@reyemtech/nimbus 1.3.0 → 2.0.1

package/dist/esm/platform/components/descheduler.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Descheduler deployment for pod rebalancing on spot instances.
+ *
+ * @module platform/components/descheduler
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployDescheduler = deployDescheduler;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+function deployDescheduler(name, config, provider, defaultVersion) {
+    const strategies = config.strategies ?? [
+        "RemoveDuplicates",
+        "LowNodeUtilization",
+        "RemovePodsViolatingNodeAffinity",
+    ];
+    const strategyValues = {};
+    for (const strategy of strategies) {
+        strategyValues[strategy] = { enabled: true };
+    }
+    return new k8s.helm.v3.Release(`${name}-descheduler`, {
+        chart: "descheduler",
+        repositoryOpts: {
+            repo: "https://kubernetes-sigs.github.io/descheduler",
+        },
+        version: config.version ?? defaultVersion,
+        namespace: "kube-system",
+        createNamespace: false,
+        values: {
+            deschedulerPolicy: { strategies: strategyValues },
+            ...config.values,
+        },
+    }, { provider });
+}
+//# sourceMappingURL=descheduler.js.map

package/dist/esm/platform/components/descheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descheduler.js","sourceRoot":"","sources":["../../../../src/platform/components/descheduler.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,8CAkCC;AArCD,wDAA0C;AAG1C,SAAgB,iBAAiB,CAC/B,IAAY,EACZ,MAA0B,EAC1B,QAAsB,EACtB,cAAkC;IAElC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI;QACtC,kBAAkB;QAClB,oBAAoB;QACpB,iCAAiC;KAClC,CAAC;IAEF,MAAM,cAAc,GAAyC,EAAE,CAAC;IAChE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,cAAc,EACrB;QACE,KAAK,EAAE,aAAa;QACpB,cAAc,EAAE;YACd,IAAI,EAAE,+CAA+C;SACtD;QACD,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc;QACzC,SAAS,EAAE,aAAa;QACxB,eAAe,EAAE,KAAK;QACtB,MAAM,EAAE;YACN,iBAAiB,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;YACjD,GAAG,MAAM,CAAC,MAAM;SACjB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC"}

package/dist/esm/platform/components/external-dns.d.ts

@@ -0,0 +1,9 @@
+/**
+ * External DNS deployment.
+ *
+ * @module platform/components/external-dns
+ */
+import * as k8s from "@pulumi/kubernetes";
+import type { IExternalDnsConfig } from "../interfaces";
+export declare function deployExternalDns(name: string, config: IExternalDnsConfig, provider: k8s.Provider, defaultVersion: string | undefined, envOverrides?: ReadonlyArray<Record<string, unknown>>): k8s.helm.v3.Release;
+//# sourceMappingURL=external-dns.d.ts.map

package/dist/esm/platform/components/external-dns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-dns.d.ts","sourceRoot":"","sources":["../../../../src/platform/components/external-dns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGxD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACpD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CA8CrB"}

package/dist/esm/platform/components/external-dns.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * External DNS deployment.
+ *
+ * @module platform/components/external-dns
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployExternalDns = deployExternalDns;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const types_1 = require("../../types");
+function deployExternalDns(name, config, provider, defaultVersion, envOverrides) {
+    const providerValues = {};
+    switch (config.dnsProvider) {
+        case "route53":
+            providerValues["provider"] = { name: "aws" };
+            break;
+        case "azure-dns":
+            providerValues["provider"] = { name: "azure" };
+            break;
+        case "cloud-dns":
+            providerValues["provider"] = { name: "google" };
+            break;
+        case "cloudflare":
+            providerValues["provider"] = { name: "cloudflare" };
+            break;
+        default:
+            (0, types_1.assertNever)(config.dnsProvider);
+    }
+    const values = {
+        ...providerValues,
+        domainFilters: config.domainFilters ?? [],
+        policy: "sync",
+        sources: ["ingress", "service", "traefik-proxy"],
+        ...config.values,
+    };
+    if (envOverrides) {
+        values["env"] = envOverrides;
+    }
+    return new k8s.helm.v3.Release(`${name}-external-dns`, {
+        chart: "external-dns",
+        repositoryOpts: {
+            repo: "https://kubernetes-sigs.github.io/external-dns",
+        },
+        version: config.version ?? defaultVersion,
+        namespace: "external-dns",
+        createNamespace: true,
+        values,
+    }, { provider });
+}
+//# sourceMappingURL=external-dns.js.map

