@rulebricks/cli 2.1.6 → 2.1.7

package/README.md

@@ -27,6 +27,32 @@ Finally, you will need to have the following tools installed and ready on your m
 - **Terraform** >= 1.0 (for infrastructure provisioning)
 - Cloud CLI (`aws`, `gcloud`, or `az`) configured for your provider
 
+## Cluster Setup
+
+If you want to create the Kubernetes cluster yourself, use the resources in `cluster-setup/` before running the CLI wizard. These files provide minimum compatible AWS, Azure, and GCP cluster setup guidance plus optional access checks. Monitoring destinations are configured later by the CLI wizard and Helm values, not by these cluster setup files.
+
+```bash
+# AWS: optional access check, then create EKS with eksctl
+AWS_REGION=us-east-1 bash cluster-setup/aws/check-aws-access.sh
+cd cluster-setup/aws && eksctl create cluster -f cluster.yaml
+
+# Azure: optional access check, then deploy AKS with Bicep
+az login
+az account set --subscription <subscription-id>
+AZURE_LOCATION=eastus bash cluster-setup/azure/check-aks-prereqs.sh
+az group create --name rulebricks-rg --location eastus
+az deployment group create \
+  --resource-group rulebricks-rg \
+  --template-file cluster-setup/azure/main.bicep \
+  --parameters @cluster-setup/azure/main.parameters.json
+
+# GCP: optional access check, then create GKE with gcloud
+GCP_REGION=us-central1 bash cluster-setup/gcp/check-gke-prereqs.sh
+# Follow cluster-setup/gcp/README.md for the gcloud create commands.
+```
+
+After the cluster exists, update kubeconfig, then run `rulebricks init` and choose **Use existing Kubernetes cluster**. The existing Terraform provisioning path remains available, but native cloud setup is the clearest path when you want to own the cluster directly.
+
 ## Quick Start
 
 ```bash

package/cluster-setup/aws/README.md

@@ -0,0 +1,74 @@
+# AWS Cluster Setup
+
+Use these files to create a minimum EKS cluster that can run Rulebricks without using the Rulebricks CLI Terraform flow.
+
+## Files
+
+- `cluster.yaml` is the minimum compatible `eksctl` cluster config, using ARM64 managed nodes and EBS CSI support.
+- `check-aws-access.sh` verifies AWS identity, common EKS/EC2/IAM permissions, quota, `eksctl`, `kubectl`, and Helm.
+
+## Core Cluster Parameters
+
+- Cluster name: `rulebricks-cluster` (`cluster.yaml` -> `metadata.name`)
+- Region: `us-east-1` (`cluster.yaml` -> `metadata.region`)
+- Kubernetes version: `1.34` (`cluster.yaml` -> `metadata.version`)
+- Node count: `4` (`cluster.yaml` -> `managedNodeGroups[0].desiredCapacity`)
+- Instance type: `c8g.large` (`cluster.yaml` -> `managedNodeGroups[0].instanceType`)
+- Disk size (GB): `50` (`cluster.yaml` -> `managedNodeGroups[0].volumeSize`)
+- Disk type: `gp3` (`cluster.yaml` -> `managedNodeGroups[0].volumeType`)
+
+## Check Access
+
+```bash
+AWS_REGION=us-east-1 bash check-aws-access.sh
+```
+
+## Create The Cluster
+
+```bash
+eksctl create cluster -f cluster.yaml
+```
+
+`eksctl` updates kubeconfig automatically. To refresh it manually:
+
+```bash
+aws eks update-kubeconfig --name rulebricks-cluster --region us-east-1
+```
+
+Use `rulebricks init` with **Use existing Kubernetes cluster** after kubeconfig works.
