@rulebricks/cli 2.0.0 → 2.0.2

package/dist/lib/dns.js

@@ -1,9 +1,19 @@
-import dns from "dns";
-import { promisify } from "util";
+import * as dns from "dns";
 import { execa } from "execa";
 import { DEFAULT_NAMESPACE } from "../types/index.js";
-const resolve4 = promisify(dns.resolve4);
-const resolveCname = promisify(dns.resolveCname);
+/**
+ * DNS resolvers to try in order:
+ * - null = system default
+ * - Google Public DNS
+ * - Cloudflare DNS
+ */
+const DNS_RESOLVERS = [
+    null, // System default
+    ["8.8.8.8", "8.8.4.4"], // Google
+    ["1.1.1.1", "1.0.0.1"], // Cloudflare
+];
+/** Timeout for each DNS lookup attempt (ms) */
+const DNS_TIMEOUT_MS = 5000;
 /**
  * Helper to detect if a string is an IP address
  */
@@ -19,81 +29,153 @@ function cnameMatchesTarget(cnameRecords, expectedTarget) {
         r.replace(/\.$/, "") === expectedTarget.replace(/\.$/, ""));
 }
 /**
- * Checks if a DNS record resolves
+ * Wrap a promise with a timeout
  */
-export async function checkDNSRecord(hostname, expectedTarget) {
-    try {
-        // If expected target is a hostname (not an IP), check CNAME first
-        if (expectedTarget && !isIPAddress(expectedTarget)) {
+function withTimeout(promise, ms) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error("DNS lookup timeout")), ms);
+        promise
+            .then((result) => {
+            clearTimeout(timer);
+            resolve(result);
+        })
+            .catch((err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+}
+/**
+ * Create promisified resolver functions for a specific DNS server
+ */
+function createResolver(servers) {
+    const resolver = new dns.Resolver();
+    if (servers) {
+        resolver.setServers(servers);
+    }
+    return {
+        resolve4: (hostname) => new Promise((resolve, reject) => {
+            resolver.resolve4(hostname, (err, addresses) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(addresses);
+            });
+        }),
+        resolveCname: (hostname) => new Promise((resolve, reject) => {
+            resolver.resolveCname(hostname, (err, addresses) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(addresses);
+            });
+        }),
+    };
+}
+/**
+ * Check DNS record with a specific resolver
+ */
+async function checkWithResolver(hostname, expectedTarget, servers) {
+    const { resolve4, resolveCname } = createResolver(servers);
+    // If expected target is a hostname (not an IP), check CNAME first
+    if (expectedTarget && !isIPAddress(expectedTarget)) {
+        try {
+            const cnameRecords = await withTimeout(resolveCname(hostname), DNS_TIMEOUT_MS);
+            const matchesTarget = cnameMatchesTarget(cnameRecords, expectedTarget);
+            return {
+                resolved: true,
+                records: cnameRecords,
+                type: "CNAME",
+                matchesTarget,
+            };
+        }
+        catch {
+            // No CNAME record exists - try A record check
+            // For hostname targets, we need to resolve both the hostname and target
+            // to IPs and compare them
             try {
-                const cnameRecords = await resolveCname(hostname);
-                // CNAME records found - return the comparison result directly
-                // Don't fall through to A record check, as that would incorrectly
-                // compare IPs against a hostname target
-                const matchesTarget = cnameMatchesTarget(cnameRecords, expectedTarget);
+                const [hostnameIPs, targetIPs] = await withTimeout(Promise.all([resolve4(hostname), resolve4(expectedTarget)]), DNS_TIMEOUT_MS);
+                const matchesTarget = hostnameIPs.some((ip) => targetIPs.includes(ip));
                 return {
                     resolved: true,
-                    records: cnameRecords,
-                    type: "CNAME",
+                    records: hostnameIPs,
+                    type: "A",
                     matchesTarget,
                 };
             }
             catch {
-                // No CNAME record exists - try A record check
-                // For hostname targets, we need to resolve both the hostname and target
-                // to IPs and compare them
-                try {
