fufu-cloud-cli 0.9.8__tar.gz → 0.10.0__tar.gz

{fufu_cloud_cli-0.9.8/src/fufu_cloud_cli.egg-info → fufu_cloud_cli-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.8
+Version: 0.10.0
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -27,10 +27,33 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
-2026-09-10 後續原始碼與 Cloud Shell 新增 GKE、firewall、五類 global LB 與 Redis
-配置命令，typed configuration 合計 22 類；都有 `MOCK ONLY` 提示、引用存在性與
-相依刪除檢查，不建立 Kubernetes、VM、Redis 或網路資料面，也未增加 IaC 資源。
-這批包含在 0.9.8；需要配套的 FUFU Console 與運算服務。
+0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
+需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
+叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
+支援 VM 建立、SSH 指令、停止／啟動與刪除，以及叢集建立、查詢、
+get-credentials／update-kubeconfig、waiter 與刪除。
+取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
+工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
+
+VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
+這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
+原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
+不代表已建立相應網路或 Redis 資料面。
+
+```bash
+gcloud-fufu compute instances create demo-vm --image-family=debian-12
+gcloud-fufu compute ssh demo-vm --command='uname -s; nproc'
+gcloud-fufu container clusters create demo-gke
+gcloud-fufu container clusters get-credentials demo-gke
+kubectl get pods -A
+aws-fufu eks create-cluster --name demo-eks
+aws-fufu eks wait cluster-active --name demo-eks
+aws-fufu eks update-kubeconfig --name demo-eks
+```
+
+這些操作需要 FUFU credential；不使用官方雲端金鑰。資源以租戶隔離，配額不足
+會明確回覆 RESOURCE_EXHAUSTED。測試後請刪除所建 VM／cluster 以釋放資源。
 
 0.9.8 提供 Cloud Run／Functions 的原生形式日誌查詢、CloudWatch Logs
 tail／follow，以及 `fufu observability` 的日誌、請求指標與追蹤查詢。
@@ -73,9 +96,10 @@ insertAll／SELECT 與持久化日誌。`fufu_cloud_cli.gcp_sdk` 提供官方 Py
 BigQuery、Cloud Tasks、Logging SDK 的明確 REST factory；可用 `[gcp]` extra
 安裝已驗收相依。需要對應的新後端，並非透明 ADC 或所有 Google SDK 替換。
 
-`fufu infrastructure` 提供 14 類 typed configuration mock。Compute Engine、
-Cloud SQL、App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、
-VM Manager、Eventarc 等設定不會啟動 VM／SQL／registry／網路／推論。
+`fufu infrastructure` 另保留 typed configuration mock 目錄，包含 Cloud SQL、
+App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、VM Manager、
+Eventarc 等。這個目錄只保存配置，不啟動 SQL／registry／網路／推論；
+實際 VM／Kubernetes 請使用上述 compute／ec2／container／eks 指令。
 UI 顯示僅設定，CLI stderr 保留 MOCK ONLY，不因輸出投影而隱藏。
 新服務尚未接入 Terraform／OpenTofu／Pulumi；單機背景投遞不是雲端 HA。
 
@@ -107,7 +131,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.8'
+pip install 'fufu-cloud-cli==0.10.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.8 → fufu_cloud_cli-0.10.0}/README.md

@@ -4,10 +4,33 @@
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
-2026-09-10 後續原始碼與 Cloud Shell 新增 GKE、firewall、五類 global LB 與 Redis
-配置命令，typed configuration 合計 22 類；都有 `MOCK ONLY` 提示、引用存在性與
-相依刪除檢查，不建立 Kubernetes、VM、Redis 或網路資料面，也未增加 IaC 資源。
-這批包含在 0.9.8；需要配套的 FUFU Console 與運算服務。
+0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
+需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
+叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
+支援 VM 建立、SSH 指令、停止／啟動與刪除，以及叢集建立、查詢、
+get-credentials／update-kubeconfig、waiter 與刪除。
+取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
+工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
+
+VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
+這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
+原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
+不代表已建立相應網路或 Redis 資料面。
+
+```bash
+gcloud-fufu compute instances create demo-vm --image-family=debian-12
+gcloud-fufu compute ssh demo-vm --command='uname -s; nproc'
+gcloud-fufu container clusters create demo-gke
+gcloud-fufu container clusters get-credentials demo-gke
+kubectl get pods -A
+aws-fufu eks create-cluster --name demo-eks
+aws-fufu eks wait cluster-active --name demo-eks
+aws-fufu eks update-kubeconfig --name demo-eks
+```
+
+這些操作需要 FUFU credential；不使用官方雲端金鑰。資源以租戶隔離，配額不足
+會明確回覆 RESOURCE_EXHAUSTED。測試後請刪除所建 VM／cluster 以釋放資源。
 
