infra(terraform): add EKS cluster, Elasticache Redis, and ECR modules for cloud deployment

terraform/main.tf

@@ -0,0 +1,158 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.27"
+    }
+  }
+
+  # Remote state — replace bucket/key/region with your values before applying.
+  # Remove this block entirely to use local state during development.
+  backend "s3" {
+    bucket         = "your-terraform-state-bucket"
+    key            = "ai-code-review-agent/terraform.tfstate"
+    region         = "us-east-1"
+    encrypt        = true
+    dynamodb_table = "terraform-state-lock"
+  }
+}
+
+provider "aws" {
+  region = var.aws_region
+
+  default_tags {
+    tags = var.tags
+  }
+}
+
+# ── networking ─────────────────────────────────────────────────────────────
+# Minimal VPC: 2 public + 2 private subnets across 2 AZs.
+# EKS nodes and Elasticache live in private subnets.
+# NAT Gateway allows outbound internet (for git clone, LLM API calls).
+
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+resource "aws_vpc" "main" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+
+  tags = { Name = "${var.cluster_name}-vpc" }
+}
+
+resource "aws_subnet" "public" {
+  count                   = 2
+  vpc_id                  = aws_vpc.main.id
+  cidr_block              = cidrsubnet("10.0.0.0/16", 8, count.index)
+  availability_zone       = data.aws_availability_zones.available.names[count.index]
+  map_public_ip_on_launch = true
+
+  tags = {
+    Name                                          = "${var.cluster_name}-public-${count.index}"
+    "kubernetes.io/role/elb"                      = "1"
+    "kubernetes.io/cluster/${var.cluster_name}"   = "shared"
+  }
+}
+
+resource "aws_subnet" "private" {
+  count             = 2
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = cidrsubnet("10.0.0.0/16", 8, count.index + 10)
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+
+  tags = {
+    Name                                          = "${var.cluster_name}-private-${count.index}"
+    "kubernetes.io/role/internal-elb"             = "1"
+    "kubernetes.io/cluster/${var.cluster_name}"   = "shared"
+  }
+}
+
+resource "aws_internet_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+  tags   = { Name = "${var.cluster_name}-igw" }
+}
+
+resource "aws_eip" "nat" {
+  domain = "vpc"
+  tags   = { Name = "${var.cluster_name}-nat-eip" }
+}
+
+resource "aws_nat_gateway" "main" {
+  allocation_id = aws_eip.nat.id
+  subnet_id     = aws_subnet.public[0].id
+  tags          = { Name = "${var.cluster_name}-nat" }
+  depends_on    = [aws_internet_gateway.main]
+}
+
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.main.id
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.main.id
+  }
+  tags = { Name = "${var.cluster_name}-public-rt" }
+}
+
+resource "aws_route_table" "private" {
+  vpc_id = aws_vpc.main.id
+  route {
+    cidr_block     = "0.0.0.0/0"
+    nat_gateway_id = aws_nat_gateway.main.id
+  }
+  tags = { Name = "${var.cluster_name}-private-rt" }
+}
+
+resource "aws_route_table_association" "public" {
+  count          = 2
+  subnet_id      = aws_subnet.public[count.index].id
+  route_table_id = aws_route_table.public.id
+}
+
+resource "aws_route_table_association" "private" {
+  count          = 2
+  subnet_id      = aws_subnet.private[count.index].id
+  route_table_id = aws_route_table.private.id
+}
+
+# ── modules ────────────────────────────────────────────────────────────────
+
+module "eks" {
+  source = "./modules/eks"
+
+  cluster_name       = var.cluster_name
+  cluster_version    = var.cluster_version
+  vpc_id             = aws_vpc.main.id
+  private_subnet_ids = aws_subnet.private[*].id
+  node_instance_type = var.node_instance_type
+  node_min_size      = var.node_min_size
+  node_max_size      = var.node_max_size
+  node_desired_size  = var.node_desired_size
+  tags               = var.tags
+}
+
+module "redis" {
+  source = "./modules/redis"
+
+  cluster_name          = var.cluster_name
+  vpc_id                = aws_vpc.main.id
+  private_subnet_ids    = aws_subnet.private[*].id
+  eks_security_group_id = module.eks.node_security_group_id
+  node_type             = var.redis_node_type
+  num_cache_nodes       = var.redis_num_cache_nodes
+  tags                  = var.tags
+}
+
+module "ecr" {
+  source = "./modules/ecr"
+
+  repository_name = var.ecr_repository_name
+  tags            = var.tags
+}

