fufu-cloud-cli 0.10.0__tar.gz → 0.11.0__tar.gz

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.10.0
+Version: 0.11.0
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -19,6 +19,7 @@ Provides-Extra: gcp
 Requires-Dist: google-cloud-bigquery==3.38.0; extra == "gcp"
 Requires-Dist: google-cloud-tasks==2.20.0; extra == "gcp"
 Requires-Dist: google-cloud-logging==3.12.1; extra == "gcp"
+Requires-Dist: google-cloud-storage==3.4.1; extra == "gcp"
 Dynamic: license-file
 
 # FUFU Cloud CLI
@@ -27,6 +28,31 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.11.0 新增獨占 GPU VM 的租用命令。需由平台啟用並驗證對應實體節點；
+支援的 RTX 3060 為整卡直通至 KVM 客體，可執行 NVIDIA 驅動與 CUDA。
+停止 VM 仍保留整卡，刪除後才釋放。GPU 使用中或已保留會明確拒絕，
+不會自動中斷其他工作。CLI 不包含節點 SSH 金鑰、主機裝置管理程式或平台設定。
+
+```bash
+gcloud-fufu compute instances create gpu-demo \
+  --zone=GPU_ZONE --machine-type=n1-standard-4 \
+  --accelerator=type=nvidia-geforce-rtx-3060,count=1 \
+  --maintenance-policy=TERMINATE
+gcloud-fufu compute ssh gpu-demo --zone=GPU_ZONE --command='nvidia-smi'
+gcloud-fufu compute instances delete gpu-demo --zone=GPU_ZONE
+
+aws-fufu ec2 run-instances --image-id=fufu-debian-12-gpu \
+  --instance-type=fufu.rtx3060.xlarge --placement=AvailabilityZone=GPU_ZONE
+```
+
+`GPU_ZONE` 使用平台 GPU 選單提供的區域。`nvidia-geforce-rtx-3060` 與
+`fufu.rtx3060.xlarge` 是 FUFU 的硬體擴充名稱；遷移到官方雲端時需改為官方
+提供的機型、加速器與區域。這不表示與官方 GPU 型號、HA、計費或 IAM 完全等價。
+
+0.10.1 新增官方 Terraform／OpenTofu／Pulumi 的 S3／GCS bucket 生命週期與
+S3 bucket tags。需配套 FUFU API；不支援 bucket versioning、retention、
+KMS、bucket IAM、GCS bucket labels 或 force destroy。
+
 0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
 需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
 叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
@@ -35,7 +61,7 @@ get-credentials／update-kubeconfig、waiter 與刪除。
 取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
 工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
 
-VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+VM 尚無公開 IP、複寫儲存、live migration 或 GPU 熱插拔；
 叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
 這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
 原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
@@ -131,7 +157,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.10.0'
+pip install 'fufu-cloud-cli==0.11.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

fufu_cloud_cli-0.10.0/src/fufu_cloud_cli.egg-info/PKG-INFO → fufu_cloud_cli-0.11.0/README.md

@@ -1,32 +1,34 @@
-Metadata-Version: 2.4
-Name: fufu-cloud-cli
-Version: 0.10.0
-Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
-License-Expression: LicenseRef-Proprietary
-Requires-Python: >=3.10
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: PyYAML==6.0.3
-Requires-Dist: jmespath==1.1.0
-Requires-Dist: tomli==2.2.1; python_version < "3.11"
-Provides-Extra: yaml
-Requires-Dist: PyYAML==6.0.3; extra == "yaml"
-Provides-Extra: test
-Requires-Dist: boto3==1.40.66; extra == "test"
-Provides-Extra: terraform
-Requires-Dist: python-hcl2==7.3.1; extra == "terraform"
-Provides-Extra: gcp
-Requires-Dist: google-cloud-bigquery==3.38.0; extra == "gcp"
-Requires-Dist: google-cloud-tasks==2.20.0; extra == "gcp"
-Requires-Dist: google-cloud-logging==3.12.1; extra == "gcp"
-Dynamic: license-file
-
 # FUFU Cloud CLI
 
 以六個指令操作 FUFU Cloud 的租戶隔離開發環境：`fufu`、`aws-fufu`、
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.11.0 新增獨占 GPU VM 的租用命令。需由平台啟用並驗證對應實體節點；
+支援的 RTX 3060 為整卡直通至 KVM 客體，可執行 NVIDIA 驅動與 CUDA。
+停止 VM 仍保留整卡，刪除後才釋放。GPU 使用中或已保留會明確拒絕，
+不會自動中斷其他工作。CLI 不包含節點 SSH 金鑰、主機裝置管理程式或平台設定。
+
+```bash
+gcloud-fufu compute instances create gpu-demo \
+  --zone=GPU_ZONE --machine-type=n1-standard-4 \
+  --accelerator=type=nvidia-geforce-rtx-3060,count=1 \
+  --maintenance-policy=TERMINATE
+gcloud-fufu compute ssh gpu-demo --zone=GPU_ZONE --command='nvidia-smi'
+gcloud-fufu compute instances delete gpu-demo --zone=GPU_ZONE
+
+aws-fufu ec2 run-instances --image-id=fufu-debian-12-gpu \
+  --instance-type=fufu.rtx3060.xlarge --placement=AvailabilityZone=GPU_ZONE
+```
+
+`GPU_ZONE` 使用平台 GPU 選單提供的區域。`nvidia-geforce-rtx-3060` 與
+`fufu.rtx3060.xlarge` 是 FUFU 的硬體擴充名稱；遷移到官方雲端時需改為官方
+提供的機型、加速器與區域。這不表示與官方 GPU 型號、HA、計費或 IAM 完全等價。
+
+0.10.1 新增官方 Terraform／OpenTofu／Pulumi 的 S3／GCS bucket 生命週期與
+S3 bucket tags。需配套 FUFU API；不支援 bucket versioning、retention、
+KMS、bucket IAM、GCS bucket labels 或 force destroy。
+
 0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
 需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
 叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
@@ -35,7 +37,7 @@ get-credentials／update-kubeconfig、waiter 與刪除。
 取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
 工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
 
-VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+VM 尚無公開 IP、複寫儲存、live migration 或 GPU 熱插拔；
 叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
 這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
 原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
@@ -131,7 +133,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.10.0'
+pip install 'fufu-cloud-cli==0.11.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.10.0"
+version = "0.11.0"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -16,7 +16,7 @@ license-files = ["LICENSE"]
 yaml = ["PyYAML==6.0.3"]
 test = ["boto3==1.40.66"]
 terraform = ["python-hcl2==7.3.1"]
-gcp = ["google-cloud-bigquery==3.38.0", "google-cloud-tasks==2.20.0", "google-cloud-logging==3.12.1"]
+gcp = ["google-cloud-bigquery==3.38.0", "google-cloud-tasks==2.20.0", "google-cloud-logging==3.12.1", "google-cloud-storage==3.4.1"]
 
 [project.scripts]
 fufu = "fufu_cloud_cli.cli:main"

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.10.0"
+__version__ = "0.11.0"

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/api_backend.py

@@ -184,6 +184,22 @@ class ApiClient:
                 return json.loads(raw)
         except HTTPError as exc:
             status = exc.code
+            if '/infrastructure/' in path and status in {409, 422, 503, 504}:
+                try:
+                    value = json.loads(exc.read(4096))
+                    code = value.get('code') if isinstance(value, dict) else None
+                    messages = {
+                        'GPU_IN_USE': '符合條件的 GPU 正在使用；未搶占現有工作或重複出租。',
+                        'GPU_RESERVED': 'GPU 已由另一台 VM 保留；停止 VM 仍保留 GPU，刪除後才會釋放。',
+                        'GPU_RECOVERY_REQUIRED': 'GPU 正在等待安全恢復；平台保留所有權，恢復前不接受再次租用。',
+                        'GPU_NODE_UNAVAILABLE': 'GPU 節點暫時無法連線；請稍後重試。',
+                        'GPU_TRANSITION_TIMEOUT': 'GPU 裝置交接逾時；所有權仍受保護，請檢查 VM 狀態。',
+                        'INSUFFICIENT_NODE_STORAGE': '目標 GPU 節點的 SSD 可用空間不足。',
+                    }
+                    if code in messages:
+                        raise FufuError(code, messages[code]) from None
+                except (ValueError, OSError): pass
+                finally: exc.close()
             if '/infrastructure/' in path and status == 429:
                 try:
                     value = json.loads(exc.read(4096))

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/aws_errors.py

@@ -1,6 +1,6 @@
 """Only documented provider error codes may cross the public transport boundary."""
 AWS_ERRORS = frozenset('''ConditionalCheckFailedException ResourceNotFoundException ResourceInUseException ResourceAlreadyExistsException ValidationException
-NoSuchKey NoSuchBucket NotFound NotModified ParameterNotFound ParameterAlreadyExists ParameterVersionNotFound QueueDoesNotExist
+NoSuchKey NoSuchBucket NoSuchTagSet BucketAlreadyExists BucketAlreadyOwnedByYou BucketNotEmpty NotFound NotModified ParameterNotFound ParameterAlreadyExists ParameterVersionNotFound QueueDoesNotExist
 PreconditionFailed InvalidRange InvalidParameterException InvalidParameterValue InvalidAttributeName InvalidAttributeValue QueueNameExists
 PurgeQueueInProgress ReceiptHandleIsInvalid BatchEntryIdsNotDistinct EmptyBatchRequest BatchRequestTooLong InvalidBatchEntryId
 TooManyEntriesInBatchRequest InvalidMessageContents AWS.SimpleQueueService.NonExistentQueue TooManyRequestsException InvalidRequestContentException'''.split())

