@highstate/cilium 0.7.1 → 0.7.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/highstate.manifest.json +5 -0
- package/dist/index.js +37 -20
- package/dist/index.js.map +1 -0
- package/package.json +12 -17
- package/src/index.ts +2 -0
- package/src/network-policy.ts +250 -0
- package/src/shared.ts +1 -0
- package/assets/charts.json +0 -8
- package/dist/index.d.ts +0 -18
package/dist/index.js
CHANGED
@@ -1,10 +1,16 @@
|
|
1
|
-
|
2
|
-
import {
|
3
|
-
import {
|
4
|
-
|
5
|
-
|
6
|
-
|
7
|
-
|
1
|
+
// src/network-policy.ts
|
2
|
+
import { output } from "@highstate/pulumi";
|
3
|
+
import {
|
4
|
+
mapMetadata,
|
5
|
+
mapNamespaceLikeToNamespaceName,
|
6
|
+
mapSelectorLikeToSelector,
|
7
|
+
mapServiceToLabelSelector,
|
8
|
+
NetworkPolicy
|
9
|
+
} from "@highstate/k8s";
|
10
|
+
import { cilium } from "@highstate/cilium-crds";
|
11
|
+
import "@pulumi/kubernetes";
|
12
|
+
import { map, mapKeys, pipe } from "remeda";
|
13
|
+
var CiliumNetworkPolicy = class _CiliumNetworkPolicy extends NetworkPolicy {
|
8
14
|
create(name, args, opts) {
|
9
15
|
return new cilium.v2.CiliumNetworkPolicy(
|
10
16
|
name,
|
@@ -13,8 +19,8 @@ class CiliumNetworkPolicy extends NetworkPolicy {
|
|
13
19
|
spec: {
|
14
20
|
description: args.description,
|
15
21
|
endpointSelector: args.podSelector,
|
16
|
-
ingress:
|
17
|
-
egress:
|
22
|
+
ingress: _CiliumNetworkPolicy.createIngressRules(args),
|
23
|
+
egress: _CiliumNetworkPolicy.createEgressRules(args)
|
18
24
|
}
|
19
25
|
},
|
20
26
|
opts
|
@@ -24,7 +30,7 @@ class CiliumNetworkPolicy extends NetworkPolicy {
|
|
24
30
|
if (args.isolateIngress) {
|
25
31
|
return [{}];
|
26
32
|
}
|
27
|
-
return args.ingressRules.flatMap((rule) =>
|
33
|
+
return args.ingressRules.flatMap((rule) => _CiliumNetworkPolicy.createRules("from", rule));
|
28
34
|
}
|
29
35
|
static createEgressRules(args) {
|
30
36
|
if (args.isolateEgress) {
|
@@ -34,17 +40,17 @@ class CiliumNetworkPolicy extends NetworkPolicy {
|
|
34
40
|
if (args.allowKubeApiServer) {
|
35
41
|
extraRules.push({ toEntities: ["kube-apiserver"] });
|
36
42
|
}
|
37
|
-
return args.egressRules.flatMap((rule) =>
|
43
|
+
return args.egressRules.flatMap((rule) => _CiliumNetworkPolicy.createRules("to", rule)).concat(extraRules);
|
38
44
|
}
|
39
45
|
static createRules(prefix, rule) {
|
40
|
-
const port =
|
46
|
+
const port = _CiliumNetworkPolicy.mapPorts(rule.ports);
|
41
47
|
const ports = port ? [port] : void 0;
|
42
48
|
return [
|
43
|
-
...
|
44
|
-
...
|
45
|
-
...
|
46
|
-
...
|
47
|
-
...prefix === "to" ?
