@reyemtech/nimbus 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ReyemTech
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,399 @@
+# @reyemtech/nimbus
+
+Cloud-agnostic infrastructure abstractions for [Pulumi](https://www.pulumi.com/). Write IaC once, deploy to AWS, Azure, or GCP. Enables full BCDR: any client environment is fully reproducible from code — cloud migration = change one config value.
+
+## Why
+
+Every client environment at ReyemTech follows the same pattern: network + cluster + DNS + secrets + platform components. The only difference is the cloud provider. This package extracts that pattern into reusable, type-safe abstractions.
+
+**Key benefits:**
+- **Cloud migration in one line** — change `cloud: "aws"` to `cloud: "azure"` and redeploy
+- **Multi-cloud active-active** — deploy to AWS + Azure simultaneously with a Global Load Balancer
+- **Factory pattern** — `createNetwork()`, `createCluster()`, `createDns()`, `createSecrets()` dispatch to the right cloud automatically
+- **Cost-optimized defaults** — fck-nat (~$3/mo vs $32/mo managed NAT), spot instances, Auto Mode
+- **Escape hatches** — every resource exposes its native cloud object via `nativeResource`
+- **Type-safe** — full TypeScript interfaces with discriminated unions for provider-specific config
+
+## Install
+
+```bash
+npm install @reyemtech/nimbus
+```
+
+**Peer dependency:** `@pulumi/pulumi >= 3.0.0`
+
+**Provider SDKs** (install only what you need):
+```bash
+# AWS
+npm install @pulumi/aws @pulumi/eks
+
+# Azure
+npm install @pulumi/azure-native
+
+# Both (for multi-cloud)
+npm install @pulumi/aws @pulumi/eks @pulumi/azure-native
+
+# Platform layer (Helm)
+npm install @pulumi/kubernetes
+```
+
+## Quick Start
+
+### Single Cloud (AWS)
+
+```typescript
+import { createNetwork, createCluster, createDns, createPlatformStack } from "@reyemtech/nimbus";
+import type { INetwork, ICluster, IDns } from "@reyemtech/nimbus";
+
+// Network with fck-nat (~$3/mo)
+const network = createNetwork("prod", {
+  cloud: "aws",
+  cidr: "10.0.0.0/16",
+  natStrategy: "fck-nat",
+}) as INetwork;
+
+// EKS cluster with Auto Mode
+const cluster = createCluster("prod", {
+  cloud: "aws",
+  nodePools: [
+    { name: "system", instanceType: "t4g.small", minNodes: 2, maxNodes: 3 },
+    { name: "workers", instanceType: "c6a.large", minNodes: 1, maxNodes: 10, spot: true },
+  ],
+  providerOptions: { aws: { autoMode: true } },
+}, network) as ICluster;
+
+// DNS zone
+const dns = createDns("prod", { cloud: "aws", zoneName: "example.com" }) as IDns;
+
+// Platform stack (Traefik, cert-manager, External DNS, ArgoCD, Vault)
+createPlatformStack("prod", {
+  cluster,
+  domain: "example.com",
+  externalDns: { dnsProvider: "route53", domainFilters: ["example.com"] },
+  vault: { enabled: true, ingressHost: "vault.example.com" },
+});
+```
+
+### Single Cloud (Azure)
+
+```typescript
+import { createNetwork, createCluster, createDns, createPlatformStack } from "@reyemtech/nimbus";
+import type { INetwork, ICluster } from "@reyemtech/nimbus";
+
+const providerOptions = { azure: { resourceGroupName: "rg-prod" } };
+
+const network = createNetwork("prod", {
+  cloud: "azure",
+  cidr: "10.1.0.0/16",
+  natStrategy: "managed",
+  providerOptions,
+}) as INetwork;
+
+const cluster = createCluster("prod", {
+  cloud: "azure",
+  nodePools: [
