Add Vultr cloud module set (live-validated) (#354)

* Add Vultr cloud module set (mirror of Linode)

Mirrors the Linode redesign module set one-for-one for Vultr, using the
official vultr/vultr provider (v2.31.2). All modules pass terraform validate
and raptor create iac-module --dry-run; uploaded + published to the demo CP
and wired into a vultr-demo sample blueprint (account -> vpc -> vke ->
node pool + object storage + managed postgres).

Modules:
- cloud_account/vultr_provider  -> @facets/vultr_cloud_account (exposes vultr provider, API key from secret store)
- network/vultr_vpc             -> @facets/vultr-vpc-details (legacy vultr_vpc; VKE is NOT compatible with VPC 2.0)
- kubernetes_cluster/vke        -> @facets/vke + @facets/kubernetes-details (client-cert auth; exposes kubernetes + helm)
- kubernetes_node_pool/vke      -> @facets/kubernetes_nodepool
- object_storage/vultr          -> @facets/vultr-object-storage (S3 subscription, not a bucket)
- datastore/postgres/vultr      -> @facets/postgres (Vultr Managed Database)

Also: vultr project type, ONBOARDING guide, README Vultr section, and a
cloud-neutral object_storage icon (was missing for the object_storage intent).

Vultr-specific deviations from the Linode template (provider-driven):
- VKE requires the original VPC (vultr_vpc), not the deprecated VPC 2.0
- VKE auth is client certificate/key, not a bearer token
- Vultr object storage is a subscription (S3 endpoint + keys), no ACL/versioning
- DB plan is a single slug; k8s version is a volatile full string (v1.35.0+1)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Fix Vultr object storage cluster selection: select by hostname

The vultr_object_storage_cluster data source errored with 'too many results'
during live deploy because Vultr now exposes multiple object storage clusters
per region (e.g. ewr -> ewr1, ewr2). The singular data source rejects a filter
that matches >1 cluster, and the provider offers no list-and-pick variant.

Select the cluster by its unique hostname instead of the ambiguous region.
Spec: region -> cluster_hostname (default ewr1.vultrobjects.com). Fix tier docs
(1=Legacy, 2=Standard) and default tier_id to 2 (Standard, validated for ewr1).

Live-validated: object storage subscription created active on ewr1.vultrobjects.com.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: anshulsao

README.md

@@ -152,6 +152,55 @@ raptor import project-type --managed facets/azure --name "My Platform"
 
 ---
 
+### Vultr — Preview
+
+VKE (Vultr Kubernetes Engine) clusters with node pools, Vultr VPC networking, S3-compatible object storage, managed PostgreSQL, and a cloud-agnostic Kubernetes service — plus the shared K8s platform and KubeBlocks datastores.
+
+**First, create a Vultr API key** at https://my.vultr.com/settings/#settingsapi and add your control plane egress IP to the API access-control allow-list. Full walkthrough: [`project-type/vultr/ONBOARDING.md`](project-type/vultr/ONBOARDING.md).
+
+**Prompt for Praxis:**
+
+```
+Import the Vultr project type for me from the facets-modules-redesign repo
+(project-type/vultr/project-type.yml) along with its output types.
+```
+
+**Raptor CLI:** (imports the project type + modules + outputs; no base template — projects start empty)
+
+```bash
+raptor import project-type -f ./project-type/vultr/project-type.yml \
+  --modules-dir ./modules --outputs-dir ./outputs
+```
+
+With custom name:
+
+```bash
+raptor import project-type -f ./project-type/vultr/project-type.yml \
+  --modules-dir ./modules --outputs-dir ./outputs --name "Vultr Platform"
+```
+
+<details>
+<summary><strong>What's included</strong></summary>
+
+**Infrastructure**
+`Cloud Account (vultr_provider)` `Network/VPC (vultr_vpc)` `VKE Cluster (vke)` `Node Pool (vke)` `Object Storage (vultr)` `Service (k8s)`
+
+**Managed Datastores**
+`PostgreSQL (vultr)`
+
+**Self-hosted via KubeBlocks**
+`PostgreSQL` `MySQL` `MongoDB` `Redis`
+
+**K8s Platform**
+`Helm` `Ingress/NGINX` `cert-manager` `ConfigMap` `Secrets` `PVC` `Access Controls` `Callbacks` `K8s Resources` `Gateway API CRD` `Artifactories`
+
+**Operators & Monitoring**
+`KubeBlocks` `ECK` `Prometheus` `Grafana` `Alert Rules` `Monitoring`
+
+</details>
+
+---
+
 ### Linode (Akamai) — Preview
 
 LKE (Linode Kubernetes Engine) clusters with node pools, Linode VPC networking, S3-compatible object storage, managed PostgreSQL, and a cloud-agnostic Kubernetes service — plus the shared K8s platform and KubeBlocks datastores.

