? parsed.toFixed(2) : undefined;
+    }
+    parseMonthly(size) {
+        const raw = size?.prices?.[0]?.priceMonthly?.net;
+        if (!raw)
+            return null;
+        const v = Number.parseFloat(raw);
+        return Number.isFinite(v) ? v : null;
+    }
+    buildMessage(ctx) {
+        if (!ctx.currentServerType) {
+            return 'Could not resolve current master server type from provider — costs are shown as n/a.';
+        }
+        if (ctx.sizesCount === 0) {
+            return 'Provider did not return any node sizes — upgrade/downgrade candidates unavailable.';
+        }
+        return undefined;
+    }
+};
+exports.ClusterCapacityService = ClusterCapacityService;
+exports.ClusterCapacityService = ClusterCapacityService = ClusterCapacityService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(cluster_entity_1.ClusterEntity)),
+    __param(1, (0, typeorm_1.InjectRepository)(cluster_node_entity_1.ClusterNodeEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository,
+        kubernetes_service_1.KubernetesService,
+        encryption_service_1.EncryptionService,
+        provider_factory_1.ProviderFactory,
+        cluster_storage_service_1.ClusterStorageService])
+], ClusterCapacityService);

package/lib/src/modules/infrastructure/clusters/services/cluster-creation.service.d.ts

@@ -0,0 +1,25 @@
+import { Repository } from 'typeorm';
+import { Queue } from 'bull';
+import { ClusterEntity } from '../entities/cluster.entity';
+import { InfrastructureOperationEntity } from '../../servers/entities/infrastructure-operations.entity';
+import { CreateClusterDto } from '../dto/create-cluster.dto';
+import { EncryptionService } from '../../../shared/encryption/services/encryption.service';
+import { ClusterFirewallIntegrationService } from './cluster-firewall-integration.service';
+import { VNetSubnetEntity } from '../../vnets/entities/vnet-subnet.entity';
+/**
+ * Service responsible for cluster creation logic
+ */
+export declare class ClusterCreationService {
+    private readonly clusterRepository;
+    private readonly operationRepository;
+    private readonly vnetSubnetRepository;
+    private readonly infrastructureQueue;
+    private readonly encryptionService;
+    private readonly clusterFirewallIntegrationService;
+    private readonly logger;
+    constructor(clusterRepository: Repository<ClusterEntity>, operationRepository: Repository<InfrastructureOperationEntity>, vnetSubnetRepository: Repository<VNetSubnetEntity>, infrastructureQueue: Queue, encryptionService: EncryptionService, clusterFirewallIntegrationService: ClusterFirewallIntegrationService);
+    /**
+     * Create a new K3s cluster
+     */
+    createCluster(dto: CreateClusterDto): Promise<InfrastructureOperationEntity>;
+}

package/lib/src/modules/infrastructure/clusters/services/cluster-creation.service.js