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/capabilities.json

@@ -27,11 +27,11 @@
       "backend": "api",
       "compatibility": "official-provider-subset",
       "providers": { "hashicorp/aws": "6.63.0", "hashicorp/google": "8.1.0" },
-      "resources": ["aws_iam_role", "aws_iam_role_policy", "aws_lambda_function", "aws_lambda_function_url", "aws_lambda_permission", "google_service_account", "google_cloud_run_v2_service", "google_cloud_run_v2_service_iam_member", "aws_sqs_queue", "aws_ssm_parameter", "google_pubsub_topic", "google_pubsub_subscription"],
+      "resources": ["aws_iam_role", "aws_iam_role_policy", "aws_lambda_function", "aws_lambda_function_url", "aws_lambda_permission", "google_service_account", "google_cloud_run_v2_service", "google_cloud_run_v2_service_iam_member", "aws_sqs_queue", "aws_ssm_parameter", "google_pubsub_topic", "google_pubsub_subscription", "aws_s3_bucket", "google_storage_bucket"],
       "operations": ["init", "plan", "saved-plan-apply", "refresh", "update", "import", "destroy"],
-      "engines": { "terraform": "1.16.1", "opentofu": "1.12.6" },
+      "engines": { "terraform": "1.16.2", "opentofu": "1.12.6" },
       "state": ["isolated-local", "tenant-remote-http", "context-binding"],
-      "limitations": ["Linux-amd64-verified", "terraform-extra-required", "root-default-providers-only", "OpenTofu-data-resources-verified-compute-not-retested", "no-full-cloud-IAM-or-runtime-equivalence", "no-Terraform-storage-or-Functions-Gen1-Gen2", "PubSub-requires-patched-emulator", "unsupported-APIs-and-fields-fail-explicitly"]
+      "limitations": ["Linux-amd64-verified", "terraform-extra-required", "root-default-providers-only", "OpenTofu-data-resources-verified-compute-not-retested", "no-full-cloud-IAM-or-runtime-equivalence", "no-VM-cluster-Functions-Gen1-Gen2-IaC", "storage-bucket-lifecycle-and-S3-tags-only", "no-force-destroy-retention-versioning-bucket-IAM-KMS", "PubSub-requires-patched-emulator", "unsupported-APIs-and-fields-fail-explicitly"]
     },
     "iac-remote-state": {
       "status": "implemented", "backend": "api", "mode": "simplified",
@@ -41,7 +41,7 @@
     "pulumi-data": {
       "status": "implemented", "backend": "api", "compatibility": "official-provider-subset",
       "providers": { "pulumi": "3.261.0", "aws": "7.45.0", "gcp": "9.36.1" },
-      "resources": ["aws:sqs/queue:Queue", "aws:ssm/parameter:Parameter", "gcp:pubsub/topic:Topic", "gcp:pubsub/subscription:Subscription"],
+      "resources": ["aws:sqs/queue:Queue", "aws:ssm/parameter:Parameter", "gcp:pubsub/topic:Topic", "gcp:pubsub/subscription:Subscription", "aws:s3/bucket:Bucket", "gcp:storage/bucket:Bucket"],
       "operations": ["preview", "up", "refresh", "update", "import", "destroy"],
       "limitations": ["Node.js-runtime", "default-providers", "separate-local-DIY-state", "external-passphrase-required", "secret-fields-encrypted-not-whole-state", "no-remote-backend", "no-compute-resource-acceptance", "trusted-programs-only"]
     },
@@ -197,7 +197,8 @@
         "metadata-describe-update-merge-delete",
         "paginated-object-list",
         "binary-cat",
-        "UTF8-preview"
+        "UTF8-preview",
+        "Terraform-OpenTofu-Pulumi-bucket-lifecycle"
       ],
       "limitations": [
         "object-5TiB-policy-subject-to-host-disk-capacity",
@@ -209,7 +210,8 @@
         "single-writer-per-volume",
         "no-signed-URLs",
         "no-versioning-retention-ACL-KMS",
-        "no-GCS-Terraform-or-Pulumi-resource-adapter"
+        "no-bucket-labels-IAM-PATCH-force-destroy",
+        "bucket-current-tenant-location-STANDARD-only"
       ]
     },
     "azure-catalog-api": {
@@ -270,7 +272,11 @@
         "rb",
         "ls",
         "cp-upload-download",
-        "rm"
+        "rm",
+        "get-bucket-tagging",
+        "put-bucket-tagging",
+        "delete-bucket-tagging",
+        "Terraform-OpenTofu-Pulumi-bucket-lifecycle"
       ],
       "limitations": [
         "object-10000-parts-of-up-to-5GiB-subject-to-host-disk-capacity",
@@ -538,9 +544,9 @@
       "backend": "api",
       "mode": "simplified",
       "operations": [
-        "create-list-describe-delete", "stop-start", "guest-ssh-command"
+        "create-list-describe-delete", "stop-start", "guest-ssh-command", "exclusive-gpu-vm"
       ],
-      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "no-self-service-GPU-passthrough", "no-official-IaC-provider"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "GPU-requires-enabled-validated-node", "GPU-exclusive-until-delete", "no-GPU-hotplug-or-live-migration", "no-official-IaC-provider"],
       "reason": "實際 KVM／KubeVirt VM、持久磁碟與 SSH 指令；原生風格指令子集，無官方雲端資源。"
     },
     "gcp-gke": {
@@ -642,8 +648,8 @@
       "status": "implemented",
       "backend": "api",
       "mode": "simplified",
-      "operations": ["run-describe-terminate-instances", "stop-start", "instance-waiters"],
-      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "no-self-service-GPU-passthrough", "no-official-IaC-provider"],
+      "operations": ["run-describe-terminate-instances", "stop-start", "instance-waiters", "exclusive-gpu-vm"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "GPU-requires-enabled-validated-node", "GPU-exclusive-until-delete", "no-GPU-hotplug-or-live-migration", "no-official-IaC-provider"],
       "reason": "實際 KVM／KubeVirt VM；支援生命週期與 scoped instance ID，無官方 EC2 網路或完整 API。"
     },
     "aws-ecs": {