|
49
|
+
..._CiliumNetworkPolicy.createAllRules(prefix, rule, ports),
|
50
|
+
..._CiliumNetworkPolicy.createCidrRules(prefix, rule, ports),
|
51
|
+
..._CiliumNetworkPolicy.createServiceRules(prefix, rule, ports),
|
52
|
+
..._CiliumNetworkPolicy.createSelectorRules(prefix, rule, ports),
|
53
|
+
...prefix === "to" ? _CiliumNetworkPolicy.createFqdnRules(rule, ports) : []
|
48
54
|
];
|
49
55
|
}
|
50
56
|
static createAllRules(prefix, rule, ports) {
|
@@ -120,7 +126,7 @@ class CiliumNetworkPolicy extends NetworkPolicy {
|
|
120
126
|
);
|
121
127
|
}
|
122
128
|
static createSelectorRules(prefix, rule, ports) {
|
123
|
-
const namespaceExpressions =
|
129
|
+
const namespaceExpressions = _CiliumNetworkPolicy.createNamespaceExpressions(rule);
|
124
130
|
if (rule.selectors.length === 0) {
|
125
131
|
if (namespaceExpressions.length === 0) {
|
126
132
|
return [];
|
@@ -173,6 +179,17 @@ class CiliumNetworkPolicy extends NetworkPolicy {
|
|
173
179
|
})
|
174
180
|
};
|
175
181
|
}
|
176
|
-
}
|
182
|
+
};
|
177
183
|
|
178
|
-
|
184
|
+
// assets/charts.json
|
185
|
+
var cilium2 = {
|
186
|
+
repo: "https://helm.cilium.io",
|
187
|
+
name: "cilium",
|
188
|
+
version: "1.17.1",
|
189
|
+
sha256: "381de4f8f4c5eace677d3426aa8d896ef8d2318c2bf4d1172c9953345b744471"
|
190
|
+
};
|
191
|
+
export {
|
192
|
+
CiliumNetworkPolicy,
|
193
|
+
cilium2 as chart
|
194
|
+
};
|
195
|
+
//# sourceMappingURL=index.js.map
|
@@ -0,0 +1 @@
|
|
1
|
+
{"version":3,"sources":["../src/network-policy.ts","../assets/charts.json"],"sourcesContent":["import { type ResourceOptions, type Resource, output } from \"@highstate/pulumi\"\nimport {\n mapMetadata,\n mapNamespaceLikeToNamespaceName,\n mapSelectorLikeToSelector,\n mapServiceToLabelSelector,\n NetworkPolicy,\n type NetworkPolicyPort,\n type NormalizedNetworkPolicyArgs,\n type NormalizedRuleArgs,\n} from \"@highstate/k8s\"\nimport { cilium, types } from \"@highstate/cilium-crds\"\nimport { types as k8sTypes } from \"@pulumi/kubernetes\"\nimport { map, mapKeys, pipe } from \"remeda\"\n\ntype Rule = types.input.cilium.v2.CiliumNetworkPolicySpecIngress &\n types.input.cilium.v2.CiliumNetworkPolicySpecEgress\n\nexport class CiliumNetworkPolicy extends NetworkPolicy {\n protected create(\n name: string,\n args: NormalizedNetworkPolicyArgs,\n opts?: ResourceOptions,\n ): Resource {\n return new cilium.v2.CiliumNetworkPolicy(\n name,\n {\n metadata: mapMetadata(args, name),\n spec: {\n description: args.description,\n endpointSelector: args.podSelector,\n ingress: CiliumNetworkPolicy.createIngressRules(args),\n egress: CiliumNetworkPolicy.createEgressRules(args),\n },\n },\n opts,\n )\n }\n\n private static createIngressRules(args: NormalizedNetworkPolicyArgs): Rule[] {\n if (args.isolateIngress) {\n return [{}]\n }\n\n return args.ingressRules.flatMap(rule => CiliumNetworkPolicy.createRules(\"from\", rule))\n }\n\n private static createEgressRules(args: NormalizedNetworkPolicyArgs): Rule[] {\n if (args.isolateEgress) {\n return [{}]\n }\n\n const extraRules: Rule[] = []\n\n if (args.allowKubeApiServer) {\n extraRules.push({ toEntities: [\"kube-apiserver\"] })\n }\n\n return args.egressRules\n .flatMap(rule => CiliumNetworkPolicy.createRules(\"to\", rule))\n .concat(extraRules)\n }\n\n private static createRules(prefix: \"from\" | \"to\", rule: NormalizedRuleArgs): Rule[] {\n const port = CiliumNetworkPolicy.mapPorts(rule.ports)\n const ports = port ? [port] : undefined\n\n return [\n ...CiliumNetworkPolicy.createAllRules(prefix, rule, ports),\n ...CiliumNetworkPolicy.createCidrRules(prefix, rule, ports),\n ...CiliumNetworkPolicy.createServiceRules(prefix, rule, ports),\n ...CiliumNetworkPolicy.createSelectorRules(prefix, rule, ports),\n ...(prefix === \"to\" ? CiliumNetworkPolicy.createFqdnRules(rule, ports) : []),\n ]\n }\n\n private static createAllRules(\n prefix: \"from\" | \"to\",\n rule: NormalizedRuleArgs,\n ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n ): Rule[] {\n if (!rule.all) {\n return []\n }\n\n return [\n {\n [`${prefix}Entities`]: [\"all\"],\n toPorts: ports,\n },\n ]\n }\n\n private static createCidrRules(\n prefix: \"from\" | \"to\",\n rule: NormalizedRuleArgs,\n ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n ): Rule[] {\n if (rule.cidrs.length === 0) {\n return []\n }\n\n return [\n {\n [`${prefix}CIDR`]: rule.cidrs,\n toPorts: ports,\n },\n ]\n }\n\n private static createFqdnRules(\n rule: NormalizedRuleArgs,\n ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n ): types.input.cilium.v2.CiliumNetworkPolicySpecEgress[] {\n if (rule.fqdns.length === 0) {\n return []\n }\n\n return [\n {\n toFQDNs: rule.fqdns.map(fqdn => {\n return fqdn.includes(\"*\") ? { matchName: fqdn } : { matchPattern: fqdn }\n }),\n toPorts: ports,\n },\n ]\n }\n\n private static createServiceRules(\n prefix: \"from\" | \"to\",\n rule: NormalizedRuleArgs,\n ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n ): Rule[] {\n if (rule.services.length === 0) {\n return []\n }\n\n const selectors = rule.services.map(service => {\n const selector = mapServiceToLabelSelector(service)\n\n return output(selector).apply(selector => ({\n matchLabels: {\n ...mapKeys(selector.matchLabels ?? {}, key => `k8s:${key}`),\n \"k8s:io.kubernetes.pod.namespace\": service.metadata.namespace,\n },\n }))\n })\n\n return [\n {\n [`${prefix}Endpoints`]: selectors,\n toPorts: ports,\n },\n ]\n }\n\n private static createNamespaceExpressions(\n rule: NormalizedRuleArgs,\n ): k8sTypes.input.meta.v1.LabelSelectorRequirement[] {\n if (rule.namespaces.length === 0) {\n return []\n }\n\n return pipe(\n //\n rule.namespaces,\n map(mapNamespaceLikeToNamespaceName),\n names => [\n {\n key: \"k8s:io.kubernetes.pod.namespace\",\n operator: \"In\",\n values: names,\n },\n ],\n )\n }\n\n private static createSelectorRules(\n prefix: \"from\" | \"to\",\n rule: NormalizedRuleArgs,\n ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n ): types.input.cilium.v2.CiliumNetworkPolicySpecIngress[] {\n const namespaceExpressions = CiliumNetworkPolicy.createNamespaceExpressions(rule)\n\n if (rule.selectors.length === 0) {\n if (namespaceExpressions.length === 0) {\n // if no selectors and no namespaces are provided, we do not match\n return []\n }\n\n // if no selectors are provided, we only match on namespaces\n return [\n {\n [`${prefix}Endpoints`]: [{ matchExpressions: namespaceExpressions }],\n toPorts: ports,\n },\n ]\n }\n\n // otherwise, we match on selectors and namespaces\n const selectors = rule.selectors.map(selector => {\n const rawSelector = mapSelectorLikeToSelector(selector)\n\n return output(rawSelector).apply(rawSelector => {\n const expressions = map(rawSelector.matchExpressions ?? [], expression => ({\n key: `k8s:${expression.key}`,\n operator: expression.operator,\n values: expression.values,\n }))\n\n return {\n matchLabels: mapKeys(rawSelector.matchLabels ?? {}, key => `k8s:${key}`),\n matchExpressions: [...expressions, ...namespaceExpressions],\n }\n })\n })\n\n return [\n {\n [`${prefix}Endpoints`]: selectors,\n toPorts: ports,\n },\n ]\n }\n\n private static mapPorts(\n ports: NetworkPolicyPort[],\n ): types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts | undefined {\n if (ports.length === 0) {\n return\n }\n\n return {\n ports: ports.map(port => {\n if (\"port\" in port) {\n return {\n port: port.port.toString(),\n protocol: port.protocol ?? \"TCP\",\n }\n }\n\n return {\n port: port.range[0].toString(),\n endPort: port.range[1],\n protocol: port.protocol ?? \"TCP\",\n }\n }),\n }\n }\n}\n","{\n \"cilium\": {\n \"repo\": \"https://helm.cilium.io\",\n \"name\": \"cilium\",\n \"version\": \"1.17.1\",\n \"sha256\": \"381de4f8f4c5eace677d3426aa8d896ef8d2318c2bf4d1172c9953345b744471\"\n }\n}\n"],"mappings":";AAAA,SAA8C,cAAc;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,cAAqB;AAC9B,OAAkC;AAClC,SAAS,KAAK,SAAS,YAAY;AAK5B,IAAM,sBAAN,MAAM,6BAA4B,cAAc;AAAA,EAC3C,OACR,MACA,MACA,MACU;AACV,WAAO,IAAI,OAAO,GAAG;AAAA,MACnB;AAAA,MACA;AAAA,QACE,UAAU,YAAY,MAAM,IAAI;AAAA,QAChC,MAAM;AAAA,UACJ,aAAa,KAAK;AAAA,UAClB,kBAAkB,KAAK;AAAA,UACvB,SAAS,qBAAoB,mBAAmB,IAAI;AAAA,UACpD,QAAQ,qBAAoB,kBAAkB,IAAI;AAAA,QACpD;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,mBAAmB,MAA2C;AAC3E,QAAI,KAAK,gBAAgB;AACvB,aAAO,CAAC,CAAC,CAAC;AAAA,IACZ;AAEA,WAAO,KAAK,aAAa,QAAQ,UAAQ,qBAAoB,YAAY,QAAQ,IAAI,CAAC;AAAA,EACxF;AAAA,EAEA,OAAe,kBAAkB,MAA2C;AAC1E,QAAI,KAAK,eAAe;AACtB,aAAO,CAAC,CAAC,CAAC;AAAA,IACZ;AAEA,UAAM,aAAqB,CAAC;AAE5B,QAAI,KAAK,oBAAoB;AAC3B,iBAAW,KAAK,EAAE,YAAY,CAAC,gBAAgB,EAAE,CAAC;AAAA,IACpD;AAEA,WAAO,KAAK,YACT,QAAQ,UAAQ,qBAAoB,YAAY,MAAM,IAAI,CAAC,EAC3D,OAAO,UAAU;AAAA,EACtB;AAAA,EAEA,OAAe,YAAY,QAAuB,MAAkC;AAClF,UAAM,OAAO,qBAAoB,SAAS,KAAK,KAAK;AACpD,UAAM,QAAQ,OAAO,CAAC,IAAI,IAAI;AAE9B,WAAO;AAAA,MACL,GAAG,qBAAoB,eAAe,QAAQ,MAAM,KAAK;AAAA,MACzD,GAAG,qBAAoB,gBAAgB,QAAQ,MAAM,KAAK;AAAA,MAC1D,GAAG,qBAAoB,mBAAmB,QAAQ,MAAM,KAAK;AAAA,MAC7D,GAAG,qBAAoB,oBAAoB,QAAQ,MAAM,KAAK;AAAA,MAC9D,GAAI,WAAW,OAAO,qBAAoB,gBAAgB,MAAM,KAAK,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF;AAAA,EAEA,OAAe,eACb,QACA,MACA,OACQ;AACR,QAAI,CAAC,KAAK,KAAK;AACb,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,UAAU,GAAG,CAAC,KAAK;AAAA,QAC7B,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,gBACb,QACA,MACA,OACQ;AACR,QAAI,KAAK,MAAM,WAAW,GAAG;AAC3B,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,MAAM,GAAG,KAAK;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,gBACb,MACA,OACuD;AACvD,QAAI,KAAK,MAAM,WAAW,GAAG;AAC3B,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA,MACL;AAAA,QACE,SAAS,KAAK,MAAM,IAAI,UAAQ;AAC9B