CloudOps in action.

OpenTofu example

[user]
>> Create OpenTofu files for a GKE cluster in us-central1. Use a small regional cluster with a node pool. Validate the configuration, show me the plan, do not apply.

[thinking]
>> The user wants infrastructure generated and checked with the CloudOps image.

[shell]
>> Creating main.tf, variables.tf, outputs.tf, and versions.tf

[file] main.tf
resource "google_container_cluster" "primary" {
  name     = var.cluster_name
  location = var.region
  project  = var.project_id
  remove_default_node_pool = true
  ip_allocation_policy {}
}

resource "google_container_node_pool" "primary" {
  cluster      = google_container_cluster.primary.name
  node_count   = 1
  machine_type = "e2-medium"
}

[thinking]
>> I will use OpenTofu to format, initialize, validate, and plan the configuration.

[shell]
$ tofu fmt && tofu init -input=false && tofu validate && tofu plan -input=false -var='project_id=openj-airlock-demo'

Initializing the backend...
Initializing provider plugins...
- Installing hashicorp/google v6.50.0...
- Installed hashicorp/google v6.50.0

Success! The configuration is valid.

[result]
>> Configuration formatted, initialized, validated, and planned.

What the image includes

The 0.0.4 CloudOps image includes OpenTofu for infrastructure plans, Helm and kubectl for Kubernetes workflows, and kind for local cluster testing. Once credentials are supplied, the same image can continue from a verified plan to an explicitly approved apply.

tofu plan
helm template openj ./chart
kubectl get pods
kind create cluster

Use the Airlock image scripts to provide the project mount, credentials, network, and other boundaries for the real task.