@highstate/k8s 0.9.8 → 0.9.9

package/dist/{chunk-JBGQQVTZ.js → chunk-7R2VAXVL.js}

@@ -1,8 +1,9 @@
 import {
   HttpRoute,
+  NetworkPolicy,
   Service,
   getServiceType
-} from "./chunk-J6O3TE56.js";
+} from "./chunk-OP75IMU7.js";
 import {
   getProvider,
   mapNamespaceLikeToNamespaceName
@@ -11,7 +12,7 @@ import {
 // src/helm.ts
 import { resolve } from "node:path";
 import { mkdir, readFile, unlink } from "node:fs/promises";
-import { toPromise } from "@highstate/pulumi";
+import { normalize, toPromise } from "@highstate/pulumi";
 import { core, helm } from "@pulumi/kubernetes";
 import {
   ComponentResource,
@@ -87,7 +88,22 @@ var Chart = class extends ComponentResource {
         { ...opts, parent: this }
       );
     });
-    this.registerOutputs({ chart: this.chart });
+    this.networkPolicies = output(args).apply((args2) => {
+      const policies = normalize(args2.networkPolicy, args2.networkPolicies);
+      return output(
+        policies.map((policy) => {
+          return NetworkPolicy.create(
+            name,
+            {
+              ...policy,
+              cluster: args2.cluster,
+              namespace: args2.namespace
+            },
+            { ...opts, parent: this }
+          );
+        })
+      );
+    });
   }
   /**
    * The underlying Helm chart.
@@ -97,6 +113,10 @@ var Chart = class extends ComponentResource {
    * The HTTP route associated with the deployment.
    */
   httpRoute;
+  /**
+   * The network policies applied to the chart.
+   */
+  networkPolicies;
   get service() {
     return this.getServiceOutput(void 0);
   }
@@ -211,4 +231,4 @@ export {
   getChartServiceOutput,
   getChartService
 };
-//# sourceMappingURL=chunk-JBGQQVTZ.js.map
+//# sourceMappingURL=chunk-7R2VAXVL.js.map

package/dist/chunk-7R2VAXVL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/helm.ts"],"sourcesContent":["import type { k8s } from \"@highstate/library\"\nimport { resolve } from \"node:path\"\nimport { mkdir, readFile, unlink } from \"node:fs/promises\"\nimport { normalize, toPromise, type InputMap } from \"@highstate/pulumi\"\nimport { core, helm, types } from \"@pulumi/kubernetes\"\nimport {\n  ComponentResource,\n  output,\n  type ComponentResourceOptions,\n  type Input,\n  type Output,\n} from \"@pulumi/pulumi\"\nimport spawn from \"nano-spawn\"\nimport { sha256 } from \"crypto-hash\"\nimport { omit } from \"remeda\"\nimport { local } from \"@pulumi/command\"\nimport { glob } from \"glob\"\nimport { NetworkPolicy, type NetworkPolicyArgs } from \"./network-policy\"\nimport { HttpRoute, type HttpRouteArgs } from \"./gateway\"\nimport { getProvider, mapNamespaceLikeToNamespaceName, type NamespaceLike } from \"./shared\"\nimport { getServiceType, Service, type ServiceArgs } from \"./service\"\n\nexport type ChartArgs = Omit<\n  helm.v4.ChartArgs,\n  \"chart\" | \"version\" | \"repositoryOpts\" | \"namespace\"\n> & {\n  /**\n   * The namespace to deploy the chart into.\n   */\n  namespace?: Input<NamespaceLike>\n\n  /**\n   * The custom name of the primary service exposed by the chart.\n   *\n   * By default, it is the same as the chart name.\n   */\n  serviceName?: string\n\n  /**\n   * The extra args to pass to the main service of the chart.\n   *\n   * Will be patched via transformations.\n   */\n  service?: Partial<ServiceArgs>\n\n  /**\n   * The manifest of the chart to resolve.\n   */\n  chart: ChartManifest\n\n  /**\n   * The cluster to create the resource in.\n   */\n  cluster: Input<k8s.Cluster>\n\n  /**\n   * The http route args to bind the service to.\n   */\n  httpRoute?: Input<HttpRouteArgs>\n\n  /**\n   * The network policy to apply to the chart.\n   */\n  networkPolicy?: Input<Omit<NetworkPolicyArgs, \"selector\" | \"cluster\" | \"namespace\">>\n\n  /**\n   * The network policies to apply to the chart.\n   */\n  networkPolicies?: Input<NetworkPolicyArgs[]>\n}\n\nexport class Chart extends ComponentResource {\n  /**\n   * The underlying Helm chart.\n   */\n  public readonly chart: Output<helm.v4.Chart>\n\n  /**\n   * The HTTP route associated with the deployment.\n   */\n  public readonly httpRoute: Output<HttpRoute | undefined>\n\n  /**\n   * The network policies applied to the chart.