AWS Infra

AWS Infra Orchestrator

Purpose

Set up the AWS infrastructure foundation for KAS/NVCF self-hosted on EKS by reading and applying the smaller component skills. This skill is the entrypoint for end-to-end AWS foundation work; it should not carry detailed Terraform, node, GPU Operator, or validation logic directly.

Use this for infra setup only. Use later NVCF skills for runtime installation, NVCA, functions, stream validation, caches, UCC, DDCS, or storage APIs. Use ecr-mirror after ECR exists when images or OCI Helm charts need to be mirrored from NGC into ECR.

Component Skills

Run or read these skills in order:

Azure parity mapping:

Required Inputs

Collect these once, then pass them to the component skills:

Confirm these when missing:

Mode Detection

Default to generate mode: create Terraform and helper scripts for review under generated/. Use deploy mode only when the user explicitly asks to apply, deploy, run, or execute the stack.

Only enter destroy mode when the user explicitly requests teardown or cleanup:

• "destroy cluster ..."
• "terraform destroy ..."
• "tear down cluster ..."
• "clean up cluster ..."
• "delete the cluster ..."
• "remove the stack ..."

Generate Workflow

1. Read aws-tf-conventions first and apply its rules to every generated file.
2. Use aws-iam-vpc, eks-cluster, eks-nodes, eks-storage, and ecr to generate the Terraform root stack for generated/terraform/aws/envs/<cluster>/. The eks-storage IAM policy attachment goes in the same root module as eks-nodes.
3. Use eks-storage to generate generated/<cluster>-storage.sh.
4. Use eks-gpu-operator to generate generated/<cluster>-gpu-operator.sh.
5. Use eks-validate to generate generated/<cluster>-validate.sh.
6. Print the generated paths and the exact command order for review.

Expected generated layout:

generated/
├── <cluster>-storage.sh
├── <cluster>-gpu-operator.sh
├── <cluster>-validate.sh
└── terraform/aws/envs/<cluster>/
    ├── main.tf
    ├── providers.tf
    ├── variables.tf
    ├── outputs.tf
    └── terraform.tfvars

Deploy Workflow

Run from the generated Terraform environment directory after reading the plan:

cd "generated/terraform/aws/envs/${CLUSTER_NAME}"
terraform fmt -recursive
terraform init
terraform validate
terraform plan -out=tfplan
terraform apply tfplan
aws eks update-kubeconfig --name "$CLUSTER_NAME" --region "$AWS_REGION" --alias "$CLUSTER_NAME"

Read the plan before applying. Investigate every destroy and every resource outside the expected AWS foundation list.

Then run the post-Terraform scripts in order:

bash "generated/${CLUSTER_NAME}-storage.sh"
bash "generated/${CLUSTER_NAME}-gpu-operator.sh"
bash "generated/${CLUSTER_NAME}-validate.sh"

Destroy Workflow

Before running any destroy, print the following and require exact cluster-name confirmation:

You are about to destroy the full AWS stack for cluster <CLUSTER_NAME>:

  Step 1 - GPU operator (Helm):  helm uninstall gpu-operator
  Step 2 - AWS infra (Terraform): terraform destroy deletes VPC, EKS, ECR, IAM

Type the cluster name to confirm:

Only proceed if the user types the cluster name exactly.

Destroy in reverse order:

helm uninstall gpu-operator \
  --kube-context "$CLUSTER_NAME" \
  --namespace gpu-operator \
  --wait --timeout 5m || true
kubectl --context "$CLUSTER_NAME" delete namespace gpu-operator --ignore-not-found

terraform -chdir=generated/terraform/aws/envs/"$CLUSTER_NAME" destroy -auto-approve

ECR repositories created by Terraform will be destroyed with the stack. If they contain mirrored images you want to keep, export or retain them before destroy.

Validation Checklist

• Component skills were read instead of recreating detailed logic here.
• Generated Terraform follows aws-tf-conventions.
• GPU Operator stays outside Terraform state.
• ecr-mirror remains optional and separate from infra apply.
• Destroy requires exact cluster-name confirmation.