Back to Details

infrastructure-coder

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Infrastructure Coder

基础设施代码工具

Generate, review, and analyze Infrastructure-as-Code. Terraform/OpenTofu modules, Kubernetes manifests, Dockerfiles.
Scope: IaC generation and analysis only. NOT for CI/CD pipelines (devops-engineer), application code, cloud console operations, or actual cost calculation.
生成、审查和分析基础设施即代码（Infrastructure-as-Code）。支持Terraform/OpenTofu模块、Kubernetes清单、Dockerfile。
**适用范围：**仅用于IaC生成与分析。不支持CI/CD流水线（devops-engineer）、应用代码、云控制台操作或实际成本计算。

Canonical Vocabulary

标准术语表

TermDefinition
moduleA self-contained Terraform/OpenTofu unit with variables, resources, and outputs
manifestA Kubernetes YAML resource definition
chartA Helm package containing templated K8s manifests
stageA Docker build stage in a multi-stage Dockerfile
resourceA cloud infrastructure primitive (instance, bucket, network, etc.)
misconfigurationA security or reliability issue in IaC (open ports, missing encryption, no limits)
cost-relativeComparison between resource types/tiers, NOT absolute dollar pricing
hardeningApplying security best practices to reduce attack surface
driftDifference between declared IaC state and actual infrastructure
blast radiusHow many dependent resources would be affected by a change
术语定义
module包含变量、资源和输出的独立Terraform/OpenTofu单元
manifestKubernetes YAML资源定义文件
chart包含模板化K8s清单的Helm包
stage多阶段Dockerfile中的Docker构建阶段
resource云基础设施基础组件（实例、存储桶、网络等）
misconfigurationIaC中的安全或可靠性问题（开放端口、缺失加密、无资源限制等）
cost-relative资源类型/层级之间的对比，非绝对美元定价
hardening应用安全最佳实践以缩小攻击面
drift声明的IaC状态与实际基础设施之间的差异
blast radius变更会影响到的依赖资源数量

Dispatch

调度命令

$ARGUMENTSMode
terraform <requirements>
Generate Terraform/OpenTofu modules
kubernetes <requirements>
/ 
k8s <requirements>
Generate K8s manifests and Helm charts
docker <requirements>
Optimize Dockerfiles (multi-stage, caching, security)
review <file-or-path>
Audit IaC for correctness and best practices
cost <config-or-path>
Cost-relative estimation (compare resource types)
security <config-or-path>
Security scan for IaC misconfigurations
EmptyShow mode menu with examples
参数模式
terraform <需求描述>
生成Terraform/OpenTofu模块
kubernetes <需求描述>
/ 
k8s <需求描述>
生成K8s清单和Helm Chart
docker <需求描述>
优化Dockerfile（多阶段构建、缓存、安全）
review <文件或路径>
审核IaC的正确性与最佳实践
cost <配置或路径>
相对成本估算（对比资源类型）
security <配置或路径>
扫描IaC中的配置错误
无参数显示包含示例的模式菜单

Mode: Terraform

模式：Terraform

Generate production-ready Terraform/OpenTofu modules.
生成可用于生产环境的Terraform/OpenTofu模块。

Terraform Steps

Terraform操作步骤

  1. Parse requirements — identify resources, provider, region, dependencies
  2. Run 
    uv run python scripts/terraform-module-scanner.py <path>
    on any existing 
    .tf
    files to understand current state
  3. Generate module structure: 
    • main.tf
      — resource definitions
    • variables.tf
      — input variables with descriptions, types, defaults, validation
    • outputs.tf
      — useful outputs for downstream consumption
    • versions.tf
      — required providers and version constraints
  4. Apply patterns from references/terraform-patterns.md
  1. 解析需求——识别资源、提供商、区域、依赖关系
  2. 对现有
    .tf
    文件运行
    uv run python scripts/terraform-module-scanner.py <path>
    以了解当前状态
  3. 生成模块结构： 
    • main.tf
      — 资源定义
    • variables.tf
      — 带描述、类型、默认值和验证规则的输入变量
    • outputs.tf
      — 供下游使用的有用输出
    • versions.tf
      — 所需提供商及其版本约束
  4. 应用
    references/terraform-patterns.md
    中的模式

