addon_configurator

Instructions

Implementation Reference

• src/tools/platform-one/addon-configurator.ts:44-96 (handler)

  The main handler function that executes the tool logic. Calls runTool() which validates input via Zod schema, then invokes Anthropic Claude to generate production-ready Big Bang addon configuration values for any Platform One addon. Returns the text content from Claude's response.

  export async function handleAddonConfigurator(args: unknown): Promise<string> {
    return runTool('addon_configurator', args, Schema, async ({ addon, targetLevel, clusterSize, existingValues }) => {
      const response = await anthropic.messages.create({
        model: MODEL,
        max_tokens: getTokenBudget('addon_configurator'),
        system: PLATFORM_ONE_SYSTEM,
        messages: [
          {
            role: 'user',
            content: `Generate production-ready Big Bang addon configuration for **${addon}** at **${targetLevel}** on a **${clusterSize}** cluster.
  ${existingValues ? `\n**Existing Values to Extend:**\n\`\`\`yaml\n${existingValues}\n\`\`\`` : ''}
  
  Provide:
  1. **Complete Addon values.yaml block** — ready to paste into Big Bang values.yaml:
     - Iron Bank image from registry1.dso.mil with SHA256 digest pin
     - Resource requests and limits sized for ${clusterSize} cluster
     - Non-root security context
     - Read-only root filesystem where supported
     - Network policy configuration
     - Istio PeerAuthentication (STRICT mTLS)
     - Persistence configuration (size, storageClass)
  
  2. **${targetLevel.toUpperCase()} Required Configurations** — what MUST be set for compliance:
     - STIG controls that drive specific settings
     - Authentication integration (CAC/PIV/Keycloak)
     - Audit logging configuration
     - Encryption settings
  
  3. **Required Secrets** — Kubernetes secrets to create before deploying ${addon}:
     \`\`\`bash
     kubectl create secret ...
     \`\`\`
  
  4. **Resource Requirements** — node requirements, storage classes, PVC sizes
  
  5. **Integration Configuration** — how to wire ${addon} into:
     - Keycloak SSO (if applicable)
     - Monitoring/alerting (ServiceMonitor, PrometheusRule)
     - Logging (Fluentbit/Loki integration)
     - Vault for secrets (if applicable)
  
  6. **Post-Deploy Verification** — commands to confirm ${addon} is healthy and ${targetLevel}-compliant
  
  7. **Common Issues** — top 5 problems people hit deploying ${addon} in Big Bang and their fixes
  
  Use exact Iron Bank image paths and realistic resource values for a ${clusterSize} cluster.`,
          },
        ],
      });
  
      return response.content[0].type === 'text' ? response.content[0].text : '';
    });
  }

• src/tools/platform-one/addon-configurator.ts:37-42 (schema)

  Zod validation schema for the tool inputs: addon (string), targetLevel (il2/il4/il5), clusterSize (small/medium/large, defaults to medium), and optional existingValues (string max 20000 chars).

  const Schema = z.object({
    addon: z.string().min(1).max(500),
    targetLevel: z.enum(['il2', 'il4', 'il5']),
    clusterSize: z.enum(['small', 'medium', 'large']).default('medium'),
    existingValues: z.string().max(20000).optional(),
  });

• src/tools/platform-one/addon-configurator.ts:6-35 (schema)

  Tool definition object with name 'addon_configurator', description, and JSON Schema input schema (type, properties, required fields). Exported as addonConfiguratorTool.

  export const addonConfiguratorTool = {
    name: 'addon_configurator',
    description:
      'Generate production-ready Big Bang addon configuration values for any Platform One addon. Returns hardened values with Iron Bank images, resource limits, and IL-appropriate security settings.',
    inputSchema: {
      type: 'object' as const,
      properties: {
        addon: {
          type: 'string',
          description:
            'Big Bang addon name e.g. "monitoring", "logging", "vault", "keycloak", "gitlab", "sonarqube", "twistlock", "mattermost"',
        },
        targetLevel: {
          type: 'string',
          enum: ['il2', 'il4', 'il5'],
          description: 'DoD IL target level',
        },
        clusterSize: {
          type: 'string',
          enum: ['small', 'medium', 'large'],
          description: 'Cluster size for resource sizing (default: medium)',
        },
        existingValues: {
          type: 'string',
          description: 'Existing addon values to extend or override (optional)',
        },
      },
      required: ['addon', 'targetLevel'],
    },
  };

• src/tools/index.ts:18-58 (registration)

  Import of the tool definition and handler from the addon-configurator module.

  import { addonConfiguratorTool, handleAddonConfigurator } from './platform-one/addon-configurator.js';
  
  import { pipelineAuditTool, handlePipelineAudit } from './pipeline/pipeline-audit.js';
  import { signingConfigTool, handleSigningConfig } from './pipeline/signing-config.js';
  import { devsecopsScoreCardTool, handleDevsecopsScorecard } from './pipeline/devsecops-scorecard.js';
  
  import { sspSectionTool, handleSspSection } from './documents/ssp-section.js';
  import { contingencyPlanTool, handleContingencyPlan } from './documents/contingency-plan.js';
  
  import { govcloudQuickstartTool, handleGovcloudQuickstart } from './govcloud-quickstart.js';
  
  export const allTools = [
    // Compliance
    bicepAnalyzeTool,
    bicepRemediateTool,
    controlLookupTool,
    controlNarrativeTool,
    poamGenerateTool,
    atoReadinessTool,
    oscalFragmentTool,
    // Architecture
    landingZoneTool,
    landingZoneReferenceTool,
    serviceSelectTool,
    gccHighTool,
    privateEndpointTool,
    // Platform One
    bigbangValidateTool,
    bigbangHardenTool,
    ironbankLookupTool,
    addonConfiguratorTool,
    // Pipeline
    pipelineAuditTool,
    signingConfigTool,
    devsecopsScoreCardTool,
    // Documents
    sspSectionTool,
    contingencyPlanTool,
    // Meta
    govcloudQuickstartTool,
  ];

• src/tools/index.ts:48-77 (registration)

  Registration of addonConfiguratorTool in the allTools array (line 48) and routing of 'addon_configurator' case in handleToolCall switch statement (line 77) to handleAddonConfigurator.

    addonConfiguratorTool,
    // Pipeline
    pipelineAuditTool,
    signingConfigTool,
    devsecopsScoreCardTool,
    // Documents
    sspSectionTool,
    contingencyPlanTool,
    // Meta
    govcloudQuickstartTool,
  ];
  
  export async function handleToolCall(name: string, args: unknown): Promise<string> {
    switch (name) {
      case 'bicep_analyze':         return handleBicepAnalyze(args);
      case 'bicep_remediate':       return handleBicepRemediate(args);
      case 'control_lookup':        return handleControlLookup(args);
      case 'control_narrative':     return handleControlNarrative(args);
      case 'poam_generate':         return handlePoamGenerate(args);
      case 'ato_readiness':         return handleAtoReadiness(args);
      case 'oscal_fragment':        return handleOscalFragment(args);
      case 'landing_zone_design':   return handleLandingZone(args);
      case 'landing_zone_reference': return handleLandingZoneReference(args);
      case 'azure_service_selector': return handleServiceSelect(args);
      case 'gcc_high_guidance':     return handleGccHigh(args);
      case 'private_endpoint_map':  return handlePrivateEndpoint(args);
      case 'bigbang_validate':      return handleBigbangValidate(args);
      case 'bigbang_harden':        return handleBigbangHarden(args);
      case 'ironbank_lookup':       return handleIronbankLookup(args);
      case 'addon_configurator':    return handleAddonConfigurator(args);