package/dist/esm/platform/components/external-dns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-dns.js","sourceRoot":"","sources":["../../../../src/platform/components/external-dns.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMH,8CAoDC;AAxDD,wDAA0C;AAE1C,uCAA0C;AAE1C,SAAgB,iBAAiB,CAC/B,IAAY,EACZ,MAA0B,EAC1B,QAAsB,EACtB,cAAkC,EAClC,YAAqD;IAErD,MAAM,cAAc,GAA4B,EAAE,CAAC;IAEnD,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3B,KAAK,SAAS;YACZ,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC7C,MAAM;QACR,KAAK,WAAW;YACd,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC/C,MAAM;QACR,KAAK,WAAW;YACd,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAChD,MAAM;QACR,KAAK,YAAY;YACf,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACpD,MAAM;QACR;YACE,IAAA,mBAAW,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,GAAG,cAAc;QACjB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;QACzC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC;QAChD,GAAG,MAAM,CAAC,MAAM;KACjB,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,eAAe,EACtB;QACE,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE;YACd,IAAI,EAAE,gDAAgD;SACvD;QACD,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc;QACzC,SAAS,EAAE,cAAc;QACzB,eAAe,EAAE,IAAI;QACrB,MAAM;KACP,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC"}

package/dist/esm/platform/components/external-secrets.d.ts

@@ -0,0 +1,9 @@
+/**
+ * External Secrets Operator deployment.
+ *
+ * @module platform/components/external-secrets
+ */
+import * as k8s from "@pulumi/kubernetes";
+import type { IPlatformComponentConfig } from "../interfaces";
+export declare function deployExternalSecrets(name: string, config: IPlatformComponentConfig, provider: k8s.Provider, defaultVersion: string | undefined): k8s.helm.v3.Release;
+//# sourceMappingURL=external-secrets.d.ts.map

package/dist/esm/platform/components/external-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-secrets.d.ts","sourceRoot":"","sources":["../../../../src/platform/components/external-secrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAsBrB"}

package/dist/esm/platform/components/external-secrets.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * External Secrets Operator deployment.
+ *
+ * @module platform/components/external-secrets
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployExternalSecrets = deployExternalSecrets;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+function deployExternalSecrets(name, config, provider, defaultVersion) {
+    return new k8s.helm.v3.Release(`${name}-external-secrets`, {
+        chart: "external-secrets",
+        repositoryOpts: { repo: "https://charts.external-secrets.io" },
+        version: config.version ?? defaultVersion,
+        namespace: "external-secrets",
+        createNamespace: true,
+        values: {
+            serviceAccount: {
+                name: "external-secrets",
+            },
+            crds: {
+                createClusterExternalSecret: true,
+                createClusterSecretStore: true,
+            },
+            ...config.values,
+        },
+    }, { provider });
+}
+//# sourceMappingURL=external-secrets.js.map

