Infralib Agent
One YAML file in. A complete, continuously updated Kubernetes platform out.
docker pull entigolabs/entigo-infralib-agentHow it works
You describe the platform you want in one config file: Kubernetes, ArgoCD, observability, DNS and TLS, SSO. On every run, the Infralib agent updates everything to the latest tested release and applies your config changes. It is a command-line tool, not an AI agent.
- config.yamlYou describe the platform: network, cluster, ArgoCD and the apps on top.
- Infralib agentResolves module versions and wires the modules together.
- PipelinesOne pipeline per step plans and applies the changes, with approvals.
- Your cloudA complete Kubernetes platform, updated to each new tested release.
Explore
Requirements
- AWS
- Google Cloud
- Oracle Cloud
- Azure
A service account with administrator access. Credentials come from your AWS configuration or environment variables.
A service account with owner access. Credentials come from GCP or the gcloud CLI.
A user with policy management access to one compartment, granted by a tenancy administrator:
Allow group <your-group> to manage policies in compartment id <compartment-ocid>
On the first run the agent writes a <prefix>-infralib-agent policy into the same compartment granting itself the rest of the required permissions and waits for it to take effect. The policy is reconciled on every run, and by default it names the executing user by OCID. Use ORACLE_AGENT_GROUP to set an existing group instead when different users execute in the same compartment.
Customer secret key for Infralib and auth token for DevOps code repository are generated on the first executing user, and stored in the Vault for later runs. Users in a non-default identity domain, and federated users, need to set ORACLE_GIT_USERNAME to <tenancy-name>/<domain>/<login> or <tenancy-name>/Federation/<login>. It is resolved once, at seeding time, and stored in the Vault alongside the token. Subsequent in-container runs (resource principal) reuse the stored credentials and need only read access to the Vault.
If a stored credential ever stops working it is not replaced automatically: delete the oracle-customer-secret-key or oracle-devops-auth-token (plus oracle-git-username) secret from the agent's Vault and the next local run reseeds it.
A service principal or user with Owner on the subscription, without the condition that restricts assigning privileged roles: the agent gives its job identity Owner, and modules create role assignments. Credentials come from the Azure SDK default chain: AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET, a managed identity, or the az login session. The Docker image has no az CLI, so pass the service principal variables to it. AZURE_SUBSCRIPTION_ID selects the Azure provider and AZURE_LOCATION sets the region.
License
AGPL v3. Free to use for your own infrastructure.
The Infralib agent, the Infralib modules and the module releases are licensed under the GNU Affero General Public License v3.0 (LICENSE). In practice:
- Running the Infralib agent to manage your own infrastructure carries no source obligation. The AGPL covers this program, not the infrastructure it provisions or the applications you run on it. Your config files, OpenTofu inputs and workloads are yours.
- If you modify the Infralib agent and let others interact with it over a network, the AGPL requires you to offer them the modified source.
- Redistributing modified versions, including modified images, requires that recipients get the source under the same license.
This summary is for orientation only; the LICENSE file governs.