Unlock the cost optimization of Pulumi and OpenShift: What Works

// Code Example 1: Provision Cost-Optimized OpenShift 4.14 Cluster on AWS with Pulumi
// Pulumi SDK Version: @pulumi/pulumi v3.94.0, @pulumi/aws v6.32.0, @pulumi/openshift v2.14.1
// Pulumi OpenShift Provider: https://github.com/pulumi/pulumi-openshift
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as openshift from "@pulumi/openshift";

// Load configuration with strict validation to avoid misconfigured cost settings
const config = new pulumi.Config();
const awsRegion = config.require("awsRegion");
const clusterName = config.require("clusterName");
const workerInstanceType = config.get("workerInstanceType") || "t4g.medium"; // ARM Graviton, 40% cheaper than x86
const workerNodeCount = config.getNumber("workerNodeCount") || 3;
const useSpotInstances = config.getBoolean("useSpotInstances") || true;
const spotMaxPrice = config.get("spotMaxPrice") || "0.10"; // Cap spot price at 50% of on-demand

// Validate required AWS credentials are present
if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {
    throw new Error("Missing AWS credentials: set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY");
}

// Configure AWS provider with region from config
const awsProvider = new aws.Provider("aws-provider", {
    region: awsRegion,
});

// Create VPC with cost-optimized settings: single NAT gateway instead of redundant for dev/test
const vpc = new aws.ec2.Vpc("openshift-vpc", {
    cidrBlock: "10.0.0.0/16",
    enableDnsSupport: true,
    enableDnsHostnames: true,
    tags: { Name: `${clusterName}-vpc`, "kubernetes.io/cluster/${clusterName}": "owned" },
}, { provider: awsProvider });

const publicSubnet = new aws.ec2.Subnet("public-subnet", {
    vpcId: vpc.id,
    cidrBlock: "10.0.1.0/24",
    mapPublicIpOnLaunch: true,
    availabilityZone: `${awsRegion}a`,
    tags: { Name: `${clusterName}-public-subnet` },
}, { provider: awsProvider });

const natGateway = new aws.ec2.NatGateway("nat-gw", {
    subnetId: publicSubnet.id,
    allocationId: new aws.ec2.Eip("nat-eip", { vpc: true }, { provider: awsProvider }).id,
}, { provider: awsProvider });

const privateSubnet = new aws.ec2.Subnet("private-subnet", {
    vpcId: vpc.id,
    cidrBlock: "10.0.2.0/24",
    availabilityZone: `${awsRegion}a`,
    tags: { Name: `${clusterName}-private-subnet`, "kubernetes.io/cluster/${clusterName}": "owned" },
}, { provider: awsProvider });

const privateRouteTable = new aws.ec2.RouteTable("private-rt", {
    vpcId: vpc.id,
    routes: [{ cidrBlock: "0.0.0.0/0", natGatewayId: natGateway.id }],
}, { provider: awsProvider });

new aws.ec2.RouteTableAssociation("private-rta", {
    subnetId: privateSubnet.id,
    routeTableId: privateRouteTable.id,
}, { provider: awsProvider });

// Provision OpenShift cluster with cost-optimized worker nodes
const cluster = new openshift.Cluster("openshift-cluster", {
    clusterName: clusterName,
    openshiftVersion: "4.14.12",
    aws: {
        region: awsRegion,
        vpcId: vpc.id,
        subnetIds: [privateSubnet.id],
        workerNodeConfig: {
            instanceType: workerInstanceType,
            nodeCount: workerNodeCount,
            spotInstanceConfig: useSpotInstances ? {
                maxPrice: spotMaxPrice,
                spotInstancePools: 3, // Spread across 3 pools to reduce interruption risk
            } : undefined,
            volumeSize: 120, // GP3 instead of GP2, 20% cheaper per GB
            volumeType: "gp3",
        },
        masterNodeConfig: {
            instanceType: "m6g.large", // ARM master nodes, 30% cheaper than x86
            nodeCount: 3,
        },
    },
    tags: { Environment: "production", CostCenter: "infra-2024" },
}, { provider: awsProvider, dependsOn: [privateRouteTable] });