\n   */\n  public readonly networkPolicies: Output<NetworkPolicy[]>\n\n  constructor(\n    private readonly name: string,\n    private readonly args: ChartArgs,\n    private readonly opts?: ComponentResourceOptions,\n  ) {\n    super(\"highstate:k8s:Chart\", name, args, opts)\n\n    const namespace = output(args.namespace).apply(namespace =>\n      output(namespace ? mapNamespaceLikeToNamespaceName(namespace) : \"default\"),\n    )\n\n    this.chart = output({ args, namespace }).apply(async ({ args, namespace }) => {\n      return new helm.v4.Chart(\n        name,\n        omit(\n          {\n            ...args,\n            chart: resolveHelmChart(args.chart),\n            namespace,\n          },\n          [\"httpRoute\"],\n        ),\n        {\n          ...opts,\n          parent: this,\n          provider: await getProvider(args.cluster),\n\n          transforms: [\n            ...(opts?.transforms ?? []),\n\n            resourceArgs => {\n              const serviceName = args.serviceName ?? name\n              const expectedName = `${name}:${namespace}/${serviceName}`\n\n              if (\n                resourceArgs.type === \"kubernetes:core/v1:Service\" &&\n                resourceArgs.name === expectedName\n              ) {\n                const spec = resourceArgs.props.spec as types.input.core.v1.ServiceSpec\n\n                return {\n                  props: {\n                    ...resourceArgs.props,\n                    spec: {\n                      ...spec,\n                      ...(args.service ?? {}),\n\n                      type: getServiceType(args.service, args.cluster),\n\n                      externalIPs:\n                        args.service?.externalIPs ?? args.cluster.externalIps ?? spec.externalIPs,\n                    },\n                  },\n                  opts: resourceArgs.opts,\n                }\n              }\n\n              return undefined\n            },\n          ],\n        },\n      )\n    })\n\n    this.httpRoute = output(args.httpRoute).apply(httpRoute => {\n      if (!httpRoute) {\n        return undefined\n      }\n\n      return new HttpRoute(\n        name,\n        {\n          ...httpRoute,\n          rule: {\n            backend: this.service,\n          },\n        },\n        { ...opts, parent: this },\n      )\n    })\n\n    this.networkPolicies = output(args).apply(args => {\n      const policies = normalize(args.networkPolicy, args.networkPolicies)\n\n      return output(\n        policies.map(policy => {\n          return NetworkPolicy.create(\n            name,\n            {\n              ...policy,\n\n              cluster: args.cluster,\n              namespace: args.namespace,\n            },\n            { ...opts, parent: this },\n          )\n        }),\n      )\n    })\n  }\n\n  get service(): Output<Service> {\n    return this.getServiceOutput(undefined)\n  }\n\n  private readonly services = new Map<string, Service>()\n\n  getServiceOutput(name: string | undefined): Output<Service> {\n    return output({ args: this.args, chart: this.chart }).apply(({ args, chart }) => {\n      const resolvedName = name ?? args.serviceName ?? this.name\n      const existingService = this.services.get(resolvedName)\n\n      if (existingService) {\n        return existingService\n      }\n\n      const service = getChartServiceOutput(chart, resolvedName)\n\n      const wrappedService = Service.wrap(\n        //\n        resolvedName,\n        service,\n        args.cluster,\n        { ...this.opts, parent: this },\n      )\n\n      this.services.set(resolvedName, wrappedService)\n      return wrappedService\n    })\n  }\n\n  getService(name?: string): Promise<Service> {\n    return toPromise(this.getServiceOutput(name))\n  }\n}\n\nexport type RenderedChartArgs = {\n  /**\n   * The namespace to deploy the chart into.\n   */\n  namespace?: Input<NamespaceLike>\n\n  /**\n   * The manifest of the chart to resolve.\n   */\n  chart: ChartManifest\n\n  /**\n   * The values to pass to the chart.\n   */\n  values?: InputMap<string>\n}\n\nexport class RenderedChart extends ComponentResource {\n  /**\n   * The rendered manifest of the Helm chart.\n   */\n  public readonly manifest: Output<string>\n\n  /**\n   * The underlying command used to render the chart.\n   */\n  public readonly command: Output<local.Command>\n\n  constructor(name: string, args: RenderedChartArgs, opts?: ComponentResourceOptions) {\n    super(\"highstate:k8s:RenderedChart\", name, args, opts)\n\n    this.command = output(args).apply(args => {\n      const values = args.values\n        ? Object.entries(args.values).flatMap(([key, value]) => [\"--set\", `${key}=\"${value}\"`])\n        : []\n\n      return new local.Command(\n        name,\n        {\n          create: output([\n            \"helm\",\n            \"template\",\n            resolveHelmChart(args.chart),\n\n            ...