@ydkn/pulumi-components 0.4.2 → 0.4.3

package/lib/hcloud/cluster.ts

@@ -0,0 +1,533 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as tls from "@pulumi/tls";
+import * as hcloud from "@pulumi/hcloud";
+import * as k8s from "@pulumi/kubernetes";
+import * as path from "path";
+import { ComponentResource } from "../common";
+import * as node from "../node";
+import * as fcos from "../fcos";
+import * as k0s from "../k0s";
+import * as ssh from "../ssh";
+import { Kubernetes } from "./kubernetes";
+
+interface Nodes extends node.Node, fcos.HostArgs {
+  serverType: pulumi.Input<string>;
+  count?: pulumi.Input<number>;
+}
+
+interface Node extends node.Node {
+  fcosHost: fcos.Host;
+}
+
+/**
+ * Arguments for hcloud cluster resource
+ */
+export interface ClusterArgs extends k0s.ClusterArgs, fcos.IgnitionArgs {
+  /**
+   * Optional: Name
+   */
+  name?: pulumi.Input<string>;
+  /**
+   * Hetzner cloud token
+   */
+  token: pulumi.Input<string>;
+  /**
+   * Hetzner cloud location
+   */
+  location: pulumi.Input<string>;
+  /**
+   * Hetzner cloud zone
+   */
+  zone: pulumi.Input<string>;
+  /**
+   * Network range
+   */
+  networkRange: pulumi.Input<string>;
+  /**
+   * Node network range
+   */
+  nodeRange: pulumi.Input<string>;
+  /**
+   * Nodes
+   */
+  nodes: pulumi.Input<pulumi.Input<Nodes>[]>;
+  /**
+   * Optional: Enable external SSH access
+   */
+  externalSshAccess?: pulumi.Input<boolean>;
+  /**
+   * Optional: Global network ranges
+   */
+  trustedNetworkRanges?: pulumi.Input<pulumi.Input<string>[]>;
+  /**
+   * Optional: Enable external access
+   */
+  externalAccess?: pulumi.Input<boolean>;
+  /**
+   * Optional: SSH authorized keys
+   */
+  sshAuthorizedKeys?: pulumi.Input<pulumi.Input<string>[]>;
+}
+
+export class Cluster extends ComponentResource {
+  private static readonly rescueSshUsername = "root";
+  private static readonly sshUsername = "pulumi";
+  private static readonly primaryInterface = "ens3";
+  private static readonly privateInterfaces = [10, 11, 12, 13, 14, 15, 16, 17, 18, 19].map((i) => `ens${i}`);
+
+  private readonly sshKey: hcloud.SshKey;
+  private readonly network: hcloud.Network;
+  private readonly nodeSubnet: hcloud.NetworkSubnet;
+  private readonly placementGroup: hcloud.PlacementGroup;
+  private readonly sshFirewall: hcloud.Firewall;
+  private readonly nodesFirewall: hcloud.Firewall;
+  private readonly kubernetes: Kubernetes;
+  public readonly name: pulumi.Output<string>;
+  public readonly location: pulumi.Output<string>;
+  public readonly zone: pulumi.Output<string>;
+  public readonly sshPrivateKey: tls.PrivateKey;
+  public readonly sshPublicKey: pulumi.Output<string>;
+  public readonly networkId: pulumi.Output<number>;
+  public readonly networkRange: pulumi.Output<string>;
+  public readonly nodeRange: pulumi.Output<string>;
+  public readonly nodes: pulumi.Output<pulumi.Output<node.Node>[]>;
+  public readonly kubeconfig: pulumi.Output<string>;
+  public readonly provider: k8s.Provider;
+  public readonly kubeletDirPath: pulumi.Output<string>;
+
+  /**
+   * Create a new hcloud cluster resource.
+   * @param name The name of hcloud cluster resource.
