anyscale 0.26.66__py3-none-any.whl → 0.26.68__py3-none-any.whl

anyscale/commands/setup_k8s.py

@@ -0,0 +1,1467 @@
+"""
+Kubernetes Cloud Setup Command
+
+This module provides a streamlined command for setting up Anyscale on Kubernetes clusters.
+It handles infrastructure provisioning, cloud registration, and operator installation.
+"""
+
+from dataclasses import dataclass
+import json
+import os
+import re
+import subprocess
+from typing import Any, Dict, List, Optional
+
+import click
+import yaml
+
+from anyscale.cli_logger import BlockLogger
+from anyscale.client.openapi_client.models import (
+    AWSConfig,
+    CloudDeployment,
+    CloudProviders,
+    ComputeStack,
+    KubernetesConfig as OpenAPIKubernetesConfig,
+    ObjectStorage,
+)
+from anyscale.controllers.cloud_controller import CloudController
+from anyscale.controllers.kubernetes_verifier import (
+    KubernetesCloudDeploymentVerifier,
+    KubernetesConfig,
+)
+from anyscale.shared_anyscale_utils.conf import ANYSCALE_CORS_ORIGIN, ANYSCALE_HOST
+
+
+@dataclass
+class ClusterInfo:
+    """Information about the target Kubernetes cluster."""
+
+    context: str
+    namespace: str
+    provider: str
+    region: str
+    cluster_name: str
+    project_id: Optional[str] = None
+    oidc_provider: Optional[str] = None
+
+
+@dataclass
+class InfrastructureResources:
+    """Resources created during infrastructure setup."""
+
+    bucket_name: str
+    iam_role_arn: str
+    region: str
+    project_id: Optional[str] = None
+
+
+class KubernetesCloudSetupCommand:
+    """Command to setup Kubernetes cloud."""
+
+    def __init__(self, logger: Optional[BlockLogger] = None, debug: bool = False):
+        self.log = logger or BlockLogger()
+        self.cloud_controller = CloudController(log=self.log)
+        self.skip_confirmation = False
+        self.debug = debug or os.environ.get("ANYSCALE_DEBUG") == "1"
+
+    def run(  # noqa: PLR0913
+        self,
+        provider: str,
+        region: str,
+        name: str,
+        cluster_name: str,
+        namespace: str,
+        project_id: Optional[str],
+        functional_verify: bool,
+        yes: bool,
+        values_file: Optional[str] = None,
+    ) -> None:
+        """
+        Main entry point for Kubernetes cloud setup.
+
+        Args:
+            provider: Cloud provider (aws, gcp)
+            region: AWS/GCP region
+            name: Name for the Anyscale cloud
+            cluster_name: Kubernetes cluster name/context
+            namespace: Namespace for the Anyscale operator
+            project_id: GCP project ID (required for GCP)
+            functional_verify: Whether to run functional verification
+            yes: Skip confirmation prompts
+            values_file: Optional custom path for Helm values file
+        """
+        self.log.open_block(
+            "Setup", f"Setting up Kubernetes cloud '{name}' on {provider.upper()}"
+        )
+
+        # Set confirmation flag
+        self.skip_confirmation = yes
+
+        try:
+            # Step 0: Check required CLI tools are installed
+            self._check_required_tools(provider)
+
+            # Step 1: Prompt for namespace BEFORE infrastructure setup
+            # This is needed because the IAM role trust relationship depends on the namespace
+            final_namespace = self._prompt_for_namespace(
+                namespace, skip_confirmation=yes
+            )
+
+            # Step 2: Discover and validate cluster
+            cluster_info = self._discover_cluster(
+                cluster_name, final_namespace, provider, region, project_id
+            )
+
+            # Step 3: Set up cloud infrastructure
+            infrastructure = self._setup_infrastructure(
+                provider, region, name, cluster_info
+            )
+
+            # Step 4: Register cloud with Anyscale
+            cloud_id = self._register_cloud(
+                name, provider, region, infrastructure, cluster_info
+            )
+
+            # Step 5: Install Anyscale operator
+            self._install_operator(
+                cloud_id,
+                provider,
+                region,
+                final_namespace,
+                infrastructure,
+                values_file,
+            )
+
+            # Step 6: Verify installation
+            if functional_verify:
+                self._verify_installation(cloud_id, final_namespace, cluster_info)
+
+            self.log.close_block("Setup")
+            self.log.info(f"Kubernetes cloud '{name}' setup completed successfully!")
+        except Exception:  # noqa: BLE001
+            self.log.close_block("Setup")
+            raise
+
+    def _debug(self, *msg: str) -> None:
+        """Log debug messages only when debug mode is enabled."""
+        if self.debug:
+            self.log.debug(*msg)
+
+    def _check_required_tools(self, provider: str) -> None:
+        """Check that required CLI tools are installed."""
+        # Common tools required for all providers
+        required_tools = ["kubectl", "helm"]
+
+        # Provider-specific tools
+        if provider == "aws":
+            required_tools.append("aws")
+        elif provider == "gcp":
+            required_tools.extend(["gcloud", "gsutil"])
+
+        self._debug(f"Checking for required tools: {', '.join(required_tools)}")
+
+        missing_tools = []
+        for tool in required_tools:
+            if not self._check_command_available(tool):
+                missing_tools.append(tool)
+
+        if missing_tools:
+            error_msg = f"Missing required CLI tools: {', '.join(missing_tools)}\n\n"
+            raise click.ClickException(error_msg.rstrip())
+
+        self.log.info(
+            f"Required CLI tools are installed ({', '.join(required_tools)})",
+            block_label="Setup",
+        )
+
+    def _check_command_available(self, command: str) -> bool:
+        """Check if a command is available in the system PATH."""
+        try:
+            result = subprocess.run(
+                ["which", command], capture_output=True, text=True, check=False
+            )
+            return result.returncode == 0
+        except Exception:  # noqa: BLE001
+            return False
+
+    def _discover_cluster(
+        self,
+        cluster_name: str,
+        namespace: str,
+        provider: str,
+        region: str,
+        project_id: Optional[str],
+    ) -> ClusterInfo:
+        """Discover and validate the target Kubernetes cluster using cloud provider APIs."""
