@ydkn/pulumi-components 0.4.2 → 0.4.3

package/lib/hcloud/kubernetes.ts

@@ -0,0 +1,249 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { request } from "urllib";
+import { ComponentResource } from "../common";
+import { transformations } from "../kubernetes";
+import { ServiceMonitor } from "../prometheus";
+
+/**
+ * Arguments for hcloud Kubernetes resource
+ */
+export interface KubernetesArgs {
+  /**
+   * Hetzner cloud token
+   */
+  token: pulumi.Input<string>;
+  /**
+   * Optional: Name of the network
+   */
+  network?: pulumi.Input<string>;
+  /**
+   * Optional: CIDR of the pods
+   */
+  podCIDR?: pulumi.Input<string>;
+  /**
+   * Optional: Kubelet directory path
+   */
+  kubeletDirPath?: pulumi.Input<string>;
+}
+
+export class Kubernetes extends ComponentResource {
+  private readonly secret: k8s.core.v1.Secret;
+  private readonly cloudControllerManager: pulumi.Output<k8s.yaml.ConfigFile>;
+  private readonly csiDriver: pulumi.Output<k8s.yaml.ConfigFile>;
+  private readonly csiMetrics: ServiceMonitor;
+
+  /**
+   * Create a new Hetzner cloud kubernetes resource.
+   * @param name The name of Hetzner cloud kubernetes resource.
+   * @param args A bag of arguments to control the Hetzner cloud kubernetes creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: KubernetesArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("hcloud:kubernetes", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    this.secret = new k8s.core.v1.Secret(
+      `${name}-hcloud-secret`,
+      {
+        metadata: { namespace: "kube-system", name: "hcloud" },
+        stringData: {
+          token: args.token,
+          network: args.network ? args.network : "",
+        },
+      },
+      opts
+    );
+
+    this.cloudControllerManager = pulumi.all([args.network, args.podCIDR]).apply(([network, podCIDR]) => {
+      const transformations = [
+        (o: any) => {
+          if (o.kind === "Deployment" && o.metadata.name === "hcloud-cloud-controller-manager") {
+            for (const c of o.spec.template.spec.containers) {
+              c.command = c.command.filter((c: string) => {
+                return (
+                  !c.match(/--secure-port=/i) &&
+                  !c.match(/--cluster-cidr=/i) &&
+                  !c.match(/--allocate-node-cidrs=/i) &&
+                  !c.match(/--configure-cloud-routes=/i)
+                );
+              });
+
+              c.command.push(`--secure-port=11258`);
+              c.command.push(`--cluster-cidr=${podCIDR}`);
+              c.command.push(`--allocate-node-cidrs=true`);
+              c.command.push(`--configure-cloud-routes=${network !== undefined ? "false" : "false"}`); // TODO enable
+
+              c.env = c.env.filter((e: { name: string }) => {
+                return e.name !== "HCLOUD_INSTANCES_ADDRESS_FAMILY";
+              });
+
+              c.env.push({ name: "HCLOUD_INSTANCES_ADDRESS_FAMILY", value: "dualstack" });
+            }
+          }
+        },
+      ];
+
+      if (network !== undefined) {
+        return this.githubAssetURL("hetznercloud/hcloud-cloud-controller-manager", "ccm-networks.yaml").apply((url) => {
+          return new k8s.yaml.ConfigFile(
+            `${name}-hcloud-cloud-controller-manager`,
+            { file: url, transformations },
+            { ...opts, dependsOn: [this.secret] }
+          );
+        });
+      } else {
+        return this.githubAssetURL("hetznercloud/hcloud-cloud-controller-manager", "ccm.yaml").apply((url) => {
+          return new k8s.yaml.ConfigFile(
+            `${name}-hcloud-cloud-controller-manager`,
+            { file: url, transformations },
+            { ...opts, dependsOn: [this.secret] }
+          );
+        });
+      }
+    });
+
+    this.csiDriver = pulumi
+      .all([this.githubRepoURL("hetznercloud/csi-driver", "deploy/kubernetes/hcloud-csi.yml"), args.kubeletDirPath])
+      .apply(([url, kubeletDirPath]) => {
+        return new k8s.yaml.ConfigFile(
+          `${name}-hcloud-csi`,
+          {
+            file: url,
+            transformations: [
+              transformations.v1beta1Deprecations,
+              (o: any) => {
