@ydkn/pulumi-components 0.4.1 → 0.4.3

package/lib/certManager/certificate.ts

@@ -0,0 +1,168 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+export interface IssuerRefArgs {
+  /**
+   * Issuer name
+   */
+  name: pulumi.Input<string>;
+  /**
+   * Optional: Kind of Issuer
+   */
+  kind?: pulumi.Input<string>;
+}
+
+export interface PrivateKeyArgs {
+  /**
+   * Optional: Crypto algorithm
+   */
+  algorithm?: pulumi.Input<string>;
+  /**
+   * Optional: Key size
+   */
+  size?: pulumi.Input<number>;
+  /**
+   * Optional: Rotation policy
+   */
+  rotationPolicy?: pulumi.Input<string>;
+}
+
+export interface PasswordSecretRefArgs {
+  /**
+   * Secret name
+   */
+  name: pulumi.Input<string>;
+  /**
+   * Secret key
+   */
+  key: pulumi.Input<string>;
+}
+
+export interface Pkcs12Args {
+  /**
+   * Optional: Create a PKCS12 bundle
+   */
+  create?: pulumi.Input<boolean>;
+  /**
+   * Password secret
+   */
+  passwordSecretRef: pulumi.Input<PasswordSecretRefArgs>;
+}
+
+export interface JksArgs {
+  /**
+   * Optional: Create a JKS bundle
+   */
+  create?: pulumi.Input<boolean>;
+  /**
+   * Password secret
+   */
+  passwordSecretRef: pulumi.Input<PasswordSecretRefArgs>;
+}
+
+export interface KeystoresArgs {
+  /**
+   * Optional: PKCS12
+   */
+  pkcs12?: pulumi.Input<Pkcs12Args>;
+  /**
+   * Optional: JKS
+   */
+  jks?: pulumi.Input<JksArgs>;
+}
+
+export interface CertificateSpecArgs {
+  /**
+   * DNS names
+   */
+  dnsNames: pulumi.Input<pulumi.Input<string>[]>;
+  /**
+   * Issuer reference
+   */
+  issuerRef: pulumi.Input<IssuerRefArgs>;
+  /**
+   * Optional: Common name
+   */
+  commonName?: pulumi.Input<string>;
+  /**
+   * Optional: Validity duration
+   */
+  duration?: pulumi.Input<string>;
+  /**
+   * Optional: Renew before expiration
+   */
+  renewBefore?: pulumi.Input<string>;
+  /**
+   * Optional: Name of secret to store certificate
+   */
+  secretName?: pulumi.Input<string>;
+  /**
+   * Optional: Private key options
+   */
+  privateKey?: pulumi.Input<PrivateKeyArgs>;
+  /**
+   * Optional: Is a certification authority
+   */
+  isCA?: pulumi.Input<boolean>;
+  /**
+   * Optional: Keystores
+   */
+  keystores?: pulumi.Input<KeystoresArgs>;
+}
+
+export interface CertificateArgs {
+  /**
+   * Metadata for the certificate resource
+   */
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  /**
+   * Spec for the certificate resource
+   */
+  spec: pulumi.Input<CertificateSpecArgs>;
+}
+
+export class Certificate extends k8s.apiextensions.CustomResource {
+  public readonly secretName: pulumi.Output<string>;
+  public readonly hostnames: pulumi.Output<pulumi.Output<string>[]>;
+
+  /**
+   * Create a new certificate resource.
+   * @param name The name of the certificate resource.
+   * @param args A bag of arguments to control the certificate creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: CertificateArgs, opts?: pulumi.CustomResourceOptions) {
+    const spec = pulumi.all([args.spec]).apply(([specWrapped]) => {
+      const spec = specWrapped as CertificateSpecArgs;
+
+      if (spec.secretName === undefined) {
+        spec.secretName = `${name}-tls`;
+      }
+
+      if (spec.privateKey === undefined) {
+        spec.privateKey = {};
+      }
+
+      spec.privateKey = pulumi.all([spec.privateKey]).apply(([privateKeyWrapped]) => {
+        const privateKey = privateKeyWrapped as PrivateKeyArgs;
+
+        if (privateKey.rotationPolicy === undefined) {
+          privateKey.rotationPolicy = "Always";
+        }
+
+        return privateKey;
+      });
+
+      if (spec.issuerRef === undefined) {
+        spec.issuerRef = { name: "letsencrypt", kind: "ClusterIssuer" };
+      }
+
+      return spec;
+    });
+
+    super(name, { apiVersion: "cert-manager.io/v1", kind: "Certificate", metadata: args.metadata, spec }, opts);
+
+    this.hostnames = spec.dnsNames as pulumi.Output<pulumi.Output<string>[]>;
+    this.secretName = spec.secretName as pulumi.Output<string>;
+  }
+}

