@ydkn/pulumi-components 0.4.1 → 0.4.3

package/.eslintrc.json

@@ -0,0 +1,14 @@
+{
+  "env": {
+    "browser": false,
+    "es2022": true
+  },
+  "extends": ["standard", "eslint:recommended", "plugin:security/recommended", "prettier"],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": 12,
+    "sourceType": "module"
+  },
+  "plugins": ["@typescript-eslint", "security"],
+  "rules": {}
+}

package/.gitlab-ci.yml

@@ -0,0 +1,72 @@
+stages:
+  - security
+  - vendor
+  - codequality
+  - build
+  - release
+
+image:
+  name: node:18-alpine
+  entrypoint:
+    - /usr/bin/env
+
+sast:
+  stage: security
+
+dependency_scanning:
+  stage: security
+
+secret_detection:
+  stage: security
+
+vendor:nodejs:
+  stage: vendor
+  before_script:
+    - npm install -g pnpm
+  script:
+    - pnpm install
+  artifacts:
+    name: vendor-nodejs-${CI_PIPELINE_ID}
+    expire_in: 1 day
+    paths:
+      - node_modules/
+
+codequality:nodejs:
+  stage: codequality
+  needs:
+    - vendor:nodejs
+  before_script:
+    - npm install -g pnpm
+  script:
+    - pnpm run lint
+
+build:nodejs:
+  stage: build
+  needs:
+    - vendor:nodejs
+    - codequality:nodejs
+  before_script:
+    - npm install -g pnpm
+  script:
+    - pnpm run build
+  artifacts:
+    name: build-nodejs-${CI_PIPELINE_ID}
+    expire_in: 1 day
+    paths:
+      - dist/
+
+release:nodejs:
+  stage: release
+  needs:
+    - build:nodejs
+  before_script:
+    - npm install -g pnpm
+  script:
+    - pnpm publish --tag="${CI_COMMIT_TAG}"
+  only:
+    - tags
+
+include:
+  - template: Security/SAST.gitlab-ci.yml
+  - template: Security/Dependency-Scanning.gitlab-ci.yml
+  - template: Security/Secret-Detection.gitlab-ci.yml

package/.prettierrc

@@ -0,0 +1,3 @@
+{
+  "printWidth": 120
+}

package/{index.d.ts → index.ts}

@@ -3,6 +3,9 @@ import * as avahi from "./lib/avahi";
 import * as aws from "./lib/aws";
 import * as blocky from "./lib/blocky";
 import * as certManager from "./lib/certManager";
+import * as cups from "./lib/cups";
+import * as devcontainer from "./lib/devcontainer";
+import * as dhcpd from "./lib/dhcpd";
 import * as externalDns from "./lib/externalDns";
 import * as fcos from "./lib/fcos";
 import * as freeradius from "./lib/freeradius";
@@ -11,10 +14,14 @@ import * as grafana from "./lib/grafana";
 import * as hcloud from "./lib/hcloud";
 import * as k0s from "./lib/k0s";
 import * as kubernetes from "./lib/kubernetes";
+import * as kubeStateMetrics from "./lib/kubeStateMetrics";
+import * as localPathProvisioner from "./lib/localPathProvisioner";
+import * as loki from "./lib/loki";
 import * as metallb from "./lib/metallb";
 import * as node from "./lib/node";
 import * as openldap from "./lib/openldap";
 import * as plex from "./lib/plex";
+import * as postgresql from "./lib/postgresql";
 import * as prometheus from "./lib/prometheus";
 import * as raspberrypi from "./lib/raspberrypi";
 import * as rethinkdb from "./lib/rethinkdb";
@@ -27,5 +34,43 @@ import * as ubuntu from "./lib/ubuntu";
 import * as unifi from "./lib/unifi";
 import * as velero from "./lib/velero";
 import * as wireguard from "./lib/wireguard";
-export { TransformationFunc, ComponentResource, avahi, aws, blocky, certManager, externalDns, fcos, freeradius, gitlab, grafana, hcloud, k0s, kubernetes, metallb, node, openldap, plex, prometheus, raspberrypi, rethinkdb, rook, samba, ssh, torproxy, traefik, ubuntu, unifi, velero, wireguard, };
-//# sourceMappingURL=index.d.ts.map
+
+export {
+  TransformationFunc,
+  ComponentResource,
+  avahi,
+  aws,
+  blocky,
+  certManager,
+  cups,
+  devcontainer,
+  dhcpd,
+  externalDns,
+  fcos,
+  freeradius,
+  gitlab,
+  grafana,
+  hcloud,
+  k0s,
+  kubernetes,
+  kubeStateMetrics,
+  localPathProvisioner,
+  loki,
+  metallb,
+  node,
+  openldap,
+  plex,
+  postgresql,
+  prometheus,
+  raspberrypi,
+  rethinkdb,
+  rook,
+  samba,
+  ssh,
+  torproxy,
+  traefik,
+  ubuntu,
+  unifi,
+  velero,
+  wireguard,
+};

