@highstate/cilium 0.9.18 → 0.9.20

package/dist/unit/index.js

@@ -1,38 +1,56 @@
-import { cilium } from '../chunk-M4DV2DAJ.js';
-import { Chart } from '@highstate/k8s';
+import { cilium } from '../chunk-QJ3DFAUT.js';
+import { Chart, Namespace } from '@highstate/k8s';
 import { k8s } from '@highstate/library';
-import { forUnit, toPromise, secret } from '@highstate/pulumi';
+import { forUnit, toPromise, ResourceHook, secret } from '@highstate/pulumi';
 import { l3EndpointToString } from '@highstate/common';
+import { KubeConfig, CoreV1Api } from '@kubernetes/client-node';
 
 var { args, inputs, outputs } = forUnit(k8s.cilium);
 var cluster = await toPromise(inputs.k8sCluster);
-new Chart("cilium", {
-  cluster,
-  namespace: "kube-system",
-  chart: cilium,
-  values: {
-    ipam: {
-      mode: "kubernetes"
-    },
-    kubeProxyReplacement: "true",
-    operator: {
-      replicas: 1
-    },
-    hubble: {
-      relay: {
-        enabled: true
-      },
-      ui: {
-        enabled: true
-      }
-    },
-    dnsProxy: {
-      dnsRejectResponseCode: "nameError"
-    },
-    k8sServiceHost: l3EndpointToString(cluster.apiEndpoints[0]),
-    k8sServicePort: cluster.apiEndpoints[0].port.toString()
-  }
+var afterCreateHook = new ResourceHook("restart-all-pods", async () => {
+  const kubeConfig = new KubeConfig();
+  kubeConfig.loadFromString(cluster.kubeconfig);
+  const coreApi = kubeConfig.makeApiClient(CoreV1Api);
+  const allPods = await coreApi.listPodForAllNamespaces();
+  await Promise.all(
+    allPods.items.map(
+      (pod) => coreApi.deleteNamespacedPod({
+        name: pod.metadata?.name,
+        namespace: pod.metadata?.namespace
+      })
+    )
+  );
 });
+new Chart(
+  "cilium",
+  {
+    namespace: Namespace.get("kube-system", { name: "kube-system", cluster }),
+    chart: cilium,
+    values: {
+      ipam: {
+        mode: "kubernetes"
+      },
+      kubeProxyReplacement: "true",
+      operator: {
+        replicas: 1
+      },
+      hubble: {
+        relay: {
+          enabled: args.enableHubble
+        },
+        ui: {
+          enabled: args.enableHubble
+        }
+      },
+      dnsProxy: {
+        dnsRejectResponseCode: "nameError"
+      },
+      k8sServiceHost: l3EndpointToString(cluster.apiEndpoints[0]),
+      k8sServicePort: cluster.apiEndpoints[0].port.toString()
+    }
+  },
+  { hooks: { afterCreate: [afterCreateHook] } }
+);
 var unit_default = outputs({
   k8sCluster: secret({
     ...cluster,
@@ -40,7 +58,7 @@ var unit_default = outputs({
     metadata: {
       ...cluster.metadata,
       cilium: {
-        allowForbiddenFqdnResolution: args.allowForbiddenFqdnResolution
+        allowForbiddenFqdnResolution: args.allowForbiddenFqdnResolution ?? false
       }
     }
   })