terraform/modules/ecr/main.tf

@@ -0,0 +1,33 @@
+variable "repository_name" { type = string }
+variable "tags"            { type = map(string) }
+
+resource "aws_ecr_repository" "main" {
+  name                 = var.repository_name
+  image_tag_mutability = "MUTABLE"
+
+  image_scanning_configuration {
+    scan_on_push = true    # free ECR basic scanning on every docker push
+  }
+
+  tags = var.tags
+}
+
+# Keep only the 10 most recent images to control storage cost
+resource "aws_ecr_lifecycle_policy" "main" {
+  repository = aws_ecr_repository.main.name
+
+  policy = jsonencode({
+    rules = [{
+      rulePriority = 1
+      description  = "Keep last 10 images"
+      selection = {
+        tagStatus   = "any"
+        countType   = "imageCountMoreThan"
+        countNumber = 10
+      }
+      action = { type = "expire" }
+    }]
+  })
+}
+
+output "repository_url" { value = aws_ecr_repository.main.repository_url }

terraform/modules/eks/main.tf

@@ -0,0 +1,132 @@
+variable "cluster_name"       { type = string }
+variable "cluster_version"    { type = string }
+variable "vpc_id"             { type = string }
+variable "private_subnet_ids" { type = list(string) }
+variable "node_instance_type" { type = string }
+variable "node_min_size"      { type = number }
+variable "node_max_size"      { type = number }
+variable "node_desired_size"  { type = number }
+variable "tags"               { type = map(string) }
+
+# ── IAM roles ──────────────────────────────────────────────────────────────
+
+resource "aws_iam_role" "cluster" {
+  name = "${var.cluster_name}-cluster-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "eks.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_iam_role_policy_attachment" "cluster_policy" {
+  role       = aws_iam_role.cluster.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
+}
+
+resource "aws_iam_role" "node_group" {
+  name = "${var.cluster_name}-node-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "ec2.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_iam_role_policy_attachment" "node_worker_policy" {
+  role       = aws_iam_role.node_group.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
+}
+
+resource "aws_iam_role_policy_attachment" "node_cni_policy" {
+  role       = aws_iam_role.node_group.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
+}
+
+resource "aws_iam_role_policy_attachment" "node_ecr_policy" {
+  role       = aws_iam_role.node_group.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
+}
+
+# ── security group ─────────────────────────────────────────────────────────
+
+resource "aws_security_group" "node" {
+  name        = "${var.cluster_name}-node-sg"
+  description = "Security group for EKS worker nodes"
+  vpc_id      = var.vpc_id
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "Allow all outbound (git clone, LLM API, ECR pull)"
+  }
+
+  tags = merge(var.tags, { Name = "${var.cluster_name}-node-sg" })
+}
+
+# ── cluster ────────────────────────────────────────────────────────────────
+
+resource "aws_eks_cluster" "main" {
+  name     = var.cluster_name
+  version  = var.cluster_version
+  role_arn = aws_iam_role.cluster.arn
+
+  vpc_config {
+    subnet_ids              = var.private_subnet_ids
+    security_group_ids      = [aws_security_group.node.id]
+    endpoint_private_access = true
+    endpoint_public_access  = true   # set false + VPN for production hardening
+  }
+
+  depends_on = [aws_iam_role_policy_attachment.cluster_policy]
+  tags       = var.tags
+}
+
+# ── managed node group ─────────────────────────────────────────────────────
+
+resource "aws_eks_node_group" "main" {
+  cluster_name    = aws_eks_cluster.main.name
+  node_group_name = "${var.cluster_name}-nodes"
+  node_role_arn   = aws_iam_role.node_group.arn
+  subnet_ids      = var.private_subnet_ids
+  instance_types  = [var.node_instance_type]
+
+  scaling_config {
+    min_size     = var.node_min_size
+    max_size     = var.node_max_size
+    desired_size = var.node_desired_size
+  }
+
+  update_config {
+    max_unavailable = 1   # rolling update: one node down at a time
+  }
+
+  depends_on = [
+    aws_iam_role_policy_attachment.node_worker_policy,
+    aws_iam_role_policy_attachment.node_cni_policy,
+    aws_iam_role_policy_attachment.node_ecr_policy,
+  ]
+
+  tags = var.tags
+}
+
+# ── outputs ────────────────────────────────────────────────────────────────
+
+output "cluster_endpoint"                    { value = aws_eks_cluster.main.endpoint }
+output "cluster_name"                        { value = aws_eks_cluster.main.name }
+output "cluster_certificate_authority_data"  { value = aws_eks_cluster.main.certificate_authority[0].data }
+output "node_security_group_id"              { value = aws_security_group.node.id }