+    { name: "system", instanceType: "Standard_D2s_v5", minNodes: 2, maxNodes: 3, mode: "system" },
+    { name: "workers", instanceType: "Standard_D4s_v5", minNodes: 1, maxNodes: 10, spot: true, mode: "user" },
+  ],
+  virtualNodes: true,
+  providerOptions,
+}, network) as ICluster;
+
+createPlatformStack("prod", {
+  cluster,
+  domain: "example.com",
+  externalDns: { dnsProvider: "azure-dns", domainFilters: ["example.com"] },
+});
+```
+
+### Multi-Cloud (AWS + Azure)
+
+```typescript
+import { createNetwork, createCluster, createGlobalLoadBalancer } from "@reyemtech/nimbus";
+import type { INetwork, ICluster } from "@reyemtech/nimbus";
+
+const providerOptions = {
+  aws: { autoMode: true },
+  azure: { resourceGroupName: "rg-prod" },
+};
+
+// Auto-offsets CIDRs: AWS gets 10.0.0.0/16, Azure gets 10.1.0.0/16
+const networks = createNetwork("prod", {
+  cloud: ["aws", "azure"],
+  cidr: "10.0.0.0/16",
+  natStrategy: "fck-nat",
+  providerOptions,
+}) as INetwork[];
+
+// Networks auto-matched by provider
+const clusters = createCluster("prod", {
+  cloud: ["aws", "azure"],
+  nodePools: [
+    { name: "system", instanceType: "t4g.small", minNodes: 2, maxNodes: 3 },
+    { name: "workers", instanceType: "c6a.large", minNodes: 2, maxNodes: 8, spot: true },
+  ],
+  providerOptions,
+}, networks) as ICluster[];
+
+// Global Load Balancer — active-active across both clouds
+const glb = createGlobalLoadBalancer("prod", {
+  strategy: "active-active",
+  clusters,
+  domain: "app.example.com",
+  healthCheck: { path: "/health", port: 443, protocol: "HTTPS" },
+  dnsProvider: "route53",
+});
+```
+
+## Architecture
+
+```
+@reyemtech/nimbus
+├── factories/      # Cloud-agnostic factory functions (primary API)
+├── types/          # CloudProvider, CloudTarget, tags, errors, validation
+├── network/        # VPC (AWS), VNet (Azure) + NAT + CIDR utilities
+├── cluster/        # EKS, AKS (+ Auto Mode, virtual nodes, spot)
+├── dns/            # Route 53, Azure DNS
+├── secrets/        # AWS Secrets Manager, Azure Key Vault
+├── platform/       # Helm: Traefik, cert-manager, External DNS, ArgoCD, Vault, ESO
+├── global-lb/      # DNS-based multi-cloud routing (active-active, failover, geo)
+├── database/       # (interfaces only — RDS, Azure DB, PXC, CNPG)
+├── cache/          # (interfaces only — ElastiCache, Azure Cache, Redis Helm)
+├── storage/        # (interfaces only — S3, Blob, GCS)
+└── queue/          # (interfaces only — SQS, Service Bus, NATS)
+```
+
+### Module Status
+
+| Module | AWS | Azure | GCP |
+|--------|-----|-------|-----|
+| **Network** | VPC + fck-nat/managed NAT | VNet + NAT Gateway | Planned |
+| **Cluster** | EKS + Auto Mode | AKS + virtual nodes | Planned |
+| **DNS** | Route 53 | Azure DNS | Planned |
+| **Secrets** | Secrets Manager | Key Vault | Planned |
+| **Platform** | Helm (provider-agnostic) | Helm (provider-agnostic) | Helm (provider-agnostic) |
+| **Global LB** | Route 53 health-checked routing | Planned | — |
+
+## API Reference
+
+### Factory Functions (Primary API)
+
+The factory functions are the recommended way to use this library. They dispatch to the correct cloud-specific implementation based on the `cloud` parameter. Provider-specific options are passed via `providerOptions`.
+
+#### `createNetwork(name, config)`
+
+Creates a VPC (AWS) or VNet (Azure) with subnets and NAT.