(args.namespace\n              ? [\"--namespace\", mapNamespaceLikeToNamespaceName(args.namespace)]\n              : []),\n\n            ...values,\n          ]).apply(command => command.join(\" \")),\n\n          logging: \"stderr\",\n        },\n        { parent: this, ...opts },\n      )\n    })\n\n    this.manifest = this.command.stdout\n\n    this.registerOutputs({ manifest: this.manifest, command: this.command })\n  }\n}\n\nexport type ChartManifest = {\n  repo: string\n  name: string\n  version: string\n  sha256: string\n}\n\n/**\n * Downloads or reuses the Helm chart according to the charts.json file.\n * Returns the full path to the chart's .tgz file.\n *\n * @param manifest The manifest of the Helm chart.\n */\nexport async function resolveHelmChart(manifest: ChartManifest): Promise<string> {\n  if (!process.env.HIGHSTATE_CACHE_DIR) {\n    throw new Error(\"Environment variable HIGHSTATE_CACHE_DIR is not set\")\n  }\n\n  const chartsDir = resolve(process.env.HIGHSTATE_CACHE_DIR, \"charts\")\n  await mkdir(chartsDir, { recursive: true })\n\n  const globPattern = `${manifest.name}-*.tgz`\n  const targetFileName = `${manifest.name}-${manifest.version}.tgz`\n\n  // find all matching files\n  const files = await glob(globPattern, { cwd: chartsDir })\n\n  if (files.includes(targetFileName)) {\n    return resolve(chartsDir, targetFileName)\n  }\n\n  // delete old versions\n  for (const file of files) {\n    await unlink(resolve(chartsDir, file))\n  }\n\n  // download the chart\n  await spawn(\"helm\", [\n    \"pull\",\n    manifest.name,\n    \"--version\",\n    manifest.version,\n    \"--repo\",\n    manifest.repo,\n    \"--destination\",\n    chartsDir,\n  ])\n\n  // check the SHA256\n  const content = await readFile(resolve(chartsDir, targetFileName))\n  const actualSha256 = await sha256(content)\n\n  if (actualSha256 !== manifest.sha256) {\n    throw new Error(`SHA256 mismatch for chart '${manifest.name}'`)\n  }\n\n  return resolve(chartsDir, targetFileName)\n}\n\n/**\n * Extracts the service with the given name from the chart resources.\n * Throws an error if the service is not found.\n *\n * @param chart The Helm chart.\n * @param name The name of the service.\n */\nexport function getChartServiceOutput(chart: helm.v4.Chart, name: string): Output<core.v1.Service> {\n  const services = chart.resources.apply(resources => {\n    return resources\n      .filter(r => core.v1.Service.isInstance(r))\n      .map(service => ({ name: service.metadata.name, service }))\n  })\n\n  return output(services).apply(services => {\n    const service = services.find(s => s.name === name)?.service\n\n    if (!service) {\n      throw new Error(`Service with name '${name}' not found in the chart resources`)\n    }\n\n    return service\n  })\n}\n\n/**\n * Extracts the service with the given name from the chart resources.\n * Throws an error if the service is not found.\n *\n * @param chart The Helm chart.\n * @param name The name of the service.\n */\nexport function getChartService(chart: helm.v4.Chart, name: string): Promise<core.v1.Service> {\n  return toPromise(getChartServiceOutput(chart, name))\n}\n"],"mappings":";;;;;;;;;;;;AACA,SAAS,eAAe;AACxB,SAAS,OAAO,UAAU,cAAc;AACxC,SAAS,WAAW,iBAAgC;AACpD,SAAS,MAAM,YAAmB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,OAAO,WAAW;AAClB,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,aAAa;AACtB,SAAS,YAAY;AAuDd,IAAM,QAAN,cAAoB,kBAAkB;AAAA,EAgB3C,YACmB,MACA,MACA,MACjB;AACA,UAAM,uBAAuB,MAAM,MAAM,IAAI;AAJ5B;AACA;AACA;AAIjB,UAAM,YAAY,OAAO,KAAK,SAAS,EAAE;AAAA,MAAM,CAAAA,eAC7C,OAAOA,aAAY,gCAAgCA,UAAS,IAAI,SAAS;AAAA,IAC3E;AAEA,SAAK,QAAQ,OAAO,EAAE,MAAM,UAAU,CAAC,EAAE,MAAM,OAAO,EAAE,MAAAC,OAAM,WAAAD,WAAU,MAAM;AAC5E,aAAO,IAAI,KAAK,GAAG;AAAA,QACjB;AAAA,QACA;AAAA,UACE;AAAA,YACE,GAAGC;AAAA,YACH,OAAO,iBAAiBA,MAAK,KAAK;AAAA,YAClC,WAAAD;AAAA,UACF;AAAA,UACA,CAAC,WAAW;AAAA,QACd;AAAA,QACA;AAAA,UACE,GAAG;AAAA,UACH,QAAQ;AAAA,UACR,UAAU,MAAM,YAAYC,MAAK,OAAO;AAAA,UAExC,YAAY;AAAA,YACV,GAAI,MAAM,cAAc,CAAC;AAAA,YAEzB,kBAAgB;AACd,oBAAM,cAAcA,MAAK,eAAe;AACxC,oBAAM,eAAe,GAAG,IAAI,IAAID,UAAS,IAAI,WAAW;AAExD,kBACE,aAAa,SAAS,gCACtB,aAAa,SAAS,cACtB;AACA,sBAAM,OAAO,aAAa,MAAM;AAEhC,uBAAO;AAAA,kBACL,OAAO;AAAA,oBACL,GAAG,aAAa;AAAA,oBAChB,MAAM;AAAA,sBACJ,GAAG;AAAA,sBACH,GAAIC,MAAK,WAAW,CAAC;AAAA,sBAErB,MAAM,eAAeA,MAAK,SAASA,MAAK,OAAO;AAAA,sBAE/C,aACEA,MAAK,SAAS,eAAeA,MAAK,QAAQ,eAAe,KAAK;AAAA,oBAClE;AAAA,kBACF;AAAA,kBACA,MAAM,aAAa;AAAA,gBACrB;AAAA,cACF;AAEA,qBAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,SAAK,