@highstate/k8s 0.20.0 → 0.21.1

package/dist/chunk-SZKOAHNX.js

@@ -1,1804 +0,0 @@
-import { isEndpointFromCluster, mapServiceToLabelSelector, Service, mapContainerPortToServicePort } from './chunk-OG2OPX7B.js';
-import { commonExtraArgs, NamespacedResource, Namespace, mapMetadata, getProvider, Secret, mapSelectorLikeToSelector, getProviderAsync, mapNamespaceNameToSelector, getNamespaceName, images_exports, getClusterKubeconfigContent } from './chunk-TOLFVF4S.js';
-import { z, getOrCreate, trimIndentation } from '@highstate/contract';
-import { k8s } from '@highstate/library';
-import { ComponentResource, makeEntityOutput, output, toPromise, interpolate, normalize, normalizeInputs, makeFileOutput } from '@highstate/pulumi';
-import { core, networking } from '@pulumi/kubernetes';
-import { deepmerge } from 'deepmerge-ts';
-import { omit, concat, map, groupBy, isNonNullish, mergeDeep, uniqueBy, flat, merge, unique, filter } from 'remeda';
-import { ImplementationMediator, parseEndpoint, addressToCidr, endpointToString, l3EndpointToCidr, AccessPointRoute, mergeEndpoints } from '@highstate/common';
-import { output as output$1, interpolate as interpolate$1 } from '@pulumi/pulumi';
-import { sha256 } from 'crypto-hash';
-
-var ConfigMap = class _ConfigMap extends NamespacedResource {
-  constructor(type, name, args, opts, metadata, namespace, data) {
-    super(type, name, args, opts, metadata, namespace);
-    this.data = data;
-  }
-  static apiVersion = "v1";
-  static kind = "ConfigMap";
-  /**
-   * The Highstate config map entity.
-   */
-  get entity() {
-    return makeEntityOutput({
-      entity: k8s.configMapEntity,
-      identity: this.metadata.uid,
-      meta: {
-        title: this.metadata.name
-      },
-      value: {
-        ...this.entityBase
-      }
-    });
-  }
-  /**
-   * Creates a new config map.
-   */
-  static create(name, args, opts) {
-    return new CreatedConfigMap(name, args, opts);
-  }
-  /**
-   * Creates a new config map or patches an existing one.
-   *
-   * @param name The name of the resource. May not be the same as the config map name.
-   * @param args The arguments to create or patch the config map with.
-   * @param opts Optional resource options.
-   */
-  static createOrPatch(name, args, opts) {
-    if (args.existing) {
-      return new ConfigMapPatch(name, {
-        ...args,
-        name: output(args.existing).metadata.name
-      });
-    }
-    return new CreatedConfigMap(name, args, opts);
-  }
-  /**
-   * Creates a new config map or gets an existing one.
-   *
-   * @param name The name of the resource. May not be the same as the config map name. Will not be used when existing config map is retrieved.
-   * @param args The arguments to create or get the config map with.
-   * @param opts Optional resource options.
-   */
-  static async createOrGet(name, args, opts) {
-    if (args.existing) {
-      return await _ConfigMap.forAsync(args.existing, output(args.namespace).cluster);
-    }
-    return new CreatedConfigMap(name, args, opts);
-  }
-  /**
-   * Patches an existing config map.
-   *
-   * Will throw an error if the config map does not exist.
-   *
-   * @param name The name of the resource. May not be the same as the config map name.
-   * @param args The arguments to patch the config map with.
-   * @param opts Optional resource options.
-   */
-  static patch(name, args, opts) {
-    return new ConfigMapPatch(name, args, opts);
-  }
-  /**
-   * Wraps an existing Kubernetes config map.
-   */
-  static wrap(name, args, opts) {
-    return new WrappedConfigMap(name, args, opts);
-  }
-  /**
-   * Gets an existing config map.
-   *
-   * Will throw an error if the config map does not exist.
-   */
-  static get(name, args, opts) {
-    return new ExternalConfigMap(name, args, opts);
-  }
-  static configMapCache = /* @__PURE__ */ new Map();
-  /**
-   * Gets an existing config map for a given entity.
-   * Prefer this method over `get` when possible.
-   *
-   * It automatically names the resource with the following format: `{clusterName}.{namespace}.{name}.{clusterId}`.
-   *
-   * This method is idempotent and will return the same instance for the same entity.
-   *
-   * @param entity The entity to get the config map for.
-   * @param cluster The cluster where the config map is located.
-   */
-  static for(entity, cluster) {
-    return getOrCreate(
-      _ConfigMap.configMapCache,
-      `${entity.clusterName}.${entity.metadata.namespace}.${entity.metadata.name}.${entity.clusterId}`,
-      (name) => {
-        return _ConfigMap.get(name, {
-          name: entity.metadata.name,
-          namespace: Namespace.forResource(entity, cluster)
-        });
-      }
-    );
-  }
-  /**
-   * Gets an existing config map for a given entity.
-   * Prefer this method over `get` when possible.
-   *
-   * It automatically names the resource with the following format: `{clusterName}.{namespace}.{name}.{clusterId}`.
-   *
-   * This method is idempotent and will return the same instance for the same entity.
-   *
-   * @param entity The entity to get the config map for.
-   * @param cluster The cluster where the config map is located.
-   */
-  static async forAsync(entity, cluster) {
-    const resolvedEntity = await toPromise(entity);
-    return _ConfigMap.for(resolvedEntity, cluster);
-  }
-};
-var CreatedConfigMap = class extends ConfigMap {
-  constructor(name, args, opts) {
-    const configMap = output(args.namespace).cluster.apply((cluster) => {
-      return new core.v1.ConfigMap(
-        name,
-        {
-          metadata: mapMetadata(args, name),
-          data: args.data
-        },
-        {
-          ...opts,
-          parent: this,
-          provider: getProvider(cluster)
-        }
-      );
-    });
-    super(
-      "highstate:k8s:ConfigMap",
-      name,
-      args,
-      opts,
-      configMap.metadata,
-      output(args.namespace),
-      configMap.data
-    );
-  }
-};
-var ConfigMapPatch = class extends ConfigMap {
-  constructor(name, args, opts) {
-    const configMap = output(args.namespace).cluster.apply((cluster) => {
-      return new core.v1.ConfigMapPatch(
-        name,
-        {
-          metadata: mapMetadata(args, name),
-          data: args.data
-        },
-        {
-          ...opts,
-          parent: this,
-          provider: getProvider(cluster)
-        }
-      );
-    });
-    super(
-      "highstate:k8s:ConfigMapPatch",
-      name,
-      args,
-      opts,
-      configMap.metadata,
-      output(args.namespace),
-      configMap.data
-    );
-  }
-};
-var WrappedConfigMap = class extends ConfigMap {
-  constructor(name, args, opts) {
-    super(
-      "highstate:k8s:WrappedConfigMap",
-      name,
-      args,
-      opts,
-      output(args.configMap).metadata,
-      output(args.namespace),
-      output(args.configMap).data
-    );
-  }
-};
-var ExternalConfigMap = class extends ConfigMap {
-  constructor(name, args, opts) {
-    const configMap = output(args.namespace).cluster.apply((cluster) => {
-      return core.v1.ConfigMap.get(
-        name,
-        interpolate`${output(args.namespace).metadata.name}/${args.name}`,
-        { ...opts, parent: this, provider: getProvider(cluster) }
-      );
-    });
-    super(
-      "highstate:k8s:ExternalConfigMap",
-      name,
-      args,
-      opts,
-      configMap.metadata,
-      output(args.namespace),
-      configMap.data
-    );
-  }
-};
-var extraPersistentVolumeClaimArgs = [...commonExtraArgs, "size"];
-var PersistentVolumeClaim = class _PersistentVolumeClaim extends NamespacedResource {
-  constructor(type, name, args, opts, metadata, namespace, spec, status) {
-    super(type, name, args, opts, metadata, namespace);
-    this.spec = spec;
-    this.status = status;
-  }
-  static apiVersion = "v1";
-  static kind = "PersistentVolumeClaim";
-  /**
-   * The Highstate PVC entity.
-   */
-  get entity() {
-    return makeEntityOutput({
-      entity: k8s.persistentVolumeClaimEntity,
-      identity: this.metadata.uid,
-      meta: {
-        title: this.metadata.name
-      },
-      value: {
-        ...this.entityBase
-      }
-    });
-  }
-  /**
-   * Creates a new PVC.