+        self.log.info(
+            f"Discovering {provider.upper()} cluster: {cluster_name}",
+            block_label="Setup",
+        )
+
+        if provider == "aws":
+            return self._discover_aws_cluster(cluster_name, namespace, region)
+        elif provider == "gcp":
+            if not project_id:
+                raise click.ClickException(
+                    "GCP project ID is required. Please provide --project-id"
+                )
+            return self._discover_gcp_cluster(
+                cluster_name, namespace, region, project_id
+            )
+        else:
+            raise click.ClickException(f"Unsupported provider: {provider}")
+
+    def _discover_aws_cluster(
+        self, cluster_name: str, namespace: str, region: str
+    ) -> ClusterInfo:
+        """Discover AWS EKS cluster details and configure kubeconfig."""
+
+        try:
+            self._debug("Fetching OIDC provider information...")
+            oidc_provider = self._get_eks_oidc_provider(cluster_name, region)
+            self._debug(f"OIDC Provider: {oidc_provider}")
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to get OIDC provider: {e}")
+            raise click.ClickException(
+                f"Failed to get OIDC provider for cluster {cluster_name}: {e}"
+            )
+
+        try:
+            self._debug("Configuring kubeconfig for EKS cluster...")
+            self._configure_aws_kubeconfig(cluster_name, region)
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to configure kubeconfig: {e}")
+            raise click.ClickException(
+                f"Failed to configure kubeconfig for EKS cluster: {e}"
+            )
+
+        try:
+            self._debug("Verifying kubeconfig configuration...")
+            self._verify_kubeconfig()
+            current_context = self._get_current_kubectl_context()
+            self.log.info(f"Cluster discovered: {current_context}", block_label="Setup")
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to verify kubeconfig: {e}")
+            raise click.ClickException(f"Failed to verify kubeconfig: {e}")
+
+        return ClusterInfo(
+            context=current_context,
+            namespace=namespace,
+            provider="aws",
+            region=region,
+            cluster_name=cluster_name,
+            oidc_provider=oidc_provider,
+        )
+
+    def _discover_gcp_cluster(
+        self, cluster_name: str, namespace: str, region: str, project_id: str
+    ) -> ClusterInfo:
+        """Discover GCP GKE cluster details and configure kubeconfig."""
+
+        try:
+            self._debug("Configuring kubeconfig for GKE cluster...")
+            self._configure_gcp_kubeconfig(cluster_name, region, project_id)
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to configure kubeconfig: {e}")
+            raise click.ClickException(
+                f"Failed to configure kubeconfig for GKE cluster: {e}"
+            )
+
+        try:
+            self._debug("Verifying kubeconfig configuration...")
+            self._verify_kubeconfig()
+            current_context = self._get_current_kubectl_context()
+            self.log.info(f"Cluster discovered: {current_context}", block_label="Setup")
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to verify kubeconfig: {e}")
+            raise click.ClickException(f"Failed to verify kubeconfig: {e}")
+
+        return ClusterInfo(
+            context=current_context,
+            namespace=namespace,
+            provider="gcp",
+            region=region,
+            cluster_name=cluster_name,
+            project_id=project_id,
+        )
+
+    def _setup_infrastructure(
+        self, provider: str, region: str, name: str, cluster_info: ClusterInfo,
+    ) -> InfrastructureResources:
+        """Set up cloud infrastructure (S3/GCS bucket, IAM roles, etc.)."""
+        self.log.info(
+            f"Setting up {provider.upper()} infrastructure...", block_label="Setup"
+        )
+
+        if provider == "aws":
+            return self._setup_aws_infrastructure(region, name, cluster_info)
+        elif provider == "gcp":
+            return self._setup_gcp_infrastructure(region, name, cluster_info)
+        else:
+            raise click.ClickException(f"Unsupported provider: {provider}")
+
+    def _setup_aws_infrastructure(  # noqa: PLR0912
+        self, region: str, name: str, cluster_info: ClusterInfo,
+    ) -> InfrastructureResources:
+        """Set up AWS infrastructure for Kubernetes using CloudFormation."""
+        try:
+            import boto3
+
+            from anyscale.utils.cloudformation_utils import CloudFormationUtils
+        except ImportError as e:
+            self.log.error(f"Failed to import required modules: {e}")
+            raise click.ClickException(f"Failed to import required modules: {e}")
+
+        try:
+            # Generate a unique cloud ID
+            cloud_id = f"k8s-{name}-{os.urandom(4).hex()}"
+            stack_name = cloud_id.replace("_", "-").lower()
+            self._debug(f"Generated cloud ID: {cloud_id}")
+            self._debug(f"CloudFormation stack name: {stack_name}")
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to generate cloud ID: {e}")
+            raise click.ClickException(f"Failed to generate cloud ID: {e}")
+
+        try:
+            # Generate CloudFormation template for Kubernetes setup with actual OIDC provider
+            if not cluster_info.oidc_provider:
+                raise click.ClickException(
+                    "OIDC provider information not found. Please ensure the EKS cluster has OIDC provider enabled."
+                )
+            self._debug("Generating CloudFormation template...")
+            self._debug(
+                f"Using namespace: {cluster_info.namespace} with service account: anyscale-operator"
+            )
+            cfn_template_body = self._generate_aws_cloudformation_template(
+                cloud_id, cluster_info.oidc_provider, cluster_info.namespace,
+            )
+            self._debug("CloudFormation template generated successfully")
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to generate CloudFormation template: {e}")
+            raise click.ClickException(
+                f"Failed to generate CloudFormation template: {e}"
+            )
+
+        try:
+            self._debug("Preparing CloudFormation parameters...")
+            parameters = [{"ParameterKey": "CloudID", "ParameterValue": cloud_id}]
+            self._debug(f"Prepared {len(parameters)} CloudFormation parameters")
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to prepare CloudFormation parameters: {e}")
+            raise click.ClickException(
+                f"Failed to prepare CloudFormation parameters: {e}"
+            )
+
+        try:
+            with self.log.indent():
+                self.log.info(
+                    "Creating CloudFormation stack (this may take a few minutes)...",
+                    block_label="Setup",
+                )
+                boto3_session = boto3.Session(region_name=region)
+                cfn_utils = CloudFormationUtils(self.log)
+                cfn_utils.create_and_wait_for_stack(
+                    stack_name=stack_name,
+                    template_body=cfn_template_body,
+                    parameters=parameters,
+                    region=region,
+                    boto3_session=boto3_session,
+                    timeout_seconds=600,
+                )
+            self.log.info("CloudFormation stack created", block_label="Setup")
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to create CloudFormation stack: {e}")
+            raise click.ClickException(f"Failed to create CloudFormation stack: {e}")
+
+        try:
+            self._debug("Retrieving CloudFormation stack outputs...")
