@leverege/build-tools 2.64.1 → 2.65.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.64.1",
+  "version": "2.65.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -20,6 +20,7 @@
     "chart-to-museum": "src/chart-to-museum.mjs",
     "chart-to-registry": "src/chart-to-registry.mjs",
     "circleate": "src/circleate.sh",
+    "clone-cnpg-from-snapshot": "src/clone-cnpg-from-snapshot.mjs",
     "decrypt-secrets": "src/decrypt-secrets.sh",
     "dirty-git": "src/dirty-git.sh",
     "dockreate": "src/dockreate.sh",
@@ -64,23 +65,25 @@
     "chalk": "^5.4.1",
     "command-line-args": "^6.0.1",
     "command-line-usage": "^7.0.3",
+    "commander": "^13.1.0",
     "deepmerge": "^4.3.1",
     "enquirer": "^2.4.1",
     "execa": "^9.5.2",
     "glob": "^11.0.1",
     "handlebars": "^4.7.8",
-    "inquirer": "^12.4.3",
+    "ignore": "^7.0.3",
+    "inquirer": "^12.5.2",
     "js-yaml": "^4.1.0",
     "jsdoc": "^4.0.4",
     "ms": "^2.1.3",
     "npm-registry-fetch": "^18.0.2",
+    "ora": "^8.2.0",
     "package-up": "^5.0.0",
-    "parse-gitignore": "^2.0.0",
     "readline-sync": "^1.4.10",
     "semver": "^7.7.1",
     "simple-git": "^3.27.0",
     "toml": "^3.0.0",
-    "zx": "^8.4.0"
+    "zx": "^8.5.0"
   },
   "devDependencies": {
     "@leverege/eslint-config-leverege": "^5.0.1",

package/src/Utils.mjs

@@ -1,9 +1,10 @@
-import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import fs from 'node:fs'
 import path from 'node:path'
 import url from 'node:url'
 
 import chalk from 'chalk'
 import { $ } from 'execa'
+import ignore from 'ignore'
 import inquirer from 'inquirer'
 import { glob } from 'glob'
 import { packageUp } from 'package-up'
@@ -89,6 +90,43 @@ export const shellCmd = async ( cmdstr, opts = {} ) => {
   }
 }
 
+export const mkdirSafe = ( dir ) => {
+  try {
+    fs.mkdirSync( dir, { recursive : true } ) // eslint-disable-line security/detect-non-literal-fs-filename
+  } catch ( error ) {
+    condir( { error }, '<==fs.mkdir failed?' )
+    warning( { error }, `Could not create output dir: ${dir}` )
+  }
+}
+
+export const getDirectories = ( { path : srcPath = process.cwd(), respectGitignore = false } = {} ) => {
+  let ig = null
+
+  if ( respectGitignore ) {
+    const gitignorePath = path.join( srcPath, '.gitignore' )
+
+    /* eslint-disable security/detect-non-literal-fs-filename */
+    if ( fs.existsSync( gitignorePath ) ) {
+      const gitignoreContent = fs.readFileSync( gitignorePath, 'utf8' )
+      ig = ignore().add( gitignoreContent )
+    }
+    /* eslint-enable security/detect-non-literal-fs-filename */
+  }
+
+  return fs.readdirSync( srcPath, { withFileTypes : true } ) // eslint-disable-line security/detect-non-literal-fs-filename
+    .filter( ( dirent ) => {
+      if ( !dirent.isDirectory() ) return false
+      return !( ig?.ignores( dirent.name ) )
+    } )
+    .map( dirent => dirent.name )
+}
+
+export const xgetDirectories = ( srcPath = process.cwd() ) => {
+  return fs.readdirSync( srcPath, { withFileTypes : true } ) // eslint-disable-line security/detect-non-literal-fs-filename
+    .filter( dirent => dirent.isDirectory() )
+    .map( dirent => dirent.name )
+}
+
 // returns YYYMMDD-hhmm
 export const getDateTimestamp = () => {
   const fullDTS = new Date().toISOString().replace( /[-T:]/g, '' ).slice( 0, 14 )
@@ -158,9 +196,9 @@ export const gitRepoIsDirty = async () => {
 
 export const parseJsonFile = async ( jsonFile ) => {
