@highstate/cilium 0.9.9 → 0.9.11

package/dist/chunk-M4DV2DAJ.js

@@ -0,0 +1,18 @@
+// assets/charts.json
+var cilium = {
+  repo: "https://helm.cilium.io",
+  name: "cilium",
+  version: "1.17.4",
+  sha256: "06dcedfe25c08c770d193690d561037153e233f9cde31e0705a06802d24cea87"
+};
+
+// src/shared.ts
+function getCiliumClusterMetadata(cluster) {
+  return cluster.metadata?.cilium ?? {};
+}
+
+export {
+  cilium,
+  getCiliumClusterMetadata
+};
+//# sourceMappingURL=chunk-M4DV2DAJ.js.map

package/dist/chunk-M4DV2DAJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../assets/charts.json","../src/shared.ts"],"sourcesContent":["{\n  \"cilium\": {\n    \"repo\": \"https://helm.cilium.io\",\n    \"name\": \"cilium\",\n    \"version\": \"1.17.4\",\n    \"sha256\": \"06dcedfe25c08c770d193690d561037153e233f9cde31e0705a06802d24cea87\"\n  }\n}\n","import type { k8s } from \"@highstate/library\"\n\nexport { cilium as chart } from \"../assets/charts.json\"\n\nexport type CiliumClusterMetadata = {\n  /**\n   * If set to `true`, the generated network policy will allow\n   * all DNS queries to be resolved, even if they are\n   * for forbidden (non-allowed) FQDNs.\n   *\n   * By default, is not set.\n   */\n  allowForbiddenFqdnResolution?: boolean\n}\n\nexport function getCiliumClusterMetadata(cluster: k8s.Cluster): CiliumClusterMetadata {\n  return cluster.metadata?.cilium ?? {}\n}\n\nexport function hasCiliumClusterMetadata(\n  cluster: k8s.Cluster,\n): cluster is k8s.Cluster & { metadata: { cilium: CiliumClusterMetadata } } {\n  return Boolean(cluster.metadata?.cilium)\n}\n"],"mappings":";AACE,aAAU;AAAA,EACR,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,QAAU;AACZ;;;ACSK,SAAS,yBAAyB,SAA6C;AACpF,SAAO,QAAQ,UAAU,UAAU,CAAC;AACtC;","names":[]}

package/dist/highstate.manifest.json

@@ -1,5 +1,6 @@
 {
   "sourceHashes": {
-    "./dist/index.js": "c261cfe847f6e51f8cb0aa2834c9bcdc348b80b83c2c1b5140b16057d6ed53cf"
+    "./dist/index.js": "80797b7d18c03770033c08b8022740afa970339ab64f319f3f5362d9a5104d2d",
+    "./dist/unit/index.js": "7389086e95165fdc5c418fa499211b38c655e940e20338cee2f3588b18edf760"
   }
 }