YAAY,OAAO,KAAK,SAAS,EAAE,MAAM,eAAa;AACzD,UAAI,CAAC,WAAW;AACd,eAAO;AAAA,MACT;AAEA,aAAO,IAAI;AAAA,QACT;AAAA,QACA;AAAA,UACE,GAAG;AAAA,UACH,MAAM;AAAA,YACJ,SAAS,KAAK;AAAA,UAChB;AAAA,QACF;AAAA,QACA,EAAE,GAAG,MAAM,QAAQ,KAAK;AAAA,MAC1B;AAAA,IACF,CAAC;AAED,SAAK,kBAAkB,OAAO,IAAI,EAAE,MAAM,CAAAA,UAAQ;AAChD,YAAM,WAAW,UAAUA,MAAK,eAAeA,MAAK,eAAe;AAEnE,aAAO;AAAA,QACL,SAAS,IAAI,YAAU;AACrB,iBAAO,cAAc;AAAA,YACnB;AAAA,YACA;AAAA,cACE,GAAG;AAAA,cAEH,SAASA,MAAK;AAAA,cACd,WAAWA,MAAK;AAAA,YAClB;AAAA,YACA,EAAE,GAAG,MAAM,QAAQ,KAAK;AAAA,UAC1B;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EA/GgB;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EAuGhB,IAAI,UAA2B;AAC7B,WAAO,KAAK,iBAAiB,MAAS;AAAA,EACxC;AAAA,EAEiB,WAAW,oBAAI,IAAqB;AAAA,EAErD,iBAAiB,MAA2C;AAC1D,WAAO,OAAO,EAAE,MAAM,KAAK,MAAM,OAAO,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM,MAAM;AAC/E,YAAM,eAAe,QAAQ,KAAK,eAAe,KAAK;AACtD,YAAM,kBAAkB,KAAK,SAAS,IAAI,YAAY;AAEtD,UAAI,iBAAiB;AACnB,eAAO;AAAA,MACT;AAEA,YAAM,UAAU,sBAAsB,OAAO,YAAY;AAEzD,YAAM,iBAAiB,QAAQ;AAAA;AAAA,QAE7B;AAAA,QACA;AAAA,QACA,KAAK;AAAA,QACL,EAAE,GAAG,KAAK,MAAM,QAAQ,KAAK;AAAA,MAC/B;AAEA,WAAK,SAAS,IAAI,cAAc,cAAc;AAC9C,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,MAAiC;AAC1C,WAAO,UAAU,KAAK,iBAAiB,IAAI,CAAC;AAAA,EAC9C;AACF;AAmBO,IAAM,gBAAN,cAA4B,kBAAkB;AAAA;AAAA;AAAA;AAAA,EAInC;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EAEhB,YAAY,MAAc,MAAyB,MAAiC;AAClF,UAAM,+BAA+B,MAAM,MAAM,IAAI;AAErD,SAAK,UAAU,OAAO,IAAI,EAAE,MAAM,CAAAA,UAAQ;AACxC,YAAM,SAASA,MAAK,SAChB,OAAO,QAAQA,MAAK,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS,GAAG,GAAG,KAAK,KAAK,GAAG,CAAC,IACpF,CAAC;AAEL,aAAO,IAAI,MAAM;AAAA,QACf;AAAA,QACA;AAAA,UACE,QAAQ,OAAO;AAAA,YACb;AAAA,YACA;AAAA,YACA,iBAAiBA,MAAK,KAAK;AAAA,YAE3B,GAAIA,MAAK,YACL,CAAC,eAAe,gCAAgCA,MAAK,SAAS,CAAC,IAC/D,CAAC;AAAA,YAEL,GAAG;AAAA,UACL,CAAC,EAAE,MAAM,aAAW,QAAQ,KAAK,GAAG,CAAC;AAAA,UAErC,SAAS;AAAA,QACX;AAAA,QACA,EAAE,QAAQ,MAAM,GAAG,KAAK;AAAA,MAC1B;AAAA,IACF,CAAC;AAED,SAAK,WAAW,KAAK,QAAQ;AAE7B,SAAK,gBAAgB,EAAE,UAAU,KAAK,UAAU,SAAS,KAAK,QAAQ,CAAC;AAAA,EACzE;AACF;AAeA,eAAsB,iBAAiB,UAA0C;AAC/E,MAAI,CAAC,QAAQ,IAAI,qBAAqB;AACpC,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAEA,QAAM,YAAY,QAAQ,QAAQ,IAAI,qBAAqB,QAAQ;AACnE,QAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAE1C,QAAM,cAAc,GAAG,SAAS,IAAI;AACpC,QAAM,iBAAiB,GAAG,SAAS,IAAI,IAAI,SAAS,OAAO;AAG3D,QAAM,QAAQ,MAAM,KAAK,aAAa,EAAE,KAAK,UAAU,CAAC;AAExD,MAAI,MAAM,SAAS,cAAc,GAAG;AAClC,WAAO,QAAQ,WAAW,cAAc;AAAA,EAC1C;AAGA,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,QAAQ,WAAW,IAAI,CAAC;AAAA,EACvC;AAGA,QAAM,MAAM,QAAQ;AAAA,IAClB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,CAAC;AAGD,QAAM,UAAU,MAAM,SAAS,QAAQ,WAAW,cAAc,CAAC;AACjE,QAAM,eAAe,MAAM,OAAO,OAAO;AAEzC,MAAI,iBAAiB,SAAS,QAAQ;AACpC,UAAM,IAAI,MAAM,8BAA8B,SAAS,IAAI,GAAG;AAAA,EAChE;AAEA,SAAO,QAAQ,WAAW,cAAc;AAC1C;AASO,SAAS,sBAAsB,OAAsB,MAAuC;AACjG,QAAM,WAAW,MAAM,UAAU,MAAM,eAAa;AAClD,WAAO,UACJ,OAAO,OAAK,KAAK,GAAG,QAAQ,WAAW,CAAC,CAAC,EACzC,IAAI,cAAY,EAAE,MAAM,QAAQ,SAAS,MAAM,QAAQ,EAAE;AAAA,EAC9D,CAAC;AAED,SAAO,OAAO,QAAQ,EAAE,MAAM,CAAAC,cAAY;AACxC,UAAM,UAAUA,UAAS,KAAK,OAAK,EAAE,SAAS,IAAI,GAAG;AAErD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,sBAAsB,IAAI,oCAAoC;AAAA,IAChF;AAEA,WAAO;AAAA,EACT,CAAC;AACH;AASO,SAAS,gBAAgB,OAAsB,MAAwC;AAC5F,SAAO,UAAU,sBAAsB,OAAO,IAAI,CAAC;AACrD;","names":["namespace","args","services"]}

package/dist/{chunk-UNVUOHHB.js → chunk-L6G2IHDP.js}

@@ -1,18 +1,13 @@
 import {
   HttpRoute,
+  NetworkPolicy,
   Service,
-  getServiceMetadata,
-  isFromCluster,
-  mapContainerPortToServicePort,
-  mapServiceToLabelSelector
-} from "./chunk-J6O3TE56.js";
+  mapContainerPortToServicePort
+} from "./chunk-OP75IMU7.js";
 import {
   commonExtraArgs,
   getProvider,
   mapMetadata,
-  mapNamespaceLikeToNamespaceName,
-  mapNamespaceNameToSelector,
-  mapSelectorLikeToSelector,
   resourceIdToString,
   withPatchName
 } from "./chunk-HTQP2NB4.js";
@@ -424,430 +419,16 @@ function mapWorkloadVolume(volume) {
   return volume;
 }
 
-// src/network-policy.ts
-import { networking } from "@pulumi/kubernetes";
-import {
-  ComponentResource as ComponentResource3,
-  interpolate,
-  normalize as normalize2,
-  output as output4
-} from "@highstate/pulumi";
-import { capitalize, flat, groupBy, merge, mergeDeep, uniqueBy } from "remeda";
-import "@highstate/library";
-import {
-  l34EndpointToString,
-  l3EndpointToCidr,
-  parseL34Endpoint
-} from "@highstate/common";
-var NetworkPolicy = class _NetworkPolicy extends ComponentResource3 {
-  /**
-   * The underlying network policy resource.