+            stack_outputs = cfn_utils.get_stack_outputs(
+                stack_name, region, boto3_session
+            )
+            bucket_name = stack_outputs.get("S3BucketName", f"anyscale-{cloud_id}")
+            iam_role_arn = stack_outputs.get("AnyscaleCrossAccountIAMRoleArn")
+
+            if not iam_role_arn:
+                raise click.ClickException(
+                    "Failed to get IAM role ARN from CloudFormation stack"
+                )
+
+            self._debug(f"S3 Bucket: {bucket_name}")
+            self._debug(f"IAM Role ARN: {iam_role_arn}")
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to get CloudFormation outputs: {e}")
+            raise click.ClickException(f"Failed to get CloudFormation outputs: {e}")
+
+        return InfrastructureResources(
+            bucket_name=bucket_name, iam_role_arn=iam_role_arn, region=region
+        )
+
+    def _generate_aws_cloudformation_template(
+        self, cloud_id: str, oidc_provider_arn: str, namespace: str,
+    ) -> str:
+        """Generate CloudFormation template for AWS Kubernetes setup."""
+        # Extract OIDC provider URL from ARN for the condition
+        # ARN format: arn:aws:iam::ACCOUNT:oidc-provider/oidc.eks.REGION.amazonaws.com/id/XXXXXX
+        # We need: oidc.eks.REGION.amazonaws.com/id/XXXXXX
+        if "oidc-provider/" not in oidc_provider_arn:
+            raise click.ClickException(
+                f"Invalid OIDC provider ARN format: {oidc_provider_arn}"
+            )
+        oidc_provider_url = oidc_provider_arn.split("oidc-provider/")[-1]
+
+        service_account_name = "anyscale-operator"
+
+        # Use ANYSCALE_CORS_ORIGIN from shared config
+        # This respects the ANYSCALE_HOST environment variable
+        allowed_origin = ANYSCALE_CORS_ORIGIN
+
+        template = {
+            "AWSTemplateFormatVersion": "2010-09-09",
+            "Description": f"Anyscale Kubernetes Cloud Infrastructure for {cloud_id}",
+            "Parameters": {
+                "CloudID": {
+                    "Type": "String",
+                    "Description": "Cloud ID for resource naming",
+                }
+            },
+            "Resources": {
+                "AnyscaleBucket": {
+                    "Type": "AWS::S3::Bucket",
+                    "Properties": {
+                        "BucketName": {"Fn::Sub": "anyscale-${CloudID}"},
+                        "VersioningConfiguration": {"Status": "Enabled"},
+                        "PublicAccessBlockConfiguration": {
+                            "BlockPublicAcls": True,
+                            "BlockPublicPolicy": True,
+                            "IgnorePublicAcls": True,
+                            "RestrictPublicBuckets": True,
+                        },
+                        "CorsConfiguration": {
+                            "CorsRules": [
+                                {
+                                    "AllowedHeaders": ["*"],
+                                    "AllowedMethods": [
+                                        "GET",
+                                        "PUT",
+                                        "POST",
+                                        "HEAD",
+                                        "DELETE",
+                                    ],
+                                    "AllowedOrigins": [allowed_origin],
+                                    "MaxAge": 3600,
+                                }
+                            ]
+                        },
+                    },
+                },
+                "AnyscaleOperatorRole": {
+                    "Type": "AWS::IAM::Role",
+                    "Properties": {
+                        "RoleName": {"Fn::Sub": "${CloudID}-anyscale-operator-role"},
+                        "AssumeRolePolicyDocument": {
+                            "Version": "2012-10-17",
+                            "Statement": [
+                                {
+                                    "Effect": "Allow",
+                                    "Principal": {"Federated": oidc_provider_arn},
+                                    "Action": "sts:AssumeRoleWithWebIdentity",
+                                    "Condition": {
+                                        "StringEquals": {
+                                            f"{oidc_provider_url}:sub": f"system:serviceaccount:{namespace}:{service_account_name}"
+                                        }
+                                    },
+                                }
+                            ],
+                        },
+                        "Policies": [
+                            {
+                                "PolicyName": "AnyscaleS3AccessPolicy",
+                                "PolicyDocument": {
+                                    "Version": "2012-10-17",
+                                    "Statement": [
+                                        {
+                                            "Effect": "Allow",
+                                            "Action": [
+                                                "s3:GetObject",
+                                                "s3:PutObject",
+                                                "s3:DeleteObject",
+                                                "s3:ListBucket",
+                                            ],
+                                            "Resource": [
+                                                {
+                                                    "Fn::GetAtt": [
+                                                        "AnyscaleBucket",
+                                                        "Arn",
+                                                    ]
+                                                },
+                                                {"Fn::Sub": "${AnyscaleBucket.Arn}/*"},
+                                            ],
+                                        }
+                                    ],
+                                },
+                            }
+                        ],
+                    },
+                },
+            },
+            "Outputs": {
+                "S3BucketName": {
+                    "Value": {"Ref": "AnyscaleBucket"},
+                    "Description": "Name of the S3 bucket",
+                },
+                "AnyscaleCrossAccountIAMRoleArn": {
+                    "Value": {"Fn::GetAtt": ["AnyscaleOperatorRole", "Arn"]},
+                    "Description": "ARN of the Anyscale operator IAM role",
+                },
+            },
+        }
+
+        return json.dumps(template, indent=2)
+
+    def _setup_gcp_infrastructure(  # noqa: PLR0912
+        self, region: str, name: str, cluster_info: ClusterInfo,
+    ) -> InfrastructureResources:
+        """Set up GCP infrastructure for Kubernetes using GCP Python SDK.
+
+        Note: Deployment Manager is deprecated so it is unused here.
+        Infrastructure Manager was tried but did not work well, so we rely
+        on the GCP Python SDK instead.
