# Kyku Docs

> Universal infrastructure provisioning tool. Write TypeScript once, deploy anywhere — AWS, GCP, Hetzner, or DigitalOcean. Kyku uses abstract instance types, images, and regions so your config works across providers without modification. Resources are defined as TypeScript classes with auto-inferred dependencies, encrypted state, and a plan/apply lifecycle.

## Getting Started

Guides to get up and running with Kyku: install, quickstart, and first config.

- [Overview](https://kyku.cloud/getting-started/overview/): What is Kyku and why use it
- [Install](https://kyku.cloud/getting-started/install/): Install Kyku and its dependencies
- [Quickstart](https://kyku.cloud/getting-started/quickstart/): Deploy your first resource in 5 minutes
- [First Config](https://kyku.cloud/getting-started/first-config/): Writing your first Kyku configuration file

## Concepts

Core concepts: resource model, abstract types, dependency graph, plan/apply lifecycle.

- [Resources](https://kyku.cloud/concepts/resources/): How Kyku resources work
- [Abstract Types](https://kyku.cloud/concepts/abstract-types/): Instance types, images, and regions mapped per provider
- [Custom Config](https://kyku.cloud/concepts/custom-config/): Provider-native passthrough for fields Kyku's portable resources don't model directly
- [Dependency Graph](https://kyku.cloud/concepts/dependency-graph/): How Kyku resolves resource ordering
- [Deploy Prefix](https://kyku.cloud/concepts/deploy-prefix/): How Kyku prevents resource name collisions
- [Environments](https://kyku.cloud/concepts/environments/): Managing multiple deployment environments
- [Outputs](https://kyku.cloud/concepts/outputs/): Using resource outputs for cross-resource references
- [Remote State](https://kyku.cloud/concepts/remote-state/): Store Kyku state in S3, GCS, DigitalOcean Spaces, or HTTP
- [State & Encryption](https://kyku.cloud/concepts/state-encryption/): How Kyku manages state and encrypts secrets

## Config

Infrastructure configuration file reference: resource syntax, providers, tags, and multi-provider setup.

- [Config File](https://kyku.cloud/config/index/): Infrastructure configuration reference
- [TypeScript modules](https://kyku.cloud/config/modules/): Compose BaseResource graphs with plain TypeScript factories

## Resources

Detailed reference for each resource type: Vpc, Vm, SecurityGroup, LoadBalancer, Database, and more.