package/dist/index.js

@@ -1,3 +1,8 @@
+import {
+  cilium,
+  getCiliumClusterMetadata
+} from "./chunk-M4DV2DAJ.js";
+
 // src/network-policy.ts
 import { output } from "@highstate/pulumi";
 import {
@@ -7,12 +12,12 @@ import {
   mapServiceToLabelSelector,
   NetworkPolicy
 } from "@highstate/k8s";
-import { cilium } from "@highstate/cilium-crds";
+import { cilium as cilium2 } from "@highstate/cilium-crds";
 import "@pulumi/kubernetes";
 import { map, mapKeys, pipe, uniqueBy } from "remeda";
 var CiliumNetworkPolicy = class _CiliumNetworkPolicy extends NetworkPolicy {
   create(name, args, opts) {
-    return new cilium.v2.CiliumNetworkPolicy(
+    return new cilium2.v2.CiliumNetworkPolicy(
       name,
       {
         metadata: mapMetadata(args, name),
@@ -31,7 +36,9 @@ var CiliumNetworkPolicy = class _CiliumNetworkPolicy extends NetworkPolicy {
       return [{}];
     }
     return uniqueBy(
-      args.ingressRules.flatMap((rule) => _CiliumNetworkPolicy.createRules("from", rule)),
+      args.ingressRules.flatMap(
+        (rule) => _CiliumNetworkPolicy.createRules("from", rule, args.cluster)
+      ),
       (rule) => JSON.stringify(rule)
     );
   }
@@ -44,11 +51,11 @@ var CiliumNetworkPolicy = class _CiliumNetworkPolicy extends NetworkPolicy {
       extraRules.push({ toEntities: ["kube-apiserver"] });
     }
     return uniqueBy(
-      args.egressRules.flatMap((rule) => _CiliumNetworkPolicy.createRules("to", rule)).concat(extraRules),
+      args.egressRules.flatMap((rule) => _CiliumNetworkPolicy.createRules("to", rule, args.cluster)).concat(extraRules),
       (rule) => JSON.stringify(rule)
     );
   }
-  static createRules(prefix, rule) {
+  static createRules(prefix, rule, cluster) {
     const port = _CiliumNetworkPolicy.mapPorts(rule.ports);
     const ports = port ? [port] : void 0;
     return [
@@ -56,7 +63,7 @@ var CiliumNetworkPolicy = class _CiliumNetworkPolicy extends NetworkPolicy {
       ..._CiliumNetworkPolicy.createCidrRules(prefix, rule, ports),
       ..._CiliumNetworkPolicy.createServiceRules(prefix, rule, ports),
       ..._CiliumNetworkPolicy.createSelectorRules(prefix, rule, ports),
-      ...prefix === "to" ? _CiliumNetworkPolicy.createFqdnRules(rule, ports) : []
+      ...prefix === "to" ? _CiliumNetworkPolicy.createFqdnRules(rule, ports, cluster) : []
     ];
   }
   static createAllRules(prefix, rule, ports) {
@@ -81,7 +88,7 @@ var CiliumNetworkPolicy = class _CiliumNetworkPolicy extends NetworkPolicy {
       }
     ];
   }
-  static createFqdnRules(rule, ports) {
+  static createFqdnRules(rule, ports, cluster) {
     if (rule.fqdns.length === 0) {
       return [];
     }
@@ -105,7 +112,9 @@ var CiliumNetworkPolicy = class _CiliumNetworkPolicy extends NetworkPolicy {
         toPorts: [
           {
             ports: [{ port: "53", protocol: "UDP" }],
-            rules: { dns: fqdnRules }
+            rules: {
+              dns: getCiliumClusterMetadata(cluster).allowForbiddenFqdnResolution ? [{ matchPattern: "*" }] : fqdnRules
+            }
           }
         ]
       }
@@ -177,7 +186,7 @@ var CiliumNetworkPolicy = class _CiliumNetworkPolicy extends NetworkPolicy {
     });
     return [
       {
-        [`${prefix}Endpoints`]: selectors,
+        [`${prefix}Endpoints`]: uniqueBy(selectors, (rule2) => JSON.stringify(rule2)),
         toPorts: ports
       }
     ];
@@ -203,16 +212,8 @@ var CiliumNetworkPolicy = class _CiliumNetworkPolicy extends NetworkPolicy {
     };
   }
 };
-
-// assets/charts.json
-var cilium2 = {
-  repo: "https://helm.cilium.io",
-  name: "cilium",
-  version: "1.17.4",
-  sha256: "06dcedfe25c08c770d193690d561037153e233f9cde31e0705a06802d24cea87"
-};
 export {
   CiliumNetworkPolicy,
-  cilium2 as chart
+  cilium as chart
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/network-policy.ts","../assets/charts.json"],"sourcesContent":["import { type ResourceOptions, type Resource, output } from \"@highstate/pulumi\"\nimport {\n  mapMetadata,\n  mapNamespaceLikeToNamespaceName,\n  mapSelectorLikeToSelector,\n  mapServiceToLabelSelector,\n  NetworkPolicy,\n  type NetworkPolicyPort,\n  type NormalizedNetworkPolicyArgs,\n  type NormalizedRuleArgs,\n} from \"@highstate/k8s\"\nimport { cilium, types } from \"@highstate/cilium-crds\"\nimport { types as k8sTypes } from \"@pulumi/kubernetes\"\nimport { map, mapKeys, pipe, uniqueBy } from \"remeda\"\n\ntype Rule = types.input.cilium.v2.CiliumNetworkPolicySpecIngress &\n  types.input.cilium.v2.CiliumNetworkPolicySpecEgress\n\nexport class CiliumNetworkPolicy extends NetworkPolicy {\n  protected create(\n    name: string,\n    args: NormalizedNetworkPolicyArgs,\n    opts?: ResourceOptions,\n  ): Resource {\n    return new cilium.v2.CiliumNetworkPolicy(\n      name,\n      {\n        metadata: mapMetadata(args, name),\n        spec: {\n          description: args.description,\n          endpointSelector: args.podSelector,\n          ingress: CiliumNetworkPolicy.createIngressRules(args),\n          egress: CiliumNetworkPolicy.createEgressRules(args),\n        },\n      },\n      opts,\n    )\n  }\n\n  private static createIngressRules(args: NormalizedNetworkPolicyArgs): Rule[] {\n    if (args.isolateIngress) {\n      return [{}]\n    }\n\n    return uniqueBy(\n      args.ingressRules.flatMap(rule => CiliumNetworkPolicy.createRules(\"from\", rule)),\n      rule => JSON.stringify(rule),\n    )\n  }\n\n  private static createEgressRules(args: NormalizedNetworkPolicyArgs): Rule[] {\n    if (args.isolateEgress) {\n      return [{}]\n    }\n\n    const extraRules: Rule[] = []\n\n    if (args.allowKubeApiServer) {\n      extraRules.push({ toEntities: [\"kube-apiserver\"] })\n    }\n\n    return uniqueBy(\n      args.egressRules\n        .flatMap(rule => CiliumNetworkPolicy.createRules(\"to\", rule))\n        .concat(extraRules),\n      rule => JSON.stringify(rule),\n    )\n  }\n\n  private static createRules(prefix: \"from\" | \"to\", rule: NormalizedRuleArgs): Rule[] {\n    const port = CiliumNetworkPolicy.mapPorts(rule.ports)\n    const ports = port ? [port] : undefined\n\n    return [\n      ...CiliumNetworkPolicy.createAllRules(prefix, rule, ports),\n      ...CiliumNetworkPolicy.createCidrRules(prefix, rule, ports),\n      ...CiliumNetworkPolicy.createServiceRules(prefix, rule, ports),\n      ...CiliumNetworkPolicy.createSelectorRules(prefix, rule, ports),\n      ...