,iBAAO,KAAK,SAAS,GAAG,IAAI,EAAE,WAAW,KAAK,IAAI,EAAE,cAAc,KAAK;AAAA,QACzE,CAAC;AAAA,QACD,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,mBACb,QACA,MACA,OACQ;AACR,QAAI,KAAK,SAAS,WAAW,GAAG;AAC9B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,YAAY,KAAK,SAAS,IAAI,aAAW;AAC7C,YAAM,WAAW,0BAA0B,OAAO;AAElD,aAAO,OAAO,QAAQ,EAAE,MAAM,CAAAA,eAAa;AAAA,QACzC,aAAa;AAAA,UACX,GAAG,QAAQA,UAAS,eAAe,CAAC,GAAG,SAAO,OAAO,GAAG,EAAE;AAAA,UAC1D,mCAAmC,QAAQ,SAAS;AAAA,QACtD;AAAA,MACF,EAAE;AAAA,IACJ,CAAC;AAED,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,WAAW,GAAG;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,2BACb,MACmD;AACnD,QAAI,KAAK,WAAW,WAAW,GAAG;AAChC,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA;AAAA,MAEL,KAAK;AAAA,MACL,IAAI,+BAA+B;AAAA,MACnC,WAAS;AAAA,QACP;AAAA,UACE,KAAK;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,oBACb,QACA,MACA,OACwD;AACxD,UAAM,uBAAuB,qBAAoB,2BAA2B,IAAI;AAEhF,QAAI,KAAK,UAAU,WAAW,GAAG;AAC/B,UAAI,qBAAqB,WAAW,GAAG;AAErC,eAAO,CAAC;AAAA,MACV;AAGA,aAAO;AAAA,QACL;AAAA,UACE,CAAC,GAAG,MAAM,WAAW,GAAG,CAAC,EAAE,kBAAkB,qBAAqB,CAAC;AAAA,UACnE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,KAAK,UAAU,IAAI,cAAY;AAC/C,YAAM,cAAc,0BAA0B,QAAQ;AAEtD,aAAO,OAAO,WAAW,EAAE,MAAM,CAAAC,iBAAe;AAC9C,cAAM,cAAc,IAAIA,aAAY,oBAAoB,CAAC,GAAG,iBAAe;AAAA,UACzE,KAAK,OAAO,WAAW,GAAG;AAAA,UAC1B,UAAU,WAAW;AAAA,UACrB,QAAQ,WAAW;AAAA,QACrB,EAAE;AAEF,eAAO;AAAA,UACL,aAAa,QAAQA,aAAY,eAAe,CAAC,GAAG,SAAO,OAAO,GAAG,EAAE;AAAA,UACvE,kBAAkB,CAAC,GAAG,aAAa,GAAG,oBAAoB;AAAA,QAC5D;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,WAAW,GAAG;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,SACb,OACwE;AACxE,QAAI,MAAM,WAAW,GAAG;AACtB;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,MAAM,IAAI,UAAQ;AACvB,YAAI,UAAU,MAAM;AAClB,iBAAO;AAAA,YACL,MAAM,KAAK,KAAK,SAAS;AAAA,YACzB,UAAU,KAAK,YAAY;AAAA,UAC7B;AAAA,QACF;AAEA,eAAO;AAAA,UACL,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS;AAAA,UAC7B,SAAS,KAAK,MAAM,CAAC;AAAA,UACrB,UAAU,KAAK,YAAY;AAAA,QAC7B;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACxPE,IAAAC,UAAU;AAAA,EACR,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,QAAU;AACZ;","names":["selector","rawSelector","cilium"]}
|
package/package.json
CHANGED
@@ -1,44 +1,39 @@
|
|
1
1
|
{
|
2
2
|
"name": "@highstate/cilium",
|
3
|
-
"version": "0.7.
|
3
|
+
"version": "0.7.3",
|
4
4
|
"type": "module",
|
5
5
|
"files": [
|
6
|
-
"
|
7
|
-
"
|
6
|
+
"dist",
|
7
|
+
"src"
|
8
8
|
],
|
9
|
-
"module": "dist/index.js",
|
10
|
-
"types": "dist/index.d.ts",
|
11
9
|
"exports": {
|
12
10
|
".": {
|
13
|
-
"
|
14
|
-
"
|
15
|
-
},
|
16
|
-
"./charts.json": {
|
17
|
-
"default": "./assets/charts.json"
|
11
|
+
"types": "./src/index.ts",
|
12
|
+
"default": "./dist/index.js"
|
18
13
|
}
|
19
14
|
},
|
20
15
|
"publishConfig": {
|
21
16
|
"access": "public"
|
22
17
|
},
|
23
18
|
"scripts": {
|
24
|
-
"build": "
|
19
|
+
"build": "highstate build",
|
25
20
|
"update-charts": "../../scripts/update-charts.sh ./assets/charts.json",
|
26
21
|
"generate-crds": "./scripts/generate-crds.sh"
|
27
22
|
},
|
28
23
|
"dependencies": {
|
29
|
-
"@highstate/cilium-crds": "^0.7.
|
30
|
-
"@highstate/k8s": "^0.7.
|
31
|
-
"@highstate/pulumi": "^0.7.
