infrastructure-coder

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Infrastructure Coder

基础设施代码工具

Generate, review, and analyze Infrastructure-as-Code. Terraform/OpenTofu modules, Kubernetes manifests, Dockerfiles.

Scope: IaC generation and analysis only. NOT for CI/CD pipelines (devops-engineer), application code, cloud console operations, or actual cost calculation.

生成、审查和分析基础设施即代码（Infrastructure-as-Code）。支持Terraform/OpenTofu模块、Kubernetes清单、Dockerfile。

**适用范围：**仅用于IaC生成与分析。不支持CI/CD流水线（devops-engineer）、应用代码、云控制台操作或实际成本计算。

Canonical Vocabulary

标准术语表

Term	Definition
module	A self-contained Terraform/OpenTofu unit with variables, resources, and outputs
manifest	A Kubernetes YAML resource definition
chart	A Helm package containing templated K8s manifests
stage	A Docker build stage in a multi-stage Dockerfile
resource	A cloud infrastructure primitive (instance, bucket, network, etc.)
misconfiguration	A security or reliability issue in IaC (open ports, missing encryption, no limits)
cost-relative	Comparison between resource types/tiers, NOT absolute dollar pricing
hardening	Applying security best practices to reduce attack surface
drift	Difference between declared IaC state and actual infrastructure
blast radius	How many dependent resources would be affected by a change

术语	定义
module	包含变量、资源和输出的独立Terraform/OpenTofu单元
manifest	Kubernetes YAML资源定义文件
chart	包含模板化K8s清单的Helm包
stage	多阶段Dockerfile中的Docker构建阶段
resource	云基础设施基础组件（实例、存储桶、网络等）
misconfiguration	IaC中的安全或可靠性问题（开放端口、缺失加密、无资源限制等）
cost-relative	资源类型/层级之间的对比，非绝对美元定价
hardening	应用安全最佳实践以缩小攻击面
drift	声明的IaC状态与实际基础设施之间的差异
blast radius	变更会影响到的依赖资源数量

Dispatch

调度命令

$ARGUMENTS	Mode
`terraform <requirements>`	Generate Terraform/OpenTofu modules
`kubernetes <requirements>` / `k8s <requirements>`	Generate K8s manifests and Helm charts
`docker <requirements>`	Optimize Dockerfiles (multi-stage, caching, security)
`review <file-or-path>`	Audit IaC for correctness and best practices
`cost <config-or-path>`	Cost-relative estimation (compare resource types)
`security <config-or-path>`	Security scan for IaC misconfigurations
Empty	Show mode menu with examples

参数	模式
`terraform <需求描述>`	生成Terraform/OpenTofu模块
`kubernetes <需求描述>` / `k8s <需求描述>`	生成K8s清单和Helm Chart
`docker <需求描述>`	优化Dockerfile（多阶段构建、缓存、安全）
`review <文件或路径>`	审核IaC的正确性与最佳实践
`cost <配置或路径>`	相对成本估算（对比资源类型）
`security <配置或路径>`	扫描IaC中的配置错误
无参数	显示包含示例的模式菜单

Mode: Terraform

模式：Terraform

Generate production-ready Terraform/OpenTofu modules.

生成可用于生产环境的Terraform/OpenTofu模块。

Terraform Steps

Terraform操作步骤

Parse requirements — identify resources, provider, region, dependencies

Run

uv run python scripts/terraform-module-scanner.py <path>

on any existing

.tf

files to understand current state

Generate module structure:
- ```
main.tf
```
  — resource definitions
- ```
variables.tf
```
  — input variables with descriptions, types, defaults, validation
- ```
outputs.tf
```
  — useful outputs for downstream consumption
- ```
versions.tf
```
  — required providers and version constraints
Apply patterns from references/terraform-patterns.md

解析需求——识别资源、提供商、区域、依赖关系

对现有

.tf

文件运行

uv run python scripts/terraform-module-scanner.py <path>

以了解当前状态

生成模块结构：
- ```
main.tf
```
  — 资源定义
- ```
variables.tf
```
  — 带描述、类型、默认值和验证规则的输入变量
- ```
outputs.tf
```
  — 供下游使用的有用输出
- ```
versions.tf
```
  — 所需提供商及其版本约束
应用
```
references/terraform-patterns.md
```
中的模式

