icdev 0.0.3__py3-none-any.whl

tools/cloudforge/iac/module_library.py

@@ -0,0 +1,265 @@
+# CUI // SP-CTI
+"""Reusable IaC module library — VPC, K8s, IAM, DB, logging modules.
+
+Provides parameterized module snippets that landing zone blueprints can
+compose. Each module returns HCL strings for Terraform/OpenTofu.
+"""
+
+import json
+import logging
+from typing import Any, Dict, List
+
+logger = logging.getLogger(__name__)
+
+# ---------------------------------------------------------------------------
+# Module catalog
+# ---------------------------------------------------------------------------
+MODULE_CATALOG: Dict[str, Dict[str, Any]] = {
+    "vpc": {
+        "name": "Virtual Private Cloud / VNet / VCN",
+        "csp_support": ["aws", "azure", "gcp", "oci"],
+        "params": ["cidr", "az_count", "enable_flow_logs"],
+    },
+    "k8s": {
+        "name": "Managed Kubernetes (EKS / AKS / GKE / OKE)",
+        "csp_support": ["aws", "azure", "gcp", "oci"],
+        "params": ["cluster_name", "node_count", "node_size", "k8s_version"],
+    },
+    "iam_baseline": {
+        "name": "IAM Baseline (roles, policies, MFA)",
+        "csp_support": ["aws", "azure", "gcp", "oci"],
+        "params": ["admin_role_name", "enforce_mfa"],
+    },
+    "logging": {
+        "name": "Centralized Logging (CloudTrail / Activity Log / Audit)",
+        "csp_support": ["aws", "azure", "gcp", "oci"],
+        "params": ["retention_days", "enable_encryption"],
+    },
+    "kms": {
+        "name": "Key Management (KMS / Key Vault / Cloud KMS)",
+        "csp_support": ["aws", "azure", "gcp", "oci"],
+        "params": ["key_alias", "rotation_days"],
+    },
+    "database": {
+        "name": "Managed Database (RDS / SQL / Cloud SQL / DB System)",
+        "csp_support": ["aws", "azure", "gcp", "oci"],
+        "params": ["engine", "instance_class", "storage_gb", "multi_az"],
+    },
+    "waf": {
+        "name": "Web Application Firewall",
+        "csp_support": ["aws", "azure", "gcp"],
+        "params": ["managed_rules", "rate_limit"],
+    },
+    "guardduty": {
+        "name": "Threat Detection (GuardDuty / Defender / SCC)",
+        "csp_support": ["aws", "azure", "gcp"],
+        "params": ["enable_s3_protection", "enable_k8s_protection"],
+    },
+}
+
+# ---------------------------------------------------------------------------
+# K8s module HCL per CSP
+# ---------------------------------------------------------------------------
+_K8S_MODULES: Dict[str, str] = {
+    "aws": '''
+# --- EKS Cluster ---
+resource "aws_eks_cluster" "{cluster_name}" {{
+  name     = "{cluster_name}"
+  role_arn = aws_iam_role.eks_cluster.arn
+  version  = "{k8s_version}"
+
+  vpc_config {{
+    subnet_ids              = aws_subnet.private[*].id
+    endpoint_private_access = true
+    endpoint_public_access  = false
+  }}
+
+  encryption_config {{
+    provider {{
+      key_arn = aws_kms_key.eks.arn
+    }}
+    resources = ["secrets"]
+  }}
+
+  tags = {{
+    ManagedBy = "cloudforge"
+  }}
+}}
+
+resource "aws_eks_node_group" "workers" {{
+  cluster_name    = aws_eks_cluster.{cluster_name}.name
+  node_group_name = "{cluster_name}-workers"
+  node_role_arn   = aws_iam_role.eks_node.arn
+  subnet_ids      = aws_subnet.private[*].id
+
+  scaling_config {{
+    desired_size = {node_count}
+    max_size     = {node_count} * 2
+    min_size     = 1
+  }}
+
+  instance_types = ["{node_size}"]
+}}
+''',
+    "azure": '''
+# --- AKS Cluster ---
+resource "azurerm_kubernetes_cluster" "{cluster_name}" {{
+  name                = "{cluster_name}"
+  location            = azurerm_resource_group.main.location