package/dist/unit/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/unit/index.ts"],"names":[],"mappings":";;;;;;AAMA,IAAM,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAQ,GAAI,OAAA,CAAQ,IAAI,MAAM,CAAA;AAEpD,IAAM,OAAA,GAAU,MAAM,SAAA,CAAU,MAAA,CAAO,UAAU,CAAA;AAEjD,IAAI,MAAM,QAAA,EAAU;AAAA,EAClB,OAAA;AAAA,EACA,SAAA,EAAW,aAAA;AAAA,EAEX,KAAA,EAAA,MAAA;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,IAAA,EAAM;AAAA,MACJ,IAAA,EAAM;AAAA,KACR;AAAA,IAEA,oBAAA,EAAsB,MAAA;AAAA,IAEtB,QAAA,EAAU;AAAA,MACR,QAAA,EAAU;AAAA,KACZ;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,KAAA,EAAO;AAAA,QACL,OAAA,EAAS;AAAA,OACX;AAAA,MACA,EAAA,EAAI;AAAA,QACF,OAAA,EAAS;AAAA;AACX,KACF;AAAA,IAEA,QAAA,EAAU;AAAA,MACR,qBAAA,EAAuB;AAAA,KACzB;AAAA,IAEA,cAAA,EAAgB,kBAAA,CAAmB,OAAA,CAAQ,YAAA,CAAa,CAAC,CAAC,CAAA;AAAA,IAC1D,gBAAgB,OAAA,CAAQ,YAAA,CAAa,CAAC,CAAA,CAAE,KAAK,QAAA;AAAS;AAE1D,CAAC,CAAA;AAED,IAAO,eAAQ,OAAA,CAAQ;AAAA,EACrB,YAAY,MAAA,CAAO;AAAA,IACjB,GAAG,OAAA;AAAA,IACH,GAAA,EAAK,QAAA;AAAA,IACL,QAAA,EAAU;AAAA,MACR,GAAG,OAAA,CAAQ,QAAA;AAAA,MACX,MAAA,EAAQ;AAAA,QACN,8BAA8B,IAAA,CAAK;AAAA;AACrC;AACF,GACD;AACH,CAAC","file":"index.js","sourcesContent":["import { Chart } from \"@highstate/k8s\"\nimport { k8s } from \"@highstate/library\"\nimport { forUnit, secret, toPromise } from \"@highstate/pulumi\"\nimport { l3EndpointToString } from \"@highstate/common\"\nimport { chart, type CiliumClusterMetadata } from \"../shared\"\n\nconst { args, inputs, outputs } = forUnit(k8s.cilium)\n\nconst cluster = await toPromise(inputs.k8sCluster)\n\nnew Chart(\"cilium\", {\n  cluster,\n  namespace: \"kube-system\",\n\n  chart,\n\n  values: {\n    ipam: {\n      mode: \"kubernetes\",\n    },\n\n    kubeProxyReplacement: \"true\",\n\n    operator: {\n      replicas: 1,\n    },\n\n    hubble: {\n      relay: {\n        enabled: true,\n      },\n      ui: {\n        enabled: true,\n      },\n    },\n\n    dnsProxy: {\n      dnsRejectResponseCode: \"nameError\",\n    },\n\n    k8sServiceHost: l3EndpointToString(cluster.apiEndpoints[0]),\n    k8sServicePort: cluster.apiEndpoints[0].port.toString(),\n  },\n})\n\nexport default outputs({\n  k8sCluster: secret({\n    ...cluster,\n    cni: \"cilium\",\n    metadata: {\n      ...cluster.metadata,\n      cilium: {\n        allowForbiddenFqdnResolution: args.allowForbiddenFqdnResolution,\n      } satisfies CiliumClusterMetadata,\n    },\n  }),\n})\n"]}
+{"version":3,"sources":["../../src/unit/index.ts"],"names":[],"mappings":";;;;;;;AAOA,IAAM,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAQ,GAAI,OAAA,CAAQ,IAAI,MAAM,CAAA;AAEpD,IAAM,OAAA,GAAU,MAAM,SAAA,CAAU,MAAA,CAAO,UAAU,CAAA;AAEjD,IAAM,eAAA,GAAkB,IAAI,YAAA,CAAa,kBAAA,EAAoB,YAAY;AAEvE,EAAA,MAAM,UAAA,GAAa,IAAI,UAAA,EAAW;AAClC,EAAA,UAAA,CAAW,cAAA,CAAe,QAAQ,UAAU,CAAA;AAE5C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,aAAA,CAAc,SAAS,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,uBAAA,EAAwB;AAEtD,EAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,IACZ,QAAQ,KAAA,CAAM,GAAA;AAAA,MAAI,CAAA,GAAA,KAChB,QAAQ,mBAAA,CAAoB;AAAA,QAC1B,IAAA,EAAM,IAAI,QAAA,EAAU,IAAA;AAAA,QACpB,SAAA,EAAW,IAAI,QAAA,EAAU;AAAA,OAC1B;AAAA;AACH,GACF;AACF,CAAC,CAAA;AAED,IAAI,KAAA;AAAA,EACF,QAAA;AAAA,EACA;AAAA,IACE,SAAA,EAAW,UAAU,GAAA,CAAI,aAAA,EAAe,EAAE,IAAA,EAAM,aAAA,EAAe,SAAS,CAAA;AAAA,IACxE,KAAA,EAAA,MAAA;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM;AAAA,QACJ,IAAA,EAAM;AAAA,OACR;AAAA,MAEA,oBAAA,EAAsB,MAAA;AAAA,MAEtB,QAAA,EAAU;AAAA,QACR,QAAA,EAAU;AAAA,OACZ;AAAA,MAEA,MAAA,EAAQ;AAAA,QACN,KAAA,EAAO;AAAA,UACL,SAAS,IAAA,CAAK;AAAA,SAChB;AAAA,QACA,EAAA,EAAI;AAAA,UACF,SAAS,IAAA,CAAK;AAAA;AAChB,OACF;AAAA,MAEA,QAAA,EAAU;AAAA,QACR,qBAAA,EAAuB;AAAA,OACzB;AAAA,MAEA,cAAA,EAAgB,kBAAA,CAAmB,OAAA,CAAQ,YAAA,CAAa,CAAC,CAAC,CAAA;AAAA,MAC1D,gBAAgB,OAAA,CAAQ,YAAA,CAAa,CAAC,CAAA,CAAE,KAAK,QAAA;AAAS;AACxD,GACF;AAAA,EACA,EAAE,KAAA,EAAO,EAAE,aAAa,CAAC,eAAe,GAAE;AAC5C,CAAA;AAEA,IAAO,eAAQ,OAAA,CAAQ;AAAA,EACrB,YAAY,MAAA,CAAO;AAAA,IACjB,GAAG,OAAA;AAAA,IACH,GAAA,EAAK,QAAA;AAAA,IACL,QAAA,EAAU;AAAA,MACR,GAAG,OAAA,CAAQ,QAAA;AAAA,MACX,MAAA,EAAQ;AAAA,QACN,4BAAA,EAA8B,KAAK,4BAAA,IAAgC;AAAA;AACrE;AACF,GACD;AACH,CAAC","file":"index.js","sourcesContent":["import { Chart, Namespace } from \"@highstate/k8s\"\nimport { k8s } from \"@highstate/library\"\nimport { forUnit, ResourceHook, secret, toPromise } from \"@highstate/pulumi\"\nimport { l3EndpointToString } from \"@highstate/common\"\nimport { CoreV1Api, KubeConfig } from \"@kubernetes/client-node\"\nimport { chart } from \"../shared\"\n\nconst { args, inputs, outputs } = forUnit(k8s.cilium)\n\nconst cluster = await toPromise(inputs.k8sCluster)\n\nconst afterCreateHook = new ResourceHook(\"restart-all-pods\", async () => {\n  // restart (delete) all pods to make Cilium manage their networking\n  const kubeConfig = new KubeConfig()\n  kubeConfig.loadFromString(cluster.kubeconfig)\n\n  const coreApi = kubeConfig.makeApiClient(CoreV1Api)\n  const allPods = await coreApi.listPodForAllNamespaces()\n\n  await Promise.all(\n    allPods.items.map(pod =>\n      coreApi.deleteNamespacedPod({\n        name: pod.metadata?.name!,\n        namespace: pod.metadata?.namespace!,\n      }),\n    ),\n  )\n})\n\nnew Chart(\n  \"cilium\",\n  {\n    namespace: Namespace.get(\"kube-system\", { name: \"kube-system\", cluster }),\n    chart,\n\n    values: {\n      ipam: {\n        mode: \"kubernetes\",\n      },\n\n      kubeProxyReplacement: \"true\",\n\n      operator: {\n        replicas: 1,\n      },\n\n      hubble: {\n        relay: {\n          enabled: args.enableHubble,\n        },\n        ui: {\n          enabled: args.enableHubble,\n        },\n      },\n\n      dnsProxy: {\n        dnsRejectResponseCode: \"nameError\",\n      },\n\n      k8sServiceHost: l3EndpointToString(cluster.apiEndpoints[0]),\n      k8sServicePort: cluster.apiEndpoints[0].port.toString(),\n    },\n  },\n  { hooks: { afterCreate: [afterCreateHook] } },\n)\n\nexport default outputs({\n  k8sCluster: secret({\n    ...cluster,\n    cni: \"cilium\",\n    metadata: {\n      ...cluster.metadata,\n      cilium: {\n        allowForbiddenFqdnResolution: args.allowForbiddenFqdnResolution ?? false,\n      },\n    } satisfies k8s.CiliumClusterMetadata,\n  }),\n})\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highstate/cilium",
-  "version": "0.9.18",
+  "version": "0.9.20",
   "type": "module",
   "files": [
     "dist",
@@ -22,18 +22,19 @@
     "generate-crds": "./scripts/generate-crds.sh"
   },
   "dependencies": {
-    "@highstate/cilium-crds": "^0.9.18",
-    "@highstate/common": "^0.9.18",
-    "@highstate/k8s": "^0.9.18",
-    "@highstate/library": "^0.9.18",
-    "@highstate/pulumi": "^0.9.18",
+    "@highstate/cilium-crds": "^0.9.20",
+    "@highstate/common": "^0.9.20",
+    "@highstate/k8s": "^0.9.20",
+    "@highstate/library": "^0.9.20",
+    "@highstate/pulumi": "^0.9.20",
+    "@kubernetes/client-node": "^1.3.0",
     "@pulumi/command": "^1.0.2",
     "@pulumi/kubernetes": "^4.18.0",
     "@pulumi/pulumi": "^3.184.0",
     "remeda": "^2.21.0"
   },
   "devDependencies": {
-    "@highstate/cli": "^0.9.18"
+    "@highstate/cli": "^0.9.20"
   },
-  "gitHead": "9ebcd7da56b00b8ca08bf52cc8438f527338cd64"
+  "gitHead": "4bf9183450c2c6f51d6a99d77efc379ff5c7b7ef"
 }