package/dist/esm/platform/components/external-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-secrets.js","sourceRoot":"","sources":["../../../../src/platform/components/external-secrets.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,sDA2BC;AA9BD,wDAA0C;AAG1C,SAAgB,qBAAqB,CACnC,IAAY,EACZ,MAAgC,EAChC,QAAsB,EACtB,cAAkC;IAElC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,mBAAmB,EAC1B;QACE,KAAK,EAAE,kBAAkB;QACzB,cAAc,EAAE,EAAE,IAAI,EAAE,oCAAoC,EAAE;QAC9D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc;QACzC,SAAS,EAAE,kBAAkB;QAC7B,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,cAAc,EAAE;gBACd,IAAI,EAAE,kBAAkB;aACzB;YACD,IAAI,EAAE;gBACJ,2BAA2B,EAAE,IAAI;gBACjC,wBAAwB,EAAE,IAAI;aAC/B;YACD,GAAG,MAAM,CAAC,MAAM;SACjB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC"}

package/dist/esm/platform/components/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Platform component deployments.
+ *
+ * Each component is a self-contained Helm release deployment
+ * called by the platform stack orchestrator.
+ *
+ * @module platform/components
+ */
+export { deployTraefik } from "./traefik";
+export { deployCertManager } from "./cert-manager";
+export { deployExternalDns } from "./external-dns";
+export { deployArgocd } from "./argocd";
+export { deployVault } from "./vault";
+export { deployExternalSecrets } from "./external-secrets";
+export { deployOAuth2Proxy } from "./oauth2-proxy";
+export { deployDescheduler } from "./descheduler";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/platform/components/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/platform/components/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC"}

package/dist/esm/platform/components/index.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * Platform component deployments.
+ *
+ * Each component is a self-contained Helm release deployment
+ * called by the platform stack orchestrator.
+ *
+ * @module platform/components
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployDescheduler = exports.deployOAuth2Proxy = exports.deployExternalSecrets = exports.deployVault = exports.deployArgocd = exports.deployExternalDns = exports.deployCertManager = exports.deployTraefik = void 0;
+var traefik_1 = require("./traefik");
+Object.defineProperty(exports, "deployTraefik", { enumerable: true, get: function () { return traefik_1.deployTraefik; } });
+var cert_manager_1 = require("./cert-manager");
+Object.defineProperty(exports, "deployCertManager", { enumerable: true, get: function () { return cert_manager_1.deployCertManager; } });
+var external_dns_1 = require("./external-dns");
+Object.defineProperty(exports, "deployExternalDns", { enumerable: true, get: function () { return external_dns_1.deployExternalDns; } });
+var argocd_1 = require("./argocd");
+Object.defineProperty(exports, "deployArgocd", { enumerable: true, get: function () { return argocd_1.deployArgocd; } });
+var vault_1 = require("./vault");
+Object.defineProperty(exports, "deployVault", { enumerable: true, get: function () { return vault_1.deployVault; } });
+var external_secrets_1 = require("./external-secrets");
+Object.defineProperty(exports, "deployExternalSecrets", { enumerable: true, get: function () { return external_secrets_1.deployExternalSecrets; } });
+var oauth2_proxy_1 = require("./oauth2-proxy");
+Object.defineProperty(exports, "deployOAuth2Proxy", { enumerable: true, get: function () { return oauth2_proxy_1.deployOAuth2Proxy; } });
+var descheduler_1 = require("./descheduler");
+Object.defineProperty(exports, "deployDescheduler", { enumerable: true, get: function () { return descheduler_1.deployDescheduler; } });
+//# sourceMappingURL=index.js.map

package/dist/esm/platform/components/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/platform/components/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,qCAA0C;AAAjC,wGAAA,aAAa,OAAA;AACtB,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,mCAAwC;AAA/B,sGAAA,YAAY,OAAA;AACrB,iCAAsC;AAA7B,oGAAA,WAAW,OAAA;AACpB,uDAA2D;AAAlD,yHAAA,qBAAqB,OAAA;AAC9B,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,6CAAkD;AAAzC,gHAAA,iBAAiB,OAAA"}

