@highstate/k8s 0.19.1 → 0.20.0

package/src/units/dns01-issuer/index.ts

@@ -1,11 +1,12 @@
 import { cert_manager } from "@highstate/cert-manager"
-import { k8s } from "@highstate/library"
-import { forUnit } from "@highstate/pulumi"
+import { common, k8s } from "@highstate/library"
+import { forUnit, makeEntityOutput } from "@highstate/pulumi"
 import { dns01SolverMediator } from "../../dns01-solver"
 import { Namespace } from "../../namespace"
+import { Secret } from "../../secret"
 import { getProviderAsync } from "../../shared"
 
-const { name, inputs, outputs } = forUnit(k8s.dns01TlsIssuer)
+const { name, args, secrets, inputs, outputs } = forUnit(k8s.dns01TlsIssuer)
 
 const provider = await getProviderAsync(inputs.k8sCluster)
 
@@ -14,6 +15,33 @@ const certManagerNs = Namespace.get("cert-manager", {
   cluster: inputs.k8sCluster,
 })
 
+let eabSecret: Secret | undefined
+
+if (args.acmeServer.type === "zerossl") {
+  if (!secrets.eabKeyId || !secrets.eabKeySecret) {
+    throw new Error("EAB key ID and secret are required for ZeroSSL ACME server")
+  }
+
+  eabSecret = Secret.create(`${name}-eab`, {
+    namespace: certManagerNs,
+    stringData: {
+      keyId: secrets.eabKeyId,
+      keySecret: secrets.eabKeySecret,
+    },
+  })
+}
+
+const getAcmeServer = () => {
+  switch (args.acmeServer.type) {
+    case "zerossl":
+      return "https://acme.zerossl.com/v2/DV90"
+    case "letsencrypt":
+      return "https://acme-v02.api.letsencrypt.org/directory"
+    case "custom":
+      return args.acmeServer.url
+  }
+}
+
 new cert_manager.v1.ClusterIssuer(
   name,
   {
@@ -22,7 +50,7 @@ new cert_manager.v1.ClusterIssuer(
     },
     spec: {
       acme: {
-        server: "https://acme-v02.api.letsencrypt.org/directory",
+        server: getAcmeServer(),
         solvers: [
           {
             dns01: dns01SolverMediator.callOutput(inputs.dnsProvider.implRef, {
@@ -34,6 +62,15 @@ new cert_manager.v1.ClusterIssuer(
         privateKeySecretRef: {
           name,
         },
+        externalAccountBinding: eabSecret
+          ? {
+              keyID: eabSecret.stringData.keyId,
+              keySecretRef: {
+                name: eabSecret.metadata.name,
+                key: "keySecret",
+              },
+            }
+          : undefined,
       },
     },
   },
@@ -41,16 +78,23 @@ new cert_manager.v1.ClusterIssuer(
 )
 
 export default outputs({
-  tlsIssuer: {
-    zones: inputs.dnsProvider.zones,
-    implRef: {
-      package: "@highstate/k8s",
-      data: {
-        clusterIssuerName: name,
-        cluster: inputs.k8sCluster,
+  tlsIssuer: makeEntityOutput({
+    entity: common.tlsIssuerEntity,
+    identity: `${name}:tls-issuer`,
+    meta: {
+      title: name,
+    },
+    value: {
+      zones: inputs.dnsProvider.zones,
+      implRef: {
+        package: "@highstate/k8s",
+        data: {
+          clusterIssuerName: name,
+          cluster: inputs.k8sCluster,
+        },
       },
     },
-  },
+  }),
 
   $statusFields: {
     zones: inputs.dnsProvider.zones,

package/src/units/existing-cluster/index.ts

@@ -7,8 +7,8 @@ import {
   parseEndpoint,
   parseEndpoints,
 } from "@highstate/common"
-import { type ImplementationReference, k8s } from "@highstate/library"
-import { forUnit, secret, toPromise } from "@highstate/pulumi"
+import { common, type ImplementationReference, k8s } from "@highstate/library"
+import { forUnit, makeEntityOutput, toPromise } from "@highstate/pulumi"
 import { AppsV1Api, KubeConfig } from "@kubernetes/client-node"
 import { core, Provider } from "@pulumi/kubernetes"
 import { createK8sTerminal, detectExternalIps } from "../../cluster"
@@ -47,7 +47,7 @@ if (args.autoDetectExternalIps) {
 }
 
 // calculate endpoints
-let endpoints = await parseEndpoints(args.endpoints, inputs.endpoints)
+let endpoints = parseEndpoints([...args.endpoints, ...inputs.endpoints])
 
 if (args.useExternalIpsAsEndpoints) {
   const ipEndpoints = externalIps.map(ip => parseEndpoint(ip))
@@ -55,7 +55,7 @@ if (args.useExternalIpsAsEndpoints) {
 }
 