-   */
-  networkPolicy;
-  constructor(name, args, opts) {
-    super("k8s:network-policy", name, args, opts);
-    const normalizedArgs = output4(args).apply((args2) => {
-      const ingressRules = normalize2(args2.ingressRule, args2.ingressRules);
-      const egressRules = normalize2(args2.egressRule, args2.egressRules);
-      const extraEgressRules = [];
-      if (args2.allowKubeDns) {
-        extraEgressRules.push({
-          namespaces: ["kube-system"],
-          selectors: [{ matchLabels: { "k8s-app": "kube-dns" } }],
-          ports: [{ port: 53, protocol: "UDP" }],
-          all: false,
-          cidrs: [],
-          fqdns: [],
-          services: []
-        });
-      }
-      return {
-        ...args2,
-        podSelector: args2.selector ? mapSelectorLikeToSelector(args2.selector) : {},
-        isolateEgress: args2.isolateEgress ?? false,
-        isolateIngress: args2.isolateIngress ?? false,
-        allowKubeApiServer: args2.allowKubeApiServer ?? false,
-        ingressRules: ingressRules.flatMap((rule) => {
-          const endpoints = normalize2(
-            args2.ingressRule?.fromEndpoint,
-            args2.ingressRule?.fromEndpoints
-          );
-          const parsedEndpoints = endpoints.map(parseL34Endpoint);
-          const endpointsByPortsAndNamespaces = groupBy(parsedEndpoints, (endpoint) => {
-            const namespace = isFromCluster(endpoint, args2.cluster) ? endpoint.metadata.k8sService.namespace : "";
-            const port = isFromCluster(endpoint, args2.cluster) ? endpoint.metadata.k8sService.targetPort : endpoint.port;
-            return `${port ?? "0"}:${namespace}`;
-          });
-          const l3OnlyRule = endpointsByPortsAndNamespaces["0:"] ? _NetworkPolicy.getRuleFromEndpoint(
-            void 0,
-            endpointsByPortsAndNamespaces["0:"],
-            args2.cluster
-          ) : void 0;
-          const otherRules = Object.entries(endpointsByPortsAndNamespaces).filter(([key]) => key !== "0:").map(([key, endpoints2]) => {
-            const [port] = key.split(":");
-            const portNumber = parseInt(port, 10);
-            const portValue = isNaN(portNumber) ? port : portNumber;
-            return _NetworkPolicy.getRuleFromEndpoint(portValue, endpoints2, args2.cluster);
-          });
-          return [
-            {
-              all: rule.fromAll ?? false,
-              cidrs: normalize2(rule.fromCidr, rule.fromCidrs).concat(l3OnlyRule?.cidrs ?? []),
-              fqdns: [],
-              services: normalize2(rule.fromService, rule.fromServices),
-              namespaces: normalize2(rule.fromNamespace, rule.fromNamespaces),
-              selectors: normalize2(rule.fromSelector, rule.fromSelectors),
-              ports: normalize2(rule.toPort, rule.toPorts)
-            },
-            ...otherRules
-          ].filter((rule2) => !_NetworkPolicy.isEmptyRule(rule2));
-        }),
-        egressRules: egressRules.flatMap((rule) => {
-          const endpoints = normalize2(args2.egressRule?.toEndpoint, args2.egressRule?.toEndpoints);
-          const parsedEndpoints = endpoints.map(parseL34Endpoint);
-          const endpointsByPortsAnsNamespaces = groupBy(parsedEndpoints, (endpoint) => {
-            const namespace = isFromCluster(endpoint, args2.cluster) ? endpoint.metadata.k8sService.namespace : "";
-            const port = isFromCluster(endpoint, args2.cluster) ? endpoint.metadata.k8sService.targetPort : endpoint.port;
-            return `${port ?? "0"}:${namespace}`;
-          });
-          const l3OnlyRule = endpointsByPortsAnsNamespaces["0:"] ? _NetworkPolicy.getRuleFromEndpoint(
-            void 0,
-            endpointsByPortsAnsNamespaces["0:"],
-            args2.cluster
-          ) : void 0;
-          const otherRules = Object.entries(endpointsByPortsAnsNamespaces).filter(([key]) => key !== "0:").map(([key, endpoints2]) => {
-            const [port] = key.split(":");
-            const portNumber = parseInt(port, 10);
-            const portValue = isNaN(portNumber) ? port : portNumber;
-            return _NetworkPolicy.getRuleFromEndpoint(portValue, endpoints2, args2.cluster);
-          });
-          return [
-            {
-              all: rule.toAll ?? false,
-              cidrs: normalize2(rule.toCidr, rule.toCidrs).concat(l3OnlyRule?.cidrs ?? []),
-              fqdns: normalize2(rule.toFqdn, rule.toFqdns).concat(l3OnlyRule?.fqdns ?? []),
-              services: normalize2(rule.toService, rule.toServices),
-              namespaces: normalize2(rule.toNamespace, rule.toNamespaces),
-              selectors: normalize2(rule.toSelector, rule.toSelectors),
-              ports: normalize2(rule.toPort, rule.toPorts)
-            },
-            ...otherRules
-          ].filter((rule2) => !_NetworkPolicy.isEmptyRule(rule2));
-        }).concat(extraEgressRules)
-      };
-    });
-    this.networkPolicy = output4(
-      normalizedArgs.apply(async (args2) => {
-        return output4(
-          this.create(name, args2, {
-            ...opts,
-            parent: this,
-            provider: await getProvider(args2.cluster)
-          })
-        );
-      })
-    );
-  }
-  static mapCidrFromEndpoint(result) {
-    if (result.type === "ipv4") {
-      return `${result.address}/32`;
-    }
-    return `${result.address}/128`;
-  }
-  static getRuleFromEndpoint(port, endpoints, cluster) {
-    const ports = port ? [{ port, protocol: endpoints[0].protocol?.toUpperCase() }] : [];