- [Vpc](https://kyku.cloud/resources/vpc/): Virtual Private Cloud — isolated network environment
- [Vm](https://kyku.cloud/resources/vm/): Virtual machine / Cloud server / Droplet / Compute instance
- [Subnet](https://kyku.cloud/resources/subnet/): Synthetic subnet resource auto-injected by the planner
- [AutoScalingGroup](https://kyku.cloud/resources/auto-scaling-group/): Auto-scaling group of VM instances
- [Bucket](https://kyku.cloud/resources/bucket/): Object storage — S3 / Cloud Storage / Spaces
- [Cache](https://kyku.cloud/resources/cache/): In-memory cache — Redis / Memcached
- [Cdn](https://kyku.cloud/resources/cdn/): Content delivery network — CloudFront / Cloud CDN
- [Certificate](https://kyku.cloud/resources/certificate/): SSL/TLS certificate for HTTPS and TLS termination
- [ContainerRegistry](https://kyku.cloud/resources/container-registry/): Managed container image registry — ECR / Artifact Registry / DO Registry
- [CustomResource](https://kyku.cloud/resources/custom/): User-defined resource with custom lifecycle handlers
- [Database](https://kyku.cloud/resources/database/): Managed relational database — PostgreSQL, MySQL, MariaDB
- [DnsRecord](https://kyku.cloud/resources/dns-record/): Individual DNS record within a zone
- [DnsZone](https://kyku.cloud/resources/dns-zone/): DNS zone for domain name management
- [Identity](https://kyku.cloud/resources/identity/): IAM User / Service Account for programmatic access
- [Resources](https://kyku.cloud/resources/index/): Catalog of all Kyku resource types
- [K8sConfigMap](https://kyku.cloud/resources/k8s-config-map/): Non-confidential key-value configuration data for Kubernetes workloads
- [K8sDeployment](https://kyku.cloud/resources/k8s-deployment/): Stateless workload with replica management and rolling updates
- [K8sHelmRelease](https://kyku.cloud/resources/k8s-helm-release/): Deploy Helm charts via Kyku
- [Kubernetes Resources](https://kyku.cloud/resources/k8s-index/): Overview of Kubernetes resource management within Kyku
- [K8sIngress](https://kyku.cloud/resources/k8s-ingress/): HTTP and HTTPS routing to Kubernetes services
- [K8sManifest](https://kyku.cloud/resources/k8s-manifest/): Deploy raw Kubernetes manifests via Kyku
- [K8sNamespace](https://kyku.cloud/resources/k8s-namespace/): Isolated environment within a Kubernetes cluster
- [K8sPersistentVolumeClaim](https://kyku.cloud/resources/k8s-persistent-volume-claim/): Persistent storage request for Kubernetes workloads
- [K8sSecret](https://kyku.cloud/resources/k8s-secret/): Sensitive data managed as a Kubernetes Secret
- [K8sService](https://kyku.cloud/resources/k8s-service/): Network endpoint exposing pods within or outside the cluster
- [K8sStatefulSet](https://kyku.cloud/resources/k8s-stateful-set/): Stateful workload with stable network identity and persistent storage
- [KmsKey](https://kyku.cloud/resources/kms-key/): Encryption key for data at rest
- [KubernetesCluster](https://kyku.cloud/resources/kubernetes-cluster/): Managed Kubernetes cluster — EKS / GKE / DOKS
- [LoadBalancer](https://kyku.cloud/resources/load-balancer/): Application or Network load balancer with health checks
- [Queue](https://kyku.cloud/resources/queue/): Message queue — SQS / PubSub
- [Role](https://kyku.cloud/resources/role/): IAM Role / Custom Role with permission definitions
- [Secret](https://kyku.cloud/resources/secret/): Secrets management — API keys, passwords, tokens
- [SecurityGroup](https://kyku.cloud/resources/security-group/): Network firewall rules — ingress and egress filtering
- [SshKey](https://kyku.cloud/resources/ssh-key/): SSH public key for VM access
- [StaticIp](https://kyku.cloud/resources/static-ip/): Reserved public IP — Elastic IP / Address / Floating IP
- [TargetGroup](https://kyku.cloud/resources/target-group/): Logical target group connecting a Vm to a LoadBalancer via label selectors
- [Volume](https://kyku.cloud/resources/volume/): Block storage volume — EBS / Persistent Disk

## Providers

Provider-specific guides for AWS, GCP, Hetzner, and DigitalOcean.

- [AWS](https://kyku.cloud/providers/aws/): AWS provider configuration and usage
- [DigitalOcean](https://kyku.cloud/providers/digitalocean/): DigitalOcean provider configuration and usage
- [GCP](https://kyku.cloud/providers/gcp/): GCP provider configuration and usage
- [Hetzner](https://kyku.cloud/providers/hetzner/): Hetzner provider configuration and usage
- [Provider Overview](https://kyku.cloud/providers/index/): Parity matrix and credential summary for all supported providers
- [Kubernetes](https://kyku.cloud/providers/kubernetes/): Kubernetes provider for managing cluster-native resources

## CLI Reference

CLI command reference for plan, apply, destroy, import, and more.

