@highstate/k8s 0.19.1 → 0.21.1

package/dist/impl/gateway-route.js

@@ -1,45 +1,65 @@
-import { Gateway, HttpRoute, TcpRoute, UdpRoute } from '../chunk-DCUMJSO6.js';
-import { Certificate } from '../chunk-BR2CLUUD.js';
-import { Service, l4EndpointToServicePort } from '../chunk-TWBMG6TD.js';
-import '../chunk-4G6LLC2X.js';
-import { Namespace, mapMetadata, getProvider } from '../chunk-OBDQONMV.js';
-import '../chunk-PZ5AY32C.js';
-import { gatewayRouteMediator } from '@highstate/common';
-import { k8s } from '@highstate/library';
-import { toPromise } from '@highstate/pulumi';
-import { core } from '@pulumi/kubernetes';
+// @bun
+import {
+  Gateway,
+  HttpRoute,
+  TcpRoute,
+  UdpRoute
+} from "../chunk-46ntav0c.js";
+import {
+  Certificate
+} from "../chunk-556pc9e6.js";
+import {
+  Service,
+  isEndpointFromCluster,
+  l4EndpointToServicePort
+} from "../chunk-k4w9zpn5.js";
+import {
+  Namespace,
+  getProvider,
+  mapMetadata
+} from "../chunk-facs31cb.js";
+import"../chunk-b05q6fm2.js";
 
-var createGatewayRoute = gatewayRouteMediator.implement(
-  k8s.gatewayDataSchema,
-  async ({ name, spec, opts }, data) => {
-    const namespace = spec.nativeData instanceof Service ? await toPromise(spec.nativeData.namespace) : Namespace.for(data.namespace, data.cluster);
-    const certSecret = await getCertificateSecret(name, namespace, spec.tlsCertificate);
-    const certificateRef = certSecret ? {
-      kind: "Secret",
-      group: "",
-      name: certSecret.metadata.name
-    } : void 0;
-    if (spec.type === "http") {
-      return await createHttpGatewayRoute({
-        name,
-        spec,
-        opts,
-        data,
-        namespace,
-        certificateRef
-      });
-    }
-    const protocol = spec.type === "tcp" ? "TCP" : "UDP";
-    return await createL4GatewayRoute({
+// src/impl/gateway-route.ts
+import { gatewayRouteMediator } from "@highstate/common";
+import { k8s } from "@highstate/library";
+import { toPromise } from "@highstate/pulumi";
+import { core } from "@pulumi/kubernetes";
+var createGatewayRoute = gatewayRouteMediator.implement(k8s.gatewayDataSchema, async ({ name, args: spec, opts }, data) => {
+  const namespace = resolveRouteNamespace(spec, data);
+  const certSecret = await getCertificateSecret(name, namespace, spec.certificate);
+  const certificateRef = certSecret ? {
+    kind: "Secret",
+    group: "",
+    name: certSecret.metadata.name
+  } : undefined;
+  const routeProtocol = resolveRouteProtocol(spec);
+  if (routeProtocol === "http") {
+    return await createHttpGatewayRoute({
       name,
       spec,
       opts,
       data,
       namespace,
-      protocol
+      certificateRef
     });
   }
-);
+  return await createL4GatewayRoute({
+    name,
+    spec,
+    opts,
+    data,
+    namespace,
+    protocol: routeProtocol === "tcp" ? "TCP" : "UDP"
+  });
+});
+function resolveRouteNamespace(spec, data) {
+  const metadataNamespace = spec.metadata["k8s.namespace"];
+  if (metadataNamespace instanceof Namespace) {
+    return metadataNamespace;
+  }
+  return Namespace.for(data.namespace, data.cluster);
+}
 async function createHttpGatewayRoute({
   name,
   spec,
@@ -48,37 +68,60 @@ async function createHttpGatewayRoute({
   namespace,
   certificateRef
 }) {
-  const backendService = spec.nativeData instanceof Service ? spec.nativeData : (await createServiceFromEndpoints(name, namespace, spec.endpoints, data.cluster, opts)).service;
+  const listenerPort = spec.port ?? (certificateRef ? data.httpsPort : data.httpPort);
+  const listenerProtocol = certificateRef ? "HTTPS" : "HTTP";
+  const listenerHostname = spec.fqdns[0];
   const listeners = [
     {
-      name: "https",
-      port: data.httpsPort,
-      protocol: "HTTPS",
+      name: `${listenerProtocol.toLowerCase()}-${listenerPort}`,
