@highstate/library 0.9.18 → 0.9.19

package/src/k8s/cert-manager.ts

@@ -0,0 +1,80 @@
+import { defineUnit, z } from "@highstate/contract"
+import { tlsIssuerEntity } from "../common"
+import * as dns from "../dns"
+import { clusterEntity } from "./shared"
+
+export const tlsIssuerDataSchema = z.object({
+  /**
+   * The Kubernetes cluster to use for creating gateway routes.
+   */
+  cluster: clusterEntity.schema,
+
+  /**
+   * The name of the cluster issuer which should be used to issue TLS certificates.
+   */
+  clusterIssuerName: z.string(),
+})
+
+/**
+ * The cert-manager installed on the Kubernetes cluster.
+ */
+export const certManager = defineUnit({
+  type: "k8s.cert-manager.v1",
+
+  args: {
+    /**
+     * Whether to enable the native support for Gateway API in cert-manager.
+     *
+     * Note that this can conflict with "Gateway API" unit since it is bringing its own CRDs.
+     */
+    enableGatewayApi: z.boolean().default(false),
+  },
+
+  inputs: {
+    k8sCluster: clusterEntity,
+  },
+
+  outputs: {
+    k8sCluster: clusterEntity,
+  },
+
+  meta: {
+    title: "Cert Manager",
+    icon: "simple-icons:letsencrypt",
+    category: "Kubernetes",
+  },
+
+  source: {
+    package: "@highstate/k8s",
+    path: "units/cert-manager",
+  },
+})
+
+/**
+ * The DNS01 TLS issuer for issuing certificates using DNS01 challenge.
+ */
+export const dns01TlsIssuer = defineUnit({
+  type: "k8s.dns01-issuer.v1",
+
+  inputs: {
+    k8sCluster: clusterEntity,
+    dnsProvider: dns.providerEntity,
+  },
+
+  outputs: {
+    tlsIssuer: tlsIssuerEntity,
+  },
+
+  meta: {
+    title: "DNS01 Issuer",
+    icon: "mdi:certificate",
+    category: "Kubernetes",
+  },
+
+  source: {
+    package: "@highstate/k8s",
+    path: "units/dns01-issuer",
+  },
+})
+
+export type TlsIssuerData = z.infer<typeof tlsIssuerDataSchema>

package/src/k8s/cilium.ts

@@ -0,0 +1,64 @@
+import { defineUnit, z } from "@highstate/contract"
+import { clusterEntity } from "./shared"
+
+/**
+ * The Cilium CNI deployed on Kubernetes.
+ */
+export const cilium = defineUnit({
+  type: "k8s.cilium.v1",
+
+  args: {
+    /**
+     * If set to `true`, the generated network policy will allow
+     * all DNS queries to be resolved, even if they are
+     * for forbidden (non-allowed) FQDNs.
+     *
+     * By default, is `false`.
+     */
+    allowForbiddenFqdnResolution: z.boolean().default(false),
+
+    /**
+     * Whether to enable Hubble Relay and UI for observability.
+     *
+     * By default, this is `true`.
+     *
+     * To expose the Hubble UI, you can use `k8s.apps.hubble-ui` unit.
+     */
+    enableHubble: z.boolean().default(true),
+  },
+
+  inputs: {
+    k8sCluster: clusterEntity,
+  },
+
+  outputs: {
+    k8sCluster: clusterEntity,
+  },
+
+  meta: {
+    title: "Cilium",
+    icon: "simple-icons:cilium",
+    secondaryIcon: "devicon:kubernetes",
+    category: "Kubernetes",
+  },
+
+  source: {
+    package: "@highstate/cilium",
+    path: "unit",
+  },
+})
+
+export const ciliumClusterMetadata = z.object({
+  cilium: z.object({
+    /**
+     * If set to `true`, the generated network policy will allow
+     * all DNS queries to be resolved, even if they are
+     * for forbidden (non-allowed) FQDNs.
+     *
+     * By default, is `false`.
+     */
+    allowForbiddenFqdnResolution: z.boolean().default(false),
+  }),
+})
+
+export type CiliumClusterMetadata = z.infer<typeof ciliumClusterMetadata>