// Export cluster endpoint and cost metrics
export const clusterEndpoint = cluster.apiServerUrl;
export const estimatedMonthlyCost = pulumi.interpolate`${workerNodeCount * (useSpotInstances ? 0.04 : 0.10) * 730} USD (approx, excludes master nodes)`;
export const workerInstanceType = workerInstanceType;

// Code Example 2: Enforce OpenShift Cost Guardrails with Pulumi Automation API
// Pulumi Automation SDK: @pulumi/pulumi v3.94.0, @pulumi/openshift v2.14.1, node-cron v3.0.3
import * as pulumi from "@pulumi/pulumi";
import * as openshift from "@pulumi/openshift";
import { CronJob } from "node-cron";
import * as k8s from "@pulumi/kubernetes";

// Configuration for cost guardrails
const config = new pulumi.Config();
const clusterName = config.require("clusterName");
const nonProdNamespaces = config.get("nonProdNamespaces")?.split(",") || ["dev", "test", "staging"];
const nightlyShutdownCron = config.get("nightlyShutdownCron") || "0 22 * * 1-5"; // 10 PM weekdays
const unusedResourceTTLHours = config.getNumber("unusedResourceTTLHours") || 72;

// Initialize Kubernetes provider for the target OpenShift cluster
const k8sProvider = new k8s.Provider("k8s-provider", {
    kubeconfig: new openshift.Cluster("existing-cluster", {
        clusterName: clusterName,
    }).kubeconfig,
});

// Function to scale down deployments in non-prod namespaces to 0 during off-hours
async function scaleDownNonProd() {
    try {
        const appsV1 = new k8s.apps.v1.Deployment("deployment-client", { provider: k8sProvider });
        for (const ns of nonProdNamespaces) {
            const deployments = await appsV1.list({ namespace: ns });
            for (const deploy of deployments.items) {
                if (deploy.spec?.replicas && deploy.spec.replicas > 0) {
                    // Store original replica count in annotation for restoration
                    const annotations = deploy.metadata?.annotations || {};
                    annotations["cost.openshift.io/original-replicas"] = deploy.spec.replicas.toString();
                    await appsV1.update(deploy.metadata!.name!, {
                        ...deploy,
                        spec: { ...deploy.spec, replicas: 0 },
                        metadata: { ...deploy.metadata, annotations },
                    });
                    console.log(`Scaled down ${deploy.metadata!.name} in ${ns} to 0 replicas`);
                }
            }
        }
    } catch (error) {
        console.error(`Failed to scale down non-prod deployments: ${error.message}`);
        throw error; // Re-throw to trigger alerting
    }
}

// Function to restore deployments to original replica counts at start of business day
async function restoreNonProd() {
    try {
        const appsV1 = new k8s.apps.v1.Deployment("deployment-client", { provider: k8sProvider });
        for (const ns of nonProdNamespaces) {
            const deployments = await appsV1.list({ namespace: ns });
            for (const deploy of deployments.items) {
                const originalReplicas = deploy.metadata?.annotations?.["cost.openshift.io/original-replicas"];
                if (originalReplicas) {
                    await appsV1.update(deploy.metadata!.name!, {
                        ...deploy,
                        spec: { ...deploy.spec, replicas: parseInt(originalReplicas) },
                    });
                    console.log(`Restored ${deploy.metadata!.name} in ${ns} to ${originalReplicas} replicas`);
                }
            }
        }
    } catch (error) {
        console.error(`Failed to restore non-prod deployments: ${error.message}`);
        throw error;
    }
}

// Function to delete unused resources (pods, PVCs) older than TTL
async function deleteUnusedResources() {
    try {
        const coreV1 = new k8s.core.v1.Pod("pod-client", { provider: k8sProvider });
        const pvcClient = new k8s.core.v1.PersistentVolumeClaim("pvc-client", { provider: k8sProvider });
        const cutoffTime = new Date(Date.now() - unusedResourceTTLHours * 60 * 60 * 1000);

        // Delete completed pods older than TTL
        const pods = await coreV1.list({ fieldSelector: "status.phase=Succeeded" });
        for (const pod of pods.items) {
            if (new Date(pod.status?.startTime!) < cutoffTime) {
                await coreV1.delete(pod.metadata!.name!, { namespace: pod.metadata!.namespace });
                console.log(`Deleted unused pod ${pod.metadata!.name} in ${pod.metadata!.namespace}`);
            }
        }