 // calculate api endpoints
-let apiEndpoints = await parseEndpoints(args.apiEndpoints, inputs.endpoints, 4)
+let apiEndpoints = parseEndpoints([...args.apiEndpoints, ...inputs.endpoints], 4)
 
 if (args.useKubeconfigApiEndpoint) {
   const configEndpoint = parseEndpoint(kubeConfig.clusters[0].server.replace("https://", ""), 4)
@@ -65,17 +65,38 @@ if (args.useKubeconfigApiEndpoint) {
 const kubeSystem = core.v1.Namespace.get("kube-system", "kube-system", { provider })
 
 export default outputs({
-  k8sCluster: {
-    id: kubeSystem.metadata.uid,
-    connectionId: kubeSystem.metadata.uid,
-    name,
-    networkPolicyImplRef,
-    externalIps,
-    endpoints,
-    apiEndpoints,
-    quirks: args.quirks,
-    kubeconfig: secret(kubeconfigContent),
-  },
+  k8sCluster: makeEntityOutput({
+    entity: k8s.clusterEntity,
+    identity: kubeSystem.metadata.uid,
+    value: {
+      id: kubeSystem.metadata.uid,
+      connectionId: kubeSystem.metadata.uid,
+      name,
+      networkPolicyImplRef,
+      externalIps,
+      endpoints,
+      apiEndpoints,
+      quirks: args.quirks,
+      kubeconfig: makeEntityOutput({
+        entity: common.fileEntity,
+        identity: `${name}:kubeconfig`,
+        meta: {
+          title: "Kubeconfig",
+        },
+        value: {
+          content: {
+            type: "embedded-secret",
+            value: kubeconfigContent,
+          },
+          meta: {
+            name: "kubeconfig",
+            contentType: "text/yaml",
+            mode: 0o600,
+          },
+        },
+      }),
+    },
+  }),
 
   $terminals: [createK8sTerminal(kubeconfigContent)],
 

package/src/units/reduced-access-cluster/index.ts

@@ -1,10 +1,11 @@
 import { text, trimIndentation } from "@highstate/contract"
 import { k8s } from "@highstate/library"
-import { fileFromString, forUnit, interpolate, output, secret, toPromise } from "@highstate/pulumi"
+import { forUnit, interpolate, makeFileOutput, output, secret, toPromise } from "@highstate/pulumi"
 import { join } from "remeda"
 import { createK8sTerminal } from "../../cluster"
 import { Namespace } from "../../namespace"
 import { ClusterAccessScope } from "../../rbac"
+import { getClusterKubeconfigContent } from "../../shared"
 
 const { args, inputs, outputs } = forUnit(k8s.reducedAccessCluster)
 
@@ -34,7 +35,7 @@ const resourceLines = await toPromise(
 export default outputs({
   k8sCluster: accessScope.cluster,
 
-  $terminals: [createK8sTerminal(accessScope.cluster.kubeconfig)],
+  $terminals: [createK8sTerminal(secret(getClusterKubeconfigContent(accessScope.cluster)))],
 
   $pages: {
     index: {
@@ -58,7 +59,9 @@ export default outputs({
         },
         {
           type: "file",
-          file: fileFromString("kubeconfig", accessScope.cluster.kubeconfig, {
+          file: makeFileOutput({
+            name: "kubeconfig",
+            content: secret(getClusterKubeconfigContent(accessScope.cluster)),
             contentType: "text/yaml",
             isSecret: true,
           }),

package/src/worker.ts

@@ -4,7 +4,7 @@ import type { DeepInput, Input, InputArray, Unwrap } from "@highstate/pulumi"
 import type { Namespace } from "./namespace"
 import { type Output, output } from "@pulumi/pulumi"
 import { ClusterAccessScope } from "./rbac"
-import { images, type NamespacedResource } from "./shared"
+import { getClusterKubeconfigContent, images, type NamespacedResource } from "./shared"
 
 export async function createMonitorWorker(
   namespace: Input<Namespace>,
@@ -12,6 +12,8 @@ export async function createMonitorWorker(
 ): Promise<Output<Unwrap<UnitWorker>>> {
   const scope = new ClusterAccessScope("monitor", {
     rule: {
+      apiGroups: ["", "apps"],
+      resources: ["deployments", "statefulsets", "services", "pods"],
       verbs: ["get", "list", "watch"],
     },
 
@@ -24,7 +26,7 @@ export async function createMonitorWorker(
     image: images["worker.k8s-monitor"].image,
 
     params: {
-      kubeconfig: scope.cluster.kubeconfig,
+      kubeconfig: getClusterKubeconfigContent(scope.cluster),
       resources: output(resources).apply(resources => resources.map(r => r.entity)),
     } satisfies DeepInput<k8s.MonitorWorkerParams>,
   })