-                    const [hostnameIPs, targetIPs] = await Promise.all([
-                        resolve4(hostname),
-                        resolve4(expectedTarget),
-                    ]);
-                    // Check if any of the hostname's IPs match any of the target's IPs
-                    const matchesTarget = hostnameIPs.some((ip) => targetIPs.includes(ip));
-                    return {
-                        resolved: true,
-                        records: hostnameIPs,
-                        type: "A",
-                        matchesTarget,
-                    };
-                }
-                catch {
-                    // Could not resolve - DNS not configured
-                    return {
-                        resolved: false,
-                        records: [],
-                        type: null,
-                        matchesTarget: false,
-                    };
-                }
+                return {
+                    resolved: false,
+                    records: [],
+                    type: null,
+                    matchesTarget: false,
+                };
             }
         }
-        // Expected target is an IP address - check A records directly
+    }
+    // Expected target is an IP address - check A records directly
+    try {
+        const aRecords = await withTimeout(resolve4(hostname), DNS_TIMEOUT_MS);
+        const matchesTarget = expectedTarget
+            ? aRecords.some((r) => r === expectedTarget)
+            : true;
+        return {
+            resolved: true,
+            records: aRecords,
+            type: "A",
+            matchesTarget,
+        };
+    }
+    catch {
+        // Try CNAME if A fails (fallback for when no expected target)
         try {
-            const aRecords = await resolve4(hostname);
+            const cnameRecords = await withTimeout(resolveCname(hostname), DNS_TIMEOUT_MS);
             const matchesTarget = expectedTarget
-                ? aRecords.some((r) => r === expectedTarget)
+                ? cnameMatchesTarget(cnameRecords, expectedTarget)
                 : true;
             return {
                 resolved: true,
-                records: aRecords,
-                type: "A",
+                records: cnameRecords,
+                type: "CNAME",
                 matchesTarget,
             };
         }
         catch {
-            // Try CNAME if A fails (fallback for when no expected target)
-            const cnameRecords = await resolveCname(hostname);
-            const matchesTarget = expectedTarget
-                ? cnameMatchesTarget(cnameRecords, expectedTarget)
-                : true;
             return {
-                resolved: true,
-                records: cnameRecords,
-                type: "CNAME",
-                matchesTarget,
+                resolved: false,
+                records: [],
+                type: null,
+                matchesTarget: false,
             };
         }
     }
+}
+/**
+ * Checks if a DNS record resolves using multiple DNS resolvers for reliability.
+ * Tries system DNS first, then Google (8.8.8.8), then Cloudflare (1.1.1.1).
+ * Returns success if ANY resolver confirms the record matches the target.
+ */
+export async function checkDNSRecord(hostname, expectedTarget) {
+    // Try each resolver in sequence until one succeeds with a matching target
+    for (const servers of DNS_RESOLVERS) {
+        try {
+            const result = await checkWithResolver(hostname, expectedTarget, servers);
+            // If we found a matching record, return immediately
+            if (result.resolved && result.matchesTarget) {
+                return result;
+            }
+            // If resolved but doesn't match, continue to next resolver
+            // (different resolvers might have different cache states)
+        }
+        catch {
+            // This resolver failed entirely, try the next one
+        }
+    }
+    // No resolver found a matching record - do one final check with system DNS
+    // to return whatever we can find (even if not matching)
+    try {
+        return await checkWithResolver(hostname, expectedTarget, null);
+    }
     catch {
         return {
             resolved: false,

