@rulebricks/cli 2.1.6 → 2.1.7

package/cluster-setup/azure/main.parameters.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "clusterName": { "value": "rulebricks-cluster" },
+    "location": { "value": "eastus" },
+    "kubernetesVersion": { "value": "1.34" },
+    "nodeCount": { "value": 4 },
+    "nodeVmSize": { "value": "Standard_D2ps_v5" },
+    "osDiskSizeGB": { "value": 20 },
+    "osDiskType": { "value": "Managed" },
+
+    "rulebricksNamespace": { "value": "rulebricks" },
+    "vectorServiceAccountName": { "value": "vector" },
+    "prometheusServiceAccountName": { "value": "prometheus" },
+    "enableExternalDns": { "value": false },
+    "dnsZoneResourceGroup": { "value": "" },
+    "enableBlobLogging": { "value": false },
+    "loggingStorageAccountName": { "value": "" }
+  }
+}

package/cluster-setup/gcp/README.md

@@ -0,0 +1,172 @@
+# GCP Cluster Setup
+
+Use these commands to create a minimum GKE cluster that can run Rulebricks without using the Rulebricks CLI Terraform flow. GCP does not have an `eksctl`-style cluster YAML or a concise Bicep equivalent; the most familiar native interface is `gcloud`.
+
+## Files
+
+- `check-gke-prereqs.sh` verifies `gcloud` auth, Application Default Credentials, required APIs, selected-region quota, GKE access, `kubectl`, and Helm.
+
+## Core Cluster Parameters
+
+- Cluster name: `rulebricks-cluster` (`Core cluster parameters` block -> `CLUSTER_NAME`)
+- Region / zone: `us-central1` / `us-central1-a` (`Core cluster parameters` block -> `REGION` / `ZONE`)
+- Kubernetes version: `1.34` (`Core cluster parameters` block -> `KUBERNETES_VERSION`)
+- Node count: `4` (`Core cluster parameters` block -> `NODE_COUNT`)
+- Machine type: `c4a-standard-2` (`Core cluster parameters` block -> `MACHINE_TYPE`)
+- Disk size (GB): `20` (`Core cluster parameters` block -> `DISK_SIZE`)
+- Disk type: `hyperdisk-balanced` (`Core cluster parameters` block -> `DISK_TYPE`)
+
+## Check Access
+
+```bash
+gcloud auth login
+gcloud config set project <project-id>
+gcloud auth application-default login
+GCP_REGION=us-central1 bash check-gke-prereqs.sh
+```
+
+If API warnings appear, run the suggested `gcloud services enable` commands and wait for enablement to complete.
+
+## Create The Cluster
+
+Set the core cluster parameters. The default example uses `us-central1-a` because it supports C4A ARM64 nodes.
+
+```bash
+PROJECT_ID="$(gcloud config get-value project)"
+CLUSTER_NAME=rulebricks-cluster
+REGION=us-central1
+ZONE=us-central1-a
+KUBERNETES_VERSION="1.34"
+NODE_COUNT=4
+MACHINE_TYPE=c4a-standard-2
+DISK_SIZE=20
+DISK_TYPE=hyperdisk-balanced
+```
+
+Enable required APIs:
+
+```bash
+gcloud services enable \
+  compute.googleapis.com \
+  container.googleapis.com \
+  iam.googleapis.com \
+  cloudresourcemanager.googleapis.com \
+  --project "$PROJECT_ID"
+```
+
+Create the VPC, subnet, NAT, and internal firewall rule:
+
+```bash
+gcloud compute networks create "${CLUSTER_NAME}-vpc" \
+  --project "$PROJECT_ID" \
+  --subnet-mode custom
+
+gcloud compute networks subnets create "${CLUSTER_NAME}-subnet" \
+  --project "$PROJECT_ID" \
+  --region "$REGION" \
+  --network "${CLUSTER_NAME}-vpc" \