|
24
|
+
"@highstate/cilium-crds": "^0.7.3",
|
25
|
+
"@highstate/k8s": "^0.7.3",
|
26
|
+
"@highstate/pulumi": "^0.7.3",
|
32
27
|
"@pulumi/command": "^1.0.2",
|
33
28
|
"@pulumi/kubernetes": "^4.18.0",
|
34
|
-
"@pulumi/pulumi": "
|
29
|
+
"@pulumi/pulumi": "patch:@pulumi/pulumi@npm%3A3.159.0#~/.yarn/patches/@pulumi-pulumi-npm-3.159.0-d07eefce5c.patch",
|
35
30
|
"remeda": "^2.21.0"
|
36
31
|
},
|
37
32
|
"peerDependencies": {
|
38
33
|
"@highstate/library": "workspace:^0.4.4"
|
39
34
|
},
|
40
35
|
"devDependencies": {
|
41
|
-
"
|
36
|
+
"@highstate/cli": "^0.7.3"
|
42
37
|
},
|
43
|
-
"gitHead": "
|
38
|
+
"gitHead": "5cf7cec27262c8fa1d96f6478833b94841459d64"
|
44
39
|
}
|
package/src/index.ts
ADDED
@@ -0,0 +1,250 @@
|
|
1
|
+
import { type ResourceOptions, type Resource, output } from "@highstate/pulumi"
|
2
|
+
import {
|
3
|
+
mapMetadata,
|
4
|
+
mapNamespaceLikeToNamespaceName,
|
5
|
+
mapSelectorLikeToSelector,
|
6
|
+
mapServiceToLabelSelector,
|
7
|
+
NetworkPolicy,
|
8
|
+
type NetworkPolicyPort,
|
9
|
+
type NormalizedNetworkPolicyArgs,
|
10
|
+
type NormalizedRuleArgs,
|
11
|
+
} from "@highstate/k8s"
|
12
|
+
import { cilium, types } from "@highstate/cilium-crds"
|
13
|
+
import { types as k8sTypes } from "@pulumi/kubernetes"
|
14
|
+
import { map, mapKeys, pipe } from "remeda"
|
15
|
+
|
16
|
+
type Rule = types.input.cilium.v2.CiliumNetworkPolicySpecIngress &
|
17
|
+
types.input.cilium.v2.CiliumNetworkPolicySpecEgress
|
18
|
+
|
19
|
+
export class CiliumNetworkPolicy extends NetworkPolicy {
|
20
|
+
protected create(
|
21
|
+
name: string,
|
22
|
+
args: NormalizedNetworkPolicyArgs,
|
23
|
+
opts?: ResourceOptions,
|
24
|
+
): Resource {
|
25
|
+
return new cilium.v2.CiliumNetworkPolicy(
|
26
|
+
name,
|
27
|
+
{
|
28
|
+
metadata: mapMetadata(args, name),
|
29
|
+
spec: {
|
30
|
+
description: args.description,
|
31
|
+
endpointSelector: args.podSelector,
|
32
|
+
ingress: CiliumNetworkPolicy.createIngressRules(args),
|
33
|
+
egress: CiliumNetworkPolicy.createEgressRules(args),
|
34
|
+
},
|
35
|
+
},
|
36
|
+
opts,
|
37
|
+
)
|
38
|
+
}
|
39
|
+
|
40
|
+
private static createIngressRules(args: NormalizedNetworkPolicyArgs): Rule[] {
|
41
|
+
if (args.isolateIngress) {
|
42
|
+
return [{}]
|
43
|
+
}
|
44
|
+
|
45
|
+
return args.ingressRules.flatMap(rule => CiliumNetworkPolicy.createRules("from", rule))
|
46
|
+
}
|
47
|
+
|
48
|
+
private static createEgressRules(args: NormalizedNetworkPolicyArgs): Rule[] {
|
49
|
+
if (args.isolateEgress) {
|
50
|
+
return [{}]
|
51
|
+
}
|
52
|
+
|
53
|
+
const extraRules: Rule[] = []
|
54
|
+
|
55
|
+
if (args.allowKubeApiServer) {
|
56
|
+
extraRules.push({ toEntities: ["kube-apiserver"] })
|
57
|
+
}
|
58
|
+
|
59
|
+
return args.egressRules
|
60
|
+
.flatMap(rule => CiliumNetworkPolicy.createRules("to", rule))
|
61
|
+
.concat(extraRules)
|
62
|
+
}
|
63
|
+
|
64
|
+
private static createRules(prefix: "from" | "to", rule: NormalizedRuleArgs): Rule[] {
|
65
|
+
const port = CiliumNetworkPolicy.mapPorts(rule.ports)
|
66
|
+
const ports = port ? [port] : undefined
|
67
|
+
|
68
|
+
return [
|
69
|
+
...CiliumNetworkPolicy.createAllRules(prefix, rule, ports),
|
70
|
+