-   */
-  static create(name, args, opts) {
-    return new CreatedPersistentVolumeClaim(name, args, opts);
-  }
-  /**
-   * Creates a new PVC or patches an existing one.
-   *
-   * @param name The name of the resource. May not be the same as the PVC name.
-   * @param args The arguments to create or patch the PVC with.
-   * @param opts Optional resource options.
-   */
-  static createOrPatch(name, args, opts) {
-    if (args.existing) {
-      return new PersistentVolumeClaimPatch(name, {
-        ...args,
-        name: output(args.existing).metadata.name
-      });
-    }
-    return new CreatedPersistentVolumeClaim(name, args, opts);
-  }
-  /**
-   * Creates a new PVC or gets an existing one.
-   *
-   * @param name The name of the resource. May not be the same as the PVC name. Will not be used when existing PVC is retrieved.
-   * @param args The arguments to create or get the PVC with.
-   * @param opts Optional resource options.
-   */
-  static async createOrGet(name, args, opts) {
-    if (args.existing) {
-      return await _PersistentVolumeClaim.forAsync(args.existing, output(args.namespace).cluster);
-    }
-    return new CreatedPersistentVolumeClaim(name, args, opts);
-  }
-  /**
-   * Patches an existing PVC.
-   *
-   * Will throw an error if the PVC does not exist.
-   *
-   * @param name The name of the resource. May not be the same as the PVC name.
-   * @param args The arguments to patch the PVC with.
-   * @param opts Optional resource options.
-   */
-  static patch(name, args, opts) {
-    return new PersistentVolumeClaimPatch(name, args, opts);
-  }
-  /**
-   * Wraps an existing Kubernetes PVC.
-   */
-  static wrap(name, args, opts) {
-    return new WrappedPersistentVolumeClaim(name, args, opts);
-  }
-  /**
-   * Gets an existing PVC.
-   *
-   * Will throw an error if the PVC does not exist.
-   */
-  static get(name, args, opts) {
-    return new ExternalPersistentVolumeClaim(name, args, opts);
-  }
-  static pvcCache = /* @__PURE__ */ new Map();
-  /**
-   * Gets an existing PVC for a given entity.
-   * Prefer this method over `get` when possible.
-   *
-   * It automatically names the resource with the following format: `{clusterName}.{namespace}.{name}.{clusterId}`.
-   *
-   * This method is idempotent and will return the same instance for the same entity.
-   *
-   * @param entity The entity to get the PVC for.
-   * @param cluster The cluster where the PVC is located.
-   */
-  static for(entity, cluster) {
-    return getOrCreate(
-      _PersistentVolumeClaim.pvcCache,
-      `${entity.clusterName}.${entity.metadata.namespace}.${entity.metadata.name}.${entity.clusterId}`,
-      (name) => {
-        return _PersistentVolumeClaim.get(name, {
-          name: entity.metadata.name,
-          namespace: Namespace.forResource(entity, cluster)
-        });
-      }
-    );
-  }
-  /**
-   * Gets an existing PVC for a given entity.
-   * Prefer this method over `get` when possible.
-   *
-   * It automatically names the resource with the following format: `{clusterName}.{namespace}.{name}.{clusterId}`.
-   *
-   * This method is idempotent and will return the same instance for the same entity.
-   *
-   * @param entity The entity to get the PVC for.
-   * @param cluster The cluster where the PVC is located.
-   */
-  static async forAsync(entity, cluster) {
-    const resolvedEntity = await toPromise(entity);
-    return _PersistentVolumeClaim.for(resolvedEntity, cluster);
-  }
-};
-var CreatedPersistentVolumeClaim = class extends PersistentVolumeClaim {
-  constructor(name, args, opts) {
-    const pvc = output(args.namespace).cluster.apply((cluster) => {
-      return new core.v1.PersistentVolumeClaim(
-        name,
-        {
-          metadata: mapMetadata(args, name),
-          spec: output(args).apply((args2) => {
-            return deepmerge(
-              {
-                accessModes: ["ReadWriteOnce"],
-                resources: {
-                  requests: {
-                    storage: args2.size ?? "100Mi"
-                  }
-                }
-              },
-              omit(args2, extraPersistentVolumeClaimArgs)
-            );
-          })
-        },
-        {
-          ...opts,
-          parent: this,
-          provider: getProvider(cluster)
-        }
-      );
-    });
-    super(
-      "highstate:k8s:PersistentVolumeClaim",
-      name,
-      args,
-      opts,
-      pvc.metadata,
-      output(args.namespace),
-      pvc.spec,
-      pvc.status
-    );
-  }
-};
-var PersistentVolumeClaimPatch = class extends PersistentVolumeClaim {
-  constructor(name, args, opts) {
-    const pvc = output(args.namespace).cluster.apply((cluster) => {
-      return new core.v1.PersistentVolumeClaimPatch(
-        name,
-        {
-          metadata: mapMetadata(args, name),
-          spec: output(args).apply((args2) => {
-            return deepmerge(
-              {
-                accessModes: ["ReadWriteOnce"],
-                resources: {
-                  requests: {
-                    storage: args2.size ?? "100Mi"
-                  }
-                }
-              },
-              omit(args2, extraPersistentVolumeClaimArgs)
-            );
-          })
-        },
-        {
-          ...opts,
-          parent: this,
-          provider: getProvider(cluster)
-        }
-      );
-    });
-    super(
-      "highstate:k8s:PersistentVolumeClaimPatch",
-      name,
-      args,
-      opts,
-      pvc.metadata,
-      output(args.namespace),
-      pvc.spec,
-      pvc.status
-    );
-  }
-};
-var WrappedPersistentVolumeClaim = class extends PersistentVolumeClaim {
-  constructor(name, args, opts) {
-    super(
-      "highstate:k8s:WrappedPersistentVolumeClaim",
-      name,
-      args,
-      opts,
-      output(args.pvc).metadata,
-      output(args.namespace),
-      output(args.pvc).spec,
-      output(args.pvc).status
-    );
-  }
-};
-var ExternalPersistentVolumeClaim = class extends PersistentVolumeClaim {
-  constructor(name, args, opts) {
-    const pvc = output(args.namespace).cluster.apply((cluster) => {
-      return core.v1.PersistentVolumeClaim.get(
-        name,
-        interpolate`${output(args.namespace).metadata.name}/${args.name}`,
-        { ...opts, parent: this, provider: getProvider(cluster) }
-      );
-    });
-    super(
-      "highstate:k8s:ExternalPersistentVolumeClaim",
-      name,
-      args,
-      opts,
-      pvc.metadata,
-      output(args.namespace),
-      pvc.spec,
-      pvc.status
-    );
-  }
-};
-function getAutoVolumeName(workloadName, index) {
-  if (index === 0) {
-    return `${workloadName}-data`;
-  }
-  return `${workloadName}-data-${index}`;
-}
-var containerExtraArgs = [
-  "port",
-  "volumeMount",
-  "volume",
-  "environment",
-  "environmentSource",
-  "environmentSources"
-];
-function getFallbackContainerName(name, index) {
-  if (index === 0) {
-    return name;
-  }
-  return `${name}-${index}`;
-}
-function mapContainerToRaw(container, cluster, fallbackName) {
-  const containerName = container.name ?? fallbackName;
-  const spec = {
-    ...omit(container, containerExtraArgs),
-    name: containerName,
-    ports: normalize(container.port, container.ports),
-    volumeMounts: map(normalize(container.volumeMount, container.volumeMounts), mapVolumeMount),
-    env: concat(
-      container.environment ? mapContainerEnvironment(container.environment) : [],
-      container.env ?? []
-    ),
-    envFrom: concat(
-      map(
-        normalize(container.environmentSource, container.environmentSources),
-        mapEnvironmentSource
-      ),
-      container.envFrom ?? []
-    )
-  };
-  if (container.enableTun) {
-    spec.securityContext ??= {};
-    spec.securityContext.capabilities ??= {};
-    spec.securityContext.capabilities.add = ["NET_ADMIN"];
-    if (cluster.quirks?.tunDevicePolicy?.type === "plugin") {
-      spec.resources ??= {};
-      spec.resources.limits ??= {};