package/dist/lib/helm.d.ts

@@ -16,7 +16,7 @@ export declare function fetchChartVersions(): Promise<ChartVersion[]>;
  */
 export declare function getInstalledVersion(releaseName: string, namespace: string): Promise<string | null>;
 /**
- * Installs the Rulebricks Helm chart
+ * Installs the Rulebricks Helm chart (use installOrUpgradeChart for idempotent operations)
  */
 export declare function installChart(deploymentName: string, options: {
     releaseName: string;
@@ -26,6 +26,19 @@ export declare function installChart(deploymentName: string, options: {
     timeout?: string;
     createNamespace?: boolean;
 }): Promise<void>;
+/**
+ * Installs or upgrades the Rulebricks Helm chart (idempotent operation).
+ * Uses `helm upgrade --install` which will install if release doesn't exist,
+ * or upgrade if it does. This is safe to run multiple times.
+ */
+export declare function installOrUpgradeChart(deploymentName: string, options: {
+    releaseName: string;
+    namespace: string;
+    version?: string;
+    wait?: boolean;
+    timeout?: string;
+    createNamespace?: boolean;
+}): Promise<void>;
 /**
  * Upgrades the Rulebricks Helm chart
  */

package/dist/lib/helm.js

@@ -102,7 +102,7 @@ export async function getInstalledVersion(releaseName, namespace) {
     }
 }
 /**
- * Installs the Rulebricks Helm chart
+ * Installs the Rulebricks Helm chart (use installOrUpgradeChart for idempotent operations)
  */
 export async function installChart(deploymentName, options) {
     const { releaseName, namespace, version, wait = true, timeout = "15m", createNamespace = true, } = options;
@@ -133,6 +133,41 @@ export async function installChart(deploymentName, options) {
         throw new Error(`Helm install failed:\n${getErrorMessage(error)}`);
     }
 }
+/**
+ * Installs or upgrades the Rulebricks Helm chart (idempotent operation).
+ * Uses `helm upgrade --install` which will install if release doesn't exist,
+ * or upgrade if it does. This is safe to run multiple times.
+ */
+export async function installOrUpgradeChart(deploymentName, options) {
+    const { releaseName, namespace, version, wait = true, timeout = "15m", createNamespace = true, } = options;
+    const valuesPath = getHelmValuesPath(deploymentName);
+    const args = [
+        "upgrade",
+        "--install", // This makes it idempotent - install if not exists, upgrade if exists
+        releaseName,
+        HELM_CHART_OCI,
+        "--namespace",
+        namespace,
+        "--values",
+        valuesPath,
+    ];
+    if (version) {
+        args.push("--version", version);
+    }
+    if (createNamespace) {
+        args.push("--create-namespace");
+    }
+    if (wait) {
+        args.push("--wait");
+        args.push("--timeout", timeout);
+    }
+    try {
+        await execa("helm", args);
+    }
+    catch (error) {
+        throw new Error(`Helm install/upgrade failed:\n${getErrorMessage(error)}`);
+    }
+}
 /**
  * Upgrades the Rulebricks Helm chart
  */

package/dist/lib/kubernetes.js

@@ -435,6 +435,7 @@ export const VALID_LOG_COMPONENTS = [
     "kafka",
     "supabase",
     "traefik",
+    "redis",
 ];
 /**
  * Pod name patterns for each component.
@@ -447,6 +448,7 @@ const COMPONENT_POD_PATTERNS = {
     kafka: ["kafka"],
     supabase: ["supabase", "db", "postgres"],
     traefik: ["traefik"],
+    redis: ["redis", "dragonfly", "keydb"],
 };
 /**
  * Gets pods for a specific component in a deployment.

package/dist/types/index.d.ts

@@ -716,3 +716,93 @@ export declare function getNamespace(deploymentName: string): string;
  * Example: rulebricks-prod, rulebricks-staging
  */
 export declare function getReleaseName(deploymentName: string): string;
+/** Benchmark test mode - QPS measures requests/sec, throughput measures solutions/sec */
+export type BenchmarkTestMode = "qps" | "throughput";
+/** Benchmark preset intensity level */
+export type BenchmarkPreset = "light" | "medium" | "heavy" | "custom";
+/** Configuration for a benchmark test run */
+export interface BenchmarkConfig {
+    /** Name of the deployment being tested */
+    deploymentName: string;
+    /** Full API URL including flow slug (e.g., https://domain.com/api/v1/flows/benchmark-flow) */
+    apiUrl: string;
+    /** Rulebricks API key */
+    apiKey: string;
+    /** Test mode - qps or throughput */
+    testMode: BenchmarkTestMode;
+    /** Test duration (e.g., "2m", "4m") */
+    testDuration: string;
+    /** Target requests per second */
+    targetRps: number;
+    /** Bulk size - only for throughput mode (payloads per request) */
+    bulkSize?: number;
+}
+/** Result metrics from a benchmark test */
+export interface BenchmarkMetrics {
+    /** Actual requests per second achieved */
+    actualRps: number;
+    /** Success rate as percentage (0-100) */
+    successRate: number;
+    /** P50 latency in milliseconds */
+    p50Latency: number;
+    /** P90 latency in milliseconds */
+    p90Latency: number;
+    /** P95 latency in milliseconds */
+    p95Latency: number;
+    /** P99 latency in milliseconds */
+    p99Latency: number;
+    /** Minimum latency in milliseconds */
+    minLatency: number;
+    /** Maximum latency in milliseconds */
+    maxLatency: number;
+    /** Average latency in milliseconds */
+    avgLatency: number;
+    /** Total requests made */
+    totalRequests: number;
+    /** Number of failed requests */
+    failedRequests: number;
+    /** Test duration in seconds */
+    testDuration: number;
+    /** Total data sent in bytes */
+    dataSent: number;
+    /** Total data received in bytes */
+    dataReceived: number;
+    /** Max virtual users used */
+    maxVUs: number;
+    /** For throughput tests: actual throughput (solutions/sec) */
+    actualThroughput?: number;
+    /** For throughput tests: total payloads processed */
+    totalPayloads?: number;
+}
+/** Result of a benchmark test run */
+export interface BenchmarkResult {
+    /** Whether the test completed successfully */
+    success: boolean;
+    /** Path to the output directory */
+    outputDir: string;
+    /** Path to the HTML report */
+    reportPath: string;
+    /** Path to the JSON results */
+    resultsPath: string;
+    /** Parsed metrics from the test (if successful) */
+    metrics?: BenchmarkMetrics;
+    /** Error message if the test failed */
+    error?: string;
+}
+/** Preset configurations for QPS tests */
+export declare const QPS_PRESETS: Record<Exclude<BenchmarkPreset, "custom">, {
+    targetRps: number;
+    testDuration: string;
+    label: string;
+    description: string;
+}>;
+/** Preset configurations for throughput tests */
+export declare const THROUGHPUT_PRESETS: Record<Exclude<BenchmarkPreset, "custom">, {
+    targetRps: number;
+    bulkSize: number;
+    testDuration: string;
+    label: string;
+    description: string;
+}>;
+/** Cloud URLs that should be blocked from benchmarking */
+export declare const BLOCKED_BENCHMARK_DOMAINS: string[];