+        """
+        try:
+            from anyscale.utils.gcp_utils import get_google_cloud_client_factory
+        except ImportError as e:
+            self.log.error(f"Failed to import required modules: {e}")
+            raise click.ClickException(f"Failed to import required modules: {e}")
+
+        try:
+            # Generate a unique cloud ID
+            cloud_id = f"k8s-{name}-{os.urandom(4).hex()}"
+            deployment_name = cloud_id.replace("_", "-").lower()
+            self._debug(f"Generated cloud ID: {cloud_id}")
+            self._debug(f"Infrastructure Manager deployment name: {deployment_name}")
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to generate cloud ID: {e}")
+            raise click.ClickException(f"Failed to generate cloud ID: {e}")
+
+        try:
+            # Get Google Cloud client factory
+            factory = get_google_cloud_client_factory(self.log, cluster_info.project_id)
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to initialize GCP client: {e}")
+            raise click.ClickException(f"Failed to initialize GCP client: {e}")
+
+        try:
+            with self.log.indent():
+                self.log.warning(
+                    "NOTE: GCP resources (bucket and service account) created by this command are not managed by Anyscale.",
+                )
+                self.log.warning(
+                    "You will need to manually delete these resources when the cloud is no longer needed.",
+                )
+                self.log.info(
+                    "Creating GCP resources (bucket, service account, IAM bindings)...",
+                )
+
+                # Calculate resource names
+                # Service account name: anyscale-operator-<random 8 chars>
+                # Max length for GCP service account is 30 characters
+                random_suffix = os.urandom(4).hex()  # 8 hex chars
+                anyscale_service_account_name = f"anyscale-operator-{random_suffix}"
+                bucket_name = f"anyscale-{cloud_id.replace('_', '-').lower()}"
+
+                # Create GCS bucket
+                self._debug(f"Creating GCS bucket: {bucket_name}")
+                storage_client = factory.storage.Client()
+                bucket = storage_client.bucket(bucket_name)
+                bucket.location = region
+                bucket.storage_class = "REGIONAL"
+                bucket.iam_configuration.uniform_bucket_level_access_enabled = True
+                bucket.iam_configuration.public_access_prevention = "enforced"
+                bucket.versioning_enabled = True
+                bucket.labels = {"anyscale-cloud-id": cloud_id.replace("-", "_")}
+
+                # Set CORS
+                # Use ANYSCALE_CORS_ORIGIN from shared config
+                # This respects the ANYSCALE_HOST environment variable
+                allowed_origin = ANYSCALE_CORS_ORIGIN
+                bucket.cors = [
+                    {
+                        "origin": [allowed_origin],
+                        "responseHeader": ["*"],
+                        "method": ["GET", "PUT", "POST", "HEAD", "DELETE"],
+                        "maxAgeSeconds": 3600,
+                    }
+                ]
+
+                storage_client.create_bucket(bucket, location=region)
+                self.log.info(f"Created GCS bucket: {bucket_name}", block_label="Setup")
+
+                # Create service account
+                self._debug(
+                    f"Creating service account: {anyscale_service_account_name}"
+                )
+                iam_client = factory.build("iam", "v1")
+                service_account_body = {
+                    "accountId": anyscale_service_account_name,
+                    "serviceAccount": {
+                        "displayName": f"{cloud_id} Anyscale operator service account",
+                        "description": "Service account for Anyscale Kubernetes operator",
+                    },
+                }
+
+                service_account = (
+                    iam_client.projects()
+                    .serviceAccounts()
+                    .create(
+                        name=f"projects/{cluster_info.project_id}",
+                        body=service_account_body,
+                    )
+                    .execute()
+                )
+
+                service_account_email = service_account["email"]
+                self.log.info(
+                    f"Created service account: {service_account_email}",
+                    block_label="Setup",
+                )
+
+                # Wait for service account to propagate through GCP systems
+                import time
+
+                self._debug("Waiting 10 seconds for service account to propagate...")
+                time.sleep(10)
+
+                # Grant Workload Identity binding
+                self._debug("Setting up Workload Identity binding")
+
+                # The K8s service account needs:
+                # 1. workloadIdentityUser role - to impersonate the GCP service account
+                # 2. serviceAccountTokenCreator - to generate tokens (for getOpenIdToken)
+
+                policy_body = {
+                    "policy": {
+                        "bindings": [
+                            {
+                                "role": "roles/iam.workloadIdentityUser",
+                                "members": [
+                                    f"serviceAccount:{cluster_info.project_id}.svc.id.goog[{cluster_info.namespace}/anyscale-operator]"
+                                ],
+                            },
+                            {
+                                "role": "roles/iam.serviceAccountTokenCreator",
+                                "members": [f"serviceAccount:{service_account_email}"],
+                            },
+                        ]
+                    }
+                }
+
+                iam_client.projects().serviceAccounts().setIamPolicy(
+                    resource=f"projects/{cluster_info.project_id}/serviceAccounts/{service_account_email}",
+                    body=policy_body,
+                ).execute()
+
+                self.log.info(
+                    "Configured Workload Identity binding", block_label="Setup"
+                )
+
+                # Grant storage admin role to service account for the bucket
+                # Note: There's often a propagation delay after service account creation
+                # We need to retry with exponential backoff
+                self._debug("Granting storage permissions")
+
+                import time
+
+                max_retries = 5
+                retry_delay = 2  # Start with 2 seconds
+
+                for attempt in range(max_retries):
+                    try:
+                        bucket_policy = bucket.get_iam_policy(
+                            requested_policy_version=3
+                        )
+                        bucket_policy.bindings.append(
+                            {
+                                "role": "roles/storage.admin",
+                                "members": {f"serviceAccount:{service_account_email}"},
+                            }
+                        )
+                        bucket.set_iam_policy(bucket_policy)
+                        break  # Success!