+                if (o.kind === "StatefulSet" || o.kind === "DaemonSet") {
+                  for (const c of o.spec.template.spec.containers) {
+                    if (c.env !== undefined) {
+                      for (const env of c.env) {
+                        if (
+                          env.name === "HCLOUD_TOKEN" &&
+                          env.valueFrom !== undefined &&
+                          env.valueFrom.secretKeyRef !== undefined
+                        ) {
+                          env.valueFrom.secretKeyRef.name = this.secret.metadata.name;
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              (o: any) => {
+                if (o.kind === "StatefulSet" && o.metadata.name === "hcloud-csi-controller") {
+                  o.spec.template.spec.tolerations = [
+                    { key: "CriticalAddonsOnly", operator: "Exists" },
+                    { key: "node-role.kubernetes.io/master", operator: "Exists", effect: "NoSchedule" },
+                    { key: "node-role.kubernetes.io/control-plane", operator: "Exists", effect: "NoSchedule" },
+                  ];
+                }
+              },
+              (o: any) => {
+                if (o.kind === "DaemonSet" && o.metadata.name === "hcloud-csi-node") {
+                  if (kubeletDirPath !== undefined) {
+                    for (const v of o.spec.template.spec.volumes) {
+                      if (v.hostPath !== undefined) {
+                        if (v.hostPath.path.startsWith("/var/lib/kubelet")) {
+                          v.hostPath.path = v.hostPath.path.replace("/var/lib/kubelet", kubeletDirPath);
+                        }
+                      }
+                    }
+
+                    for (const c of o.spec.template.spec.containers) {
+                      for (const v of c.volumeMounts) {
+                        if (v.mountPath !== undefined) {
+                          if (v.mountPath.startsWith("/var/lib/kubelet")) {
+                            v.mountPath = v.mountPath.replace("/var/lib/kubelet", kubeletDirPath);
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+            ],
+          },
+          opts
+        );
+      });
+
+    this.csiMetrics = new ServiceMonitor(
+      `${name}-hcloud-csi`,
+      {
+        metadata: {
+          name: "hcloud-csi",
+          namespace: "kube-system",
+          labels: { app: "hcloud-csi" },
+        },
+        spec: {
+          selector: { matchLabels: { app: "hcloud-csi" } },
+          endpoints: [
+            {
+              port: "metrics",
+              honorLabels: true,
+              metricRelabelings: [
+                {
+                  action: "drop",
+                  sourceLabels: ["__name__"],
+                  regex: ["go_.*", "grpc_server_.*"].join("|"),
+                },
+              ],
+            },
+          ],
+        },
+      },
+      { ...opts, dependsOn: [this.csiDriver] }
+    );
+
+    this.registerOutputs();
+  }
+
+  private githubAssetURL(repo: string, filename: string, version?: string): pulumi.Output<string | undefined> {
+    if (version === undefined) {
+      version = "latest";
+    }
+
+    const promise = new Promise<string | undefined>((resolve, reject) => {
+      request(`https://api.github.com/repos/${repo}/releases/${version}`, { dataType: "json", gzip: true })
+        .then((body) => {
+          if (body.statusCode !== 200) {
+            return reject(new Error(`failed to fetch releases for repo: ${repo}`));
+          }
+
+          resolve(`https://github.com/${repo}/releases/download/${body.data.tag_name as string}/${filename}`);
+        })
+        .catch(() => {
+          return reject(new Error(`failed to fetch asset URL for repo: ${repo}`));
+        });
+    });
+
+    return pulumi.all([promise]).apply(([promise]) => {
+      return promise;
+    });
+  }
+
+  private githubRepoURL(repo: string, filename: string, version?: string): pulumi.Output<string | undefined> {
+    if (version === undefined) {
+      version = "latest";
+    }
+
+    const promise = new Promise<string | undefined>((resolve, reject) => {