+  resource_group_name = azurerm_resource_group.main.name
+  dns_prefix          = "{cluster_name}"
+  kubernetes_version  = "{k8s_version}"
+
+  default_node_pool {{
+    name       = "default"
+    node_count = {node_count}
+    vm_size    = "{node_size}"
+    vnet_subnet_id = azurerm_subnet.private.id
+  }}
+
+  identity {{
+    type = "SystemAssigned"
+  }}
+
+  network_profile {{
+    network_plugin = "azure"
+    network_policy = "calico"
+  }}
+
+  tags = {{
+    ManagedBy = "cloudforge"
+  }}
+}}
+''',
+    "gcp": '''
+# --- GKE Cluster ---
+resource "google_container_cluster" "{cluster_name}" {{
+  name     = "{cluster_name}"
+  location = var.region
+
+  initial_node_count       = 1
+  remove_default_node_pool = true
+  min_master_version       = "{k8s_version}"
+
+  network    = google_compute_network.main.name
+  subnetwork = google_compute_subnetwork.private.name
+
+  private_cluster_config {{
+    enable_private_nodes    = true
+    enable_private_endpoint = false
+    master_ipv4_cidr_block  = "172.16.0.0/28"
+  }}
+}}
+
+resource "google_container_node_pool" "workers" {{
+  name       = "{cluster_name}-workers"
+  location   = var.region
+  cluster    = google_container_cluster.{cluster_name}.name
+  node_count = {node_count}
+
+  node_config {{
+    machine_type = "{node_size}"
+    oauth_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
+  }}
+}}
+''',
+    "oci": '''
+# --- OKE Cluster ---
+resource "oci_containerengine_cluster" "{cluster_name}" {{
+  compartment_id     = var.compartment_id
+  kubernetes_version = "{k8s_version}"
+  name               = "{cluster_name}"
+  vcn_id             = oci_core_vcn.main.id
+
+  endpoint_config {{
+    is_public_ip_enabled = false
+    subnet_id            = oci_core_subnet.private.id
+  }}
+}}
+
+resource "oci_containerengine_node_pool" "workers" {{
+  cluster_id         = oci_containerengine_cluster.{cluster_name}.id
+  compartment_id     = var.compartment_id
+  kubernetes_version = "{k8s_version}"
+  name               = "{cluster_name}-workers"
+
+  node_config_details {{
+    size = {node_count}
+    placement_configs {{
+      availability_domain = data.oci_identity_availability_domains.ads.availability_domains[0].name
+      subnet_id           = oci_core_subnet.private.id
+    }}
+  }}
+
+  node_shape = "{node_size}"
+}}
+''',
+}
+
+# ---------------------------------------------------------------------------
+# Default node sizes per CSP
+# ---------------------------------------------------------------------------
+_DEFAULT_NODE_SIZES: Dict[str, str] = {
+    "aws": "m5.xlarge",
+    "azure": "Standard_D4s_v3",
+    "gcp": "e2-standard-4",
+    "oci": "VM.Standard.E4.Flex",
+}
+
+
+def get_module_catalog() -> List[Dict[str, Any]]:
+    """Return the full module catalog."""
+    return [{"id": k, **v} for k, v in MODULE_CATALOG.items()]
+
+
+def render_k8s_module(
+    csp_family: str,
+    cluster_name: str = "cloudforge-k8s",
+    node_count: int = 3,
+    node_size: str = "",
+    k8s_version: str = "1.29",
+) -> str:
+    """Render a managed Kubernetes module for the given CSP family."""
+    node_size = node_size or _DEFAULT_NODE_SIZES.get(csp_family, "m5.xlarge")
+    template = _K8S_MODULES.get(csp_family, f"# No K8s template for {csp_family}\n")
+    return template.format(
+        cluster_name=cluster_name,
+        node_count=node_count,
+        node_size=node_size,
+        k8s_version=k8s_version,
+    )
+
+
+def list_modules(csp_family: str = "") -> List[Dict[str, Any]]:
+    """List available modules, optionally filtered by CSP family."""