-    const cidrs = endpoints.filter((endpoint) => !isFromCluster(endpoint, cluster)).filter((endpoint) => endpoint.type === "ipv4" || endpoint.type === "ipv6").map(_NetworkPolicy.mapCidrFromEndpoint);
-    const fqdns = endpoints.filter((endpoint) => endpoint.type === "hostname").map((endpoint) => endpoint.hostname);
-    const selectors = endpoints.filter((endpoint) => isFromCluster(endpoint, cluster)).map((endpoint) => endpoint.metadata.k8sService.selector);
-    const namespace = endpoints.filter((endpoint) => isFromCluster(endpoint, cluster)).map((endpoint) => getServiceMetadata(endpoint)?.namespace)[0];
-    return {
-      all: false,
-      cidrs,
-      fqdns,
-      services: [],
-      namespaces: namespace ? [namespace] : [],
-      selectors,
-      ports
-    };
-  }
-  static isEmptyRule(rule) {
-    return !rule.all && rule.cidrs.length === 0 && rule.fqdns.length === 0 && rule.services.length === 0 && rule.namespaces.length === 0 && rule.selectors.length === 0 && rule.ports.length === 0;
-  }
-  static create(name, args, opts) {
-    return output4(args).apply(async (args2) => {
-      const cni = args2.cluster.cni;
-      if (cni === "other") {
-        return new NativeNetworkPolicy(name, args2, opts);
-      }
-      const implName = `${capitalize(cni)}NetworkPolicy`;
-      const implModule = await import(`@highstate/${cni}`);
-      const implClass = implModule[implName];
-      if (!implClass) {
-        throw new Error(`No implementation found for ${cni}`);
-      }
-      return new implClass(name, args2, opts);
-    });
-  }
-  static isolate(namespace, cluster, opts) {
-    return _NetworkPolicy.create(
-      "isolate",
-      {
-        namespace,
-        cluster,
-        description: "By default, deny all traffic to/from the namespace.",
-        isolateEgress: true,
-        isolateIngress: true
-      },
-      opts
-    );
-  }
-  static allowInsideNamespace(namespace, cluster, opts) {
-    return _NetworkPolicy.create(
-      "allow-inside-namespace",
-      {
-        namespace,
-        cluster,
-        description: "Allow all traffic inside the namespace.",
-        selector: {},
-        ingressRule: { fromNamespace: namespace },
-        egressRule: { toNamespace: namespace }
-      },
-      opts
-    );
-  }
-  static allowKubeApiServer(namespace, cluster, opts) {
-    return _NetworkPolicy.create(
-      "allow-kube-api-server",
-      {
-        namespace,
-        cluster,
-        description: "Allow all traffic to the Kubernetes API server from the namespace.",
-        allowKubeApiServer: true
-      },
-      opts
-    );
-  }
-  static allowKubeDns(namespace, cluster, opts) {
-    return _NetworkPolicy.create(
-      "allow-kube-dns",
-      {
-        namespace,
-        cluster,
-        description: "Allow all traffic to the Kubernetes DNS server from the namespace.",
-        allowKubeDns: true
-      },
-      opts
-    );
-  }
-  static allowAllEgress(namespace, cluster, opts) {
-    return _NetworkPolicy.create(
-      "allow-all-egress",
-      {
-        namespace,
-        cluster,
-        description: "Allow all egress traffic from the namespace.",
-        egressRule: { toAll: true }
-      },
-      opts
-    );
-  }
-  static allowAllIngress(namespace, cluster, opts) {
-    return _NetworkPolicy.create(
-      "allow-all-ingress",
-      {
-        namespace,
-        cluster,
-        description: "Allow all ingress traffic to the namespace.",
-        ingressRule: { fromAll: true }
-      },
-      opts
-    );
-  }
-  static allowEgressToEndpoint(endpoint, namespace, cluster, opts) {
-    const parsedEndpoint = parseL34Endpoint(endpoint);
-    return _NetworkPolicy.create(
-      `allow-egress-to-${l34EndpointToString(parsedEndpoint)}`,
-      {
-        namespace,
-        cluster,
-        description: interpolate`Allow egress traffic to "${l34EndpointToString(parsedEndpoint)}" from the namespace.`,
-        egressRule: { toEndpoint: endpoint }
-      },
-      opts
-    );
-  }
-  static allowIngressFromEndpoint(endpoint, namespace, cluster, opts) {
-    const parsedEndpoint = parseL34Endpoint(endpoint);
-    return _NetworkPolicy.create(
-      `allow-ingress-from-${l34EndpointToString(parsedEndpoint)}`,
-      {
-        namespace,
-        cluster,
-        description: interpolate`Allow ingress traffic from "${l34EndpointToString(parsedEndpoint)}" to the namespace.`,
-        ingressRule: { fromEndpoint: endpoint }
-      },
-      opts
-    );
-  }
-};
-var NativeNetworkPolicy = class _NativeNetworkPolicy extends NetworkPolicy {
-  create(name, args, opts) {
-    const ingress = _NativeNetworkPolicy.createIngressRules(args);
-    const egress = _NativeNetworkPolicy.createEgressRules(args);
-    const policyTypes = [];
-    if (ingress.length > 0 || args.isolateIngress) {
-      policyTypes.push("Ingress");
-    }
-    if (egress.length > 0 || args.isolateEgress) {
-      policyTypes.push("Egress");
-    }
-    return new networking.v1.NetworkPolicy(
-      name,
-      {
-        metadata: mergeDeep(mapMetadata(args, name), {
-          annotations: args.description ? { "kubernetes.io/description": args.description } : void 0
-        }),
-        spec: {
-          podSelector: args.podSelector,
-          ingress,
-          egress,
-          policyTypes
-        }
-      },
-      opts
-    );
-  }
-  static fallbackIpBlock = {
-    cidr: "0.0.0.0/0",
-    except: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
-  };
-  static fallbackDnsRule = {
-    to: [
-      {
-        namespaceSelector: { matchLabels: { "kubernetes.io/metadata.name": "kube-system" } },