+  --range 10.0.0.0/16 \
+  --secondary-range pods=10.1.0.0/16,services=10.2.0.0/16 \
+  --enable-private-ip-google-access
+
+gcloud compute routers create "${CLUSTER_NAME}-router" \
+  --project "$PROJECT_ID" \
+  --region "$REGION" \
+  --network "${CLUSTER_NAME}-vpc"
+
+gcloud compute routers nats create "${CLUSTER_NAME}-nat" \
+  --project "$PROJECT_ID" \
+  --region "$REGION" \
+  --router "${CLUSTER_NAME}-router" \
+  --auto-allocate-nat-external-ips \
+  --nat-all-subnet-ip-ranges
+
+gcloud compute firewall-rules create "${CLUSTER_NAME}-allow-internal" \
+  --project "$PROJECT_ID" \
+  --network "${CLUSTER_NAME}-vpc" \
+  --allow tcp:0-65535,udp:0-65535,icmp \
+  --source-ranges 10.0.0.0/16,10.1.0.0/16,10.2.0.0/16 \
+  --target-tags "gke-${CLUSTER_NAME}"
+```
+
+Create the GKE cluster:
+
+```bash
+gcloud container clusters create "$CLUSTER_NAME" \
+  --project "$PROJECT_ID" \
+  --region "$REGION" \
+  --node-locations "$ZONE" \
+  --cluster-version "$KUBERNETES_VERSION" \
+  --release-channel regular \
+  --network "${CLUSTER_NAME}-vpc" \
+  --subnetwork "${CLUSTER_NAME}-subnet" \
+  --enable-ip-alias \
+  --cluster-secondary-range-name pods \
+  --services-secondary-range-name services \
+  --enable-private-nodes \
+  --master-ipv4-cidr 172.16.0.0/28 \
+  --enable-master-authorized-networks \
+  --master-authorized-networks 0.0.0.0/0 \
+  --workload-pool "${PROJECT_ID}.svc.id.goog" \
+  --enable-network-policy \
+  --addons HttpLoadBalancing,HorizontalPodAutoscaling,GcePersistentDiskCsiDriver \
+  --node-pool rulebricks-nodes \
+  --machine-type "$MACHINE_TYPE" \
+  --num-nodes "$NODE_COUNT" \
+  --disk-type "$DISK_TYPE" \
+  --disk-size "$DISK_SIZE" \
+  --scopes cloud-platform \
+  --workload-metadata GKE_METADATA \
+  --enable-autorepair \
+  --enable-autoupgrade \
+  --node-labels environment=rulebricks \
+  --tags "gke-${CLUSTER_NAME}"
+```
+
+Configure kubeconfig:
+
+```bash
+gcloud container clusters get-credentials "$CLUSTER_NAME" \
+  --region "$REGION" \
+  --project "$PROJECT_ID"
+```
+
+Use `rulebricks init` with **Use existing Kubernetes cluster** after kubeconfig works.
+
+## Optional Identity Setup
+
+If you use GCS decision-log export, bind the `vector` Kubernetes service account to a Google service account that can write to the bucket:
+
+```bash
+NAMESPACE=rulebricks-demo
+PROJECT_ID="$(gcloud config get-value project)"
+GSA=rulebricks-vector@"$PROJECT_ID".iam.gserviceaccount.com
+
+gcloud iam service-accounts create rulebricks-vector \
+  --project "$PROJECT_ID"
+
+gcloud storage buckets add-iam-policy-binding gs://<bucket-name> \
+  --member "serviceAccount:$GSA" \
+  --role roles/storage.objectCreator
+
+gcloud iam service-accounts add-iam-policy-binding "$GSA" \
+  --project "$PROJECT_ID" \
+  --role roles/iam.workloadIdentityUser \
+  --member "serviceAccount:$PROJECT_ID.svc.id.goog[$NAMESPACE/vector]"
+```
+
+Annotate the service account after the Rulebricks namespace exists:
+
+```bash
+kubectl annotate serviceaccount vector \
+  --namespace "$NAMESPACE" \
+  iam.gke.io/gcp-service-account="$GSA"
+```
+
+Enter the Google service account email when prompted by the CLI.