Generation Rules

生成规则

Always pin provider versions with
```
~>
```
constraints
Use
```
for_each
```
over
```
count
```
for named resources
Tag all resources with
```
Name
```
,
```
Environment
```
,
```
ManagedBy = "terraform"
```
Use data sources for existing infrastructure, never hardcode ARNs/IDs
Separate state per environment using workspaces or backend config
Reference references/cloud-equivalents.md for multi-cloud alternatives

始终使用
```
~>
```
约束固定提供商版本
对命名资源优先使用
```
for_each
```
而非
```
count
```
为所有资源添加
```
Name
```
、
```
Environment
```
、
```
ManagedBy = "terraform"
```
标签
对现有基础设施使用数据源，绝不硬编码ARN/ID
使用工作区或后端配置按环境分离状态
参考
```
references/cloud-equivalents.md
```
获取多云替代方案

Mode: Kubernetes

模式：Kubernetes

Generate Kubernetes manifests or Helm charts.

生成Kubernetes清单或Helm Chart。

Manifest Steps

清单生成步骤

Parse requirements — identify workload type, scaling, networking, storage

Run

uv run python scripts/k8s-manifest-validator.py <path>

on existing manifests

Generate manifests with best practices:
- Resource limits and requests on every container
- Health checks (liveness, readiness, startup probes)
- Security context (non-root, read-only root filesystem, drop capabilities)
- Pod disruption budgets for HA workloads
- NetworkPolicies for pod-to-pod communication

解析需求——识别工作负载类型、伸缩策略、网络配置、存储需求

对现有清单运行

uv run python scripts/k8s-manifest-validator.py <path>

遵循最佳实践生成清单：
- 为每个容器设置资源限制与请求
- 配置健康检查（存活探针、就绪探针、启动探针）
- 设置安全上下文（非root用户、只读根文件系统、移除不必要权限）
- 为高可用工作负载配置Pod中断预算
- 配置NetworkPolicies管控Pod间通信

Helm Charts

Helm Chart生成

For Helm charts: parameterize environment-specific values, use
```
values.yaml
```
defaults
Apply patterns from references/kubernetes-patterns.md

针对Helm Chart：将环境特定参数化，使用
```
values.yaml
```
设置默认值
应用
```
references/kubernetes-patterns.md
```
中的模式

Mode: Docker

模式：Docker

Optimize Dockerfiles for size, build speed, and security.

Run

uv run python scripts/dockerfile-analyzer.py <path>

on existing Dockerfile

Parse JSON output for issues and optimization opportunities
Apply optimizations:
- Multi-stage builds separating build and runtime
- Order layers by change frequency (dependencies before source)
- Use specific base image tags (never
```
latest
```
  )
- Distroless or Alpine for runtime images
- Non-root USER directive
- COPY specific files, avoid COPY . .
- Combine RUN commands to reduce layers
- Use .dockerignore
Reference references/dockerfile-guide.md for detailed patterns

针对大小、构建速度和安全性优化Dockerfile。

对现有Dockerfile运行

uv run python scripts/dockerfile-analyzer.py <path>

解析JSON输出以发现问题与优化机会
应用优化措施：
- 使用多阶段构建分离构建与运行时
- 按变更频率排序镜像层（依赖在前，源码在后）
- 使用特定的基础镜像标签（绝不使用
```
latest
```
  ）
- 运行时镜像使用Distroless或Alpine
- 设置非root USER指令
- 复制特定文件，避免使用
```
COPY . .
```
- 合并RUN命令以减少镜像层
- 使用.dockerignore文件
参考
```
references/dockerfile-guide.md
```
获取详细模式

Mode: Review

模式：审查

Audit IaC files for correctness, best practices, and reliability.

审核IaC文件的正确性、最佳实践与可靠性。

Analysis Pipeline

分析流程

Identify file type (Terraform, K8s manifest, Dockerfile, Helm chart)

Run the appropriate analysis script:

```
.tf
```
files:
```
terraform-module-scanner.py
```
K8s YAML:
```
k8s-manifest-validator.py
```
Dockerfile:
```
dockerfile-analyzer.py
```

Multi-pass analysis (adapted from review pipeline):
- Pass 1 — Correctness: syntax, valid references, API version compatibility
- Pass 2 — Best practices: patterns from reference files, anti-patterns
- Pass 3 — Reliability: failure modes, blast radius, recovery paths