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/cli.py

@@ -128,6 +128,7 @@ def fufu_parser():
     sub.add_parser('pulumi', help='官方 Pulumi Node.js SDK；使用獨立 FUFU 開發 state')
     sub.add_parser('state', help='管理 Terraform／OpenTofu 遠端 state、版本與鎖')
     sub.add_parser('infrastructure', help='GCP 基礎設施配置 mock 的查詢與 CRUD；不啟動資源')
+    sub.add_parser('usage', help='逐台 VM 的月用量、電量分攤估算與成本明細')
     for action in ("plan", "deploy"):
         q = sub.add_parser(action)
         q.add_argument("--file", required=True)
@@ -515,6 +516,12 @@ def entry(provider, argv=None):
         if provider == 'fufu' and argv[:1] == ['state']:
             from .iac_state import command
             emit(command(argv[1:], Parser)); return
+        if provider == 'fufu' and argv[:1] == ['usage']:
+            from .usage import command
+            value = command(argv[1:], Parser)
+            if isinstance(value, str): sys.stdout.write(value)
+            else: emit(value)
+            return
         if provider == 'fufu' and argv[:1] == ['infrastructure']:
             from .gcp_infra import configuration_command
             emit(configuration_command(argv[1:], Parser)); return

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/control.py

@@ -28,6 +28,7 @@ AWS_OPERATIONS = {
  },
  's3api': {
   'CreateBucket': 'Bucket CreateBucketConfiguration', 'DeleteBucket': 'Bucket', 'ListBuckets': '', 'HeadBucket': 'Bucket', 'GetBucketLocation': 'Bucket',
+  'GetBucketTagging': 'Bucket', 'PutBucketTagging': 'Bucket Tagging', 'DeleteBucketTagging': 'Bucket',
   'ListObjectsV2': 'Bucket Prefix MaxKeys ContinuationToken Delimiter StartAfter EncodingType', 'PutObject': 'Bucket Key Body ContentType Metadata',
   'GetObject': 'Bucket Key ChecksumMode Range IfMatch IfNoneMatch', 'HeadObject': 'Bucket Key ChecksumMode IfMatch IfNoneMatch', 'DeleteObject': 'Bucket Key',
  },
@@ -53,7 +54,7 @@ AWS_OPERATIONS = {
   'PutRetentionPolicy': 'logGroupName retentionInDays', 'DeleteRetentionPolicy': 'logGroupName',
  },
 }
-JSON_FIELDS = set('AssumeRolePolicyDocument PolicyDocument AttributeDefinitions KeySchema ProvisionedThroughput GlobalSecondaryIndexes LocalSecondaryIndexes StreamSpecification Item Key ExpressionAttributeNames ExpressionAttributeValues ExclusiveStartKey RequestItems CreateBucketConfiguration Metadata Attributes MessageAttributes Tags tags ParameterFilters Entries logEvents'.split())
+JSON_FIELDS = set('AssumeRolePolicyDocument PolicyDocument AttributeDefinitions KeySchema ProvisionedThroughput GlobalSecondaryIndexes LocalSecondaryIndexes StreamSpecification Item Key ExpressionAttributeNames ExpressionAttributeValues ExclusiveStartKey RequestItems CreateBucketConfiguration Metadata Attributes MessageAttributes Tags tags Tagging ParameterFilters Entries logEvents'.split())
 LIST_FIELDS = set('ActionNames ResourceArns Names AttributeNames MessageAttributeNames MessageSystemAttributeNames TagKeys logStreamNames'.split())
 BOOL_FIELDS = set('ConsistentRead ScanIndexForward WithDecryption Overwrite Enabled Recursive descending startFromHead'.split())
 INT_FIELDS = set('Limit MaxKeys MaxResults MaxNumberOfMessages VisibilityTimeout WaitTimeSeconds DelaySeconds BatchSize limit startTime endTime retentionInDays'.split())

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/docker_backend.py

@@ -38,6 +38,7 @@ INGRESS_IMAGE = "fufu-cloud-cli-ingress:local"
 LABEL = "io.fufu.cloud-cli"
 KINDS = {"cloud-run-http", "cloud-run-functions-http", "cloud-functions-gen1-http", "aws-lambda-sync"}
 from .limits import compute_limits, MAX_SOURCE_FILES, size_label, workload_resources
+from .gateway_contract import api_gateway_labels
 from .capacity import run_admitted
 
