Claude Code云原生基础设施实战：Terraform到K8s交付全链路

flowchart TB
    subgraph "Claude Code驱动的基础设施工作流"
        A[CLAUDE.md项目配置] --> B[Terraform模块开发]
        B --> C[terraform validate/plan]
        C --> D{Plan通过?}
        D -->|是| E[安全扫描 Checkov]
        D -->|否| F[Claude Code修复错误]
        F --> C
        E --> G[Docker镜像构建]
        G --> H[K8s清单/Helm Chart]
        H --> I[kubectl apply / helm install]
        I --> J[监控与成本追踪]

        K[Git Commit] --> L[CI/CD Pipeline]
        L --> B
    end

    style A fill:#f9f,stroke:#333
    style F fill:#ff9,stroke:#333
    style J fill:#9f9,stroke:#333

mkdir cloud-infra-project && cd cloud-infra-project
mkdir -p terraform/{modules,environments/{dev,staging,prod}}
mkdir -p k8s/{base,overlays/{dev,staging,prod}}
mkdir -p helm-charts/myapp
mkdir -p docker
mkdir -p scripts

cloud-infra-project/
├── CLAUDE.md                    # Claude Code项目指令
├── terraform/
│   ├── modules/
│   │   ├── vpc/
│   │   ├── eks/
│   │   ├── rds/
│   │   └── s3/
│   └── environments/
│       ├── dev/
│       ├── staging/
│       └── prod/
├── k8s/
│   ├── base/
│   └── overlays/
├── helm-charts/
├── docker/
└── scripts/

# Cloud Infrastructure Project

## Project Overview
云原生基础设施项目，使用Terraform管理AWS资源，Kubernetes编排容器，Helm交付应用。

## Tech Stack
- Infrastructure: Terraform 1.7+ / OpenTofu
- Container Orchestration: Kubernetes (EKS 1.29)
- Container Runtime: Docker with multi-stage builds
- Package Management: Helm 3.x
- Cloud Provider: AWS (primary), with GCP support planned

## Terraform Conventions
- 所有资源必须添加 `tags` 块，包含 Environment、Project、ManagedBy 字段
- 变量定义在 `variables.tf`，输出在 `outputs.tf`，资源按模块拆分
- 使用 `locals` 进行命名约定：`${local.project}-${local.environment}-${resource}`
- State存储在S3后端，启用DynamoDB锁定
- 禁止硬编码AWS Account ID或Region，使用 `data "aws_caller_identity"` 和变量
- 模块版本必须锁定：`source = "...?ref=v1.2.3"`
- 敏感变量必须标记 `sensitive = true`
- 始终运行 `terraform fmt` 和 `terraform validate` 后再提交

## Kubernetes Conventions
- 使用Kustomize管理多环境配置（base + overlay模式）
- 所有Deployment必须设置 `resources.requests` 和 `resources.limits`
- 必须配置 `livenessProbe` 和 `readinessProbe`
- 使用NetworkPolicy限制Pod间通信
- 镜像标签禁止使用 `latest`，必须指定具体版本

## Docker Conventions
- 多阶段构建，最终镜像基于distroless或alpine
- 禁止以root用户运行应用
- 使用 `.dockerignore` 排除不必要文件

## Security Requirements
- 安全组遵循最小权限原则
- 所有S3桶启用版本控制和加密
- RDS启用加密和自动备份
- 定期运行 `checkov` 扫描Terraform代码
- IAM策略遵循最小权限

## Commands
- 格式化: `terraform fmt -recursive`
- 验证: `terraform validate`
- 计划: `terraform plan -out=tfplan`
- 安全扫描: `checkov -d terraform/ --framework terraform`
- K8s验证: `kubectl apply --dry-run=client -f k8s/`

claude "请描述当前项目的目录结构和规范要求"

claude "在 terraform/modules/vpc/ 下创建一个生产级VPC模块，要求：
1. 支持多AZ部署（3个可用区）
2. 公有子网、私有子网、数据库子网分离
3. 启用NAT Gateway（每个AZ一个）
4. VPC Flow Log发送到CloudWatch
5. 使用locals进行命名约定
6. 所有资源添加标准tags"

variable "vpc_cidr" {
  description = "VPC CIDR block"
  type        = string
  default     = "10.0.0.0/16"
}

variable "environment" {
  description = "Environment name"
  type        = string
}

