450 lines
14 KiB
Text
450 lines
14 KiB
Text
|
// Demo Infrastructure Configuration - Rust Meetup 2025
|
||
|
|
// KCL configuration example showing type-safe infrastructure definition
|
||
|
|
|
||
|
|
// Import core schemas
|
||
|
|
import provisioning.settings as ps
|
||
|
|
import provisioning.providers.aws as aws
|
||
|
|
import provisioning.taskservs as ts
|
||
|
|
|
||
|
|
// Main infrastructure configuration
|
||
|
|
config: ps.Settings = {
|
||
|
|
// Basic metadata
|
||
|
|
main_name = "rust-meetup-demo"
|
||
|
|
main_title = "Rust Meetup 2025 Demo Infrastructure"
|
||
|
|
description = "Demonstración de Infrastructure as Code con tipos"
|
||
|
|
|
||
|
|
// Provider configuration
|
||
|
|
provider = {
|
||
|
|
name = "aws"
|
||
|
|
region = "eu-west-1"
|
||
|
|
availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
|
||
|
|
|
||
|
|
// Type-safe provider config
|
||
|
|
aws_config = aws.AwsConfig {
|
||
|
|
profile = "default"
|
||
|
|
assume_role_arn = None
|
||
|
|
session_duration = 3600
|
||
|
|
tags = {
|
||
|
|
Environment = "demo"
|
||
|
|
Project = "rust-meetup"
|
||
|
|
Owner = "JesusPerezLorenzo"
|
||
|
|
CostCenter = "engineering"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// Network configuration with validation
|
||
|
|
network = {
|
||
|
|
vpc_cidr = "10.0.0.0/16"
|
||
|
|
|
||
|
|
// Subnets with type checking
|
||
|
|
subnets = [
|
||
|
|
{
|
||
|
|
name = "public-1a"
|
||
|
|
cidr = "10.0.1.0/24"
|
||
|
|
availability_zone = "eu-west-1a"
|
||
|
|
type = "public"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name = "private-1a"
|
||
|
|
cidr = "10.0.2.0/24"
|
||
|
|
availability_zone = "eu-west-1a"
|
||
|
|
type = "private"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name = "public-1b"
|
||
|
|
cidr = "10.0.3.0/24"
|
||
|
|
availability_zone = "eu-west-1b"
|
||
|
|
type = "public"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
|
||
|
|
// Security groups with explicit rules
|
||
|
|
security_groups = [
|
||
|
|
{
|
||
|
|
name = "kubernetes-master"
|
||
|
|
description = "Security group for Kubernetes master nodes"
|
||
|
|
rules = [
|
||
|
|
{
|
||
|
|
type = "ingress"
|
||
|
|
protocol = "tcp"
|
||
|
|
port_range = "6443"
|
||
|
|
source = "10.0.0.0/16"
|
||
|
|
description = "Kubernetes API server"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
type = "ingress"
|
||
|
|
protocol = "tcp"
|
||
|
|
port_range = "22"
|
||
|
|
source = "0.0.0.0/0"
|
||
|
|
description = "SSH access"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
name = "kubernetes-worker"
|
||
|
|
description = "Security group for Kubernetes worker nodes"
|
||
|
|
rules = [
|
||
|
|
{
|
||
|
|
type = "ingress"
|
||
|
|
protocol = "tcp"
|
||
|
|
port_range = "10250"
|
||
|
|
source = "10.0.0.0/16"
|
||
|
|
description = "Kubelet API"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
type = "ingress"
|
||
|
|
protocol = "tcp"
|
||
|
|
port_range = "30000-32767"
|
||
|
|
source = "0.0.0.0/0"
|
||
|
|
description = "NodePort services"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|
||
|
|
// Server definitions with strong typing
|
||
|
|
servers = [
|
||
|
|
{
|
||
|
|