识别文件类型（Terraform、K8s清单、Dockerfile、Helm Chart）

运行对应的分析脚本：

```
.tf
```
文件：
```
terraform-module-scanner.py
```
K8s YAML：
```
k8s-manifest-validator.py
```
Dockerfile：
```
dockerfile-analyzer.py
```

多轮分析（适配审查流程）：
- 第一轮——正确性：语法、有效引用、API版本兼容性
- 第二轮——最佳实践：参考文件中的模式、反模式
- 第三轮——可靠性：故障模式、影响范围、恢复路径

Findings Report

发现结果报告

Present findings grouped by severity (Critical / Warning / Info)
For each finding: file location, issue description, recommended fix
Reference references/security-hardening.md for security-specific checks

按严重程度（关键/警告/信息）分组展示发现结果
每个结果需包含：文件位置、问题描述、推荐修复方案
参考
```
references/security-hardening.md
```
进行安全专项检查

Mode: Cost

模式：成本分析

Cost-relative comparison between resource configurations. NOT absolute pricing.

Identify resources in the configuration
Reference references/cloud-equivalents.md for cross-cloud mapping
Compare configurations on relative axes:
- Instance families: compute-optimized vs memory-optimized vs general-purpose
- Storage tiers: standard vs infrequent-access vs archive
- Network: inter-region vs intra-region vs same-AZ
- Managed vs self-hosted trade-offs
Present as relative comparison table (e.g., "~2x cost of...", "comparable to...")
Reference references/cost-comparison.md for tier mappings

Output relative comparisons only. Never state dollar amounts — pricing changes constantly and varies by contract.

资源配置之间的相对成本对比。不提供绝对定价。

识别配置中的资源
参考
```
references/cloud-equivalents.md
```
进行跨云映射
从以下维度对比配置：
- 实例系列：计算优化型 vs 内存优化型 vs 通用型
- 存储层级：标准 vs 低频访问 vs 归档
- 网络：跨区域 vs 区域内 vs 可用区内
- 托管式 vs 自托管式的权衡
以相对对比表格形式呈现（例如：“约为...的2倍成本”、“与...相当”）
参考
```
references/cost-comparison.md
```
获取层级映射

仅输出相对对比结果。绝不提供美元金额——定价会持续变化且因合同而异。

Mode: Security

模式：安全扫描

Scan IaC for security misconfigurations.

Run the appropriate analysis script for file type
Check against references/security-hardening.md checklist:
- Network: open security groups, public subnets, missing NACLs
- Encryption: unencrypted storage, missing TLS, plaintext secrets
- Access: overly permissive IAM, missing MFA, wildcard policies
- Containers: privileged mode, root user, host networking, latest tags
- Secrets: hardcoded credentials, API keys in config, missing vault integration
Classify findings by severity:
- Critical: exploitable without authentication, data exposure
- High: requires some access but significant impact
- Medium: defense-in-depth violation, potential escalation path
- Low: informational, hardening recommendation
Present findings with CIS/cloud-specific benchmark references where applicable

扫描IaC中的安全配置错误。

针对文件类型运行对应的分析脚本
对照
```
references/security-hardening.md
```
检查清单：
- 网络：开放的安全组、公共子网、缺失网络访问控制列表（NACL）
- 加密：未加密存储、缺失TLS、明文密钥
- 访问控制：权限过度宽松的IAM、缺失MFA、通配符策略
- 容器：特权模式、root用户、主机网络、latest标签
- 密钥：硬编码凭证、配置中的API密钥、缺失Vault集成
按严重程度分类发现结果：
- 关键：无需认证即可利用、数据暴露
- 高：需要一定访问权限但影响重大
- 中：违反纵深防御原则、存在潜在升级路径
- 低：信息性提示、加固建议
若适用，附上CIS/云厂商特定基准参考

Dashboard

仪表盘

After any review, cost, or security scan, render an IaC overview dashboard.

Collect all findings and resource inventory

Inject as JSON into

templates/dashboard.html

json

{
  "view": "iac-overview",
  "resources": [...],
  "findings": [...],
  "dockerfile_layers": [...],
  "cost_comparison": [...]
}

Copy template to a temporary file, inject data, open in browser

完成任何审查、成本或安全扫描后，生成IaC概览仪表盘。

收集所有发现结果与资源清单

将数据以JSON格式注入

templates/dashboard.html

：

json

{
  "view": "iac-overview",
  "resources": [...],
  "findings": [...],
  "dockerfile_layers": [...],
  "cost_comparison": [...]
}

将模板复制到临时文件，注入数据后在浏览器中打开

Reference Files

参考文件

Load ONE reference at a time. Do not preload all references.