+
+| Parameter | Type | Description |
+|-----------|------|-------------|
+| `name` | `string` | Resource name prefix |
+| `config.cloud` | `CloudArg` | `"aws"`, `"azure"`, or `["aws", "azure"]` for multi-cloud |
+| `config.cidr` | `string` | CIDR block (auto-offset for multi-cloud) |
+| `config.natStrategy` | `NatStrategy` | `"managed"`, `"fck-nat"`, or `"none"` |
+| `config.providerOptions` | `IProviderOptions` | Provider-specific options (see below) |
+
+Returns: `INetwork` (single cloud) or `INetwork[]` (multi-cloud)
+
+#### `createCluster(name, config, networks)`
+
+Creates an EKS (AWS) or AKS (Azure) cluster.
+
+| Parameter | Type | Description |
+|-----------|------|-------------|
+| `config.nodePools` | `INodePool[]` | Node pool definitions |
+| `config.version` | `string` | Kubernetes version |
+| `config.providerOptions` | `IProviderOptions` | Provider-specific options |
+| `networks` | `INetwork \| INetwork[]` | Network(s) — auto-matched by provider for multi-cloud |
+
+Returns: `ICluster` (single cloud) or `ICluster[]` (multi-cloud)
+
+#### `createDns(name, config)`
+
+Creates a Route 53 (AWS) or Azure DNS zone.
+
+Returns: `IDns` (single cloud) or `IDns[]` (multi-cloud)
+
+#### `createSecrets(name, config)`
+
+Creates an AWS Secrets Manager or Azure Key Vault store.
+
+```typescript
+const secrets = createSecrets("prod", { cloud: "aws" }) as ISecrets;
+secrets.putSecret("database", { host: "db.example.com", password: dbPassword });
+const pw = secrets.getSecretRef({ path: "database", key: "password" });
+```
+
+Returns: `ISecrets` (single cloud) or `ISecrets[]` (multi-cloud)
+
+#### Provider Options
+
+```typescript
+providerOptions: {
+  aws: {
+    // Network
+    fckNatInstanceType: "t4g.nano",
+    availabilityZoneCount: 2,
+    // Cluster
+    autoMode: true,
+    addons: ["vpc-cni", "coredns"],
+    endpointAccess: "both",
+  },
+  azure: {
+    resourceGroupName: "my-rg",  // Required for all Azure resources
+    // Network
+    subnetCount: 2,
+    // Cluster
+    azureCni: true,
+    virtualNodes: false,
+    aadTenantId: "...",
+    dnsPrefix: "...",
+    // Secrets
+    tenantId: "...",             // Required for Key Vault
+    objectId: "...",
+    sku: "standard",
+  },
+}
+```
+
+### Direct Cloud Functions (Escape Hatch)
+
+For maximum control, you can still use cloud-specific functions directly:
+
+- `createAwsNetwork(name, config, options?)` / `createAzureNetwork(name, config, options)`
+- `createEksCluster(name, config, network, options?)` / `createAksCluster(name, config, network, options)`
+- `createRoute53Dns(name, config)` / `createAzureDns(name, config, options)`
+- `createAwsSecrets(name, config)` / `createAzureSecrets(name, config, options)`
+
+### Platform Stack
+
+#### `createPlatformStack(name, config)`
+
+Deploys Helm-based platform components to one or more clusters.
+
+| Component | Default | Chart |
+|-----------|---------|-------|
+| Traefik | Enabled | `traefik/traefik` v34.3.0 |
+| cert-manager | Enabled | `jetstack/cert-manager` v1.17.2 |
+| External DNS | If configured | `kubernetes-sigs/external-dns` v1.16.1 |
+| ArgoCD | Disabled | `argoproj/argo-cd` v7.8.26 |
+| Vault | Disabled | `hashicorp/vault` v0.29.1 |
+| External Secrets | Disabled | `external-secrets/external-secrets` v0.14.4 |
+
+### Global Load Balancer
+
+#### `createGlobalLoadBalancer(name, config)`
+
+Routes traffic across clusters using DNS-based health checks.