package/lib/certManager/index.ts

@@ -0,0 +1,39 @@
+import { LetsEncryptCloudflareArgs, CertManagerArgs, CertManager } from "./operator";
+import { IssuerRefArgs, PrivateKeyArgs, CertificateSpecArgs, CertificateArgs, Certificate } from "./certificate";
+import {
+  SelfSignedArgs,
+  CaArgs,
+  PrivateKeySecretRefArgs,
+  SecretKeyRefArgs,
+  CloudflareSolverArgs,
+  DnsSolverArgs,
+  SolverArgs,
+  AcmeArgs,
+  IssuerSpecArgs,
+  IssuerArgs,
+  Issuer,
+  ClusterIssuer,
+} from "./issuer";
+
+export {
+  LetsEncryptCloudflareArgs,
+  CertManagerArgs,
+  CertManager,
+  SelfSignedArgs,
+  CaArgs,
+  PrivateKeySecretRefArgs,
+  SecretKeyRefArgs,
+  CloudflareSolverArgs,
+  DnsSolverArgs,
+  SolverArgs,
+  AcmeArgs,
+  IssuerSpecArgs,
+  IssuerArgs,
+  Issuer,
+  ClusterIssuer,
+  IssuerRefArgs,
+  PrivateKeyArgs,
+  CertificateSpecArgs,
+  CertificateArgs,
+  Certificate,
+};

package/lib/certManager/issuer.ts

@@ -0,0 +1,141 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+export interface SelfSignedArgs {}
+
+export interface CaArgs {
+  /**
+   * Optional: Name of secret to store certificate
+   */
+  secretName?: pulumi.Input<string>;
+}
+
+export interface PrivateKeySecretRefArgs {
+  /**
+   * Name of secret
+   */
+  name: pulumi.Input<string>;
+}
+
+export interface SecretKeyRefArgs {
+  /**
+   * Name of secret
+   */
+  name: pulumi.Input<string>;
+  /**
+   * Key of secret
+   */
+  key: pulumi.Input<string>;
+}
+
+export interface CloudflareSolverArgs {
+  /**
+   * E-Mail
+   */
+  email: pulumi.Input<string>;
+  /**
+   * Reference for secret containing the API token
+   */
+  apiTokenSecretRef: pulumi.Input<SecretKeyRefArgs>;
+}
+
+export interface DnsSolverArgs {
+  /**
+   * Cloudflare DNS solver
+   */
+  cloudflare?: pulumi.Input<CloudflareSolverArgs>;
+}
+
+export interface SolverArgs {
+  /**
+   * DNS solver
+   */
+  dns01?: pulumi.Input<DnsSolverArgs>;
+}
+
+export interface AcmeArgs {
+  /**
+   * E-Mail
+   */
+  email: pulumi.Input<string>;
+  /**
+   * Server
+   */
+  server: pulumi.Input<string>;
+  /**
+   * Reference to private key secret
+   */
+  privateKeySecretRef: pulumi.Input<PrivateKeySecretRefArgs>;
+  /**
+   * Solvers
+   */
+  solvers: pulumi.Input<pulumi.Input<SolverArgs>[]>;
+}
+
+export interface IssuerSpecArgs {
+  /**
+   * Optional: Self-Signed issuer
+   */
+  selfSigned?: pulumi.Input<SelfSignedArgs>;
+  /**
+   * Optional: CA issuer
+   */
+  ca?: pulumi.Input<CaArgs>;
+  /**
+   * Optional: ACME issuer
+   */
+  acme?: pulumi.Input<AcmeArgs>;
+}
+
+export interface IssuerArgs {
+  /**
+   * Metadata for the Issuer resource
+   */
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  /**
+   * Spec for the Issuer resource
+   */
+  spec: pulumi.Input<IssuerSpecArgs>;
+}
+
+export class Issuer extends k8s.apiextensions.CustomResource {
+  /**
+   * Create a new issuer resource.
+   * @param name The name of the issuer resource.
+   * @param args A bag of arguments to control the issuer creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: IssuerArgs, opts?: pulumi.CustomResourceOptions) {
+    super(
+      name,
+      {
+        apiVersion: "cert-manager.io/v1",
+        kind: "Issuer",
+        metadata: args.metadata,
+        spec: args.spec,
+      },
+      opts
+    );
+  }
+}
+
+export class ClusterIssuer extends k8s.apiextensions.CustomResource {
+  /**
+   * Create a new cluster issuer resource.
+   * @param name The name of the cluster issuer resource.
+   * @param args A bag of arguments to control the cluster issuer creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: IssuerArgs, opts?: pulumi.CustomResourceOptions) {
+    super(
+      name,
+      {
+        apiVersion: "cert-manager.io/v1",
+        kind: "ClusterIssuer",
+        metadata: args.metadata,
+        spec: args.spec,
+      },
+      opts
+    );
+  }
+}