(prefix === \"to\" ? CiliumNetworkPolicy.createFqdnRules(rule, ports) : []),\n    ]\n  }\n\n  private static createAllRules(\n    prefix: \"from\" | \"to\",\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n  ): Rule[] {\n    if (!rule.all) {\n      return []\n    }\n\n    return [\n      {\n        [`${prefix}Entities`]: [\"all\"],\n        toPorts: ports,\n      },\n    ]\n  }\n\n  private static createCidrRules(\n    prefix: \"from\" | \"to\",\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n  ): Rule[] {\n    if (rule.cidrs.length === 0) {\n      return []\n    }\n\n    return [\n      {\n        [`${prefix}CIDR`]: rule.cidrs,\n        toPorts: ports,\n      },\n    ]\n  }\n\n  private static createFqdnRules(\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n  ): types.input.cilium.v2.CiliumNetworkPolicySpecEgress[] {\n    if (rule.fqdns.length === 0) {\n      return []\n    }\n\n    const fqdnRules = rule.fqdns.map(fqdn => {\n      return fqdn.includes(\"*\") ? { matchPattern: fqdn } : { matchName: fqdn }\n    })\n\n    return [\n      {\n        toFQDNs: fqdnRules,\n        toPorts: ports,\n      },\n      {\n        toEndpoints: [\n          {\n            matchLabels: {\n              \"k8s:io.kubernetes.pod.namespace\": \"kube-system\",\n              \"k8s:k8s-app\": \"kube-dns\",\n            },\n          },\n        ],\n        toPorts: [\n          {\n            ports: [{ port: \"53\", protocol: \"UDP\" }],\n            rules: { dns: fqdnRules },\n          },\n        ],\n      },\n    ]\n  }\n\n  private static createServiceRules(\n    prefix: \"from\" | \"to\",\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n  ): Rule[] {\n    if (rule.services.length === 0) {\n      return []\n    }\n\n    const selectors = rule.services.map(service => {\n      const selector = mapServiceToLabelSelector(service)\n\n      return output(selector).apply(selector => ({\n        matchLabels: {\n          ...mapKeys(selector.matchLabels ?? {}, key => `k8s:${key}`),\n          \"k8s:io.kubernetes.pod.namespace\": service.metadata.namespace,\n        },\n      }))\n    })\n\n    return [\n      {\n        [`${prefix}Endpoints`]: selectors,\n        toPorts: ports,\n      },\n    ]\n  }\n\n  private static createNamespaceExpressions(\n    rule: NormalizedRuleArgs,\n  ): k8sTypes.input.meta.v1.LabelSelectorRequirement[] {\n    if (rule.namespaces.length === 0) {\n      return []\n    }\n\n    return pipe(\n      //\n      rule.namespaces,\n      map(mapNamespaceLikeToNamespaceName),\n      names => [\n        {\n          key: \"k8s:io.kubernetes.pod.namespace\",\n          operator: \"In\",\n          values: names,\n        },\n      ],\n    )\n  }\n\n  private static createSelectorRules(\n    prefix: \"from\" | \"to\",\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n  ): types.input.cilium.v2.CiliumNetworkPolicySpecIngress[] {\n    const namespaceExpressions = CiliumNetworkPolicy.createNamespaceExpressions(rule)\n\n    if (rule.selectors.length === 0) {\n      if (namespaceExpressions.length === 0) {\n        // if no selectors and no namespaces are provided, we do not match\n        return []\n      }\n\n      // if no selectors are provided, we only match on namespaces\n      return [\n        {\n          [`${prefix}Endpoints`]: [{ matchExpressions: namespaceExpressions }],\n          toPorts: ports,\n        },\n      ]\n    }\n\n    // otherwise, we match on selectors and namespaces\n    const selectors = rule.selectors.map(selector => {\n      const rawSelector = mapSelectorLikeToSelector(selector)\n\n      return output(rawSelector).apply(rawSelector => {\n        const expressions = map(rawSelector.matchExpressions ?? [], expression => ({\n          key: `k8s:${expression.key}`,\n          operator: expression.operator,\n          values: expression.values,\n        }))\n\n        return {\n          matchLabels: mapKeys(rawSelector.matchLabels ?? {}, key => `k8s:${key}`),\n          matchExpressions: [...expressions, ...namespaceExpressions],\n        }\n      })\n    })\n\n    return [\n      {\n        [`${prefix}Endpoints`]: selectors,\n        toPorts: ports,\n      },\n    ]\n  }\n\n  private static mapPorts(\n    ports: NetworkPolicyPort[],\n  ): types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts | undefined {\n    if (ports.length === 0) {\n      return\n    }\n\n    return {\n      ports: ports.map(port => {\n        if (\"port\" in port) {\n          return {\n            port: port.port.toString(),\n            protocol: port.protocol ?? \"TCP\",\n          }\n        }\n\n        return {\n          port: port.range[0].toString(),\n          endPort: port.range[1],\n          protocol: port.protocol ?? \"TCP\",\n        }\n      }),\n    }\n  }\n}\n","{\n  \"cilium\": {\n    \"repo\": \"https://helm.cilium.io\",\n    \"name\": \"cilium\",\n    \"version\": \"1.17.4\",\n    \"sha256\": \"06dcedfe25c08c770d193690d561037153e233f9cde31e0705a06802d24cea87\"\n  }\n}\n"],"mappings":";AAAA,SAA8C,cAAc;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,cAAqB;AAC9B,OAAkC;AAClC,SAAS,KAAK,SAAS,MAAM,gBAAgB;AAKtC,IAAM,sBAAN,MAAM,6BAA4B,cAAc;AAAA,EAC3C,OACR,MACA,MACA,MACU;AACV,WAAO,IAAI,OAAO,GAAG;AAAA,MACnB;AAAA,MACA;AAAA,QACE,UAAU,YAAY,MAAM,IAAI;AAAA,QAChC,MAAM;AAAA,UACJ,aAAa,KAAK;AAAA,UAClB,kBAAkB,KAAK;AAAA,UACvB,SAAS,qBAAoB,mBAAmB,IAAI;AAAA,UACpD,QAAQ,qBAAoB,kBAAkB,IAAI;AAAA,QACpD;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,mBAAmB,MAA2C;AAC3E,QAAI,KAAK,gBAAgB;AACvB,aAAO,CAAC,CAAC,CAAC;AAAA,IACZ;AAEA,WAAO;AAAA,MACL,KAAK,aAAa,QAAQ,UAAQ,qBAAoB,YAAY,QAAQ,IAAI,CAAC;AAAA,MAC/E,UAAQ,KAAK,UAAU,IAAI;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,OAAe,kBAAkB,MAA2C;AAC1E,QAAI,KAAK,eAAe;AACtB,aAAO,CAAC,CAAC,CAAC;AAAA,IACZ;AAEA,UAAM,aAAqB,CAAC;AAE5B,QAAI,KAAK,oBAAoB;AAC3B,iBAAW,KAAK,EAAE,YAAY,CAAC,gBAAgB,EAAE,CAAC;AAAA,IACpD;AAEA,WAAO;AAAA,MACL,KAAK,YACF,QAAQ,UAAQ,qBAAoB,YAAY,MAAM,IAAI,CAAC,EAC3D,OAAO,UAAU;AAAA,MACpB,UAAQ,KAAK,UAAU,IAAI;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,OAAe,YAAY,QAAuB,MAAkC;AAClF,UAAM,OAAO,qBAAoB,SAAS,KAAK,KAAK;AACpD,UAAM,QAAQ,OAAO,CAAC,IAAI,IAAI;AAE9B,WAAO;AAAA,MACL,GAAG,qBAAoB,eAAe,QAAQ,MAAM,KAAK;AAAA,MACzD,GAAG,qBAAoB,gBAAgB,QAAQ,MAAM,KAAK;AAAA,MAC1D,GAAG,qBAAoB,mBAAmB,QAAQ,MAAM,KAAK;AAAA,MAC7D,GAAG,qBAAoB,oBAAoB,QAAQ,MAAM,KAAK;AAAA,MAC9D,GAAI,WAAW,OAAO,qBAAoB,gBAAgB,MAAM,KAAK,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF;AAAA,EAEA,OAAe,eACb,QACA,MACA,OACQ;AACR,QAAI,CAAC,KAAK,KAAK;AACb,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,UAAU,GAAG,CAAC,KAAK;AAAA,QAC7B,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,gBACb,QACA,MACA,OACQ;AACR,QAAI,KAAK,MAAM,WAAW,GAAG;AAC3B,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,MAAM,GAAG,KAAK;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,gBACb,MACA,OACuD;AACvD,QAAI,KAAK,MAAM,WAAW,GAAG;AAC3B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,YAAY,KAAK,MAAM,IAAI,UAAQ;AACvC,aAAO,KAAK,SAAS,GAAG,IAAI,EAAE,cAAc,KAAK,IAAI,EAAE,WAAW,KAAK;AAAA,IACzE,CAAC;AAED,WAAO;AAAA,MACL;AAAA,QACE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,aAAa;AAAA,UACX;AAAA,YACE,aAAa;AAAA,cACX,mCAAmC;AAAA,cACnC,eAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AAAA,QACA,SAAS;AAAA,UACP;AAAA,YACE,OAAO,CAAC,EAAE,MAAM,MAAM,UAAU,MAAM,CAAC;AAAA,YACvC,OAAO,EAAE,KAAK,UAAU;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,mBACb,QACA,MACA,OACQ;AACR,QAAI,KAAK,SAAS,WAAW,GAAG;AAC9B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,YAAY,KAAK,SAAS,IAAI,aAAW;AAC7C,YAAM,WAAW,0BAA0B,OAAO;AAElD,aAAO,OAAO,QAAQ,EAAE,MAAM,CAAAA,eAAa;AAAA,QACzC,aAAa;AAAA,UACX,GAAG,QAAQA,UAAS,eAAe,CAAC,GAAG,SAAO,OAAO,GAAG,EAAE;AAAA,UAC1D,mCAAmC,QAAQ,SAAS;AAAA,QACtD;AAAA,MACF,EAAE;AAAA,IACJ,CAAC;AAED,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,WAAW,GAAG;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,2BACb,MACmD;AACnD,QAAI,KAAK,WAAW,WAAW,GAAG;AAChC,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA;AAAA,MAEL,KAAK;AAAA,MACL,IAAI,+BAA+B;AAAA,MACnC,WAAS;AAAA,QACP;AAAA,UACE,KAAK;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,oBACb,QACA,MACA,OACwD;AACxD,UAAM,uBAAuB,qBAAoB,2BAA2B,IAAI;AAEhF,QAAI,KAAK,UAAU,WAAW,GAAG;AAC/B,UAAI,qBAAqB,WAAW,GAAG;AAErC,eAAO,CAAC;AAAA,MACV;AAGA,aAAO;AAAA,QACL;AAAA,UACE,CAAC,GAAG,MAAM,WAAW,GAAG,CAAC,EAAE,kBAAkB,qBAAqB,CAAC;AAAA,UACnE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,KAAK,UAAU,IAAI,cAAY;AAC/C,YAAM,cAAc,0BAA0B,QAAQ;AAEtD,aAAO,OAAO,WAAW,EAAE,MAAM,CAAAC,iBAAe;AAC9C,cAAM,cAAc,IAAIA,aAAY,oBAAoB,CAAC,GAAG,iBAAe;AAAA,UACzE,KAAK,OAAO,WAAW,GAAG;AAAA,UAC1B,UAAU,WAAW;AAAA,UACrB,QAAQ,WAAW;AAAA,QACrB,EAAE;AAEF,eAAO;AAAA,UACL,aAAa,QAAQA,aAAY,eAAe,CAAC,GAAG,SAAO,OAAO,GAAG,EAAE;AAAA,UACvE,kBAAkB,CAAC,GAAG,aAAa,GAAG,oBAAoB;AAAA,QAC5D;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,WAAW,GAAG;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,SACb,OACwE;AACxE,QAAI,MAAM,WAAW,GAAG;AACtB;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,MAAM,IAAI,UAAQ;AACvB,YAAI,UAAU,MAAM;AAClB,iBAAO;AAAA,YACL,MAAM,KAAK,KAAK,SAAS;AAAA,YACzB,UAAU,KAAK,YAAY;AAAA,UAC7B;AAAA,QACF;AAEA,eAAO;AAAA,UACL,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS;AAAA,UAC7B,SAAS,KAAK,MAAM,CAAC;AAAA,UACrB,UAAU,KAAK,YAAY;AAAA,QAC7B;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AChRE,IAAAC,UAAU;AAAA,EACR,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,QAAU;AACZ;","names":["selector","rawSelector","cilium"]}
+{"version":3,"sources":["../src/network-policy.ts"],"sourcesContent":["import type { k8s } from \"@highstate/library\"\nimport { type ResourceOptions, type Resource, output } from \"@highstate/pulumi\"\nimport {\n  mapMetadata,\n  mapNamespaceLikeToNamespaceName,\n  mapSelectorLikeToSelector,\n  mapServiceToLabelSelector,\n  NetworkPolicy,\n  type NetworkPolicyPort,\n  type NormalizedNetworkPolicyArgs,\n  type NormalizedRuleArgs,\n} from \"@highstate/k8s\"\nimport { cilium, types } from \"@highstate/cilium-crds\"\nimport { types as k8sTypes } from \"@pulumi/kubernetes\"\nimport { map, mapKeys, pipe, uniqueBy } from \"remeda\"\nimport { getCiliumClusterMetadata } from \"./shared\"\n\ntype Rule = types.input.cilium.v2.CiliumNetworkPolicySpecIngress &\n  types.input.cilium.v2.CiliumNetworkPolicySpecEgress\n\nexport class CiliumNetworkPolicy extends NetworkPolicy {\n  protected create(\n    name: string,\n    args: NormalizedNetworkPolicyArgs,\n    opts?: ResourceOptions,\n  ): Resource {\n    return new cilium.v2.CiliumNetworkPolicy(\n      name,\n      {\n        metadata: mapMetadata(args, name),\n        spec: {\n          description: args.description,\n          endpointSelector: args.podSelector,\n          ingress: CiliumNetworkPolicy.createIngressRules(args),\n          egress: CiliumNetworkPolicy.createEgressRules(args),\n        },\n      },\n      opts,\n    )\n  }\n\n  private static createIngressRules(args: NormalizedNetworkPolicyArgs): Rule[] {\n    if (args.isolateIngress) {\n      return [{}]\n    }\n\n    return uniqueBy(\n      args.ingressRules.flatMap(rule =>\n        CiliumNetworkPolicy.createRules(\"from\", rule, args.cluster),\n      ),\n      rule => JSON.stringify(rule),\n    )\n  }\n\n  private static createEgressRules(args: NormalizedNetworkPolicyArgs): Rule[] {\n    if (args.isolateEgress) {\n      return [{}]\n    }\n\n    const extraRules: Rule[] = []\n\n    if (args.allowKubeApiServer) {\n      extraRules.push({ toEntities: [\"kube-apiserver\"] })\n    }\n\n    return uniqueBy(\n      args.egressRules\n        .flatMap(rule => CiliumNetworkPolicy.createRules(\"to\", rule, args.cluster))\n        .concat(extraRules),\n      rule => JSON.stringify(rule),\n    )\n  }\n\n  private static createRules(\n    prefix: \"from\" | \"to\",\n    rule: NormalizedRuleArgs,\n    cluster: k8s.Cluster,\n  ): Rule[] {\n    const port = CiliumNetworkPolicy.mapPorts(rule.ports)\n    const ports = port ? [port] : undefined\n\n    return [\n      ...CiliumNetworkPolicy.createAllRules(prefix, rule, ports),\n      ...CiliumNetworkPolicy.createCidrRules(prefix, rule, ports),\n      ...CiliumNetworkPolicy.createServiceRules(prefix, rule, ports),\n      ...CiliumNetworkPolicy.createSelectorRules(prefix, rule, ports),\n      ...(prefix === \"to\" ? CiliumNetworkPolicy.createFqdnRules(rule, ports, cluster) : []),\n    ]\n  }\n\n  private static createAllRules(\n    prefix: \"from\" | \"to\",\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n  ): Rule[] {\n    if (!rule.all) {\n      return []\n    }\n\n    return [\n      {\n        [`${prefix}Entities`]: [\"all\"],\n        toPorts: ports,\n      },\n    ]\n  }\n\n  private static createCidrRules(\n    prefix: \"from\" | \"to\",\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n  ): Rule[] {\n    if (rule.cidrs.length === 0) {\n      return []\n    }\n\n    return [\n      {\n        [`${prefix}CIDR`]: rule.cidrs,\n        toPorts: ports,\n      },\n    ]\n  }\n\n  private static createFqdnRules(\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n    cluster: k8s.Cluster,\n  ): types.input.cilium.v2.CiliumNetworkPolicySpecEgress[] {\n    if (rule.fqdns.length === 0) {\n      return []\n    }\n\n    const fqdnRules = rule.fqdns.map(fqdn => {\n      return fqdn.includes(\"*\") ? { matchPattern: fqdn } : { matchName: fqdn }\n    })\n\n    return [\n      {\n        toFQDNs: fqdnRules,\n        toPorts: ports,\n      },\n      {\n        toEndpoints: [\n          {\n            matchLabels: {\n              \"k8s:io.kubernetes.pod.namespace\": \"kube-system\",\n              \"k8s:k8s-app\": \"kube-dns\",\n            },\n          },\n        ],\n        toPorts: [\n          {\n            ports: [{ port: \"53\", protocol: \"UDP\" }],\n            rules: {\n              dns: getCiliumClusterMetadata(cluster).allowForbiddenFqdnResolution\n                ? [{ matchPattern: \"*\" }]\n                : fqdnRules,\n            },\n          },\n        ],\n      },\n    ]\n  }\n\n  private static createServiceRules(\n    prefix: \"from\" | \"to\",\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n  ): Rule[] {\n    if (rule.services.length === 0) {\n      return []\n    }\n\n    const selectors = rule.services.map(service => {\n      const selector = mapServiceToLabelSelector(service)\n\n      return output(selector).apply(selector => ({\n        matchLabels: {\n          ...mapKeys(selector.matchLabels ?? {}, key => `k8s:${key}`),\n          \"k8s:io.kubernetes.pod.namespace\": service.metadata.namespace,\n        },\n      }))\n    })\n\n    return [\n      {\n        [`${prefix}Endpoints`]: selectors,\n        toPorts: ports,\n      },\n    ]\n  }\n\n  private static createNamespaceExpressions(\n    rule: NormalizedRuleArgs,\n  ): k8sTypes.input.meta.v1.LabelSelectorRequirement[] {\n    if (rule.namespaces.length === 0) {\n      return []\n    }\n\n    return pipe(\n      //\n      rule.namespaces,\n      map(mapNamespaceLikeToNamespaceName),\n      names => [\n        {\n          key: \"k8s:io.kubernetes.pod.namespace\",\n          operator: \"In\",\n          values: names,\n        },\n      ],\n    )\n  }\n\n  private static createSelectorRules(\n    prefix: \"from\" | \"to\",\n    rule: NormalizedRuleArgs,\n    ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,\n  ): types.input.cilium.v2.CiliumNetworkPolicySpecIngress[] {\n    const namespaceExpressions = CiliumNetworkPolicy.createNamespaceExpressions(rule)\n\n    if (rule.selectors.length === 0) {\n      if (namespaceExpressions.length === 0) {\n        // if no selectors and no namespaces are provided, we do not match\n        return []\n      }\n\n      // if no selectors are provided, we only match on namespaces\n      return [\n        {\n          [`${prefix}Endpoints`]: [{ matchExpressions: namespaceExpressions }],\n          toPorts: ports,\n        },\n      ]\n    }\n\n    // otherwise, we match on selectors and namespaces\n    const selectors = rule.selectors.map(selector => {\n      const rawSelector = mapSelectorLikeToSelector(selector)\n\n      return output(rawSelector).apply(rawSelector => {\n        const expressions = map(rawSelector.matchExpressions ?? [], expression => ({\n          key: `k8s:${expression.key}`,\n          operator: expression.operator,\n          values: expression.values,\n        }))\n\n        return {\n          matchLabels: mapKeys(rawSelector.matchLabels ?? {}, key => `k8s:${key}`),\n          matchExpressions: [...expressions, ...namespaceExpressions],\n        }\n      })\n    })\n\n    return [\n      {\n        [`${prefix}Endpoints`]: uniqueBy(selectors, rule => JSON.stringify(rule)),\n        toPorts: ports,\n      },\n    ]\n  }\n\n  private static mapPorts(\n    ports: NetworkPolicyPort[],\n  ): types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts | undefined {\n    if (ports.length === 0) {\n      return\n    }\n\n    return {\n      ports: ports.map(port => {\n        if (\"port\" in port) {\n          return {\n            port: port.port.toString(),\n            protocol: port.protocol ?? \"TCP\",\n          }\n        }\n\n        return {\n          port: port.range[0].toString(),\n          endPort: port.range[1],\n          protocol: port.protocol ?? \"TCP\",\n        }\n      }),\n    }\n  }\n}\n"],"mappings":";;;;;;AACA,SAA8C,cAAc;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,UAAAA,eAAqB;AAC9B,OAAkC;AAClC,SAAS,KAAK,SAAS,MAAM,gBAAgB;AAMtC,IAAM,sBAAN,MAAM,6BAA4B,cAAc;AAAA,EAC3C,OACR,MACA,MACA,MACU;AACV,WAAO,IAAIC,QAAO,GAAG;AAAA,MACnB;AAAA,MACA;AAAA,QACE,UAAU,YAAY,MAAM,IAAI;AAAA,QAChC,MAAM;AAAA,UACJ,aAAa,KAAK;AAAA,UAClB,kBAAkB,KAAK;AAAA,UACvB,SAAS,qBAAoB,mBAAmB,IAAI;AAAA,UACpD,QAAQ,qBAAoB,kBAAkB,IAAI;AAAA,QACpD;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,mBAAmB,MAA2C;AAC3E,QAAI,KAAK,gBAAgB;AACvB,aAAO,CAAC,CAAC,CAAC;AAAA,IACZ;AAEA,WAAO;AAAA,MACL,KAAK,aAAa;AAAA,QAAQ,UACxB,qBAAoB,YAAY,QAAQ,MAAM,KAAK,OAAO;AAAA,MAC5D;AAAA,MACA,UAAQ,KAAK,UAAU,IAAI;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,OAAe,kBAAkB,MAA2C;AAC1E,QAAI,KAAK,eAAe;AACtB,aAAO,CAAC,CAAC,CAAC;AAAA,IACZ;AAEA,UAAM,aAAqB,CAAC;AAE5B,QAAI,KAAK,oBAAoB;AAC3B,iBAAW,KAAK,EAAE,YAAY,CAAC,gBAAgB,EAAE,CAAC;AAAA,IACpD;AAEA,WAAO;AAAA,MACL,KAAK,YACF,QAAQ,UAAQ,qBAAoB,YAAY,MAAM,MAAM,KAAK,OAAO,CAAC,EACzE,OAAO,UAAU;AAAA,MACpB,UAAQ,KAAK,UAAU,IAAI;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,OAAe,YACb,QACA,MACA,SACQ;AACR,UAAM,OAAO,qBAAoB,SAAS,KAAK,KAAK;AACpD,UAAM,QAAQ,OAAO,CAAC,IAAI,IAAI;AAE9B,WAAO;AAAA,MACL,GAAG,qBAAoB,eAAe,QAAQ,MAAM,KAAK;AAAA,MACzD,GAAG,qBAAoB,gBAAgB,QAAQ,MAAM,KAAK;AAAA,MAC1D,GAAG,qBAAoB,mBAAmB,QAAQ,MAAM,KAAK;AAAA,MAC7D,GAAG,qBAAoB,oBAAoB,QAAQ,MAAM,KAAK;AAAA,MAC9D,GAAI,WAAW,OAAO,qBAAoB,gBAAgB,MAAM,OAAO,OAAO,IAAI,CAAC;AAAA,IACrF;AAAA,EACF;AAAA,EAEA,OAAe,eACb,QACA,MACA,OACQ;AACR,QAAI,CAAC,KAAK,KAAK;AACb,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,UAAU,GAAG,CAAC,KAAK;AAAA,QAC7B,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,gBACb,QACA,MACA,OACQ;AACR,QAAI,KAAK,MAAM,WAAW,GAAG;AAC3B,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,MAAM,GAAG,KAAK;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,gBACb,MACA,OACA,SACuD;AACvD,QAAI,KAAK,MAAM,WAAW,GAAG;AAC3B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,YAAY,KAAK,MAAM,IAAI,UAAQ;AACvC,aAAO,KAAK,SAAS,GAAG,IAAI,EAAE,cAAc,KAAK,IAAI,EAAE,WAAW,KAAK;AAAA,IACzE,CAAC;AAED,WAAO;AAAA,MACL;AAAA,QACE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,MACA;AAAA,QACE,aAAa;AAAA,UACX;AAAA,YACE,aAAa;AAAA,cACX,mCAAmC;AAAA,cACnC,eAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AAAA,QACA,SAAS;AAAA,UACP;AAAA,YACE,OAAO,CAAC,EAAE,MAAM,MAAM,UAAU,MAAM,CAAC;AAAA,YACvC,OAAO;AAAA,cACL,KAAK,yBAAyB,OAAO,EAAE,+BACnC,CAAC,EAAE,cAAc,IAAI,CAAC,IACtB;AAAA,YACN;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,mBACb,QACA,MACA,OACQ;AACR,QAAI,KAAK,SAAS,WAAW,GAAG;AAC9B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,YAAY,KAAK,SAAS,IAAI,aAAW;AAC7C,YAAM,WAAW,0BAA0B,OAAO;AAElD,aAAO,OAAO,QAAQ,EAAE,MAAM,CAAAC,eAAa;AAAA,QACzC,aAAa;AAAA,UACX,GAAG,QAAQA,UAAS,eAAe,CAAC,GAAG,SAAO,OAAO,GAAG,EAAE;AAAA,UAC1D,mCAAmC,QAAQ,SAAS;AAAA,QACtD;AAAA,MACF,EAAE;AAAA,IACJ,CAAC;AAED,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,WAAW,GAAG;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,2BACb,MACmD;AACnD,QAAI,KAAK,WAAW,WAAW,GAAG;AAChC,aAAO,CAAC;AAAA,IACV;AAEA,WAAO;AAAA;AAAA,MAEL,KAAK;AAAA,MACL,IAAI,+BAA+B;AAAA,MACnC,WAAS;AAAA,QACP;AAAA,UACE,KAAK;AAAA,UACL,UAAU;AAAA,UACV,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,oBACb,QACA,MACA,OACwD;AACxD,UAAM,uBAAuB,qBAAoB,2BAA2B,IAAI;AAEhF,QAAI,KAAK,UAAU,WAAW,GAAG;AAC/B,UAAI,qBAAqB,WAAW,GAAG;AAErC,eAAO,CAAC;AAAA,MACV;AAGA,aAAO;AAAA,QACL;AAAA,UACE,CAAC,GAAG,MAAM,WAAW,GAAG,CAAC,EAAE,kBAAkB,qBAAqB,CAAC;AAAA,UACnE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,KAAK,UAAU,IAAI,cAAY;AAC/C,YAAM,cAAc,0BAA0B,QAAQ;AAEtD,aAAO,OAAO,WAAW,EAAE,MAAM,CAAAC,iBAAe;AAC9C,cAAM,cAAc,IAAIA,aAAY,oBAAoB,CAAC,GAAG,iBAAe;AAAA,UACzE,KAAK,OAAO,WAAW,GAAG;AAAA,UAC1B,UAAU,WAAW;AAAA,UACrB,QAAQ,WAAW;AAAA,QACrB,EAAE;AAEF,eAAO;AAAA,UACL,aAAa,QAAQA,aAAY,eAAe,CAAC,GAAG,SAAO,OAAO,GAAG,EAAE;AAAA,UACvE,kBAAkB,CAAC,GAAG,aAAa,GAAG,oBAAoB;AAAA,QAC5D;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,WAAO;AAAA,MACL;AAAA,QACE,CAAC,GAAG,MAAM,WAAW,GAAG,SAAS,WAAW,CAAAC,UAAQ,KAAK,UAAUA,KAAI,CAAC;AAAA,QACxE,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,SACb,OACwE;AACxE,QAAI,MAAM,WAAW,GAAG;AACtB;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,MAAM,IAAI,UAAQ;AACvB,YAAI,UAAU,MAAM;AAClB,iBAAO;AAAA,YACL,MAAM,KAAK,KAAK,SAAS;AAAA,YACzB,UAAU,KAAK,YAAY;AAAA,UAC7B;AAAA,QACF;AAEA,eAAO;AAAA,UACL,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS;AAAA,UAC7B,SAAS,KAAK,MAAM,CAAC;AAAA,UACrB,UAAU,KAAK,YAAY;AAAA,QAC7B;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["cilium","cilium","selector","rawSelector","rule"]}