package/src/{network-policy.ts → impl/network-policy.ts}

@@ -1,30 +1,34 @@
-import type { k8s } from "@highstate/library"
-import { type ResourceOptions, type Resource, output } from "@highstate/pulumi"
+import { k8s } from "@highstate/library"
+import { ComponentResource, output, type ResourceOptions } from "@highstate/pulumi"
 import {
+  getNamespaceName,
   mapMetadata,
-  mapNamespaceLikeToNamespaceName,
   mapSelectorLikeToSelector,
   mapServiceToLabelSelector,
-  NetworkPolicy,
+  networkPolicyMediator,
   type NetworkPolicyPort,
   type NormalizedNetworkPolicyArgs,
   type NormalizedRuleArgs,
 } from "@highstate/k8s"
-import { cilium, types } from "@highstate/cilium-crds"
-import { types as k8sTypes } from "@pulumi/kubernetes"
+import { cilium, type types } from "@highstate/cilium-crds"
+import type { types as k8sTypes } from "@pulumi/kubernetes"
 import { map, mapKeys, pipe, uniqueBy } from "remeda"
-import { getCiliumClusterMetadata } from "./shared"
+import { check } from "@highstate/contract"
+import { implementationReferenceSchema } from "@highstate/library"
 
 type Rule = types.input.cilium.v2.CiliumNetworkPolicySpecIngress &
   types.input.cilium.v2.CiliumNetworkPolicySpecEgress
 
-export class CiliumNetworkPolicy extends NetworkPolicy {
-  protected create(
-    name: string,
-    args: NormalizedNetworkPolicyArgs,
-    opts?: ResourceOptions,
-  ): Resource {
-    return new cilium.v2.CiliumNetworkPolicy(
+class CiliumNetworkPolicy extends ComponentResource {
+  /**
+   * The underlying Cilium network policy resource.
+   */
+  public readonly networkPolicy: cilium.v2.CiliumNetworkPolicy
+
+  constructor(name: string, args: NormalizedNetworkPolicyArgs, opts?: ResourceOptions) {
+    super("highstate:cilium:NetworkPolicy", name, args, opts)
+
+    this.networkPolicy = new cilium.v2.CiliumNetworkPolicy(
       name,
       {
         metadata: mapMetadata(args, name),
@@ -35,7 +39,7 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
           egress: CiliumNetworkPolicy.createEgressRules(args),
         },
       },
-      opts,
+      { ...opts, parent: this },
     )
   }
 