icons/object_storage.svg

@@ -0,0 +1,31 @@
+# Vultr Provider Configuration
+
+Configures the Vultr Terraform provider with API key authentication for use by other Vultr modules.
+
+## Overview
+
+This module establishes the foundational Vultr provider configuration using a Vultr API key. It serves as the base provider configuration that other Vultr infrastructure modules (VPC, VKE, Object Storage, Managed Database) consume to access Vultr APIs and provision resources. It produces the `@facets/vultr_cloud_account` output type.
+
+## Environment as Dimension
+
+**Environment-specific provider configuration**: The API key is a secret reference and the default region is an override-only field, allowing different Vultr credentials and regions per environment.
+
+## Resources Created
+
+- **Vultr Provider Configuration**: Establishes an authenticated connection to the Vultr API
+- **Provider Output Interface**: Exposes the configured provider and default region for consumption by other modules
+
+## Security Considerations
+
+- The API key is supplied via a secret reference and is never stored in plain text within the module configuration
+- The key is declared in the `secrets` output attribute so the platform treats it as sensitive
+- Provider configuration is scoped per environment for security isolation
+
+## Required Configuration
+
+- **Vultr API Key**: A Vultr API key with access to the resources you intend to manage (secret reference)
+- **Vultr Region**: The default region for downstream resources, e.g. `ewr`, `lax`, `ord`, `fra`, `sgp` (override-only)
+
+## Usage Notes
+
+This module does not create any actual Vultr resources — it only configures the provider authentication. Other Vultr modules should consume this module's `@facets/vultr_cloud_account` output to access Vultr services with proper authentication.

modules/cloud_account/vultr_provider/1.0/README.md

@@ -0,0 +1,54 @@
+intent: cloud_account
+flavor: vultr_provider
+version: "1.0"
+description: Module to configure and provision resources within a Vultr cloud account
+intentDetails:
+  type: Cloud & Infrastructure
+  description: Configure and provision resources within a Vultr cloud account
+  displayName: Cloud Account
+  iconUrl: https://raw.githubusercontent.com/Facets-cloud/facets-modules-redesign/main/icons/cloud_account.svg
+clouds:
+  - kubernetes
+spec:
+  title: Vultr Provider Configuration
+  description: Configure Vultr API access credentials and the default region
+  type: object
+  properties:
+    api_key:
+      type: string
+      title: Vultr API Key
+      description: Vultr API key with access to the resources you intend to manage
+      x-ui-secret-ref: true
+    region:
+      type: string
+      title: Vultr Region
+      description: Default Vultr region for downstream resources (e.g. ewr, lax, ord, fra, sgp)
+      x-ui-placeholder: ewr
+      x-ui-overrides-only: true
+  required:
+    - api_key
+    - region
+  x-ui-order:
+    - api_key
+    - region
+outputs:
+  default:
+    type: "@facets/vultr_cloud_account"
+    providers:
+      vultr:
+        source: vultr/vultr
+        version: 2.31.2
+        attributes:
+          api_key: attributes.api_key
+sample:
+  kind: cloud_account
+  flavor: vultr_provider
+  version: "1.0"
+  disabled: true
+  spec:
+    api_key: ""
+    region: ewr
+iac:
+  validated_files:
+    - main.tf
+    - variables.tf

modules/cloud_account/vultr_provider/1.0/facets.yaml

@@ -0,0 +1,4 @@
+# Vultr Provider Configuration Module
+# This module configures the Vultr provider credentials and exposes them for other modules.
+#
+# Note: output_attributes and output_interfaces locals are defined in outputs.tf

modules/cloud_account/vultr_provider/1.0/main.tf

@@ -0,0 +1,9 @@
+locals {
+  output_attributes = {
+    api_key = var.instance.spec.api_key
+    region  = var.instance.spec.region
+    secrets = "[\"api_key\"]"
+  }
+  output_interfaces = {
+  }
+}

modules/cloud_account/vultr_provider/1.0/outputs.tf

@@ -0,0 +1,31 @@
+variable "instance" {
+  description = "Configures the Vultr Terraform provider with API key authentication"
+  type = object({
+    kind    = string
+    flavor  = string
+    version = string
+    spec = object({
+      api_key = string
+      region  = string
+    })
+  })
+}
+
+variable "instance_name" {
+  description = "The architectural name for the resource as added in the Facets blueprint designer."
+  type        = string
+}
+
+variable "environment" {
+  description = "An object containing details about the environment."
+  type = object({
+    name        = string
+    unique_name = string
+  })
+}
+
+variable "inputs" {
+  description = "A map of inputs requested by the module developer."
+  type = object({
+  })
+}