+
+| Strategy | Behavior |
+|----------|----------|
+| `active-active` | Weighted routing — equal traffic to all healthy clusters |
+| `active-passive` | Failover — primary cluster, secondary on failure |
+| `geo` | Geolocation — route by client continent |
+
+### CIDR Utilities
+
+```typescript
+import { parseCidr, cidrsOverlap, buildCidrMap, autoOffsetCidrs } from "@reyemtech/nimbus";
+
+// Parse CIDR to numeric range
+parseCidr("10.0.0.0/16"); // { network, prefix, size, start, end }
+
+// Check overlap
+cidrsOverlap("10.0.0.0/16", "10.0.5.0/24"); // true
+
+// Auto-generate non-overlapping CIDRs
+autoOffsetCidrs(3); // ["10.0.0.0/16", "10.1.0.0/16", "10.2.0.0/16"]
+
+// Build a cloud-to-CIDR map with conflict detection
+buildCidrMap(["aws", "azure"], { aws: "10.0.0.0/16" });
+// => { aws: "10.0.0.0/16", azure: "10.1.0.0/16" }
+```
+
+### Cross-Cloud Validation
+
+```typescript
+import { validateMultiCloud, validateResourceName, isFeatureSupported } from "@reyemtech/nimbus";
+
+// Validate multi-cloud config (checks duplicates + naming)
+validateMultiCloud([
+  { provider: "aws", region: "us-east-1" },
+  { provider: "azure", region: "canadacentral" },
+], "my-cluster"); // { valid: true, errors: [], warnings: [] }
+
+// Check feature availability
+isFeatureSupported("fck-nat", "aws"); // true
+isFeatureSupported("fck-nat", "azure"); // false
+
+// Validate resource names per provider
+validateResourceName("MyCluster", "gcp"); // warns about uppercase
+```
+
+### Tags
+
+```typescript
+import { normalizeTags, mergeWithRequiredTags } from "@reyemtech/nimbus";
+
+// GCP label normalization (lowercase, no special chars, max 63)
+normalizeTags({ "Cost Center": "R&D" }, "gcp"); // { "cost-center": "r-d" }
+
+// Merge required tags (environment, client, costCenter, managedBy)
+mergeWithRequiredTags(
+  { environment: "prod", client: "acme", costCenter: "eng" },
+  { custom: "value" },
+); // { environment: "prod", client: "acme", costCenter: "eng", managedBy: "nimbus", custom: "value" }
+```
+
+## Escape Hatches
+
+Every resource exposes its cloud-native object via `nativeResource`:
+
+```typescript
+import * as aws from "@pulumi/aws";
+
+const cluster = createCluster("prod", { cloud: "aws", ... }, network) as ICluster;
+const eksCluster = cluster.nativeResource as aws.eks.Cluster;
+eksCluster.arn.apply(arn => console.log("EKS ARN:", arn));
+```
+
+## Cloud Target Flexibility
+
+All factory functions accept flexible cloud arguments:
+
+```typescript
+// String shorthand (uses DEFAULT_REGIONS)
+createNetwork("prod", { cloud: "aws", ... });
+
+// Explicit target
+createNetwork("prod", { cloud: { provider: "aws", region: "eu-west-1" }, ... });
+
+// Multi-cloud array
+createNetwork("prod", { cloud: ["aws", "azure"], ... });
+```
+
+## Error Handling
+
+All errors extend `AnyCloudError` with typed error codes:
+
+| Error | Code | When |
+|-------|------|------|
+| `CloudValidationError` | `CLOUD_VALIDATION` | Invalid provider or target |
+| `CidrError` | `CIDR_OVERLAP` / `CIDR_INVALID` | CIDR conflicts or malformed |
+| `UnsupportedFeatureError` | `UNSUPPORTED_FEATURE` | Feature not available on provider |
+| `ConfigError` | `CONFIG_MISSING` / `CONFIG_INVALID` | Missing or invalid configuration |
+
+## Development
+
+```bash
+npm install
+npm run typecheck   # Type checking
+npm run lint        # ESLint
+npm run format      # Prettier
+npm test            # Vitest (unit tests)
+npm run test:coverage  # With coverage thresholds
+npm run build       # ESM + CJS dual build
+```
+
+## License
+
+MIT

package/dist/cjs/aws/cluster.d.ts

@@ -0,0 +1,32 @@
+/**
+ * AWS EKS cluster implementation with Auto Mode support.