 MAX_PAYLOAD = 32 * 1024 * 1024
@@ -284,8 +285,8 @@ class Backend:
                 require(gateway_container is not None, 'GATEWAY_UNAVAILABLE', 'Workload gateway 尚未配置。')
                 gateway = object_json(docker('container', 'inspect', gateway_container, '--format',
                     '{"id":{{json .Id}},"labels":{{json .Config.Labels}},"networks":{{json .NetworkSettings.Networks}},"running":{{json .State.Running}}}'))
-                require(gateway['running'] and gateway['labels'].get('com.docker.compose.service') == 'local-cloud-console',
-                        'GATEWAY_UNAVAILABLE', '指定 gateway 必須是正在執行的 FUFU Console。')
+                require(gateway['running'] and api_gateway_labels(gateway['labels']),
+                        'GATEWAY_UNAVAILABLE', '指定 gateway 必須是正在執行且已核准的 FUFU API 入口。')
                 if network not in gateway['networks']:
                     docker('network', 'connect', '--alias', 'fufu-api', network, gateway['id'])
             revision = str(uuid.uuid4()) if kind == 'aws-lambda-sync' else f"{service}-{uuid.uuid4().hex[:8]}"
@@ -325,7 +326,7 @@ class Backend:
                           'lastModified': datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%S.%f')[:23] + '+0000',
                           'architecture': {'x86_64': 'x86_64', 'aarch64': 'arm64'}.get(platform.machine()),
                           **({'network': network, 'gateway_id': gateway['id']} if gateway else {}),
-                          **({'role': role, 'sdkTransport': 'fufu-workload-token', 'iamEnforced': True} if role else {}),
+                          **({'role': role, 'sdkTransport': 'aws-sigv4-wire' if (runtime_env or {}).get('FUFU_AWS_SDK_TRANSPORT') == 'native-v1' else 'fufu-workload-token', 'iamEnforced': True} if role else {}),
                           **({'build': build} if build else {}),
                           **({'source': source} if source else {}),
                           **({'imageReference': image_reference} if image_reference else {}),
@@ -354,7 +355,8 @@ class Backend:
                     "--network", self.ingress_network, "--publish", "127.0.0.1::8080",
                     "--user", "10001:10001", "--read-only", "--cap-drop", "ALL",
                     "--security-opt", "no-new-privileges:true", "--pids-limit", "64", "--memory", "64m", "--cpus", "0.25",
-                    "--log-opt", "max-size=1m", "--log-opt", "max-file=1",
+                    "--log-driver", "local", "--log-opt", "max-size=1m",
+                    "--log-opt", "max-file=2", "--log-opt", "compress=true",
                     "--env", "FUFU_UPSTREAM_HOST", "--env", "FUFU_UPSTREAM_PORT", ingress_image_id,
                     env={"FUFU_UPSTREAM_HOST": cname, "FUFU_UPSTREAM_PORT": str(port)})
                 docker("network", "connect", network, ingress_candidate)
@@ -566,11 +568,11 @@ def prepare_runtime(runtimes=("python3.12",)):
     return {"prepared": ["functions-python312", "ingress", *runtimes], "backend": "local-docker"}
 
 
-def build_function(source, target, *, network="default"):
+def build_function(source, target, *, network="default", image_store=None):
     require(re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", target or ""), "INVALID_HANDLER", "入口必須是有效 Python 函式名稱。")
     src = Path(source).resolve()
     require(src.is_dir() and (src / "main.py").is_file(), "INVALID_SOURCE", "Python function 來源需包含 main.py。")
-    inspect_image(FUNCTIONS_IMAGE)
+    (image_store.inspect_image if image_store else inspect_image)(FUNCTIONS_IMAGE)
     base = FUNCTIONS_IMAGE
     with tempfile.TemporaryDirectory(prefix="fufu-function-") as tmp:
         dst = Path(tmp)
@@ -595,6 +597,12 @@ def build_function(source, target, *, network="default"):
         requirements = dst / "app/requirements.txt"
         if not requirements.exists():
             requirements.write_text("")
+        if image_store:
+            require(not requirements.read_text().strip(), 'DEPENDENCIES_NOT_PREPARED',
+                    '離線 Function 配方需要預先準備相依套件。')
+            return image_store.layer(base, dst / 'app', '/app', [
+                'functions-framework', '--target', target, '--signature-type', 'http',
+                '--host', '0.0.0.0', '--port', '8080'], workdir='/app')
         # 原始 requirements 可安裝應用相依；build 有網路，runtime 不開放 egress。
         dockerfile = (f"FROM {base}\nUSER 0\nCOPY app/requirements.txt /tmp/requirements.txt\n"
                       "RUN python -m pip install --index-url https://pypi.org/simple --disable-pip-version-check --no-cache-dir --retries 1 --timeout 20 -r /tmp/requirements.txt\n"
@@ -637,11 +645,11 @@ def extract_zip(archive, destination, *, kind="aws-lambda-sync"):
         raise FufuError("INVALID_ZIP", "ZIP 無法安全解壓縮。") from exc
 
 
-def build_lambda(archive, runtime, handler):
+def build_lambda(archive, runtime, handler, *, image_store=None):
     require(runtime in LAMBDA_IMAGES, "UNSUPPORTED_RUNTIME", "目前只支援 Python 3.10 與 3.12 Lambda ZIP。")
     require(re.fullmatch(r"[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+", handler or ""), "INVALID_HANDLER", "Lambda handler 格式應為 module.function。")
     base = LAMBDA_IMAGES[runtime]
-    inspect_image(base)
+    (image_store.inspect_image if image_store else inspect_image)(base)
     with tempfile.TemporaryDirectory(prefix="fufu-lambda-") as tmp:
         dst = Path(tmp)
         app = dst / "app"
@@ -661,17 +669,20 @@ def build_lambda(archive, runtime, handler):
         require(not transfer.exists(), 'RESERVED_FILE', '來源與物件傳輸 helper 的保留檔名衝突。')
         shutil.copyfile(Path(__file__).with_name('object_transfer.py'), transfer)
         transfer.chmod(0o644)
+        if image_store:
+            return image_store.layer(base, app, '/var/task', ['_fufu_runtime_adapter.handler'],
+                                     {'FUFU_HANDLER': handler})
         (dst / "Dockerfile").write_text(f"FROM {base}\nENV FUFU_HANDLER={handler}\nCOPY --chown=10001:10001 app/ ${{LAMBDA_TASK_ROOT}}/\nCMD " + json.dumps(["_fufu_runtime_adapter.handler"]) + "\n")
         return build_image(dst, f"fufu-cli-lambda:{uuid.uuid4().hex}")
 