variable "project" {
  description = "Project name"
  type        = string
}

variable "availability_zones" {
  description = "List of availability zones"
  type        = list(string)
  default     = ["us-east-1a", "us-east-1b", "us-east-1c"]
}

variable "public_subnets" {
  description = "CIDR blocks for public subnets"
  type        = list(string)
  default     = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
}

variable "private_subnets" {
  description = "CIDR blocks for private subnets"
  type        = list(string)
  default     = ["10.0.10.0/24", "10.0.20.0/24", "10.0.30.0/24"]
}

variable "database_subnets" {
  description = "CIDR blocks for database subnets"
  type        = list(string)
  default     = ["10.0.100.0/24", "10.0.200.0/24", "10.0.300.0/24"]
}

locals {
  name_prefix = "${var.project}-${var.environment}"
  common_tags = {
    Environment = var.environment
    Project     = var.project
    ManagedBy   = "terraform"
  }
}

resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-vpc"
  })
}

# 公有子网
resource "aws_subnet" "public" {
  count                   = length(var.public_subnets)
  vpc_id                  = aws_vpc.main.id
  cidr_block              = var.public_subnets[count.index]
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true

  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-public-${count.index + 1}"
    Tier = "public"
  })
}

# 私有子网
resource "aws_subnet" "private" {
  count             = length(var.private_subnets)
  vpc_id            = aws_vpc.main.id
  cidr_block        = var.private_subnets[count.index]
  availability_zone = var.availability_zones[count.index]

  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-private-${count.index + 1}"
    Tier = "private"
  })
}

# NAT Gateway（每AZ一个）
resource "aws_eip" "nat" {
  count  = length(var.public_subnets)
  domain = "vpc"

  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-nat-eip-${count.index + 1}"
  })
}

resource "aws_nat_gateway" "main" {
  count         = length(var.public_subnets)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id

  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-nat-${count.index + 1}"
  })

  depends_on = [aws_internet_gateway.main]
}

# VPC Flow Logs
resource "aws_flow_log" "main" {
  vpc_id          = aws_vpc.main.id
  traffic_type    = "ALL"
  iam_role_arn    = aws_iam_role.flow_log.arn
  log_destination = aws_cloudwatch_log_group.flow_log.arn

  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-flow-log"
  })
}

claude "在 terraform/environments/dev/ 下创建dev环境配置：
1. 引用上述VPC模块
2. 使用 dev-test 的CIDR范围（10.1.0.0/16）
3. 只用2个AZ（节省成本）
4. 配置S3后端存储state
5. 创建provider配置，region从变量读取"

# Claude Code可以直接在终端执行terraform命令
claude "在dev环境下运行 terraform init、fmt、validate，报告所有错误和警告"

claude "在项目根目录创建 scripts/security-scan.sh 脚本：
1. 运行 checkov 扫描 terraform/ 目录
2. 运行 trivy 扫描 docker/ 目录
3. 输出报告到 security-reports/ 目录
4. 退出码表示是否有高危漏洞"

#!/bin/bash
set -euo pipefail

REPORT_DIR="security-reports/$(date +%Y%m%d-%H%M%S)"
mkdir -p "$REPORT_DIR"

echo "=== Terraform Security Scan ==="
checkov -d terraform/ \
  --framework terraform \
  --output cli \
  --output junitxml \
  --output-file-plan "${REPORT_DIR}/terraform-checkov.xml" \
  --soft-fail-on LOW \
  --hard-fail-on CRITICAL,HIGH

echo "=== Docker Security Scan ==="
for dockerfile in docker/*/Dockerfile; do
  trivy config "$dockerfile" --format json > "${REPORT_DIR}/trivy-$(basename $(dirname $dockerfile)).json"
done

echo "Reports saved to ${REPORT_DIR}"

claude "Checkov报告了以下问题，请逐一修复：
1. CKV_AWS_79: S3桶未启用加密
2. CKV_AWS_18: S3桶未配置访问日志
3. CKV_AWS_23: 安全组规则过于宽松（0.0.0.0/0）
4. CKV_AWS_35: RDS未启用加密"

# Before (不安全)
resource "aws_security_group_rule" "ingress" {
  type        = "ingress"
  from_port   = 443
  to_port     = 443
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]  # Checkov: CKV_AWS_23
}

# After (修复后)
resource "aws_security_group_rule" "ingress" {
  type        = "ingress"
  from_port   = 443
  to_port     = 443
  protocol    = "tcp"
  cidr_blocks = [var.allowed_cidr_blocks]  # 限制为已知IP范围
  description = "HTTPS access from known networks"
}