+ *
+ * @module aws/cluster
+ */
+import type { ICluster, IClusterConfig } from "../cluster";
+import type { INetwork } from "../network";
+/** AWS-specific EKS options beyond the base config. */
+export interface IEksOptions {
+    /** Enable EKS Auto Mode (managed node provisioning). Default: false. */
+    readonly autoMode?: boolean;
+    /** EKS add-ons to install. Default: vpc-cni, coredns, kube-proxy. */
+    readonly addons?: ReadonlyArray<string>;
+    /** Endpoint access: "public", "private", or "both". Default: "both". */
+    readonly endpointAccess?: "public" | "private" | "both";
+}
+/**
+ * Create an EKS cluster with optional Auto Mode.
+ *
+ * @example
+ * ```typescript
+ * const cluster = createEksCluster("prod", {
+ *   cloud: "aws",
+ *   nodePools: [
+ *     { name: "system", instanceType: "t4g.small", minNodes: 2, maxNodes: 3 },
+ *     { name: "spot", instanceType: "t4g.medium", minNodes: 1, maxNodes: 10, spot: true },
+ *   ],
+ * }, network, { autoMode: true });
+ * ```
+ */
+export declare function createEksCluster(name: string, config: IClusterConfig, network: INetwork, options?: IEksOptions): ICluster;
+//# sourceMappingURL=cluster.d.ts.map

package/dist/cjs/aws/cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster.d.ts","sourceRoot":"","sources":["../../../src/aws/cluster.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,wEAAwE;IACxE,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;CACzD;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,QAAQ,EACjB,OAAO,CAAC,EAAE,WAAW,GACpB,QAAQ,CA8IV"}

package/dist/cjs/aws/cluster.js

@@ -0,0 +1,214 @@
+"use strict";
+/**
+ * AWS EKS cluster implementation with Auto Mode support.
+ *
+ * @module aws/cluster
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEksCluster = createEksCluster;
+const aws = __importStar(require("@pulumi/aws"));
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const types_1 = require("../types");
+const DEFAULT_ADDONS = ["vpc-cni", "coredns", "kube-proxy"];
+/**
+ * Create an EKS cluster with optional Auto Mode.
+ *
+ * @example
+ * ```typescript
+ * const cluster = createEksCluster("prod", {
+ *   cloud: "aws",
+ *   nodePools: [
+ *     { name: "system", instanceType: "t4g.small", minNodes: 2, maxNodes: 3 },
+ *     { name: "spot", instanceType: "t4g.medium", minNodes: 1, maxNodes: 10, spot: true },
+ *   ],
+ * }, network, { autoMode: true });
+ * ```
+ */
+function createEksCluster(name, config, network, options) {
+    const cloud = Array.isArray(config.cloud) ? (config.cloud[0] ?? "aws") : config.cloud;
+    const target = (0, types_1.resolveCloudTarget)(cloud);
+    const tags = config.tags ?? {};
+    const autoMode = options?.autoMode ?? config.autoMode ?? false;
+    const addons = options?.addons ?? DEFAULT_ADDONS;
+    const endpointAccess = options?.endpointAccess ?? "both";
+    // EKS cluster IAM role
+    const clusterRole = new aws.iam.Role(`${name}-cluster-role`, {
+        namePrefix: `${name}-eks`,
+        assumeRolePolicy: JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Action: "sts:AssumeRole",
+                    Effect: "Allow",
+                    Principal: { Service: "eks.amazonaws.com" },
+                },
+            ],
+        }),
+        tags,
+    });
+    new aws.iam.RolePolicyAttachment(`${name}-cluster-policy`, {
+        policyArn: "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
+        role: clusterRole.name,
+    });
+    // EKS Cluster
+    const cluster = new aws.eks.Cluster(`${name}-cluster`, {
+        name,
+        roleArn: clusterRole.arn,
+        version: config.version,
+        vpcConfig: {
+            subnetIds: pulumi
+                .all([network.publicSubnetIds, network.privateSubnetIds])
+                .apply(([pub, priv]) => [...pub, ...priv]),
+            endpointPrivateAccess: endpointAccess === "private" || endpointAccess === "both",
+            endpointPublicAccess: endpointAccess === "public" || endpointAccess === "both",
+        },
+        computeConfig: autoMode ? { enabled: true } : undefined,
+        accessConfig: { authenticationMode: "API_AND_CONFIG_MAP" },