...CiliumNetworkPolicy.createCidrRules(prefix, rule, ports),
|
71
|
+
...CiliumNetworkPolicy.createServiceRules(prefix, rule, ports),
|
72
|
+
...CiliumNetworkPolicy.createSelectorRules(prefix, rule, ports),
|
73
|
+
...(prefix === "to" ? CiliumNetworkPolicy.createFqdnRules(rule, ports) : []),
|
74
|
+
]
|
75
|
+
}
|
76
|
+
|
77
|
+
private static createAllRules(
|
78
|
+
prefix: "from" | "to",
|
79
|
+
rule: NormalizedRuleArgs,
|
80
|
+
ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,
|
81
|
+
): Rule[] {
|
82
|
+
if (!rule.all) {
|
83
|
+
return []
|
84
|
+
}
|
85
|
+
|
86
|
+
return [
|
87
|
+
{
|
88
|
+
[`${prefix}Entities`]: ["all"],
|
89
|
+
toPorts: ports,
|
90
|
+
},
|
91
|
+
]
|
92
|
+
}
|
93
|
+
|
94
|
+
private static createCidrRules(
|
95
|
+
prefix: "from" | "to",
|
96
|
+
rule: NormalizedRuleArgs,
|
97
|
+
ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,
|
98
|
+
): Rule[] {
|
99
|
+
if (rule.cidrs.length === 0) {
|
100
|
+
return []
|
101
|
+
}
|
102
|
+
|
103
|
+
return [
|
104
|
+
{
|
105
|
+
[`${prefix}CIDR`]: rule.cidrs,
|
106
|
+
toPorts: ports,
|
107
|
+
},
|
108
|
+
]
|
109
|
+
}
|
110
|
+
|
111
|
+
private static createFqdnRules(
|
112
|
+
rule: NormalizedRuleArgs,
|
113
|
+
ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,
|
114
|
+
): types.input.cilium.v2.CiliumNetworkPolicySpecEgress[] {
|
115
|
+
if (rule.fqdns.length === 0) {
|
116
|
+
return []
|
117
|
+
}
|
118
|
+
|
119
|
+
return [
|
120
|
+
{
|
121
|
+
toFQDNs: rule.fqdns.map(fqdn => {
|
122
|
+
return fqdn.includes("*") ? { matchName: fqdn } : { matchPattern: fqdn }
|
123
|
+
}),
|
124
|
+
toPorts: ports,
|
125
|
+
},
|
126
|
+
]
|
127
|
+
}
|
128
|
+
|
129
|
+
private static createServiceRules(
|
130
|
+
prefix: "from" | "to",
|
131
|
+
rule: NormalizedRuleArgs,
|
132
|
+
ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,
|
133
|
+
): Rule[] {
|
134
|
+
if (rule.services.length === 0) {
|
135
|
+
return []
|
136
|
+
}
|
137
|
+
|
138
|
+
const selectors = rule.services.map(service => {
|
139
|
+
const selector = mapServiceToLabelSelector(service)
|
140
|
+
|
141
|
+
return output(selector).apply(selector => ({
|
142
|
+
matchLabels: {
|
143
|
+
...mapKeys(selector.matchLabels ?? {}, key => `k8s:${key}`),
|
144
|
+
"k8s:io.kubernetes.pod.namespace": service.metadata.namespace,
|
145
|
+
},
|
146
|
+
}))
|
147
|
+
})
|
148
|
+
|
149
|
+
return [
|
150
|
+
{
|
151
|
+
[`${prefix}Endpoints`]: selectors,
|
152
|
+
toPorts: ports,
|
153
|
+
},
|
154
|
+
]
|
155
|
+
}
|
156
|
+
|
157
|
+
private static createNamespaceExpressions(
|
158
|
+
rule: NormalizedRuleArgs,
|
159
|
+
): k8sTypes.input.meta.v1.LabelSelectorRequirement[] {
|
160
|
+
if (rule.namespaces.length === 0) {
|
161
|
+
return []
|
162
|
+
}
|
163
|
+
|
164
|
+
return pipe(
|
165
|
+
//
|
166
|
+
rule.namespaces,
|
167
|
+
map(mapNamespaceLikeToNamespaceName),
|
168
|
+
names => [
|
169
|
+
{
|
170
|
+
key: "k8s:io.kubernetes.pod.namespace",
|
171
|
+
operator: "In",
|
172
|
+
values: names,
|
173
|
+
},
|
174
|
+
],
|
175
|
+
)
|
176
|
+
}
|
177
|
+
|
178
|
+
private static createSelectorRules(
|
179
|
+
prefix: "from" | "to",
|
180
|
+
rule: NormalizedRuleArgs,
|
181
|
+
ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,