 0.9.8 提供 Cloud Run／Functions 的原生形式日誌查詢、CloudWatch Logs
 tail／follow，以及 `fufu observability` 的日誌、請求指標與追蹤查詢。
@@ -50,9 +73,10 @@ insertAll／SELECT 與持久化日誌。`fufu_cloud_cli.gcp_sdk` 提供官方 Py
 BigQuery、Cloud Tasks、Logging SDK 的明確 REST factory；可用 `[gcp]` extra
 安裝已驗收相依。需要對應的新後端，並非透明 ADC 或所有 Google SDK 替換。
 
-`fufu infrastructure` 提供 14 類 typed configuration mock。Compute Engine、
-Cloud SQL、App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、
-VM Manager、Eventarc 等設定不會啟動 VM／SQL／registry／網路／推論。
+`fufu infrastructure` 另保留 typed configuration mock 目錄，包含 Cloud SQL、
+App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、VM Manager、
+Eventarc 等。這個目錄只保存配置，不啟動 SQL／registry／網路／推論；
+實際 VM／Kubernetes 請使用上述 compute／ec2／container／eks 指令。
 UI 顯示僅設定，CLI stderr 保留 MOCK ONLY，不因輸出投影而隱藏。
 新服務尚未接入 Terraform／OpenTofu／Pulumi；單機背景投遞不是雲端 HA。
 
@@ -84,7 +108,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.8'
+pip install 'fufu-cloud-cli==0.10.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.8 → fufu_cloud_cli-0.10.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.9.8"
+version = "0.10.0"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"

{fufu_cloud_cli-0.9.8 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.9.8"
+__version__ = "0.10.0"

{fufu_cloud_cli-0.9.8 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/api_backend.py

@@ -184,6 +184,13 @@ class ApiClient:
                 return json.loads(raw)
         except HTTPError as exc:
             status = exc.code
+            if '/infrastructure/' in path and status == 429:
+                try:
+                    value = json.loads(exc.read(4096))
+                    if isinstance(value, dict) and value.get('code') == 'RESOURCE_EXHAUSTED':
+                        raise FufuError('RESOURCE_EXHAUSTED', 'FUFU 租戶資源配額或主機容量已滿；請刪除不需要的資源，或調整平台資源配額後再重試。') from None
+                except (ValueError, OSError): pass
+                finally: exc.close()
             if self.provider == 'aws' and '/compute/' in path and status in {400, 412}:
                 try:
                     value = json.loads(exc.read(4096))

{fufu_cloud_cli-0.9.8 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/capabilities.json

@@ -534,21 +534,23 @@
     },
     "gcp-compute-engine": {
       "name": "Compute Engine",
-      "status": "mock-only",
+      "status": "implemented",
       "backend": "api",
-      "mode": "mock-only",
+      "mode": "simplified",
       "operations": [
-        "typed-instance-configuration-crud"
+        "create-list-describe-delete", "stop-start", "guest-ssh-command"
       ],
-      "reason": "僅保存設定；無 VM、disk、SSH、guest OS 或 hypervisor。"
+      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "no-self-service-GPU-passthrough", "no-official-IaC-provider"],
+      "reason": "實際 KVM／KubeVirt VM、持久磁碟與 SSH 指令；原生風格指令子集，無官方雲端資源。"
     },
     "gcp-gke": {
       "name": "GKE",
-      "status": "mock-only",
+      "status": "implemented",
       "backend": "api",
-      "mode": "mock-only",
-      "operations": ["typed-cluster-configuration-crud", "network-reference-validation"],
-      "reason": "僅保存叢集配置；無 Kubernetes API、nodes、kubectl、scheduler 或 workloads。"
+      "mode": "simplified",
+      "operations": ["create-list-describe-delete", "get-credentials", "kubectl-workloads", "GPU-container-jobs"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "shared-workers", "single-control-plane-replica", "no-workload-PVC", "no-public-LoadBalancer", "no-interactive-exec-or-portforward", "no-official-IaC-provider"],
+      "reason": "獨立 vCluster Kubernetes API 與控制面資料；共用受管節點，支援標準 kubectl 工作負載子集。"
     },
     "gcp-vpc": {
       "name": "VPC / Firewall",
@@ -637,8 +639,12 @@
     },
     "aws-ec2": {
       "name": "EC2",
-      "status": "mock-only",
-      "reason": "明示 mock 目錄；VM 未執行，不能列為成功部署。"
+      "status": "implemented",
+      "backend": "api",
+      "mode": "simplified",
+      "operations": ["run-describe-terminate-instances", "stop-start", "instance-waiters"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "Debian-12-only", "private-network", "single-node-disk", "no-self-service-GPU-passthrough", "no-official-IaC-provider"],
+      "reason": "實際 KVM／KubeVirt VM；支援生命週期與 scoped instance ID，無官方 EC2 網路或完整 API。"
     },
     "aws-ecs": {
       "name": "ECS / Fargate",
@@ -647,8 +653,12 @@
     },
     "aws-eks": {
       "name": "EKS",
-      "status": "unsupported",
-      "reason": "尚未實作可供 CLI 自動部署與驗證的服務契約。"
+      "status": "implemented",
+      "backend": "api",
+      "mode": "simplified",
+      "operations": ["create-list-describe-delete", "update-kubeconfig", "cluster-waiters", "kubectl-workloads", "GPU-container-jobs"],
+      "limitations": ["requires-FUFU-infrastructure-backend", "shared-workers", "single-control-plane-replica", "no-workload-PVC", "no-public-LoadBalancer", "no-interactive-exec-or-portforward", "no-official-IaC-provider"],
+      "reason": "獨立 vCluster Kubernetes API 與控制面資料；FUFU 短效認證，不是 AWS 原生 IAM 或託管控制面。"
     },
     "aws-app-runner": {
       "name": "App Runner",