hostname = "k8s-master-01"
|
||
|
|
instance_type = "t3.large"
|
||
|
|
|
||
|
|
// Hardware specs with validation
|
||
|
|
hardware = {
|
||
|
|
cpu_cores = 2
|
||
|
|
memory_gb = 8
|
||
|
|
storage_gb = 30
|
||
|
|
architecture = "x86_64" // or "aarch64" for ARM
|
||
|
|
}
|
||
|
|
|
||
|
|
// OS and image configuration
|
||
|
|
image = {
|
||
|
|
os = "ubuntu"
|
||
|
|
version = "22.04"
|
||
|
|
arch = "x86_64"
|
||
|
|
|
||
|
|
// Custom AMI for optimized performance
|
||
|
|
custom_image_id = "ami-0d527b8c289b4af7f"
|
||
|
|
}
|
||
|
|
|
||
|
|
// Network placement
|
||
|
|
placement = {
|
||
|
|
subnet = "public-1a"
|
||
|
|
security_groups = ["kubernetes-master"]
|
||
|
|
assign_public_ip = True
|
||
|
|
availability_zone = "eu-west-1a"
|
||
|
|
}
|
||
|
|
|
||
|
|
// Server-specific metadata
|
||
|
|
metadata = {
|
||
|
|
role = "kubernetes-master"
|
||
|
|
environment = "demo"
|
||
|
|
backup_enabled = False
|
||
|
|
monitoring_enabled = True
|
||
|
|
}
|
||
|
|
},
|
||
|
|
|
||
|
|
{
|
||
|
|
hostname = "k8s-worker-01"
|
||
|
|
instance_type = "t3.large"
|
||
|
|
|
||
|
|
hardware = {
|
||
|
|
cpu_cores = 2
|
||
|
|
memory_gb = 8
|
||
|
|
storage_gb = 30
|
||
|
|
architecture = "x86_64"
|
||
|
|
}
|
||
|
|
|
||
|
|
image = {
|
||
|
|
os = "ubuntu"
|
||
|
|
version = "22.04"
|
||
|
|
arch = "x86_64"
|
||
|
|
custom_image_id = "ami-0d527b8c289b4af7f"
|
||
|
|
}
|
||
|
|
|
||
|
|
placement = {
|
||
|
|
subnet = "private-1a"
|
||
|
|
security_groups = ["kubernetes-worker"]
|
||
|
|
assign_public_ip = False
|
||
|
|
availability_zone = "eu-west-1a"
|
||
|
|
}
|
||
|
|
|
||
|
|
metadata = {
|
||
|
|
role = "kubernetes-worker"
|
||
|
|
environment = "demo"
|
||
|
|
backup_enabled = False
|
||
|
|
monitoring_enabled = True
|
||
|
|
}
|
||
|
|
},
|
||
|
|
|
||
|
|
{
|
||
|
|
hostname = "k8s-worker-02"
|
||
|
|
instance_type = "t3.large"
|
||
|
|
|
||
|
|
hardware = {
|
||
|
|
cpu_cores = 2
|
||
|
|
memory_gb = 8
|
||
|
|
storage_gb = 30
|
||
|
|
architecture = "aarch64" // ARM for cost optimization
|
||
|
|
}
|
||
|
|
|
||
|
|
image = {
|
||
|
|
os = "ubuntu"
|
||
|
|
version = "22.04"
|
||
|
|
arch = "aarch64"
|
||
|
|
custom_image_id = "ami-0a1b2c3d4e5f6g7h8" // ARM-optimized AMI
|
||
|
|
}
|
||
|
|
|
||
|
|
placement = {
|
||
|
|
subnet = "private-1a"
|
||
|
|
security_groups = ["kubernetes-worker"]
|
||
|
|
assign_public_ip = False
|
||
|
|
availability_zone = "eu-west-1a"
|
||
|
|
}
|
||
|
|
|
||
|
|
metadata = {
|
||
|
|
role = "kubernetes-worker"
|
||
|
|
environment = "demo"
|
||
|
|
backup_enabled = False
|
||
|
|
monitoring_enabled = True
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
|
||
|
|
// Task services (infrastructure components) with dependencies
|
||
|
|
taskservs = [
|
||
|
|
{
|
||
|
|
name = "kubernetes"
|
||
|
|
version = "1.29.0"
|
||
|
|
|
||
|
|
// Service-specific configuration
|
||
|
|
config = ts.KubernetesConfig {
|
||
|
|
cluster_name = "rust-meetup-cluster"
|
||
|
|
network_plugin = "cilium"
|
||
|
|
container_runtime = "youki" // Rust-based OCI runtime
|
||
|
|
|
||
|
|
// Master node configuration
|
||
|
|
master = {
|
||
|
|
node_selector = {"role": "kubernetes-master"}