@@ -0,0 +1,192 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ClusterCreationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterCreationService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const bull_1 = require("@nestjs/bull");
+const cluster_entity_1 = require("../entities/cluster.entity");
+const infrastructure_operations_entity_1 = require("../../servers/entities/infrastructure-operations.entity");
+const encryption_service_1 = require("../../../shared/encryption/services/encryption.service");
+const cluster_firewall_integration_service_1 = require("./cluster-firewall-integration.service");
+const operation_steps_helper_1 = require("../../operations/helpers/operation-steps.helper");
+const vnet_subnet_entity_1 = require("../../vnets/entities/vnet-subnet.entity");
+const nip_token_util_1 = require("../../../dns/utils/nip-token.util");
+const hostname_mode_enum_1 = require("../../../dns/enums/hostname-mode.enum");
+/**
+ * Service responsible for cluster creation logic
+ */
+let ClusterCreationService = ClusterCreationService_1 = class ClusterCreationService {
+    constructor(clusterRepository, operationRepository, vnetSubnetRepository, infrastructureQueue, encryptionService, clusterFirewallIntegrationService) {
+        this.clusterRepository = clusterRepository;
+        this.operationRepository = operationRepository;
+        this.vnetSubnetRepository = vnetSubnetRepository;
+        this.infrastructureQueue = infrastructureQueue;
+        this.encryptionService = encryptionService;
+        this.clusterFirewallIntegrationService = clusterFirewallIntegrationService;
+        this.logger = new common_1.Logger(ClusterCreationService_1.name);
+    }
+    /**
+     * Create a new K3s cluster
+     */
+    async createCluster(dto) {
+        this.logger.log(`Creating cluster: ${dto.name}`);
+        // Generate and encrypt K3s token
+        const k3sToken = this.encryptionService.generateK3sToken();
+        const k3sTokenEncrypted = this.encryptionService.encrypt(k3sToken);
+        // Determine cluster type from metadata
+        const metadata = dto.metadata || {};
+        const clusterType = metadata.isObservabilityCluster
+            ? cluster_entity_1.ClusterType.OBSERVABILITY
+            : cluster_entity_1.ClusterType.WORKLOAD;
+        // Resolve the environment-level VNet/Subnet (seeded at bootstrap by the CLI).
+        // Every cluster — observability or workload — joins the same private network
+        // so intra-cluster and inter-cluster traffic stays off the public interface.
+        const envSubnet = await this.vnetSubnetRepository.findOne({
+            where: {},
+            order: { createdAt: 'ASC' },
+        });
+        if (!envSubnet) {
+            throw new common_1.BadRequestException('No environment subnet registered. The CLI must provision a VNet/Subnet during `flui env create` before any cluster can be created.');
+        }
+        metadata.vnetConfig = {
+            vnetId: envSubnet.vnetId,
+            subnetId: envSubnet.id,
+            autoAssignIp: true,
+        };
+        this.logger.log(`Cluster ${dto.name} attached to environment subnet ${envSubnet.id} (${envSubnet.ipRange})`);
+        // Resolve nip.io hostname token: when running in IP mode, every cluster gets
+        // a unique token segment so the LE domain set differs between recreations,
+        // avoiding the 5-certs-per-7-days rate limit.
+        const hostnameMode = dto.endpointHostnameMode ?? hostname_mode_enum_1.HostnameMode.IP;
+        let nipHostnameToken = null;
+        if (hostnameMode === hostname_mode_enum_1.HostnameMode.IP) {
+            if (dto.nipHostnameToken) {
+                if (!(0, nip_token_util_1.isValidNipHostnameToken)(dto.nipHostnameToken)) {
+                    throw new common_1.BadRequestException('nipHostnameToken must match [a-z0-9-], 1-30 chars, no leading/trailing dash.');
+                }
+                nipHostnameToken = dto.nipHostnameToken;
+            }
+            else {
+                nipHostnameToken = (0, nip_token_util_1.generateNipHostnameToken)();
+            }
+            this.logger.log(`Cluster ${dto.name} nip.io hostname token: ${nipHostnameToken}`);
+        }
+        // Create cluster record
+        const cluster = this.clusterRepository.create({
+            name: dto.name,
+            provider: dto.provider,
+            region: dto.region,
+            nodeSize: dto.nodeSize,
+            nodeCount: 0, // Will be updated as nodes are created
+            autoscalingEnabled: dto.autoscalingEnabled || false,
+            minNodes: dto.minNodes,
+            maxNodes: dto.maxNodes,
+            scaleUpMemoryPct: dto.scaleUpMemoryPct,
+            scaleUpCpuPct: dto.scaleUpCpuPct,
+            cooldownSeconds: dto.cooldownSeconds,
+            k3sTokenEncrypted,
+            k3sVersion: dto.k3sVersion,
+            status: cluster_entity_1.ClusterStatus.CREATING,
+            clusterType,
+            sshKeyIds: dto.sshKeys,
+            image: dto.image,
+            diskSizeGb: dto.diskSizeGb,
+            endpointHostnameMode: dto.endpointHostnameMode,
+            nipHostnameToken,
+            // Flui shared storage (§14 of scaling doc). Default enabled for all
+            // cluster types unless explicitly disabled via --no-shared-storage.
+            // The architecture works on both OBSERVABILITY and WORKLOAD clusters;
+            // the cluster-type discriminator is only for the future split where
+            // observability gets its own dedicated topology.
+            sharedStorageEnabled: dto.sharedStorageEnabled !== false,
+            sharedStorageVolumeSizeGb: dto.sharedStorageVolumeSizeGb ?? 20,
+            metadata,
+        });
+        const savedCluster = await this.clusterRepository.save(cluster);
+        this.logger.log(`Cluster record created: ${savedCluster.id}`);
+        // Create cluster firewall (BEFORE creating nodes).
+        // Intra-cluster Prometheus scraping no longer requires public firewall rules:
+        // observability ↔ workload metrics traffic flows over the environment VNet.
+        let providerFirewallId = null;
+        try {
+            const desiredRules = dto.firewallRules || [];
+            providerFirewallId =
+                await this.clusterFirewallIntegrationService.createAndReconcileFirewall(savedCluster, desiredRules);
+            this.logger.log(`Firewall created for cluster ${savedCluster.id}: ${providerFirewallId}`);
+        }
+        catch (error) {
+            this.logger.error(`Failed to create firewall for cluster ${savedCluster.id}: ${error.message}`, error.stack);
+            // Firewall creation failure should fail cluster creation
+            await this.clusterRepository.delete(savedCluster.id);
+            throw new common_1.BadRequestException(`Failed to create cluster firewall: ${error.message}`);
+        }
+        // Use worker count directly from DTO
+        const workerCount = dto.workerCount;
+        // Generate dynamic steps based on cluster configuration
+        const withFirewall = !!providerFirewallId;
+        const operationSteps = (0, operation_steps_helper_1.getOperationSteps)(infrastructure_operations_entity_1.OperationType.CREATE_CLUSTER, {
+            workerCount,
+            withFirewall,
+        });
+        // Create operation for tracking
+        const operation = this.operationRepository.create({
+            operationType: infrastructure_operations_entity_1.OperationType.CREATE_CLUSTER,
+            status: infrastructure_operations_entity_1.OperationStatus.PENDING,
+            resourceType: 'cluster',
+            resourceName: dto.name,
+            resourceId: savedCluster.id,
+            provider: dto.provider,
+            totalSteps: operationSteps.length,
+            currentStepIndex: 0,
+            currentStepProgress: 0,
+            metadata: {
+                clusterConfig: dto,
+                estimatedDurationInSeconds: 900,
+                providerFirewallId, // Single firewall ID (not array)
+                operationSteps: operationSteps, // Fixed: was 'steps', now 'operationSteps'
+            },
+        });
+        const savedOperation = await this.operationRepository.save(operation);
+        // Queue cluster creation job
+        const jobData = {
+            operationId: savedOperation.id,
+            clusterId: savedCluster.id,
+        };
+        await this.infrastructureQueue.add('create-cluster', jobData, {
+            attempts: 3,
+            backoff: {
+                type: 'exponential',
+                delay: 2000,
+            },
+            timeout: 1800000, // 30 minutes
+        });
+        this.logger.log(`Cluster creation job queued for cluster ${savedCluster.id} with operation ${savedOperation.id}`);
+        return savedOperation;
+    }
+};
+exports.ClusterCreationService = ClusterCreationService;
+exports.ClusterCreationService = ClusterCreationService = ClusterCreationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(cluster_entity_1.ClusterEntity)),
+    __param(1, (0, typeorm_1.InjectRepository)(infrastructure_operations_entity_1.InfrastructureOperationEntity)),
+    __param(2, (0, typeorm_1.InjectRepository)(vnet_subnet_entity_1.VNetSubnetEntity)),
+    __param(3, (0, bull_1.InjectQueue)('infrastructure')),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository, Object, encryption_service_1.EncryptionService,
+        cluster_firewall_integration_service_1.ClusterFirewallIntegrationService])
+], ClusterCreationService);