{fufu_cloud_cli-0.9.8 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli/cli.py

@@ -518,6 +518,9 @@ def entry(provider, argv=None):
         if provider == 'fufu' and argv[:1] == ['infrastructure']:
             from .gcp_infra import configuration_command
             emit(configuration_command(argv[1:], Parser)); return
+        if provider == 'fufu' and argv[:1] == ['kubernetes-token']:
+            from .infrastructure import token_command
+            emit(token_command(argv[1:], Parser)); return
         # Native global selectors are checked against the authenticated tenant scope.
         if provider in {'aws-fufu', 'gcloud-fufu'}:
             rest = []; i = 0; explicit_region = False
@@ -580,6 +583,12 @@ def entry(provider, argv=None):
                 if output_format and argv[:2] == ['functions', 'call']:
                     require(output_format == 'json', 'UNSUPPORTED_FORMAT', 'Functions call 目前只支援 JSON 回應。')
         from . import public_access
+        if provider == 'gcloud-fufu' and argv[:2] in [['compute', 'instances'], ['compute', 'ssh'], ['container', 'clusters']]:
+            from .infrastructure import gcp_command
+            emit(gcp_command(argv, Parser)); return
+        if provider == 'aws-fufu' and argv[:1] in [['ec2'], ['eks']]:
+            from .infrastructure import aws_command as infrastructure_aws_command
+            emit(infrastructure_aws_command(argv, Parser)); return
         if provider == 'gcloud-fufu' and argv and argv[0] in {'scheduler', 'tasks', 'logging', 'compute', 'sql', 'artifacts', 'dns', 'eventarc', 'container', 'redis'}:
             from .gcp_infra import command
             emit(command(argv, Parser)); return