- [apply](https://kyku.cloud/cli/apply/): Apply infrastructure changes
- [completion](https://kyku.cloud/cli/completion/): Print bash, zsh, or fish completion scripts
- [destroy](https://kyku.cloud/cli/destroy/): Destroy resources tracked in state
- [doctor](https://kyku.cloud/cli/doctor/): Read-only checks for Bun, credentials, state, and the lock file
- [Global Flags](https://kyku.cloud/cli/global-flags/): Global CLI flags and exit codes
- [graph](https://kyku.cloud/cli/graph/): Show dependency graph of resources
- [import](https://kyku.cloud/cli/import/): Import an existing cloud resource into Kyku state
- [init](https://kyku.cloud/cli/init/): Scaffold a new Kyku project
- [output](https://kyku.cloud/cli/output/): Show resource outputs
- [plan](https://kyku.cloud/cli/plan/): Preview changes without applying
- [refresh](https://kyku.cloud/cli/refresh/): Update state from cloud drift without applying
- [rollback](https://kyku.cloud/cli/rollback/): Restore state from the newest local backup
- [schema](https://kyku.cloud/cli/schema/): Show customConfig schema metadata for a resource type on a provider
- [state](https://kyku.cloud/cli/state/): Manage state file resources
- [taint / untaint](https://kyku.cloud/cli/taint/): Mark a state resource for forced replacement on the next plan
- [test](https://kyku.cloud/cli/test/): Run TypeScript policy assertions against the generated plan
- [validate](https://kyku.cloud/cli/validate/): Validate config without cloud calls

## Guides

Advanced guides: CI/CD, multi-provider, secrets management, migration from Terraform.

- [CI/CD with OIDC](https://kyku.cloud/guides/ci-cd/): Use OIDC to deploy Kyku without long-lived cloud credentials
- [Deploy a Web App](https://kyku.cloud/guides/deploy-web-app/): Deploy a full web app with VPC, VM, SecurityGroup, and LoadBalancer
- [Environments](https://kyku.cloud/guides/environments/): Manage dev, staging, and prod environments with Kyku
- [Import Resources](https://kyku.cloud/guides/import-resources/): Adopt existing cloud resources into Kyku management
- [HAR record and replay](https://kyku.cloud/guides/record-replay/): Record provider HTTP once, sanitize tokens, and replay in CI without cloud credentials
- [State Encryption](https://kyku.cloud/guides/state-encryption/): Deep dive on AES-256-GCM state encryption with PBKDF2 key derivation

## Internals

Architecture documentation: engine, planner, diff engine, crypto, state management.

- [ADR-001 Policy tests](https://kyku.cloud/internals/adr-001-policy-tests/): Typed TypeScript policy API for kyku test, not Gherkin reuse
- [Auth Modules](https://kyku.cloud/internals/auth/): Authentication modules for cloud provider credentials and OIDC token exchange
- [Encryption Architecture](https://kyku.cloud/internals/crypto/): AES-256-GCM with PBKDF2 key derivation via Web Crypto API
- [Architecture Decision Log](https://kyku.cloud/internals/decisions/): Record of architectural decisions made during Kyku development
- [Dependency Graph](https://kyku.cloud/internals/dependency-graph/): GraphBuilder, edge detection, level assignment, and cycle detection
- [Diff Engine](https://kyku.cloud/internals/diff-engine/): How DiffEngine compares desired vs actual state to detect changes
- [Engine](https://kyku.cloud/internals/engine/): How KykuEngine manages the plan/apply/destroy lifecycle
- [Planner](https://kyku.cloud/internals/planner/): How Planner.generatePlan() translates diffs into an ordered execution plan

## AI Agents

Configuration for AI coding agents (Claude Code, Cursor, etc.) to work with Kyku.

- [Contributor Context](https://kyku.cloud/agents/contributor-context/): AGENTS.md conventions for provider development and contributor guidance
- [AI Agents Overview](https://kyku.cloud/agents/index/): Using Kyku with AI coding agents
- [llms.txt](https://kyku.cloud/agents/llms-txt/): The llms.txt standard and what Kyku exposes for AI context
- [Docs MCP Server](https://kyku.cloud/agents/mcp-server/): MCP server for runtime agent queries about Kyku documentation