-      spec.resources.limits[cluster.quirks.tunDevicePolicy.resourceName] = cluster.quirks.tunDevicePolicy.resourceValue;
-    } else {
-      spec.volumeMounts ??= [];
-      spec.volumeMounts.push({
-        name: "tun-device",
-        mountPath: "/dev/net/tun",
-        readOnly: false
-      });
-    }
-  }
-  return spec;
-}
-function mapContainerEnvironment(environment) {
-  const envVars = [];
-  for (const [name, value] of Object.entries(environment)) {
-    if (!value) {
-      continue;
-    }
-    if (typeof value === "string") {
-      envVars.push({ name, value });
-      continue;
-    }
-    if ("secret" in value) {
-      envVars.push({
-        name,
-        valueFrom: {
-          secretKeyRef: {
-            name: value.secret.metadata.name,
-            key: value.key
-          }
-        }
-      });
-      continue;
-    }
-    if ("configMap" in value) {
-      envVars.push({
-        name,
-        valueFrom: {
-          configMapKeyRef: {
-            name: value.configMap.metadata.name,
-            key: value.key
-          }
-        }
-      });
-      continue;
-    }
-    envVars.push({ name, valueFrom: value });
-  }
-  return envVars;
-}
-function mapVolumeMount(volumeMount) {
-  if ("volume" in volumeMount) {
-    return omit(
-      {
-        ...volumeMount,
-        name: output(volumeMount.volume).apply(mapWorkloadVolume).apply((volume) => output(volume.name))
-      },
-      ["volume"]
-    );
-  }
-  return {
-    ...volumeMount,
-    name: volumeMount.name
-  };
-}
-function mapEnvironmentSource(envFrom) {
-  if (envFrom instanceof core.v1.ConfigMap || envFrom instanceof ConfigMap) {
-    return {
-      configMapRef: {
-        name: envFrom.metadata.name
-      }
-    };
-  }
-  if (envFrom instanceof core.v1.Secret || envFrom instanceof Secret) {
-    return {
-      secretRef: {
-        name: envFrom.metadata.name
-      }
-    };
-  }
-  return envFrom;
-}
-function mapWorkloadVolume(volume) {
-  if (volume instanceof PersistentVolumeClaim) {
-    return {
-      name: volume.metadata.name,
-      persistentVolumeClaim: {
-        claimName: volume.metadata.name
-      }
-    };
-  }
-  if (volume instanceof Secret) {
-    return {
-      name: volume.metadata.name,
-      secret: {
-        secretName: volume.metadata.name
-      }
-    };
-  }
-  if (volume instanceof ConfigMap) {
-    return {
-      name: volume.metadata.name,
-      configMap: {
-        name: volume.metadata.name
-      }
-    };
-  }
-  if (core.v1.PersistentVolumeClaim.isInstance(volume)) {
-    return {
-      name: volume.metadata.name,
-      persistentVolumeClaim: {
-        claimName: volume.metadata.name
-      }
-    };
-  }
-  if (core.v1.ConfigMap.isInstance(volume)) {
-    return {
-      name: volume.metadata.name,
-      configMap: {
-        name: volume.metadata.name
-      }
-    };
-  }
-  if (core.v1.Secret.isInstance(volume)) {
-    return {
-      name: volume.metadata.name,
-      secret: {
-        secretName: volume.metadata.name
-      }
-    };
-  }
-  return volume;
-}
-function getWorkloadVolumeResourceUuid(volume) {
-  if (volume instanceof PersistentVolumeClaim) {
-    return volume.metadata.uid;
-  }
-  if (volume instanceof Secret) {
-    return volume.metadata.uid;
-  }
-  if (volume instanceof ConfigMap) {
-    return volume.metadata.uid;
-  }
-  if (core.v1.PersistentVolumeClaim.isInstance(volume)) {
-    return volume.metadata.uid;
-  }
-  if (core.v1.ConfigMap.isInstance(volume)) {
-    return volume.metadata.uid;
-  }
-  if (core.v1.Secret.isInstance(volume)) {
-    return volume.metadata.uid;
-  }
-  return output(void 0);
-}
-
-// src/network.ts
-function getBestEndpoint(endpoints, cluster) {
-  if (!endpoints.length) {
-    return void 0;
-  }
-  if (endpoints.length === 1) {
-    return endpoints[0];
-  }
-  if (cluster) {
-    const clusterEndpoint = endpoints.find(
-      (endpoint) => isEndpointFromCluster(endpoint, cluster) && endpoint.metadata["k8s.service"].isInternal
-    );
-    if (clusterEndpoint) {
-      return clusterEndpoint;
-    }
-  }
-  const publicEndpoint = endpoints.find((endpoint) => endpoint.metadata["iana.scope"] === "global");
-  if (publicEndpoint) {
-    return publicEndpoint;
-  }
-  return endpoints[0];
-}
-function requireBestEndpoint(endpoints, cluster) {
-  const endpoint = getBestEndpoint(endpoints, cluster);
-  if (!endpoint) {
-    throw new Error(`No best endpoint found for cluster "${cluster.name}" (${cluster.id})`);
-  }
-  return endpoint;
-}
-var networkPolicyMediator = new ImplementationMediator(
-  "network-policy",
-  z.object({ name: z.string(), args: z.custom() }),
-  z.instanceof(ComponentResource)
-);
-var NetworkPolicy = class _NetworkPolicy extends ComponentResource {
-  /**
-   * The underlying network policy resource.
-   */
-  networkPolicy;
-  constructor(name, args, opts) {
-    super("k8s:network-policy", name, args, opts);
-    const normalizedArgs = output(args).apply(async (args2) => {
-      const ingressRules = normalize(args2.ingressRule, args2.ingressRules);
-      const egressRules = normalize(args2.egressRule, args2.egressRules);
-      const cluster = await toPromise(args2.namespace.cluster);
-      const extraEgressRules = [];
-      if (args2.allowKubeDns) {
-        extraEgressRules.push({
-          namespaces: ["kube-system"],
-          namespaceSelectors: [],
-          selectors: [{ matchLabels: { "k8s-app": "kube-dns" } }],
-          ports: [{ port: 53, protocol: "UDP" }],
-          all: false,
-          clusterPods: false,
-          cidrs: [],
-          fqdns: [],
-          services: []
-        });
-      }
-      return {
-        ...args2,
-        podSelector: args2.selector ? mapSelectorLikeToSelector(args2.selector) : {},
-        cluster,
-        isolateEgress: args2.isolateEgress ?? false,
-        isolateIngress: args2.isolateIngress ?? false,
-        allowKubeApiServer: args2.allowKubeApiServer ?? false,
-        ingressRules: ingressRules.flatMap((rule) => {
-          const endpoints = normalize(rule?.fromEndpoint, rule?.fromEndpoints);
-          const parsedEndpoints = endpoints.map((endpoint) => parseEndpoint(endpoint));
-          const endpointsNamespaces = groupBy(parsedEndpoints, (endpoint) => {
-            const namespace = isEndpointFromCluster(endpoint, cluster) ? endpoint.metadata["k8s.service"].namespace : "";
-            return namespace;
-          });
-          const l3OnlyRule = endpointsNamespaces[""] ? _NetworkPolicy.getRuleFromEndpoint(void 0, endpointsNamespaces[""], cluster) : void 0;
-          const otherRules = Object.entries(endpointsNamespaces).filter(([key]) => key !== "").map(([, endpoints2]) => {
-            return _NetworkPolicy.getRuleFromEndpoint(void 0, endpoints2, cluster);
-          });
-          return [
-            {
-              all: rule.fromAll ?? false,
-              clusterPods: rule.fromClusterPods ?? false,
-              cidrs: normalize(rule.fromCidr, rule.fromCidrs).concat(l3OnlyRule?.cidrs ?? []),
-              fqdns: [],
-              services: normalize(rule.fromService, rule.fromServices),
-              namespaces: normalize(rule.fromNamespace, rule.fromNamespaces),
-              namespaceSelectors: normalize(
-                rule.fromNamespaceSelector,
-                rule.fromNamespaceSelectors
-              ),
-              selectors: normalize(rule.fromSelector, rule.fromSelectors),
-              ports: normalize(rule.toPort, rule.toPorts)
-            },
-            ...otherRules
-          ].filter((rule2) => !_NetworkPolicy.isEmptyRule(rule2));
-        }),
-        egressRules: egressRules.flatMap((rule) => {
-          const endpoints = normalize(rule?.toEndpoint, rule?.toEndpoints);
-          const parsedEndpoints = endpoints.map((endpoint) => parseEndpoint(endpoint));
-          const endpointsByPortsAnsNamespaces = groupBy(parsedEndpoints, (endpoint) => {