fufu_cloud_cli-0.10.0/src/fufu_cloud_cli/infrastructure.py

@@ -0,0 +1,283 @@
+"""Native command subset backed by the private RKE2 infrastructure adapter."""
+import base64
+import datetime
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import ssl
+import sys
+import tempfile
+import time
+import uuid
+
+import yaml
+
+from .api_backend import ApiClient, segment
+from .errors import FufuError, require
+
+BASE = '/infrastructure/resources/'
+VM_TYPES = {'e2-micro': (2, 1), 'e2-small': (2, 2), 'e2-medium': (2, 4), 'e2-standard-2': (2, 8),
+    'e2-standard-4': (4, 16), 'e2-standard-8': (8, 32), 't3.micro': (2, 1), 't3.small': (2, 2),
+    't3.medium': (2, 4), 'm5.large': (2, 8), 'm5.xlarge': (4, 16), 'm5.2xlarge': (8, 32)}
+
+
+def warn(kind):
+    sys.stderr.write('FUFU runtime: ' + ('KVM VM with a private network and one-node persistent disk; no GPU passthrough.\n' if kind == 'vm' else
+        'Independent Kubernetes API with shared worker nodes; private ClusterIP services, no workload PVCs or native cloud IAM.\n'))
+
+
+def route(kind, name=None):
+    return BASE + kind + ('/' + segment(name) if name else '')
+
+
+def wait(api, kind, name, desired='RUNNING', seconds=480):
+    deadline = time.monotonic() + seconds
+    while time.monotonic() < deadline:
+        try: value = api.request('GET', route(kind, name))
+        except FufuError as error:
+            if desired == 'DELETED' and error.code in {'RESOURCE_NOT_FOUND', 'NOT_FOUND'}: return {'name': name, 'state': 'DELETED'}
+            raise
+        require(value['state'] != 'ERROR', 'INFRASTRUCTURE_FAILED', '基礎設施建立失敗；請查看資源事件，修正後刪除重建。')
+        if value['state'] == desired: return value
+        time.sleep(2)
+    raise FufuError('DEADLINE_EXCEEDED', '資源尚未達到預期狀態；請查詢狀態，勿直接重複建立。')
+
+
+def fufu_fields(value):
+    return {key: value.get(key) for key in ['name', 'state', 'mode', 'backend', 'node', 'limitations', 'spec'] if key in value}
+
+
+def gcp_shape(value, kind):
+    spec = value.get('spec', {})
+    if kind == 'vm':
+        return {'name': value['name'], 'status': {'STOPPED': 'TERMINATED', 'DELETING': 'STOPPING'}.get(value['state'], value['state']),
+            'machineType': spec.get('machineType'), 'zone': spec.get('location'),
+            'disks': [{'boot': True, 'diskSizeGb': str(spec.get('diskGiB', 20))}], 'Fufu': fufu_fields(value)}
+    return {'name': value['name'], 'status': {'PROVISIONING': 'PROVISIONING', 'RUNNING': 'RUNNING', 'ERROR': 'ERROR', 'DELETING': 'STOPPING'}.get(value['state'], value['state']),
+        'location': spec.get('location'), 'currentMasterVersion': spec.get('version'), 'Fufu': fufu_fields(value)}
+
+
+def aws_shape(value, kind, who):
+    spec = value.get('spec', {})
+    if kind == 'vm':
+        identifier = 'i-' + hashlib.sha256((str(who['tenantId']) + value['name'] + value.get('resourceId', value.get('createdAt', ''))).encode()).hexdigest()[:17]
+        state = {'RUNNING': (16, 'running'), 'STOPPED': (80, 'stopped'), 'STOPPING': (64, 'stopping'), 'DELETING': (32, 'shutting-down'), 'DELETED': (48, 'terminated')}.get(value['state'], (0, 'pending'))
+        return {'InstanceId': identifier, 'InstanceType': spec.get('machineType'), 'ImageId': 'fufu-debian-12',
+            'State': {'Code': state[0], 'Name': state[1]}, 'Tags': [{'Key': 'Name', 'Value': value['name']}], 'Fufu': fufu_fields(value)}
+    return {'name': value['name'], 'arn': f"arn:aws:eks:{who['region']}:{who['accountId']}:cluster/{value['name']}",
+        'status': {'RUNNING': 'ACTIVE', 'PROVISIONING': 'CREATING', 'DELETING': 'DELETING', 'ERROR': 'FAILED'}.get(value['state'], value['state']),
+        'version': spec.get('version'), 'Fufu': fufu_fields(value)}
+
+
+def kubernetes_transport(api, name, who):
+    endpoint = api.endpoint
+    cluster = {}
+    if who.get('sessionKind') == 'terminal' and endpoint == 'http://127.0.0.1:8787':
+        require(os.environ.get('FUFU_SESSION_FILE') == '/run/fufu/session.json',
+            'INVALID_SESSION', 'Cloud Shell 工作階段來源不符。')
+        certificate = Path('/run/fufu/kubernetes-ca.crt')
+        require(certificate.is_file() and not certificate.is_symlink() and certificate.stat().st_size <= 16384,
+            'INVALID_SESSION', 'Cloud Shell TLS 憑證不存在或無效，請重新開啟 Shell。')
+        content = certificate.read_text(encoding='ascii')
+        try:
+            ssl.PEM_cert_to_DER_cert(content)
+        except ValueError:
+            raise FufuError('INVALID_SESSION', 'Cloud Shell TLS 憑證無效。') from None
+        endpoint = 'https://127.0.0.1:8788'
+        cluster['certificate-authority-data'] = base64.b64encode(content.encode('ascii')).decode('ascii')
+    cluster['server'] = endpoint + f'/api/cloud/{api.provider}/infrastructure/clusters/{segment(name)}/kubernetes'
+    return cluster
+
+
+def write_kubeconfig(api, name, filename=None, alias=None):
+    who = api.whoami()
+    require(not who.get('role'), 'PERMISSION_DENIED', '目前叢集存取需使用租戶擁有者；不會將受限 IAM 角色提升為 Kubernetes 管理員。')
+    value = api.request('GET', route('cluster', name))
+    require(value['state'] == 'RUNNING', 'CLUSTER_NOT_READY', '叢集尚未就緒。')
+    selected = filename or os.environ.get('KUBECONFIG') or str(Path.home() / '.kube/config')
+    require(os.pathsep not in selected, 'UNSUPPORTED_CONFIG', '目前請指定單一 kubeconfig 檔案。')
+    path = Path(selected).expanduser().absolute()
+    require(not path.is_symlink(), 'INVALID_CONFIG', 'kubeconfig 不可為符號連結。')
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    context = alias or f'fufu-{api.provider}-{name}'
+    require(isinstance(context, str) and 0 < len(context) < 256 and not re.search(r'[\x00-\x1f]', context), 'INVALID_CONFIG', 'Context 名稱無效。')
+    data = {'apiVersion': 'v1', 'kind': 'Config', 'clusters': [], 'contexts': [], 'users': []}
+    if path.exists():
+        require(path.is_file() and path.stat().st_size <= 4 * 1024**2 and path.stat().st_mode & 0o022 == 0,
+            'INVALID_CONFIG', '既有 kubeconfig 的格式或寫入權限不安全。')
+        data = yaml.safe_load(path.read_text()) or data
+        require(type(data) is dict, 'INVALID_CONFIG', 'kubeconfig 格式無效。')
+        backup = path.with_name(path.name + '.fufu-backup-' + str(time.time_ns()))
+        shutil.copy2(path, backup); os.chmod(backup, 0o600)
+    scope = hashlib.sha256(who['tenantId'].encode()).hexdigest()
+    cluster = kubernetes_transport(api, name, who)