+                    except Exception as e:  # noqa: BLE001
+                        if "does not exist" in str(e) and attempt < max_retries - 1:
+                            self._debug(
+                                f"Service account not yet propagated, retrying in {retry_delay}s... (attempt {attempt + 1}/{max_retries})"
+                            )
+                            time.sleep(retry_delay)
+                            retry_delay *= 2  # Exponential backoff
+                        else:
+                            raise  # Re-raise if it's not a propagation issue or we're out of retries
+
+                self.log.info(
+                    "Granted storage permissions to service account",
+                    block_label="Setup",
+                )
+
+            self.log.info("GCP resources created successfully", block_label="Setup")
+            self.log.warning(
+                f"REMINDER: To clean up when no longer needed, delete GCS bucket '{bucket_name}' and service account '{service_account_email}'"
+            )
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Failed to create GCP resources: {e}")
+            raise click.ClickException(f"Failed to create GCP resources: {e}")
+
+        # Resources were created in the try block above
+        # bucket_name and service_account_email are already set
+        self._debug(f"GCS Bucket: {bucket_name}")
+        self._debug(f"Service Account Email: {service_account_email}")
+
+        return InfrastructureResources(
+            bucket_name=bucket_name,
+            iam_role_arn=service_account_email,  # For GCP, we use service account email
+            region=region,
+            project_id=cluster_info.project_id,
+        )
+
+    def _get_gke_cluster_info(
+        self, cluster_name: str, region: str, project_id: str
+    ) -> Dict[str, Any]:
+        """Get GKE cluster information using gcloud CLI."""
+        try:
+            # Try regional cluster first
+            result = subprocess.run(
+                [
+                    "gcloud",
+                    "container",
+                    "clusters",
+                    "describe",
+                    cluster_name,
+                    f"--region={region}",
+                    f"--project={project_id}",
+                    "--format=json",
+                ],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            if result.returncode == 0:
+                return json.loads(result.stdout)
+
+            # Try zonal cluster
+            # Assuming zone 'a' if regional fails
+            zone = f"{region}-a"
+            result = subprocess.run(
+                [
+                    "gcloud",
+                    "container",
+                    "clusters",
+                    "describe",
+                    cluster_name,
+                    f"--zone={zone}",
+                    f"--project={project_id}",
+                    "--format=json",
+                ],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            return json.loads(result.stdout)
+        except subprocess.CalledProcessError as e:
+            raise click.ClickException(f"Failed to get GKE cluster info: {e.stderr}")
+        except json.JSONDecodeError as e:
+            raise click.ClickException(f"Failed to parse GKE cluster info: {e}")
+
+    def _get_gke_zones(
+        self, cluster_name: str, region: str, project_id: str
+    ) -> List[str]:
+        """Get zones where the GKE cluster's node pools are located."""
+        try:
+            cluster_info = self._get_gke_cluster_info(cluster_name, region, project_id)
+
+            # Extract zones from node pools
+            zones = []
+            node_pools = cluster_info.get("nodePools", [])
+
+            for pool in node_pools:
+                # For zonal clusters, each node pool has locations
+                pool_locations = pool.get("locations", [])
+                zones.extend(pool_locations)
+
+            # If no zones found from node pools, try cluster-level locations
+            if not zones:
+                cluster_locations = cluster_info.get("locations", [])
+                if cluster_locations:
+                    zones = cluster_locations
+
+            # Remove duplicates and sort
+            if zones:
+                unique_zones = sorted(set(zones))
+                self._debug(f"Discovered zones: {', '.join(unique_zones)}")
+                return unique_zones
+            else:
+                # Fallback to default zones
+                self._debug(
+                    "No zones found in cluster info, falling back to default zones"
+                )
+                return [region + "-a", region + "-b", region + "-c"]
+
+        except Exception as e:  # noqa: BLE001
+            self._debug(f"Failed to get zones: {e}, using default zones")
+            return [region + "-a", region + "-b", region + "-c"]
+
+    def _configure_gcp_kubeconfig(
+        self, cluster_name: str, region: str, project_id: str
+    ) -> None:
+        """Configure kubeconfig for GCP GKE cluster."""
+        self.log.info(f"Configuring kubeconfig for GKE cluster: {cluster_name}")
+
+        try:
+            # Try regional cluster first
+            result = subprocess.run(
+                [
+                    "gcloud",
+                    "container",
+                    "clusters",
+                    "get-credentials",
+                    cluster_name,
+                    f"--region={region}",
+                    f"--project={project_id}",
+                ],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            if result.returncode == 0:
+                self.log.info("GKE kubeconfig configured successfully")
+                return
+
+            # Try zonal cluster
+            zone = f"{region}-a"
+            subprocess.run(
+                [
+                    "gcloud",
+                    "container",
+                    "clusters",
+                    "get-credentials",
+                    cluster_name,
+                    f"--zone={zone}",
+                    f"--project={project_id}",
+                ],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            self.log.info("GKE kubeconfig configured successfully")
+        except subprocess.CalledProcessError as e:
+            raise click.ClickException(
+                f"Failed to configure GKE kubeconfig: {e.stderr}"
+            )
+
+    def _get_eks_cluster_info(self, cluster_name: str, region: str) -> Dict[str, Any]:
+        """Get EKS cluster information using AWS CLI."""
+        try:
+            result = subprocess.run(
+                [
+                    "aws",
+                    "eks",
+                    "describe-cluster",
+                    "--name",
+                    cluster_name,
+                    "--region",
+                    region,
+                ],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            cluster_data = json.loads(result.stdout)
+            return cluster_data.get("cluster", {})
+        except subprocess.CalledProcessError as e:
+            raise click.ClickException(f"Failed to get EKS cluster info: {e.stderr}")
+
+    def _get_eks_availability_zones(self, cluster_name: str, region: str) -> List[str]:
+        """Get availability zones where the EKS cluster's subnets are located."""
+        try:
+            cluster_info = self._get_eks_cluster_info(cluster_name, region)
+            subnet_ids = cluster_info.get("resourcesVpcConfig", {}).get("subnetIds", [])
+
+            if not subnet_ids:
+                self._debug(
+                    "No subnets found in cluster info, falling back to default zones"
+                )
+                return [region + "a", region + "b", region + "c"]
+
+            # Get subnet details to find their availability zones
+            result = subprocess.run(
+                [
+                    "aws",
+                    "ec2",
+                    "describe-subnets",
+                    "--subnet-ids",
+                    *subnet_ids,
+                    "--region",
+                    region,
+                    "--query",
+                    "Subnets[*].AvailabilityZone",
+                    "--output",
+                    "json",
+                ],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+
+            zones = json.loads(result.stdout)
+            # Remove duplicates and sort
+            unique_zones = sorted(set(zones))
+
+            if unique_zones:
+                self._debug(f"Discovered availability zones: {', '.join(unique_zones)}")
+                return unique_zones
+            else:
+                self._debug(
+                    "No availability zones found, falling back to default zones"
+                )
+                return [region + "a", region + "b", region + "c"]
+
+        except Exception as e:  # noqa: BLE001
+            self._debug(f"Failed to get availability zones: {e}, using default zones")
+            return [region + "a", region + "b", region + "c"]
+
+    def _get_eks_oidc_provider(self, cluster_name: str, region: str) -> str:
+        """Get EKS OIDC provider URL for IRSA."""