package/src/k8s/gateway.ts

@@ -0,0 +1,70 @@
+import { defineUnit, z } from "@highstate/contract"
+import { namespaceEntity } from "./resources"
+import { clusterEntity } from "./shared"
+
+export const gatewayDataSchema = z.object({
+  /**
+   * The Kubernetes cluster to use for creating gateway routes.
+   */
+  cluster: clusterEntity.schema,
+
+  /**
+   * The namespace where the gateway controller of the class is running.
+   */
+  namespace: namespaceEntity.schema,
+
+  /**
+   * The name of the gateway class to use.
+   */
+  className: z.string(),
+
+  /**
+   * The port to use for HTTP in listener.
+   *
+   * If not provided, defaults to 80.
+   */
+  httpPort: z.number().default(80),
+
+  /**
+   * The port to use for HTTPS in listener.
+   *
+   * If not provided, defaults to 443.
+   */
+  httpsPort: z.number().default(443),
+})
+
+export const gatewayImplRefSchema = z.object({
+  package: z.literal("@highstate/k8s"),
+  data: gatewayDataSchema,
+})
+
+/**
+ * Installs the Gateway API CRDs to the cluster.
+ */
+export const gatewayApi = defineUnit({
+  type: "k8s.gateway-api.v1",
+
+  inputs: {
+    k8sCluster: clusterEntity,
+  },
+
+  outputs: {
+    k8sCluster: clusterEntity,
+  },
+
+  meta: {
+    title: "Gateway API",
+    icon: "devicon:kubernetes",
+    secondaryIcon: "mdi:api",
+    secondaryIconColor: "#4CAF50",
+    category: "Kubernetes",
+  },
+
+  source: {
+    package: "@highstate/k8s",
+    path: "units/gateway-api",
+  },
+})
+
+export type GatewayData = z.infer<typeof gatewayDataSchema>
+export type GatewayImplRef = z.infer<typeof gatewayImplRefSchema>

package/src/k8s/index.ts

@@ -0,0 +1,9 @@
+export * as apps from "./apps"
+export * from "./cert-manager"
+export * from "./cilium"
+export * from "./gateway"
+export * as obfuscators from "./obfuscators"
+export * from "./resources"
+export * from "./service"
+export * from "./shared"
+export * from "./workload"

package/src/{obfuscators → k8s/obfuscators}/phantun.ts

@@ -1,38 +1,42 @@
 import { defineUnit } from "@highstate/contract"
 import { deobfuscatorSpec, obfuscatorSpec } from "./shared"
 
+/**
+ * The Phantun Deobfuscator deployed on Kubernetes.
+ */
 export const deobfuscator = defineUnit({
-  type: "obfuscators.phantun.deobfuscator",
+  type: "k8s.obfuscators.phantun.deobfuscator.v1",
   ...deobfuscatorSpec,
 
   meta: {
     title: "Phantun Deobfuscator",
-    description: "The Phantun Deobfuscator deployed on Kubernetes.",
     icon: "mdi:network-outline",
     secondaryIcon: "mdi:hide",
     category: "Obfuscators",
   },
 
   source: {
-    package: "@highstate/obfuscators",
+    package: "@highstate/k8s.obfuscators",
     path: "phantun/deobfuscator",
   },
 })
 
+/**
+ * The Phantun Obfuscator deployed on Kubernetes.
+ */
 export const obfuscator = defineUnit({
-  type: "obfuscators.phantun.obfuscator",
+  type: "k8s.obfuscators.phantun.obfuscator.v1",
   ...obfuscatorSpec,
 
   meta: {
     title: "Phantun Obfuscator",
-    description: "The Phantun Obfuscator deployed on Kubernetes.",
     icon: "mdi:network-outline",
     secondaryIcon: "mdi:hide",
     category: "Obfuscators",
   },
 
   source: {
-    package: "@highstate/obfuscators",
+    package: "@highstate/k8s.obfuscators",
     path: "phantun/obfuscator",
   },
 })

package/src/{obfuscators → k8s/obfuscators}/shared.ts

@@ -1,6 +1,6 @@
-import { $args, $inputs, $outputs, z } from "@highstate/contract"
-import { clusterEntity } from "../k8s"
-import { l4EndpointEntity } from "../network"
+import { $args, $inputs, $outputs, type FullComponentArgumentOptions, z } from "@highstate/contract"
+import { l4EndpointEntity } from "../../network"
+import { clusterEntity } from "../shared"
 
 export const deobfuscatorSpec = {
   args: $args({
@@ -109,5 +109,11 @@ export const obfuscatorSpec = {
   }),
 }
 
-export type DeobfuscatorArgs = z.infer<typeof deobfuscatorSpec.args>
-export type ObfuscatorArgs = z.infer<typeof obfuscatorSpec.args>
+type ArgsFromSpec<T extends Record<string, FullComponentArgumentOptions>> = z.infer<
+  z.ZodObject<{
+    [K in keyof T]: T[K]["schema"]
+  }>
+>
+
+export type DeobfuscatorArgs = ArgsFromSpec<typeof deobfuscatorSpec.args>
+export type ObfuscatorArgs = ArgsFromSpec<typeof obfuscatorSpec.args>