modules/cloud_account/vultr_provider/1.0/variables.tf

@@ -0,0 +1,30 @@
+# Vultr Managed PostgreSQL
+
+Creates a Vultr managed PostgreSQL database with SSL/TLS and trusted-IP allow-listing. Produces `@facets/postgres`.
+
+## Overview
+
+Provisions a Vultr Managed Database running the PostgreSQL engine. The module exposes `writer` and `reader` connection interfaces (both pointing at the primary host; Vultr handles read scaling via separate read replicas). The database is protected from accidental deletion with `prevent_destroy`.
+
+## Resources Created
+
+- **vultr_database**: A managed PostgreSQL cluster (`database_engine = "pg"`)
+
+## Required Configuration
+
+- **PostgreSQL Version**: one of `13`, `14`, `15`, `16`, `17`
+- **Database Plan** (`sizing.plan`): a Vultr managed-database plan slug encoding vCPU/RAM/disk and node count, e.g. `vultr-dbaas-hobbyist-cc-1-25-1` (list via `GET /v2/databases/plans`)
+- **Trusted IPs** (optional): CIDRs permitted to connect; empty denies all external access
+
+## Inputs
+
+- **Vultr Cloud Account** (`@facets/vultr_cloud_account`): provides the Vultr provider and region
+
+## Outputs
+
+- `@facets/postgres` (default): `writer` and `reader` interfaces with `host`, `port`, `username`, `password`, `connection_string`
+
+## Notes & Gotchas
+
+- **Trusted IPs**: the database is reachable only from CIDRs in `network_access.trusted_ips`. Add your VKE node egress CIDRs to allow the cluster to connect.
+- **SSL required**: connection strings include `sslmode=require`.

modules/datastore/postgres/vultr/1.0/README.md

@@ -0,0 +1,99 @@
+intent: postgres
+flavor: vultr
+version: "1.0"
+clouds:
+  - kubernetes
+description: Managed PostgreSQL database on Vultr with SSL/TLS and trusted-IP allow-listing
+intentDetails:
+  type: Datastores
+  description: Vultr managed PostgreSQL database service
+  displayName: PostgreSQL
+  iconUrl: https://raw.githubusercontent.com/Facets-cloud/facets-modules-redesign/main/icons/postgres.svg
+spec:
+  title: Vultr Managed PostgreSQL Database
+  description: Managed PostgreSQL database on Vultr
+  type: object
+  x-ui-order:
+    - version_config
+    - sizing
+    - network_access
+  properties:
+    version_config:
+      type: object
+      title: Version Configuration
+      x-ui-order:
+        - version
+      properties:
+        version:
+          type: string
+          title: PostgreSQL Version
+          description: PostgreSQL engine major version
+          enum:
+            - "13"
+            - "14"
+            - "15"
+            - "16"
+            - "17"
+          default: "16"
+      required:
+        - version
+    sizing:
+      type: object
+      title: Sizing & Performance
+      x-ui-order:
+        - plan
+      properties:
+        plan:
+          type: string
+          title: Database Plan
+          description: "Vultr managed database plan slug (encodes vCPU/RAM/disk and node count, e.g. vultr-dbaas-hobbyist-cc-1-25-1). List plans via the Vultr API (GET /v2/databases/plans)."
+          default: vultr-dbaas-hobbyist-cc-1-25-1
+          x-ui-placeholder: vultr-dbaas-hobbyist-cc-1-25-1
+      required:
+        - plan
+    network_access:
+      type: object
+      title: Network Access
+      properties:
+        trusted_ips:
+          type: array
+          title: Trusted IPs
+          description: List of CIDRs permitted to connect (empty denies all external access)
+          default: []
+          items:
+            type: string
+            pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$
+      required: []
+  required:
+    - version_config
+    - sizing
+inputs:
+  vultr_cloud_account:
+    type: "@facets/vultr_cloud_account"
+    optional: false
+    displayName: Vultr Cloud Account
+    description: Vultr provider configuration and default region
+    providers:
+      - vultr
+outputs:
+  default:
+    type: "@facets/postgres"
+    title: Vultr PostgreSQL Database
+sample:
+  kind: postgres
+  flavor: vultr
+  version: "1.0"
+  disabled: true
+  spec:
+    version_config:
+      version: "16"
+    sizing:
+      plan: vultr-dbaas-hobbyist-cc-1-25-1
+    network_access:
+      trusted_ips: []
+iac:
+  validated_files:
+    - main.tf
+    - variables.tf
+    - outputs.tf
+    - versions.tf

modules/datastore/postgres/vultr/1.0/facets.yaml

@@ -0,0 +1,27 @@
+# Vultr Managed PostgreSQL Module
+# Creates a Vultr managed PostgreSQL database.
+
+module "name" {
+  source        = "github.com/Facets-cloud/facets-utility-modules//name"
+  environment   = var.environment
+  limit         = 32
+  resource_name = var.instance_name
+  resource_type = "postgres"
+}
+
+locals {
+  region = var.inputs.vultr_cloud_account.attributes.region
+}
+
+resource "vultr_database" "db" {
+  label                   = module.name.name
+  database_engine         = "pg"
+  database_engine_version = var.instance.spec.version_config.version
+  region                  = local.region
+  plan                    = var.instance.spec.sizing.plan
+  trusted_ips             = var.instance.spec.network_access.trusted_ips
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}