+        cluster_info = self._get_eks_cluster_info(cluster_name, region)
+        identity = cluster_info.get("identity", {})
+        oidc_issuer = identity.get("oidc", {}).get("issuer", "")
+
+        if not oidc_issuer:
+            raise click.ClickException(
+                "Could not find OIDC issuer for EKS cluster. IRSA setup requires OIDC provider."
+            )
+
+        # Extract OIDC provider ARN
+        # OIDC issuer URL format: https://oidc.eks.region.amazonaws.com/id/EXAMPLED539D4633E53CE8D
+        if "oidc.eks." in oidc_issuer and ".amazonaws.com/id/" in oidc_issuer:
+            oidc_id = oidc_issuer.split("/id/")[-1]
+            account_id = self._get_aws_account_id()
+            oidc_provider_arn = f"arn:aws:iam::{account_id}:oidc-provider/oidc.eks.{region}.amazonaws.com/id/{oidc_id}"
+            return oidc_provider_arn
+
+        raise click.ClickException(
+            f"Could not parse OIDC provider from issuer URL: {oidc_issuer}"
+        )
+
+    def _get_aws_account_id(self) -> str:
+        """Get AWS account ID."""
+        try:
+            result = subprocess.run(
+                [
+                    "aws",
+                    "sts",
+                    "get-caller-identity",
+                    "--query",
+                    "Account",
+                    "--output",
+                    "text",
+                ],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            return result.stdout.strip()
+        except subprocess.CalledProcessError as e:
+            raise click.ClickException(f"Failed to get AWS account ID: {e.stderr}")
+
+    def _configure_aws_kubeconfig(self, cluster_name: str, region: str) -> None:
+        """Configure kubeconfig for AWS EKS cluster."""
+        self.log.info(f"Configuring kubeconfig for EKS cluster: {cluster_name}")
+
+        try:
+            subprocess.run(
+                [
+                    "aws",
+                    "eks",
+                    "update-kubeconfig",
+                    "--region",
+                    region,
+                    "--name",
+                    cluster_name,
+                ],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            self.log.info("EKS kubeconfig configured successfully")
+        except subprocess.CalledProcessError as e:
+            raise click.ClickException(
+                f"Failed to configure EKS kubeconfig: {e.stderr}"
+            )
+
+    def _verify_kubeconfig(self) -> None:
+        """Verify that kubeconfig is working correctly."""
+        self.log.info("Verifying kubeconfig configuration...")
+
+        try:
+            subprocess.run(
+                ["kubectl", "cluster-info"], capture_output=True, text=True, check=True
+            )
+            self.log.info("Kubeconfig verification successful")
+        except subprocess.CalledProcessError as e:
+            raise click.ClickException(f"Kubeconfig verification failed: {e.stderr}")
+
+    def _get_current_kubectl_context(self) -> str:
+        """Get the current kubectl context."""
+        try:
+            result = subprocess.run(
+                ["kubectl", "config", "current-context"],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            return result.stdout.strip()
+        except subprocess.CalledProcessError as e:
+            raise click.ClickException(
+                f"Failed to get current kubectl context: {e.stderr}"
+            )
+
+    def _register_cloud(  # noqa: PLR0912
+        self,
+        name: str,
+        provider: str,
+        region: str,
+        infrastructure: InfrastructureResources,
+        cluster_info: ClusterInfo,
+    ) -> str:
+        """Register the cloud with Anyscale."""
+        self.log.info("Registering cloud with Anyscale...", block_label="Setup")
+
+        if provider == "aws":
+            # Dynamically determine availability zones from the EKS cluster
+            zones = self._get_eks_availability_zones(cluster_info.cluster_name, region)
+
+            cloud_deployment = CloudDeployment(
+                name=name,
+                provider=CloudProviders.AWS,
+                region=region,
+                compute_stack=ComputeStack.K8S,
+                object_storage=ObjectStorage(
+                    bucket_name=infrastructure.bucket_name, region=region
+                ),
+                aws_config=AWSConfig(),
+                kubernetes_config=OpenAPIKubernetesConfig(
+                    anyscale_operator_iam_identity=infrastructure.iam_role_arn,
+                    zones=zones,
+                ),
+            )
+        elif provider == "gcp":
+            assert infrastructure.project_id, "Project ID is required for GCP"
+
+            from anyscale.client.openapi_client.models import GCPConfig
+
+            # Dynamically determine zones from the GKE cluster
+            zones = self._get_gke_zones(
+                cluster_info.cluster_name, region, infrastructure.project_id
+            )
+
+            cloud_deployment = CloudDeployment(
+                name=name,
+                provider=CloudProviders.GCP,
+                region=region,
+                compute_stack=ComputeStack.K8S,
+                object_storage=ObjectStorage(
+                    bucket_name=infrastructure.bucket_name, region=region
+                ),
+                gcp_config=GCPConfig(project_id=infrastructure.project_id,),
+                kubernetes_config=OpenAPIKubernetesConfig(
+                    anyscale_operator_iam_identity=infrastructure.iam_role_arn,
+                    zones=zones,
+                ),
+            )
+        else:
+            raise click.ClickException(f"Unsupported provider: {provider}")
+
+        # Register the cloud
+        try:
+            self._debug("Cloud deployment details:")
+            self._debug(f"  Name: {cloud_deployment.name}")
+            self._debug(f"  Provider: {cloud_deployment.provider}")
+            self._debug(f"  Region: {cloud_deployment.region}")
+            self._debug(f"  Compute Stack: {cloud_deployment.compute_stack}")
+            self._debug(f"  Bucket Name: {cloud_deployment.object_storage.bucket_name}")
+            self._debug(
+                f"  IAM Identity: {cloud_deployment.kubernetes_config.anyscale_operator_iam_identity}"
+            )
+            if cloud_deployment.aws_config:
+                self._debug("  AWS Config:")
+                self._debug(
+                    f"    IAM Role ID: {cloud_deployment.aws_config.anyscale_iam_role_id}"
+                )
+
+            # Temporarily suppress cloud controller logging to avoid Helm command output
+            original_log_info = self.cloud_controller.log.info
+            self.cloud_controller.log.info = lambda *_args, **_kwargs: None
+
+            try:
+                if provider == "aws":
+                    self.log.info("Calling register_aws_cloud...")