package/dist/unit/index.js

@@ -0,0 +1,54 @@
+import {
+  cilium
+} from "../chunk-M4DV2DAJ.js";
+
+// src/unit/index.ts
+import { Chart } from "@highstate/k8s";
+import { k8s } from "@highstate/library";
+import { forUnit, secret, toPromise } from "@highstate/pulumi";
+import { l3EndpointToString } from "@highstate/common";
+var { args, inputs, outputs } = forUnit(k8s.cilium);
+var cluster = await toPromise(inputs.k8sCluster);
+new Chart("cilium", {
+  cluster,
+  namespace: "kube-system",
+  chart: cilium,
+  values: {
+    ipam: {
+      mode: "kubernetes"
+    },
+    kubeProxyReplacement: "true",
+    operator: {
+      replicas: 1
+    },
+    hubble: {
+      relay: {
+        enabled: true
+      },
+      ui: {
+        enabled: true
+      }
+    },
+    dnsProxy: {
+      dnsRejectResponseCode: "nameError"
+    },
+    k8sServiceHost: l3EndpointToString(cluster.apiEndpoints[0]),
+    k8sServicePort: cluster.apiEndpoints[0].port.toString()
+  }
+});
+var unit_default = outputs({
+  k8sCluster: secret({
+    ...cluster,
+    cni: "cilium",
+    metadata: {
+      ...cluster.metadata,
+      cilium: {
+        allowForbiddenFqdnResolution: args.allowForbiddenFqdnResolution
+      }
+    }
+  })
+});
+export {
+  unit_default as default
+};
+//# sourceMappingURL=index.js.map

package/dist/unit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/unit/index.ts"],"sourcesContent":["import { Chart } from \"@highstate/k8s\"\nimport { k8s } from \"@highstate/library\"\nimport { forUnit, secret, toPromise } from \"@highstate/pulumi\"\nimport { l3EndpointToString } from \"@highstate/common\"\nimport { chart, type CiliumClusterMetadata } from \"../shared\"\n\nconst { args, inputs, outputs } = forUnit(k8s.cilium)\n\nconst cluster = await toPromise(inputs.k8sCluster)\n\nnew Chart(\"cilium\", {\n  cluster,\n  namespace: \"kube-system\",\n\n  chart,\n\n  values: {\n    ipam: {\n      mode: \"kubernetes\",\n    },\n\n    kubeProxyReplacement: \"true\",\n\n    operator: {\n      replicas: 1,\n    },\n\n    hubble: {\n      relay: {\n        enabled: true,\n      },\n      ui: {\n        enabled: true,\n      },\n    },\n\n    dnsProxy: {\n      dnsRejectResponseCode: \"nameError\",\n    },\n\n    k8sServiceHost: l3EndpointToString(cluster.apiEndpoints[0]),\n    k8sServicePort: cluster.apiEndpoints[0].port.toString(),\n  },\n})\n\nexport default outputs({\n  k8sCluster: secret({\n    ...cluster,\n    cni: \"cilium\",\n    metadata: {\n      ...cluster.metadata,\n      cilium: {\n        allowForbiddenFqdnResolution: args.allowForbiddenFqdnResolution,\n      } satisfies CiliumClusterMetadata,\n    },\n  }),\n})\n"],"mappings":";;;;;AAAA,SAAS,aAAa;AACtB,SAAS,WAAW;AACpB,SAAS,SAAS,QAAQ,iBAAiB;AAC3C,SAAS,0BAA0B;AAGnC,IAAM,EAAE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,IAAI,MAAM;AAEpD,IAAM,UAAU,MAAM,UAAU,OAAO,UAAU;AAEjD,IAAI,MAAM,UAAU;AAAA,EAClB;AAAA,EACA,WAAW;AAAA,EAEX;AAAA,EAEA,QAAQ;AAAA,IACN,MAAM;AAAA,MACJ,MAAM;AAAA,IACR;AAAA,IAEA,sBAAsB;AAAA,IAEtB,UAAU;AAAA,MACR,UAAU;AAAA,IACZ;AAAA,IAEA,QAAQ;AAAA,MACN,OAAO;AAAA,QACL,SAAS;AAAA,MACX;AAAA,MACA,IAAI;AAAA,QACF,SAAS;AAAA,MACX;AAAA,IACF;AAAA,IAEA,UAAU;AAAA,MACR,uBAAuB;AAAA,IACzB;AAAA,IAEA,gBAAgB,mBAAmB,QAAQ,aAAa,CAAC,CAAC;AAAA,IAC1D,gBAAgB,QAAQ,aAAa,CAAC,EAAE,KAAK,SAAS;AAAA,EACxD;AACF,CAAC;AAED,IAAO,eAAQ,QAAQ;AAAA,EACrB,YAAY,OAAO;AAAA,IACjB,GAAG;AAAA,IACH,KAAK;AAAA,IACL,UAAU;AAAA,MACR,GAAG,QAAQ;AAAA,MACX,QAAQ;AAAA,QACN,8BAA8B,KAAK;AAAA,MACrC;AAAA,IACF;AAAA,EACF,CAAC;AACH,CAAC;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highstate/cilium",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "type": "module",
   "files": [
     "dist",
@@ -10,7 +10,8 @@
     ".": {
       "types": "./src/index.ts",
       "default": "./dist/index.js"
-    }
+    },
+    "./unit": "./dist/unit/index.js"
   },
   "publishConfig": {
     "access": "public"
@@ -21,17 +22,18 @@
     "generate-crds": "./scripts/generate-crds.sh"
   },
   "dependencies": {
-    "@highstate/cilium-crds": "^0.9.9",
-    "@highstate/k8s": "^0.9.9",
-    "@highstate/library": "^0.9.9",
-    "@highstate/pulumi": "^0.9.9",
+    "@highstate/cilium-crds": "^0.9.11",
+    "@highstate/common": "^0.9.11",
+    "@highstate/k8s": "^0.9.11",
+    "@highstate/library": "^0.9.11",
+    "@highstate/pulumi": "^0.9.11",
     "@pulumi/command": "^1.0.2",
     "@pulumi/kubernetes": "^4.18.0",
     "@pulumi/pulumi": "^3.165.0",
     "remeda": "^2.21.0"
   },
   "devDependencies": {
-    "@highstate/cli": "^0.9.9"
+    "@highstate/cli": "^0.9.11"
   },
-  "gitHead": "1c04a713fa1bb7c0231e5e6d0537709097bb0e8e"
+  "gitHead": "d62cae30ea9fadaa1aa4fb3b5734a16cf53810ce"
 }