+      port: listenerPort,
+      protocol: listenerProtocol,
+      hostname: listenerHostname,
       tls: {
         mode: "Terminate",
-        certificateRefs: certificateRef ? [certificateRef] : void 0
+        certificateRefs: certificateRef ? [certificateRef] : undefined
       }
     }
   ];
-  const gateway = await Gateway.createOnce(
-    {
-      name: data.className,
-      namespace,
-      gatewayClassName: data.className,
-      listeners
-    },
-    opts
-  );
-  const httpRoute = new HttpRoute(
-    name,
-    {
-      gateway,
-      rule: {
-        backend: backendService
-      }
-    },
-    opts
-  );
+  const gateway = Gateway.create(name, {
+    namespace,
+    gatewayClassName: data.className,
+    listeners
+  }, opts);
+  const ruleSpecs = Object.values(spec.rules);
+  const rules = await Promise.all(ruleSpecs.map(async (ruleSpec, ruleIndex) => {
+    const backendRefs = await Promise.all(ruleSpec.backends.map(async (backend, backendIndex) => {
+      const backendData = await resolveBackendFromEndpoints({
+        routeName: name,
+        backendName: `${ruleIndex}-${backendIndex}`,
+        endpoints: backend.endpoints,
+        namespace,
+        cluster: data.cluster,
+        opts
+      });
+      const backendPort = await selectBackendPort({
+        ports: backendData.ports,
+        protocol: "TCP",
+        targetPort: backendData.preferredTargetPort,
+        serviceName: backendData.serviceName,
+        routeName: name
+      });
+      return {
+        name: backendData.serviceName,
+        namespace: backendData.serviceNamespace,
+        port: backendPort.port
+      };
+    }));
+    return {
+      matches: ruleSpec.paths,
+      backends: backendRefs
+    };
+  }));
+  const httpRoute = new HttpRoute(name, {
+    gateway,
+    hostnames: spec.fqdns,
+    rules
+  }, opts);
   return {
     resource: httpRoute,
     endpoints: await toPromise(gateway.endpoints)
@@ -92,16 +135,24 @@ async function createL4GatewayRoute({
   namespace,
   protocol
 }) {
-  const serviceData = spec.nativeData instanceof Service ? {
-    service: spec.nativeData,
-    ports: await getServicePorts(spec.nativeData)
-  } : await createServiceFromEndpoints(name, namespace, spec.endpoints, data.cluster, opts);
-  const serviceName = await toPromise(serviceData.service.metadata.name);
+  const backends = Object.values(spec.rules).flatMap((rule) => rule.backends);
+  if (backends.length === 0) {
+    throw new Error(`Gateway route "${name}" has no backends to expose.`);
+  }
+  const firstBackend = backends[0];
+  const backendData = await resolveBackendFromEndpoints({
+    routeName: name,
+    backendName: "0",
+    endpoints: firstBackend.endpoints,
+    namespace,
+    cluster: data.cluster,
+    opts
+  });
   const backendPort = await selectBackendPort({
-    ports: serviceData.ports,
+    ports: backendData.ports,
     protocol,
-    targetPort: spec.targetPort,
-    serviceName,
+    targetPort: backendData.preferredTargetPort,
+    serviceName: backendData.serviceName,
     routeName: name
   });
   const listenerPort = await resolveListenerPort({
@@ -111,51 +162,35 @@ async function createL4GatewayRoute({
     routeName: name
   });
   const listenerName = `${protocol.toLowerCase()}-${listenerPort}`;
-  const gateway = await Gateway.createOnce(
-    {
-      name: data.className,
-      namespace,
-      gatewayClassName: data.className,
-      listeners: [
-        {
-          name: listenerName,
-          port: listenerPort,
-          protocol
-        }
-      ]
-    },
-    opts
-  );
-  const backendRef = serviceData.service.metadata.apply((metadata) => {
-    if (!metadata?.name) {
-      throw new Error(
-        `Service "${serviceName}" referenced by gateway route "${name}" does not have a name.`