+    catalog = get_module_catalog()
+    if csp_family:
+        catalog = [m for m in catalog if csp_family in m["csp_support"]]
+    return catalog
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+if __name__ == "__main__":
+    import argparse
+
+    parser = argparse.ArgumentParser(description="CloudForge Module Library")
+    parser.add_argument("--list", action="store_true", help="List all modules")
+    parser.add_argument("--csp", default="", help="Filter by CSP family")
+    parser.add_argument("--render-k8s", action="store_true")
+    parser.add_argument("--cluster-name", default="cloudforge-k8s")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+
+    if args.list:
+        modules = list_modules(args.csp)
+        if args.json:
+            print(json.dumps(modules, indent=2))
+        else:
+            for m in modules:
+                print(f"  {m['id']:20s} {m['name']}")
+    elif args.render_k8s:
+        csp = args.csp or "aws"
+        hcl = render_k8s_module(csp, cluster_name=args.cluster_name)
+        print(hcl)

tools/cloudforge/iac/opentofu_adapter.py

@@ -0,0 +1,89 @@
+# CUI // SP-CTI
+"""OpenTofu adapter — wraps Terraform renderer for OpenTofu compatibility.
+
+OpenTofu is a fork of Terraform with identical HCL syntax. This adapter
+reuses the Terraform renderer and adjusts version constraints + backend config.
+"""
+
+import json
+import logging
+import re
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+logger = logging.getLogger(__name__)
+
+
+def render_opentofu(
+    cloud_type: str,
+    blueprint_name: str = "default",
+    region: str = "",
+    impact_level: str = "IL4",
+    parameters: Optional[Dict[str, Any]] = None,
+    output_dir: Optional[str] = None,
+    zone_id: str = "",
+) -> str:
+    """Render OpenTofu HCL by delegating to the Terraform renderer.
+
+    Adjusts version constraints for OpenTofu compatibility.
+    Returns the path to the output directory.
+    """
+    from tools.cloudforge.iac.terraform_renderer import render_terraform
+
+    result_path = render_terraform(
+        cloud_type=cloud_type,
+        blueprint_name=blueprint_name,
+        region=region,
+        impact_level=impact_level,
+        parameters=parameters,
+        output_dir=output_dir,
+        zone_id=zone_id,
+    )
+
+    # Patch versions.tf to note OpenTofu compatibility
+    versions_file = Path(result_path) / "versions.tf"
+    if versions_file.exists():
+        content = versions_file.read_text(encoding="utf-8")
+        content = content.replace(
+            'required_version = ">= 1.5.0"',
+            'required_version = ">= 1.5.0"  # OpenTofu compatible',
+        )
+        # Add OpenTofu marker comment
+        if "opentofu" not in content.lower():
+            content = content.replace(
+                "# Generated by ICDEV CloudForge",
+                "# Generated by ICDEV CloudForge (OpenTofu mode)",
+            )
+        versions_file.write_text(content, encoding="utf-8")
+
+    logger.info("Rendered OpenTofu HCL to %s", result_path)
+    return result_path
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+if __name__ == "__main__":
+    import argparse
+
+    parser = argparse.ArgumentParser(description="CloudForge OpenTofu Adapter")
+    parser.add_argument("--cloud-type", required=True)
+    parser.add_argument("--region", default="")
+    parser.add_argument("--impact-level", default="IL4")
+    parser.add_argument("--zone-id", default="")
+    parser.add_argument("--output-dir", default="")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+
+    result_path = render_opentofu(
+        cloud_type=args.cloud_type,
+        region=args.region,
+        impact_level=args.impact_level,
+        zone_id=args.zone_id,
+        output_dir=args.output_dir or None,
+    )
+
+    if args.json:
+        print(json.dumps({"status": "ok", "output_dir": result_path}))
+    else:
+        print(f"Generated OpenTofu at: {result_path}")

tools/cloudforge/iac/pulumi_renderer.py

@@ -0,0 +1,292 @@
+# CUI // SP-CTI
+"""Pulumi renderer for CloudForge landing zones.
+
+Generates Pulumi Python programs for each CSP. Secondary IaC engine (D-CF-4).
+"""
+
+import json
+import logging
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent.parent
+OUTPUT_DIR = BASE_DIR / ".tmp" / "cloudforge" / "pulumi"
+
+CUI_HEADER = '''# CUI // SP-CTI
+# Generated by ICDEV CloudForge — {timestamp}
+# Classification: CUI // SP-CTI
+'''
+
+# ---------------------------------------------------------------------------
+# Pulumi program templates per CSP family
+# ---------------------------------------------------------------------------
+_PULUMI_PROGRAMS: Dict[str, str] = {
+    "aws": '''"""CloudForge Landing Zone — AWS ({cloud_type})."""