+        tags: { ...tags, [`kubernetes.io/cluster/${name}`]: "owned" },
+    });
+    // Node pools — Auto Mode delegates to EKS, standard uses managed node groups
+    const nodeGroups = [];
+    if (!autoMode) {
+        for (const np of config.nodePools) {
+            const nodeRole = createNodeRole(`${name}-${np.name}`, tags);
+            nodeGroups.push(new aws.eks.NodeGroup(`${name}-ng-${np.name}`, {
+                clusterName: cluster.name,
+                nodeGroupName: `${name}-${np.name}`,
+                nodeRoleArn: nodeRole.arn,
+                instanceTypes: [np.instanceType],
+                capacityType: np.spot ? "SPOT" : "ON_DEMAND",
+                scalingConfig: {
+                    desiredSize: np.desiredNodes ?? np.minNodes,
+                    minSize: np.minNodes,
+                    maxSize: np.maxNodes,
+                },
+                subnetIds: network.privateSubnetIds,
+                labels: np.labels,
+                tags: { ...tags, Name: `${name}-${np.name}` },
+            }));
+        }
+    }
+    const firstNodeGroup = nodeGroups[0];
+    // EKS Add-ons
+    for (const addon of addons) {
+        new aws.eks.Addon(`${name}-addon-${addon}`, {
+            clusterName: cluster.name,
+            addonName: addon,
+            resolveConflictsOnCreate: "OVERWRITE",
+            resolveConflictsOnUpdate: "OVERWRITE",
+            tags,
+        }, firstNodeGroup ? { dependsOn: [firstNodeGroup] } : undefined);
+    }
+    // K8s provider for this cluster
+    const kubeconfig = pulumi
+        .all([cluster.endpoint, cluster.certificateAuthority, cluster.name])
+        .apply(([endpoint, ca, clusterName]) => JSON.stringify({
+        apiVersion: "v1",
+        kind: "Config",
+        clusters: [
+            {
+                cluster: {
+                    server: endpoint,
+                    "certificate-authority-data": ca.data,
+                },
+                name: clusterName,
+            },
+        ],
+        contexts: [
+            {
+                context: { cluster: clusterName, user: clusterName },
+                name: clusterName,
+            },
+        ],
+        "current-context": clusterName,
+        users: [
+            {
+                name: clusterName,
+                user: {
+                    exec: {
+                        apiVersion: "client.authentication.k8s.io/v1beta1",
+                        command: "aws",
+                        args: ["eks", "get-token", "--cluster-name", clusterName],
+                    },
+                },
+            },
+        ],
+    }));
+    const provider = new k8s.Provider(`${name}-k8s`, {
+        kubeconfig,
+    });
+    return {
+        name,
+        cloud: target,
+        endpoint: cluster.endpoint,
+        kubeconfig,
+        version: cluster.version,
+        nodePools: config.nodePools,
+        nativeResource: cluster,
+        provider,
+    };
+}
+function createNodeRole(name, tags) {
+    const role = new aws.iam.Role(`${name}-node-role`, {
+        namePrefix: `${name}-node`,
+        assumeRolePolicy: JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Action: "sts:AssumeRole",
+                    Effect: "Allow",
+                    Principal: { Service: "ec2.amazonaws.com" },
+                },
+            ],
+        }),
+        tags,
+    });
+    const policies = [
+        "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
+        "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
+        "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
+    ];
+    for (const policyArn of policies) {
+        const shortName = policyArn.split("/").pop() ?? policyArn;
+        new aws.iam.RolePolicyAttachment(`${name}-${shortName}`, {
+            policyArn,
+            role: role.name,
+        });
+    }
+    return role;
+}
+//# sourceMappingURL=cluster.js.map