+      request(`https://api.github.com/repos/${repo}/releases/${version}`, { dataType: "json", gzip: true })
+        .then((body) => {
+          if (body.statusCode !== 200) {
+            return reject(new Error(`failed to fetch releases for repo: ${repo}`));
+          }
+
+          resolve(`https://raw.githubusercontent.com/${repo}/${body.data.tag_name as string}/${filename}`);
+        })
+        .catch(() => {
+          return reject(new Error(`failed to get repo url for repo: ${repo}`));
+        });
+    });
+
+    return pulumi.all([promise]).apply(([promise]) => {
+      return promise;
+    });
+  }
+}

package/lib/hcloud/wireguard.ts

@@ -0,0 +1,164 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as hcloud from "@pulumi/hcloud";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+import * as wireguard from "../wireguard";
+import { Node } from "../node";
+import { DnsEndpoint, DnsEndpointsArgs } from "../externalDns";
+
+export interface WireguardArgs extends wireguard.WireguardArgs {
+  /**
+   * Nodes
+   */
+  nodes: pulumi.Input<pulumi.Input<Node>[]>;
+  /**
+   * NetworkId
+   */
+  networkId: pulumi.Input<number>;
+  /**
+   * Optional: Hostnames
+   */
+  hostnames?: pulumi.Input<pulumi.Input<string>[]>;
+}
+
+export class Wireguard extends ComponentResource {
+  private readonly wireguard: wireguard.Wireguard;
+  private readonly firewall: hcloud.Firewall;
+  private readonly networkRoutes: pulumi.Output<hcloud.NetworkRoute[]>;
+  private readonly dnsEndpoint?: DnsEndpoint;
+
+  /**
+   * Create a new wireguard resource.
+   * @param name The name of the wireguard resource.
+   * @param args A bag of arguments to control the wireguard deployment.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: WireguardArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("hcloud:wireguard", name, args, opts);
+
+    const hcloudOpts = this.opts(hcloud.Provider);
+    const k8sOpts = this.opts(k8s.Provider);
+
+    this.wireguard = new wireguard.Wireguard(name, args, { ...opts, parent: this });
+
+    const gatewayNodes = Wireguard.gatewayNodes(args.nodes);
+
+    this.firewall = new hcloud.Firewall(
+      name,
+      {
+        name,
+        applyTos: gatewayNodes.apply((nodes) =>
+          pulumi.all(nodes).apply((nodes) =>
+            nodes.map((node) => {
+              return { server: parseInt(node.id as string) };
+            })
+          )
+        ),
+        rules: [
+          {
+            description: "UDP",
+            direction: "in",
+            protocol: "udp",
+            port: pulumi.interpolate`${this.wireguard.interfacePort}`,
+            sourceIps: ["0.0.0.0/0", "::/0"],
+          },
+        ],
+      },
+      hcloudOpts
+    );
+
+    this.networkRoutes = pulumi.all([gatewayNodes, args.peers]).apply(([gatewayNodes, peers]) =>
+      pulumi.all(gatewayNodes ?? []).apply((gatewayNodes) => {
+        const gatewayIPs = gatewayNodes.map((node) => node.privateIpv4Address as string);
+
+        if (gatewayIPs.length === 0) {
+          return pulumi.output([] as hcloud.NetworkRoute[]);
+        }
+
+        return pulumi.all(peers ?? []).apply((peers) => {
+          const peerIPRanges: string[] = [];
+
+          for (const peer of peers) {
+            for (const ip of peer.allowedIPs) {
+              if (ip.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}$/)) {
+                peerIPRanges.push(ip);
+              }
+            }
+          }
+
+          return peerIPRanges.map(
+            (peerIPRange) =>
+              new hcloud.NetworkRoute(
+                `${name}-${peerIPRange}`,
+                { networkId: args.networkId, destination: peerIPRange, gateway: gatewayIPs[0] },
+                hcloudOpts
+              )
+          );
+        });
+      })
+    );
+
+    if (args.hostnames !== undefined) {
+      this.dnsEndpoint = new DnsEndpoint(
+        name,
+        {
+          metadata: { namespace: this.wireguard.namespace, name },
+          spec: {
+            endpoints: pulumi.all([args.hostnames, gatewayNodes]).apply(([hostnames, gatewayNodes]) =>
+              pulumi.all(hostnames).apply((hostnames) =>