+                    self.cloud_controller.register_aws_cloud(
+                        name=name,
+                        cloud_resource=cloud_deployment,
+                        functional_verify=None,
+                        yes=True,
+                        skip_verifications=True,
+                        auto_add_user=True,
+                    )
+                elif provider == "gcp":
+                    self.log.info("Calling register_gcp_cloud...")
+                    self.cloud_controller.register_gcp_cloud(
+                        name=name,
+                        cloud_resource=cloud_deployment,
+                        functional_verify=None,
+                        yes=True,
+                        skip_verifications=True,
+                        auto_add_user=True,
+                    )
+                else:
+                    raise click.ClickException(f"Unsupported provider: {provider}")
+            finally:
+                # Restore the original log.info method
+                self.cloud_controller.log.info = original_log_info
+
+            self._debug("Cloud registration completed, fetching cloud ID...")
+            clouds = (
+                self.cloud_controller.api_client.list_clouds_api_v2_clouds_get().results
+            )
+            cloud = next((c for c in clouds if c.name == name), None)
+            if not cloud:
+                raise click.ClickException("Failed to find registered cloud")
+
+            cloud_id = getattr(cloud, "id", None) or getattr(cloud, "cloud_id", None)
+            if not cloud_id:
+                raise click.ClickException(
+                    "Failed to get cloud ID from registered cloud"
+                )
+
+            self.log.info(f"Cloud registered with ID: {cloud_id}", block_label="Setup")
+
+            return cloud_id
+
+        except Exception as e:  # noqa: BLE001
+            self.log.error(f"Cloud registration failed with error: {e}")
+            self.log.error(f"Error type: {type(e).__name__}")
+            if hasattr(e, "response"):
+                self.log.error(f"Response details: {getattr(e, 'response', 'N/A')}")
+            if hasattr(e, "args"):
+                self.log.error(f"Error args: {e.args}")
+            import traceback
+
+            self.log.error(f"Full traceback: {traceback.format_exc()}")
+            raise click.ClickException(f"Failed to register cloud: {e}")
+
+    def _install_operator(  # noqa: PLR0913
+        self,
+        cloud_id: str,
+        provider: str,
+        region: str,
+        namespace: str,
+        infrastructure: InfrastructureResources,
+        values_file: Optional[str] = None,
+    ) -> None:
+        """Install the Anyscale operator using Helm."""
+        self.log.info("Installing Anyscale operator...", block_label="Setup")
+
+        # Get cloud resources to get the cloud resource ID
+        cloud_resources = self.cloud_controller.get_decorated_cloud_resources(cloud_id)
+
+        if not cloud_resources:
+            raise click.ClickException("No cloud resources found")
+
+        cloud_resource_id = cloud_resources[0].cloud_resource_id
+
+        release_name = "anyscale-operator"
+
+        # Generate Helm command and extract --set-string flags from it
+        self._debug("Generating Helm command to extract parameters...")
+        helm_command = self.cloud_controller._generate_helm_upgrade_command(  # noqa: SLF001
+            provider=provider,
+            cloud_deployment_id=cloud_resource_id,
+            region=region,
+            operator_iam_identity=infrastructure.iam_role_arn,
+        )
+
+        set_string_values = self._extract_set_string_values(helm_command)
+        self._debug(f"Extracted {len(set_string_values)} --set-string parameters")
+
+        values_file_path = self._generate_helm_values_file(
+            provider=provider,
+            cloud_deployment_id=cloud_resource_id,
+            region=region,
+            namespace=namespace,
+            infrastructure=infrastructure,
+            custom_path=values_file,
+            additional_values=set_string_values,
+        )
+
+        # Add Helm repo before installing
+        self._debug("Adding Anyscale Helm repository...")
+        self._add_helm_repo()
+
+        # Build a simple Helm command that only uses the values file
+        self._debug("Generating Helm command...")
+        helm_command = (
+            f"helm upgrade {release_name} anyscale/anyscale-operator "
+            f"--values {values_file_path} "
+            f"--namespace {namespace} "
+            f"--create-namespace "
+            f"--wait "
+            f"-i"
+        )
+
+        self._execute_helm_command(helm_command)
+
+    def _add_helm_repo(self) -> None:
+        """Add and update the Anyscale Helm repository."""
+        try:
+            # Add the Anyscale Helm repository
+            self.log.info("Adding Anyscale Helm repository...", block_label="Setup")
+            subprocess.run(
+                [
+                    "helm",
+                    "repo",
+                    "add",
+                    "anyscale",
+                    "https://anyscale.github.io/helm-charts",
+                ],
+                capture_output=True,
+                text=True,
+                check=False,  # Don't fail if repo already exists
+            )
+
+            # Update the Helm repository
+            self.log.info("Updating Helm repositories...", block_label="Setup")
+            subprocess.run(
+                ["helm", "repo", "update", "anyscale"],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            self.log.info(
+                "Helm repository configured successfully", block_label="Setup"
+            )
+        except subprocess.CalledProcessError as e:
+            self.log.error(f"Failed to configure Helm repository: {e.stderr}")
+            raise click.ClickException(
+                f"Failed to configure Helm repository: {e.stderr}"
+            )
+
+    def _extract_set_string_values(self, helm_command: str) -> Dict[str, str]:
+        """
+        Extract all --set-string key=value pairs from a Helm command.
+
+        Args:
+            helm_command: The Helm command string to parse
+
+        Returns:
+            Dictionary of key-value pairs from --set-string flags
+        """
+        import re
+
+        set_string_values = {}
+
+        # Pattern to match --set-string key=value
+        pattern = r"--set-string\s+(\S+?)=(\S+)"
+
+        matches = re.findall(pattern, helm_command)
+        for key, value in matches:
+            set_string_values[key] = value
+
+        return set_string_values
+
+    def _prompt_for_namespace(
+        self, default_namespace: str, skip_confirmation: bool = False
+    ) -> str:
+        """Prompt user for namespace confirmation."""