package/lib/certManager/operator.ts

@@ -0,0 +1,244 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import * as fs from "fs";
+import * as path from "path";
+import { ComponentResource } from "../common";
+import * as helm from "../kubernetes/helm";
+import { ClusterIssuer } from "./issuer";
+import { Dashboard } from "../grafana";
+
+export interface LetsEncryptCloudflareArgs {
+  token: pulumi.Input<string>;
+  email: pulumi.Input<string>;
+}
+
+export interface CertManagerArgs {
+  namespace?: pulumi.Input<string>;
+  replicas?: pulumi.Input<number>;
+  letsencryptCloudflare?: pulumi.Input<LetsEncryptCloudflareArgs>;
+}
+
+export class CertManager extends ComponentResource {
+  private readonly helmRelease: helm.v3.Release;
+  private readonly grafanaDashboard: Dashboard;
+  public readonly namespace: pulumi.Output<string>;
+  public readonly clusterIssuers: pulumi.Output<{ [key: string]: pulumi.Output<string> }>;
+
+  /**
+   * Create a new cert-manager resource.
+   * @param name The name of cert-manager resource.
+   * @param args A bag of arguments to control the cert-manager creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: CertManagerArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("cert-manager", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    if (args.replicas === undefined) {
+      args.replicas = 1;
+    }
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "cert-manager",
+        "app.kubernetes.io/component": "cert-manager",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.helmRelease = new helm.v3.Release(
+      name,
+      {
+        name: metadata.name,
+        namespace: metadata.namespace,
+        repositoryOpts: { repo: "https://charts.jetstack.io" },
+        chart: "cert-manager",
+        values: {
+          fullnameOverride: name,
+          replicaCount: args.replicas,
+          installCRDs: true,
+          global: {
+            leaderElection: { namespace: metadata.namespace },
+          },
+          extraArgs: ["--enable-certificate-owner-ref=true"],
+          webhook: {
+            replicaCount: args.replicas,
+            affinity: {
+              podAntiAffinity: {
+                preferredDuringSchedulingIgnoredDuringExecution: [
+                  {
+                    weight: 100,
+                    podAffinityTerm: {
+                      labelSelector: {
+                        matchExpressions: [
+                          { key: "app.kubernetes.io/name", operator: "In", values: ["cert-manager"] },
+                          { key: "app.kubernetes.io/component", operator: "In", values: ["webhook"] },
+                          { key: "app.kubernetes.io/instance", operator: "In", values: [name] },
+                        ],
+                      },
+                      topologyKey: "kubernetes.io/hostname",
+                    },
+                  },
+                ],
+              },
+            },
+            resources: {
+              requests: { memory: "48Mi" },
+              limits: { memory: "96Mi" },
+            },
+          },
+          cainjector: {
+            replicaCount: args.replicas,
+            affinity: {
+              podAntiAffinity: {
+                preferredDuringSchedulingIgnoredDuringExecution: [
+                  {
+                    weight: 100,
+                    podAffinityTerm: {
+                      labelSelector: {
+                        matchExpressions: [
+                          { key: "app.kubernetes.io/name", operator: "In", values: ["cert-manager"] },
+                          { key: "app.kubernetes.io/component", operator: "In", values: ["cainjector"] },
+                          { key: "app.kubernetes.io/instance", operator: "In", values: [name] },
+                        ],
+                      },
+                      topologyKey: "kubernetes.io/hostname",
+                    },
+                  },
+                ],