package/lib/src/modules/infrastructure/clusters/services/cluster-deletion.service.d.ts

@@ -0,0 +1,36 @@
+import { Repository } from 'typeorm';
+import { Queue } from 'bull';
+import { ClusterEntity } from '../entities/cluster.entity';
+import { InfrastructureOperationEntity } from '../../servers/entities/infrastructure-operations.entity';
+import { ClusterFirewallIntegrationService } from './cluster-firewall-integration.service';
+import { CloudProvider } from '../../../providers/enums/cloud-provider.enum';
+import { GrafanaDatasourceService } from '../../../../modules/grafana/services/grafana-datasource.service';
+import { ClusterDnsCleanupService } from '../../../../modules/dns/services/cluster-dns-cleanup.service';
+/**
+ * Service responsible for cluster deletion logic
+ */
+export declare class ClusterDeletionService {
+    private readonly clusterRepository;
+    private readonly operationRepository;
+    private readonly infrastructureQueue;
+    private readonly clusterFirewallIntegrationService;
+    private readonly grafanaDatasourceService;
+    private readonly clusterDnsCleanupService;
+    private readonly logger;
+    constructor(clusterRepository: Repository<ClusterEntity>, operationRepository: Repository<InfrastructureOperationEntity>, infrastructureQueue: Queue, clusterFirewallIntegrationService: ClusterFirewallIntegrationService, grafanaDatasourceService: GrafanaDatasourceService, clusterDnsCleanupService: ClusterDnsCleanupService);
+    /**
+     * Delete a cluster
+     */
+    deleteCluster(clusterId: string, force?: boolean): Promise<InfrastructureOperationEntity>;
+    /**
+     * Cleanup cluster firewall during deletion
+     * Called from the queue processor after nodes are deleted
+     */
+    cleanupClusterFirewall(clusterId: string, provider: CloudProvider): Promise<void>;
+    cleanupClusterDnsRecords(clusterId: string): Promise<void>;
+    /**
+     * Remove workload cluster datasources from Grafana observability cluster
+     * Called automatically before cluster deletion
+     */
+    private removeClusterFromGrafana;
+}

package/lib/src/modules/infrastructure/clusters/services/cluster-deletion.service.js