package/dist/esm/platform/components/oauth2-proxy.d.ts

@@ -0,0 +1,14 @@
+/**
+ * OAuth2 Proxy deployment for dashboard protection.
+ *
+ * @module platform/components/oauth2-proxy
+ */
+import * as k8s from "@pulumi/kubernetes";
+import * as pulumi from "@pulumi/pulumi";
+import type { IPlatformComponentConfig } from "../interfaces";
+export declare function deployOAuth2Proxy(name: string, config: IPlatformComponentConfig & {
+    readonly provider: "google" | "github" | "azure";
+    readonly clientId: pulumi.Input<string>;
+    readonly clientSecret: pulumi.Input<string>;
+}, domain: string, provider: k8s.Provider, defaultVersion: string | undefined): k8s.helm.v3.Release;
+//# sourceMappingURL=oauth2-proxy.d.ts.map

package/dist/esm/platform/components/oauth2-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-proxy.d.ts","sourceRoot":"","sources":["../../../../src/platform/components/oauth2-proxy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,wBAAwB,GAAG;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CAC7C,EACD,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAuCrB"}

package/dist/esm/platform/components/oauth2-proxy.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * OAuth2 Proxy deployment for dashboard protection.
+ *
+ * @module platform/components/oauth2-proxy
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployOAuth2Proxy = deployOAuth2Proxy;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const crypto_1 = require("crypto");
+function deployOAuth2Proxy(name, config, domain, provider, defaultVersion) {
+    // Generate a deterministic cookie secret from the stack name via SHA-256.
+    // In production, override via config.values.config.cookieSecret.
+    const cookieSecret = pulumi.output(name).apply((n) => {
+        return (0, crypto_1.createHash)("sha256").update(`${n}-oauth2-proxy-cookie`).digest("base64").slice(0, 32);
+    });
+    return new k8s.helm.v3.Release(`${name}-oauth2-proxy`, {
+        chart: "oauth2-proxy",
+        repositoryOpts: {
+            repo: "https://oauth2-proxy.github.io/manifests",
+        },
+        version: config.version ?? defaultVersion,
+        namespace: "traefik",
+        createNamespace: true,
+        values: {
+            config: {
+                clientID: config.clientId,
+                clientSecret: config.clientSecret,
+                cookieSecret,
+            },
+            extraArgs: {
+                provider: config.provider,
+                "email-domain": "*",
+                "cookie-secure": "true",
+                upstream: "static://202",
+                "reverse-proxy": "true",
+                "set-xauthrequest": "true",
+                "cookie-domain": `.${domain}`,
+                "whitelist-domain": `.${domain}`,
+            },
+            service: { portNumber: 4180 },
+            ...config.values,
+        },
+    }, { provider });
+}
+//# sourceMappingURL=oauth2-proxy.js.map

package/dist/esm/platform/components/oauth2-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-proxy.js","sourceRoot":"","sources":["../../../../src/platform/components/oauth2-proxy.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOH,8CAiDC;AAtDD,wDAA0C;AAC1C,uDAAyC;AACzC,mCAAoC;AAGpC,SAAgB,iBAAiB,CAC/B,IAAY,EACZ,MAIC,EACD,MAAc,EACd,QAAsB,EACtB,cAAkC;IAElC,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACnD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,eAAe,EACtB;QACE,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE;YACd,IAAI,EAAE,0CAA0C;SACjD;QACD,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc;QACzC,SAAS,EAAE,SAAS;QACpB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,YAAY;aACb;YACD,SAAS,EAAE;gBACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,cAAc,EAAE,GAAG;gBACnB,eAAe,EAAE,MAAM;gBACvB,QAAQ,EAAE,cAAc;gBACxB,eAAe,EAAE,MAAM;gBACvB,kBAAkB,EAAE,MAAM;gBAC1B,eAAe,EAAE,IAAI,MAAM,EAAE;gBAC7B,kBAAkB,EAAE,IAAI,MAAM,EAAE;aACjC;YACD,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;YAC7B,GAAG,MAAM,CAAC,MAAM;SACjB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC"}

