@rulebricks/cli 2.1.6 → 2.1.7

package/dist/lib/helmValues.js

@@ -36,17 +36,39 @@ function generateVectorSinks(config) {
                 };
                 break;
             case "azure-blob":
-                sinks.azure_blob = {
+                if (!bucket) {
+                    throw new Error("Azure Blob logging requires a storage account.");
+                }
+                const azureBlobSink = {
                     type: "azure_blob",
                     inputs: ["kafka"],
-                    container_name: bucket,
-                    storage_account: "rulebrickslogs", // Will be configured via env var
+                    account_name: bucket,
+                    container_name: config.features.logging.azureBlobContainer || "rulebricks-logs",
                     blob_prefix: "rulebricks/logs/%Y/%m/%d/",
                     compression: "gzip",
                     encoding: {
                         codec: "json",
                     },
                 };
+                if (config.features.logging.cloudAuthMode === "secret") {
+                    if (!config.features.logging.azureBlobConnectionStringSecretRef) {
+                        throw new Error("Azure Blob connection string auth requires a secret ref.");
+                    }
+                    azureBlobSink.connection_string = "${AZURE_STORAGE_CONNECTION_STRING}";
+                }
+                else {
+                    if (!config.features.logging.azureBlobClientId ||
+                        !config.features.logging.azureBlobTenantId) {
+                        throw new Error("Azure Blob workload identity requires client ID and tenant ID.");
+                    }
+                    azureBlobSink.auth = {
+                        azure_credential_kind: "workload_identity",
+                        client_id: config.features.logging.azureBlobClientId,
+                        tenant_id: config.features.logging.azureBlobTenantId,
+                        token_file_path: "/var/run/secrets/azure/tokens/azure-identity-token",
+                    };
+                }
+                sinks.azure_blob = azureBlobSink;
                 break;
             case "gcs":
                 sinks.gcs = {
@@ -163,6 +185,61 @@ function generateVectorSinks(config) {
     }
     return sinks;
 }
+function generateVectorEnv(config) {
+    const env = [
+        {
+            name: "KAFKA_BOOTSTRAP_SERVERS",
+            valueFrom: {
+                configMapKeyRef: {
+                    name: "vector-kafka-env",
+                    key: "KAFKA_BOOTSTRAP_SERVERS",
+                },
+            },
+        },
+    ];
+    const azureBlobSecretRef = config.features.logging.azureBlobConnectionStringSecretRef;
+    if (config.features.logging.sink === "azure-blob" &&
+        config.features.logging.cloudAuthMode === "secret" &&
+        azureBlobSecretRef) {
+        env.push({
+            name: "AZURE_STORAGE_CONNECTION_STRING",
+            valueFrom: {
+                secretKeyRef: secretKeySelector(azureBlobSecretRef),
+            },
+        });
+    }
+    return env;
+}
+function generateVectorServiceAccount(config) {
+    const annotations = {};
+    if (config.features.logging.sink === "s3" && config.features.logging.awsIamRoleArn) {
+        annotations["eks.amazonaws.com/role-arn"] =
+            config.features.logging.awsIamRoleArn;
+    }
+    if (config.features.logging.sink === "azure-blob" &&
+        config.features.logging.cloudAuthMode !== "secret" &&
+        config.features.logging.azureBlobClientId) {
+        annotations["azure.workload.identity/client-id"] =
+            config.features.logging.azureBlobClientId;
+    }
+    if (config.features.logging.sink === "gcs" && config.features.logging.gcpServiceAccountEmail) {
+        annotations["iam.gke.io/gcp-service-account"] =
+            config.features.logging.gcpServiceAccountEmail;
+    }
+    return {
+        create: true,
+        name: "vector",
+        annotations,
+    };
+}
+function generateVectorPodLabels(config) {
+    const labels = {};
+    if (config.features.logging.sink === "azure-blob" &&
+        config.features.logging.cloudAuthMode !== "secret") {
+        labels["azure.workload.identity/use"] = "true";
+    }
+    return labels;
+}
 /**
  * Maps DNS provider to external-dns provider name
  */
@@ -175,6 +252,145 @@ function getExternalDnsProvider(dnsProvider) {
     };
     return mapping[dnsProvider] || "aws";
 }
+function secretKeySelector(ref) {
+    return {
+        name: ref.name,
+        key: ref.key,
+    };
+}
+function generateRemoteWriteSpec(config) {
+    if (config.features.monitoring.destination === "local-grafana") {
+        return [];
+    }
+    const remoteWrite = config.features.monitoring.remoteWrite;
+    if (!remoteWrite) {
+        return config.features.monitoring.remoteWriteUrl
+            ? [{ url: config.features.monitoring.remoteWriteUrl }]
+            : [];
+    }
+    const base = {
+        url: remoteWrite.url,
+    };
+    switch (remoteWrite.destination) {
+        case "aws-amp":
+            if (!remoteWrite.awsRegion) {
+                throw new Error("AWS Managed Prometheus remote_write requires a region.");
+            }
+            return [
+                {
+                    ...base,
+                    sigv4: {
+                        region: remoteWrite.awsRegion,
+                    },
+                },
+            ];
+        case "azure-monitor":
+            return [generateAzureMonitorRemoteWrite(remoteWrite, base)];
+        case "grafana-cloud":
+            return [generateBasicAuthRemoteWrite(remoteWrite, base)];
+        case "generic":
+            return [generateGenericRemoteWrite(remoteWrite, base)];
+        default:
+            return [base];
+    }
+}
+function generatePrometheusServiceAccount(config) {
+    const annotations = {};
+    const remoteWrite = config.features.monitoring.remoteWrite;
+    if (remoteWrite?.destination === "aws-amp" && remoteWrite.awsRoleArn) {
+        annotations["eks.amazonaws.com/role-arn"] = remoteWrite.awsRoleArn;
+    }