+    user = {'name': context, 'user': {'exec': {'apiVersion': 'client.authentication.k8s.io/v1', 'command': 'fufu',
+        'args': ['kubernetes-token', '--provider', api.provider, '--cluster', name, '--scope', scope],
+        'interactiveMode': 'Never', 'provideClusterInfo': True}}}
+    for key, item in [('clusters', {'name': context, 'cluster': cluster}), ('users', user),
+            ('contexts', {'name': context, 'context': {'cluster': context, 'user': context}})]:
+        require(type(data.get(key, [])) is list, 'INVALID_CONFIG', 'kubeconfig 清單格式無效。')
+        data[key] = [x for x in data.get(key, []) if x.get('name') != context] + [item]
+    data['current-context'] = context
+    fd, tmp = tempfile.mkstemp(prefix='.fufu-kube-', dir=path.parent)
+    try:
+        with os.fdopen(fd, 'w') as f:
+            yaml.safe_dump(data, f, sort_keys=False); f.flush(); os.fsync(f.fileno())
+        os.replace(tmp, path)
+    finally:
+        if os.path.exists(tmp): os.unlink(tmp)
+    return {'context': context, 'kubeconfig': str(path), 'credentials': 'exec-plugin; no static cloud or host keys'}
+
+
+def token_command(argv, Parser):
+    p = Parser(prog='fufu kubernetes-token', description='Kubernetes exec credential protocol; not intended for interactive use.')
+    p.add_argument('--provider', required=True, choices=['gcp', 'aws']); p.add_argument('--cluster', required=True); p.add_argument('--scope', required=True)
+    a = p.parse_args(argv)
+    require(bool(os.environ.get('KUBERNETES_EXEC_INFO')), 'INVALID_SESSION', '此指令僅供 Kubernetes exec credential protocol 使用。')
+    info = json.loads(os.environ['KUBERNETES_EXEC_INFO'])
+    with ApiClient(a.provider) as api:
+        who = api.whoami()
+        expected = kubernetes_transport(api, a.cluster, who)
+        supplied = info.get('spec', {}).get('cluster', {})
+        require(all(supplied.get(key) == expected.get(key) for key in ['server', 'certificate-authority-data'])
+                and not any(supplied.get(key) for key in ['insecure-skip-tls-verify', 'tls-server-name', 'proxy-url']) and
+                hashlib.sha256(who['tenantId'].encode()).hexdigest() == a.scope and not who.get('role'),
+                'RESOURCE_SCOPE_MISMATCH', 'Kubernetes context 與目前租戶或 endpoint 不符。')
+        api.request('GET', route('cluster', a.cluster))
+        result = {'apiVersion': 'client.authentication.k8s.io/v1', 'kind': 'ExecCredential',
+            'status': {'token': api.token, 'expirationTimestamp': (datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(minutes=4)).isoformat().replace('+00:00', 'Z')}}
+        api.owns_token = False
+        return result
+
+
+def gcp_command(argv, Parser):
+    ssh = argv[:2] == ['compute', 'ssh']
+    kind = 'vm' if argv[0] == 'compute' else 'cluster'
+    tail = argv[2:]
+    p = Parser(prog='gcloud-fufu ' + ' '.join(argv[:2]), description='FUFU private infrastructure runtime; supported native command subset.')
+    if ssh:
+        p.add_argument('name'); p.add_argument('--command', required=True); p.add_argument('--zone')
+        a = p.parse_args(tail)
+        with ApiClient('gcp') as api:
+            if a.zone:
+                item = api.request('GET', route('vm', a.name))
+                require(item.get('spec', {}).get('location') == a.zone, 'RESOURCE_NOT_FOUND', 'VM 不在指定 zone。')
+            value = api.request('POST', route('vm', a.name) + '/command', {'command': a.command})
+            sys.stdout.write(value['stdout']); sys.stderr.write(value['stderr'])
+            raise SystemExit(value['exitCode'])
+    actions = p.add_subparsers(dest='action', required=True)
+    names = ['create', 'describe', 'list', 'delete', 'start', 'stop'] if kind == 'vm' else ['create', 'describe', 'list', 'delete', 'get-credentials']
+    for action in names:
+        q = actions.add_parser(action)
+        if action != 'list': q.add_argument('name')
+        q.add_argument('--zone'); q.add_argument('--location')
+        if action in {'create', 'delete', 'start', 'stop'}: q.add_argument('--async', dest='asynchronous', action='store_true')
+        if action == 'create':
+            if kind == 'vm':
+                q.add_argument('--machine-type', default='e2-small'); q.add_argument('--image-family', default='debian-12')
+                q.add_argument('--image-project', default='debian-cloud'); q.add_argument('--boot-disk-size', default='20GB')
+            else:
+                q.add_argument('--cluster-version', default='1.36')
+    a = p.parse_args(tail)
+    warn(kind)
+    with ApiClient('gcp', read_only=a.action in {'list', 'describe'}) as api:
+        location = a.zone or a.location
+        require(not (a.zone and a.location and a.zone != a.location), 'INVALID_CONFIG', 'Zone 與 location 不一致。')
+        if a.action == 'list': return [gcp_shape(x, kind) for x in api.request('GET', route(kind))['items']
+            if not location or x.get('spec', {}).get('location') == location]
+        if a.action != 'create' and location:
+            item = api.request('GET', route(kind, a.name))
+            require(item.get('spec', {}).get('location') == location, 'RESOURCE_NOT_FOUND', '資源不在指定 location。')
+        if a.action == 'get-credentials': return write_kubeconfig(api, a.name)
+        if a.action == 'describe': return gcp_shape(api.request('GET', route(kind, a.name)), kind)
+        if a.action == 'create':
+            who = api.whoami()
+            spec = {'location': a.zone or a.location or who.get('region')}
+            if kind == 'vm':
+                require(a.machine_type in VM_TYPES and a.machine_type.startswith('e2-') and a.image_family == 'debian-12' and a.image_project == 'debian-cloud',
+                    'UNSUPPORTED_CONFIG', '目前提供已驗證的 Debian 12 映像與列明的 VM 規格。')
+                match = re.fullmatch(r'(\d+)(?:GB|GiB)?', a.boot_disk_size, re.I)
+                require(match is not None, 'INVALID_CONFIG', '磁碟大小須為整數 GB。')
+                cpu, memory = VM_TYPES[a.machine_type]
+                spec.update(cpu=cpu, memoryGiB=memory, machineType=a.machine_type, diskGiB=int(match[1]), image=a.image_family)
+            else: spec['version'] = a.cluster_version
+            value = api.request('POST', route(kind, a.name), {'spec': spec})
+        elif a.action == 'delete': value = api.request('DELETE', route(kind, a.name))