+
+## Notes
+
+- The example creates four `c4a-standard-2` ARM64 nodes with `hyperdisk-balanced`, matching the minimum CLI Terraform defaults.
+- C4A availability varies by region and zone. If you change `REGION`, choose a `ZONE` where C4A is available.
+- Regional GKE clusters can multiply node counts across node locations. This example pins one node location to keep the minimum cluster shape predictable.

package/cluster-setup/gcp/check-gke-prereqs.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PROJECT_ID="${GOOGLE_CLOUD_PROJECT:-$(gcloud config get-value project 2>/dev/null || true)}"
+REGION="${GCP_REGION:-us-central1}"
+REQUIRED_VCPU=8
+REQUIRED_APIS=(
+  compute.googleapis.com
+  container.googleapis.com
+  iam.googleapis.com
+  cloudresourcemanager.googleapis.com
+)
+
+require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || {
+    echo "Missing required command: $1" >&2
+    exit 1
+  }
+}
+
+check_api() {
+  local api="$1"
+  if gcloud services list \
+    --project "$PROJECT_ID" \
+    --enabled \
+    --filter="name:${api}" \
+    --format="value(name)" | awk -v api="$api" '$0 ~ api { found=1 } END { exit found ? 0 : 1 }'; then
+    echo "OK: $api is enabled"
+  else
+    echo "WARN: $api is not enabled. Run: gcloud services enable $api --project $PROJECT_ID"
+  fi
+}
+
+check_quota() {
+  echo "Checking regional CPU quota in $REGION..."
+  local quota_line
+  quota_line="$(gcloud compute regions describe "$REGION" \
+    --project "$PROJECT_ID" \
+    --format="csv[no-heading](quotas.metric,quotas.limit,quotas.usage)" 2>/dev/null \
+    | awk -F, '$1=="CPUS"{print $2 "," $3; exit}' || true)"
+
+  if [[ -z "$quota_line" ]]; then
+    echo "WARN: Could not read regional CPU quota."
+    return
+  fi
+
+  local limit="${quota_line%,*}"
+  local usage="${quota_line#*,}"
+  local available
+  available="$(awk -v limit="$limit" -v usage="$usage" 'BEGIN { printf "%d", limit - usage }')"
+
+  if (( available < REQUIRED_VCPU )); then
+    echo "WARN: ${available}/${limit} CPUs available; ${REQUIRED_VCPU}+ recommended for the included cluster commands."
+  else
+    echo "OK: ${available}/${limit} CPUs available."
+  fi
+}
+
+require_cmd gcloud
+require_cmd kubectl
+require_cmd helm
+require_cmd awk
+
+if [[ -z "$PROJECT_ID" ]]; then
+  echo "No GCP project configured. Run: gcloud config set project PROJECT_ID" >&2
+  exit 1
+fi
+
+echo "Rulebricks GKE prerequisite checks"
+echo "Project: $PROJECT_ID"
+echo "Region: $REGION"
+echo
+
+echo "Checking gcloud account..."
+gcloud auth list --filter=status:ACTIVE --format="value(account)"
+gcloud auth application-default print-access-token >/dev/null
+echo "OK: gcloud auth and Application Default Credentials are available."
+echo
+
+for api in "${REQUIRED_APIS[@]}"; do
+  check_api "$api"
+done
+
+echo
+gcloud compute regions describe "$REGION" --project "$PROJECT_ID" >/dev/null
+echo "OK: region $REGION is accessible."
+gcloud container clusters list --region "$REGION" --project "$PROJECT_ID" >/dev/null
+echo "OK: GKE cluster list access works."
+check_quota
+
+echo
+echo "Checking local Kubernetes tools..."
+kubectl version --client=true >/dev/null
+helm version >/dev/null
+echo "OK: kubectl and Helm are installed."
+
+echo
+echo "GKE prerequisite checks completed. Warnings may require GCP project-admin review before cluster creation."