+    if (remoteWrite?.destination === "azure-monitor" &&
+        remoteWrite.authType === "workload-identity" &&
+        remoteWrite.clientId) {
+        annotations["azure.workload.identity/client-id"] = remoteWrite.clientId;
+    }
+    return {
+        create: true,
+        name: "prometheus",
+        annotations,
+    };
+}
+function generatePrometheusPodMetadata(config) {
+    const remoteWrite = config.features.monitoring.remoteWrite;
+    if (remoteWrite?.destination === "azure-monitor" &&
+        remoteWrite.authType === "workload-identity") {
+        return {
+            labels: {
+                "azure.workload.identity/use": "true",
+            },
+        };
+    }
+    return {};
+}
+function generateAzureMonitorRemoteWrite(remoteWrite, base) {
+    const azureAd = {
+        cloud: remoteWrite.azureCloud || "AzurePublic",
+    };
+    if (remoteWrite.authType === "oauth") {
+        if (!remoteWrite.clientId ||
+            !remoteWrite.tenantId ||
+            !remoteWrite.clientSecretRef) {
+            throw new Error("Azure Monitor remote_write OAuth requires client ID, tenant ID, and client secret ref.");
+        }
+        azureAd.oauth = {
+            clientId: remoteWrite.clientId,
+            tenantId: remoteWrite.tenantId,
+            clientSecret: secretKeySelector(remoteWrite.clientSecretRef),
+        };
+    }
+    else if (remoteWrite.authType === "workload-identity") {
+        if (!remoteWrite.clientId || !remoteWrite.tenantId) {
+            throw new Error("Azure Monitor remote_write workload identity requires client ID and tenant ID.");
+        }
+        azureAd.workloadIdentity = {
+            clientId: remoteWrite.clientId,
+            tenantId: remoteWrite.tenantId,
+        };
+    }
+    else {
+        if (!remoteWrite.clientId) {
+            throw new Error("Azure Monitor remote_write managed identity requires client ID.");
+        }
+        azureAd.managedIdentity = {
+            clientId: remoteWrite.clientId,
+        };
+    }
+    return {
+        ...base,
+        azureAd,
+    };
+}
+function generateBasicAuthRemoteWrite(remoteWrite, base) {
+    if (!remoteWrite.usernameSecretRef || !remoteWrite.passwordSecretRef) {
+        throw new Error("Basic auth remote_write requires username and password secret refs.");
+    }
+    return {
+        ...base,
+        basicAuth: {
+            username: secretKeySelector(remoteWrite.usernameSecretRef),
+            password: secretKeySelector(remoteWrite.passwordSecretRef),
+        },
+    };
+}
+function generateGenericRemoteWrite(remoteWrite, base) {
+    if (remoteWrite.authType === "basic") {
+        return generateBasicAuthRemoteWrite(remoteWrite, base);
+    }
+    if (remoteWrite.authType === "bearer") {
+        if (!remoteWrite.bearerTokenSecretRef) {
+            throw new Error("Bearer remote_write requires a token secret ref.");
+        }
+        return {
+            ...base,
+            authorization: {
+                type: "Bearer",
+                credentials: secretKeySelector(remoteWrite.bearerTokenSecretRef),
+            },
+        };
+    }
+    return base;
+}
 /**
  * Generates Kafka extra environment variables for tuning
  */
@@ -205,6 +421,7 @@ function generateKafkaExtraEnvVars() {
 export async function generateHelmValues(config, options = {}) {
     const tierConfig = TIER_CONFIGS[config.tier];
     const { tlsEnabled = true } = options;
+    const useLocalGrafana = config.features.monitoring.destination === "local-grafana";
     // Determine if external-dns should be enabled
     const externalDnsEnabled = config.dns.autoManage && isSupportedDnsProvider(config.dns.provider);
     // Determine storage class based on provider
@@ -501,22 +718,14 @@ export async function generateHelmValues(config, options = {}) {
             replicas: tierConfig.vectorReplicas,
             resources: tierConfig.vectorResources,
             tolerations: arm64Tolerations,
+            serviceAccount: generateVectorServiceAccount(config),
+            podLabels: generateVectorPodLabels(config),
             service: {
                 enabled: true,
                 ports: [{ name: "api", port: 8686, protocol: "TCP", targetPort: 8686 }],
             },
             // Load KAFKA_BOOTSTRAP_SERVERS from templated ConfigMap
-            env: [
-                {
-                    name: "KAFKA_BOOTSTRAP_SERVERS",
-                    valueFrom: {
-                        configMapKeyRef: {
-                            name: "vector-kafka-env",
-                            key: "KAFKA_BOOTSTRAP_SERVERS",
-                        },
-                    },
-                },
-            ],
+            env: generateVectorEnv(config),
             customConfig: {
                 sources: {
                     kafka: {
@@ -598,12 +807,14 @@ export async function generateHelmValues(config, options = {}) {
                 enabled: false,
             },
             grafana: {
-                enabled: false,
+                enabled: useLocalGrafana,
             },
             prometheus: {
                 enabled: config.features.monitoring.enabled,
+                serviceAccount: generatePrometheusServiceAccount(config),
                 prometheusSpec: {
                     retention: "30d",
+                    podMetadata: generatePrometheusPodMetadata(config),
                     storageSpec: {
                         volumeClaimTemplate: {
                             spec: {
@@ -617,13 +828,7 @@ export async function generateHelmValues(config, options = {}) {
                             },
                         },
                     },
-                    ...(config.features.monitoring.remoteWriteUrl
-                        ? {
-                            remoteWrite: [
-                                { url: config.features.monitoring.remoteWriteUrl },
-                            ],
-                        }
-                        : { remoteWrite: [] }),
+                    remoteWrite: generateRemoteWriteSpec(config),
                 },
             },
         },