+   * @param args A bag of arguments to control the hcloud cluster creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: ClusterArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("hcloud:cluster", name, args, opts);
+
+    const emptyOpts = this.opts();
+    const hcloudOpts = this.opts(hcloud.Provider);
+
+    if (args.name === undefined) {
+      this.name = new random.RandomId(name, { byteLength: 3 }, { ...emptyOpts, protect: args.protect }).hex;
+    } else {
+      this.name = pulumi.output(args.name);
+    }
+
+    this.location = pulumi.output(args.location);
+    this.zone = pulumi.output(args.zone);
+
+    this.sshPrivateKey = new tls.PrivateKey(name, { algorithm: "ED25519" }, { ...emptyOpts, protect: args.protect });
+    this.sshPublicKey = this.sshPrivateKey.publicKeyOpenssh;
+    this.sshKey = new hcloud.SshKey(name, { name: "pulumi", publicKey: this.sshPublicKey }, hcloudOpts);
+
+    this.network = new hcloud.Network(
+      name,
+      { name: "private", ipRange: args.networkRange, labels: { cluster: this.name } },
+      { ...hcloudOpts, protect: args.protect }
+    );
+    this.networkId = this.network.id.apply((o) => parseInt(o));
+    this.networkRange = this.network.ipRange;
+
+    this.nodeSubnet = new hcloud.NetworkSubnet(
+      `${name}-nodes`,
+      { type: "cloud", networkId: this.networkId, networkZone: this.zone, ipRange: args.nodeRange },
+      { ...hcloudOpts, protect: args.protect }
+    );
+    this.nodeRange = this.nodeSubnet.ipRange;
+
+    this.placementGroup = new hcloud.PlacementGroup(
+      name,
+      { name: "nodes", type: "spread", labels: { cluster: this.name } },
+      hcloudOpts
+    );
+
+    const serverImage = pulumi
+      .all([hcloud.getImages({ withStatuses: ["available"] }, hcloudOpts)])
+      .apply(([result]) => {
+        return result.images.filter((image) => image.osFlavor === "ubuntu").sort((a, b) => (a > b ? -1 : 1))[0].name;
+      });
+
+    const servers = this.createServers(
+      args.nodes,
+      serverImage,
+      this.sshKey,
+      this.sshPrivateKey.privateKeyOpenssh,
+      this.nodeSubnet,
+      this.placementGroup,
+      args.modules,
+      args.packages,
+      args.files,
+      args.systemdUnits,
+      args.sshAuthorizedKeys,
+      args.protect
+    );
+
+    this.nodes = servers.apply((servers) => servers.map((s) => s.node));
+
+    const nodeIPs = pulumi.all([this.nodes]).apply(([nodes]) =>
+      pulumi.all(nodes).apply((nodes) => {
+        const nodeIPs: pulumi.Output<string>[] = [];
+
+        for (const node of nodes) {
+          nodeIPs.push(pulumi.interpolate`${node.ipv4Address}/32`, pulumi.interpolate`${node.ipv6Address}/128`);
+
+          if (node.privateIpv4Address !== undefined) {
+            nodeIPs.push(pulumi.interpolate`${node.privateIpv4Address}/32`);
+          }
+        }
+
+        if (nodeIPs.length <= 0) {
+          nodeIPs.push(pulumi.output("127.0.0.1/32"));
+        }
+
+        return nodeIPs;
+      })
+    );
+
+    this.sshFirewall = new hcloud.Firewall(
+      `${name}-ssh`,
+      {
+        name: "ssh",
+        labels: { cluster: this.name },
+        applyTos: [{ labelSelector: pulumi.interpolate`cluster=${this.name}` }],
+        rules: [
+          {
+            description: "SSH",
+            direction: "in",
+            protocol: "tcp",
+            port: "22",
+            sourceIps: pulumi
+              .all([args.externalSshAccess])
+              .apply(([externalSshAccess]) =>
+                externalSshAccess ? ["0.0.0.0/0", "::/0"] : ["127.0.0.1/32", "::1/128"]
+              ),
+          },
+        ],
+      },
+      hcloudOpts
+    );
+
+    const nodeFirewallSourceIps = nodeIPs.apply((nodeIPs) => nodeIPs.concat(this.networkRange));
+
+    this.nodesFirewall = new hcloud.Firewall(
+      `${name}-nodes`,
+      {
+        name: "nodes",
+        labels: { cluster: this.name },
+        applyTos: [{ labelSelector: pulumi.interpolate`cluster=${this.name}` }],