package/dist/commands/init.js

@@ -6,6 +6,7 @@ import { DeploymentModeStep, CloudProviderStep, DomainStep, SMTPStep, DatabaseSt
 import { AppShell, ProgressHeader, ThemeProvider, useTheme, Logo, LOGO_LINES, } from "../components/common/index.js";
 import { saveDeploymentConfig, deploymentExists, loadProfile, updateProfile, extractProfileFromConfig, } from "../lib/config.js";
 import { generateHelmValues } from "../lib/helmValues.js";
+import { inferClusterTier } from "../lib/kubernetes.js";
 const STEP_INFO = {
     mode: { title: "Deployment Mode", description: "Choose how to deploy" },
     cloud: { title: "Cloud Provider", description: "Select your cloud provider" },
@@ -65,7 +66,10 @@ function WizardStepController({ onSaveComplete }) {
         if (state.databaseType === "self-hosted") {
             steps.push("database-creds");
         }
-        steps.push("tier", "features");
+        if (state.infrastructureMode === "provision") {
+            steps.push("tier");
+        }
+        steps.push("features");
         // Feature config only if AI, SSO, monitoring, external logging, or custom emails enabled
         if (state.aiEnabled ||
             state.ssoEnabled ||
@@ -107,7 +111,10 @@ function WizardStepController({ onSaveComplete }) {
         setPendingNav("back");
     }, []);
     const handleSave = useCallback(async () => {
-        const config = toConfig();
+        const inferredTier = state.infrastructureMode === "existing"
+            ? (await inferClusterTier()) || state.tier || "small"
+            : state.tier || undefined;
+        const config = toConfig({ tier: inferredTier });
         if (!config) {
             setError("Invalid configuration - please check all required fields");
             return;

package/dist/components/Wizard/WizardContext.d.ts

@@ -1,5 +1,5 @@
 import React, { ReactNode } from "react";
-import { DeploymentConfig, CloudProvider, DatabaseType, PerformanceTier, SSOProvider, DnsProvider, LoggingSink, EmailSubjects, EmailTemplates, ProfileConfig } from "../../types/index.js";
+import { DeploymentConfig, CloudProvider, DatabaseType, PerformanceTier, SSOProvider, DnsProvider, LoggingSink, CloudLoggingAuthMode, MonitoringDestination, RemoteWriteAuthType, RemoteWriteDestination, EmailSubjects, EmailTemplates, ProfileConfig } from "../../types/index.js";
 export interface WizardState {
     step: number;
     name: string;
@@ -40,10 +40,29 @@ export interface WizardState {
     ssoClientId: string;
     ssoClientSecret: string;
     monitoringEnabled: boolean;
+    prometheusMonitoringDestination: MonitoringDestination | null;
     prometheusRemoteWriteUrl: string;
+    prometheusRemoteWriteDestination: RemoteWriteDestination | null;
+    prometheusRemoteWriteAuthType: RemoteWriteAuthType | null;
+    prometheusRemoteWriteAwsRegion: string;
+    prometheusRemoteWriteAwsRoleArn: string;
+    prometheusRemoteWriteAzureCloud: "AzurePublic" | "AzureChina" | "AzureGovernment";
+    prometheusRemoteWriteClientId: string;
+    prometheusRemoteWriteTenantId: string;
+    prometheusRemoteWriteSecretRef: string;
+    prometheusRemoteWriteUsernameSecretRef: string;
+    prometheusRemoteWritePasswordSecretRef: string;
+    prometheusRemoteWriteBearerTokenSecretRef: string;
     loggingSink: LoggingSink;
     loggingBucket: string;
     loggingRegion: string;
+    loggingCloudAuthMode: CloudLoggingAuthMode;
+    loggingAwsIamRoleArn: string;
+    loggingAzureBlobContainer: string;
+    loggingAzureBlobClientId: string;
+    loggingAzureBlobTenantId: string;
+    loggingAzureBlobConnectionStringSecretRef: string;
+    loggingGcpServiceAccountEmail: string;
     customEmailsEnabled: boolean;
     emailSubjects: EmailSubjects;
     emailTemplates: EmailTemplates;
@@ -127,12 +146,15 @@ type WizardAction = {
 } | {
     type: "SET_PROMETHEUS_REMOTE_WRITE";
     url: string;
+} | {
+    type: "SET_PROMETHEUS_REMOTE_WRITE_CONFIG";