package/dist/types/index.js

@@ -554,3 +554,54 @@ export function getNamespace(deploymentName) {
 export function getReleaseName(deploymentName) {
     return `rulebricks-${deploymentName}`;
 }
+/** Preset configurations for QPS tests */
+export const QPS_PRESETS = {
+    light: {
+        targetRps: 100,
+        testDuration: "2m",
+        label: "Light",
+        description: "100 RPS for 2 minutes - quick validation",
+    },
+    medium: {
+        targetRps: 500,
+        testDuration: "4m",
+        label: "Medium",
+        description: "500 RPS for 4 minutes - standard load test",
+    },
+    heavy: {
+        targetRps: 1000,
+        testDuration: "4m",
+        label: "Heavy",
+        description: "1000 RPS for 4 minutes - stress test",
+    },
+};
+/** Preset configurations for throughput tests */
+export const THROUGHPUT_PRESETS = {
+    light: {
+        targetRps: 50,
+        bulkSize: 25,
+        testDuration: "2m",
+        label: "Light",
+        description: "1,250 solutions/sec for 2 minutes",
+    },
+    medium: {
+        targetRps: 100,
+        bulkSize: 50,
+        testDuration: "4m",
+        label: "Medium",
+        description: "5,000 solutions/sec for 4 minutes",
+    },
+    heavy: {
+        targetRps: 200,
+        bulkSize: 100,
+        testDuration: "4m",
+        label: "Heavy",
+        description: "20,000 solutions/sec for 4 minutes",
+    },
+};
+/** Cloud URLs that should be blocked from benchmarking */
+export const BLOCKED_BENCHMARK_DOMAINS = [
+    "api.rulebricks.com",
+    "rulebricks.io",
+    "app.rulebricks.com",
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulebricks/cli",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "CLI for deploying and managing private Rulebricks instances",
   "type": "module",
   "bin": {
@@ -38,19 +38,19 @@
     "commander": "^12.1.0",
     "execa": "^8.0.1",
     "figures": "^6.1.0",
-    "ink": "^5.0.1",
+    "ink": "^6.6.0",
     "ink-select-input": "^6.0.0",
     "ink-spinner": "^5.0.0",
     "ink-text-input": "^6.0.0",
     "node-fetch": "^3.3.2",
     "ora": "^8.0.1",
-    "react": "^18.3.1",
+    "react": "^19.2.4",
     "yaml": "^2.4.5",
     "zod": "^3.23.8"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",
-    "@types/react": "^18.3.3",
+    "@types/react": "^19.2.4",
     "typescript": "^5.5.3"
   },
   "engines": {
@@ -59,7 +59,8 @@
   "pkg": {
     "scripts": "dist/**/*.js",
     "assets": [
-      "terraform/**/*"
+      "terraform/**/*",
+      "benchmarks/**/*"
     ],
     "targets": [
       "node20-linux-x64",
@@ -73,6 +74,7 @@
   "files": [
     "dist",
     "terraform",
-    "email-templates"
+    "templates",
+    "benchmarks"
   ]
 }