terraform/modules/redis/main.tf

@@ -0,0 +1,68 @@
+variable "cluster_name"          { type = string }
+variable "vpc_id"                { type = string }
+variable "private_subnet_ids"    { type = list(string) }
+variable "eks_security_group_id" { type = string }
+variable "node_type"             { type = string }
+variable "num_cache_nodes"       { type = number }
+variable "tags"                  { type = map(string) }
+
+# ── subnet group ───────────────────────────────────────────────────────────
+
+resource "aws_elasticache_subnet_group" "redis" {
+  name       = "${var.cluster_name}-redis-subnet-group"
+  subnet_ids = var.private_subnet_ids
+  tags       = var.tags
+}
+
+# ── security group ─────────────────────────────────────────────────────────
+# Only EKS worker nodes can reach Redis on port 6379.
+
+resource "aws_security_group" "redis" {
+  name        = "${var.cluster_name}-redis-sg"
+  description = "Allow Redis access from EKS worker nodes only"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    from_port       = 6379
+    to_port         = 6379
+    protocol        = "tcp"
+    security_groups = [var.eks_security_group_id]
+    description     = "Redis from EKS nodes"
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = merge(var.tags, { Name = "${var.cluster_name}-redis-sg" })
+}
+
+# ── elasticache cluster ────────────────────────────────────────────────────
+
+resource "aws_elasticache_cluster" "redis" {
+  cluster_id           = "${var.cluster_name}-redis"
+  engine               = "redis"
+  engine_version       = "7.0"
+  node_type            = var.node_type
+  num_cache_nodes      = var.num_cache_nodes
+  parameter_group_name = "default.redis7"
+  port                 = 6379
+  subnet_group_name    = aws_elasticache_subnet_group.redis.name
+  security_group_ids   = [aws_security_group.redis.id]
+
+  # Automatic minor version upgrades during maintenance window
+  auto_minor_version_upgrade = true
+  maintenance_window         = "sun:05:00-sun:06:00"
+  snapshot_retention_limit   = 1    # 1-day snapshot for recovery
+  snapshot_window            = "04:00-05:00"
+
+  tags = var.tags
+}
+
+# ── outputs ────────────────────────────────────────────────────────────────
+
+output "primary_endpoint_address" { value = aws_elasticache_cluster.redis.cache_nodes[0].address }
+output "port"                     { value = aws_elasticache_cluster.redis.port }

terraform/outputs.tf

@@ -0,0 +1,37 @@
+output "cluster_endpoint" {
+  description = "EKS cluster API server endpoint"
+  value       = module.eks.cluster_endpoint
+  sensitive   = false
+}
+
+output "cluster_name" {
+  description = "EKS cluster name — pass to kubectl and helm"
+  value       = module.eks.cluster_name
+}
+
+output "cluster_certificate_authority_data" {
+  description = "Base64-encoded CA cert for kubectl config"
+  value       = module.eks.cluster_certificate_authority_data
+  sensitive   = true
+}
+
+output "ecr_repository_url" {
+  description = "Full ECR repository URL for docker push"
+  value       = module.ecr.repository_url
+}
+
+output "redis_endpoint" {
+  description = "Elasticache Redis primary endpoint — set as REDIS_URL in k8s secret"
+  value       = module.redis.primary_endpoint_address
+  sensitive   = true
+}
+
+output "redis_port" {
+  description = "Elasticache Redis port"
+  value       = module.redis.port
+}
+
+output "kubeconfig_command" {
+  description = "Run this command to update your local kubeconfig"
+  value       = "aws eks update-kubeconfig --region ${var.aws_region} --name ${var.cluster_name}"
+}

terraform/variables.tf

@@ -0,0 +1,70 @@
+variable "aws_region" {
+  description = "AWS region to deploy into"
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "cluster_name" {
+  description = "EKS cluster name"
+  type        = string
+  default     = "ai-code-review-agent"
+}
+
+variable "cluster_version" {
+  description = "Kubernetes version"
+  type        = string
+  default     = "1.29"
+}
+
+variable "node_instance_type" {
+  description = "EC2 instance type for EKS worker nodes"
+  type        = string
+  default     = "t3.medium"   # 2 vCPU, 4 GB — adequate for API pods
+                               # use t3.large for worker pods running LLM calls
+}
+
+variable "node_min_size" {
+  description = "Minimum number of EKS worker nodes"
+  type        = number
+  default     = 2
+}
+
+variable "node_max_size" {
+  description = "Maximum number of EKS worker nodes"
+  type        = number
+  default     = 10
+}
+
+variable "node_desired_size" {
+  description = "Desired number of EKS worker nodes at launch"
+  type        = number
+  default     = 2
+}
+
+variable "redis_node_type" {
+  description = "Elasticache node type for the Redis task queue and result cache"
+  type        = string
+  default     = "cache.t3.micro"
+}
+
+variable "redis_num_cache_nodes" {
+  description = "Number of Elasticache nodes (1 = single node, no replication)"
+  type        = number
+  default     = 1
+}
+
+variable "ecr_repository_name" {
+  description = "Name of the ECR repository for the application image"
+  type        = string
+  default     = "ai-code-review-agent"
+}
+
+variable "tags" {
+  description = "Tags applied to all resources"
+  type        = map(string)
+  default = {
+    Project     = "ai-code-review-agent"
+    Environment = "production"
+    ManagedBy   = "terraform"
+  }
+}