+import pulumi
+import pulumi_aws as aws
+
+config = pulumi.Config()
+zone_id = config.require("zone_id")
+impact_level = config.get("impact_level") or "{impact_level}"
+env = config.get("environment") or "staging"
+
+tags = {{
+    "ManagedBy": "cloudforge",
+    "Environment": env,
+    "ImpactLevel": impact_level,
+    "Classification": "CUI",
+}}
+
+# VPC
+vpc = aws.ec2.Vpc(f"{{zone_id}}-vpc",
+    cidr_block=config.get("vpc_cidr") or "10.0.0.0/16",
+    enable_dns_support=True,
+    enable_dns_hostnames=True,
+    tags={{**tags, "Name": f"{{zone_id}}-vpc"}},
+)
+
+# Private subnet
+private_subnet = aws.ec2.Subnet(f"{{zone_id}}-private-0",
+    vpc_id=vpc.id,
+    cidr_block="10.0.0.0/20",
+    tags={{**tags, "Name": f"{{zone_id}}-private-0", "Tier": "private"}},
+)
+
+# Public subnet
+public_subnet = aws.ec2.Subnet(f"{{zone_id}}-public-0",
+    vpc_id=vpc.id,
+    cidr_block="10.0.16.0/20",
+    map_public_ip_on_launch=True,
+    tags={{**tags, "Name": f"{{zone_id}}-public-0", "Tier": "public"}},
+)
+
+# VPC Flow Logs
+flow_log_group = aws.cloudwatch.LogGroup(f"{{zone_id}}-flow-logs",
+    retention_in_days=90,
+    tags=tags,
+)
+
+pulumi.export("vpc_id", vpc.id)
+pulumi.export("zone_id", zone_id)
+pulumi.export("region", aws.get_region().name)
+''',
+    "azure": '''"""CloudForge Landing Zone — Azure ({cloud_type})."""
+import pulumi
+import pulumi_azure_native as azure
+
+config = pulumi.Config()
+zone_id = config.require("zone_id")
+impact_level = config.get("impact_level") or "{impact_level}"
+region = config.get("region") or "{region}"
+
+tags = {{
+    "ManagedBy": "cloudforge",
+    "ImpactLevel": impact_level,
+    "Classification": "CUI",
+}}
+
+# Resource Group
+rg = azure.resources.ResourceGroup(f"{{zone_id}}-rg",
+    location=region,
+    tags=tags,
+)
+
+# Virtual Network
+vnet = azure.network.VirtualNetwork(f"{{zone_id}}-vnet",
+    resource_group_name=rg.name,
+    location=rg.location,
+    address_space=azure.network.AddressSpaceArgs(
+        address_prefixes=["10.0.0.0/16"],
+    ),
+    tags=tags,
+)
+
+# Private Subnet
+private_subnet = azure.network.Subnet(f"{{zone_id}}-private",
+    resource_group_name=rg.name,
+    virtual_network_name=vnet.name,
+    address_prefix="10.0.0.0/20",
+)
+
+# NSG
+nsg = azure.network.NetworkSecurityGroup(f"{{zone_id}}-nsg",
+    resource_group_name=rg.name,
+    location=rg.location,
+    tags=tags,
+)
+
+pulumi.export("vnet_id", vnet.id)
+pulumi.export("zone_id", zone_id)
+pulumi.export("region", rg.location)
+''',
+    "gcp": '''"""CloudForge Landing Zone — GCP."""
+import pulumi
+import pulumi_gcp as gcp
+
+config = pulumi.Config()
+zone_id = config.require("zone_id")
+impact_level = config.get("impact_level") or "{impact_level}"
+region = config.get("region") or "{region}"
+
+# VPC Network
+network = gcp.compute.Network(f"{{zone_id}}-vpc",
+    auto_create_subnetworks=False,
+)
+
+# Private Subnet
+private_subnet = gcp.compute.Subnetwork(f"{{zone_id}}-private",
+    network=network.id,
+    ip_cidr_range="10.0.0.0/20",
+    region=region,
+    log_config=gcp.compute.SubnetworkLogConfigArgs(
+        aggregation_interval="INTERVAL_5_SEC",
+        flow_sampling=1.0,
+    ),
+)
+
+# Firewall — deny all ingress by default
+deny_all = gcp.compute.Firewall(f"{{zone_id}}-deny-all",
+    network=network.name,
+    priority=65534,
+    denies=[gcp.compute.FirewallDenyArgs(protocol="all")],
+    source_ranges=["0.0.0.0/0"],
+)
+
+pulumi.export("network_id", network.id)
+pulumi.export("zone_id", zone_id)
+''',
+    "oci": '''"""CloudForge Landing Zone — OCI."""