   /* eslint-disable security/detect-non-literal-fs-filename */
-  if ( existsSync( jsonFile ) ) {
+  if ( fs.existsSync( jsonFile ) ) {
     try {
-      const json = JSON.parse( readFileSync( jsonFile, 'utf8' ) )  
+      const json = JSON.parse( fs.readFileSync( jsonFile, 'utf8' ) )  
       return json
     } catch ( error ) {
       throw new Error( `${error} in ${jsonFile}` )
@@ -369,13 +407,13 @@ https://console.cloud.google.com/artifacts/browse/leverege-registry?project=leve
 
 export const parseHelmChart = async ( helmroot = './helm' ) => {
   /* eslint-disable security/detect-non-literal-fs-filename */
-  if ( !existsSync( helmroot ) ) { return undefined }
-  const chartFiles = readdirSync( helmroot, { encoding : 'utf8', recursive : true } )
-  const chartYaml = YAML.load( readFileSync( `${helmroot}/Chart.yaml`, 'utf8' ) )
+  if ( !fs.existsSync( helmroot ) ) { return undefined }
+  const chartFiles = fs.readdirSync( helmroot, { encoding : 'utf8', recursive : true } )
+  const chartYaml = YAML.load( fs.readFileSync( `${helmroot}/Chart.yaml`, 'utf8' ) )
   const chartName = chartYaml.name
   const chartVersion = chartYaml.version
   const chartPackage = `${chartName}-${chartVersion}.tgz`
-  const valuesYaml = YAML.load( readFileSync( `${helmroot}/values.yaml`, 'utf8' ) )
+  const valuesYaml = YAML.load( fs.readFileSync( `${helmroot}/values.yaml`, 'utf8' ) )
   debug( valuesYaml, '<== helm/values.yaml' )
   if ( !valuesYaml.image ) {
     errorExit( 'Error: legacy helm chart detected - must upgrade to latest ignition template to proceed' )

package/src/awesome-fetch.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs'
+import yaml from 'js-yaml'
+
+const SOURCE_URL = 'https://raw.githubusercontent.com/samber/awesome-prometheus-alerts/master/dist/rules/kubernetes/kubestate-exporter.yml'
+const OUTPUT_FILE = 'converted-alerts.yaml'
+
+async function fetchAndConvert() {
+  /* eslint-disable no-console */
+  try {
+    console.log( `Fetching YAML from ${SOURCE_URL}...` )
+    const response = await fetch( SOURCE_URL )
+    if ( !response.ok ) throw new Error( `Failed to fetch: ${response.statusText}` )
+
+    const rawYaml = await response.text()
+    const parsedYaml = yaml.load( rawYaml )
+    if ( !parsedYaml.groups ) throw new Error( 'Invalid YAML structure, missing "groups"' )
+
+    // Reformat into PrometheusRule CRD format
+    const prometheusRule = {
+      apiVersion : 'monitoring.coreos.com/v1',
+      kind : 'PrometheusRule',
+      metadata : {
+        name : 'node-alerts', // Adjust based on the source
+      },
+      spec : {
+        groups : parsedYaml.groups.map( group => ( {
+          name : `${group.name}-rules`,
+          rules : group.rules,
+        } ) ),
+      },
+    }
+
+    // Convert back to YAML with proper formatting
+    const formattedYaml = yaml.dump( prometheusRule, { noRefs : true, indent : 0 } )
+    fs.writeFileSync( OUTPUT_FILE, formattedYaml, 'utf8' )
+    console.log( `Converted YAML written to ${OUTPUT_FILE}` )
+  } catch ( error ) {
+    console.error( 'Error processing YAML:', error.message )
+  }
+}
+
+fetchAndConvert()

package/src/clone-cnpg-from-snapshot.mjs

@@ -0,0 +1,449 @@
+#!/usr/bin/env node
+
+// clone-cnpg-from-snapshot.mjs
+
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import ora from 'ora'
+
+import { program } from 'commander'
+import chalk from 'chalk'
+import YAML from 'js-yaml'
+import {
+  // condir,