+              },
+            },
+            resources: {
+              requests: { memory: "128Mi" },
+              limits: { memory: "384Mi" },
+            },
+          },
+          prometheus: { servicemonitor: { enabled: true } },
+          affinity: {
+            podAntiAffinity: {
+              preferredDuringSchedulingIgnoredDuringExecution: [
+                {
+                  weight: 100,
+                  podAffinityTerm: {
+                    labelSelector: {
+                      matchExpressions: [
+                        { key: "app.kubernetes.io/name", operator: "In", values: ["cert-manager"] },
+                        { key: "app.kubernetes.io/component", operator: "In", values: ["controller"] },
+                        { key: "app.kubernetes.io/instance", operator: "In", values: [name] },
+                      ],
+                    },
+                    topologyKey: "kubernetes.io/hostname",
+                  },
+                },
+              ],
+            },
+          },
+          resources: {
+            requests: { memory: "128Mi" },
+            limits: { memory: "384Mi" },
+          },
+        },
+      },
+      opts
+    );
+
+    this.clusterIssuers = pulumi.all([args.letsencryptCloudflare]).apply(([letsencryptCloudflare]) => {
+      const clusterIssuers: { [key: string]: pulumi.Output<string> } = {};
+
+      clusterIssuers.selfSigned = this.selfSignedIssuer(name, metadata, opts).metadata.name;
+
+      if (letsencryptCloudflare !== undefined) {
+        clusterIssuers.letsencrypt = this.letsencryptCloudflareIssuer(
+          name,
+          metadata,
+          letsencryptCloudflare,
+          opts
+        ).metadata.name;
+      }
+
+      return clusterIssuers;
+    });
+
+    this.grafanaDashboard = new Dashboard(
+      `${name}-grafana-dashboard`,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-grafana-dashboard` },
+        name: "cert-manager",
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        data: fs.readFileSync(path.join(__dirname, "assets", "dashboard.json"), "utf-8"),
+      },
+      opts
+    );
+
+    this.registerOutputs();
+  }
+
+  private selfSignedIssuer(
+    name: string,
+    metadata: k8s.types.input.meta.v1.ObjectMeta,
+    opts?: pulumi.ComponentResourceOptions
+  ): pulumi.Output<ClusterIssuer> {
+    return pulumi.output(
+      new ClusterIssuer(
+        `${name}-self-signed`,
+        {
+          metadata: { ...metadata, name: "self-signed" },
+          spec: { selfSigned: {} },
+        },
+        { ...opts, dependsOn: [this.helmRelease] }
+      )
+    );
+  }
+
+  private letsencryptCloudflareIssuer(
+    name: string,
+    metadata: k8s.types.input.meta.v1.ObjectMeta,
+    args: pulumi.Input<LetsEncryptCloudflareArgs>,
+    opts?: pulumi.ComponentResourceOptions
+  ): pulumi.Output<ClusterIssuer> {
+    return pulumi.all([args]).apply(([args]) => {
+      const secret = new k8s.core.v1.Secret(
+        `${name}-cloudflare`,
+        {
+          metadata: { ...metadata, name: "cloudflare" },
+          stringData: {
+            apiToken: args.token,
+          },
+        },
+        opts
+      );
+
+      return new ClusterIssuer(
+        `${name}-cloudflare`,
+        {
+          metadata: { ...metadata, name: "letsencrypt" },
+          spec: {
+            acme: {
+              email: args.email,
+              server: "https://acme-v02.api.letsencrypt.org/directory",
+              privateKeySecretRef: { name: "letsencrypt" },
+              solvers: [
+                {
+                  dns01: {
+                    cloudflare: {
+                      email: args.email,
+                      apiTokenSecretRef: { name: secret.metadata.name, key: "apiToken" },
+                    },
+                  },
+                },
+              ],
+            },
+          },
+        },
+        { ...opts, dependsOn: [this.helmRelease] }
+      );
+    });
+  }
+}

