# Kyku Quick Reference

## Resource Types
Vpc — Virtual network with CIDR, region, auto-subnets
Subnet — Synthetic subnet (auto-injected by planner)
Vm — Virtual machine / compute instance
SecurityGroup — Firewall rules with ingress/egress
LoadBalancer — Application or network load balancer
TargetGroup — LB target group with health checks
Database — Managed relational database (RDS, Cloud SQL)
Identity — IAM user / service account
Role — IAM role with policies
SshKey — SSH public key resource
Bucket — Object storage (S3, GCS, Spaces)
DnsZone — DNS zone
DnsRecord — DNS record
Secret — Managed secret
Certificate — TLS/SSL certificate
KmsKey — Encryption key
Volume — Block storage volume
AutoScalingGroup — Auto-scaling group
Queue — Message queue
Cache — Managed cache (Redis/Memcached)
KubernetesCluster — Managed Kubernetes cluster
K8sNamespace — Kubernetes namespace
K8sConfigMap — ConfigMap resource
K8sSecret — Secret resource
K8sDeployment — Deployment
K8sStatefulSet — StatefulSet
K8sPersistentVolumeClaim — Persistent volume claim
Custom — Provider-provisioned resource

## CLI Commands
| Command | Description |
|---------|-------------|
| kyku plan | Preview changes (diff against state) |
| kyku apply | Execute planned changes |
| kyku destroy | Tear down all tracked resources |
| kyku init | Scaffold a new project |
| kyku import <type> <id> | Import existing cloud resource |
| kyku graph | Visualize resource dependency graph |
| kyku output | Show resolved resource outputs |
| kyku state | Manage state file (pull, push, rm) |
| kyku rollback | Restore newest local state backup (no cloud calls) |

## Provider Credentials
| Provider | Env Var | Notes |
|----------|---------|-------|
| AWS | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION | OIDC supported in CI/CD |
| GCP | GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_CLOUD_PROJECT | ADC or service account key |
| Hetzner | HCLOUD_TOKEN | API token |
| DigitalOcean | DIGITALOCEAN_TOKEN | Personal access token |

## Abstract Type Mapping
| Abstract | AWS | GCP | Hetzner | DigitalOcean |
|----------|-----|-----|---------|-------------|
| small | t3.small | e2-small | cpx11 | s-1vcpu-2gb |
| medium | t3.medium | e2-medium | cpx21 | s-2vcpu-2gb |
| large | t3.large | e2-standard-2 | cpx31 | s-2vcpu-4gb |
| ubuntu-22.04 | varies by region | ubuntu-os-cloud/ubuntu-2204-lts | ubuntu-22.04 | ubuntu-22-04-x64 |
| ubuntu-24.04 | varies by region | ubuntu-os-cloud/ubuntu-2404-lts | ubuntu-24.04 | ubuntu-24-04-x64 |
| us-east | us-east-1 | us-east1 | us-east | nyc1 |
| eu-central | eu-central-1 | europe-west1 | eu-central | fra1 |

## State
- Encrypted with AES-256-GCM + PBKDF2
- Safe to commit to version control
- File-based lock at .kyku.lock (auto-released on success/error)
- Stale lock detection (>5 min) auto-breaks