+        else: value = api.request('POST', route(kind, a.name) + '/' + a.action, {})
+        if not a.asynchronous:
+            value = wait(api, kind, a.name, 'DELETED' if a.action == 'delete' else 'STOPPED' if a.action == 'stop' else 'RUNNING')
+        return gcp_shape(value, kind)
+
+
+def aws_command(argv, Parser):
+    kind = 'cluster' if argv[0] == 'eks' else 'vm'
+    p = Parser(prog='aws-fufu ' + argv[0], description='FUFU private infrastructure runtime; unsupported cloud options fail explicitly.')
+    actions = p.add_subparsers(dest='action', required=True)
+    if kind == 'cluster':
+        for action in ['create-cluster', 'describe-cluster', 'delete-cluster', 'list-clusters', 'update-kubeconfig']:
+            q = actions.add_parser(action)
+            if action != 'list-clusters': q.add_argument('--name', required=True)
+            if action == 'create-cluster': q.add_argument('--kubernetes-version', default='1.36')
+            if action == 'update-kubeconfig': q.add_argument('--kubeconfig'); q.add_argument('--alias')
+        q = actions.add_parser('wait'); q.add_argument('waiter', choices=['cluster-active', 'cluster-deleted']); q.add_argument('--name', required=True)
+    else:
+        q = actions.add_parser('run-instances'); q.add_argument('--image-id', required=True); q.add_argument('--instance-type', default='t3.small')
+        q.add_argument('--count', type=int, default=1); q.add_argument('--tag-specifications')
+        for action in ['describe-instances', 'start-instances', 'stop-instances', 'terminate-instances']:
+            q = actions.add_parser(action); q.add_argument('--instance-ids', nargs='+', required=action != 'describe-instances')
+        q = actions.add_parser('wait'); q.add_argument('waiter', choices=['instance-running', 'instance-stopped', 'instance-terminated']); q.add_argument('--instance-ids', nargs='+', required=True)
+    a = p.parse_args(argv[1:])
+    warn(kind)
+    with ApiClient('aws', read_only=a.action in {'list-clusters', 'describe-cluster', 'describe-instances', 'wait'}) as api:
+        who = api.whoami()
+        if kind == 'cluster':
+            if a.action == 'list-clusters': return {'clusters': [x['name'] for x in api.request('GET', route(kind))['items']]}
+            if a.action == 'update-kubeconfig': return write_kubeconfig(api, a.name, a.kubeconfig, a.alias)
+            if a.action == 'wait': wait(api, kind, a.name, 'DELETED' if a.waiter == 'cluster-deleted' else 'RUNNING'); return None
+            if a.action == 'create-cluster': value = api.request('POST', route(kind, a.name), {'spec': {'version': a.kubernetes_version, 'location': who['region']}})
+            elif a.action == 'delete-cluster': value = api.request('DELETE', route(kind, a.name))
+            else: value = api.request('GET', route(kind, a.name))
+            return {'cluster': aws_shape(value, kind, who)}
+        if a.action == 'run-instances':
+            require(a.count == 1 and a.image_id == 'fufu-debian-12' and a.instance_type in VM_TYPES and not a.instance_type.startswith('e2-'), 'UNSUPPORTED_CONFIG',
+                '目前使用 fufu-debian-12，且每次建立一台 VM；不會將官方 AMI 冒充為本地映像。')
+            name = 'vm-' + uuid.uuid4().hex[:12]
+            if a.tag_specifications:
+                tags = json.loads(a.tag_specifications)
+                require(type(tags) is list and len(tags) == 1 and tags[0].get('ResourceType') == 'instance'
+                    and len(tags[0].get('Tags', [])) == 1 and tags[0]['Tags'][0].get('Key') == 'Name', 'UNSUPPORTED_CONFIG', '目前只接受一個 Name 標籤。')
+                name = tags[0]['Tags'][0]['Value']
+            cpu, memory = VM_TYPES[a.instance_type]
+            api.request('POST', route(kind, name), {'spec': {'image': 'debian-12', 'machineType': a.instance_type, 'cpu': cpu, 'memoryGiB': memory, 'location': who['region']}})
+            value = api.request('GET', route(kind, name))
+            return {'Instances': [aws_shape(value, kind, who)]}
+        rows = api.request('GET', route(kind))['items']
+        selected = [x for x in rows if not a.instance_ids or aws_shape(x, kind, who)['InstanceId'] in a.instance_ids]
+        if a.instance_ids: require(len(selected) == len(set(a.instance_ids)), 'InvalidInstanceID.NotFound', 'Instance ID 不存在於目前租戶。')
+        if a.action == 'describe-instances': return {'Reservations': [{'Instances': [aws_shape(x, kind, who) for x in selected]}]}
+        if a.action == 'wait':
+            desired = {'instance-running': 'RUNNING', 'instance-stopped': 'STOPPED', 'instance-terminated': 'DELETED'}[a.waiter]
+            deadline = time.monotonic() + 480
+            while not all(x['state'] == desired for x in selected):
+                require(time.monotonic() < deadline, 'DEADLINE_EXCEEDED', 'Instance 尚未達到預期狀態。')
+                require(not any(x['state'] in {'ERROR', 'DELETED'} for x in selected), 'WAITER_FAILED', 'Instance 已進入無法達成預期狀態的狀態。')
+                time.sleep(2)
+                rows = api.request('GET', route(kind))['items']
+                selected = [x for x in rows if aws_shape(x, kind, who)['InstanceId'] in a.instance_ids]
+                require(len(selected) == len(set(a.instance_ids)), 'InvalidInstanceID.NotFound', 'Instance ID 不存在於目前租戶。')
+            return None
+        output = []
+        for x in selected:
+            old = aws_shape(x, kind, who)
+            action = {'start-instances': 'start', 'stop-instances': 'stop', 'terminate-instances': 'delete'}[a.action]
+            if x['state'] == 'DELETED':
+                require(action == 'delete', 'IncorrectInstanceState', '已終止的 Instance 無法啟動或停止。')
+                output.append({'InstanceId': old['InstanceId'], 'PreviousState': old['State'], 'CurrentState': old['State']})
+                continue
+            api.request('DELETE' if action == 'delete' else 'POST', route(kind, x['name']) + ('' if action == 'delete' else '/' + action), None if action == 'delete' else {})
+            target = {'start': (0, 'pending'), 'stop': (64, 'stopping'), 'delete': (32, 'shutting-down')}[action]
+            output.append({'InstanceId': old['InstanceId'], 'PreviousState': old['State'], 'CurrentState': {'Code': target[0], 'Name': target[1]}})
+        return {{'start-instances': 'StartingInstances', 'stop-instances': 'StoppingInstances', 'terminate-instances': 'TerminatingInstances'}[a.action]: output}