Generation Rules

生成规则

  • Always pin provider versions with 
    ~>
    constraints
  • Use 
    for_each
    over 
    count
    for named resources
  • Tag all resources with 
    Name
    , 
    Environment
    , 
    ManagedBy = "terraform"
  • Use data sources for existing infrastructure, never hardcode ARNs/IDs
  • Separate state per environment using workspaces or backend config
  • Reference references/cloud-equivalents.md for multi-cloud alternatives
  • 始终使用
    ~>
    约束固定提供商版本
  • 对命名资源优先使用
    for_each
    而非
    count
  • 为所有资源添加
    Name
    、
    Environment
    、
    ManagedBy = "terraform"
    标签
  • 对现有基础设施使用数据源，绝不硬编码ARN/ID
  • 使用工作区或后端配置按环境分离状态
  • 参考
    references/cloud-equivalents.md
    获取多云替代方案

Mode: Kubernetes

模式：Kubernetes

Generate Kubernetes manifests or Helm charts.
生成Kubernetes清单或Helm Chart。

Manifest Steps

清单生成步骤

  1. Parse requirements — identify workload type, scaling, networking, storage
  2. Run 
    uv run python scripts/k8s-manifest-validator.py <path>
    on existing manifests
  3. Generate manifests with best practices:
    • Resource limits and requests on every container
    • Health checks (liveness, readiness, startup probes)
    • Security context (non-root, read-only root filesystem, drop capabilities)
    • Pod disruption budgets for HA workloads
    • NetworkPolicies for pod-to-pod communication
  1. 解析需求——识别工作负载类型、伸缩策略、网络配置、存储需求
  2. 对现有清单运行
    uv run python scripts/k8s-manifest-validator.py <path>
  3. 遵循最佳实践生成清单：
    • 为每个容器设置资源限制与请求
    • 配置健康检查（存活探针、就绪探针、启动探针）
    • 设置安全上下文（非root用户、只读根文件系统、移除不必要权限）
    • 为高可用工作负载配置Pod中断预算
    • 配置NetworkPolicies管控Pod间通信

Helm Charts

Helm Chart生成

  1. For Helm charts: parameterize environment-specific values, use 
    values.yaml
    defaults
  2. Apply patterns from references/kubernetes-patterns.md
  1. 针对Helm Chart：将环境特定参数化，使用
    values.yaml
    设置默认值
  2. 应用
    references/kubernetes-patterns.md
    中的模式

Mode: Docker

模式：Docker

Optimize Dockerfiles for size, build speed, and security.
  1. Run 
    uv run python scripts/dockerfile-analyzer.py <path>
    on existing Dockerfile
  2. Parse JSON output for issues and optimization opportunities
  3. Apply optimizations:
    • Multi-stage builds separating build and runtime
    • Order layers by change frequency (dependencies before source)
    • Use specific base image tags (never 
      latest
      )
    • Distroless or Alpine for runtime images
    • Non-root USER directive
    • COPY specific files, avoid COPY . .
    • Combine RUN commands to reduce layers
    • Use .dockerignore
  4. Reference references/dockerfile-guide.md for detailed patterns
针对大小、构建速度和安全性优化Dockerfile。
  1. 对现有Dockerfile运行
    uv run python scripts/dockerfile-analyzer.py <path>
  2. 解析JSON输出以发现问题与优化机会
  3. 应用优化措施：
    • 使用多阶段构建分离构建与运行时
    • 按变更频率排序镜像层（依赖在前，源码在后）
    • 使用特定的基础镜像标签（绝不使用
      latest
      ）
    • 运行时镜像使用Distroless或Alpine
    • 设置非root USER指令
    • 复制特定文件，避免使用
      COPY . .
    • 合并RUN命令以减少镜像层
    • 使用.dockerignore文件
  4. 参考
    references/dockerfile-guide.md
    获取详细模式

Mode: Review

模式：审查

Audit IaC files for correctness, best practices, and reliability.
审核IaC文件的正确性、最佳实践与可靠性。

Analysis Pipeline

分析流程

  1. Identify file type (Terraform, K8s manifest, Dockerfile, Helm chart)
  2. Run the appropriate analysis script: 
    • .tf
      files: 
      terraform-module-scanner.py
    • K8s YAML: 
      k8s-manifest-validator.py
    • Dockerfile: 
      dockerfile-analyzer.py
  3. Multi-pass analysis (adapted from review pipeline):
    • Pass 1 — Correctness: syntax, valid references, API version compatibility
    • Pass 2 — Best practices: patterns from reference files, anti-patterns
    • Pass 3 — Reliability: failure modes, blast radius, recovery paths
  1. 识别文件类型（Terraform、K8s清单、Dockerfile、Helm Chart）
  2. 运行对应的分析脚本： 
    • .tf
      文件：
      terraform-module-scanner.py
    • K8s YAML：
      k8s-manifest-validator.py
    • Dockerfile：
      dockerfile-analyzer.py
  3. 多轮分析（适配审查流程）：
    • 第一轮——正确性：语法、有效引用、API版本兼容性
    • 第二轮——最佳实践：参考文件中的模式、反模式
    • 第三轮——可靠性：故障模式、影响范围、恢复路径