@@ -153,9 +157,11 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
           {
             ports: [{ port: "53", protocol: "UDP" }],
             rules: {
-              dns: getCiliumClusterMetadata(cluster).allowForbiddenFqdnResolution
-                ? [{ matchPattern: "*" }]
-                : fqdnRules,
+              dns:
+                check(k8s.ciliumClusterMetadata, cluster.metadata) &&
+                cluster.metadata.cilium.allowForbiddenFqdnResolution
+                  ? [{ matchPattern: "*" }]
+                  : fqdnRules,
             },
           },
         ],
@@ -198,18 +204,13 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
       return []
     }
 
-    return pipe(
-      //
-      rule.namespaces,
-      map(mapNamespaceLikeToNamespaceName),
-      names => [
-        {
-          key: "k8s:io.kubernetes.pod.namespace",
-          operator: "In",
-          values: names,
-        },
-      ],
-    )
+    return pipe(rule.namespaces, map(getNamespaceName), names => [
+      {
+        key: "k8s:io.kubernetes.pod.namespace",
+        operator: "In",
+        values: names,
+      },
+    ])
   }
 
   private static createSelectorRules(
@@ -285,3 +286,10 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
     }
   }
 }
+
+export const createNetworkPolicy = networkPolicyMediator.implement(
+  implementationReferenceSchema,
+  ({ name, args }) => {
+    return new CiliumNetworkPolicy(name, args)
+  },
+)

package/src/index.ts

@@ -1,2 +1,4 @@
-export { CiliumNetworkPolicy } from "./network-policy"
 export { chart } from "./shared"
+
+// Implementations
+import "./impl/network-policy"

package/src/shared.ts

@@ -1,24 +1 @@
-import type { k8s } from "@highstate/library"
-
 export { cilium as chart } from "../assets/charts.json"
-
-export type CiliumClusterMetadata = {
-  /**
-   * If set to `true`, the generated network policy will allow
-   * all DNS queries to be resolved, even if they are
-   * for forbidden (non-allowed) FQDNs.
-   *
-   * By default, is not set.
-   */
-  allowForbiddenFqdnResolution?: boolean
-}
-
-export function getCiliumClusterMetadata(cluster: k8s.Cluster): CiliumClusterMetadata {
-  return cluster.metadata?.cilium ?? {}
-}
-
-export function hasCiliumClusterMetadata(
-  cluster: k8s.Cluster,
-): cluster is k8s.Cluster & { metadata: { cilium: CiliumClusterMetadata } } {
-  return Boolean(cluster.metadata?.cilium)
-}

package/src/unit/index.ts

@@ -1,47 +1,68 @@
-import { Chart } from "@highstate/k8s"
+import { Chart, Namespace } from "@highstate/k8s"
 import { k8s } from "@highstate/library"
-import { forUnit, secret, toPromise } from "@highstate/pulumi"
+import { forUnit, ResourceHook, secret, toPromise } from "@highstate/pulumi"
 import { l3EndpointToString } from "@highstate/common"
-import { chart, type CiliumClusterMetadata } from "../shared"
+import { CoreV1Api, KubeConfig } from "@kubernetes/client-node"
+import { chart } from "../shared"
 
 const { args, inputs, outputs } = forUnit(k8s.cilium)
 
 const cluster = await toPromise(inputs.k8sCluster)
 
-new Chart("cilium", {
-  cluster,
-  namespace: "kube-system",
+const afterCreateHook = new ResourceHook("restart-all-pods", async () => {
+  // restart (delete) all pods to make Cilium manage their networking
+  const kubeConfig = new KubeConfig()
+  kubeConfig.loadFromString(cluster.kubeconfig)
 
-  chart,
+  const coreApi = kubeConfig.makeApiClient(CoreV1Api)
+  const allPods = await coreApi.listPodForAllNamespaces()
 
-  values: {
-    ipam: {
-      mode: "kubernetes",
-    },
+  await Promise.all(
+    allPods.items.map(pod =>
+      coreApi.deleteNamespacedPod({
+        name: pod.metadata?.name!,
+        namespace: pod.metadata?.namespace!,
+      }),
+    ),
+  )
+})
 
-    kubeProxyReplacement: "true",
+new Chart(
+  "cilium",
+  {
+    namespace: Namespace.get("kube-system", { name: "kube-system", cluster }),
+    chart,
 