|
182
|
+
): types.input.cilium.v2.CiliumNetworkPolicySpecIngress[] {
|
183
|
+
const namespaceExpressions = CiliumNetworkPolicy.createNamespaceExpressions(rule)
|
184
|
+
|
185
|
+
if (rule.selectors.length === 0) {
|
186
|
+
if (namespaceExpressions.length === 0) {
|
187
|
+
// if no selectors and no namespaces are provided, we do not match
|
188
|
+
return []
|
189
|
+
}
|
190
|
+
|
191
|
+
// if no selectors are provided, we only match on namespaces
|
192
|
+
return [
|
193
|
+
{
|
194
|
+
[`${prefix}Endpoints`]: [{ matchExpressions: namespaceExpressions }],
|
195
|
+
toPorts: ports,
|
196
|
+
},
|
197
|
+
]
|
198
|
+
}
|
199
|
+
|
200
|
+
// otherwise, we match on selectors and namespaces
|
201
|
+
const selectors = rule.selectors.map(selector => {
|
202
|
+
const rawSelector = mapSelectorLikeToSelector(selector)
|
203
|
+
|
204
|
+
return output(rawSelector).apply(rawSelector => {
|
205
|
+
const expressions = map(rawSelector.matchExpressions ?? [], expression => ({
|
206
|
+
key: `k8s:${expression.key}`,
|
207
|
+
operator: expression.operator,
|
208
|
+
values: expression.values,
|
209
|
+
}))
|
210
|
+
|
211
|
+
return {
|
212
|
+
matchLabels: mapKeys(rawSelector.matchLabels ?? {}, key => `k8s:${key}`),
|
213
|
+
matchExpressions: [...expressions, ...namespaceExpressions],
|
214
|
+
}
|
215
|
+
})
|
216
|
+
})
|
217
|
+
|
218
|
+
return [
|
219
|
+
{
|
220
|
+
[`${prefix}Endpoints`]: selectors,
|
221
|
+
toPorts: ports,
|
222
|
+
},
|
223
|
+
]
|
224
|
+
}
|
225
|
+
|
226
|
+
private static mapPorts(
|
227
|
+
ports: NetworkPolicyPort[],
|
228
|
+
): types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts | undefined {
|
229
|
+
if (ports.length === 0) {
|
230
|
+
return
|
231
|
+
}
|
232
|
+
|
233
|
+
return {
|
234
|
+
ports: ports.map(port => {
|
235
|
+
if ("port" in port) {
|
236
|
+
return {
|
237
|
+
port: port.port.toString(),
|
238
|
+
protocol: port.protocol ?? "TCP",
|
239
|
+
}
|
240
|
+
}
|
241
|
+
|
242
|
+
return {
|
243
|
+
port: port.range[0].toString(),
|
244
|
+
endPort: port.range[1],
|
245
|
+
protocol: port.protocol ?? "TCP",
|
246
|
+
}
|
247
|
+
}),
|
248
|
+
}
|
249
|
+
}
|
250
|
+
}
|
package/src/shared.ts
ADDED
@@ -0,0 +1 @@
|
|
1
|
+
export { cilium as chart } from "../assets/charts.json"
|
package/assets/charts.json
DELETED
package/dist/index.d.ts
DELETED
@@ -1,18 +0,0 @@
|
|
1
|
-
import { ResourceOptions, Resource } from '@highstate/pulumi';
|
2
|
-
import { NetworkPolicy, NormalizedNetworkPolicyArgs } from '@highstate/k8s';
|
3
|
-
|
4
|
-
declare class CiliumNetworkPolicy extends NetworkPolicy {
|
5
|
-
protected create(name: string, args: NormalizedNetworkPolicyArgs, opts?: ResourceOptions): Resource;
|
6
|
-
private static createIngressRules;
|
7
|
-
private static createEgressRules;
|
8
|
-
private static createRules;
|
9
|
-
private static createAllRules;
|
10
|
-
private static createCidrRules;
|
11
|
-
private static createFqdnRules;
|
12
|
-
private static createServiceRules;
|
13
|
-
private static createNamespaceExpressions;
|
14
|
-
private static createSelectorRules;
|
15
|
-
private static mapPorts;
|
16
|
-
}
|
17
|
-
|
18
|
-
export { CiliumNetworkPolicy };
|