@@ -0,0 +1,159 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ClusterDeletionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterDeletionService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const bull_1 = require("@nestjs/bull");
+const cluster_entity_1 = require("../entities/cluster.entity");
+const infrastructure_operations_entity_1 = require("../../servers/entities/infrastructure-operations.entity");
+const cluster_firewall_integration_service_1 = require("./cluster-firewall-integration.service");
+const grafana_datasource_service_1 = require("../../../../modules/grafana/services/grafana-datasource.service");
+const cluster_dns_cleanup_service_1 = require("../../../../modules/dns/services/cluster-dns-cleanup.service");
+/**
+ * Service responsible for cluster deletion logic
+ */
+let ClusterDeletionService = ClusterDeletionService_1 = class ClusterDeletionService {
+    constructor(clusterRepository, operationRepository, infrastructureQueue, clusterFirewallIntegrationService, grafanaDatasourceService, clusterDnsCleanupService) {
+        this.clusterRepository = clusterRepository;
+        this.operationRepository = operationRepository;
+        this.infrastructureQueue = infrastructureQueue;
+        this.clusterFirewallIntegrationService = clusterFirewallIntegrationService;
+        this.grafanaDatasourceService = grafanaDatasourceService;
+        this.clusterDnsCleanupService = clusterDnsCleanupService;
+        this.logger = new common_1.Logger(ClusterDeletionService_1.name);
+    }
+    /**
+     * Delete a cluster
+     */
+    async deleteCluster(clusterId, force = false) {
+        this.logger.log(`Deleting cluster: ${clusterId} (force: ${force})`);
+        // Check if cluster exists
+        const cluster = await this.clusterRepository.findOne({
+            where: { id: clusterId },
+            relations: ['nodes'],
+        });
+        if (!cluster) {
+            throw new common_1.NotFoundException(`Cluster ${clusterId} not found`);
+        }
+        // Check if cluster is already being deleted or deleted (allow retry from DELETION_FAILED)
+        if (cluster.status === cluster_entity_1.ClusterStatus.DELETING) {
+            throw new common_1.BadRequestException(`Cluster ${clusterId} is currently being deleted. Please wait for the operation to complete.`);
+        }
+        if (cluster.status === cluster_entity_1.ClusterStatus.DELETED) {
+            throw new common_1.BadRequestException(`Cluster ${clusterId} has already been deleted`);
+        }
+        // Log retry attempt if status is DELETION_FAILED
+        if (cluster.status === cluster_entity_1.ClusterStatus.DELETION_FAILED) {
+            this.logger.log(`Retrying deletion for cluster ${clusterId} (previous attempt failed: ${cluster.metadata?.deletionError || 'unknown error'})`);
+        }
+        // Pre-deletion hook: Remove Grafana datasources if this is a workload cluster
+        await this.removeClusterFromGrafana(cluster);
+        // Update cluster status to DELETING
+        cluster.status = cluster_entity_1.ClusterStatus.DELETING;
+        await this.clusterRepository.save(cluster);
+        // Create operation record
+        const operation = this.operationRepository.create({
+            operationType: infrastructure_operations_entity_1.OperationType.DELETE_CLUSTER,
+            status: infrastructure_operations_entity_1.OperationStatus.PENDING,
+            resourceType: 'cluster',
+            resourceName: cluster.name,
+            resourceId: cluster.id,
+            metadata: {
+                clusterId: cluster.id,
+                clusterName: cluster.name,
+                nodeCount: cluster.nodes.length,
+                force,
+                estimatedDurationInSeconds: 80,
+            },
+        });
+        const savedOperation = await this.operationRepository.save(operation);
+        // Queue delete cluster job
+        const jobData = {
+            operationId: savedOperation.id,
+            clusterId: cluster.id,
+            force,
+        };
+        await this.infrastructureQueue.add('delete-cluster', jobData, {
+            attempts: 3,
+            backoff: {
+                type: 'exponential',
+                delay: 2000,
+            },
+            timeout: 600000, // 10 minutes
+        });
+        this.logger.log(`Cluster deletion job queued for cluster ${clusterId} with operation ${savedOperation.id}`);
+        return savedOperation;
+    }
+    /**
+     * Cleanup cluster firewall during deletion
+     * Called from the queue processor after nodes are deleted
+     */
+    async cleanupClusterFirewall(clusterId, provider) {
+        this.logger.log(`Cleaning up firewall for cluster ${clusterId}`);
+        try {
+            await this.clusterFirewallIntegrationService.deleteClusterFirewall(clusterId, provider);
+            this.logger.log(`Firewall cleanup completed for cluster ${clusterId}`);
+        }
+        catch (error) {
+            // Log error but don't fail cluster deletion
+            this.logger.error(`Failed to cleanup firewall for cluster ${clusterId}: ${error.message}`, error.stack);
+        }
+    }
+    async cleanupClusterDnsRecords(clusterId) {
+        this.logger.log(`Cleaning up DNS records for cluster ${clusterId}`);
+        try {
+            const deleted = await this.clusterDnsCleanupService.deleteRecordsByClusterId(clusterId);
+            this.logger.log(`DNS cleanup completed for cluster ${clusterId} (${deleted} record(s) removed)`);
+        }
+        catch (error) {
+            this.logger.error(`Failed to cleanup DNS records for cluster ${clusterId}: ${error.message}`, error.stack);
+        }
+    }
+    /**
+     * Remove workload cluster datasources from Grafana observability cluster
+     * Called automatically before cluster deletion
+     */
+    async removeClusterFromGrafana(cluster) {
+        // Only remove datasources for WORKLOAD clusters (not OBSERVABILITY clusters)
+        if (cluster.clusterType !== cluster_entity_1.ClusterType.WORKLOAD) {
+            this.logger.debug(`Skipping Grafana datasource removal for ${cluster.clusterType} cluster ${cluster.name}`);
+            return;
+        }
+        try {
+            this.logger.log(`Removing cluster ${cluster.name} datasources from Grafana`);
+            // Remove datasources from Grafana
+            await this.grafanaDatasourceService.removeClusterDatasources(cluster.id);
+            this.logger.log(`✅ Cluster ${cluster.name} datasources removed from Grafana`);
+        }
+        catch (error) {
+            // Log error but don't fail cluster deletion
+            this.logger.warn(`Failed to remove cluster ${cluster.name} from Grafana: ${error.message}`);
+            this.logger.warn('Cluster deletion will proceed - Grafana datasources may need manual cleanup');
+        }
+    }
+};
+exports.ClusterDeletionService = ClusterDeletionService;
+exports.ClusterDeletionService = ClusterDeletionService = ClusterDeletionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(cluster_entity_1.ClusterEntity)),
+    __param(1, (0, typeorm_1.InjectRepository)(infrastructure_operations_entity_1.InfrastructureOperationEntity)),
+    __param(2, (0, bull_1.InjectQueue)('infrastructure')),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository, Object, cluster_firewall_integration_service_1.ClusterFirewallIntegrationService,
+        grafana_datasource_service_1.GrafanaDatasourceService,
+        cluster_dns_cleanup_service_1.ClusterDnsCleanupService])
+], ClusterDeletionService);

