@highstate/cilium 0.4.5

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+import { ResourceOptions, Resource } from '@highstate/pulumi';
+import { NetworkPolicy, NormalizedNetworkPolicyArgs } from '@highstate/k8s';
+
+declare class CiliumNetworkPolicy extends NetworkPolicy {
+    protected create(name: string, args: NormalizedNetworkPolicyArgs, opts?: ResourceOptions): Resource;
+    private static createIngressRules;
+    private static createEgressRules;
+    private static createRules;
+    private static createAllRules;
+    private static createCidrRules;
+    private static createFqdnRules;
+    private static createServiceRules;
+    private static createNamespaceExpressions;
+    private static createSelectorRules;
+    private static mapPorts;
+}
+
+export { CiliumNetworkPolicy };

package/dist/index.js

@@ -0,0 +1,168 @@
+import { output } from '@highstate/pulumi';
+import { NetworkPolicy, mapMetadata, mapServiceToLabelSelector, mapNamespaceLikeToNamespaceName, mapSelectorLikeToSelector } from '@highstate/k8s';
+import { cilium } from '@highstate/cilium-crds';
+import '@pulumi/kubernetes';
+import { mapKeys, pipe, map } from 'remeda';
+
+class CiliumNetworkPolicy extends NetworkPolicy {
+  create(name, args, opts) {
+    return new cilium.v2.CiliumNetworkPolicy(
+      name,
+      {
+        metadata: mapMetadata(args, name),
+        spec: {
+          description: args.description,
+          endpointSelector: args.podSelector,
+          ingress: CiliumNetworkPolicy.createIngressRules(args),
+          egress: CiliumNetworkPolicy.createEgressRules(args)
+        }
+      },
+      opts
+    );
+  }
+  static createIngressRules(args) {
+    return args.ingressRules.flatMap((rule) => CiliumNetworkPolicy.createRules("from", rule));
+  }
+  static createEgressRules(args) {
+    return args.egressRules.flatMap((rule) => CiliumNetworkPolicy.createRules("to", rule));
+  }
+  static createRules(prefix, rule) {
+    const port = CiliumNetworkPolicy.mapPorts(rule.ports);
+    const ports = port ? [port] : void 0;
+    return [
+      ...CiliumNetworkPolicy.createAllRules(prefix, rule, ports),
+      ...CiliumNetworkPolicy.createCidrRules(prefix, rule, ports),
+      ...CiliumNetworkPolicy.createServiceRules(prefix, rule, ports),
+      ...CiliumNetworkPolicy.createSelectorRules(prefix, rule, ports),
+      ...prefix === "to" ? CiliumNetworkPolicy.createFqdnRules(rule, ports) : []
+    ];
+  }
+  static createAllRules(prefix, rule, ports) {
+    if (!rule.all) {
+      return [];
+    }
+    return [
+      {
+        [`${prefix}Entities`]: ["all"],
+        toPorts: ports
+      }
+    ];
+  }
+  static createCidrRules(prefix, rule, ports) {
+    if (rule.cidrs.length === 0) {
+      return [];
+    }
+    return [
+      {
+        [`${prefix}CIDR`]: rule.cidrs,
+        toPorts: ports
+      }
+    ];
+  }
+  static createFqdnRules(rule, ports) {
+    if (rule.fqdns.length === 0) {
+      return [];
+    }
+    return [
+      {
+        toFQDNs: rule.fqdns.map((fqdn) => {
+          return fqdn.includes("*") ? { matchName: fqdn } : { matchPattern: fqdn };
+        }),
+        toPorts: ports
+      }
+    ];
+  }
+  static createServiceRules(prefix, rule, ports) {
+    if (rule.services.length === 0) {
+      return [];
+    }
+    const selectors = rule.services.map((service) => {
+      const selector = mapServiceToLabelSelector(service);
+      return output(selector).apply((selector2) => ({
+        matchLabels: {
+          ...mapKeys(selector2.matchLabels ?? {}, (key) => `k8s:${key}`),
+          "k8s:io.kubernetes.pod.namespace": service.metadata.namespace
+        }
+      }));
+    });
+    return [
+      {
+        [`${prefix}Endpoints`]: selectors,
+        toPorts: ports
+      }
+    ];
+  }
+  static createNamespaceExpressions(rule) {
+    if (rule.namespaces.length === 0) {
+      return [];
+    }
+    return pipe(
+      //
+      rule.namespaces,
+      map(mapNamespaceLikeToNamespaceName),
+      (names) => [
+        {
+          key: "k8s:io.kubernetes.pod.namespace",
+          operator: "In",
+          values: names
+        }
+      ]
+    );
+  }
+  static createSelectorRules(prefix, rule, ports) {
+    const namespaceExpressions = CiliumNetworkPolicy.createNamespaceExpressions(rule);
+    if (rule.selectors.length === 0) {
+      if (namespaceExpressions.length === 0) {
+        return [];
+      }
+      return [
+        {
+          [`${prefix}Endpoints`]: [{ matchExpressions: namespaceExpressions }],
+          toPorts: ports
+        }
+      ];
+    }
+    const selectors = rule.selectors.map((selector) => {
+      const rawSelector = mapSelectorLikeToSelector(selector);
+      return output(rawSelector).apply((rawSelector2) => {
+        const expressions = map(rawSelector2.matchExpressions ?? [], (expression) => ({
+          key: `k8s:${expression.key}`,
+          operator: expression.operator,
+          values: expression.values
+        }));
+        return {
+          matchLabels: mapKeys(rawSelector2.matchLabels ?? {}, (key) => `k8s:${key}`),
+          matchExpressions: [...expressions, ...namespaceExpressions]
+        };
+      });
+    });
+    return [
+      {
+        [`${prefix}Endpoints`]: selectors,
+        toPorts: ports
+      }
+    ];
+  }
+  static mapPorts(ports) {
+    if (ports.length === 0) {
+      return;
+    }
+    return {
+      ports: ports.map((port) => {
+        if ("port" in port) {
+          return {
+            port: port.port.toString(),
+            protocol: port.protocol ?? "TCP"
+          };
+        }
+        return {
+          port: port.range[0].toString(),
+          endPort: port.range[1],
+          protocol: port.protocol ?? "TCP"
+        };
+      })
+    };
+  }
+}
+
+export { CiliumNetworkPolicy };

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@highstate/cilium",
+  "version": "0.4.5",
+  "type": "module",
+  "files": [
+    "dist",
+    "assets/charts"
+  ],
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "default": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "pkgroll --tsconfig=tsconfig.build.json",
+    "update-assets": "./scripts/update-assets.sh",
+    "generate-crds": "./scripts/generate-crds.sh"
+  },
+  "dependencies": {
+    "@highstate/cilium-crds": "^0.4.5",
+    "@highstate/k8s": "^0.4.5",
+    "@highstate/pulumi": "^0.4.5",
+    "@pulumi/command": "^1.0.2",
+    "@pulumi/kubernetes": "^4.18.0",
+    "@pulumi/pulumi": "^3.152.0",
+    "remeda": "^2.21.0"
+  },
+  "peerDependencies": {
+    "@highstate/library": "workspace:^0.4.4"
+  },
+  "devDependencies": {
+    "pkgroll": "^2.5.1"
+  },
+  "gitHead": "afd601fdade1bcf31af58072eea3c08ee26349b8"
+}