package/lib/avahi/deployment.ts

@@ -0,0 +1,171 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+
+export interface AvahiArgs {
+  namespace?: pulumi.Input<string>;
+  allowInterfaces?: pulumi.Input<string>;
+  nodeSelector?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+}
+
+export class Avahi extends ComponentResource {
+  private readonly serviceAccount: k8s.core.v1.ServiceAccount;
+  private readonly clusterRole: k8s.rbac.v1.ClusterRole;
+  private readonly clusterRoleBinding: k8s.rbac.v1.ClusterRoleBinding;
+  private readonly deployment: k8s.apps.v1.Deployment;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  public readonly namespace: pulumi.Output<string>;
+  public readonly labelName: pulumi.Output<string>;
+
+  /**
+   * Create a new Avahi resource.
+   * @param name The name of the Avahi resource.
+   * @param args A bag of arguments to control the Avahi creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: AvahiArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("avahi", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "avahi",
+        "app.kubernetes.io/component": "avahi",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.serviceAccount = new k8s.core.v1.ServiceAccount(name, { metadata }, opts);
+
+    this.clusterRole = new k8s.rbac.v1.ClusterRole(
+      name,
+      {
+        metadata,
+        rules: [{ apiGroups: [""], resources: ["configmaps"], verbs: ["get", "list"] }],
+      },
+      opts
+    );
+
+    this.clusterRoleBinding = new k8s.rbac.v1.ClusterRoleBinding(
+      name,
+      {
+        metadata,
+        subjects: [
+          {
+            kind: this.serviceAccount.kind,
+            name: this.serviceAccount.metadata.name,
+            namespace: this.serviceAccount.metadata.namespace,
+          },
+        ],
+        roleRef: {
+          kind: this.clusterRole.kind,
+          name: this.clusterRole.metadata.name,
+          apiGroup: "rbac.authorization.k8s.io",
+        },
+      },
+      opts
+    );
+
+    this.labelName = pulumi.interpolate`${name}-service`;
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: { labels: metadata.labels },
+            spec: {
+              serviceAccountName: this.serviceAccount.metadata.name,
+              nodeSelector: args.nodeSelector,
+              hostNetwork: true,
+              initContainers: [
+                {
+                  name: "services",
+                  image: "cyrilix/k8s-sidecar:latest",
+                  imagePullPolicy: "Always",
+                  env: [
+                    { name: "NAMESPACE", value: "ALL" },
+                    { name: "METHOD", value: "LIST" },
+                    { name: "LABEL", value: this.labelName },
+                    { name: "FOLDER", value: "/etc/avahi/services" },
+                  ],
+                  resources: {
+                    requests: { memory: "32Mi" },
+                    limits: { memory: "48Mi" },
+                  },
+                  volumeMounts: [{ name: "services", mountPath: "/etc/avahi/services" }],
+                },
+              ],
+              containers: [
+                {
+                  name: "avahi",
+                  image: "ydkn/avahi:latest",
+                  imagePullPolicy: "Always",
+                  env: [{ name: "ALLOW_INTERFACES", value: args.allowInterfaces }],
+                  resources: {
+                    requests: { memory: "8Mi" },
+                    limits: { memory: "16Mi" },
+                  },
+                  volumeMounts: [{ name: "services", mountPath: "/etc/avahi/services" }],
+                },
+              ],
+              volumes: [{ name: "services", emptyDir: {} }],
+              affinity: {
+                podAntiAffinity: {
+                  preferredDuringSchedulingIgnoredDuringExecution: [
+                    {
+                      weight: 100,
+                      podAffinityTerm: {
+                        labelSelector: {
+                          matchExpressions: [
+                            {
+                              key: "app.kubernetes.io/name",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/name"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/instance",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/instance"]],
+                            },
+                          ],
+                        },
+                        topologyKey: "kubernetes.io/hostname",
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+      opts
+    );
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          maxUnavailable: 0,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      opts
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/avahi/{index.d.ts → index.ts}