-            const namespace = isEndpointFromCluster(endpoint, cluster) ? endpoint.metadata["k8s.service"].namespace : "";
-            const port = isEndpointFromCluster(endpoint, cluster) ? endpoint.metadata["k8s.service"].targetPort : endpoint.level !== 3 ? endpoint.port : void 0;
-            return `${port ?? "0"}:${namespace}`;
-          });
-          const l3OnlyRule = endpointsByPortsAnsNamespaces["0:"] ? _NetworkPolicy.getRuleFromEndpoint(
-            void 0,
-            endpointsByPortsAnsNamespaces["0:"],
-            cluster
-          ) : void 0;
-          const otherRules = Object.entries(endpointsByPortsAnsNamespaces).filter(([key]) => key !== "0:").map(([key, endpoints2]) => {
-            const [port] = key.split(":");
-            const portNumber = parseInt(port, 10);
-            const portValue = Number.isNaN(portNumber) ? port : portNumber;
-            return _NetworkPolicy.getRuleFromEndpoint(portValue, endpoints2, cluster);
-          });
-          return [
-            {
-              all: rule.toAll ?? false,
-              clusterPods: rule.toClusterPods ?? false,
-              cidrs: normalize(rule.toCidr, rule.toCidrs).concat(l3OnlyRule?.cidrs ?? []),
-              fqdns: normalize(rule.toFqdn, rule.toFqdns).concat(l3OnlyRule?.fqdns ?? []),
-              services: normalize(rule.toService, rule.toServices),
-              namespaces: normalize(rule.toNamespace, rule.toNamespaces),
-              namespaceSelectors: normalize(rule.toNamespaceSelector, rule.toNamespaceSelectors),
-              selectors: normalize(rule.toSelector, rule.toSelectors),
-              ports: normalize(rule.toPort, rule.toPorts)
-            },
-            ...otherRules
-          ].filter((rule2) => !_NetworkPolicy.isEmptyRule(rule2));
-        }).concat(extraEgressRules)
-      };
-    });
-    this.networkPolicy = output(
-      normalizedArgs.apply(async (args2) => {
-        const cluster = args2.cluster;
-        if (cluster.networkPolicyImplRef) {
-          return networkPolicyMediator.call(cluster.networkPolicyImplRef, {
-            name,
-            args: args2
-          });
-        }
-        const nativePolicy = new NativeNetworkPolicy(name, args2, {
-          ...opts,
-          parent: this,
-          provider: await getProviderAsync(output(args2.namespace).cluster)
-        });
-        return nativePolicy.networkPolicy;
-      })
-    );
-  }
-  static getRuleFromEndpoint(port, endpoints, cluster) {
-    const ports = port ? [
-      {
-        port,
-        protocol: endpoints[0].level !== 3 ? endpoints[0].protocol?.toUpperCase() : void 0
-      }
-    ] : [];
-    const cidrs = endpoints.filter((endpoint) => !isEndpointFromCluster(endpoint, cluster)).map((endpoint) => endpoint.address ? addressToCidr(endpoint.address) : null).filter(isNonNullish);
-    const fqdns = endpoints.filter((endpoint) => endpoint.type === "hostname").map((endpoint) => endpoint.hostname);
-    const selectors = endpoints.filter((endpoint) => isEndpointFromCluster(endpoint, cluster)).map((endpoint) => endpoint.metadata["k8s.service"].selector);
-    const namespace = endpoints.filter((endpoint) => isEndpointFromCluster(endpoint, cluster)).map((endpoint) => endpoint.metadata["k8s.service"].namespace)[0];
-    return {
-      all: false,
-      clusterPods: false,
-      cidrs,
-      fqdns,
-      services: [],
-      namespaces: namespace ? [namespace] : [],
-      namespaceSelectors: [],
-      selectors,
-      ports
-    };
-  }
-  static isEmptyRule(rule) {
-    return !rule.all && !rule.clusterPods && rule.cidrs.length === 0 && rule.fqdns.length === 0 && rule.services.length === 0 && rule.namespaces.length === 0 && rule.namespaceSelectors.length === 0 && rule.selectors.length === 0 && rule.ports.length === 0;
-  }
-  /**
-   * Creates network policy to isolate the namespace by denying all traffic to/from it.
-   *
-   * Automatically names the policy as: `isolate-namespace.{clusterName}.{namespace}.{clusterId}`.
-   *
-   * @param namespace The namespace to isolate.
-   * @param opts Optional resource options.
-   */
-  static async isolateNamespace(namespace, opts) {
-    const name = await toPromise(output(namespace).metadata.name);
-    const cluster = await toPromise(output(namespace).cluster);
-    return new _NetworkPolicy(
-      `isolate-namespace.${cluster.name}.${name}.${cluster.id}`,
-      {
-        namespace,
-        description: "By default, deny all traffic to/from the namespace.",
-        isolateEgress: true,
-        isolateIngress: true
-      },
-      opts
-    );
-  }
-  /**
-   * Creates network policy to allow all traffic inside the namespace (pod to pod within same namespace).
-   *
-   * Automatically names the policy as: `allow-inside-namespace.{clusterName}.{namespace}.{clusterId}`.
-   *
-   * @param namespace The namespace to create the policy in.
-   * @param opts Optional resource options.
-   */
-  static async allowInsideNamespace(namespace, opts) {
-    const nsName = await toPromise(output(namespace).metadata.name);
-    const cluster = await toPromise(output(namespace).cluster);
-    return new _NetworkPolicy(
-      `allow-inside-namespace.${cluster.name}.${nsName}.${cluster.id}`,
-      {
-        namespace,
-        description: "Allow all traffic inside the namespace.",
-        ingressRule: { fromNamespace: namespace },
-        egressRule: { toNamespace: namespace }
-      },
-      opts
-    );
-  }
-  /**
-   * Creates network policy to allow traffic from the namespace to the Kubernetes API server.
-   *
-   * Automatically names the policy as: `allow-kube-api-server.{clusterName}.{namespace}.{clusterId}`.
-   *
-   * @param namespace The namespace to create the policy in.
-   * @param opts Optional resource options.
-   */
-  static async allowKubeApiServer(namespace, opts) {
-    const nsName = await toPromise(output(namespace).metadata.name);
-    const cluster = await toPromise(output(namespace).cluster);
-    return new _NetworkPolicy(
-      `allow-kube-api-server.${cluster.name}.${nsName}.${cluster.id}`,
-      {
-        namespace,
-        description: "Allow all traffic to the Kubernetes API server from the namespace.",
-        allowKubeApiServer: true
-      },
-      opts
-    );
-  }
-  /**
-   * Creates network policy to allow egress DNS traffic (UDP 53) required for name resolution.
-   *
-   * Automatically names the policy as: `allow-kube-dns.{clusterName}.{namespace}.{clusterId}`.
-   *
-   * @param namespace The namespace to create the policy in.
-   * @param opts Optional resource options.
-   */
-  static async allowKubeDns(namespace, opts) {
-    const nsName = await toPromise(output(namespace).metadata.name);
-    const cluster = await toPromise(output(namespace).cluster);
-    return new _NetworkPolicy(
-      `allow-kube-dns.${cluster.name}.${nsName}.${cluster.id}`,
-      {
-        namespace,
-        description: "Allow all traffic to the Kubernetes DNS server from the namespace.",
-        allowKubeDns: true
-      },
-      opts
-    );
-  }
-  /**
-   * Creates network policy to allow all egress traffic from the namespace.
-   *
-   * Automatically names the policy as: `allow-all-egress.{clusterName}.{namespace}.{clusterId}`.
-   *
-   * @param namespace The namespace to create the policy in.
-   * @param opts Optional resource options.
-   */
-  static async allowAllEgress(namespace, opts) {
-    const nsName = await toPromise(output(namespace).metadata.name);
-    const cluster = await toPromise(output(namespace).cluster);
-    return new _NetworkPolicy(
-      `allow-all-egress.${cluster.name}.${nsName}.${cluster.id}`,
-      {
-        namespace,
-        description: "Allow all egress traffic from the namespace.",
-        egressRule: { toAll: true }
-      },
-      opts
-    );
-  }
-  /**
-   * Creates network policy to allow all ingress traffic to the namespace.
-   *
-   * Automatically names the policy as: `allow-all-ingress.{clusterName}.{namespace}.{clusterId}`.