+
+## Optional Identity Setup
+
+If you use S3 decision-log export or AWS Managed Prometheus remote write, create IAM roles for the Kubernetes service accounts rendered by the CLI:
+
+```bash
+NAMESPACE=rulebricks-demo
+CLUSTER=rulebricks-cluster
+REGION=us-east-1
+ACCOUNT_ID="$(aws sts get-caller-identity --query Account --output text)"
+
+eksctl utils associate-iam-oidc-provider \
+  --cluster "$CLUSTER" \
+  --region "$REGION" \
+  --approve
+
+eksctl create iamserviceaccount \
+  --cluster "$CLUSTER" \
+  --region "$REGION" \
+  --namespace "$NAMESPACE" \
+  --name vector \
+  --attach-policy-arn arn:aws:iam::"$ACCOUNT_ID":policy/<vector-s3-policy> \
+  --role-name rulebricks-vector \
+  --approve
+
+eksctl create iamserviceaccount \
+  --cluster "$CLUSTER" \
+  --region "$REGION" \
+  --namespace "$NAMESPACE" \
+  --name prometheus \
+  --attach-policy-arn arn:aws:iam::aws:policy/AmazonPrometheusRemoteWriteAccess \
+  --role-name rulebricks-prometheus \
+  --approve
+```
+
+Enter the created role ARNs when prompted by the CLI.

package/cluster-setup/aws/check-aws-access.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-us-east-1}}"
+REQUIRED_VCPU=8
+
+require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || {
+    echo "Missing required command: $1" >&2
+    exit 1
+  }
+}
+
+check_aws() {
+  echo "Checking AWS identity..."
+  aws sts get-caller-identity --output table
+  echo
+}
+
+check_permission() {
+  local label="$1"
+  shift
+  if "$@" >/dev/null 2>&1; then
+    echo "OK: $label"
+  else
+    echo "WARN: Could not verify $label"
+    echo "      Command failed: $*"
+  fi
+}
+
+check_quota() {
+  echo "Checking regional on-demand vCPU quota in $REGION..."
+  local quota
+  quota="$(aws service-quotas get-service-quota \
+    --service-code ec2 \
+    --quota-code L-1216C47A \
+    --region "$REGION" \
+    --query 'Quota.Value' \
+    --output text 2>/dev/null || true)"
+
+  if [[ -z "$quota" || "$quota" == "None" ]]; then
+    echo "WARN: Could not read EC2 on-demand vCPU quota."
+    return
+  fi
+
+  local quota_int="${quota%.*}"
+  if (( quota_int < REQUIRED_VCPU )); then
+    echo "WARN: Quota may be too low: ${quota} vCPU available, ${REQUIRED_VCPU}+ recommended for the included cluster config."
+  else
+    echo "OK: EC2 on-demand vCPU quota is ${quota}."
+  fi
+}
+
+require_cmd aws
+require_cmd eksctl
+require_cmd kubectl
+require_cmd helm
+
+echo "Rulebricks AWS access checks"
+echo "Region: $REGION"
+echo
+
+check_aws
+check_permission "EKS access" aws eks list-clusters --region "$REGION"
+check_permission "EC2 VPC access" aws ec2 describe-vpcs --region "$REGION" --max-items 5
+check_permission "IAM access" aws iam get-user
+check_permission "ECR public image pull path" aws ecr-public describe-registries --region us-east-1
+check_quota
+
+echo
+echo "Checking local Kubernetes tools..."
+eksctl version >/dev/null
+kubectl version --client=true >/dev/null
+helm version >/dev/null
+echo "OK: eksctl, kubectl, and Helm are installed."
+
+echo
+echo "AWS access checks completed. Warnings may require cloud-admin review before cluster creation."

package/cluster-setup/aws/cluster.yaml

@@ -0,0 +1,33 @@
+# Minimum eksctl configuration for a Rulebricks EKS cluster.
+# Core knobs: name, region, Kubernetes version, instance type, node count,
+# disk size, and disk type.
+# Nodes must be ARM based. Storage is required; customize Helm storage class
+# values if you use a different CSI driver or StorageClass.
+
+apiVersion: eksctl.io/v1alpha5
+kind: ClusterConfig
+
+metadata:
+  name: rulebricks-cluster
+  region: us-east-1
+  version: "1.34"
+
+managedNodeGroups:
+  - name: standard-nodes
+    instanceType: c8g.large
+    desiredCapacity: 4
+    minSize: 4
+    maxSize: 4
+    volumeSize: 50
+    volumeType: gp3
+    amiFamily: AmazonLinux2023
+    iam:
+      withAddonPolicies:
+        ebs: true
+        albIngress: true
+
+addons:
+  - name: vpc-cni
+  - name: coredns
+  - name: kube-proxy
+  - name: aws-ebs-csi-driver

package/cluster-setup/azure/README.md

@@ -0,0 +1,93 @@
+# Azure Cluster Setup
+
+Use these files to create a minimum AKS cluster that can run Rulebricks without using the Rulebricks CLI Terraform flow.