        // Delete unbound PVCs older than TTL
        const pvcs = await pvcClient.list();
        for (const pvc of pvcs.items) {
            if (pvc.status?.phase === "Pending" && new Date(pvc.metadata!.creationTimestamp!) < cutoffTime) {
                await pvcClient.delete(pvc.metadata!.name!, { namespace: pvc.metadata!.namespace });
                console.log(`Deleted unbound PVC ${pvc.metadata!.name} in ${pvc.metadata!.namespace}`);
            }
        }
    } catch (error) {
        console.error(`Failed to delete unused resources: ${error.message}`);
        throw error;
    }
}

// Schedule nightly shutdown and morning restoration
new CronJob(nightlyShutdownCron, scaleDownNonProd, null, true);
new CronJob("0 8 * * 1-5", restoreNonProd, null, true); // 8 AM weekdays
new CronJob("0 * * * *", deleteUnusedResources, null, true); // Hourly check for unused resources

// Export guardrail metrics
export const nonProdNamespacesCount = nonProdNamespaces.length;
export const estimatedMonthlySavings = pulumi.interpolate`${nonProdNamespaces.length * 4 * 0.05 * 730} USD (approx, based on 4 deployments per namespace)`;

// Code Example 3: Automated OpenShift Pod Right-Sizing with Pulumi and Prometheus Metrics
// Dependencies: @pulumi/pulumi v3.94.0, @pulumi/kubernetes v4.11.0, prometheus-api-client v1.0.4
import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";
import { PrometheusQueryClient } from "prometheus-api-client";

// Configuration
const config = new pulumi.Config();
const prometheusUrl = config.require("prometheusUrl");
const clusterName = config.require("clusterName");
const cpuBufferPercentage = config.getNumber("cpuBufferPercentage") || 20; // 20% buffer for CPU
const memoryBufferPercentage = config.getNumber("memoryBufferPercentage") || 30; // 30% buffer for memory
const dryRun = config.getBoolean("dryRun") || true; // Default to dry run to avoid breaking changes

// Initialize Kubernetes provider
const k8sProvider = new k8s.Provider("k8s-provider", {
    kubeconfig: config.require("kubeconfig"),
});

// Initialize Prometheus client
const promClient = new PrometheusQueryClient({ endpoint: prometheusUrl });

// Query Prometheus for 7-day average CPU and memory usage per pod
async function getPodUsageMetrics() {
    try {
        const sevenDaysAgo = Math.floor((Date.now() - 7 * 24 * 60 * 60 * 1000) / 1000);
        const cpuQuery = `avg_over_time(container_cpu_usage_seconds_total{cluster="${clusterName}", container!="POD"}[7d]) * 1000`; // Convert to millicores
        const memoryQuery = `avg_over_time(container_memory_working_set_bytes{cluster="${clusterName}", container!="POD"}[7d]) / 1024 / 1024 / 1024`; // Convert to GB

        const cpuResult = await promClient.query(cpuQuery, sevenDaysAgo);
        const memoryResult = await promClient.query(memoryQuery, sevenDaysAgo);

        // Map metrics to pod identifiers
        const podMetrics = new Map();
        for (const sample of cpuResult.data.result) {
            const podName = sample.metric.pod;
            const namespace = sample.metric.namespace;
            const key = `${namespace}/${podName}`;
            if (!podMetrics.has(key)) podMetrics.set(key, { cpu: 0, memory: 0 });
            podMetrics.get(key).cpu = parseFloat(sample.value[1]);
        }
        for (const sample of memoryResult.data.result) {
            const podName = sample.metric.pod;
            const namespace = sample.metric.namespace;
            const key = `${namespace}/${podName}`;
            if (!podMetrics.has(key)) podMetrics.set(key, { cpu: 0, memory: 0 });
            podMetrics.get(key).memory = parseFloat(sample.value[1]);
        }
        return podMetrics;
    } catch (error) {
        console.error(`Failed to query Prometheus: ${error.message}`);
        throw error;
    }
}

// Right-size a single deployment based on usage metrics
async function rightSizeDeployment(deployName: string, namespace: string, metrics: any) {
    try {
        const appsV1 = new k8s.apps.v1.Deployment("deployment-client", { provider: k8sProvider });
        const deploy = await appsV1.get(deployName, namespace);
        const key = `${namespace}/${deployName}`;
        const usage = metrics.get(key);

        if (!usage) {
            console.log(`No usage metrics found for ${key}, skipping`);
            return;
        }