+    config: Partial<Pick<WizardState, "prometheusMonitoringDestination" | "prometheusRemoteWriteDestination" | "prometheusRemoteWriteAuthType" | "prometheusRemoteWriteAwsRegion" | "prometheusRemoteWriteAwsRoleArn" | "prometheusRemoteWriteAzureCloud" | "prometheusRemoteWriteClientId" | "prometheusRemoteWriteTenantId" | "prometheusRemoteWriteSecretRef" | "prometheusRemoteWriteUsernameSecretRef" | "prometheusRemoteWritePasswordSecretRef" | "prometheusRemoteWriteBearerTokenSecretRef">>;
 } | {
     type: "SET_LOGGING_SINK";
     sink: LoggingSink;
 } | {
     type: "SET_LOGGING_CONFIG";
-    config: Partial<Pick<WizardState, "loggingBucket" | "loggingRegion">>;
+    config: Partial<Pick<WizardState, "loggingBucket" | "loggingRegion" | "loggingCloudAuthMode" | "loggingAwsIamRoleArn" | "loggingAzureBlobContainer" | "loggingAzureBlobClientId" | "loggingAzureBlobTenantId" | "loggingAzureBlobConnectionStringSecretRef" | "loggingGcpServiceAccountEmail">>;
 } | {
     type: "SET_CUSTOM_EMAILS_ENABLED";
     enabled: boolean;
@@ -160,7 +182,9 @@ type WizardAction = {
 interface WizardContextValue {
     state: WizardState;
     dispatch: React.Dispatch<WizardAction>;
-    toConfig: () => DeploymentConfig | null;
+    toConfig: (options?: {
+        tier?: PerformanceTier;
+    }) => DeploymentConfig | null;
     skipToStep: (stepId: string) => void;
     profile: ProfileConfig | null;
     /** Suggests a domain based on the profile's domain suffix and deployment name */

package/dist/components/Wizard/WizardContext.js

@@ -55,11 +55,30 @@ function getInitialState(profile) {
         ssoClientSecret: profile?.ssoClientSecret ?? "",
         // Features - Monitoring
         monitoringEnabled: false,
+        prometheusMonitoringDestination: null,
         prometheusRemoteWriteUrl: "",
+        prometheusRemoteWriteDestination: null,
+        prometheusRemoteWriteAuthType: null,
+        prometheusRemoteWriteAwsRegion: "",
+        prometheusRemoteWriteAwsRoleArn: "",
+        prometheusRemoteWriteAzureCloud: "AzurePublic",
+        prometheusRemoteWriteClientId: "",
+        prometheusRemoteWriteTenantId: "",
+        prometheusRemoteWriteSecretRef: "",
+        prometheusRemoteWriteUsernameSecretRef: "",
+        prometheusRemoteWritePasswordSecretRef: "",
+        prometheusRemoteWriteBearerTokenSecretRef: "",
         // Features - Logging
         loggingSink: "console", // Default to console only
         loggingBucket: "",
         loggingRegion: "",
+        loggingCloudAuthMode: "workload-identity",
+        loggingAwsIamRoleArn: "",
+        loggingAzureBlobContainer: "rulebricks-logs",
+        loggingAzureBlobClientId: "",
+        loggingAzureBlobTenantId: "",
+        loggingAzureBlobConnectionStringSecretRef: "",
+        loggingGcpServiceAccountEmail: "",
         // Features - Custom Email Templates
         customEmailsEnabled: false,
         emailSubjects: { ...DEFAULT_EMAIL_SUBJECTS },
@@ -79,6 +98,12 @@ function getInitialState(profile) {
 }
 // Default initial state (for backwards compatibility)
 const initialState = getInitialState();
+function parseSecretKeyRef(value) {
+    const [name, key] = value.split(":").map((part) => part.trim());
+    if (!name || !key)
+        return undefined;
+    return { name, key };
+}
 function wizardReducer(state, action) {
     switch (action.type) {
         case "SET_STEP":
@@ -136,6 +161,8 @@ function wizardReducer(state, action) {
             return { ...state, monitoringEnabled: action.enabled };
         case "SET_PROMETHEUS_REMOTE_WRITE":
             return { ...state, prometheusRemoteWriteUrl: action.url };
+        case "SET_PROMETHEUS_REMOTE_WRITE_CONFIG":
+            return { ...state, ...action.config };
         case "SET_LOGGING_SINK":
             // Reset bucket/region if switching to console
             return {
@@ -183,7 +210,7 @@ export function WizardProvider({ children, initialName, profile, }) {
         ...getInitialState(profile),
         name: initialName || "",
     });
-    const toConfig = () => {
+    const toConfig = (options = {}) => {
         // Validate required fields
         if (!state.name ||
             !state.domain ||