package/dist/esm/platform/components/traefik.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Traefik ingress controller deployment.
+ *
+ * @module platform/components/traefik
+ */
+import * as k8s from "@pulumi/kubernetes";
+import type { IPlatformComponentConfig } from "../interfaces";
+export declare function deployTraefik(name: string, config: IPlatformComponentConfig | undefined, provider: k8s.Provider, defaultVersion: string | undefined, robotsBlock?: boolean): k8s.helm.v3.Release;
+//# sourceMappingURL=traefik.d.ts.map

package/dist/esm/platform/components/traefik.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traefik.d.ts","sourceRoot":"","sources":["../../../../src/platform/components/traefik.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,wBAAwB,GAAG,SAAS,EAC5C,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,WAAW,CAAC,EAAE,OAAO,GACpB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAkCrB"}

package/dist/esm/platform/components/traefik.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Traefik ingress controller deployment.
+ *
+ * @module platform/components/traefik
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployTraefik = deployTraefik;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+function deployTraefik(name, config, provider, defaultVersion, robotsBlock) {
+    return new k8s.helm.v3.Release(`${name}-traefik`, {
+        chart: "traefik",
+        repositoryOpts: { repo: "https://traefik.github.io/charts" },
+        version: config?.version ?? defaultVersion,
+        namespace: "traefik",
+        createNamespace: true,
+        values: {
+            ingressClass: { enabled: true, isDefaultClass: true, name: "traefik" },
+            ingressRoute: {
+                dashboard: { enabled: false },
+            },
+            ports: {
+                metrics: { expose: { default: true } },
+                web: {
+                    http: {
+                        redirections: {
+                            entryPoint: { to: "websecure", scheme: "https" },
+                        },
+                    },
+                },
+                ...(robotsBlock && {
+                    websecure: {
+                        http: { middlewares: ["traefik-robots-block@kubernetescrd"] },
+                    },
+                }),
+            },
+            ...config?.values,
+        },
+    }, { provider });
+}
+//# sourceMappingURL=traefik.js.map

package/dist/esm/platform/components/traefik.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traefik.js","sourceRoot":"","sources":["../../../../src/platform/components/traefik.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,sCAwCC;AA3CD,wDAA0C;AAG1C,SAAgB,aAAa,CAC3B,IAAY,EACZ,MAA4C,EAC5C,QAAsB,EACtB,cAAkC,EAClC,WAAqB;IAErB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,GAAG,IAAI,UAAU,EACjB;QACE,KAAK,EAAE,SAAS;QAChB,cAAc,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE;QAC5D,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,cAAc;QAC1C,SAAS,EAAE,SAAS;QACpB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;YACtE,YAAY,EAAE;gBACZ,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aAC9B;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBACtC,GAAG,EAAE;oBACH,IAAI,EAAE;wBACJ,YAAY,EAAE;4BACZ,UAAU,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;yBACjD;qBACF;iBACF;gBACD,GAAG,CAAC,WAAW,IAAI;oBACjB,SAAS,EAAE;wBACT,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,oCAAoC,CAAC,EAAE;qBAC9D;iBACF,CAAC;aACH;YACD,GAAG,MAAM,EAAE,MAAM;SAClB;KACF,EACD,EAAE,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC"}

package/dist/esm/platform/components/vault.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Vault secrets management deployment with auto-unseal and bootstrap sidecar.
+ *
+ * @module platform/components/vault
+ */
+import * as k8s from "@pulumi/kubernetes";
+import type { IVaultConfig } from "../interfaces";
+/**
+ * Deploy Vault with optional auto-unseal and bootstrap sidecar.
+ */
+export declare function deployVault(name: string, config: IVaultConfig, domain: string, provider: k8s.Provider, defaultVersion: string | undefined): k8s.helm.v3.Release;
+//# sourceMappingURL=vault.d.ts.map

package/dist/esm/platform/components/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../../src/platform/components/vault.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAE1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAyUlD;;GAEG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAoLrB"}