+
+## Files
+
+- `main.bicep` creates a minimum compatible AKS cluster with ARM64 nodes, Azure CNI, Calico, Standard Load Balancer, Disk CSI, OIDC issuer, and Workload Identity.
+- `main.parameters.json` is a sample Bicep parameter file.
+- `check-aks-prereqs.sh` verifies Azure CLI login, subscription state, provider registration, selected-region quota, resource group access, `kubectl`, and Helm.
+
+## Core Cluster Parameters
+
+- Cluster name: `rulebricks-cluster` (`main.parameters.json` -> `clusterName`)
+- Region: `eastus` (`main.parameters.json` -> `location`)
+- Kubernetes version: `1.34` (`main.parameters.json` -> `kubernetesVersion`)
+- Node count: `4` (`main.parameters.json` -> `nodeCount`)
+- VM size: `Standard_D2ps_v5` (`main.parameters.json` -> `nodeVmSize`)
+- Disk size (GB): `20` (`main.parameters.json` -> `osDiskSizeGB`)
+- Disk type: `Managed` (`main.parameters.json` -> `osDiskType`)
+
+## Parameter Groups
+
+`main.parameters.json` keeps the core cluster shape first, followed by optional Rulebricks identity settings.
+
+- Core cluster parameters: `clusterName`, `location`, `kubernetesVersion`, `nodeCount`, `nodeVmSize`, `osDiskSizeGB`, `osDiskType`.
+- Rulebricks identity parameters: `rulebricksNamespace`, `vectorServiceAccountName`, `prometheusServiceAccountName`, `enableExternalDns`, `dnsZoneResourceGroup`, `enableBlobLogging`, `loggingStorageAccountName`.
+
+## Check Access
+
+```bash
+az login
+az account set --subscription <subscription-id>
+AZURE_LOCATION=eastus bash check-aks-prereqs.sh
+```
+
+If provider registration warnings appear, run the suggested `az provider register` commands and wait for registration to complete.
+
+## Create The Cluster
+
+```bash
+az group create --name rulebricks-rg --location eastus
+az deployment group create \
+  --resource-group rulebricks-rg \
+  --template-file main.bicep \
+  --parameters @main.parameters.json
+```
+
+Then configure kubeconfig:
+
+```bash
+az aks get-credentials --name rulebricks-cluster --resource-group rulebricks-rg
+```
+
+Use `rulebricks init` with **Use existing Kubernetes cluster** after kubeconfig works.
+
+## Notes
+
+- The template creates four `Standard_D2ps_v5` ARM64 nodes, matching the minimum CLI Terraform defaults.
+- Set `rulebricksNamespace` in `main.parameters.json` to the namespace the CLI will use, usually `rulebricks-<deployment-name>`, before enabling Workload Identity integrations.
+- Azure DNS and Blob role assignments are created in the deployment resource group. If your DNS zone or storage account lives elsewhere, have an Azure admin assign `DNS Zone Contributor` or `Storage Blob Data Contributor` to the emitted managed identity client ID.
+
+The deployment outputs `vectorClientId` and `prometheusClientId`. Enter those client IDs in the CLI when configuring Azure Blob decision logs or Azure Monitor remote write with Workload Identity.