File	Content	Read When
`references/terraform-patterns.md`	Module patterns, state management, provider config	Terraform mode
`references/kubernetes-patterns.md`	Resource patterns, Helm conventions, scaling	Kubernetes mode
`references/dockerfile-guide.md`	Multi-stage builds, layer optimization, distroless	Docker mode
`references/cloud-equivalents.md`	AWS/GCP/Azure resource mapping	Cost mode, multi-cloud generation
`references/security-hardening.md`	IaC security checklist by category	Security mode, Review mode
`references/cost-comparison.md`	Relative cost tiers and trade-offs	Cost mode

Script	When to Run
`scripts/dockerfile-analyzer.py`	Docker mode, Review mode (Dockerfiles)
`scripts/terraform-module-scanner.py`	Terraform mode, Review mode (.tf files)
`scripts/k8s-manifest-validator.py`	Kubernetes mode, Review mode (K8s YAML)

Template	When to Render
`templates/dashboard.html`	After review, cost, or security scan

每次仅加载一个参考文件。请勿预加载所有参考文件。

文件	内容	加载时机
`references/terraform-patterns.md`	模块模式、状态管理、提供商配置	Terraform模式
`references/kubernetes-patterns.md`	资源模式、Helm约定、伸缩策略	Kubernetes模式
`references/dockerfile-guide.md`	多阶段构建、镜像层优化、Distroless	Docker模式
`references/cloud-equivalents.md`	AWS/GCP/Azure资源映射	成本模式、多云生成
`references/security-hardening.md`	按类别划分的IaC安全检查清单	安全模式、审查模式
`references/cost-comparison.md`	相对成本层级与权衡	成本模式

脚本	运行时机
`scripts/dockerfile-analyzer.py`	Docker模式、审查模式（Dockerfile）
`scripts/terraform-module-scanner.py`	Terraform模式、审查模式（.tf文件）
`scripts/k8s-manifest-validator.py`	Kubernetes模式、审查模式（K8s YAML）

模板	渲染时机
`templates/dashboard.html`	审查、成本或安全扫描完成后

Critical Rules

核心规则

Never state absolute dollar pricing — use relative comparisons only ("~2x", "comparable to")
Always pin versions — provider versions, base image tags, chart versions. Never
```
latest
```
Never generate IaC with hardcoded secrets — use variables, vault references, or secret managers
Always include resource limits in K8s manifests — CPU, memory requests and limits
Always run the appropriate analysis script before review/security mode output
Never skip security context in K8s — non-root, read-only root FS, dropped capabilities
Tag all cloud resources — Name, Environment, ManagedBy at minimum
Use
```
for_each
```
over
```
count
```
in Terraform for named resources
Never generate overly permissive IAM policies — principle of least privilege
Always include health checks in K8s manifests — liveness, readiness probes
Present review findings grouped by severity — Critical before Info
Load ONE reference file at a time — do not preload all references into context
Refuse CI/CD pipeline requests — redirect to devops-engineer skill
Refuse application code requests — this skill is IaC only
Refuse absolute cost estimation requests — explain why relative comparison is provided instead

绝不提供绝对美元定价——仅使用相对对比（"~2x"、"与...相当"）
始终固定版本——提供商版本、基础镜像标签、Chart版本。绝不使用
```
latest
```
绝不生成包含硬编码密钥的IaC——使用变量、Vault引用或密钥管理器
K8s清单中始终包含资源限制——CPU、内存的请求与限制
输出审查/安全模式结果前，必须运行对应的分析脚本
K8s配置中绝不省略安全上下文——非root用户、只读根文件系统、移除不必要权限
为所有云资源添加标签——至少包含Name、Environment、ManagedBy
Terraform中对命名资源优先使用
```
for_each
```
而非
```
count
```
绝不生成权限过度宽松的IAM策略——遵循最小权限原则
K8s清单中始终包含健康检查——存活探针、就绪探针
按严重程度分组展示审查发现结果——关键结果优先于信息性提示
每次仅加载一个参考文件——请勿将所有参考文件预加载到上下文
拒绝CI/CD流水线请求——引导至devops-engineer工具
拒绝应用代码请求——本工具仅处理IaC相关内容
拒绝绝对成本估算请求——解释为何仅提供相对对比