-   *
-   * @param namespace The namespace to create the policy in.
-   * @param opts Optional resource options.
-   */
-  static async allowAllIngress(namespace, opts) {
-    const nsName = await toPromise(output(namespace).metadata.name);
-    const cluster = await toPromise(output(namespace).cluster);
-    return new _NetworkPolicy(
-      `allow-all-ingress.${cluster.name}.${nsName}.${cluster.id}`,
-      {
-        namespace,
-        description: "Allow all ingress traffic to the namespace.",
-        ingressRule: { fromAll: true }
-      },
-      opts
-    );
-  }
-  /**
-   * Creates network policy to allow egress traffic to a specific L3/L4 endpoint.
-   *
-   * Automatically names the policy as: `allow-egress-to-<endpoint>.{clusterName}.{namespace}.{clusterId}`.
-   *
-   * @param namespace The namespace to create the policy in.
-   * @param endpoint The endpoint to allow egress to.
-   * @param opts Optional resource options.
-   */
-  static async allowEgressToEndpoint(namespace, endpoint, opts) {
-    const parsedEndpoint = parseEndpoint(endpoint);
-    const endpointStr = endpointToString(parsedEndpoint).replace(/:/g, "-");
-    const nsName = await toPromise(output(namespace).metadata.name);
-    const cluster = await toPromise(output(namespace).cluster);
-    return new _NetworkPolicy(
-      `allow-egress-to-${endpointStr}.${cluster.name}.${nsName}.${cluster.id}`,
-      {
-        namespace,
-        description: `Allow egress traffic to "${endpointToString(parsedEndpoint)}" from the namespace.`,
-        egressRule: { toEndpoint: endpoint }
-      },
-      opts
-    );
-  }
-  /**
-   * Creates network policy to allow egress traffic to the best endpoint among provided candidates.
-   *
-   * Automatically names the policy as: `allow-egress-to-<bestEndpoint>.{clusterName}.{namespace}.{clusterId}`.
-   *
-   * @param namespace The namespace to create the policy in.
-   * @param endpoints The candidate endpoints to select from.
-   * @param opts Optional resource options.
-   */
-  static async allowEgressToBestEndpoint(namespace, endpoints, opts) {
-    const cluster = await toPromise(output(namespace).cluster);
-    const resolvedEndpoints = await toPromise(output(endpoints));
-    const bestEndpoint = requireBestEndpoint(
-      resolvedEndpoints.map((endpoint) => parseEndpoint(endpoint)),
-      cluster
-    );
-    return await _NetworkPolicy.allowEgressToEndpoint(namespace, bestEndpoint, opts);
-  }
-  /**
-   * Creates network policy to allow ingress traffic from a specific L3/L4 endpoint.
-   *
-   * Automatically names the policy as: `allow-ingress-from-<endpoint>.{clusterName}.{namespace}.{clusterId}`.
-   *
-   * @param namespace The namespace to create the policy in.
-   * @param endpoint The endpoint to allow ingress from.
-   * @param opts Optional resource options.
-   */
-  static async allowIngressFromEndpoint(namespace, endpoint, opts) {
-    const parsedEndpoint = parseEndpoint(endpoint);
-    const endpointStr = endpointToString(parsedEndpoint).replace(/:/g, "-");
-    const nsName = await toPromise(output(namespace).metadata.name);
-    const cluster = await toPromise(output(namespace).cluster);
-    return new _NetworkPolicy(
-      `allow-ingress-from-${endpointStr}.${cluster.name}.${nsName}.${cluster.id}`,
-      {
-        namespace,
-        description: interpolate`Allow ingress traffic from "${endpointToString(parsedEndpoint)}" to the namespace.`,
-        ingressRule: { fromEndpoint: endpoint }
-      },
-      opts
-    );
-  }
-};
-var NativeNetworkPolicy = class _NativeNetworkPolicy extends ComponentResource {
-  /**
-   * The underlying native network policy resource.
-   */
-  networkPolicy;
-  constructor(name, args, opts) {
-    super("k8s:native-network-policy", name, args, opts);
-    const ingress = _NativeNetworkPolicy.createIngressRules(args);
-    const egress = _NativeNetworkPolicy.createEgressRules(args);
-    const policyTypes = [];
-    if (ingress.length > 0 || args.isolateIngress) {
-      policyTypes.push("Ingress");
-    }
-    if (egress.length > 0 || args.isolateEgress) {
-      policyTypes.push("Egress");
-    }
-    this.networkPolicy = new networking.v1.NetworkPolicy(
-      name,
-      {
-        metadata: mergeDeep(mapMetadata(args, name), {
-          annotations: args.description ? { "kubernetes.io/description": args.description } : void 0
-        }),
-        spec: {
-          podSelector: args.podSelector,
-          ingress,
-          egress,
-          policyTypes
-        }
-      },
-      { ...opts, parent: this }
-    );
-  }
-  static fallbackIpBlock = {
-    cidr: "0.0.0.0/0",
-    except: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
-  };
-  static fallbackDnsRule = {
-    to: [
-      {
-        namespaceSelector: { matchLabels: { "kubernetes.io/metadata.name": "kube-system" } },
-        podSelector: { matchLabels: { "k8s-app": "kube-dns" } }
-      }
-    ],
-    ports: [{ port: 53, protocol: "UDP" }]
-  };
-  static createIngressRules(args) {
-    return uniqueBy(
-      args.ingressRules.map((rule) => ({
-        from: rule.all ? [] : rule.clusterPods ? [{ namespaceSelector: {} }] : _NativeNetworkPolicy.createRulePeers(rule),
-        ports: _NativeNetworkPolicy.mapPorts(rule.ports)
-      })),
-      (rule) => JSON.stringify(rule)
-    );
-  }
-  static createEgressRules(args) {
-    const extraRules = [];
-    const needKubeDns = args.egressRules.some((rule) => rule.fqdns.length > 0);
-    if (needKubeDns) {
-      extraRules.push(_NativeNetworkPolicy.fallbackDnsRule);
-    }
-    const needFallback = args.egressRules.some(
-      (rule) => rule.fqdns.some((fqdn) => !fqdn.endsWith(".cluster.local"))
-    );
-    if (needFallback) {
-      extraRules.push({ to: [{ ipBlock: _NativeNetworkPolicy.fallbackIpBlock }] });
-    }
-    if (args.allowKubeApiServer) {
-      const { quirks, apiEndpoints } = args.cluster;
-      if (quirks?.fallbackKubeApiAccess) {
-        extraRules.push({
-          to: [{ ipBlock: { cidr: `${quirks?.fallbackKubeApiAccess.serverIp}/32` } }],
-          ports: [{ port: quirks?.fallbackKubeApiAccess.serverPort, protocol: "TCP" }]
-        });
-      } else {
-        const rules = apiEndpoints.filter((endpoint) => endpoint.type !== "hostname").map((endpoint) => ({
-          to: [{ ipBlock: { cidr: l3EndpointToCidr(endpoint) } }],
-          ports: [{ port: endpoint.port, protocol: "TCP" }]
-        }));
-        extraRules.push(...rules);
-      }
-    }
-    return uniqueBy(
-      args.egressRules.map((rule) => {
-        return {
-          to: rule.all ? [] : rule.clusterPods ? [{ namespaceSelector: {} }] : _NativeNetworkPolicy.createRulePeers(rule),
-          ports: _NativeNetworkPolicy.mapPorts(rule.ports)
-        };
-      }).filter((rule) => rule.to !== void 0).concat(extraRules),
-      (rule) => JSON.stringify(rule)
-    );
-  }
-  static createRulePeers(args) {
-    const peers = uniqueBy(
-      [
-        ..._NativeNetworkPolicy.createCidrPeers(args),
-        ..._NativeNetworkPolicy.createServicePeers(args),
-        ..._NativeNetworkPolicy.createSelectorPeers(args)
-      ],
-      (peer) => JSON.stringify(peer)
-    );
-    return peers.length > 0 ? peers : void 0;
-  }
-  static createCidrPeers(args) {
-    return args.cidrs.map((cidr) => ({ ipBlock: { cidr } }));
-  }
-  static createServicePeers(args) {
-    return args.services.map((service) => {
-      const selector = mapServiceToLabelSelector(service);
-      return {
-        namespaceSelector: mapNamespaceNameToSelector(service.metadata.namespace),
-        podSelector: selector
-      };
-    });
-  }
-  static createSelectorPeers(args) {
-    const selectorPeers = args.selectors.map((selector) => ({
-      podSelector: mapSelectorLikeToSelector(selector)
-    }));
-    const namespacePeers = [
-      ...args.namespaces.map(_NativeNetworkPolicy.createNamespacePeer),
-      ...args.namespaceSelectors.map(_NativeNetworkPolicy.createNamespaceSelectorPeer)
-    ];
-    if (namespacePeers.length === 0) {
-      return selectorPeers;
-    }
-    if (selectorPeers.length === 0) {