+        rules: pulumi
+          .all([args.trustedNetworkRanges ?? [], nodeFirewallSourceIps])
+          .apply(([trustedNetworkRanges, nodeFirewallSourceIps]) =>
+            pulumi.all(trustedNetworkRanges.concat(nodeFirewallSourceIps)).apply((sourceIps) => [
+              { description: "ICMP", direction: "in", protocol: "icmp", sourceIps },
+              { description: "TCP", direction: "in", protocol: "tcp", port: "any", sourceIps },
+              { description: "UDP", direction: "in", protocol: "udp", port: "any", sourceIps },
+            ])
+          ),
+      },
+      hcloudOpts
+    );
+
+    pulumi.all([args.externalAccess]).apply(([externalAccess]) => {
+      if (externalAccess) {
+        // eslint-disable-next-line no-unused-vars
+        const controllersFirewall = new hcloud.Firewall(
+          `${name}-controllers`,
+          {
+            name: "controllers",
+            labels: { cluster: this.name, controller: "true" },
+            applyTos: [{ labelSelector: pulumi.interpolate`cluster=${this.name},role=controller` }],
+            rules: [
+              { description: "TCP", direction: "in", protocol: "tcp", port: "6443", sourceIps: ["0.0.0.0/0", "::/0"] },
+            ],
+          },
+          hcloudOpts
+        );
+      }
+    });
+
+    const k0sCluster = servers.apply((servers) =>
+      pulumi.all(servers.map((s) => s.depends)).apply((dependsOn) => {
+        return new k0s.Cluster(
+          name,
+          {
+            name: this.name,
+            nodes: this.nodes,
+            k0s: args.k0s,
+            cloudProvider: true,
+            protect: args.protect,
+          },
+          { ...emptyOpts, dependsOn }
+        );
+      })
+    );
+
+    this.kubeletDirPath = k0sCluster.kubeletDirPath;
+    this.kubeconfig = k0sCluster.kubeconfig;
+    this.provider = new k8s.Provider(
+      `${name}-k8s`,
+      { kubeconfig: this.kubeconfig, suppressHelmHookWarnings: true },
+      emptyOpts
+    );
+
+    this.kubernetes = new Kubernetes(
+      name,
+      {
+        token: args.token,
+        network: this.network.id,
+        podCIDR: k0sCluster.apply((cluster) =>
+          cluster.spec.apply((spec) =>
+            spec.k0s
+              ? [spec.k0s.config?.spec?.network?.podCIDR, spec.k0s.config?.spec?.network?.dualStack?.IPv6podCIDR]
+                  .filter((cidr) => cidr !== undefined)
+                  .join(",")
+              : ""
+          )
+        ),
+        kubeletDirPath: this.kubeletDirPath,
+      },
+      { ...emptyOpts, providers: [this.provider] }
+    );
+
+    this.registerOutputs();
+  }
+
+  private createServers(
+    nodes: pulumi.Input<pulumi.Input<Nodes>[]>,
+    image: pulumi.Input<string>,
+    sshKey: pulumi.Input<hcloud.SshKey>,
+    sshPrivateKey: pulumi.Input<string>,
+    subnet: hcloud.NetworkSubnet,
+    placementGroup: hcloud.PlacementGroup,
+    modules?: pulumi.Input<pulumi.Input<string>[]>,
+    packages?: pulumi.Input<pulumi.Input<string>[]>,
+    files?: pulumi.Input<pulumi.Input<fcos.FilesArgs>[]>,
+    systemdUnits?: pulumi.Input<pulumi.Input<fcos.SystemdUnitArgs>[]>,
+    sshAuthorizedKeys?: pulumi.Input<pulumi.Input<string>[]>,
+    protect?: boolean
+  ): pulumi.Output<{ node: pulumi.Output<Node>; depends?: pulumi.Output<pulumi.Resource> }[]> {
+    const emptyOpts = this.opts();
+    const hcloudOpts = this.opts(hcloud.Provider);
+
+    return pulumi.all([nodes]).apply(([nodes]) => {
+      const results: { node: pulumi.Output<Node>; depends?: pulumi.Output<pulumi.Resource> }[] = [];
+
+      for (const nodeGroup of nodes) {
+        let nodesCount = nodeGroup.count;
+        if (nodesCount === undefined) {
+          nodesCount = 1;
+        }
+
+        for (let i = 0; i < nodesCount; i++) {
+          const nodeId = new random.RandomId(`${nodeGroup.id}-${i}`, { byteLength: 3 }, emptyOpts).hex;
+          const hostname = pulumi.interpolate`${this.name}-${k0s.Cluster.rolesHostname(nodeGroup.roles)}-${nodeId}`;