+
+## Fallback Secret-Based Auth
+
+If Workload Identity is not available, Azure Blob decision-log export can use a storage account connection string stored in the Rulebricks namespace:
+
+```bash
+kubectl create namespace rulebricks-demo
+kubectl create secret generic azure-blob-logs \
+  --namespace rulebricks-demo \
+  --from-literal=connection-string='<azure-storage-connection-string>'
+```
+
+When prompted by the CLI, enter:
+
+```text
+azure-blob-logs:connection-string
+```
+
+Azure Monitor remote write can also use OAuth client-secret auth as a fallback:
+
+```bash
+kubectl create secret generic azure-monitor-oauth \
+  --namespace rulebricks-demo \
+  --from-literal=client-secret='<client-secret>'
+```
+
+When prompted by the CLI, enter:
+
+```text
+azure-monitor-oauth:client-secret
+```

package/cluster-setup/azure/check-aks-prereqs.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+LOCATION="${AZURE_LOCATION:-eastus}"
+RESOURCE_GROUP="${AZURE_RESOURCE_GROUP:-}"
+REQUIRED_VCPU=8
+REQUIRED_PROVIDERS=(
+  Microsoft.ContainerService
+  Microsoft.Network
+  Microsoft.ManagedIdentity
+  Microsoft.Compute
+  Microsoft.Authorization
+  Microsoft.Storage
+)
+
+require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || {
+    echo "Missing required command: $1" >&2
+    exit 1
+  }
+}
+
+check_provider() {
+  local provider="$1"
+  local state
+  state="$(az provider show --namespace "$provider" --query registrationState --output tsv 2>/dev/null || true)"
+  if [[ "$state" == "Registered" ]]; then
+    echo "OK: $provider is registered"
+  else
+    echo "WARN: $provider is $state. Run: az provider register --namespace $provider"
+  fi
+}
+
+check_quota() {
+  echo "Checking regional vCPU quota in $LOCATION..."
+  local usage
+  local limit
+  usage="$(az vm list-usage --location "$LOCATION" --query "[?name.value=='cores'].currentValue | [0]" --output tsv 2>/dev/null || true)"
+  limit="$(az vm list-usage --location "$LOCATION" --query "[?name.value=='cores'].limit | [0]" --output tsv 2>/dev/null || true)"
+
+  if [[ -z "$usage" || -z "$limit" ]]; then
+    echo "WARN: Could not read regional vCPU quota."
+    return
+  fi
+
+  local available=$((limit - usage))
+  if (( available < REQUIRED_VCPU )); then
+    echo "WARN: ${available}/${limit} vCPUs available; ${REQUIRED_VCPU}+ recommended for the included cluster config."
+  else
+    echo "OK: ${available}/${limit} vCPUs available."
+  fi
+}
+
+check_access() {
+  local label="$1"
+  shift
+  if "$@" >/dev/null 2>&1; then
+    echo "OK: $label"
+  else
+    echo "WARN: Could not verify $label"
+    echo "      Command failed: $*"
+  fi
+}
+
+require_cmd az
+require_cmd kubectl
+require_cmd helm
+
+echo "Rulebricks AKS prerequisite checks"
+echo "Location: $LOCATION"
+echo
+
+echo "Checking Azure account..."
+az account show --query "{name:name,id:id,state:state,tenantId:tenantId}" --output table
+echo
+
+for provider in "${REQUIRED_PROVIDERS[@]}"; do
+  check_provider "$provider"
+done
+
+echo
+check_access "AKS list access" az aks list --output none
+check_access "Subscription deployment read access" az deployment sub list --query "[0].name" --output tsv
+if [[ -n "$RESOURCE_GROUP" ]]; then
+  check_access "Resource group access ($RESOURCE_GROUP)" az group show --name "$RESOURCE_GROUP"
+fi
+check_quota
+
+echo
+echo "Checking local Kubernetes tools..."
+kubectl version --client=true >/dev/null
+helm version >/dev/null
+echo "OK: kubectl and Helm are installed."
+
+echo
+echo "AKS prerequisite checks completed. Warnings may require Azure admin review before cluster creation."

package/cluster-setup/azure/main.bicep

@@ -0,0 +1,282 @@
+targetScope = 'resourceGroup'
+
+@description('Name of the AKS cluster.')
+param clusterName string = 'rulebricks-cluster'
+
+@description('Azure region for all resources.')
+param location string = resourceGroup().location
+
+@description('AKS Kubernetes version.')
+param kubernetesVersion string = '1.34'
+
+@description('Number of nodes in the default node pool.')
+param nodeCount int = 4
+
+@description('VM size for the default node pool. ARM64 (Standard_*ps_*) recommended.')