package/src/k8s/resources.ts

@@ -0,0 +1,111 @@
+import { defineEntity, z } from "@highstate/contract"
+
+/**
+ * The generic metadata schema for Kubernetes resources.
+ */
+export const metadataSchema = z.object({
+  name: z.string(),
+  labels: z.record(z.string(), z.string()).optional(),
+  annotations: z.record(z.string(), z.string()).optional(),
+  uid: z.string(),
+})
+
+/**
+ * The metadata schema for Kubernetes resources that are scoped to a namespace.
+ *
+ * It includes the namespace field.
+ */
+export const scopedMetadataSchema = z.object({
+  ...metadataSchema.shape,
+  namespace: z.string(),
+})
+
+/**
+ * The base schema for Kubernetes resources.
+ *
+ * It includes the cluster ID and name, which are required for all Kubernetes resources.
+ */
+export const resourceSchema = z.object({
+  clusterId: z.string(),
+  clusterName: z.string(),
+  type: z.string(),
+  metadata: metadataSchema,
+})
+
+/**
+ * The schema for Kubernetes resources that are scoped to a namespace.
+ *
+ * Extends the base resource schema with the scoped metadata.
+ */
+export const scopedResourceSchema = z.object({
+  ...resourceSchema.shape,
+  metadata: scopedMetadataSchema,
+})
+
+/**
+ * The entity which represents a Kubernetes namespace managed by Highstate.
+ */
+export const namespaceEntity = defineEntity({
+  type: "k8s.namespace.v1",
+
+  schema: z.object({
+    ...resourceSchema.shape,
+    type: z.literal("namespace"),
+  }),
+
+  meta: {
+    color: "#9E9E9E",
+  },
+})
+
+/**
+ * The entity which represents a Kubernetes persistent volume claim managed by Highstate.
+ */
+export const persistentVolumeClaimEntity = defineEntity({
+  type: "k8s.persistent-volume-claim.v1",
+
+  schema: z.object({
+    ...scopedResourceSchema.shape,
+    type: z.literal("persistent-volume-claim"),
+  }),
+
+  meta: {
+    color: "#FFC107",
+  },
+})
+
+/**
+ * The entity which represents a Gateway resource from the Gateway API.
+ */
+export const gatewayEntity = defineEntity({
+  type: "k8s.gateway.v1",
+
+  schema: z.object({
+    ...scopedResourceSchema.shape,
+    type: z.literal("gateway"),
+  }),
+
+  meta: {
+    color: "#4CAF50",
+  },
+})
+
+export const certificateEntity = defineEntity({
+  type: "k8s.certificate.v1",
+
+  schema: z.object({
+    ...scopedResourceSchema.shape,
+    type: z.literal("certificate"),
+  }),
+})
+
+export type Metadata = z.infer<typeof metadataSchema>
+export type Resource = z.infer<typeof resourceSchema>
+
+export type ScopedMetadata = z.infer<typeof scopedMetadataSchema>
+export type ScopedResource = z.infer<typeof scopedResourceSchema>
+
+export type Namespace = z.infer<typeof namespaceEntity.schema>
+export type PersistentVolumeClaim = z.infer<typeof persistentVolumeClaimEntity.schema>
+export type Gateway = z.infer<typeof gatewayEntity.schema>
+export type Certificate = z.infer<typeof certificateEntity.schema>

package/src/k8s/service.ts

@@ -0,0 +1,65 @@
+import { defineEntity, z } from "@highstate/contract"
+import { l4EndpointEntity } from "../network"
+import { scopedResourceSchema } from "./resources"
+
+export const endpointServiceMetadataSchema = z.object({
+  "k8s.service": z.object({
+    /**
+     * The ID of the cluster where the service is located.
+     */
+    clusterId: z.string(),
+
+    /**
+     * The name of the cluster where the service is located.
+     */
+    clusterName: z.string(),
+
+    /**
+     * The name of the service.
+     */
+    name: z.string(),
+
+    /**
+     * The namespace of the service.
+     */
+    namespace: z.string(),
+
+    /**
+     * The selector of the service.
+     */
+    selector: z.record(z.string(), z.string()),
+
+    /**
+     * The target port of the service.
+     */
+    targetPort: z.union([z.string(), z.number()]),
+  }),
+})
+
+export const serviceEndpointSchema = z.intersection(
+  l4EndpointEntity.schema,
+  z.object({
+    metadata: endpointServiceMetadataSchema,
+  }),
+)
+
+export const serviceEntity = defineEntity({
+  type: "k8s.service.v1",
+
+  schema: z.object({
+    ...scopedResourceSchema.shape,
+    type: z.literal("service"),
+    endpoints: serviceEndpointSchema.array(),
+  }),
+
+  meta: {
+    color: "#2196F3",
+  },
+})
+
+export const serviceTypeSchema = z.enum(["NodePort", "LoadBalancer", "ClusterIP"])
+
+export type EndpointServiceMetadata = z.infer<typeof endpointServiceMetadataSchema>
+export type ServiceEndpoint = z.infer<typeof serviceEndpointSchema>
+export type ServiceType = z.infer<typeof serviceTypeSchema>
+export type Service = z.infer<typeof serviceEntity.schema>