+  debug,
+  // err,
+  errorExit,
+  log,
+  mkdirSafe,
+  shellCmd,
+  warning,
+} from './Utils.mjs'
+
+program
+  .requiredOption( '--snapshot <name>', 'CNPG VolumeSnapshot name' )
+  .requiredOption( '--source-project <project>', 'Source GCP project ID' )
+  .requiredOption( '--dest-project <project>', 'Destination GCP project ID' )
+  .requiredOption( '--dest-region <region>', 'Destination region, e.g. us-east4' )
+  .option( '--artifacts-only', 'Only generate the volume snapshot YAML, script and readme' )
+  .option( '--dry-run', 'Show commands but don\'t run them' )
+  .option( '--execute', 'Perform real actions (required to run gcloud commands)' )
+  .option( '--cleanup', 'Remove temporary GCP resources after snapshot creation' )
+  .option( '--cleanup-only', 'Only do removal of temporary GCP resources and exit' )
+  .parse()
+
+const options = program.opts()
+
+const {
+  execute,
+  cleanup,
+  cleanupOnly,
+  destProject,
+  destRegion,
+  dryRun,
+  snapshot,
+  sourceProject,
+} = options
+
+const k8sSnapshotName = `${snapshot}-final`
+const tempDisk = `temp-from-${snapshot}`
+const tempImage = `img-from-${snapshot}`
+const intermediateSnapshot = `source-snapshot-${sourceProject}-${snapshot}`
+const destSnapshot = `snapshot-${sourceProject}-${snapshot}`
+const tempDiskFromImage = `temp-from-img-${snapshot}`
+const destZone = `${destRegion}-a` // infer from region - implies "-a" zone always available
+
+// directory for receiving the YAML necessary for defining the snapshot class,
+// content and volume
+const emitYamlDir = `cnpg-clone-${snapshot}`
+
+let sourceZone // set and used in main(), also needed by cleanupResouces
+
+const getPrettyTimeNow = () => {
+  const now = new Date()
+  const [ month, day, year ] = now.toLocaleDateString( 'en-US' ).split( '/' )
+  const time = now.toLocaleTimeString( 'en-US', { hour12 : true } )
+  return `${year}-${month.padStart( 2, '0' )}-${day.padStart( 2, '0' )} ${time}`
+}
+
+const getElapsedTime = ( startMs ) => {
+  const deltaSec = Math.floor( ( Date.now() - startMs ) / 1000 )
+  const minutes = Math.floor( deltaSec / 60 ).toString().padStart( 2, '0' )
+  const seconds = ( deltaSec % 60 ).toString().padStart( 2, '0' )
+  return `${minutes}:${seconds}`
+}
+
+// equivalent to Unix touch command to create an empty file
+const touchFile = async ( filename ) => {
+  if ( filename ) {
+    const handle = await fs.open( filename, 'w' ) // eslint-disable-line security/detect-non-literal-fs-filename
+    await handle.close()
+  }
+}
+
+// generates an executable script to use for defining the volume on k8s
+const writeApplyScript = async ( dir ) => {
+  const applyScript = `#!/ust/bin/env bash
+#
+# Apply VolumeSnapshot resources prior to deploying the CNPG cluster
+#
+kubectl apply -f ${dir}/volumesnapshotclass.yaml
+kubectl apply -f ${dir}/volumesnapshotcontent.yaml
+kubectl apply -f ${dir}/volumesnapshot.yaml
+`
+
+  const scriptPath = path.join( dir, 'apply-volumesnapshots.sh' )
+  await fs.writeFile( scriptPath, applyScript, { mode : 0o755 } ) // eslint-disable-line security/detect-non-literal-fs-filename
+  log( chalk.green( '  [✓] Helper script written:' ), scriptPath )
+}
+
+const writeReadme = async ( dir ) => {
+  const readmePath = path.join( dir, 'readme.txt' )
+  const content = `This directory contains the Kubernetes manifests needed to bootstrap a new CNPG cluster
+using a cloned volume snapshot from another GCP project.
