@mcpg-dev/pulumi 0.1.0-beta.11

package/src/tenant.ts

@@ -0,0 +1,79 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { Gateway, GatewayArgs } from "./gateway";
+import { PluginSet } from "./pluginSet";
+
+export interface TenantArgs {
+    tenantName: string;
+    namespace?: string;
+    labels?: { [key: string]: string };
+    /** Default true → default-deny cross-tenant ingress NetworkPolicy. */
+    networkPolicy?: boolean;
+    pluginSet?: { entries: any[]; capabilityGrants?: any[] };
+    gateway?: Omit<GatewayArgs, "namespace">;
+}
+
+/**
+ * One tenant as an imperative fan-out: namespace + NetworkPolicy isolation +
+ * (optional) plugin-set + gateway. Instantiate in a loop to fan out a fleet.
+ *
+ * NB: this does NOT create an MCPGTenant CR, so it does NOT engage the
+ * operator's tenant GOVERNANCE (plugin allowlist, ResourceQuota, replica caps,
+ * exclusive namespace ownership). For declarative governance use {@link TenantCR}
+ * (the MCPGTenant CR) — alongside or instead of this helper.
+ */
+export class Tenant extends pulumi.ComponentResource {
+    public readonly namespace: pulumi.Output<string>;
+    public readonly gateway?: Gateway;
+    public readonly pluginSet?: PluginSet;
+
+    constructor(name: string, args: TenantArgs, opts?: pulumi.ComponentResourceOptions) {
+        super("mcpg:index:Tenant", name, {}, opts);
+
+        const nsName = args.namespace ?? args.tenantName;
+
+        const ns = new k8s.core.v1.Namespace(`${name}-ns`, {
+            metadata: {
+                name: nsName,
+                labels: {
+                    "app.kubernetes.io/managed-by": "pulumi-mcpg",
+                    "mcpg.dev/tenant": args.tenantName,
+                    ...(args.labels ?? {}),
+                },
+            },
+        }, { parent: this });
+
+        if (args.networkPolicy !== false) {
+            new k8s.networking.v1.NetworkPolicy(`${name}-isolation`, {
+                metadata: { name: "mcpg-tenant-isolation", namespace: nsName },
+                spec: {
+                    podSelector: {},
+                    policyTypes: ["Ingress"],
+                    ingress: [{ from: [{ namespaceSelector: { matchLabels: { "mcpg.dev/tenant": args.tenantName } } }] }],
+                },
+            }, { parent: this, dependsOn: ns });
+        }
+
+        const setName = `${args.tenantName}-set`;
+        if (args.pluginSet) {
+            this.pluginSet = new PluginSet(`${name}-set`, {
+                namespace: nsName,
+                entries: args.pluginSet.entries,
+                capabilityGrants: args.pluginSet.capabilityGrants,
+                resourceName: setName,
+            }, { parent: this, dependsOn: ns });
+        }
+
+        if (args.gateway) {
+            this.gateway = new Gateway(`${name}-gw`, {
+                ...args.gateway,
+                namespace: nsName,
+                pluginSetRef: args.pluginSet ? setName : args.gateway.pluginSetRef,
+                resourceName: args.gateway.resourceName ?? args.tenantName,
+            }, { parent: this, dependsOn: ns });
+        }
+
+        this.namespace = pulumi.output(nsName);
+        this.registerOutputs({ namespace: this.namespace });
+    }
+}

package/src/tenantCr.ts

@@ -0,0 +1,45 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+
+export interface TenantCRArgs {
+    /** Namespaces this tenant owns (non-empty, unique). */
+    namespaces: string[];
+    /** Plugin allowlist: [{ name? , registryPrefix? }] (each sets ≥1 matcher; [] = deny-all). */
+    allowedPlugins?: any[];
+    /** { maxGateways?, maxPluginSets?, maxRoutes?, maxReplicasPerGateway? } — each ≥ 0. */
+    quotas?: { [key: string]: number };
+    /** { key, ... } — key non-empty when set. */
+    identityAttribute?: { [key: string]: any };
+    labels?: { [key: string]: string };
+    resourceName?: string;
+}
+
+/**
+ * An MCPGTenant (cluster-scoped): the DECLARATIVE tenant governance boundary
+ * — plugin allowlist, per-namespace ResourceQuota, replica caps, and
+ * exclusive namespace ownership. Distinct from the {@link Tenant} component,
+ * which is an imperative namespace+RBAC+NetworkPolicy fan-out that does NOT
+ * engage tenant governance.
+ */
+export class TenantCR extends pulumi.ComponentResource {
+    public readonly tenant: mcpg.v1alpha1.MCPGTenant;
+    public readonly name: pulumi.Output<string>;
+
+    constructor(name: string, args: TenantCRArgs, opts?: pulumi.ComponentResourceOptions) {
+        super("mcpg:index:TenantCR", name, {}, opts);
+
+        const tName = args.resourceName ?? name;
+        const spec: { [key: string]: any } = { namespaces: args.namespaces };
+        if (args.allowedPlugins && args.allowedPlugins.length > 0) spec.allowedPlugins = args.allowedPlugins;
+        if (args.quotas) spec.quotas = args.quotas;
+        if (args.identityAttribute) spec.identityAttribute = args.identityAttribute;
+
+        this.tenant = new mcpg.v1alpha1.MCPGTenant(tName, {
+            metadata: { name: tName, labels: args.labels },
+            spec: spec as any,
+        }, { parent: this });
+
+        this.name = pulumi.output(tName);
+        this.registerOutputs({ name: this.name });
+    }
+}

package/src/trustBootstrap.ts

@@ -0,0 +1,40 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+
+export interface SecretRef {
+    name: string;
+    key: string;
+}
+
+export interface TrustBootstrapArgs {
+    revocationListName?: string;
+    revocations?: any[];
+    issuedAt?: string;
+    /** Signing-key Secret reference, passed through to plugin trust. Bytes are
+     * never read into state (the no-secret-in-state invariant). */
+    signingKeySecretRef?: SecretRef;
+}
+
+/** Seeds the cluster-default MCPGRevocationList and carries the signing-key ref. */
+export class TrustBootstrap extends pulumi.ComponentResource {
+    public readonly revocationList: mcpg.v1alpha1.MCPGRevocationList;
+    public readonly revocationListName: pulumi.Output<string>;
+    public readonly signingKeySecretRef?: SecretRef;
+
+    constructor(name: string, args: TrustBootstrapArgs = {}, opts?: pulumi.ComponentResourceOptions) {
+        super("mcpg:index:TrustBootstrap", name, {}, opts);
+
+        const rlName = args.revocationListName ?? "cluster-default";
+        const spec: { [key: string]: any } = { version: 1, revocations: args.revocations ?? [] };
+        if (args.issuedAt) spec.issuedAt = args.issuedAt;
+
+        this.revocationList = new mcpg.v1alpha1.MCPGRevocationList(rlName, {
+            metadata: { name: rlName },
+            spec: spec as any,
+        }, { parent: this });
+
+        this.revocationListName = pulumi.output(rlName);
+        this.signingKeySecretRef = args.signingKeySecretRef;
+        this.registerOutputs({ revocationListName: this.revocationListName });
+    }
+}

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "es2020",
+    "module": "commonjs",
+    "moduleResolution": "node",
+    "declaration": true,
+    "outDir": "bin",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src/**/*.ts"]
+}