-        podSelector: { matchLabels: { "k8s-app": "kube-dns" } }
-      }
-    ],
-    ports: [{ port: 53, protocol: "UDP" }]
-  };
-  static createIngressRules(args) {
-    return uniqueBy(
-      args.ingressRules.map((rule) => ({
-        from: rule.all ? [] : _NativeNetworkPolicy.createRulePeers(rule),
-        ports: _NativeNetworkPolicy.mapPorts(rule.ports)
-      })),
-      (rule) => JSON.stringify(rule)
-    );
-  }
-  static createEgressRules(args) {
-    const extraRules = [];
-    const needKubeDns = args.egressRules.some((rule) => rule.fqdns.length > 0);
-    if (needKubeDns) {
-      extraRules.push(_NativeNetworkPolicy.fallbackDnsRule);
-    }
-    const needFallback = args.egressRules.some(
-      (rule) => rule.fqdns.some((fqdn) => !fqdn.endsWith(".cluster.local"))
-    );
-    if (needFallback) {
-      extraRules.push({ to: [{ ipBlock: _NativeNetworkPolicy.fallbackIpBlock }] });
-    }
-    if (args.allowKubeApiServer) {
-      const { quirks, apiEndpoints } = args.cluster;
-      if (quirks?.fallbackKubeApiAccess) {
-        extraRules.push({
-          to: [{ ipBlock: { cidr: `${quirks?.fallbackKubeApiAccess.serverIp}/32` } }],
-          ports: [{ port: quirks?.fallbackKubeApiAccess.serverPort, protocol: "TCP" }]
-        });
-      } else {
-        const rules = apiEndpoints.filter((endpoint) => endpoint.type !== "hostname").map((endpoint) => ({
-          to: [{ ipBlock: { cidr: l3EndpointToCidr(endpoint) } }],
-          ports: [{ port: endpoint.port, protocol: "TCP" }]
-        }));
-        extraRules.push(...rules);
-      }
-    }
-    return uniqueBy(
-      args.egressRules.map((rule) => {
-        return {
-          to: rule.all ? [] : _NativeNetworkPolicy.createRulePeers(rule),
-          ports: _NativeNetworkPolicy.mapPorts(rule.ports)
-        };
-      }).filter((rule) => rule.to !== void 0).concat(extraRules),
-      (rule) => JSON.stringify(rule)
-    );
-  }
-  static createRulePeers(args) {
-    const peers = uniqueBy(
-      [
-        ..._NativeNetworkPolicy.createCidrPeers(args),
-        ..._NativeNetworkPolicy.createServicePeers(args),
-        ..._NativeNetworkPolicy.createSelectorPeers(args)
-      ],
-      (peer) => JSON.stringify(peer)
-    );
-    return peers.length > 0 ? peers : void 0;
-  }
-  static createCidrPeers(args) {
-    return args.cidrs.map((cidr) => ({ ipBlock: { cidr } }));
-  }
-  static createServicePeers(args) {
-    return args.services.map((service) => {
-      const selector = mapServiceToLabelSelector(service);
-      return {
-        namespaceSelector: mapNamespaceNameToSelector(service.metadata.namespace),
-        podSelector: selector
-      };
-    });
-  }
-  static createSelectorPeers(args) {
-    const selectorPeers = args.selectors.map((selector) => ({
-      podSelector: mapSelectorLikeToSelector(selector)
-    }));
-    const namespacePeers = args.namespaces.map(_NativeNetworkPolicy.createNamespacePeer);
-    if (namespacePeers.length === 0) {
-      return selectorPeers;
-    }
-    if (selectorPeers.length === 0) {
-      return namespacePeers;
-    }
-    return flat(
-      selectorPeers.map((selectorPeer) => {
-        return namespacePeers.map((namespacePeer) => merge(selectorPeer, namespacePeer));
-      })
-    );
-  }
-  static createNamespacePeer(namespace) {
-    const namespaceName = mapNamespaceLikeToNamespaceName(namespace);
-    const namespaceSelector = mapNamespaceNameToSelector(namespaceName);
-    return { namespaceSelector };
-  }
-  static mapPorts(ports) {
-    return ports.map((port) => {
-      if ("port" in port) {
-        return {
-          port: port.port,
-          protocol: port.protocol ?? "TCP"
-        };
-      }
-      return {
-        port: port.range[0],
-        endPort: port.range[1],
-        protocol: port.protocol ?? "TCP"
-      };
-    });
-  }
-};
-
 // src/workload.ts
 import {
-  normalize as normalize3
+  normalize as normalize2
 } from "@highstate/pulumi";
 import {
-  ComponentResource as ComponentResource4,
-  interpolate as interpolate2,
-  output as output5
+  ComponentResource as ComponentResource3,
+  interpolate,
+  output as output4
 } from "@pulumi/pulumi";
-import { uniqueBy as uniqueBy2 } from "remeda";
+import { uniqueBy } from "remeda";
 import { deepmerge as deepmerge2 } from "deepmerge-ts";
 
 // src/pod.ts
@@ -862,26 +443,26 @@ function getWorkloadComponents(name, args, parent, opts) {
   const labels = {
     "app.kubernetes.io/name": name
   };
-  const containers = output5(args).apply((args2) => normalize3(args2.container, args2.containers));
+  const containers = output4(args).apply((args2) => normalize2(args2.container, args2.containers));
   const volumes = containers.apply((containers2) => {
-    const containerVolumes = containers2.flatMap((container) => normalize3(container.volume, container.volumes)).map(mapWorkloadVolume);
+    const containerVolumes = containers2.flatMap((container) => normalize2(container.volume, container.volumes)).map(mapWorkloadVolume);
     const containerVolumeMounts = containers2.flatMap((container) => {
-      return normalize3(container.volumeMount, container.volumeMounts).map((volumeMount) => {
+      return normalize2(container.volumeMount, container.volumeMounts).map((volumeMount) => {
         return "volume" in volumeMount ? volumeMount.volume : void 0;
       }).filter(Boolean);
     }).map(mapWorkloadVolume);
-    return output5([...containerVolumes, ...containerVolumeMounts]).apply(
-      uniqueBy2((volume) => volume.name)
