Cloud-Native Config: Helm, Terraform, IAM & WireGuard

Shipping to Kubernetes and AWS means getting five configs right at once: values files, infrastructure graphs, IAM policies, VPN tunnels, and observability pipelines. These five tools generate each one from its source: Helm Values Diff & Merge, Terraform DAG Diagrammer, AWS IAM Least Privilege, WireGuard Config Generator, and OpenTelemetry Collector Builder.

Merge Helm values without surprises

The merger parses both files with parseValues (empty input becomes {}), then runs deepMerge with strategic-merge semantics: a null in the override deletes the key from the base instead of setting it to null, maps merge recursively, and everything else is replaced. diffValues flattens both sides to dotted paths (replicaCount, image.tag) and classifies each path as added, changed, or deleted, carrying the base, override, and merged value per row. mergeHelmValues returns the merged object plus sorted mergedYaml via yaml.dump, and on bad YAML it reports the message with a 1-based line number from the parser mark.

# base
replicaCount: 2
legacyFlag: true
# override — null deletes the key
legacyFlag: null
replicaCount: 3
# merged: { replicaCount: 3 }, diff: legacyFlag deleted, replicaCount changed

Preview the diff before you helm upgrade and deleted keys stop looking like mysterious no-ops.

From HCL references to a Mermaid DAG

The diagrammer's buildTerraformDag first runs maskHcl, which blanks comments and quoted strings while preserving newlines, so aws_instance.web inside a string literal never becomes a phantom edge. findBlocks then matches resource and data headers with brace-depth tracking, producing canonical addresses like aws_instance.web and data.aws_ami.ubuntu. Each block body is scanned with addressPattern (resource refs) and variablePattern (var.*, local.*, module.*); only references resolving to a known block become DAG edges. A depth-first visit pass detects cycles and reports them plus cyclicResources, and the output renders as copy-pasteable Mermaid:

flowchart TD
  tf_aws_instance_web[aws_instance.web]
  tf_aws_security_group_web[aws_security_group.web]
  tf_aws_instance_web --> tf_aws_security_group_web

Paste it into any Mermaid renderer and review ordering, fan-in, and accidental cycles before terraform apply.

Least privilege, private tunnels, and pipelines

The IAM builder draws from AWS_IAM_CATALOG — eight services (S3, DynamoDB, SQS, SNS, Lambda, CloudWatch Logs, EC2, STS) with curated actions and ARN templates. buildAwsIamPolicy intersects your selections against the catalog, sorts actions, substitutes your concrete ARNs (falling back to resource templates), and emits a Version: 2012-10-17 statement with Effect, Action, Resource, and sorted Condition blocks. validateAwsIamPolicy then checks the version string, Effect of Allow/Deny, and the presence of Action and Resource.

WireGuard configs follow the same generate-then-validate loop. generateWireGuardConfig emits [Interface] (PrivateKey, Address, optional DNS, MTU, ListenPort) followed by one [Peer] block per peer (PublicKey, PresharedKey, AllowedIPs, Endpoint, PersistentKeepalive). validateWireGuardConfig enforces 44-character base64 keys decoding to 32 bytes (isValidWireGuardKey), CIDR syntax for addresses and AllowedIPs (isValidCIDR, IPv4 and IPv6), and a 0–65535 keepalive range. generateWireGuardKeyPair mints fresh X25519 keys via WebCrypto when available.

Finally, buildOpenTelemetryCollectorConfig assembles deterministic collector YAML: otlp/grpc on 4317 and otlp/http on 4318 receivers (plus optional hostmetrics scrapers), batch, memory_limiter, and resource processors, and otlp, debug, and prometheus exporters — wired into per-signal traces, metrics, and logs service pipelines. Dangling pipeline references surface as warnings, empty pipelines as errors, and a Kubernetes note reminds you when k8sattributes enrichment is missing.

Try Them

• Helm Values Diff & Merge — merge values with null-deletes semantics and a path-level diff.
• Terraform DAG Diagrammer — turn HCL references into a Mermaid graph with cycle detection.
• AWS IAM Least Privilege — generate minimal policy JSON with Action, Resource, and Condition.
• WireGuard Config Generator — build client/server conf with X25519 keys and AllowedIPs.
• OpenTelemetry Collector Builder — compose receivers, processors, and exporters into pipelines YAML.