@mizchi/k1c 0.3.0 → 0.4.0

package/README.md

@@ -49,8 +49,9 @@ $ K1C_ACCOUNT_ID=...  CLOUDFLARE_API_TOKEN=... pnpm k1c apply -f manifest.yaml
 | `DNSRecord` (CRD) | DNS records | working |
 | `LogpushJob` (CRD) | Logpush (zone- or account-scoped) | working |
 | `ai` / `browser` / `version_metadata` / `analytics_engine` Worker bindings | annotation- / volume-driven | working |
-| `Ingress` (`networking.k8s.io/v1`) | generated router Worker + Custom Domain per host | working |
-| `CustomHostname` / Zero Trust Access | — | not implemented (see [`TODO.md`](TODO.md)) |
+| `Ingress` (`networking.k8s.io/v1`) | generated router Worker + Custom Domain per literal host (Workers Route per wildcard host) | working |
+| `AccessApplication` (CRD) | Cloudflare Access self-hosted app with inline policies | working |
+| `CustomHostname` | — | not implemented (see [`TODO.md`](TODO.md)) |
 
 See [`docs/resources.md`](docs/resources.md) for the full mapping and limitations,
 and [`TODO.md`](TODO.md) for what's queued.

package/dist/manifest/lower.js

@@ -31,6 +31,7 @@ export async function lower(resources, options) {
     const dnsRecords = [];
     const logpushJobs = [];
     const ingresses = [];
+    const accessApplications = [];
     for (const r of resources) {
         const label = labelOf(r);
         switch (r.kind) {
@@ -90,6 +91,9 @@ export async function lower(resources, options) {
             case 'Ingress':
                 ingresses.push(r);
                 break;
+            case 'AccessApplication':
+                accessApplications.push(r);
+                break;
         }
     }
     const desired = [];
@@ -154,8 +158,58 @@ export async function lower(resources, options) {
             desired.push(out);
         }
     }
+    for (const app of accessApplications) {
+        desired.push(lowerAccessApplication(app));
+    }
     return { desired, warnings };
 }
+function ruleToWire(rule) {
+    if ('email' in rule)
+        return { email: { email: rule.email.email } };
+    if ('emailDomain' in rule)
+        return { email_domain: { domain: rule.emailDomain.domain } };
+    if ('everyone' in rule)
+        return { everyone: {} };
+    if ('ip' in rule)
+        return { ip: { ip: rule.ip.ip } };
+    if ('country' in rule)
+        return { country: { country_code: rule.country.code } };
+    if ('serviceToken' in rule)
+        return { service_token: { token_id: rule.serviceToken.tokenId } };
+    return { any_valid_service_token: {} };
+}
+function policyToWire(p) {
+    return {
+        name: p.name,
+        decision: p.decision,
+        include: p.include.map(ruleToWire),
+        ...(p.exclude !== undefined ? { exclude: p.exclude.map(ruleToWire) } : {}),
+        ...(p.require !== undefined ? { require: p.require.map(ruleToWire) } : {}),
+        ...(p.sessionDuration !== undefined ? { session_duration: p.sessionDuration } : {}),
+    };
+}
+function lowerAccessApplication(app) {
+    const ns = app.metadata.namespace ?? 'default';
+    const name = app.metadata.name;
+    const properties = {
+        appName: `k1c-${ns}-${name}`,
+        domain: app.spec.domain,
+        ...(app.spec.sessionDuration !== undefined
+            ? { sessionDuration: app.spec.sessionDuration }
+            : {}),
+        ...(app.spec.autoRedirectToIdentity !== undefined
+            ? { autoRedirectToIdentity: app.spec.autoRedirectToIdentity }
+            : {}),
+        ...(app.spec.allowedIdps !== undefined ? { allowedIdps: [...app.spec.allowedIdps] } : {}),
+        policies: app.spec.policies.map(policyToWire),
+    };
+    return {
+        resourceType: 'AccessApplication',
+        ref: refOf(app),
+        label: `${ns}/${name}`,
+        properties,
+    };
+}
 function lowerVectorize(v) {
     const ns = v.metadata.namespace ?? 'default';
     const name = v.metadata.name;
@@ -336,25 +390,19 @@ async function lowerIngress(ing, tables, warnings, options) {
         throw new LowerError(`Ingress ${ns}/${name}: missing required annotation \`cloudflare.com/zone-id\``);
     }
     const literalHosts = new Set();
-    let hasWildcardHost = false;
+    const wildcardHosts = new Set();
     for (const rule of ing.spec.rules) {
         if (rule.host === undefined)
             continue;
         if (rule.host.startsWith('*.')) {
-            hasWildcardHost = true;
+            wildcardHosts.add(rule.host);
         }
         else {
             literalHosts.add(rule.host);
         }
     }
-    if (literalHosts.size === 0) {
-        throw new LowerError(`Ingress ${ns}/${name}: at least one rule must specify a literal (non-wildcard) host so a Custom Domain can be created`);
-    }
-    if (hasWildcardHost) {
-        warnings.push({
-            ref,
-            message: `Ingress ${ns}/${name}: wildcard hosts are matched in-router only; create a Workers Route or extra Custom Domain manifest to actually receive traffic for the wildcard`,
-        });
+    if (literalHosts.size === 0 && wildcardHosts.size === 0) {
+        throw new LowerError(`Ingress ${ns}/${name}: at least one rule must specify a host (literal or wildcard) so traffic can be bound to the router`);
     }
     // Assign one binding name per unique backend Service.
     const backendBindings = new Map(); // serviceName -> bindingName
@@ -454,6 +502,26 @@ async function lowerIngress(ing, tables, warnings, options) {
             dependsOn: [routerRef],
         });
     }
+    // Wildcard hosts cannot be bound via Custom Domain (which takes literal
+    // hostnames only); fall back to a zone-scoped Workers Route at `<host>/*`.
+    // The router Worker already matches the wildcard in-source, so this just
+    // delivers traffic to it.
+    for (const host of wildcardHosts) {
+        const pattern = `${host}/*`;
+        const routeRef = { ...ref, name: `${name}--route--${host}` };
+        const routeProps = {
+            zoneId,
+            pattern,
+            scriptName: routerScriptName,
+        };
+        results.push({
+            resourceType: 'WorkerRoute',
+            ref: routeRef,
+            label: pattern,
+            properties: routeProps,
+            dependsOn: [routerRef],
+        });
+    }
     return results;
 }
 function findWorkloadBySelector(selector, namespace, deployments, rollouts) {