{fufu_cloud_cli-0.9.8 → fufu_cloud_cli-0.10.0/src/fufu_cloud_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.8
+Version: 0.10.0
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -27,10 +27,33 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`、`bq-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
-2026-09-10 後續原始碼與 Cloud Shell 新增 GKE、firewall、五類 global LB 與 Redis
-配置命令，typed configuration 合計 22 類；都有 `MOCK ONLY` 提示、引用存在性與
-相依刪除檢查，不建立 Kubernetes、VM、Redis 或網路資料面，也未增加 IaC 資源。
-這批包含在 0.9.8；需要配套的 FUFU Console 與運算服務。
+0.10.0 新增 Compute Engine／EC2 VM 與 GKE／EKS 介面的實際運算命令。
+需要啟用相應 infrastructure backend 的 FUFU 服務端；VM 使用 KVM／KubeVirt，
+叢集使用獨立 Kubernetes API 與共用節點，均不是官方雲端資源。
+支援 VM 建立、SSH 指令、停止／啟動與刪除，以及叢集建立、查詢、
+get-credentials／update-kubeconfig、waiter 與刪除。
+取得憑證後可使用標準 kubectl 部署 Deployment、Service、Job 及受管 GPU 容器。
+工作站需另安裝 kubectl；配套 Cloud Shell 已提供。
+
+VM 尚無公開 IP、複寫儲存、live migration 或自助 GPU passthrough；
+叢集尚無 workload PVC、公開 LoadBalancer、互動式 exec／attach／port-forward。
+這批新 VM／cluster API 尚未支援官方 Terraform／OpenTofu／Pulumi provider。
+原有 firewall、global LB、Redis 等 typed configuration 仍明示 `MOCK ONLY`，
+不代表已建立相應網路或 Redis 資料面。
+
+```bash
+gcloud-fufu compute instances create demo-vm --image-family=debian-12
+gcloud-fufu compute ssh demo-vm --command='uname -s; nproc'
+gcloud-fufu container clusters create demo-gke
+gcloud-fufu container clusters get-credentials demo-gke
+kubectl get pods -A
+aws-fufu eks create-cluster --name demo-eks
+aws-fufu eks wait cluster-active --name demo-eks
+aws-fufu eks update-kubeconfig --name demo-eks
+```
+
+這些操作需要 FUFU credential；不使用官方雲端金鑰。資源以租戶隔離，配額不足
+會明確回覆 RESOURCE_EXHAUSTED。測試後請刪除所建 VM／cluster 以釋放資源。
 