-      return namespacePeers;
-    }
-    return flat(
-      selectorPeers.map((selectorPeer) => {
-        return namespacePeers.map((namespacePeer) => merge(selectorPeer, namespacePeer));
-      })
-    );
-  }
-  static createNamespacePeer(namespace) {
-    const namespaceName = getNamespaceName(namespace);
-    const namespaceSelector = mapNamespaceNameToSelector(namespaceName);
-    return { namespaceSelector };
-  }
-  static createNamespaceSelectorPeer(selector) {
-    return {
-      namespaceSelector: mapSelectorLikeToSelector(selector)
-    };
-  }
-  static mapPorts(ports) {
-    return ports.map((port) => {
-      if ("port" in port) {
-        return {
-          port: port.port,
-          protocol: port.protocol ?? "TCP"
-        };
-      }
-      return {
-        port: port.range[0],
-        endPort: port.range[1],
-        protocol: port.protocol ?? "TCP"
-      };
-    });
-  }
-};
-
-// src/pod.ts
-var podSpecDefaults = {
-  automountServiceAccountToken: false
-};
-var workloadExtraArgs = [...commonExtraArgs, "container", "containers"];
-function filterPatchOwnedContainersInTemplate(template, ownedTemplate) {
-  const ownedContainerNames = unique(
-    (ownedTemplate.spec?.containers ?? []).map((container) => container.name).filter(isNonNullish)
-  );
-  const ownedInitContainerNames = unique(
-    (ownedTemplate.spec?.initContainers ?? []).map((container) => container.name).filter(isNonNullish)
-  );
-  const filterByOwnedNames = (source, ownedNames) => {
-    if (!source || source.length === 0 || ownedNames.length === 0) {
-      return void 0;
-    }
-    const filtered = source.filter(
-      (container) => container.name ? ownedNames.includes(container.name) : false
-    );
-    return filtered.length > 0 ? filtered : void 0;
-  };
-  const containers = filterByOwnedNames(template.spec?.containers, ownedContainerNames);
-  const initContainers = filterByOwnedNames(template.spec?.initContainers, ownedInitContainerNames);
-  const {
-    containers: _containers,
-    initContainers: _initContainers,
-    ...restSpec
-  } = template.spec ?? {};
-  const spec = {
-    ...restSpec,
-    ...containers ? { containers } : {},
-    ...initContainers ? { initContainers } : {}
-  };
-  return {
-    ...template,
-    spec
-  };
-}
-var workloadServiceExtraArgs = [
-  ...workloadExtraArgs,
-  "service",
-  "route",
-  "routes"
-];
-function getWorkloadComponents(name, args, parent, opts, isForPatch) {
-  const labels = isForPatch ? void 0 : { "app.kubernetes.io/name": name };
-  const containers = output$1(args).apply((args2) => normalize(args2.container, args2.containers));
-  const initContainers = output$1(args).apply(
-    (args2) => normalize(args2.initContainer, args2.initContainers)
-  );
-  const rawVolumes = output$1({ containers, initContainers }).apply(
-    ({ containers: containers2, initContainers: initContainers2 }) => {
-      const containerVolumes = [...containers2, ...initContainers2].flatMap(
-        (container) => normalize(container.volume, container.volumes)
-      );
-      const containerVolumeMounts = containers2.flatMap((container) => {
-        return normalize(container.volumeMount, container.volumeMounts).map((volumeMount) => {
-          return "volume" in volumeMount ? volumeMount.volume : void 0;
-        }).filter(Boolean);
-      });
-      return output$1([...containerVolumes, ...containerVolumeMounts]);
-    }
-  );
-  const volumes = rawVolumes.apply((rawVolumes2) => {
-    return output$1(rawVolumes2.map(mapWorkloadVolume)).apply(uniqueBy((volume) => volume.name));
-  });
-  const podSpec = output$1({
-    cluster: output$1(args.namespace).cluster,
-    containers,
-    initContainers,
-    volumes
-  }).apply(({ cluster, containers: containers2, initContainers: initContainers2, volumes: volumes2 }) => {
-    const spec = {
-      volumes: volumes2,
-      containers: containers2.map(
-        (container, index) => mapContainerToRaw(container, cluster, getFallbackContainerName(name, index))
-      ),
-      initContainers: initContainers2.map(
-        (container, index) => mapContainerToRaw(container, cluster, getFallbackContainerName(`init-${name}`, index))
-      ),
-      ...podSpecDefaults
-    };
-    if (containers2.some((container) => container.enableTun) && cluster.quirks?.tunDevicePolicy?.type !== "plugin") {
-      spec.volumes = output$1(spec.volumes).apply((volumes3) => [
-        ...volumes3 ?? [],
-        {
-          name: "tun-device",
-          hostPath: {
-            path: "/dev/net/tun"
-          }
-        }
-      ]);
-    }
-    return spec;
-  });
-  const dependencyHash = rawVolumes.apply((rawVolumes2) => {
-    return output$1(rawVolumes2.map(getWorkloadVolumeResourceUuid)).apply(filter(isNonNullish)).apply(unique()).apply((ids) => sha256(ids.join(",")));
-  });
-  const podTemplate = output$1({ podSpec, dependencyHash }).apply(({ podSpec: podSpec2, dependencyHash: dependencyHash2 }) => {
-    return {
-      metadata: {
-        labels,
-        annotations: {
-          // to trigger a redeployment when the volumes change
-          // we embed a hash as annotation name (not value) to allow patching without conflicts
-          [`highstate.io/dependency-hash-${dependencyHash2.slice(32)}`]: "1"
-        }
-      },
-      spec: podSpec2
-    };
-  });
-  const networkPolicy = output$1({ containers }).apply(({ containers: containers2 }) => {
-    if (isForPatch) {
-      return output$1(void 0);
-    }
-    const allowedEndpoints = containers2.flatMap((container) => container.allowedEndpoints ?? []);
-    if (allowedEndpoints.length === 0 && !args.networkPolicy) {
-      return output$1(void 0);
-    }
-    return output$1(
-      new NetworkPolicy(
-        name,
-        {
-          namespace: args.namespace,
-          selector: labels,
-          description: `Network policy for "${name}"`,
-          ...args.networkPolicy,
-          egressRules: output$1(args.networkPolicy?.egressRules).apply((egressRules) => [
-            ...egressRules ?? [],
-            ...allowedEndpoints.length > 0 ? [{ toEndpoints: allowedEndpoints }] : []
-          ])
-        },
-        { ...opts, parent: parent() }
-      )
-    );
-  });
-  return { labels, containers, volumes, podSpec, podTemplate, networkPolicy };
-}
-function getWorkloadServiceComponents(name, args, parent, opts, isForPatch) {
-  const { labels, containers, volumes, podSpec, podTemplate, networkPolicy } = getWorkloadComponents(name, args, parent, opts, isForPatch);
-  const service = output$1({
-    existing: args.existing,
-    serviceArgs: args.service,
-    containers
-  }).apply(({ existing, serviceArgs, containers: containers2 }) => {
-    if (!args.service && !args.route && !args.routes) {
-      return void 0;
-    }
-    if (existing?.service) {
-      return Service.for(existing.service, output$1(args.namespace).cluster);
-    }
-    if (existing) {
-      return void 0;
-    }
-    const ports = containers2.flatMap((container) => normalize(container.port, container.ports));
-    return Service.create(name, {
-      ...serviceArgs,
-      selector: labels,
-      namespace: args.namespace,
-      ports: (
-        // allow to completely override the ports
-        !serviceArgs?.port && !serviceArgs?.ports ? ports.map(mapContainerPortToServicePort) : serviceArgs?.ports
-      )
-    });
-  });
-  const routes = output$1({
-    routesArgs: normalizeInputs(args.route, args.routes),
-    service,
-    namespace: output$1(args.namespace)
-  }).apply(async ({ routesArgs, service: service2, namespace }) => {
-    if (!routesArgs.length || !service2) {
-      return [];
-    }
-    if (args.existing) {
-      return [];
-    }
-    const serviceEndpoints = await toPromise(service2.endpoints);
-    const servicePorts = await toPromise(service2.spec.ports);
-    const resolveServiceEndpoints = async (servicePort, routeName) => {
-      if (serviceEndpoints.length === 0) {
-        throw new Error(`No endpoints found for workload service in route "${routeName}"`);
-      }
-      let resolvedServicePort;
-      if (servicePort != null) {