+
+Files:
+  - volumesnapshotclass.yaml         (optional, use if the class doesn't already exist)
+  - volumesnapshotcontent.yaml       (refers to the GCE snapshot copied into this project)
+  - volumesnapshot.yaml              (used by CNPG to bootstrap from the volume snapshot)
+  - apply-volumesnapshots.sh         (helper script to apply these manifests in correct order)
+  - .nohelm                          (marker file for overwhelm to skip values.yaml generation)
+
+To deploy the volume snapshots to your Kubernetes cluster:
+  
+  $ ./apply-volumesnapshots.sh
+
+Once applied, reference the following VolumeSnapshot in your CNPG cluster bootstrap config:
+
+  spec.bootstrap.recovery.volumeSnapshot.volumeSnapshotName: ${k8sSnapshotName}
+
+Then deploy your CNPG cluster normally. Validate the cluster startup:
+
+  $ kubectl get pods -n cnpg-operands
+
+Enjoy your cloned cluster ✨
+`
+
+  await fs.writeFile( readmePath, content ) // eslint-disable-line security/detect-non-literal-fs-filename
+  log( chalk.green( '  [✓] README written:' ), readmePath )
+}
+
+const writeYaml = async ( filename, data ) => {
+  const fullPath = path.join( emitYamlDir, filename )
+  const yaml = YAML.dump( data )
+  await fs.writeFile( fullPath, yaml ) // eslint-disable-line security/detect-non-literal-fs-filename
+  log( chalk.green( '  [✓] YAML written:' ), fullPath )
+}
+
+const getVolumeSnapshotContentName = async ( snapshotName ) => {
+  const json = await shellCmd(
+    'kubectl get volumesnapshotcontents.snapshot.storage.k8s.io -o json'
+  )
+
+  const data = JSON.parse( json )
+  const match = data.items.find(
+    item => item?.spec?.volumeSnapshotRef?.name === snapshotName
+  )
+
+  return match?.metadata?.name || ''
+}
+
+const getVolumeHandle = async ( vscName ) => {
+  const cmd = `kubectl get volumesnapshotcontent ${vscName} -o jsonpath='{.spec.source.volumeHandle}'`
+  const handle = ( await shellCmd( cmd ) ).replace( /'/g, '' )
+  debug( { handle }, '<==getVolumeHandle' )
+  return handle
+}
+
+// this function is responsible for emitting all of the artifacts for the creation
+// of the k8s volume that will then be used to bootstrap the cnpg cluster
+const emitCloningArtifacts = async () => {
+  try {
+    const snapshotYamlRaw = await shellCmd(
+      `kubectl get volumesnapshot ${snapshot} -n cnpg-operands -o json`
+    )
+
+    const snapshotData = JSON.parse( snapshotYamlRaw )
+    const annotations = snapshotData?.metadata?.annotations || {}
+    const labels = snapshotData?.metadata?.labels || {}
+
+    // Only keep CNPG-related annotations
+    const filteredAnnotations = Object.fromEntries(
+      Object.entries( annotations ).filter( ( [ key ] ) => key.startsWith( 'cnpg.io/' ) || key.startsWith( 'snapshotOf' )
+      )
+    )
+
+    // Only keep CNPG-related labels
+    const filteredLabels = Object.fromEntries(
+      Object.entries( labels ).filter( ( [ key ] ) => key.startsWith( 'cnpg.io/' ) || key.startsWith( 'snapshotOf' )
+      )
+    )
+
+    const snapshotClass = {
+      apiVersion : 'snapshot.storage.k8s.io/v1',
+      kind : 'VolumeSnapshotClass',
+      metadata : { name : 'cnpg-preprovisioned' },
+      driver : 'pd.csi.storage.gke.io',
+      deletionPolicy : 'Retain'
+    }
+
+    const snapshotContent = {
+      apiVersion : 'snapshot.storage.k8s.io/v1',