@@ -1,4 +1,4 @@
 import { AvahiArgs, Avahi } from "./deployment";
 import { AvahiServiceArgs, AvahiServiceDefinitionArgs, AvahiService } from "./service";
+
 export { AvahiArgs, Avahi, AvahiServiceArgs, AvahiServiceDefinitionArgs, AvahiService };
-//# sourceMappingURL=index.d.ts.map

package/lib/avahi/service.ts

@@ -0,0 +1,118 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+export interface AvahiServiceDefinitionArgs {
+  type: pulumi.Input<string>;
+  port: pulumi.Input<number>;
+  subtype?: pulumi.Input<string>;
+  hostname?: pulumi.Input<string>;
+  txtRecords?: pulumi.Input<pulumi.Input<string>[]>;
+}
+
+export interface AvahiServiceArgs {
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  labelName: pulumi.Input<string>;
+  name: pulumi.Input<string>;
+  services: pulumi.Input<pulumi.Input<AvahiServiceDefinitionArgs>[]>;
+}
+
+export interface ConfigAvahiServicesArgs {
+  [key: string]: {
+    name: pulumi.Input<string>;
+    services: pulumi.Input<pulumi.Input<AvahiServiceDefinitionArgs>[]>;
+  };
+}
+
+export interface ConfigAvahiServiceArgs {
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  labelName: pulumi.Input<string>;
+  services: ConfigAvahiServicesArgs;
+}
+
+export class AvahiService extends k8s.core.v1.ConfigMap {
+  /**
+   * Create a new Avahi service resource.
+   * @param name The name of the Avahi service resource.
+   * @param args A bag of arguments to control the Avahi service creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: AvahiServiceArgs, opts?: pulumi.CustomResourceOptions) {
+    const data = pulumi.all([args.name, args.services]).apply(([name, services]) => {
+      const serviceData: string[] = [
+        `<?xml version="1.0" standalone="no"?>`,
+        `<!DOCTYPE service-group SYSTEM "avahi-service.dtd">`,
+        `<service-group>`,
+        `<name replace-wildcards="yes">${name}</name>`,
+      ];
+
+      for (const service of services) {
+        serviceData.push(`<service>`);
+        serviceData.push(`<type>${service.type}</type>`);
+
+        if (service.subtype !== undefined) {
+          serviceData.push(`<subtype>${service.subtype}</subtype>`);
+        }
+
+        serviceData.push(`<port>${service.port}</port>`);
+
+        if (service.hostname !== undefined) {
+          serviceData.push(`<host-name>${service.hostname}</host-name>`);
+        }
+
+        if (service.txtRecords !== undefined) {
+          for (const txtRecord of service.txtRecords) {
+            serviceData.push(`<txt-record>${txtRecord}</txt-record>`);
+          }
+        }
+
+        serviceData.push(`</service>`);
+      }
+
+      serviceData.push(`</service-group>`);
+
+      const configMapData: { [id: string]: string } = {};
+
+      configMapData[`${name}.service`] = serviceData.join("\n");
+
+      return configMapData;
+    });
+
+    const metadata = pulumi.all([args.labelName, args.metadata]).apply(([labelName, metadata]) => {
+      if (metadata === undefined) {
+        metadata = {};
+      }
+
+      if (metadata.labels === undefined) {
+        metadata.labels = {};
+      }
+
+      // eslint-disable-next-line security/detect-object-injection
+      metadata.labels[labelName] = "true";
+
+      return metadata;
+    });
+
+    super(name, { metadata, data }, opts);
+  }
+
+  static fromConfig(args: ConfigAvahiServiceArgs, opts?: pulumi.CustomResourceOptions): AvahiService[] {
+    const services: AvahiService[] = [];
+
+    for (const name in args.services) {
+      services.push(
+        new AvahiService(
+          name,
+          {
+            // eslint-disable-next-line security/detect-object-injection
+            ...args.services[name],
+            metadata: { ...args.metadata, name: pulumi.interpolate`${name}-${args.labelName}` },
+            labelName: args.labelName,
+          },
+          opts
+        )
+      );
+    }
+
+    return services;
+  }
+}