package/dist/cjs/aws/cluster.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster.js","sourceRoot":"","sources":["../../../src/aws/cluster.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCH,4CAmJC;AApLD,iDAAmC;AACnC,wDAA0C;AAC1C,uDAAyC;AAGzC,oCAA8C;AAY9C,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAE5D;;;;;;;;;;;;;GAaG;AACH,SAAgB,gBAAgB,CAC9B,IAAY,EACZ,MAAsB,EACtB,OAAiB,EACjB,OAAqB;IAErB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IACtF,MAAM,MAAM,GAAG,IAAA,0BAAkB,EAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC/D,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,cAAc,CAAC;IACjD,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,MAAM,CAAC;IAEzD,uBAAuB;IACvB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,eAAe,EAAE;QAC3D,UAAU,EAAE,GAAG,IAAI,MAAM;QACzB,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC;YAC/B,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE;iBAC5C;aACF;SACF,CAAC;QACF,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,IAAI,iBAAiB,EAAE;QACzD,SAAS,EAAE,gDAAgD;QAC3D,IAAI,EAAE,WAAW,CAAC,IAAI;KACvB,CAAC,CAAC;IAEH,cAAc;IACd,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE;QACrD,IAAI;QACJ,OAAO,EAAE,WAAW,CAAC,GAAG;QACxB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE;YACT,SAAS,EAAE,MAAM;iBACd,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;iBACxD,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC5C,qBAAqB,EAAE,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,MAAM;YAChF,oBAAoB,EAAE,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,MAAM;SAC/E;QACD,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QACvD,YAAY,EAAE,EAAE,kBAAkB,EAAE,oBAAoB,EAAE;QAC1D,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,yBAAyB,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE;KAC9D,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,UAAU,GAAwB,EAAE,CAAC;IAE3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5D,UAAU,CAAC,IAAI,CACb,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC7C,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,aAAa,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE;gBACnC,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,aAAa,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC;gBAChC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;gBAC5C,aAAa,EAAE;oBACb,WAAW,EAAE,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,QAAQ;oBAC3C,OAAO,EAAE,EAAE,CAAC,QAAQ;oBACpB,OAAO,EAAE,EAAE,CAAC,QAAQ;iBACrB;gBACD,SAAS,EAAE,OAAO,CAAC,gBAA2C;gBAC9D,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;aAC9C,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAErC,cAAc;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CACf,GAAG,IAAI,UAAU,KAAK,EAAE,EACxB;YACE,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,SAAS,EAAE,KAAK;YAChB,wBAAwB,EAAE,WAAW;YACrC,wBAAwB,EAAE,WAAW;YACrC,IAAI;SACL,EACD,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC7D,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,MAAM,UAAU,GAAG,MAAM;SACtB,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;SACnE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CACrC,IAAI,CAAC,SAAS,CAAC;QACb,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,4BAA4B,EAAE,EAAE,CAAC,IAAI;iBACtC;gBACD,IAAI,EAAE,WAAW;aAClB;SACF;QACD,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE;gBACpD,IAAI,EAAE,WAAW;aAClB;SACF;QACD,iBAAiB,EAAE,WAAW;QAC9B,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE;oBACJ,IAAI,EAAE;wBACJ,UAAU,EAAE,sCAAsC;wBAClD,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC;qBAC1D;iBACF;aACF;SACF;KACF,CAAC,CACH,CAAC;IAEJ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,MAAM,EAAE;QAC/C,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,OAAO;QACvB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAsC;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,YAAY,EAAE;QACjD,UAAU,EAAE,GAAG,IAAI,OAAO;QAC1B,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC;YAC/B,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE;iBAC5C;aACF;SACF,CAAC;QACF,IAAI;KACL,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG;QACf,mDAAmD;QACnD,8CAA8C;QAC9C,4DAA4D;KAC7D,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC;QAC1D,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,IAAI,IAAI,SAAS,EAAE,EAAE;YACvD,SAAS;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}