 
-def build_cloud_run(archive, handler, port, tag):
+def build_cloud_run(archive, handler, port, tag, *, image_store=None):
     """固定 Python ASGI 配方；不執行使用者 Dockerfile、安裝程式或建置 hook。"""
     require(isinstance(handler, str) and re.fullmatch(r"[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*:[A-Za-z_]\w*", handler),
             'INVALID_HANDLER', 'ASGI entry point 必須是 module:app。')
     require(type(port) is int and 1024 <= port <= 65535, 'INVALID_PORT', '容器 port 範圍為 1024–65535。')
     require(re.fullmatch(r'fufu-source:[a-f0-9]{64}', tag), 'INVALID_IMAGE', '來源映像名稱無效。')
-    inspect_image(PYTHON_IMAGE)
+    (image_store.inspect_image if image_store else inspect_image)(PYTHON_IMAGE)
     base = PYTHON_IMAGE
     with tempfile.TemporaryDirectory(prefix='fufu-asgi-') as tmp:
         context = Path(tmp)
@@ -707,6 +718,9 @@ def build_cloud_run(archive, handler, port, tag):
         shutil.copyfile(Path(__file__).with_name('object_transfer.py'), transfer)
         transfer.chmod(0o644)
         command = ['python', '-m', 'uvicorn', handler, '--host', '0.0.0.0', '--port', str(port)]
+        if image_store:
+            return image_store.layer(base, app, '/app', command,
+                                     {'PYTHONDONTWRITEBYTECODE': '1', 'PYTHONUNBUFFERED': '1'}, workdir='/app')
         (context / 'Dockerfile').write_text(
             f'FROM {base}\nCOPY --chown=10001:10001 app/ /app/\nWORKDIR /app\n'
             'ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1\nUSER 10001:10001\n'

fufu_cloud_cli-0.11.0/src/fufu_cloud_cli/gateway_contract.py

@@ -0,0 +1,8 @@
+"""管理者配置的 API gateway；容器標籤只能由受信任的宿主控制器設定。"""
+
+
+def api_gateway_labels(labels):
+    if not isinstance(labels, dict):
+        return False
+    return labels.get('com.docker.compose.service') == 'local-cloud-console' or \
+        labels.get('io.fufu.platform-bridge') == 'console-rke2-v1'

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/gcp_sdk.py

@@ -38,6 +38,13 @@ def tasks_client():
     return tasks_v2.CloudTasksClient(credentials=credentials, transport='rest', client_options={'api_endpoint': endpoint + '/tasks'})
 
 
+def storage_client():
+    """Official Storage JSON API with the same managed workload identity."""
+    from google.cloud import storage
+    endpoint, project, credentials = _configuration()
+    return storage.Client(project=project, credentials=credentials, client_options={'api_endpoint': endpoint + '/storage'})
+
+
 def logging_client():
     from google.cloud import logging_v2
     from google.cloud.logging_v2.resource import Resource

{fufu_cloud_cli-0.10.0 → fufu_cloud_cli-0.11.0}/src/fufu_cloud_cli/infrastructure.py

@@ -8,6 +8,7 @@ from pathlib import Path
 import re
 import shutil
 import ssl
+import stat
 import sys
 import tempfile
 import time
@@ -21,11 +22,12 @@ from .errors import FufuError, require
 BASE = '/infrastructure/resources/'
 VM_TYPES = {'e2-micro': (2, 1), 'e2-small': (2, 2), 'e2-medium': (2, 4), 'e2-standard-2': (2, 8),
     'e2-standard-4': (4, 16), 'e2-standard-8': (8, 32), 't3.micro': (2, 1), 't3.small': (2, 2),
-    't3.medium': (2, 4), 'm5.large': (2, 8), 'm5.xlarge': (4, 16), 'm5.2xlarge': (8, 32)}
+    't3.medium': (2, 4), 'm5.large': (2, 8), 'm5.xlarge': (4, 16), 'm5.2xlarge': (8, 32),
+    'n1-standard-4': (4, 15), 'n1-standard-8': (8, 30), 'fufu.rtx3060.xlarge': (4, 16)}
 
 
 def warn(kind):
-    sys.stderr.write('FUFU runtime: ' + ('KVM VM with a private network and one-node persistent disk; no GPU passthrough.\n' if kind == 'vm' else
+    sys.stderr.write('FUFU runtime: ' + ('KVM VM with a private network and one-node persistent disk; optional exclusive GPU on validated nodes, retained until deletion.\n' if kind == 'vm' else
         'Independent Kubernetes API with shared worker nodes; private ClusterIP services, no workload PVCs or native cloud IAM.\n'))
 