-      );
-    }
-    return {
-      name: metadata.name,
-      namespace: metadata.namespace,
-      port: backendPort.port
-    };
-  });
+  const gatewayName = name;
+  const gatewayResourceName = name;
+  const gateway = Gateway.create(gatewayResourceName, {
+    name: gatewayName,
+    namespace,
+    gatewayClassName: data.className,
+    listeners: [
+      {
+        name: listenerName,
+        port: listenerPort,
+        protocol
+      }
+    ]
+  }, opts);
+  const backendRef = {
+    name: backendData.serviceName,
+    namespace: backendData.serviceNamespace,
+    port: backendPort.port
+  };
   const routeOpts = { ...opts, parent: gateway };
-  const route = protocol === "TCP" ? new TcpRoute(
-    name,
-    {
-      gateway,
-      listenerName,
-      backend: backendRef
-    },
-    routeOpts
-  ) : new UdpRoute(
-    name,
-    {
-      gateway,
-      listenerName,
-      backend: backendRef
-    },
-    routeOpts
-  );
+  const route = protocol === "TCP" ? new TcpRoute(name, {
+    gateway,
+    listenerName,
+    backend: backendRef
+  }, routeOpts) : new UdpRoute(name, {
+    gateway,
+    listenerName,
+    backend: backendRef
+  }, routeOpts);
   return {
     resource: route,
     endpoints: await toPromise(gateway.endpoints)
@@ -164,7 +199,7 @@ async function createL4GatewayRoute({
 async function getCertificateSecret(_name, namespace, tlsCertificate) {
   const resolvedCertificate = await toPromise(tlsCertificate);
   if (!resolvedCertificate) {
-    return void 0;
+    return;
   }
   const resource = await toPromise(resolvedCertificate.resource);
   if (resource instanceof Certificate) {
@@ -176,9 +211,68 @@ async function getCertificateSecret(_name, namespace, tlsCertificate) {
       return await toPromise(resource.secret);
     }
   }
-  throw new Error(
-    "Not implemented: copying certificate secret across namespaces/clusters/different systems"
-  );
+  throw new Error("Not implemented: copying certificate secret across namespaces/clusters/different systems");
+}
+function resolveRouteProtocol(spec) {
+  const rules = Object.values(spec.rules);
+  if (rules.length === 0) {
+    throw new Error("Gateway route must contain at least one rule");
+  }
+  const type = rules[0].type;
+  if (rules.some((rule) => rule.type !== type)) {
+    throw new Error("Gateway route rules must use the same protocol type");
+  }
+  return type;
+}
+async function resolveBackendFromEndpoints({
+  routeName,
+  backendName,
+  endpoints,
+  namespace,
+  cluster,
+  opts
+}) {
+  const serviceMeta = getServiceMetadataFromEndpoints(endpoints, cluster);
+  if (serviceMeta) {
+    const metadataPorts = endpoints.map((endpoint) => ({
+      name: typeof serviceMeta.targetPort === "string" ? serviceMeta.targetPort : undefined,
+      port: endpoint.port,
+      protocol: endpoint.protocol.toUpperCase(),
+      targetPort: serviceMeta.targetPort
+    }));
+    return {
+      serviceName: serviceMeta.name,
+      serviceNamespace: serviceMeta.namespace,
+      ports: metadataPorts,
+      preferredTargetPort: serviceMeta.targetPort
+    };
+  }
+  const syntheticService = await createServiceFromEndpoints(`${routeName}-${backendName}`, namespace, endpoints, cluster, opts);
+  const syntheticServiceName = await toPromise(syntheticService.service.metadata.name);
+  const syntheticServiceNamespace = await toPromise(syntheticService.service.metadata.namespace);
+  if (!syntheticServiceNamespace) {
+    throw new Error(`Synthetic backend service "${syntheticServiceName}" for gateway route "${routeName}" has no namespace.`);
+  }
+  return {
+    serviceName: syntheticServiceName,
+    serviceNamespace: syntheticServiceNamespace,
+    ports: syntheticService.ports
+  };
+}
+function getServiceMetadataFromEndpoints(endpoints, cluster) {