@@ -216,6 +243,45 @@ export function WizardProvider({ children, initialName, profile, }) {
         if (state.loggingSink !== "console" && !state.loggingBucket) {
             return null;
         }
+        if (state.loggingSink === "azure-blob" &&
+            (!state.loggingAzureBlobContainer ||
+                (state.loggingCloudAuthMode === "workload-identity" &&
+                    (!state.loggingAzureBlobClientId || !state.loggingAzureBlobTenantId)) ||
+                (state.loggingCloudAuthMode === "secret" &&
+                    !parseSecretKeyRef(state.loggingAzureBlobConnectionStringSecretRef)))) {
+            return null;
+        }
+        if (state.loggingSink === "s3" && !state.loggingAwsIamRoleArn) {
+            return null;
+        }
+        if (state.loggingSink === "gcs" && !state.loggingGcpServiceAccountEmail) {
+            return null;
+        }
+        const remoteWrite = state.monitoringEnabled &&
+            state.prometheusMonitoringDestination !== "local-grafana" &&
+            state.prometheusRemoteWriteDestination &&
+            state.prometheusRemoteWriteUrl
+            ? {
+                destination: state.prometheusRemoteWriteDestination,
+                url: state.prometheusRemoteWriteUrl,
+                authType: state.prometheusRemoteWriteAuthType || undefined,
+                awsRegion: state.prometheusRemoteWriteDestination === "aws-amp"
+                    ? state.prometheusRemoteWriteAwsRegion ||
+                        state.region ||
+                        undefined
+                    : undefined,
+                awsRoleArn: state.prometheusRemoteWriteDestination === "aws-amp"
+                    ? state.prometheusRemoteWriteAwsRoleArn || undefined
+                    : undefined,
+                azureCloud: state.prometheusRemoteWriteAzureCloud,
+                clientId: state.prometheusRemoteWriteClientId || undefined,
+                tenantId: state.prometheusRemoteWriteTenantId || undefined,
+                clientSecretRef: parseSecretKeyRef(state.prometheusRemoteWriteSecretRef),
+                usernameSecretRef: parseSecretKeyRef(state.prometheusRemoteWriteUsernameSecretRef),
+                passwordSecretRef: parseSecretKeyRef(state.prometheusRemoteWritePasswordSecretRef),
+                bearerTokenSecretRef: parseSecretKeyRef(state.prometheusRemoteWriteBearerTokenSecretRef),
+            }
+            : undefined;
         return {
             name: state.name,
             infrastructure: {
@@ -254,7 +320,7 @@ export function WizardProvider({ children, initialName, profile, }) {
                 supabaseDashboardUser: state.supabaseDashboardUser || undefined,
                 supabaseDashboardPass: state.supabaseDashboardPass || undefined,
             },
-            tier: state.tier || "small",
+            tier: options.tier || state.tier || "small",
             features: {
                 ai: {
                     enabled: state.aiEnabled,
@@ -269,12 +335,39 @@ export function WizardProvider({ children, initialName, profile, }) {
                 },
                 monitoring: {
                     enabled: state.monitoringEnabled,
+                    destination: state.prometheusMonitoringDestination ||
+                        remoteWrite?.destination ||
+                        undefined,
                     remoteWriteUrl: state.prometheusRemoteWriteUrl || undefined,
+                    remoteWrite,
                 },
                 logging: {
                     sink: state.loggingSink,
                     bucket: state.loggingBucket || undefined,
                     region: state.loggingRegion || undefined,
+                    cloudAuthMode: state.loggingSink === "s3" ||
+                        state.loggingSink === "azure-blob" ||
+                        state.loggingSink === "gcs"
+                        ? state.loggingCloudAuthMode
+                        : undefined,
+                    awsIamRoleArn: state.loggingSink === "s3"
+                        ? state.loggingAwsIamRoleArn || undefined