package/terraform/aws/main.tf

@@ -185,6 +185,28 @@ module "eks" {
     }
   }
 
+  # Allow all node-to-node traffic for intra-cluster communication
+  # This ensures services on any port (including port 80 for serverless-redis-http) can communicate
+  node_security_group_additional_rules = {
+    ingress_self_all = {
+      description = "Node to node all ports/protocols"
+      protocol    = "-1"
+      from_port   = 0
+      to_port     = 0
+      type        = "ingress"
+      self        = true
+    }
+    egress_all = {
+      description      = "Node all egress"
+      protocol         = "-1"
+      from_port        = 0
+      to_port          = 0
+      type             = "egress"
+      cidr_blocks      = ["0.0.0.0/0"]
+      ipv6_cidr_blocks = ["::/0"]
+    }
+  }
+
   tags = {
     Environment = "rulebricks"
     Terraform   = "true"

package/terraform/azure/main.tf

@@ -138,6 +138,51 @@ resource "azurerm_subnet" "aks" {
   address_prefixes     = ["10.240.0.0/16"]
 }
 
+# Network Security Group for AKS subnet
+# Allows all intra-VNet traffic for Kubernetes node-to-node communication
+resource "azurerm_network_security_group" "aks" {
+  name                = "${var.cluster_name}-nsg"
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+
+  # Allow all intra-VNet inbound traffic for Kubernetes
+  security_rule {
+    name                       = "AllowVNetInbound"
+    priority                   = 100
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "*"
+    source_port_range          = "*"
+    destination_port_range     = "*"
+    source_address_prefix      = "VirtualNetwork"
+    destination_address_prefix = "VirtualNetwork"
+  }
+
+  # Allow all intra-VNet outbound traffic for Kubernetes
+  security_rule {
+    name                       = "AllowVNetOutbound"
+    priority                   = 100
+    direction                  = "Outbound"
+    access                     = "Allow"
+    protocol                   = "*"
+    source_port_range          = "*"
+    destination_port_range     = "*"
+    source_address_prefix      = "VirtualNetwork"
+    destination_address_prefix = "VirtualNetwork"
+  }
+
+  tags = {
+    Environment = "rulebricks"
+    Terraform   = "true"
+  }
+}
+
+# Associate NSG with AKS subnet
+resource "azurerm_subnet_network_security_group_association" "aks" {
+  subnet_id                 = azurerm_subnet.aks.id
+  network_security_group_id = azurerm_network_security_group.aks.id
+}
+
 # User Assigned Identity for AKS
 resource "azurerm_user_assigned_identity" "aks" {
   name                = "${var.cluster_name}-identity"

package/terraform/gcp/main.tf

@@ -165,6 +165,37 @@ resource "google_compute_router_nat" "nat" {
   source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
 }
 
+# Firewall rule to allow all internal traffic within the VPC
+# This ensures services on any port can communicate between nodes
+resource "google_compute_firewall" "allow_internal" {
+  name    = "${var.cluster_name}-allow-internal"
+  network = google_compute_network.vpc.name
+
+  allow {
+    protocol = "tcp"
+    ports    = ["0-65535"]
+  }
+
+  allow {
+    protocol = "udp"
+    ports    = ["0-65535"]
+  }
+
+  allow {
+    protocol = "icmp"
+  }
+
+  # Allow traffic from nodes, pods, and services in the same VPC
+  source_ranges = [
+    google_compute_subnetwork.subnet.ip_cidr_range,                        # Node IPs (10.0.0.0/16)
+    google_compute_subnetwork.subnet.secondary_ip_range[0].ip_cidr_range,  # Pod IPs (10.1.0.0/16)
+    google_compute_subnetwork.subnet.secondary_ip_range[1].ip_cidr_range   # Service IPs (10.2.0.0/16)
+  ]
+
+  # Target all instances in the VPC
+  target_tags = ["gke-${var.cluster_name}"]
+}
+
 # GKE Cluster
 resource "google_container_cluster" "cluster" {
   provider = google-beta
@@ -266,6 +297,9 @@ resource "google_container_node_pool" "primary" {
       tier        = var.tier
     }
 
+    # Network tags for firewall rules
+    tags = ["gke-${var.cluster_name}"]
+
     workload_metadata_config {
       mode = "GKE_METADATA"
     }