+param nodeVmSize string = 'Standard_D2ps_v5'
+
+@description('OS disk size in GB for the default node pool.')
+param osDiskSizeGB int = 20
+
+@description('OS disk type for the default node pool.')
+@allowed([
+  'Managed'
+  'Ephemeral'
+])
+param osDiskType string = 'Managed'
+
+@description('Namespace where Rulebricks will be installed. CLI deployments usually use rulebricks-<deployment-name>.')
+param rulebricksNamespace string = 'rulebricks'
+
+@description('Kubernetes ServiceAccount name used by Vector.')
+param vectorServiceAccountName string = 'vector'
+
+@description('Kubernetes ServiceAccount name used by Prometheus.')
+param prometheusServiceAccountName string = 'prometheus'
+
+@description('Enable a user-assigned identity and federated credential for external-dns with Azure DNS.')
+param enableExternalDns bool = false
+
+@description('Resource group containing the Azure DNS zone. Required when enableExternalDns is true.')
+param dnsZoneResourceGroup string = ''
+
+@description('Enable a user-assigned identity and federated credential for Vector Azure Blob logging.')
+param enableBlobLogging bool = false
+
+@description('Existing Azure Storage account name for Vector logs.')
+param loggingStorageAccountName string = ''
+
+var networkContributorRoleId = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')
+var dnsZoneContributorRoleId = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')
+var storageBlobDataContributorRoleId = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')
+
+resource vnet 'Microsoft.Network/virtualNetworks@2023-11-01' = {
+  name: '${clusterName}-vnet'
+  location: location
+  tags: {
+    Environment: 'rulebricks'
+  }
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        '10.0.0.0/8'
+      ]
+    }
+    subnets: [
+      {
+        name: 'aks-subnet'
+        properties: {
+          addressPrefix: '10.240.0.0/16'
+        }
+      }
+    ]
+  }
+}
+
+resource nsg 'Microsoft.Network/networkSecurityGroups@2023-11-01' = {
+  name: '${clusterName}-nsg'
+  location: location
+  tags: {
+    Environment: 'rulebricks'
+  }
+  properties: {
+    securityRules: [
+      {
+        name: 'AllowVNetInbound'
+        properties: {
+          priority: 100
+          direction: 'Inbound'
+          access: 'Allow'
+          protocol: '*'
+          sourcePortRange: '*'
+          destinationPortRange: '*'
+          sourceAddressPrefix: 'VirtualNetwork'
+          destinationAddressPrefix: 'VirtualNetwork'
+        }
+      }
+      {
+        name: 'AllowVNetOutbound'
+        properties: {
+          priority: 100
+          direction: 'Outbound'
+          access: 'Allow'
+          protocol: '*'
+          sourcePortRange: '*'
+          destinationPortRange: '*'
+          sourceAddressPrefix: 'VirtualNetwork'
+          destinationAddressPrefix: 'VirtualNetwork'
+        }
+      }
+    ]
+  }
+}
+
+resource subnet 'Microsoft.Network/virtualNetworks/subnets@2023-11-01' = {
+  parent: vnet
+  name: 'aks-subnet'
+  properties: {
+    addressPrefix: '10.240.0.0/16'
+    networkSecurityGroup: {
+      id: nsg.id
+    }
+  }
+}
+
+resource aksIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
+  name: '${clusterName}-identity'
+  location: location
+}
+
+resource aksNetworkRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(vnet.id, aksIdentity.id, 'Network Contributor')
+  scope: vnet
+  properties: {
+    roleDefinitionId: networkContributorRoleId
+    principalId: aksIdentity.properties.principalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+resource aks 'Microsoft.ContainerService/managedClusters@2024-05-01' = {
+  name: clusterName
+  location: location
+  tags: {
+    Environment: 'rulebricks'
+  }
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: {
+      '${aksIdentity.id}': {}
+    }
+  }
+  properties: {
+    dnsPrefix: clusterName
+    kubernetesVersion: kubernetesVersion
+    agentPoolProfiles: [
+      {
+        name: 'default'
+        count: nodeCount
+        enableAutoScaling: false
+        vmSize: nodeVmSize