 0.9.8 提供 Cloud Run／Functions 的原生形式日誌查詢、CloudWatch Logs
 tail／follow，以及 `fufu observability` 的日誌、請求指標與追蹤查詢。
@@ -73,9 +96,10 @@ insertAll／SELECT 與持久化日誌。`fufu_cloud_cli.gcp_sdk` 提供官方 Py
 BigQuery、Cloud Tasks、Logging SDK 的明確 REST factory；可用 `[gcp]` extra
 安裝已驗收相依。需要對應的新後端，並非透明 ADC 或所有 Google SDK 替換。
 
-`fufu infrastructure` 提供 14 類 typed configuration mock。Compute Engine、
-Cloud SQL、App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、
-VM Manager、Eventarc 等設定不會啟動 VM／SQL／registry／網路／推論。
+`fufu infrastructure` 另保留 typed configuration mock 目錄，包含 Cloud SQL、
+App Engine、DNS、VPC、Artifact Registry、Cloud Build、Gemini、VM Manager、
+Eventarc 等。這個目錄只保存配置，不啟動 SQL／registry／網路／推論；
+實際 VM／Kubernetes 請使用上述 compute／ec2／container／eks 指令。
 UI 顯示僅設定，CLI stderr 保留 MOCK ONLY，不因輸出投影而隱藏。
 新服務尚未接入 Terraform／OpenTofu／Pulumi；單機背景投遞不是雲端 HA。
 
@@ -107,7 +131,7 @@ Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.9.8'
+pip install 'fufu-cloud-cli==0.10.0'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.8 → fufu_cloud_cli-0.10.0}/src/fufu_cloud_cli.egg-info/SOURCES.txt

@@ -24,6 +24,7 @@ src/fufu_cloud_cli/gcp_sdk.py
 src/fufu_cloud_cli/gcs.py
 src/fufu_cloud_cli/http_runtime.py
 src/fufu_cloud_cli/iac_state.py
+src/fufu_cloud_cli/infrastructure.py
 src/fufu_cloud_cli/lambda_adapter.py
 src/fufu_cloud_cli/limits.py
 src/fufu_cloud_cli/manifest.py