+
+          const server = pulumi
+            .all([this.name, hostname, nodeGroup.roles, sshKey, nodeId, placementGroup.id])
+            .apply(([name, hostname, roles, sshKey, nodeId, placementGroupId]) => {
+              const role = k0s.Cluster.rolesHostname(roles);
+
+              return new hcloud.Server(
+                hostname,
+                {
+                  name: hostname,
+                  location: this.location,
+                  serverType: nodeGroup.serverType,
+                  image,
+                  rescue: "linux64",
+                  sshKeys: [sshKey.id],
+                  keepDisk: true,
+                  labels: { cluster: name, role, nodeId },
+                  placementGroupId: parseInt(placementGroupId),
+                },
+                { ...hcloudOpts, ignoreChanges: ["sshKeys"], protect }
+              );
+            });
+
+          const serverNetwork = pulumi.all([server.id, server.name]).apply(([serverId, serverName]) => {
+            return new hcloud.ServerNetwork(
+              serverName,
+              { serverId: parseInt(serverId), subnetId: subnet.id },
+              hcloudOpts
+            );
+          });
+
+          const node = pulumi
+            .all([hostname, modules, packages, files, systemdUnits, sshAuthorizedKeys, server.ipv6Address])
+            .apply(([hostname, modules, packages, files, systemdUnits, sshAuthorizedKeys, ipv6Address]) => {
+              const fcosHost = new fcos.Host(
+                hostname,
+                {
+                  hostname,
+                  files: pulumi.all(files || []).apply((files) => {
+                    files.push({
+                      path: `/etc/NetworkManager/system-connections/${Cluster.primaryInterface}.nmconnection`,
+                      contents: [
+                        "[connection]",
+                        "type=ethernet",
+                        `id=${Cluster.primaryInterface}`,
+                        `interface-name=${Cluster.primaryInterface}`,
+                        "[ipv4]",
+                        "method=auto",
+                        "ignore-auto-dns=true",
+                        "[ipv6]",
+                        "method=manual",
+                        `address1=${ipv6Address}`,
+                        "gateway=fe80::1",
+                        "dns=2a01:4ff:ff00::add:1;2a01:4ff:ff00::add:2",
+                      ].join("\n"),
+                      mode: 0o600,
+                    });
+
+                    for (const iface of Cluster.privateInterfaces) {
+                      files.push({
+                        path: `/etc/NetworkManager/system-connections/${iface}.nmconnection`,
+                        contents: [
+                          "[connection]",
+                          "type=ethernet",
+                          `id=${iface}`,
+                          `interface-name=${iface}`,
+                          "[ipv4]",
+                          "method=auto",
+                          "never-default=true",
+                          "[ipv6]",
+                          "method=auto",
+                          "never-default=true",
+                        ].join("\n"),
+                        mode: 0o600,
+                      });
+                    }
+
+                    return files;
+                  }),
+                  systemdUnits,
+                  packages,
+                  modules,
+                  users: [{ name: "core", sshAuthorizedKeys }],
+                  sshUsers: [{ name: Cluster.sshUsername, groups: ["sudo"] }],
+                },
+                emptyOpts
+              );
+
+              const roles: string[] = nodeGroup.roles || [];
+
+              let isController = false;
+              for (const role of roles) {
+                if (role === "controller") {
+                  isController = true;
+                  break;
+                }