+        osDiskSizeGB: osDiskSizeGB
+        osDiskType: osDiskType
+        osType: 'Linux'
+        type: 'VirtualMachineScaleSets'
+        mode: 'System'
+        vnetSubnetID: subnet.id
+        nodeLabels: {
+          environment: 'rulebricks'
+        }
+      }
+    ]
+    networkProfile: {
+      networkPlugin: 'azure'
+      networkPolicy: 'calico'
+      loadBalancerSku: 'standard'
+      serviceCidr: '10.0.0.0/16'
+      dnsServiceIP: '10.0.0.10'
+    }
+    oidcIssuerProfile: {
+      enabled: true
+    }
+    securityProfile: {
+      workloadIdentity: {
+        enabled: true
+      }
+    }
+    storageProfile: {
+      diskCSIDriver: {
+        enabled: true
+      }
+      fileCSIDriver: {
+        enabled: true
+      }
+    }
+  }
+  dependsOn: [
+    aksNetworkRole
+  ]
+}
+
+resource externalDnsIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = if (enableExternalDns) {
+  name: '${clusterName}-external-dns'
+  location: location
+}
+
+resource externalDnsRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (enableExternalDns && (empty(dnsZoneResourceGroup) || dnsZoneResourceGroup == resourceGroup().name)) {
+  name: guid(resourceGroup().id, externalDnsIdentity!.id, 'DNS Zone Contributor')
+  scope: resourceGroup()
+  properties: {
+    roleDefinitionId: dnsZoneContributorRoleId
+    principalId: externalDnsIdentity!.properties.principalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+resource externalDnsFederatedCredential 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2023-01-31' = if (enableExternalDns) {
+  parent: externalDnsIdentity
+  name: 'external-dns'
+  properties: {
+    issuer: aks.properties.oidcIssuerProfile.issuerURL
+    subject: 'system:serviceaccount:${rulebricksNamespace}:external-dns'
+    audiences: [
+      'api://AzureADTokenExchange'
+    ]
+  }
+}
+
+resource vectorIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = if (enableBlobLogging) {
+  name: '${clusterName}-vector'
+  location: location
+}
+
+resource loggingStorageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = if (enableBlobLogging && !empty(loggingStorageAccountName)) {
+  name: loggingStorageAccountName
+}
+
+resource vectorBlobRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (enableBlobLogging && !empty(loggingStorageAccountName)) {
+  name: guid(loggingStorageAccount.id, vectorIdentity!.id, 'Storage Blob Data Contributor')
+  scope: loggingStorageAccount
+  properties: {
+    roleDefinitionId: storageBlobDataContributorRoleId
+    principalId: vectorIdentity!.properties.principalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+resource vectorFederatedCredential 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2023-01-31' = if (enableBlobLogging) {
+  parent: vectorIdentity
+  name: 'vector'
+  properties: {
+    issuer: aks.properties.oidcIssuerProfile.issuerURL
+    subject: 'system:serviceaccount:${rulebricksNamespace}:${vectorServiceAccountName}'
+    audiences: [
+      'api://AzureADTokenExchange'
+    ]
+  }
+}
+
+resource prometheusIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
+  name: '${clusterName}-prometheus'
+  location: location
+}
+
+resource prometheusFederatedCredential 'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials@2023-01-31' = {
+  parent: prometheusIdentity
+  name: 'prometheus'
+  properties: {
+    issuer: aks.properties.oidcIssuerProfile.issuerURL
+    subject: 'system:serviceaccount:${rulebricksNamespace}:${prometheusServiceAccountName}'
+    audiences: [
+      'api://AzureADTokenExchange'
+    ]
+  }
+}
+
+output clusterName string = aks.name
+output resourceGroupName string = resourceGroup().name
+output location string = location
+output kubeconfigCommand string = 'az aks get-credentials --name ${clusterName} --resource-group ${resourceGroup().name}'
+output externalDnsClientId string = enableExternalDns ? externalDnsIdentity!.properties.clientId : ''
+output vectorClientId string = enableBlobLogging ? vectorIdentity!.properties.clientId : ''
+output prometheusClientId string = prometheusIdentity.properties.clientId