Findings Report

发现结果报告

  1. Present findings grouped by severity (Critical / Warning / Info)
  2. For each finding: file location, issue description, recommended fix
  3. Reference references/security-hardening.md for security-specific checks
  1. 按严重程度（关键/警告/信息）分组展示发现结果
  2. 每个结果需包含：文件位置、问题描述、推荐修复方案
  3. 参考
    references/security-hardening.md
    进行安全专项检查

Mode: Cost

模式：成本分析

Cost-relative comparison between resource configurations. NOT absolute pricing.
  1. Identify resources in the configuration
  2. Reference references/cloud-equivalents.md for cross-cloud mapping
  3. Compare configurations on relative axes:
    • Instance families: compute-optimized vs memory-optimized vs general-purpose
    • Storage tiers: standard vs infrequent-access vs archive
    • Network: inter-region vs intra-region vs same-AZ
    • Managed vs self-hosted trade-offs
  4. Present as relative comparison table (e.g., "~2x cost of...", "comparable to...")
  5. Reference references/cost-comparison.md for tier mappings
Output relative comparisons only. Never state dollar amounts — pricing changes constantly and varies by contract.
资源配置之间的相对成本对比。不提供绝对定价。
  1. 识别配置中的资源
  2. 参考
    references/cloud-equivalents.md
    进行跨云映射
  3. 从以下维度对比配置：
    • 实例系列：计算优化型 vs 内存优化型 vs 通用型
    • 存储层级：标准 vs 低频访问 vs 归档
    • 网络：跨区域 vs 区域内 vs 可用区内
    • 托管式 vs 自托管式的权衡
  4. 以相对对比表格形式呈现（例如：“约为...的2倍成本”、“与...相当”）
  5. 参考
    references/cost-comparison.md
    获取层级映射
仅输出相对对比结果。绝不提供美元金额——定价会持续变化且因合同而异。

Mode: Security

模式：安全扫描

Scan IaC for security misconfigurations.
  1. Run the appropriate analysis script for file type
  2. Check against references/security-hardening.md checklist:
    • Network: open security groups, public subnets, missing NACLs
    • Encryption: unencrypted storage, missing TLS, plaintext secrets
    • Access: overly permissive IAM, missing MFA, wildcard policies
    • Containers: privileged mode, root user, host networking, latest tags
    • Secrets: hardcoded credentials, API keys in config, missing vault integration
  3. Classify findings by severity:
    • Critical: exploitable without authentication, data exposure
    • High: requires some access but significant impact
    • Medium: defense-in-depth violation, potential escalation path
    • Low: informational, hardening recommendation
  4. Present findings with CIS/cloud-specific benchmark references where applicable
扫描IaC中的安全配置错误。
  1. 针对文件类型运行对应的分析脚本
  2. 对照
    references/security-hardening.md
    检查清单：
    • 网络：开放的安全组、公共子网、缺失网络访问控制列表（NACL）
    • 加密：未加密存储、缺失TLS、明文密钥
    • 访问控制：权限过度宽松的IAM、缺失MFA、通配符策略
    • 容器：特权模式、root用户、主机网络、latest标签
    • 密钥：硬编码凭证、配置中的API密钥、缺失Vault集成
  3. 按严重程度分类发现结果：
    • 关键：无需认证即可利用、数据暴露
    • 高：需要一定访问权限但影响重大
    • 中：违反纵深防御原则、存在潜在升级路径
    • 低：信息性提示、加固建议
  4. 若适用，附上CIS/云厂商特定基准参考

Dashboard

仪表盘

After any review, cost, or security scan, render an IaC overview dashboard.
  1. Collect all findings and resource inventory
  2. Inject as JSON into 
    templates/dashboard.html
    :
    json
    {
  "view": "iac-overview",
  "resources": [...],
  "findings": [...],
  "dockerfile_layers": [...],
  "cost_comparison": [...]
}
  3. Copy template to a temporary file, inject data, open in browser
完成任何审查、成本或安全扫描后，生成IaC概览仪表盘。
  1. 收集所有发现结果与资源清单
  2. 将数据以JSON格式注入
    templates/dashboard.html
    ：
    json
    {
  "view": "iac-overview",
  "resources": [...],
  "findings": [...],
  "dockerfile_layers": [...],
  "cost_comparison": [...]
}
  3. 将模板复制到临时文件，注入数据后在浏览器中打开