-        const requestedServicePort = await toPromise(servicePort);
-        if (typeof requestedServicePort === "string") {
-          const namedPort = servicePorts?.find((port) => port.name === requestedServicePort);
-          if (!namedPort) {
-            throw new Error(
-              `Named port "${requestedServicePort}" not found for workload service in route "${routeName}"`
-            );
-          }
-          resolvedServicePort = namedPort.port;
-        } else {
-          resolvedServicePort = requestedServicePort;
-        }
-      } else {
-        resolvedServicePort = serviceEndpoints[0]?.port;
-      }
-      if (resolvedServicePort == null) {
-        throw new Error(
-          `Unable to resolve service port for workload service in route "${routeName}"`
-        );
-      }
-      const filteredEndpoints = serviceEndpoints.filter(
-        (endpoint) => endpoint.port === resolvedServicePort
-      );
-      if (filteredEndpoints.length === 0) {
-        throw new Error(
-          `No endpoints with port ${resolvedServicePort} found for workload service in route "${routeName}"`
-        );
-      }
-      return filteredEndpoints;
-    };
-    return await Promise.all(
-      routesArgs.map(async (routeArgs, index) => {
-        const routeName = `${name}.${index}`;
-        const routeRules = await toPromise(routeArgs.rules);
-        const routeRuleValues = Object.values(routeRules ?? {});
-        const needsDefaultBackend = routeRuleValues.length === 0 || routeRuleValues.some((rule) => rule.servicePort == null);
-        const defaultServiceEndpoints = needsDefaultBackend ? await resolveServiceEndpoints(routeArgs.servicePort, routeName) : void 0;
-        const resolvedRules = routeRules ? await Promise.all(
-          Object.entries(routeRules).map(async ([ruleName, rule]) => {
-            const ruleServiceEndpoints = await resolveServiceEndpoints(
-              rule.servicePort ?? routeArgs.servicePort,
-              `${routeName}:${ruleName}`
-            );
-            return [
-              ruleName,
-              {
-                ...omit(rule, ["servicePort"]),
-                backend: {
-                  endpoints: ruleServiceEndpoints
-                }
-              }
-            ];
-          })
-        ) : void 0;
-        const resolvedRulesInput = resolvedRules ? Object.fromEntries(resolvedRules) : void 0;
-        return new AccessPointRoute(routeName, {
-          ...omit(routeArgs, ["servicePort", "rules"]),
-          ...defaultServiceEndpoints ? {
-            backend: {
-              endpoints: defaultServiceEndpoints
-            }
-          } : {},
-          rules: resolvedRulesInput,
-          metadata: {
-            ...routeArgs.metadata ?? {},
-            "k8s.namespace": namespace
-          }
-        });
-      })
-    );
-  });
-  return { labels, containers, volumes, podSpec, podTemplate, networkPolicy, service, routes };
-}
-var Workload = class extends NamespacedResource {
-  constructor(type, name, args, opts, metadata, namespace, terminalArgs, containers, podTemplate, networkPolicy, _service = output$1(void 0), routes = output$1([])) {
-    super(type, name, args, opts, metadata, namespace);
-    this.name = name;
-    this.terminalArgs = terminalArgs;
-    this.containers = containers;
-    this.podTemplate = podTemplate;
-    this.networkPolicy = networkPolicy;
-    this._service = _service;
-    this.routes = routes;
-  }
-  set terminal(_value) {
-  }
-  set logsTerminal(_value) {
-  }
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: for pulumi which for some reason tries to copy all properties
-  set terminals(_value) {
-  }
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: for pulumi which for some reason tries to copy all properties
-  set optionalService(_value) {
-  }
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: for pulumi which for some reason tries to copy all properties
-  set service(_value) {
-  }
-  // biome-ignore lint/correctness/noUnusedPrivateClassMembers: for pulumi which for some reason tries to copy all properties
-  set selector(_value) {
-  }
-  /**
-   * The service associated with the workload.
-   */
-  get optionalService() {
-    return this._service;
-  }
-  /**
-   * The service associated with the workload.
-   *
-   * Will throw an error if the service is not available.
-   */
-  get service() {
-    return this._service.apply((service) => {
-      if (!service) {
-        throw new Error(`The service of the workload "${this.name}" is not available.`);
-      }
-      return service;
-    });
-  }
-  /**
-   * The merged and deduplicated L3 endpoints of all routes.
-   */
-  get endpoints() {
-    return this.routes.apply(
-      (routes) => output$1(routes.map((route) => route.route.endpoints)).apply((endpoints) => flat(endpoints)).apply(mergeEndpoints)
-    );
-  }
-  /**
-   * The selector matching pods created from this workload's template labels.
-   */
-  get selector() {
-    return this.podTemplate.apply((template) => ({
-      matchLabels: template.metadata?.labels
-    }));
-  }
-  /**
-   * The instance terminal to interact with the workload's pods.
-   */
-  get terminal() {
-    const containerName = this.podTemplate.spec.containers.apply((containers) => containers[0].name);
-    const shell = this.terminalArgs.apply((args) => args.shell ?? "bash");
-    const podLabelSelector = this.templateMetadata.apply((meta) => meta.labels ?? {}).apply(
-      (labels) => Object.entries(labels).map(([key, value]) => `${key}=${value}`).join(",")
-    );
-    return output$1({
-      name: this.metadata.name,
-      meta: this.getTerminalMeta(),
-      spec: {
-        image: images_exports["terminal-kubectl"].image,
-        command: ["bash", "/welcome.sh"],
-        files: {
-          "/kubeconfig": makeFileOutput({
-            name: "kubeconfig",
-            content: getClusterKubeconfigContent(this.cluster),
-            isSecret: true
-          }),
-          "/welcome.sh": makeFileOutput({
-            name: "welcome.sh",
-            content: interpolate$1`
-              #!/bin/bash
-              set -euo pipefail
-
-              NAMESPACE="${this.metadata.namespace}"
-              RESOURCE_TYPE="${this.kind.toLowerCase()}"
-              RESOURCE_NAME="${this.metadata.name}"
-              CONTAINER_NAME="${containerName}"
-              SHELL="${shell}"
-              LABEL_SELECTOR="${podLabelSelector}"
-
-              echo "Connecting to $RESOURCE_TYPE \\"$RESOURCE_NAME\\" in namespace \\"$NAMESPACE\\""
-
-              # get all pods for this workload
-              PODS=$(kubectl get pods -n "$NAMESPACE" -l "$LABEL_SELECTOR" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "")
-
-              if [ -z "$PODS" ]; then
-                echo "No pods found"
-                exit 1
-              fi
-
-              # convert space-separated string to array
-              read -ra POD_ARRAY <<< "$PODS"
-
-              if [ \${#POD_ARRAY[@]} -eq 1 ]; then
-                # single pod found, connect directly
-                SELECTED_POD="\${POD_ARRAY[0]}"
-                echo "Found single pod: $SELECTED_POD"
-              else
-                # multiple pods found, use fzf for selection
-                echo "Found \${#POD_ARRAY[@]} pods. Please select one."
-                
-                SELECTED_POD=$(printf '%s\n' "\${POD_ARRAY[@]}" | fzf --prompt="Select pod: " --height 10 --border --info=inline)
-                
-                if [ -z "$SELECTED_POD" ]; then
-                  echo "No pod selected"
-                  exit 1
-                fi
-                
-                echo "Selected pod: $SELECTED_POD"
-              fi
-
-              # execute into the selected pod
-              exec kubectl exec -it -n "$NAMESPACE" "$SELECTED_POD" -c "$CONTAINER_NAME" -- "$SHELL"
-            `.apply(trimIndentation)
-          })
-        },
-        env: {
-          KUBECONFIG: "/kubeconfig"
-        }
-      }
-    });
-  }
-  /**
-   * The instance terminal to view the workload's logs.