        // Calculate right-sized resource requests
        const currentCpuRequest = deploy.spec?.template?.spec?.containers?.[0]?.resources?.requests?.cpu;
        const currentMemoryRequest = deploy.spec?.template?.spec?.containers?.[0]?.resources?.requests?.memory;
        const newCpuRequest = Math.ceil(usage.cpu * (1 + cpuBufferPercentage / 100));
        const newMemoryRequest = Math.ceil(usage.memory * (1 + memoryBufferPercentage / 100));

        // Only update if there's a significant difference (>10%)
        if (currentCpuRequest && (Math.abs(parseInt(currentCpuRequest) - newCpuRequest) / parseInt(currentCpuRequest)) > 0.1) {
            if (dryRun) {
                console.log(`[DRY RUN] Would update ${key} CPU request from ${currentCpuRequest} to ${newCpuRequest}m`);
            } else {
                await appsV1.update(deployName, {
                    ...deploy,
                    spec: {
                        ...deploy.spec,
                        template: {
                            ...deploy.spec.template,
                            spec: {
                                ...deploy.spec.template.spec,
                                containers: deploy.spec.template.spec.containers.map(container => ({
                                    ...container,
                                    resources: {
                                        ...container.resources,
                                        requests: {
                                            ...container.resources?.requests,
                                            cpu: `${newCpuRequest}m`,
                                            memory: `${newMemoryRequest}Gi`,
                                        },
                                    },
                                })),
                            },
                        },
                    },
                });
                console.log(`Updated ${key} CPU request to ${newCpuRequest}m, memory to ${newMemoryRequest}Gi`);
            }
        }
    } catch (error) {
        console.error(`Failed to right-size ${deployName} in ${namespace}: ${error.message}`);
    }
}

// Main execution: iterate over all deployments and right-size
getPodUsageMetrics().then(async (metrics) => {
    const appsV1 = new k8s.apps.v1.Deployment("deployment-client", { provider: k8sProvider });
    const deployments = await appsV1.list();
    for (const deploy of deployments.items) {
        await rightSizeDeployment(deploy.metadata!.name!, deploy.metadata!.namespace!, metrics);
    }
});

// Export right-sizing metrics
export const dryRunEnabled = dryRun;
export const estimatedMonthlySavings = pulumi.interpolate`${metrics?.size || 0 * 0.02 * 730} USD (approx, per pod)`;

// CrossGuard Policy: Reject OpenShift pods with no resource requests
import { PolicyPack, validateResource } from "@pulumi/policy";

new PolicyPack("openshift-cost-policies", {
    policies: [{
        name: "no-unrequested-pods",
        description: "Reject OpenShift pods that do not specify CPU/memory requests",
        enforcementLevel: "mandatory",
        validateResource: (resource, reportViolation) => {
            if (resource.type === "kubernetes:apps/v1:Deployment") {
                const containers = resource.properties.spec?.template?.spec?.containers || [];
                for (const container of containers) {
                    if (!container.resources?.requests?.cpu || !container.resources?.requests?.memory) {
                        reportViolation(`Deployment ${resource.name} has container ${container.name} with no resource requests. This leads to overprovisioning.`);
                    }
                }
            }
        },
    }],
});

// Export cost-relevant tags for OpenShift Cost Management
const costTags = {
    "cost.openshift.io/cost-center": "infra-2024",
    "cost.openshift.io/environment": "production",
    "cost.openshift.io/team": "platform-engineering",
    "cost.openshift.io/spot-instances": useSpotInstances.toString(),
};

// Apply tags to all resources
new aws.ec2.Vpc("openshift-vpc", {
    // ... other config
    tags: { ...costTags, Name: `${clusterName}-vpc` },
}, { provider: awsProvider });

// Cost-optimized control plane configuration in Pulumi
masterNodeConfig: {
    instanceType: "m6g.large", // ARM Graviton, 35% cheaper than x86 m5d.large
    nodeCount: 3,
    volumeSize: 100, // GP3, sufficient for control plane logs/etcd
    volumeType: "gp3",
},