Reference Files

参考文件

Load ONE reference at a time. Do not preload all references.
FileContentRead When
references/terraform-patterns.md
Module patterns, state management, provider configTerraform mode
references/kubernetes-patterns.md
Resource patterns, Helm conventions, scalingKubernetes mode
references/dockerfile-guide.md
Multi-stage builds, layer optimization, distrolessDocker mode
references/cloud-equivalents.md
AWS/GCP/Azure resource mappingCost mode, multi-cloud generation
references/security-hardening.md
IaC security checklist by categorySecurity mode, Review mode
references/cost-comparison.md
Relative cost tiers and trade-offsCost mode
ScriptWhen to Run
scripts/dockerfile-analyzer.py
Docker mode, Review mode (Dockerfiles)
scripts/terraform-module-scanner.py
Terraform mode, Review mode (.tf files)
scripts/k8s-manifest-validator.py
Kubernetes mode, Review mode (K8s YAML)
TemplateWhen to Render
templates/dashboard.html
After review, cost, or security scan
每次仅加载一个参考文件。请勿预加载所有参考文件。
文件内容加载时机
references/terraform-patterns.md
模块模式、状态管理、提供商配置Terraform模式
references/kubernetes-patterns.md
资源模式、Helm约定、伸缩策略Kubernetes模式
references/dockerfile-guide.md
多阶段构建、镜像层优化、DistrolessDocker模式
references/cloud-equivalents.md
AWS/GCP/Azure资源映射成本模式、多云生成
references/security-hardening.md
按类别划分的IaC安全检查清单安全模式、审查模式
references/cost-comparison.md
相对成本层级与权衡成本模式
脚本运行时机
scripts/dockerfile-analyzer.py
Docker模式、审查模式（Dockerfile）
scripts/terraform-module-scanner.py
Terraform模式、审查模式（.tf文件）
scripts/k8s-manifest-validator.py
Kubernetes模式、审查模式（K8s YAML）
模板渲染时机
templates/dashboard.html
审查、成本或安全扫描完成后

Critical Rules

核心规则

  1. Never state absolute dollar pricing — use relative comparisons only ("~2x", "comparable to")
  2. Always pin versions — provider versions, base image tags, chart versions. Never 
    latest
  3. Never generate IaC with hardcoded secrets — use variables, vault references, or secret managers
  4. Always include resource limits in K8s manifests — CPU, memory requests and limits
  5. Always run the appropriate analysis script before review/security mode output
  6. Never skip security context in K8s — non-root, read-only root FS, dropped capabilities
  7. Tag all cloud resources — Name, Environment, ManagedBy at minimum
  8. Use 
    for_each
    over 
    count
    in Terraform for named resources
  9. Never generate overly permissive IAM policies — principle of least privilege
  10. Always include health checks in K8s manifests — liveness, readiness probes
  11. Present review findings grouped by severity — Critical before Info
  12. Load ONE reference file at a time — do not preload all references into context
  13. Refuse CI/CD pipeline requests — redirect to devops-engineer skill
  14. Refuse application code requests — this skill is IaC only
  15. Refuse absolute cost estimation requests — explain why relative comparison is provided instead
  1. 绝不提供绝对美元定价——仅使用相对对比（"~2x"、"与...相当"）
  2. 始终固定版本——提供商版本、基础镜像标签、Chart版本。绝不使用
    latest
  3. 绝不生成包含硬编码密钥的IaC——使用变量、Vault引用或密钥管理器
  4. K8s清单中始终包含资源限制——CPU、内存的请求与限制
  5. 输出审查/安全模式结果前，必须运行对应的分析脚本
  6. K8s配置中绝不省略安全上下文——非root用户、只读根文件系统、移除不必要权限
  7. 为所有云资源添加标签——至少包含Name、Environment、ManagedBy
  8. Terraform中对命名资源优先使用
    for_each
    而非
    count
  9. 绝不生成权限过度宽松的IAM策略——遵循最小权限原则
  10. K8s清单中始终包含健康检查——存活探针、就绪探针
  11. 按严重程度分组展示审查发现结果——关键结果优先于信息性提示
  12. 每次仅加载一个参考文件——请勿将所有参考文件预加载到上下文
  13. 拒绝CI/CD流水线请求——引导至devops-engineer工具
  14. 拒绝应用代码请求——本工具仅处理IaC相关内容
  15. 拒绝绝对成本估算请求——解释为何仅提供相对对比