+    return output4([...containerVolumes, ...containerVolumeMounts]).apply(
+      uniqueBy((volume) => volume.name)
     );
   });
-  const podSpec = output5({ args, containers, volumes }).apply(({ args: args2, containers: containers2, volumes: volumes2 }) => {
+  const podSpec = output4({ args, containers, volumes }).apply(({ args: args2, containers: containers2, volumes: volumes2 }) => {
     const spec = {
       volumes: volumes2,
       containers: containers2.map((container) => mapContainerToRaw(container, args2.cluster, name)),
       ...podSpecDefaults
     };
     if (containers2.some((container) => container.enableTun) && args2.cluster.quirks?.tunDevicePolicy?.type !== "plugin") {
-      spec.volumes = output5(spec.volumes).apply((volumes3) => [
+      spec.volumes = output4(spec.volumes).apply((volumes3) => [
         ...volumes3 ?? [],
         {
           name: "tun-device",
@@ -921,7 +502,7 @@ function getWorkloadComponents(name, args, parent, opts) {
 }
 function getExposableWorkloadComponents(name, args, parent, opts) {
   const { labels, containers, volumes, podSpec, podTemplate, networkPolicy } = getWorkloadComponents(name, args, parent, opts);
-  const service = output5({ args, containers }).apply(async ({ args: args2, containers: containers2 }) => {
+  const service = output4({ args, containers }).apply(async ({ args: args2, containers: containers2 }) => {
     if (!args2.service && !args2.httpRoute) {
       return void 0;
     }
@@ -931,7 +512,7 @@ function getExposableWorkloadComponents(name, args, parent, opts) {
     if (args2.existing) {
       return void 0;
     }
-    const ports = containers2.flatMap((container) => normalize3(container.port, container.ports));
+    const ports = containers2.flatMap((container) => normalize2(container.port, container.ports));
     return Service.create(
       name,
       {
@@ -951,7 +532,7 @@ function getExposableWorkloadComponents(name, args, parent, opts) {
       }
     );
   });
-  const httpRoute = output5({
+  const httpRoute = output4({
     args,
     service
   }).apply(async ({ args: args2, service: service2 }) => {
@@ -979,7 +560,7 @@ function getExposableWorkloadComponents(name, args, parent, opts) {
   });
   return { labels, containers, volumes, podSpec, podTemplate, networkPolicy, service, httpRoute };
 }
-var Workload = class extends ComponentResource4 {
+var Workload = class extends ComponentResource3 {
   constructor(type, name, args, opts, resourceType, cluster, metadata, networkPolicy) {
     super(type, name, args, opts);
     this.name = name;
@@ -993,11 +574,11 @@ var Workload = class extends ComponentResource4 {
    * The instance terminal to interact with the deployment.
    */
   get terminal() {
-    const containerName = output5(this.args).apply((args) => {
-      const containers = normalize3(args.container, args.containers);
+    const containerName = output4(this.args).apply((args) => {
+      const containers = normalize2(args.container, args.containers);
       return containers[0]?.name ?? this.name;
     });
-    return output5({
+    return output4({
       name: this.metadata.name,
       title: this.metadata.name,
       image: "ghcr.io/exeteres/highstate/terminal-kubectl",
@@ -1008,7 +589,7 @@ var Workload = class extends ComponentResource4 {
         "-it",
         "-n",
         this.metadata.namespace,
-        interpolate2`${this.resourceType}/${this.metadata.name}`,
+        interpolate`${this.resourceType}/${this.metadata.name}`,
         "-c",
         containerName,
         "--",
@@ -1072,9 +653,9 @@ var ExposableWorkload = class extends Workload {
    * Creates a generic workload or patches the existing one.
    */
   static createOrPatchGeneric(name, args, opts) {
-    return output5(args).apply(async (args2) => {
+    return output4(args).apply(async (args2) => {
       if (args2.existing?.type === "k8s.deployment") {
-        const { Deployment } = await import("./deployment-TFCMSEGW.js");
+        const { Deployment } = await import("./deployment-A26RVQ73.js");
         return Deployment.patch(
           name,
           {
@@ -1086,7 +667,7 @@ var ExposableWorkload = class extends Workload {
         );
       }
       if (args2.existing?.type === "k8s.stateful-set") {
-        const { StatefulSet } = await import("./stateful-set-2OEPSK44.js");
+        const { StatefulSet } = await import("./stateful-set-S5BHTDJY.js");
         return StatefulSet.patch(
           name,
           {
@@ -1098,11 +679,11 @@ var ExposableWorkload = class extends Workload {
         );
       }
       if (args2.type === "Deployment") {
-        const { Deployment } = await import("./deployment-TFCMSEGW.js");
+        const { Deployment } = await import("./deployment-A26RVQ73.js");
         return Deployment.create(name, deepmerge2(args2, args2.deployment), opts);
       }
       if (args2.type === "StatefulSet") {
-        const { StatefulSet } = await import("./stateful-set-2OEPSK44.js");
+        const { StatefulSet } = await import("./stateful-set-S5BHTDJY.js");
         return StatefulSet.create(name, deepmerge2(args2, args2.statefulSet), opts);
       }
       throw new Error(`Unknown workload type: ${args2.type}`);
@@ -1113,11 +694,10 @@ var ExposableWorkload = class extends Workload {
 export {
   PersistentVolumeClaim,
   Secret,
-  NetworkPolicy,
   exposableWorkloadExtraArgs,
   getWorkloadComponents,
   getExposableWorkloadComponents,
   Workload,
   ExposableWorkload
 };
-//# sourceMappingURL=chunk-UNVUOHHB.js.map
+//# sourceMappingURL=chunk-L6G2IHDP.js.map