|
||
|
|
api_server_port = 6443
|
||
|
|
etcd_data_dir = "/var/lib/etcd"
|
||
|
|
}
|
||
|
|
|
||
|
|
// Worker node configuration
|
||
|
|
workers = {
|
||
|
|
node_selector = {"role": "kubernetes-worker"}
|
||
|
|
max_pods_per_node = 110
|
||
|
|
container_log_max_size = "100Mi"
|
||
|
|
}
|
||
|
|
|
||
|
|
// Networking configuration
|
||
|
|
networking = {
|
||
|
|
service_subnet = "10.96.0.0/12"
|
||
|
|
pod_subnet = "10.244.0.0/16"
|
||
|
|
dns_domain = "cluster.local"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
dependencies = [] // No dependencies for base Kubernetes
|
||
|
|
install_order = 1
|
||
|
|
},
|
||
|
|
|
||
|
|
{
|
||
|
|
name = "youki"
|
||
|
|
version = "0.3.0"
|
||
|
|
|
||
|
|
config = ts.YoukiConfig {
|
||
|
|
// Rust OCI runtime configuration
|
||
|
|
runtime_name = "youki"
|
||
|
|
runtime_path = "/usr/local/bin/youki"
|
||
|
|
|
||
|
|
// Performance optimizations
|
||
|
|
features = {
|
||
|
|
seccomp = True
|
||
|
|
systemd = True
|
||
|
|
v2 = True
|
||
|
|
wasm = False // Disable WASM for this demo
|
||
|
|
}
|
||
|
|
|
||
|
|
// Resource limits
|
||
|
|
default_limits = {
|
||
|
|
memory = "512Mi"
|
||
|
|
cpu = "0.5"
|
||
|
|
pids = 1024
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
dependencies = ["kubernetes"]
|
||
|
|
install_order = 2
|
||
|
|
},
|
||
|
|
|
||
|
|
{
|
||
|
|
name = "cilium"
|
||
|
|
version = "1.14.0"
|
||
|
|
|
||
|
|
config = ts.CiliumConfig {
|
||
|
|
// Advanced networking with eBPF
|
||
|
|
cluster_name = "rust-meetup-cluster"
|
||
|
|
|
||
|
|
// eBPF features
|
||
|
|
ebpf = {
|
||
|
|
datapath_mode = "veth"
|
||
|
|
masquerade = True
|
||
|
|
host_routing = True
|
||
|
|
}
|
||
|
|
|
||
|
|
// Security policies
|
||
|
|
network_policy = {
|
||
|
|
enabled = True
|
||
|
|
default_deny = False
|
||
|
|
}
|
||
|
|
|
||
|
|
// Load balancing
|
||
|
|
load_balancer = {
|
||
|
|
algorithm = "round_robin"
|
||
|
|
mode = "dsr" // Direct Server Return
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
dependencies = ["kubernetes", "youki"]
|
||
|
|
install_order = 3
|
||
|
|
},
|
||
|
|
|
||
|
|
{
|
||
|
|
name = "cosmian-kms"
|
||
|
|
version = "4.0.0"
|
||
|
|
|
||
|
|
config = ts.CosmianKMSConfig {
|
||
|
|
// Rust-based key management system
|
||
|
|
server_config = {
|
||
|
|
bind_address = "0.0.0.0:9998"
|
||
|
|
tls_enabled = True
|
||
|
|
cert_path = "/etc/cosmian/server.crt"
|
||
|
|
key_path = "/etc/cosmian/server.key"
|
||
|
|
}
|
||
|
|
|
||
|
|
// Database backend
|
||
|
|
database = {
|
||
|
|
type = "postgresql"
|
||
|
|
host = "localhost"
|
||
|
|
port = 5432
|
||
|
|
database_name = "cosmian_kms"
|
||
|
|
ssl_mode = "require"
|
||
|
|
}
|
||
|
|
|
||
|
|
// Security configuration
|
||
|
|
security = {
|
||
|
|
default_key_algorithm = "AES256-GCM"
|
||
|
|
key_rotation_days = 90
|
||
|
|
audit_logging = True
|
||
|
|
hsm_enabled = False // For demo, use software keys
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
dependencies = ["kubernetes"]
|
||
|
|
install_order = 4
|
||
|
|
}
|
||
|
|
]
|
||
|
|
|
||
|
|
// Secret management configuration
|
||
|
|
secret_management = {
|
||
|
|
provider = "cosmian-kms"
|
||
|