+      kind : 'VolumeSnapshotContent',
+      metadata : { name : k8sSnapshotName },
+      spec : {
+        deletionPolicy : 'Retain',
+        driver : 'pd.csi.storage.gke.io',
+        source : {
+          snapshotHandle : `projects/${destProject}/global/snapshots/${destSnapshot}`,
+        },
+        volumeSnapshotClassName : 'cnpg-preprovisioned',
+        volumeSnapshotRef : {
+          name : k8sSnapshotName,
+          namespace : 'cnpg-operands',
+        },
+      },
+    }
+
+    const snapshotYaml = {
+      apiVersion : 'snapshot.storage.k8s.io/v1',
+      kind : 'VolumeSnapshot',
+      metadata : {
+        name : k8sSnapshotName,
+        namespace : 'cnpg-operands',
+        annotations : filteredAnnotations,
+        labels : filteredLabels,
+      },
+      spec : {
+        volumeSnapshotClassName : 'cnpg-preprovisioned',
+        source : {
+          volumeSnapshotContentName : k8sSnapshotName,
+        },
+      },
+    }
+
+    mkdirSafe( emitYamlDir )
+
+    await writeYaml( 'volumesnapshotclass.yaml', snapshotClass )
+    await writeYaml( 'volumesnapshotcontent.yaml', snapshotContent )
+    await writeYaml( 'volumesnapshot.yaml', snapshotYaml )
+    await touchFile( path.join( emitYamlDir, '.nohelm' ) )
+    await writeApplyScript( emitYamlDir )
+    await writeReadme( emitYamlDir )
+
+  } catch ( err ) {
+    errorExit( `Unable to generate VolumeSnapshot YAML: ${err.message}` )
+  }
+}
+
+// runs a CLI command with a silly little spinner in an attempt to convince
+// the user its worth waiting around for while also being somewhere tolerant
+// of certain faults which are probably safe to ignore
+const runCommand = async ( commandParts, opts = {} ) => {
+  const cmdIndent = '        '
+  const optIndent = '          '
+  const rendered = commandParts
+    .map( ( part, idx ) => {
+      const isLast = idx === commandParts.length - 1
+      return `${idx === 0 ? cmdIndent : optIndent}${part}${isLast ? '' : ' \\'}`
+    } )
+    .join( '\n' )
+
+  log( `  \n  ${chalk.yellow( ` 🚀 Launching @ ${getPrettyTimeNow()}` )}\n${chalk.cyan( rendered )}` )
+
+  if ( dryRun ) { return }
+
+  const fullCommand = commandParts.join( ' ' )
+  const spinner = ora( {
+    text : chalk.green( ' Executing' ),
+    prefixText : '  ',
+    spinner : 'dots13',
+  } ).start()
+
+  try {
+    const startTimeMs = Date.now()
+    await shellCmd( fullCommand, opts )
+    spinner.succeed( chalk.green( ` Completed @ ${getPrettyTimeNow()} (${getElapsedTime( startTimeMs )})` ) )
+  } catch ( error ) {
+    const nonFatal = [
+      'already exists',
+      'is already being used',
+      'Cannot reuse name',
+      'already exists',
+    ]
+
+    const msg = error.stderr || ''
+
+    if ( nonFatal.some( warnError => msg.includes( warnError ) ) ) {
+      log( { error }, '<==Full Error' )
+      warning( 'non fatal error ignored' )
+      spinner.succeed( chalk.yellow( ' Warned' ) )
+      return
+    }
+    
+    spinner.fail( chalk.red( ' Failed' ) )
+    if ( cleanupOnly ) { return }
+
+    throw error
+  }
+}
+
+const main = async () => {
+  if ( !execute && !dryRun ) {
+    errorExit( 'Must specify either --dry-run or --execute' )
+  }
+
+  if ( dryRun ) {
+    warning( 'Dry run enabled — no gcloud commands will run.' )
+  }
+
+  // STEP 1: Resolve volume handle from k8s VolumeSnapshotContent