package/lib/common/componentResource.ts

@@ -0,0 +1,78 @@
+import * as pulumi from "@pulumi/pulumi";
+
+export class ComponentResource extends pulumi.ComponentResource {
+  private readonly _opts: pulumi.ComponentResourceOptions;
+
+  /**
+   * Creates and registers a new component resource. [type] is the fully qualified type token and
+   * [name] is the "name" part to use in creating a stable and globally unique URN for the object.
+   * [opts.parent] is the optional parent for this component, and [opts.dependsOn] is an optional
+   * list of other resources that this resource depends on, controlling the order in which we
+   * perform resource operations.
+   *
+   * @param type The type of the resource.
+   * @param name The _unique_ name of the resource.
+   * @param args Information passed to [initialize] method.
+   * @param opts A bag of options that control this resource's behavior.
+   * @param remote True if this is a remote component resource.
+   */
+  constructor(
+    type: string,
+    name: string,
+    args?: pulumi.Inputs,
+    opts?: pulumi.ComponentResourceOptions,
+    remote?: boolean
+  ) {
+    super(type, name, args, opts, remote);
+
+    if (opts === undefined) {
+      opts = {};
+    }
+
+    this._opts = { ...opts, ...{ parent: this } };
+  }
+
+  opts(provider?: any, opts?: pulumi.ComponentResourceOptions): pulumi.ComponentResourceOptions {
+    opts = { ...this._opts, ...opts };
+
+    delete opts.provider;
+    delete opts.providers;
+
+    const providers: pulumi.ProviderResource[] = [];
+
+    if (this._opts.provider !== undefined) {
+      providers.push(this._opts.provider);
+    }
+
+    if (this._opts.providers !== undefined) {
+      const providersRecords = this._opts.providers as Record<string, pulumi.ProviderResource>;
+
+      if (providersRecords != null) {
+        for (const p in providersRecords) {
+          // eslint-disable-next-line security/detect-object-injection
+          providers.push(providersRecords[p]);
+        }
+      }
+
+      const providersList = this._opts.providers as pulumi.ProviderResource[];
+
+      if (providersList != null) {
+        for (const p of providersList) {
+          providers.push(p);
+        }
+      }
+    }
+
+    if (provider !== undefined) {
+      for (const p of providers) {
+        if (p instanceof provider) {
+          opts.provider = p;
+
+          break;
+        }
+      }
+    }
+
+    return opts;
+  }
+}

package/lib/common/{index.d.ts → index.ts}

@@ -1,4 +1,5 @@
 import { TransformationFunc } from "./types";
 import { ComponentResource } from "./componentResource";
+
+
 export { TransformationFunc, ComponentResource };
-//# sourceMappingURL=index.d.ts.map

package/lib/common/types.ts

@@ -0,0 +1,3 @@
+import * as pulumi from "@pulumi/pulumi";
+
+export type TransformationFunc = (o: any, opts: pulumi.CustomResourceOptions) => void;