package/lib/src/modules/infrastructure/clusters/services/cluster-firewall-integration.service.d.ts

@@ -0,0 +1,25 @@
+import { FirewallDesiredStateService } from '../../firewalls/services/firewall-desired-state.service';
+import { FirewallReconciliationService } from '../../firewalls/services/firewall-reconciliation.service';
+import { ClusterEntity } from '../entities/cluster.entity';
+import { FirewallRuleDto } from '../../../providers/dto/firewall.dto';
+import { CloudProvider } from '../../../providers/enums/cloud-provider.enum';
+/**
+ * Service to handle cluster-firewall integration
+ * Manages firewall creation and deletion during cluster lifecycle
+ */
+export declare class ClusterFirewallIntegrationService {
+    private readonly firewallDesiredStateService;
+    private readonly firewallReconciliationService;
+    private readonly logger;
+    constructor(firewallDesiredStateService: FirewallDesiredStateService, firewallReconciliationService: FirewallReconciliationService);
+    /**
+     * Create and reconcile firewall for a cluster
+     * IMPORTANT: This MUST be called BEFORE creating any cluster nodes
+     */
+    createAndReconcileFirewall(cluster: ClusterEntity, desiredRules: FirewallRuleDto[]): Promise<string | null>;
+    /**
+     * Delete firewall for a cluster
+     * Called during cluster deletion
+     */
+    deleteClusterFirewall(clusterId: string, provider: CloudProvider): Promise<void>;
+}