package/src/network-policy.ts

@@ -1,3 +1,4 @@
+import type { k8s } from "@highstate/library"
 import { type ResourceOptions, type Resource, output } from "@highstate/pulumi"
 import {
   mapMetadata,
@@ -12,6 +13,7 @@ import {
 import { cilium, types } from "@highstate/cilium-crds"
 import { types as k8sTypes } from "@pulumi/kubernetes"
 import { map, mapKeys, pipe, uniqueBy } from "remeda"
+import { getCiliumClusterMetadata } from "./shared"
 
 type Rule = types.input.cilium.v2.CiliumNetworkPolicySpecIngress &
   types.input.cilium.v2.CiliumNetworkPolicySpecEgress
@@ -43,7 +45,9 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
     }
 
     return uniqueBy(
-      args.ingressRules.flatMap(rule => CiliumNetworkPolicy.createRules("from", rule)),
+      args.ingressRules.flatMap(rule =>
+        CiliumNetworkPolicy.createRules("from", rule, args.cluster),
+      ),
       rule => JSON.stringify(rule),
     )
   }
@@ -61,13 +65,17 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
 
     return uniqueBy(
       args.egressRules
-        .flatMap(rule => CiliumNetworkPolicy.createRules("to", rule))
+        .flatMap(rule => CiliumNetworkPolicy.createRules("to", rule, args.cluster))
         .concat(extraRules),
       rule => JSON.stringify(rule),
     )
   }
 
-  private static createRules(prefix: "from" | "to", rule: NormalizedRuleArgs): Rule[] {
+  private static createRules(
+    prefix: "from" | "to",
+    rule: NormalizedRuleArgs,
+    cluster: k8s.Cluster,
+  ): Rule[] {
     const port = CiliumNetworkPolicy.mapPorts(rule.ports)
     const ports = port ? [port] : undefined
 
@@ -76,7 +84,7 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
       ...CiliumNetworkPolicy.createCidrRules(prefix, rule, ports),
       ...CiliumNetworkPolicy.createServiceRules(prefix, rule, ports),
       ...CiliumNetworkPolicy.createSelectorRules(prefix, rule, ports),
-      ...(prefix === "to" ? CiliumNetworkPolicy.createFqdnRules(rule, ports) : []),
+      ...(prefix === "to" ? CiliumNetworkPolicy.createFqdnRules(rule, ports, cluster) : []),
     ]
   }
 
@@ -117,6 +125,7 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
   private static createFqdnRules(
     rule: NormalizedRuleArgs,
     ports: types.input.cilium.v2.CiliumNetworkPolicySpecEgressToPorts[] | undefined,
+    cluster: k8s.Cluster,
   ): types.input.cilium.v2.CiliumNetworkPolicySpecEgress[] {
     if (rule.fqdns.length === 0) {
       return []
@@ -143,7 +152,11 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
         toPorts: [
           {
             ports: [{ port: "53", protocol: "UDP" }],
-            rules: { dns: fqdnRules },
+            rules: {
+              dns: getCiliumClusterMetadata(cluster).allowForbiddenFqdnResolution
+                ? [{ matchPattern: "*" }]
+                : fqdnRules,
+            },
           },
         ],
       },
@@ -241,7 +254,7 @@ export class CiliumNetworkPolicy extends NetworkPolicy {
 
     return [
       {
-        [`${prefix}Endpoints`]: selectors,
+        [`${prefix}Endpoints`]: uniqueBy(selectors, rule => JSON.stringify(rule)),
         toPorts: ports,
       },
     ]

package/src/shared.ts

@@ -1 +1,24 @@
+import type { k8s } from "@highstate/library"
+
 export { cilium as chart } from "../assets/charts.json"
+
+export type CiliumClusterMetadata = {
+  /**
+   * If set to `true`, the generated network policy will allow
+   * all DNS queries to be resolved, even if they are
+   * for forbidden (non-allowed) FQDNs.
+   *
+   * By default, is not set.
+   */
+  allowForbiddenFqdnResolution?: boolean
+}
+
+export function getCiliumClusterMetadata(cluster: k8s.Cluster): CiliumClusterMetadata {
+  return cluster.metadata?.cilium ?? {}
+}
+
+export function hasCiliumClusterMetadata(
+  cluster: k8s.Cluster,
+): cluster is k8s.Cluster & { metadata: { cilium: CiliumClusterMetadata } } {
+  return Boolean(cluster.metadata?.cilium)
+}

package/src/unit/index.ts

@@ -0,0 +1,57 @@
+import { Chart } from "@highstate/k8s"
+import { k8s } from "@highstate/library"
+import { forUnit, secret, toPromise } from "@highstate/pulumi"
+import { l3EndpointToString } from "@highstate/common"
+import { chart, type CiliumClusterMetadata } from "../shared"
+
+const { args, inputs, outputs } = forUnit(k8s.cilium)
+
+const cluster = await toPromise(inputs.k8sCluster)
+
+new Chart("cilium", {
+  cluster,
+  namespace: "kube-system",
+
+  chart,
+
+  values: {
+    ipam: {
+      mode: "kubernetes",
+    },
+
+    kubeProxyReplacement: "true",
+
+    operator: {
+      replicas: 1,
+    },
+
+    hubble: {
+      relay: {
+        enabled: true,
+      },
+      ui: {
+        enabled: true,
+      },
+    },
+
+    dnsProxy: {
+      dnsRejectResponseCode: "nameError",
+    },
+
+    k8sServiceHost: l3EndpointToString(cluster.apiEndpoints[0]),
+    k8sServicePort: cluster.apiEndpoints[0].port.toString(),
+  },
+})
+
+export default outputs({
+  k8sCluster: secret({
+    ...cluster,
+    cni: "cilium",
+    metadata: {
+      ...cluster.metadata,
+      cilium: {
+        allowForbiddenFqdnResolution: args.allowForbiddenFqdnResolution,
+      } satisfies CiliumClusterMetadata,
+    },
+  }),
+})