-    operator: {
-      replicas: 1,
-    },
+    values: {
+      ipam: {
+        mode: "kubernetes",
+      },
 
-    hubble: {
-      relay: {
-        enabled: true,
+      kubeProxyReplacement: "true",
+
+      operator: {
+        replicas: 1,
       },
-      ui: {
-        enabled: true,
+
+      hubble: {
+        relay: {
+          enabled: args.enableHubble,
+        },
+        ui: {
+          enabled: args.enableHubble,
+        },
       },
-    },
 
-    dnsProxy: {
-      dnsRejectResponseCode: "nameError",
-    },
+      dnsProxy: {
+        dnsRejectResponseCode: "nameError",
+      },
 
-    k8sServiceHost: l3EndpointToString(cluster.apiEndpoints[0]),
-    k8sServicePort: cluster.apiEndpoints[0].port.toString(),
+      k8sServiceHost: l3EndpointToString(cluster.apiEndpoints[0]),
+      k8sServicePort: cluster.apiEndpoints[0].port.toString(),
+    },
   },
-})
+  { hooks: { afterCreate: [afterCreateHook] } },
+)
 
 export default outputs({
   k8sCluster: secret({
@@ -50,8 +71,8 @@ export default outputs({
     metadata: {
       ...cluster.metadata,
       cilium: {
-        allowForbiddenFqdnResolution: args.allowForbiddenFqdnResolution,
-      } satisfies CiliumClusterMetadata,
-    },
+        allowForbiddenFqdnResolution: args.allowForbiddenFqdnResolution ?? false,
+      },
+    } satisfies k8s.CiliumClusterMetadata,
   }),
 })

package/dist/chunk-M4DV2DAJ.js

@@ -1,16 +0,0 @@
-// assets/charts.json
-var cilium = {
-  repo: "https://helm.cilium.io",
-  name: "cilium",
-  version: "1.17.4",
-  sha256: "06dcedfe25c08c770d193690d561037153e233f9cde31e0705a06802d24cea87"
-};
-
-// src/shared.ts
-function getCiliumClusterMetadata(cluster) {
-  return cluster.metadata?.cilium ?? {};
-}
-
-export { cilium, getCiliumClusterMetadata };
-//# sourceMappingURL=chunk-M4DV2DAJ.js.map
-//# sourceMappingURL=chunk-M4DV2DAJ.js.map

package/dist/chunk-M4DV2DAJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../assets/charts.json","../src/shared.ts"],"names":[],"mappings":";AACE,IAAA,MAAA,GAAU;AAAA,EACR,IAAA,EAAQ,wBAAA;AAAA,EACR,IAAA,EAAQ,QAAA;AAAA,EACR,OAAA,EAAW,QAAA;AAAA,EACX,MAAA,EAAU;AACZ;;;ACSK,SAAS,yBAAyB,OAAA,EAA6C;AACpF,EAAA,OAAO,OAAA,CAAQ,QAAA,EAAU,MAAA,IAAU,EAAC;AACtC","file":"chunk-M4DV2DAJ.js","sourcesContent":["{\n  \"cilium\": {\n    \"repo\": \"https://helm.cilium.io\",\n    \"name\": \"cilium\",\n    \"version\": \"1.17.4\",\n    \"sha256\": \"06dcedfe25c08c770d193690d561037153e233f9cde31e0705a06802d24cea87\"\n  }\n}\n","import type { k8s } from \"@highstate/library\"\n\nexport { cilium as chart } from \"../assets/charts.json\"\n\nexport type CiliumClusterMetadata = {\n  /**\n   * If set to `true`, the generated network policy will allow\n   * all DNS queries to be resolved, even if they are\n   * for forbidden (non-allowed) FQDNs.\n   *\n   * By default, is not set.\n   */\n  allowForbiddenFqdnResolution?: boolean\n}\n\nexport function getCiliumClusterMetadata(cluster: k8s.Cluster): CiliumClusterMetadata {\n  return cluster.metadata?.cilium ?? {}\n}\n\nexport function hasCiliumClusterMetadata(\n  cluster: k8s.Cluster,\n): cluster is k8s.Cluster & { metadata: { cilium: CiliumClusterMetadata } } {\n  return Boolean(cluster.metadata?.cilium)\n}\n"]}