# 安装antonbabenko的terraform-skill
mkdir -p ~/.claude/skills
git clone https://github.com/antonbabenko/terraform-skill ~/.claude/skills/terraform

claude "在 docker/app/ 下为Node.js应用创建生产级Dockerfile：
1. 多阶段构建（build → production）
2. 最终镜像基于node:20-alpine
3. 创建非root用户运行应用
4. 使用.dockerignore排除node_modules等
5. 添加健康检查
6. 遵循CLAUDE.md中的容器规范"

# Stage 1: Build
FROM node:20-alpine AS builder

WORKDIR /app

# 先复制依赖文件，利用Docker缓存
COPY package.json package-lock.json ./
RUN npm ci --only=production && \
    npm cache clean --force

# 复制源码并构建
COPY . .
RUN npm run build

# Stage 2: Production
FROM node:20-alpine AS production

# 安装dumb-init作为PID 1
RUN apk add --no-cache dumb-init

# 创建非root用户
RUN addgroup -g 1001 -S appgroup && \
    adduser -S appuser -u 1001 -G appgroup

WORKDIR /app

# 只复制构建产物和必要依赖
COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:appgroup /app/package.json ./

USER appuser

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "dist/server.js"]

claude "使用trivy扫描刚才构建的Docker镜像，检查是否有高危CVE漏洞"

claude "在 k8s/base/ 下为上述应用创建K8s清单：
1. Deployment（2 replicas，含resources限制）
2. Service（ClusterIP类型）
3. HorizontalPodAutoscaler
4. NetworkPolicy（只允许同namespace流量）
5. PodDisruptionBudget
6. 必须配置liveness和readiness探针
7. 使用kustomization.yaml组织"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 1001
      containers:
        - name: myapp
          image: myapp:latest  # kustomize会替换tag
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL

claude "创建 k8s/overlays/prod/ 的Kustomize overlay：
1. 副本数增加到5
2. 资源限制提高到 1 CPU / 1Gi 内存
3. 添加HPA（目标CPU 70%）
4. 配置生产环境ConfigMap和Secret引用
5. 添加PodDisruptionBudget（minAvailable: 3）"

claude "在 helm-charts/myapp/ 下创建完整的Helm Chart：
1. Chart.yaml 和 values.yaml
2. templates/ 包含 deployment、service、ingress、hpa、networkpolicy
3. _helpers.tpl 定义通用标签模板
4. values.yaml 提供合理的默认值和注释说明
5. 支持通过values覆盖所有关键参数"

# -- 部署副本数
replicaCount: 2

image:
  # -- 镜像仓库地址
  repository: 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp
  # -- 镜像拉取策略
  pullPolicy: IfNotPresent
  # -- 镜像标签（禁止使用latest）
  tag: ""

# -- 镜像拉取Secret（ECR私有仓库需要）
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

service:
  type: ClusterIP
  port: 80
  targetPort: 3000

ingress:
  enabled: false
  className: alb
  annotations: {}
  hosts: []
  tls: []

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 70

# -- 安全上下文
securityContext:
  runAsNonRoot: true
  runAsUser: 1001
  fsGroup: 1001

# -- 网络策略
networkPolicy:
  enabled: true
  ingressFrom: []

claude "验证Helm Chart：
1. helm lint helm-charts/myapp/
2. helm template 渲染并检查输出
3. 确保所有模板都能正确渲染"

claude "创建 .github/workflows/infrastructure.yml：
1. PR触发时运行 terraform plan + checkov 扫描
2. main分支合并时运行 terraform apply
3. 包含terraform fmt检查
4. plan结果作为PR评论输出
5. 使用OIDC认证（不使用长期AK/SK）"

name: Infrastructure Pipeline

on:
  pull_request:
    paths:
      - 'terraform/**'
  push:
    branches: [main]
    paths:
      - 'terraform/**'

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Terraform Format Check
        run: terraform fmt -recursive -check terraform/

      - name: Security Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          framework: terraform
          soft_fail_on: LOW
          hard_fail_on: CRITICAL,HIGH

      - name: Terraform Plan
        run: |
          cd terraform/environments/${{ github.ref_name == 'main' && 'prod' || 'dev' }}
          terraform init
          terraform plan -out=tfplan