+        final_namespace = default_namespace or "anyscale-operator"
+
+        if skip_confirmation:
+            self.log.info(f"Using namespace: {final_namespace}", block_label="Setup")
+            return final_namespace
+
+        self.log.info("Configuring Kubernetes namespace...")
+
+        self.log.info(
+            f"Enter the namespace to use for the Anyscale operator (default: {final_namespace}):"
+        )
+        final_namespace = click.prompt("", default=final_namespace, show_default=True)
+
+        # Validate namespace (Kubernetes DNS-1123 label requirements)
+        # Must be lowercase alphanumeric or hyphens, start and end with alphanumeric, max 63 chars
+
+        if not final_namespace:
+            raise click.ClickException("Namespace cannot be empty")
+        if len(final_namespace) > 63:
+            raise click.ClickException("Namespace must be 63 characters or less")
+        if not re.match(r"^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", final_namespace):
+            raise click.ClickException(
+                "Namespace must consist of lowercase alphanumeric characters or hyphens, "
+                "and must start and end with an alphanumeric character"
+            )
+
+        self.log.info(f"Using namespace: {final_namespace}")
+
+        return final_namespace
+
+    def _generate_helm_values_file(  # noqa: PLR0913
+        self,
+        provider: str,
+        cloud_deployment_id: str,
+        region: str,
+        namespace: str,
+        infrastructure: InfrastructureResources,
+        custom_path: Optional[str] = None,
+        additional_values: Optional[Dict[str, str]] = None,
+    ) -> str:
+        """Generate Helm values file and save it locally."""
+        self.log.info("Generating Helm values file...")
+
+        # Create values dictionary starting with base values
+        values: Dict[str, Any] = {
+            "global": {
+                "cloudDeploymentId": cloud_deployment_id,
+                "cloudProvider": provider,
+                "region": region,
+                "auth": {"iamIdentity": infrastructure.iam_role_arn,},
+            },
+            "ingress-nginx": {"enabled": True},
+        }
+
+        if additional_values:
+            for key, value in additional_values.items():
+                if key not in values:
+                    values[key] = value
+
+        # Add control plane URL from ANYSCALE_HOST environment variable
+        if ANYSCALE_HOST:
+            values["controlPlaneURL"] = ANYSCALE_HOST
+            self.log.info(f"Using control plane URL: {ANYSCALE_HOST}")
+
+        if custom_path:
+            values_file_path = custom_path
+        else:
+            # Create filename with timestamp
+            import datetime
+
+            timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
+            filename = f"anyscale-helm-values-{provider}-{namespace}-{timestamp}.yaml"
+            values_file_path = os.path.join(os.getcwd(), filename)
+
+        with open(values_file_path, "w") as f:
+            yaml.dump(values, f, default_flow_style=False, sort_keys=False)
+
+        self.log.info(f"Generated Helm values file: {values_file_path}")
+
+        return values_file_path
+
+    def _execute_helm_command(self, helm_command: str) -> None:
+        """Execute the helm command."""
+        # Convert multi-line command to single line and execute
+        single_line_command = helm_command.replace(" \\\n", " ").replace("\n", " ")
+
+        self.log.info(f"Executing: {single_line_command}")
+
+        try:
+            subprocess.run(
+                single_line_command,
+                shell=True,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            self.log.info("Helm installation completed successfully")
+        except subprocess.CalledProcessError as e:
+            self.log.error(f"Helm installation failed: {e.stderr}")
+            raise click.ClickException(
+                f"Failed to install Anyscale operator: {e.stderr}"
+            )
+
+    def _verify_installation(
+        self, cloud_id: str, namespace: str, cluster_info: ClusterInfo
+    ) -> None:
+        """Verify the Kubernetes installation."""
+        self.log.info("Verifying installation...")
+
+        # Get the cloud deployment
+        cloud_resources = self.cloud_controller.get_cloud_resources(cloud_id)
+
+        if not cloud_resources:
+            raise click.ClickException("No cloud resources found for verification")
+
+        cloud_deployment = cloud_resources[0]
+
+        # Use the existing Kubernetes verifier
+        verifier = KubernetesCloudDeploymentVerifier(
+            self.log, self.cloud_controller.api_client
+        )
+
+        # Set up kubectl config for verification using the discovered context
+        verifier.k8s_config = KubernetesConfig(
+            context=cluster_info.context,  # Use the discovered context to avoid re-prompting
+            operator_namespace=namespace,
+        )
+
+        # Run verification
+        success = verifier.verify(cloud_deployment)
+
+        if success:
+            self.log.info("Verification completed successfully")
+        else:
+            self.log.error("Verification failed - please check the logs above")
+            raise click.ClickException("Installation verification failed")
+
+
+def setup_kubernetes_cloud(  # noqa: PLR0913
+    provider: str,
+    region: str,
+    name: str,
+    cluster_name: str,
+    namespace: str = "anyscale-operator",
+    project_id: Optional[str] = None,
+    functional_verify: bool = False,
+    yes: bool = False,
+    values_file: Optional[str] = None,
+    debug: bool = False,
+) -> None:
+    """
+    Set up Anyscale on a Kubernetes cluster.
+
+    This function can be called from multiple CLI commands and provides
+    the core K8s setup functionality.
+
+    Args:
+        provider: Cloud provider (aws, gcp)
+        region: Cloud region
+        name: Name for the Anyscale cloud
+        cluster_name: Kubernetes cluster name
+        namespace: Namespace for Anyscale operator (default: anyscale-operator)
+        project_id: GCP project ID (optional, for future GCP support)
+        functional_verify: Whether to run functional verification
+        yes: Skip confirmation prompts
+        values_file: Optional path for Helm values file
+        debug: Enable debug logging
+    """
+    cmd = KubernetesCloudSetupCommand(debug=debug)
+
+    try:
+        cmd.run(
+            provider=provider,
+            region=region,
+            name=name,
+            cluster_name=cluster_name,
+            namespace=namespace,
+            project_id=project_id,
+            functional_verify=functional_verify,
+            yes=yes,
+            values_file=values_file,
+        )
+    except Exception as e:  # noqa: BLE001
+        click.echo(f"Setup failed: {e}", err=True)
+        raise click.Abort()