+                        : undefined,
+                    azureBlobContainer: state.loggingSink === "azure-blob"
+                        ? state.loggingAzureBlobContainer || undefined
+                        : undefined,
+                    azureBlobClientId: state.loggingSink === "azure-blob"
+                        ? state.loggingAzureBlobClientId || undefined
+                        : undefined,
+                    azureBlobTenantId: state.loggingSink === "azure-blob"
+                        ? state.loggingAzureBlobTenantId || undefined
+                        : undefined,
+                    azureBlobConnectionStringSecretRef: state.loggingSink === "azure-blob"
+                        ? parseSecretKeyRef(state.loggingAzureBlobConnectionStringSecretRef)
+                        : undefined,
+                    gcpServiceAccountEmail: state.loggingSink === "gcs"
+                        ? state.loggingGcpServiceAccountEmail || undefined
+                        : undefined,
                 },
                 customEmails: state.customEmailsEnabled
                     ? {

package/dist/components/Wizard/steps/CloudProviderStep.js

@@ -78,7 +78,12 @@ export function CloudProviderStep({ onComplete, onBack, }) {
         ];
         return providers.map((p) => ({
             ...p,
-            disabled: !p.status.installed || !p.status.authenticated,
+            // Existing clusters only need a selectable provider so we can record
+            // kubeconfig refresh details. Strict auth/quota checks are only required
+            // when the CLI will provision infrastructure.
+            disabled: needsTerraform
+                ? !p.status.installed || !p.status.authenticated
+                : !p.status.installed,
         }));
     };
     const providerItems = getProviderItems();
@@ -215,7 +220,7 @@ export function CloudProviderStep({ onComplete, onBack, }) {
                                     ? colors.accent
                                     : undefined;
                             return (_jsxs(Box, { children: [_jsxs(Text, { color: textColor, dimColor: item.disabled, children: [isSelected && !item.disabled ? "❯ " : "  ", label] }), renderStatusIndicator(item.status), item.status.identity && item.status.authenticated && (_jsxs(Text, { color: "gray", dimColor: true, children: [" ", "(", item.status.identity, ")"] }))] }));
-                        } })] })), subStep === "gcp-project" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Enter your GCP Project ID:" }), gcpProject && (_jsxs(Text, { color: "gray", dimColor: true, children: ["Detected project: ", gcpProject] })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.accent, children: "\u276F " }), _jsx(TextInput, { value: gcpProject, onChange: setGcpProject, onSubmit: handleGcpProjectSubmit, placeholder: "my-gcp-project" })] })] })), subStep === "azure-rg" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Enter your Azure Resource Group name:" }), _jsx(Text, { color: "gray", dimColor: true, children: "This resource group will contain all Rulebricks resources" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.accent, children: "\u276F " }), _jsx(TextInput, { value: azureRg, onChange: setAzureRg, onSubmit: handleAzureRgSubmit, placeholder: "rulebricks-rg" })] })] })), subStep === "region-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: `Fetching ${state.provider?.toUpperCase()} regions...` }) })), subStep === "region" && (_jsxs(_Fragment, { children: [_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsxs(Text, { children: ["Select a region for ", state.provider?.toUpperCase(), ":"] }), _jsxs(Text, { color: "gray", dimColor: true, children: [regions.length, " regions available"] })] }), _jsx(Box, { height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: regionItems, onSelect: handleRegionSelect, limit: 8, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) })] })), subStep === "cluster-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: `Fetching ${state.provider?.toUpperCase()} clusters in ${state.region}...