package/dist/lib/kubernetes.d.ts

@@ -1,4 +1,4 @@
-import { CloudProvider } from "../types/index.js";
+import { CloudProvider, PerformanceTier } from "../types/index.js";
 /**
  * Checks if kubectl is installed
  */
@@ -20,6 +20,12 @@ export declare function checkClusterAccessible(): Promise<string | null>;
  * Gets the current kubectl context
  */
 export declare function getCurrentContext(): Promise<string | null>;
+/**
+ * Infers the closest internal Rulebricks sizing tier from the current cluster.
+ * This is used only for existing clusters, where the CLI is not responsible for
+ * provisioning node pools but still needs app/Kafka/worker Helm sizing values.
+ */
+export declare function inferClusterTier(): Promise<PerformanceTier | null>;
 /**
  * Gets pod status for the Rulebricks namespace
  */

package/dist/lib/kubernetes.js

@@ -165,6 +165,65 @@ export async function getCurrentContext() {
         return null;
     }
 }
+function parseCpuToCores(cpu) {
+    if (cpu.endsWith("n"))
+        return Number(cpu.slice(0, -1)) / 1_000_000_000;
+    if (cpu.endsWith("u"))
+        return Number(cpu.slice(0, -1)) / 1_000_000;
+    if (cpu.endsWith("m"))
+        return Number(cpu.slice(0, -1)) / 1_000;
+    return Number(cpu);
+}
+function parseMemoryToGi(memory) {
+    const match = memory.match(/^(\d+(?:\.\d+)?)([KMGTP]i?|[kMGTPE])?$/);
+    if (!match)
+        return 0;
+    const value = Number(match[1]);
+    const unit = match[2] || "";
+    const multipliers = {
+        Ki: 1 / 1024 / 1024,
+        Mi: 1 / 1024,
+        Gi: 1,
+        Ti: 1024,
+        Pi: 1024 * 1024,
+        K: 1000 / 1024 / 1024 / 1024,
+        M: 1000 ** 2 / 1024 ** 3,
+        G: 1000 ** 3 / 1024 ** 3,
+        T: 1000 ** 4 / 1024 ** 3,
+        P: 1000 ** 5 / 1024 ** 3,
+    };
+    return value * (multipliers[unit] ?? 1 / 1024 ** 3);
+}
+/**
+ * Infers the closest internal Rulebricks sizing tier from the current cluster.
+ * This is used only for existing clusters, where the CLI is not responsible for
+ * provisioning node pools but still needs app/Kafka/worker Helm sizing values.
+ */
+export async function inferClusterTier() {
+    try {
+        const { stdout } = await execa("kubectl", ["get", "nodes", "-o", "json"], {
+            timeout: 15000,
+        });
+        const data = JSON.parse(stdout);
+        const schedulableNodes = data.items?.filter((node) => !node.spec?.unschedulable) ?? [];
+        let totalCpu = 0;
+        let totalMemoryGi = 0;
+        for (const node of schedulableNodes) {
+            totalCpu += parseCpuToCores(node.status?.allocatable?.cpu || "0");
+            totalMemoryGi += parseMemoryToGi(node.status?.allocatable?.memory || "0");
+        }
+        if (totalCpu >= 40 && totalMemoryGi >= 80)
+            return "large";
+        if (totalCpu >= 16 && totalMemoryGi >= 32)
+            return "medium";
+        if (totalCpu > 0 && totalMemoryGi > 0)
+            return "small";
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Gets pod status for the Rulebricks namespace
  */