+import pulumi
+import pulumi_oci as oci
+
+config = pulumi.Config()
+zone_id = config.require("zone_id")
+impact_level = config.get("impact_level") or "{impact_level}"
+compartment_id = config.require("compartment_id")
+
+# VCN
+vcn = oci.core.Vcn(f"{{zone_id}}-vcn",
+    compartment_id=compartment_id,
+    cidr_blocks=["10.0.0.0/16"],
+    display_name=f"{{zone_id}}-vcn",
+)
+
+# Private Subnet
+private_subnet = oci.core.Subnet(f"{{zone_id}}-private",
+    compartment_id=compartment_id,
+    vcn_id=vcn.id,
+    cidr_block="10.0.0.0/20",
+    display_name=f"{{zone_id}}-private",
+    prohibit_public_ip_on_vnic=True,
+)
+
+pulumi.export("vcn_id", vcn.id)
+pulumi.export("zone_id", zone_id)
+''',
+}
+
+
+def _cui_header() -> str:
+    return CUI_HEADER.format(timestamp=datetime.now(timezone.utc).isoformat())
+
+
+def _write(path: Path, content: str) -> Path:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(content, encoding="utf-8")
+    return path
+
+
+def _csp_family(cloud_type: str) -> str:
+    if cloud_type.startswith("aws"):
+        return "aws"
+    if cloud_type.startswith("azure"):
+        return "azure"
+    return cloud_type
+
+
+def render_pulumi(
+    cloud_type: str,
+    blueprint_name: str = "default",
+    region: str = "",
+    impact_level: str = "IL4",
+    parameters: Optional[Dict[str, Any]] = None,
+    output_dir: Optional[str] = None,
+    zone_id: str = "",
+) -> str:
+    """Render a Pulumi Python program for a landing zone.
+
+    Returns the path to the output directory.
+    """
+    from tools.cloudforge.iac.terraform_renderer import _default_region
+
+    region = region or _default_region(cloud_type)
+    zone_id = zone_id or f"lz-{cloud_type}-{region}"
+    out = Path(output_dir) if output_dir else OUTPUT_DIR / zone_id
+    family = _csp_family(cloud_type)
+    header = _cui_header()
+
+    template = _PULUMI_PROGRAMS.get(family, f"# No Pulumi template for {family}\n")
+    program = template.format(
+        cloud_type=cloud_type,
+        impact_level=impact_level,
+        region=region,
+    )
+
+    _write(out / "__main__.py", f"{header}\n{program}")
+
+    # Pulumi.yaml project file
+    pulumi_yaml = f"""name: cloudforge-{zone_id}
+runtime: python
+description: "CloudForge Landing Zone — {cloud_type} ({impact_level})"
+config:
+  zone_id:
+    value: "{zone_id}"
+  impact_level:
+    value: "{impact_level}"
+"""
+    _write(out / "Pulumi.yaml", pulumi_yaml)
+
+    # requirements.txt
+    pip_pkg = {
+        "aws": "pulumi-aws>=6.0.0",
+        "azure": "pulumi-azure-native>=2.0.0",
+        "gcp": "pulumi-gcp>=7.0.0",
+        "oci": "pulumi-oci>=1.0.0",
+    }
+    reqs = f"pulumi>=3.0.0\n{pip_pkg.get(family, '')}\n"
+    _write(out / "requirements.txt", reqs)
+
+    logger.info("Rendered Pulumi program to %s", out)
+    return str(out)
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+if __name__ == "__main__":
+    import argparse
+
+    parser = argparse.ArgumentParser(description="CloudForge Pulumi Renderer")
+    parser.add_argument("--cloud-type", required=True)
+    parser.add_argument("--region", default="")
+    parser.add_argument("--impact-level", default="IL4")
+    parser.add_argument("--zone-id", default="")
+    parser.add_argument("--output-dir", default="")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+
+    result_path = render_pulumi(
+        cloud_type=args.cloud_type,
+        region=args.region,
+        impact_level=args.impact_level,
+        zone_id=args.zone_id,
+        output_dir=args.output_dir or None,
+    )
+
+    if args.json:
+        print(json.dumps({"status": "ok", "output_dir": result_path}))
+    else:
+        print(f"Generated Pulumi at: {result_path}")