-   */
-  get logsTerminal() {
-    const containerName = this.podTemplate.spec.containers.apply((containers) => containers[0].name);
-    const podLabelSelector = this.templateMetadata.apply((meta) => meta.labels ?? {}).apply(
-      (labels) => Object.entries(labels).map(([key, value]) => `${key}=${value}`).join(",")
-    );
-    return output$1({
-      name: interpolate$1`${this.metadata.name}.logs`,
-      meta: output$1(this.getTerminalMeta()).apply((meta) => ({
-        ...meta,
-        title: `${meta.title} Logs`,
-        globalTitle: `${meta.globalTitle} | Logs`,
-        description: `The logs of ${meta.title.toLowerCase()}.`
-      })),
-      spec: {
-        image: images_exports["terminal-kubectl"].image,
-        command: ["bash", "/welcome.sh"],
-        files: {
-          "/kubeconfig": makeFileOutput({
-            name: "kubeconfig",
-            content: getClusterKubeconfigContent(this.cluster),
-            isSecret: true
-          }),
-          "/welcome.sh": makeFileOutput({
-            name: "welcome.sh",
-            content: interpolate$1`
-              #!/bin/bash
-              set -euo pipefail
-
-              NAMESPACE="${this.metadata.namespace}"
-              RESOURCE_TYPE="${this.kind.toLowerCase()}"
-              RESOURCE_NAME="${this.metadata.name}"
-              CONTAINER_NAME="${containerName}"
-              LABEL_SELECTOR="${podLabelSelector}"
-
-              echo "Connecting to logs of $RESOURCE_TYPE \"$RESOURCE_NAME\" in namespace \"$NAMESPACE\""
-
-              # get all pods for this workload
-              PODS=$(kubectl get pods -n "$NAMESPACE" -l "$LABEL_SELECTOR" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || echo "")
-
-              if [ -z "$PODS" ]; then
-                echo "No pods found"
-                exit 1
-              fi
-
-              # convert space-separated string to array
-              read -ra POD_ARRAY <<< "$PODS"
-
-              if [ \${#POD_ARRAY[@]} -eq 1 ]; then
-                # single pod found, connect directly
-                SELECTED_POD="\${POD_ARRAY[0]}"
-                echo "Found single pod: $SELECTED_POD"
-              else
-                # multiple pods found, use fzf for selection
-                echo "Found \${#POD_ARRAY[@]} pods. Please select one."
-
-                SELECTED_POD=$(printf '%s\n' "\${POD_ARRAY[@]}" | fzf --prompt="Select pod: " --height 10 --border --info=inline)
-
-                if [ -z "$SELECTED_POD" ]; then
-                  echo "No pod selected"
-                  exit 1
-                fi
-
-                echo "Selected pod: $SELECTED_POD"
-              fi
-
-              # stream logs for the selected pod
-              exec kubectl logs -f -n "$NAMESPACE" "$SELECTED_POD" -c "$CONTAINER_NAME"
-            `.apply(trimIndentation)
-          })
-        },
-        env: {
-          KUBECONFIG: "/kubeconfig"
-        }
-      }
-    });
-  }
-  /**
-   * The instance terminals to interact with the workload's pods and view its logs.
-   */
-  get terminals() {
-    return [this.logsTerminal, this.terminal];
-  }
-  /**
-   * Creates a terminal with a custom command.
-   *
-   * @param meta The metadata for the terminal.
-   * @param command The command to run in the terminal.
-   * @param spec Additional spec options for the terminal.
-   */
-  createTerminal(name, meta, command, spec) {
-    const containerName = this.podTemplate.spec.containers.apply((containers) => containers[0].name);
-    return output$1({
-      name,
-      meta: output$1(this.getTerminalMeta()).apply((currentMeta) => ({
-        ...currentMeta,
-        ...meta
-      })),
-      spec: {
-        image: images_exports["terminal-kubectl"].image,
-        command: output$1(command).apply((command2) => [
-          "exec",
-          "kubectl",
-          "exec",
-          "-it",
-          "-n",
-          this.metadata.namespace,
-          interpolate$1`${this.kind.toLowerCase()}/${this.metadata.name}`,
-          "-c",
-          containerName,
-          "--",
-          ...command2
-        ]),
-        files: {
-          "/kubeconfig": makeFileOutput({
-            name: "kubeconfig",
-            content: getClusterKubeconfigContent(this.cluster),
-            isSecret: true
-          }),
-          ...spec?.files
-        },
-        env: {
-          KUBECONFIG: "/kubeconfig",
-          ...spec?.env
-        }
-      }
-    });
-  }
-  /**
-   * Creates a generic workload or patches the existing one.
-   */
-  static createOrPatchGeneric(name, args, opts) {
-    return output$1(args).apply(async (args2) => {
-      if (args2.existing?.kind === "Deployment") {
-        const { Deployment } = await import('./deployment-T35TUOL2.js');
-        return Deployment.patch(
-          name,
-          {
-            ...deepmerge(args2, args2.deployment),
-            name: args2.existing.metadata.name,
-            namespace: Namespace.forResourceAsync(args2.existing, output$1(args2.namespace).cluster)
-          },
-          opts
-        );
-      }
-      if (args2.existing?.kind === "StatefulSet") {
-        const { StatefulSet } = await import('./stateful-set-LUIRHQJY.js');
-        return StatefulSet.patch(
-          name,
-          {
-            ...deepmerge(args2, args2.statefulSet),
-            name: args2.existing.metadata.name,
-            namespace: Namespace.forResourceAsync(args2.existing, output$1(args2.namespace).cluster)
-          },
-          opts
-        );
-      }
-      if (args2.existing?.kind === "Job") {
-        const { Job } = await import('./job-PE4AKOHB.js');
-        return Job.patch(
-          name,
-          {
-            ...deepmerge(args2, args2.job),
-            name: args2.existing.metadata.name,
-            namespace: Namespace.forResourceAsync(args2.existing, output$1(args2.namespace).cluster)
-          },
-          opts
-        );
-      }
-      if (args2.existing?.kind === "CronJob") {
-        const { CronJob } = await import('./cron-job-RKB2HYTO.js');
-        return CronJob.patch(
-          name,
-          {
-            ...deepmerge(args2, args2.cronJob),
-            name: args2.existing.metadata.name,
-            namespace: Namespace.forResourceAsync(args2.existing, output$1(args2.namespace).cluster)
-          },
-          opts
-        );
-      }
-      if (args2.defaultType === "Deployment") {
-        const { Deployment } = await import('./deployment-T35TUOL2.js');
-        const deploymentArgs = deepmerge(
-          omit(args2, ["defaultType", "existing", "deployment", "statefulSet", "job", "cronJob"]),
-          args2.deployment ?? {}
-        );
-        return Deployment.create(name, deploymentArgs, opts);
-      }
-      if (args2.defaultType === "StatefulSet") {
-        const { StatefulSet } = await import('./stateful-set-LUIRHQJY.js');
-        const statefulSetArgs = deepmerge(
-          omit(args2, ["defaultType", "existing", "deployment", "statefulSet", "job", "cronJob"]),
-          args2.statefulSet ?? {}
-        );
-        return StatefulSet.create(name, statefulSetArgs, opts);
-      }
-      if (args2.defaultType === "Job") {
-        const { Job } = await import('./job-PE4AKOHB.js');
-        return Job.create(name, deepmerge(args2, args2.job), opts);
-      }
-      if (args2.defaultType === "CronJob") {
-        const { CronJob } = await import('./cron-job-RKB2HYTO.js');
-        return CronJob.create(name, deepmerge(args2, args2.cronJob), opts);
-      }
-      throw new Error(`Unknown workload type: ${args2.defaultType}`);
-    });
-  }
-};
-
-export { ConfigMap, NativeNetworkPolicy, NetworkPolicy, PersistentVolumeClaim, Workload, filterPatchOwnedContainersInTemplate, getAutoVolumeName, getBestEndpoint, getFallbackContainerName, getWorkloadComponents, getWorkloadServiceComponents, getWorkloadVolumeResourceUuid, mapContainerEnvironment, mapContainerToRaw, mapEnvironmentSource, mapVolumeMount, mapWorkloadVolume, networkPolicyMediator, podSpecDefaults, requireBestEndpoint, workloadExtraArgs, workloadServiceExtraArgs };
-//# sourceMappingURL=chunk-SZKOAHNX.js.map
-//# sourceMappingURL=chunk-SZKOAHNX.js.map