+  log( `\n[STEP 1] 📦 Snapshot clone process starting: ${snapshot}` )
+  const vscName = await getVolumeSnapshotContentName( snapshot )
+  if ( !vscName ) errorExit( `Unable to locate VolumeSnapshotContent for ${snapshot}` )
+
+  const volumeHandle = await getVolumeHandle( vscName )
+  if ( !volumeHandle ) errorExit( `Unable to locate volumeHandle for ${vscName}` )
+
+  // expect volumeHandle to be in this format:
+  //        projects/<project>/zones/<zone>/disks/<diskName>
+  const volumeParts = volumeHandle.split( '/' )
+  const diskName = volumeParts[5]
+  sourceZone = volumeParts[3] // sourceZone also needed in cleanupResources
+
+  log( `\n  [✓] Resolved disk: ${chalk.cyan( diskName )}` )
+  log( `        from handle: ${chalk.cyan( volumeHandle )}` )
+  log( `            in zone: ${chalk.cyan( sourceZone )}\n` )
+
+  // if all we want are the artifacts
+  if ( options.artifactsOnly ) {
+    await emitCloningArtifacts()
+    process.exit( 0 )
+  }
+
+  log( `\n[STEP 2] 📸 Creating GCE snapshot from source disk [${diskName}]` )
+  await runCommand( [
+    `gcloud compute disks snapshot ${diskName}`,
+    `--snapshot-names=${intermediateSnapshot}`,
+    `--zone=${sourceZone}`,
+    `--project=${sourceProject}`,
+    `--storage-location=${destRegion}`,
+  ] )
+
+  log( '\n[STEP 3] 💽 Creating temp disk from snapshot...' )
+  await runCommand( [
+    `gcloud compute disks create ${tempDisk}`,
+    `--source-snapshot=${intermediateSnapshot}`,
+    `--zone=${sourceZone}`,
+    `--project=${sourceProject}`,
+  ] )
+
+  log( '\n[STEP 4] 🖼️  Creating image from temp disk...' )
+  await runCommand( [
+    `gcloud compute images create ${tempImage}`,
+    `--source-disk=${tempDisk}`,
+    `--source-disk-zone=${sourceZone}`,
+    `--storage-location=${destRegion}`,
+    `--project=${sourceProject}`,
+  ] )
+
+  log( '\n[STEP 5] 🔐 Granting image access to destination project...' )
+  await runCommand( [
+    `gcloud compute images add-iam-policy-binding ${tempImage}`,
+    `--member=serviceAccount:${destProject}@appspot.gserviceaccount.com`,
+    '--role=roles/compute.imageUser',
+    `--project=${sourceProject}`,
+  ] )
+
+  log( '\n[STEP 6] 🚚 Importing image into destination project...' )
+  await runCommand( [
+    `gcloud compute images create ${tempImage}`,
+    `--source-image=${tempImage}`,
+    `--source-image-project=${sourceProject}`,
+    `--storage-location=${destRegion}`,
+    `--project=${destProject}`,
+  ] )
+
+  log( '\n[STEP 7] 🧊 Creating temp disk from image in destination project...' )
+  await runCommand( [
+    `gcloud compute disks create ${tempDiskFromImage}`,
+    `--image=${tempImage}`,
+    `--image-project=${destProject}`,
+    `--zone=${destZone}`,
+    `--project=${destProject}`,
+  ] )
+
+  log( '\n[STEP 8] 🧊 Creating snapshot in destination project...' )
+  await runCommand( [
+    `gcloud compute snapshots create ${destSnapshot}`,
+    `--source-disk=${tempDiskFromImage}`,
+    `--source-disk-zone=${destZone}`,
+    `--storage-location=${destRegion}`,
+    `--project=${destProject}`,
+  ] )
+
+  await emitCloningArtifacts()
+
+  log( `
+  ✅ Done. Snapshot: ${chalk.cyan( destSnapshot )}
+           Recovery YAMLs written to: ${chalk.cyan( emitYamlDir )}
+           Run '${chalk.yellow( './apply-recovery-yaml.sh' )}' to prep the cluster for recovery.