 
@@ -55,6 +57,8 @@ def gcp_shape(value, kind):
     if kind == 'vm':
         return {'name': value['name'], 'status': {'STOPPED': 'TERMINATED', 'DELETING': 'STOPPING'}.get(value['state'], value['state']),
             'machineType': spec.get('machineType'), 'zone': spec.get('location'),
+            **({'guestAccelerators': [{'acceleratorType': spec['gpu']['type'], 'acceleratorCount': spec['gpu']['count']}],
+                'scheduling': {'onHostMaintenance': 'TERMINATE'}} if spec.get('gpu') else {}),
             'disks': [{'boot': True, 'diskSizeGb': str(spec.get('diskGiB', 20))}], 'Fufu': fufu_fields(value)}
     return {'name': value['name'], 'status': {'PROVISIONING': 'PROVISIONING', 'RUNNING': 'RUNNING', 'ERROR': 'ERROR', 'DELETING': 'STOPPING'}.get(value['state'], value['state']),
         'location': spec.get('location'), 'currentMasterVersion': spec.get('version'), 'Fufu': fufu_fields(value)}
@@ -65,13 +69,41 @@ def aws_shape(value, kind, who):
     if kind == 'vm':
         identifier = 'i-' + hashlib.sha256((str(who['tenantId']) + value['name'] + value.get('resourceId', value.get('createdAt', ''))).encode()).hexdigest()[:17]
         state = {'RUNNING': (16, 'running'), 'STOPPED': (80, 'stopped'), 'STOPPING': (64, 'stopping'), 'DELETING': (32, 'shutting-down'), 'DELETED': (48, 'terminated')}.get(value['state'], (0, 'pending'))
-        return {'InstanceId': identifier, 'InstanceType': spec.get('machineType'), 'ImageId': 'fufu-debian-12',
+        return {'InstanceId': identifier, 'InstanceType': spec.get('machineType'), 'ImageId': 'fufu-debian-12-gpu' if spec.get('gpu') else 'fufu-debian-12',
+            'Placement': {'AvailabilityZone': spec.get('location')},
             'State': {'Code': state[0], 'Name': state[1]}, 'Tags': [{'Key': 'Name', 'Value': value['name']}], 'Fufu': fufu_fields(value)}
     return {'name': value['name'], 'arn': f"arn:aws:eks:{who['region']}:{who['accountId']}:cluster/{value['name']}",
         'status': {'RUNNING': 'ACTIVE', 'PROVISIONING': 'CREATING', 'DELETING': 'DELETING', 'ERROR': 'FAILED'}.get(value['state'], value['state']),
         'version': spec.get('version'), 'Fufu': fufu_fields(value)}
 