` }) })), subStep === "cluster-select" && (_jsxs(_Fragment, { children: [_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Select your Kubernetes cluster:" }), _jsxs(Text, { color: "gray", dimColor: true, children: [clusters.length, " cluster", clusters.length !== 1 ? "s" : "", " found in ", state.region] })] }), _jsx(Box, { height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: clusters.map((c) => ({ label: c, value: c })), onSelect: handleClusterSelect, limit: 8, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }), state.provider && state.region && (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" ", state.provider?.toUpperCase(), " \u2022 ", state.region] })] }))] })), subStep === "cluster" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Enter the Kubernetes cluster name:" }), _jsx(Text, { color: "gray", dimColor: true, children: state.infrastructureMode === "provision"
+                        } })] })), subStep === "gcp-project" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Enter your GCP Project ID:" }), gcpProject && (_jsxs(Text, { color: "gray", dimColor: true, children: ["Detected project: ", gcpProject] })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.accent, children: "\u276F " }), _jsx(TextInput, { value: gcpProject, onChange: setGcpProject, onSubmit: handleGcpProjectSubmit, placeholder: "my-gcp-project" })] })] })), subStep === "azure-rg" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Enter your Azure Resource Group name:" }), _jsx(Text, { color: "gray", dimColor: true, children: "This should be the resource group containing your AKS cluster" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.accent, children: "\u276F " }), _jsx(TextInput, { value: azureRg, onChange: setAzureRg, onSubmit: handleAzureRgSubmit, placeholder: "rulebricks-rg" })] })] })), subStep === "region-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: `Fetching ${state.provider?.toUpperCase()} regions...` }) })), subStep === "region" && (_jsxs(_Fragment, { children: [_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsxs(Text, { children: ["Select a region for ", state.provider?.toUpperCase(), ":"] }), _jsxs(Text, { color: "gray", dimColor: true, children: [regions.length, " regions available"] })] }), _jsx(Box, { height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: regionItems, onSelect: handleRegionSelect, limit: 8, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) })] })), subStep === "cluster-loading" && (_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Spinner, { label: `Fetching ${state.provider?.toUpperCase()} clusters in ${state.region}...` }) })), subStep === "cluster-select" && (_jsxs(_Fragment, { children: [_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Select your Kubernetes cluster:" }), _jsxs(Text, { color: "gray", dimColor: true, children: [clusters.length, " cluster", clusters.length !== 1 ? "s" : "", " found in ", state.region] })] }), _jsx(Box, { height: 10, flexDirection: "column", overflowY: "hidden", children: _jsx(SelectInput, { items: clusters.map((c) => ({ label: c, value: c })), onSelect: handleClusterSelect, limit: 8, indicatorComponent: () => null, itemComponent: ({ isSelected, label }) => (_jsxs(Text, { color: isSelected ? colors.accent : undefined, children: [isSelected ? "❯ " : "  ", label] })) }) }), state.provider && state.region && (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: colors.success, children: "\u2713" }), _jsxs(Text, { color: "gray", children: [" ", state.provider?.toUpperCase(), " \u2022 ", state.region] })] }))] })), subStep === "cluster" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Enter the Kubernetes cluster name:" }), _jsx(Text, { color: "gray", dimColor: true, children: state.infrastructureMode === "provision"
                             ? "This cluster will be created"
                             : clusters.length === 0 && state.infrastructureMode === "existing"
                                 ? "No clusters found in this region - enter the name manually"