+  const serviceEndpoints = endpoints.filter((endpoint) => isEndpointFromCluster(endpoint, cluster));
+  if (serviceEndpoints.length === 0 || serviceEndpoints.length !== endpoints.length) {
+    return;
+  }
+  const first = serviceEndpoints[0].metadata["k8s.service"];
+  if (serviceEndpoints.some((endpoint) => endpoint.metadata["k8s.service"].name !== first.name || endpoint.metadata["k8s.service"].namespace !== first.namespace)) {
+    return;
+  }
+  return {
+    name: first.name,
+    namespace: first.namespace,
+    targetPort: first.targetPort
+  };
 }
 async function createServiceFromEndpoints(name, namespace, endpointsInput, cluster, opts) {
   const endpoints = await toPromise(endpointsInput);
@@ -216,44 +310,21 @@ async function createServiceFromEndpoints(name, namespace, endpointsInput, clust
     ports: ipEndpoints.map(l4EndpointToServicePort)
   });
   const endpointsName = `hs-backend-${name}`;
-  new core.v1.Endpoints(
-    endpointsName,
-    {
-      metadata: mapMetadata({ namespace }, endpointsName),
-      subsets: ipEndpoints.map((endpoint) => ({
-        addresses: [{ ip: endpoint.address.value }],
-        ports: [l4EndpointToServicePort(endpoint)]
-      }))
-    },
-    { ...opts, provider: getProvider(cluster), parent: service }
-  );
+  new core.v1.Endpoints(endpointsName, {
+    metadata: mapMetadata({ namespace }, endpointsName),
+    subsets: ipEndpoints.map((endpoint) => ({
+      addresses: [{ ip: endpoint.address.value }],
+      ports: [l4EndpointToServicePort(endpoint)]
+    }))
+  }, { ...opts, provider: getProvider(cluster), parent: service });
   return {
     service,
     ports: ipPortInfos
   };
 }
-async function getServicePorts(service) {
-  const spec = await toPromise(service.spec);
-  const ports = spec.ports ?? [];
-  const result = [];
-  for (const port of ports) {
-    const value = port.port;
-    const protocol = (port.protocol ?? "TCP").toUpperCase();
-    if (value === void 0 || protocol !== "TCP" && protocol !== "UDP") {
-      continue;
-    }
-    result.push({
-      name: port.name ?? void 0,
-      port: value,
-      protocol,
-      targetPort: port.targetPort
-    });
-  }
-  return result;
-}
 function toServicePortInfoFromEndpoint(endpoint) {
   return {
-    name: void 0,
+    name: undefined,
     port: endpoint.port,
     protocol: endpoint.protocol.toUpperCase(),
     targetPort: endpoint.port
@@ -268,15 +339,13 @@ async function selectBackendPort({
 }) {
   const candidates = ports.filter((port) => port.protocol === protocol);
   if (candidates.length === 0) {
-    throw new Error(
-      `Service "${serviceName}" does not expose any ${protocol} ports required by gateway route "${routeName}".`
-    );
+    throw new Error(`Service "${serviceName}" does not expose any ${protocol} ports required by gateway route "${routeName}".`);
   }
   if (!targetPort) {
     return candidates[0];
   }
   const resolvedTarget = await toPromise(targetPort);
-  if (resolvedTarget === void 0 || resolvedTarget === null) {
+  if (resolvedTarget === undefined || resolvedTarget === null) {
     return candidates[0];
   }
   if (typeof resolvedTarget === "number") {
@@ -292,9 +361,7 @@ async function selectBackendPort({
     if (match2) {
       return match2;
     }
-    throw new Error(
-      `Gateway route "${routeName}" requested target port ${resolvedTarget}, but service "${serviceName}" does not expose it for ${protocol} backends.`
-    );
+    throw new Error(`Gateway route "${routeName}" requested target port ${resolvedTarget}, but service "${serviceName}" does not expose it for ${protocol} backends.`);
   }
   const targetString = String(resolvedTarget);
   const match = candidates.find((candidate) => {
@@ -309,9 +376,7 @@ async function selectBackendPort({
   if (match) {