      - name: Terraform Apply
        if: github.ref == 'refs/heads/main'
        run: |
          cd terraform/environments/prod
          terraform apply -auto-approve tfplan

claude "创建Terraform模块来配置GitHub Actions OIDC认证：
1. IAM Identity Provider（GitHub OIDC）
2. IAM Role with Web Identity
3. 最小权限策略（仅允许需要的terraform操作）
4. Trust policy限制为特定仓库和分支"

claude "基于项目CLAUDE.md规范，生成完整的微服务基础设施代码：
1. terraform/modules/eks/ — EKS集群模块（托管节点组）
2. terraform/modules/rds/ — PostgreSQL模块（Multi-AZ）
3. terraform/modules/elasticache/ — Redis模块
4. terraform/environments/prod/ — 组合所有模块
5. helm-charts/order-service/ 和 helm-charts/inventory-service/
6. k8s/overlays/prod/ — 包含HPA和NetworkPolicy

架构约束：
- EKS节点组使用Spot实例降低成本
- RDS使用Graviton实例
- 所有跨服务通信通过Service Mesh
- 启用X-Ray分布式追踪"

sequenceDiagram
    participant Dev as 开发者
    participant CC as Claude Code
    participant TF as Terraform
    participant CK as Checkov
    participant K8s as Kubernetes

    Dev->>CC: 描述基础设施需求
    CC->>CC: 读取CLAUDE.md规范
    CC->>TF: 生成Terraform代码
    CC->>TF: terraform fmt + validate
    TF-->>CC: 验证结果

    alt 验证失败
        CC->>CC: 自动修复错误
        CC->>TF: 重新验证
    end

    CC->>CK: 运行安全扫描
    CK-->>CC: 安全报告

    alt 发现高危问题
        CC->>CC: 生成修复补丁
        CC->>Dev: 展示修复建议
    end

    CC->>TF: terraform plan
    TF-->>CC: 变更计划
    CC->>Dev: 展示计划摘要

    Dev->>CC: 确认应用
    CC->>TF: terraform apply

    CC->>K8s: 部署Helm Charts
    K8s-->>CC: 部署状态
    CC->>Dev: 完整交付报告

claude "分析 terraform/environments/prod/ 的配置，识别以下成本优化机会：
1. 是否有可使用Spot实例的工作负载
2. RDS实例类型是否right-sized
3. NAT Gateway数量是否合理（每个$32/月）
4. 是否有不必要的Elastic IP
5. S3生命周期策略是否完善
6. 给出预估月度成本"

claude "使用terratest为VPC模块编写集成测试：
1. 测试VPC创建成功
2. 验证子网数量和CIDR
3. 验证NAT Gateway数量
4. 验证Flow Log配置
5. 测试放在 terraform/modules/vpc/test/ 下"

claude "创建 scripts/drift-detect.sh 脚本：
1. 对每个环境运行 terraform plan -detailed-exitcode
2. 如果检测到drift（exit code 2），发送告警
3. 生成drift报告：哪些资源被手动修改
4. 可以与cron或GitHub Actions定时任务集成"

claude "创建 terraform/modules/abstract-database/ 模块：
1. 使用terraform条件表达式选择AWS RDS或GCP Cloud SQL
2. 统一的变量接口（engine, version, size）
3. 统一的输出接口（endpoint, port, connection_string）
4. 具体实现在 modules/rds/ 和 modules/cloud-sql/ 中"

claude "创建Terraform状态管理脚本：
1. scripts/state-bootstrap.sh — 初始化S3后端和DynamoDB锁表
2. scripts/state-import.sh — 导入现有资源到state
3. scripts/state-mv.sh — 安全的资源移动（模块重构用）
4. 所有操作前先备份state文件"

graph LR
    subgraph "开发阶段"
        A1[编写CLAUDE.md] --> A2[生成Terraform模块]
        A2 --> A3[生成Dockerfile]
        A3 --> A4[生成K8s清单/Helm]
    end

    subgraph "验证阶段"
        B1[terraform fmt] --> B2[terraform validate]
        B2 --> B3[checkov安全扫描]
        B3 --> B4[trivy镜像扫描]
        B4 --> B5[helm lint]
    end

    subgraph "交付阶段"
        C1[terraform plan] --> C2[人工审核]
        C2 --> C3[terraform apply]
        C3 --> C4[helm install/upgrade]
        C4 --> C5[监控验证]
    end

    A4 --> B1
    B5 --> C1