 
+def read_shell_certificate(certificate):
+    """Read a bounded CA file, including a Kubernetes projected Secret link.
+
+    Kubelet projects each Secret key through ``..data``. Resolve it inside the
+    fixed session mount, then inspect and read one non-following file descriptor.
+    External links, special files and writable trust files remain rejected.
+    """
+    fd = None
+    try:
+        target = certificate.resolve(strict=True)
+        target.relative_to(certificate.parent.resolve(strict=True))
+        fd = os.open(target, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC)
+        info = os.fstat(fd)
+        require(stat.S_ISREG(info.st_mode) and not info.st_mode & 0o022 and 0 < info.st_size <= 16384,
+                'INVALID_SESSION', 'Cloud Shell TLS 憑證不存在或無效，請重新開啟 Shell。')
+        data = os.read(fd, 16385)
+        require(0 < len(data) <= 16384, 'INVALID_SESSION', 'Cloud Shell TLS 憑證大小無效。')
+        content = data.decode('ascii')
+        ssl.PEM_cert_to_DER_cert(content)
+        return content
+    except (OSError, ValueError, UnicodeError):
+        raise FufuError('INVALID_SESSION', 'Cloud Shell TLS 憑證不存在或無效，請重新開啟 Shell。') from None
+    finally:
+        if fd is not None:
+            os.close(fd)
+
+
 def kubernetes_transport(api, name, who):
     endpoint = api.endpoint
     cluster = {}
@@ -79,13 +111,7 @@ def kubernetes_transport(api, name, who):
         require(os.environ.get('FUFU_SESSION_FILE') == '/run/fufu/session.json',
             'INVALID_SESSION', 'Cloud Shell 工作階段來源不符。')
         certificate = Path('/run/fufu/kubernetes-ca.crt')
-        require(certificate.is_file() and not certificate.is_symlink() and certificate.stat().st_size <= 16384,
-            'INVALID_SESSION', 'Cloud Shell TLS 憑證不存在或無效，請重新開啟 Shell。')
-        content = certificate.read_text(encoding='ascii')
-        try:
-            ssl.PEM_cert_to_DER_cert(content)
-        except ValueError:
-            raise FufuError('INVALID_SESSION', 'Cloud Shell TLS 憑證無效。') from None
+        content = read_shell_certificate(certificate)
         endpoint = 'https://127.0.0.1:8788'
         cluster['certificate-authority-data'] = base64.b64encode(content.encode('ascii')).decode('ascii')
     cluster['server'] = endpoint + f'/api/cloud/{api.provider}/infrastructure/clusters/{segment(name)}/kubernetes'
@@ -179,6 +205,7 @@ def gcp_command(argv, Parser):
             if kind == 'vm':
                 q.add_argument('--machine-type', default='e2-small'); q.add_argument('--image-family', default='debian-12')
                 q.add_argument('--image-project', default='debian-cloud'); q.add_argument('--boot-disk-size', default='20GB')
+                q.add_argument('--accelerator'); q.add_argument('--maintenance-policy', choices=['MIGRATE', 'TERMINATE'], default='MIGRATE')
             else:
                 q.add_argument('--cluster-version', default='1.36')
     a = p.parse_args(tail)
@@ -197,12 +224,20 @@ def gcp_command(argv, Parser):
             who = api.whoami()
             spec = {'location': a.zone or a.location or who.get('region')}
             if kind == 'vm':
-                require(a.machine_type in VM_TYPES and a.machine_type.startswith('e2-') and a.image_family == 'debian-12' and a.image_project == 'debian-cloud',
+                require(a.machine_type in VM_TYPES and a.machine_type.startswith(('e2-', 'n1-')) and a.image_family == 'debian-12' and a.image_project == 'debian-cloud',
                     'UNSUPPORTED_CONFIG', '目前提供已驗證的 Debian 12 映像與列明的 VM 規格。')
                 match = re.fullmatch(r'(\d+)(?:GB|GiB)?', a.boot_disk_size, re.I)
                 require(match is not None, 'INVALID_CONFIG', '磁碟大小須為整數 GB。')
                 cpu, memory = VM_TYPES[a.machine_type]
                 spec.update(cpu=cpu, memoryGiB=memory, machineType=a.machine_type, diskGiB=int(match[1]), image=a.image_family)
+                if a.accelerator:
+                    parts = a.accelerator.split(',')
+                    require(len(parts) == 2 and all('=' in p for p in parts), 'INVALID_CONFIG', 'Accelerator 格式為 type=nvidia-geforce-rtx-3060,count=1。')
+                    gpu = dict(p.split('=', 1) for p in parts)
+                    require(gpu == {'type': 'nvidia-geforce-rtx-3060', 'count': '1'}, 'UNSUPPORTED_CONFIG', '目前 GPU VM 僅開放已驗證的 RTX 3060；此型號為 FUFU 硬體擴充。')
+                    require(a.machine_type.startswith('n1-') and a.maintenance_policy == 'TERMINATE', 'INVALID_CONFIG',
+                            'GPU VM 請使用 n1-standard-4 或 n1-standard-8，並指定 --maintenance-policy=TERMINATE。')
+                    spec['gpu'] = {'type': gpu['type'], 'count': 1}
             else: spec['version'] = a.cluster_version
             value = api.request('POST', route(kind, a.name), {'spec': spec})
         elif a.action == 'delete': value = api.request('DELETE', route(kind, a.name))
@@ -226,6 +261,7 @@ def aws_command(argv, Parser):
     else:
         q = actions.add_parser('run-instances'); q.add_argument('--image-id', required=True); q.add_argument('--instance-type', default='t3.small')
         q.add_argument('--count', type=int, default=1); q.add_argument('--tag-specifications')
+        q.add_argument('--placement')
         for action in ['describe-instances', 'start-instances', 'stop-instances', 'terminate-instances']:
             q = actions.add_parser(action); q.add_argument('--instance-ids', nargs='+', required=action != 'describe-instances')
         q = actions.add_parser('wait'); q.add_argument('waiter', choices=['instance-running', 'instance-stopped', 'instance-terminated']); q.add_argument('--instance-ids', nargs='+', required=True)
@@ -242,7 +278,8 @@ def aws_command(argv, Parser):
             else: value = api.request('GET', route(kind, a.name))
             return {'cluster': aws_shape(value, kind, who)}
         if a.action == 'run-instances':
-            require(a.count == 1 and a.image_id == 'fufu-debian-12' and a.instance_type in VM_TYPES and not a.instance_type.startswith('e2-'), 'UNSUPPORTED_CONFIG',
+            gpu = a.instance_type == 'fufu.rtx3060.xlarge'
+            require(a.count == 1 and a.image_id == ('fufu-debian-12-gpu' if gpu else 'fufu-debian-12') and a.instance_type in VM_TYPES and not a.instance_type.startswith(('e2-', 'n1-')), 'UNSUPPORTED_CONFIG',
                 '目前使用 fufu-debian-12，且每次建立一台 VM；不會將官方 AMI 冒充為本地映像。')
             name = 'vm-' + uuid.uuid4().hex[:12]
             if a.tag_specifications:
@@ -251,7 +288,19 @@ def aws_command(argv, Parser):
                     and len(tags[0].get('Tags', [])) == 1 and tags[0]['Tags'][0].get('Key') == 'Name', 'UNSUPPORTED_CONFIG', '目前只接受一個 Name 標籤。')
                 name = tags[0]['Tags'][0]['Value']
             cpu, memory = VM_TYPES[a.instance_type]
-            api.request('POST', route(kind, name), {'spec': {'image': 'debian-12', 'machineType': a.instance_type, 'cpu': cpu, 'memoryGiB': memory, 'location': who['region']}})
+            location = who['region']
+            if a.placement:
+                if a.placement.startswith('{'):
+                    placement = json.loads(a.placement)
+                else:
+                    parts = a.placement.split(',')
+                    require(len(parts) == 1 and all('=' in p for p in parts), 'UNSUPPORTED_CONFIG', 'Placement 格式為 AvailabilityZone=fufu-m1 或 AvailabilityZone=fufu-m6。')
+                    placement = dict(p.split('=', 1) for p in parts)
+                require(type(placement) is dict and set(placement) == {'AvailabilityZone'} and placement['AvailabilityZone'] in {'fufu-m1', 'fufu-m6'},
+                        'UNSUPPORTED_CONFIG', '目前 placement 僅支援已配置的 FUFU AvailabilityZone。')
+                location = placement['AvailabilityZone']
+            api.request('POST', route(kind, name), {'spec': {'image': 'debian-12', 'machineType': a.instance_type, 'cpu': cpu, 'memoryGiB': memory, 'location': location,
+                **({'gpu': {'type': 'nvidia-geforce-rtx-3060', 'count': 1}, 'diskGiB': 20} if gpu else {})}})
             value = api.request('GET', route(kind, name))
             return {'Instances': [aws_shape(value, kind, who)]}
         rows = api.request('GET', route(kind))['items']