package/lib/aws/accessKey.ts

@@ -0,0 +1,40 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { ComponentResource } from "../common";
+
+export interface AccessKeyArgs {
+  /**
+   * Name
+   */
+  name?: pulumi.Input<string>;
+}
+
+export class AccessKey extends ComponentResource {
+  public readonly user: aws.iam.User;
+  public readonly accessKey: aws.iam.AccessKey;
+
+  /**
+   * Create a new AWS access key resource.
+   * @param name The name of the AWS access key resource.
+   * @param args A bag of arguments to control the AWS access key creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: AccessKeyArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("aws:accessKey", name, {}, opts);
+
+    opts = this.opts(aws.Provider);
+
+    this.user = new aws.iam.User(name, { name: args.name ?? name }, opts);
+    this.accessKey = this.newAccessKey(name, new Date(), opts);
+
+    this.registerOutputs();
+  }
+
+  private newAccessKey(name: string, date: Date, opts?: pulumi.ComponentResourceOptions): aws.iam.AccessKey {
+    return new aws.iam.AccessKey(
+      `${name}-${date.getFullYear()}-${date.getMonth() + 1}`,
+      { user: this.user.name },
+      { ...opts, dependsOn: this.user }
+    );
+  }
+}

package/lib/aws/bucket.ts

@@ -0,0 +1,71 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as aws from "@pulumi/aws";
+import { ComponentResource } from "../common";
+import { AccessKey } from "./accessKey";
+
+export interface BucketArgs extends aws.s3.BucketArgs {
+  /**
+   * Optional: Name
+   */
+  name?: pulumi.Input<string>;
+  /**
+   * Optional: Protect critical resources
+   */
+  protect?: boolean;
+}
+
+export class Bucket extends ComponentResource {
+  private readonly id: pulumi.Output<string>;
+  public readonly bucket: aws.s3.Bucket;
+  public readonly accessKey: AccessKey;
+  public readonly userPolicy: aws.iam.UserPolicy;
+
+  /**
+   * Create a new AWS bucket resource.
+   * @param name The name of the AWS bucket resource.
+   * @param args A bag of arguments to control the AWS bucket creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: BucketArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("aws:bucket", name, args, opts);
+
+    const emptyOpts = this.opts();
+    const awsOpts = this.opts(aws.Provider);
+
+    this.id = new random.RandomId(
+      `${name}-bucket`,
+      { byteLength: 6, prefix: pulumi.interpolate`${args.name ?? name}-` },
+      { ...emptyOpts, protect: args.protect }
+    ).hex;
+
+    this.bucket = new aws.s3.Bucket(name, { ...args, bucket: this.id }, { ...awsOpts, protect: args.protect });
+
+    this.accessKey = new AccessKey(name, { name: this.id }, awsOpts);
+
+    this.userPolicy = new aws.iam.UserPolicy(
+      name,
+      {
+        user: this.accessKey.user.name,
+        policy: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Action: ["s3:ListBucket"],
+              Resource: [pulumi.interpolate`arn:aws:s3:::${this.bucket.id}`],
+            },
+            {
+              Effect: "Allow",
+              Action: ["s3:*Object"],
+              Resource: [pulumi.interpolate`arn:aws:s3:::${this.bucket.id}/*`],
+            },
+          ],
+        },
+      },
+      awsOpts
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/aws/{index.d.ts → index.ts}

@@ -1,4 +1,4 @@
 import { AccessKeyArgs, AccessKey } from "./accessKey";
 import { BucketArgs, Bucket } from "./bucket";
+
 export { AccessKeyArgs, AccessKey, BucketArgs, Bucket };
-//# sourceMappingURL=index.d.ts.map