+  ` )
+}
+
+const cleanupResources = async () => {
+  log( '\n[STEP 9] 🧹 Cleaning up temporary resources (unwinding the stack)...' )
+
+  const commands = [
+    [ // STEP 7: Remove temp disk from image in destination project
+      `gcloud compute disks delete ${tempDiskFromImage}`,
+      `--zone=${destZone}`,
+      `--project=${destProject}`,
+      '--quiet'
+    ],
+
+    [ // STEP 6: Remove copied image from destination project
+      `gcloud compute images delete ${tempImage}`,
+      `--project=${destProject}`,
+      '--quiet'
+    ],
+
+    [ // STEP 4: Remove image from source project
+      `gcloud compute images delete ${tempImage}`,
+      `--project=${sourceProject}`,
+      '--quiet'
+    ],
+
+    [ // STEP 3: Remove temp disk from source project
+      `gcloud compute disks delete ${tempDisk}`,
+      `--zone=${sourceZone}`,
+      `--project=${sourceProject}`,
+      '--quiet'
+    ],
+
+    [ // STEP 2: Remove source snapshot
+      `gcloud compute snapshots delete ${intermediateSnapshot}`,
+      `--project=${sourceProject}`,
+      '--quiet'
+    ],
+  ]
+
+  await Promise.all(
+    commands.map( cmdParts => runCommand( cmdParts ).catch( ( err ) => {
+      warning( `Non-fatal error during cleanup: ${err.message}` )
+    } ) )
+  )
+
+  log( chalk.green( '  [✓] Parallel complete. Final GCE snapshot retained for CNPG bootstrapping.' ) )
+}
+
+if ( cleanupOnly ) {
+  await cleanupResources()
+  process.exit( 1 )
+}
+
+await main().catch( err => errorExit( err.message || err ) )
+
+if ( cleanup ) {
+  await cleanupResources()
+}

package/src/fetch-awesome-alerts.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs'
+import path from 'node:path'
+import yaml from 'js-yaml'
+import { Command } from 'commander'
+import chalk from 'chalk'
+
+import { log, err } from './Utils.mjs'
+
+const program = new Command()
+
+program
+  .name( 'fetch-alerts' )
+  .description( 'Fetch a Prometheus alert YAML file and convert it to a PrometheusRule CRD.' )
+  .argument( '<sourceFile>', 'YAML filename to fetch from awesome-prometheus' )
+  .option( '-o, --output <outputFile>', 'Output file name', 'converted-alerts.yaml' )
+  .option( '-n, --name <customName>', 'Override metadata.name in the PrometheusRule' )
+  .option( '--dry-run', 'Print output to console instead of writing to file' )
+  .parse()
+
+const [ sourceFile ] = program.args
+const { output : outputFile, dryRun, name : customName } = program.opts()
+
+const BASE_URL = 'https://raw.githubusercontent.com/samber/awesome-prometheus-alerts/master/dist/rules'
+const SOURCE_URL = `${BASE_URL}/${sourceFile}`
+
+const defaultName = path.basename( sourceFile ).replace( /\.(yaml|yml)$/, '' )
+const metadataName = customName || defaultName
+
+async function fetchAndConvert() {
+  try {
+    log( chalk.blueBright( `🔍 Fetching YAML from ${SOURCE_URL}...` ) )
+    const response = await fetch( SOURCE_URL )
+    if ( !response.ok ) throw new Error( `Failed to fetch: ${response.statusText}` )
+
+    const rawYaml = await response.text()
+    const parsedYaml = yaml.load( rawYaml )
+    if ( !parsedYaml.groups ) throw new Error( 'Invalid YAML structure, missing "groups"' )
+
+    const prometheusRule = {
+      apiVersion : 'monitoring.coreos.com/v1',
+      kind : 'PrometheusRule',
+      metadata : {
+        name : metadataName,
+        namespace : 'prometheus',
+      },
+      spec : {
+        groups : parsedYaml.groups.map( group => ( {
+          name : `${group.name}-rules`,
+          rules : group.rules,
+        } ) ),
+      },
+    }
+
+    const formattedYaml = yaml.dump( prometheusRule, {
+      noRefs : true,
+      indent : 2,
+      lineWidth : -1,
+    } )
+
+    if ( dryRun ) {
+      log( chalk.green( `\n🟢 Dry Run Output for: ${chalk.yellow( metadataName )}\n` ) )
+      log( formattedYaml )
+    } else {
+      fs.writeFileSync( outputFile, formattedYaml, 'utf8' ) // eslint-disable-line security/detect-non-literal-fs-filename
+      log( chalk.green( `✅ Converted YAML written to ${chalk.cyan( outputFile )}` ) )
+    }
+  } catch ( error ) {
+    err( chalk.red( '❌ Error:' ), error.message )
+  }
+}
+
+fetchAndConvert()