|
|
||
|
|
kms_config = {
|
||
|
|
server_url = "https://k8s-master-01:9998"
|
||
|
|
auth_method = "certificate"
|
||
|
|
client_cert_path = "/etc/provisioning/client.crt"
|
||
|
|
client_key_path = "/etc/provisioning/client.key"
|
||
|
|
ca_cert_path = "/etc/provisioning/ca.crt"
|
||
|
|
timeout = 30
|
||
|
|
verify_ssl = True
|
||
|
|
}
|
||
|
|
|
||
|
|
// Automatic key rotation
|
||
|
|
rotation_policy = {
|
||
|
|
enabled = True
|
||
|
|
rotation_interval_days = 30
|
||
|
|
grace_period_days = 7
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// AI integration configuration
|
||
|
|
ai_provider = {
|
||
|
|
enabled = True
|
||
|
|
provider = "openai" // or "claude", "generic"
|
||
|
|
|
||
|
|
// Model configuration
|
||
|
|
model_config = {
|
||
|
|
model = "gpt-4"
|
||
|
|
max_tokens = 2048
|
||
|
|
temperature = 0.3
|
||
|
|
timeout = 30
|
||
|
|
}
|
||
|
|
|
||
|
|
// Feature flags
|
||
|
|
features = {
|
||
|
|
enable_template_ai = True
|
||
|
|
enable_query_ai = True
|
||
|
|
enable_webhook_ai = False
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// Runtime configuration
|
||
|
|
runtime = {
|
||
|
|
wait = True
|
||
|
|
output_format = "human" // "yaml", "json"
|
||
|
|
output_path = "tmp/rust-meetup-deploy"
|
||
|
|
inventory_file = "./inventory.yaml"
|
||
|
|
use_time = True
|
||
|
|
|
||
|
|
// Deployment strategy
|
||
|
|
deployment = {
|
||
|
|
strategy = "rolling"
|
||
|
|
max_unavailable = 1
|
||
|
|
health_check_timeout = 300
|
||
|
|
rollback_on_failure = True
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// Cost optimization settings
|
||
|
|
cost_optimization = {
|
||
|
|
auto_scaling = {
|
||
|
|
enabled = True
|
||
|
|
min_nodes = 2
|
||
|
|
max_nodes = 5
|
||
|
|
target_cpu_utilization = 70
|
||
|
|
}
|
||
|
|
|
||
|
|
scheduling = {
|
||
|
|
spot_instances = True
|
||
|
|
spot_max_price = 0.05 // USD per hour
|
||
|
|
on_demand_base = 1 // Always keep 1 on-demand
|
||
|
|
}
|
||
|
|
|
||
|
|
resource_tags = {
|
||
|
|
AutoShutdown = "20:00"
|
||
|
|
Environment = "demo"
|
||
|
|
BillingProject = "rust-meetup"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// Validation schemas and constraints
|
||
|
|
schema DemoValidation {
|
||
|
|
// Ensure we don't exceed demo budget
|
||
|
|
check max([server.hardware.cpu_cores for server in config.servers]) <= 4, "Max 4 CPU per server for demo"
|
||
|
|
check len(config.servers) <= 5, "Max 5 servers for demo"
|
||
|
|
check all(server.metadata.backup_enabled == False for server in config.servers), "Backup disabled for demo"
|
||
|
|
|
||
|
|
// Network validation
|
||
|
|
check config.network.vpc_cidr in ["10.0.0.0/16", "172.16.0.0/16"], "Use private CIDR ranges"
|
||
|
|
check all(subnet.cidr in config.network.vpc_cidr for subnet in config.network.subnets), "Subnets must be within VPC CIDR"
|
||
|
|
|
||
|
|
// Security validation
|
||
|
|
check config.secret_management.kms_config.verify_ssl == True, "SSL verification required"
|
||
|
|
check config.ai_provider.features.enable_webhook_ai == False, "Webhook AI disabled for security"
|
||
|
|
}
|
||
|
|
|
||
|
|
// Apply validation
|
||
|
|
validation = DemoValidation {}
|