72 lines
3.6 KiB
Markdown
72 lines
3.6 KiB
Markdown
# Live infrastructure — draw what's actually running
|
|
|
|
The IaC importers (`tfimports.py`, `k8simports.py`, `composeimports.py`) draw the
|
|
**declared** config. These three recipes draw the **real** state — the resources
|
|
actually deployed, the containers actually running, the cluster as it is now.
|
|
Every path ends the same way: an importer emits autolayout graph JSON, then
|
|
`autolayout.py` renders an editable `.drawio` with the same official icons.
|
|
|
|
Read this when the user says things like *"draw my running cluster / stack"*,
|
|
*"diagram what's actually deployed"*, *"visualize my live AWS/Azure/GCP infra"*,
|
|
or *"map the containers I have up right now"*.
|
|
|
|
> The commands below read local tool state (`terraform`, `docker`, `kubectl`)
|
|
> the user already has authenticated. The skill never reaches out to a cloud
|
|
> account itself — it only parses the JSON those tools print. If a tool or its
|
|
> auth is missing, say so and fall back to the declared-config importer.
|
|
|
|
## 1. Deployed cloud resources — Terraform state
|
|
|
|
Provider-agnostic (AWS / Azure / GCP alike). Run from the Terraform working dir:
|
|
|
|
```bash
|
|
terraform show -json | python3 <this-skill-dir>/scripts/tfstate.py - -o graph.json
|
|
python3 <this-skill-dir>/scripts/autolayout.py graph.json -o deployed.drawio
|
|
```
|
|
|
|
- Works on live state (above) or a saved plan: `terraform show -json plan.tfplan | …`.
|
|
- `count` / `for_each` resources appear as their real instances (`name[0]`, `name[1]`).
|
|
- `--group` boxes resources by module; `--no-icons` for plain boxes; `--direction LR`.
|
|
- Edges are the dependencies Terraform recorded in state (`depends_on`). A state
|
|
with no recorded dependencies still produces a useful **inventory** (every
|
|
deployed resource with its official icon) — mention that if edges come out sparse.
|
|
- Contrast with `tfimports.py` (the `.tf` files) when the user wants declared-vs-actual.
|
|
|
|
## 2. Running containers — Docker
|
|
|
|
```bash
|
|
docker inspect $(docker ps -q) | python3 <this-skill-dir>/scripts/dockerimports.py - -o graph.json
|
|
python3 <this-skill-dir>/scripts/autolayout.py graph.json -o running.drawio
|
|
```
|
|
|
|
- Containers → rounded boxes (name + image); user networks → green ellipses;
|
|
named volumes → cylinders. Built-in `bridge`/`host`/`none`/`ingress` networks
|
|
and bind mounts are dropped as noise.
|
|
- Edges: container→network, container→volume, and container→container from
|
|
`links` and the compose `depends_on` label.
|
|
- `--group` boxes containers by their compose project (else first network).
|
|
- `docker ps -q` lists only running containers; add `-a` to include stopped ones.
|
|
|
|
## 3. Live cluster — Kubernetes (via k8simports)
|
|
|
|
No new script — `k8simports.py` already ingests `kubectl get ... -o json`. Ask for
|
|
the resource kinds that make the architecture readable (workloads + what wires them):
|
|
|
|
```bash
|
|
kubectl get deploy,sts,ds,svc,ing,cm,secret,pvc,hpa -n <ns> -o json \
|
|
| python3 <this-skill-dir>/scripts/k8simports.py - -o graph.json
|
|
python3 <this-skill-dir>/scripts/autolayout.py graph.json -o cluster.drawio
|
|
```
|
|
|
|
- `kubectl get all` alone omits Ingress / ConfigMap / Secret / PVC — list the
|
|
kinds explicitly (as above) so the reference edges have endpoints to land on.
|
|
- `--group` boxes objects by namespace; add `-A` to `kubectl` for all namespaces.
|
|
- Edges are derived within a namespace: Ingress→Service, Service→workload
|
|
(selector match), workload→ConfigMap/Secret/PVC, HPA→target.
|
|
|
|
## After any of them
|
|
|
|
Continue at the main workflow's **Export draft** step: preview PNG (`--width 2000`),
|
|
self-check, review, final export with `-e` + `repair_png.py`. A live snapshot is a
|
|
point in time — re-run the pipeline to refresh it.
|