+              }
+
+              if (isController) {
+                roles.push("etcd");
+              }
+
+              return {
+                id: server.id,
+                hostname,
+                roles,
+                ipv4Address: server.ipv4Address,
+                privateIpv4Address: serverNetwork.ip,
+                ipv6Address: server.ipv6Address,
+                labels: nodeGroup.labels ?? {},
+                taints: nodeGroup.taints ?? [],
+                username: Cluster.sshUsername,
+                privateKey: fcosHost.sshPrivateKeys.apply((sshPrivateKeys) => {
+                  for (const username in sshPrivateKeys) {
+                    if (username === Cluster.sshUsername) {
+                      // eslint-disable-next-line security/detect-object-injection
+                      return sshPrivateKeys[username].privateKeyOpenssh;
+                    }
+                  }
+
+                  throw new Error(`No private key found for user ${Cluster.sshUsername}`);
+                }),
+                fcosHost,
+              };
+            });
+
+          results.push({
+            node,
+            depends: this.configureFcosNode(sshPrivateKey, server, node),
+          });
+        }
+      }
+
+      return results;
+    });
+  }
+
+  private configureFcosNode(
+    sshPrivateKey: pulumi.Input<string>,
+    server: pulumi.Output<hcloud.Server>,
+    node: pulumi.Input<Node>
+  ): pulumi.Output<pulumi.Resource> {
+    const emptyOpts = this.opts();
+
+    return pulumi.all([server.name, server.ipv4Address, node]).apply(([nodeName, ipv4Address, node]) => {
+      const connection: ssh.ConnectionArgs = {
+        host: ipv4Address,
+        username: Cluster.rescueSshUsername,
+        privateKey: sshPrivateKey,
+        initialDelay: 10000,
+        retries: 20,
+      };
+
+      const fcosInstallScriptPathRemote = "/tmp/fcos-install.sh";
+      const fcosConfigPathRemote = "/tmp/fcos-config.ign";
+
+      const fcosInstallScript = new ssh.File(
+        `${nodeName}-fcos-install-script`,
+        {
+          connection,
+          changeToken: "",
+          src: { file: path.join(__dirname, "assets", "fcos-install.sh") },
+          dst: fcosInstallScriptPathRemote,
+        },
+        { ...emptyOpts, dependsOn: server, ignoreChanges: ["connection", "src"] }
+      );
+
+      const fcosConfigFile = new ssh.File(
+        `${nodeName}-fcos-config`,
+        {
+          connection,
+          changeToken: "",
+          src: { data: node.fcosHost.ignitionConfig },
+          dst: fcosConfigPathRemote,
+        },
+        { ...emptyOpts, dependsOn: server, ignoreChanges: ["connection", "src"] }
+      );
+
+      const fcosInstall = new ssh.Exec(
+        `${nodeName}-fcos-install`,
+        {
+          connection,
+          changeToken: "",
+          command: [
+            `chmod +x ${fcosInstallScriptPathRemote}`,
+            `${fcosInstallScriptPathRemote} /dev/sda ${fcosConfigPathRemote}`,
+          ].join(" && "),
+        },
+        { ...emptyOpts, dependsOn: [fcosInstallScript, fcosConfigFile], ignoreChanges: ["connection"] }
+      );
+
+      return new ssh.Exec(
+        `${nodeName}-fcos-up`,
+        {
+          connection: {
+            host: ipv4Address,
+            username: Cluster.sshUsername,
+            privateKey: node.privateKey,
+            initialDelay: 30000,
+            retries: 20,
+          },
+          changeToken: "",
+          command: "ls /",
+        },
+        { ...emptyOpts, dependsOn: [fcosInstall], ignoreChanges: ["connection"] }
+      );
+    });
+  }
+}

package/lib/hcloud/{index.d.ts → index.ts}

@@ -1,5 +1,5 @@
 import { ClusterArgs, Cluster } from "./cluster";
 import { KubernetesArgs, Kubernetes } from "./kubernetes";
 import { WireguardArgs, Wireguard } from "./wireguard";
+
 export { ClusterArgs, Cluster, KubernetesArgs, Kubernetes, WireguardArgs, Wireguard };
-//# sourceMappingURL=index.d.ts.map