     return match;
   }
-  throw new Error(
-    `Gateway route "${routeName}" requested target port "${targetString}", but service "${serviceName}" does not expose it for ${protocol} backends.`
-  );
+  throw new Error(`Gateway route "${routeName}" requested target port "${targetString}", but service "${serviceName}" does not expose it for ${protocol} backends.`);
 }
 async function resolveListenerPort({
   requestedPort,
@@ -323,23 +388,18 @@ async function resolveListenerPort({
     return backendPort.port;
   }
   const resolved = await toPromise(requestedPort);
-  if (resolved === void 0 || resolved === null) {
+  if (resolved === undefined || resolved === null) {
     return backendPort.port;
   }
   if (!Number.isInteger(resolved)) {
-    throw new Error(
-      `Gateway route "${routeName}" must use integer listener ports for ${protocol.toLowerCase()} traffic.`
-    );
+    throw new Error(`Gateway route "${routeName}" must use integer listener ports for ${protocol.toLowerCase()} traffic.`);
   }
   const port = Number(resolved);
   if (port < 1 || port > 65535) {
-    throw new Error(
-      `Gateway route "${routeName}" specified listener port ${port}, which is outside the valid range 1-65535.`
-    );
+    throw new Error(`Gateway route "${routeName}" specified listener port ${port}, which is outside the valid range 1-65535.`);
   }
   return port;
 }
-
-export { createGatewayRoute };
-//# sourceMappingURL=gateway-route.js.map
-//# sourceMappingURL=gateway-route.js.map
+export {
+  createGatewayRoute
+};

package/dist/impl/tls-certificate.js

@@ -1,32 +1,32 @@
-import { Certificate } from '../chunk-BR2CLUUD.js';
-import '../chunk-4G6LLC2X.js';
-import { getProvider, Namespace } from '../chunk-OBDQONMV.js';
-import '../chunk-PZ5AY32C.js';
-import { tlsCertificateMediator } from '@highstate/common';
-import { k8s } from '@highstate/library';
+// @bun
+import {
+  Certificate
+} from "../chunk-556pc9e6.js";
+import {
+  Namespace,
+  getProvider
+} from "../chunk-facs31cb.js";
+import"../chunk-b05q6fm2.js";
 
-var createCertificate = tlsCertificateMediator.implement(
-  k8s.tlsIssuerDataSchema,
-  ({ name, spec, opts }, data) => {
-    const provider = getProvider(data.cluster);
-    const namespace = spec.nativeData instanceof Namespace ? spec.nativeData : Namespace.get("cert-manager", { name: "cert-manager", cluster: data.cluster });
-    return Certificate.create(
-      name,
-      {
-        namespace,
-        commonName: spec.commonName,
-        dnsNames: spec.dnsNames,
-        issuerRef: {
-          name: data.clusterIssuerName,
-          kind: "ClusterIssuer"
-        },
-        secretName: `hs-certificate-${name}`
-      },
-      { ...opts, provider }
-    );
-  }
-);
-
-export { createCertificate };
-//# sourceMappingURL=tls-certificate.js.map
-//# sourceMappingURL=tls-certificate.js.map
+// src/impl/tls-certificate.ts
+import { tlsCertificateMediator } from "@highstate/common";
+import { k8s } from "@highstate/library";
+var createCertificate = tlsCertificateMediator.implement(k8s.tlsIssuerDataSchema, ({ name, spec, opts }, data) => {
+  const provider = getProvider(data.cluster);
+  const metadata = spec.metadata;
+  const metadataNamespace = metadata?.["k8s.namespace"];
+  const namespace = metadataNamespace instanceof Namespace ? metadataNamespace : metadataNamespace ? Namespace.for(metadataNamespace, data.cluster) : Namespace.get("cert-manager", { name: "cert-manager", cluster: data.cluster });
+  return Certificate.create(name, {
+    namespace,
+    commonName: spec.commonName,
+    dnsNames: spec.dnsNames,
+    issuerRef: {
+      name: data.clusterIssuerName,
+      kind: "ClusterIssuer"
+    },
+    secretName: `hs-certificate-${name}`
+  }, { ...opts, provider });
+});
+export {
+  createCertificate
+};