+                pulumi.all(gatewayNodes).apply((nodes) => {
+                  const ipv4Endpoints: string[] = [];
+                  const ipv6Endpoints: string[] = [];
+
+                  for (const node of nodes) {
+                    if (node.ipv4Address !== undefined) {
+                      ipv4Endpoints.push(node.ipv4Address);
+                    }
+
+                    if (node.ipv6Address !== undefined) {
+                      ipv6Endpoints.push(node.ipv6Address);
+                    }
+                  }
+
+                  const endpoints: DnsEndpointsArgs[] = [];
+
+                  for (const dnsName of hostnames) {
+                    if (ipv4Endpoints.length > 0) {
+                      endpoints.push({ dnsName, recordType: "A", targets: ipv4Endpoints });
+                    }
+
+                    if (ipv6Endpoints.length > 0) {
+                      endpoints.push({ dnsName, recordType: "AAAA", targets: ipv6Endpoints });
+                    }
+                  }
+
+                  return endpoints;
+                })
+              )
+            ),
+          },
+        },
+        k8sOpts
+      );
+    }
+
+    this.registerOutputs();
+  }
+
+  private static gatewayNodes(nodes: pulumi.Input<pulumi.Input<Node>[]>): pulumi.Output<pulumi.Output<Node>[]> {
+    return pulumi.all([nodes]).apply(([nodes]) =>
+      pulumi.all(nodes ?? []).apply((nodes) => {
+        return nodes
+          .filter(
+            (node) =>
+              node.id !== undefined &&
+              node.labels !== undefined &&
+              node.labels[wireguard.Wireguard.gatewayLabel] !== undefined &&
+              node.labels[wireguard.Wireguard.gatewayLabel] === wireguard.Wireguard.gatewayLabelValue &&
+              node.privateIpv4Address !== undefined
+          )
+          .map((node) => pulumi.output(node));
+      })
+    );
+  }
+}

package/lib/k0s/cluster.ts

@@ -0,0 +1,264 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as k0s from "@ydkn/pulumi-k0s";
+import * as os from "os";
+import * as fs from "fs";
+import * as path from "path";
+import * as crypto from "crypto";
+import * as yaml from "js-yaml";
+import { ComponentResource } from "../common";
+import { Node } from "../node";
+
+export interface ClusterArgs {
+  /**
+   * Optional: Name
+   */
+  name?: pulumi.Input<string>;
+  /**
+   * Nodes
+   */
+  nodes: pulumi.Input<pulumi.Input<Node>[]>;
+  /**
+   * Optional: k0s config
+   */
+  k0s?: pulumi.Input<k0s.types.input.K0sArgs>;
+  /**
+   * Optional: k0s host hooks
+   */
+  hooks?: pulumi.Input<k0s.types.input.HooksArgs>;
+  /**
+   * Optional: Cloud provider
+   */
+  cloudProvider?: pulumi.Input<boolean>;
+  /**
+   * Optional: Protect critical resources
+   */
+  protect?: boolean;
+}
+
+export class Cluster extends ComponentResource {
+  private readonly clusterProvider: k0s.Provider;
+  private readonly cluster: k0s.Cluster;
+  public readonly name: pulumi.Output<string>;
+  public readonly nodes: pulumi.Output<pulumi.Output<Node>[]>;
+  public readonly spec: pulumi.Output<k0s.types.output.Spec>;
+  public readonly kubeconfig: pulumi.Output<string>;
+  public readonly kubeletDirPath: pulumi.Output<string>;
+
+  /**
+   * Create a new cluster resource.
+   * @param name The name of the cluster resource.
+   * @param args A bag of arguments to control the cluster creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: ClusterArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("k0s:cluster", name, args, opts);
+
+    const emptyOpts = this.opts();
+
+    if (args.name === undefined) {
+      this.name = new random.RandomId(name, { byteLength: 3 }, { ...emptyOpts, protect: args.protect }).hex;
+    } else {
+      this.name = pulumi.output(args.name);
+    }
+
+    this.nodes = pulumi.all([args.nodes]).apply(([nodes]) => {
+      const outputNodes: pulumi.Output<Node>[] = [];
+
+      for (const node of nodes) {
+        outputNodes.push(pulumi.output(node));
+      }
+
+      return outputNodes;
+    });
+
+    this.clusterProvider = new k0s.Provider(name, { noDrain: true }, emptyOpts);
+
+    this.cluster = new k0s.Cluster(
+      name,
+      {
+        metadata: { name: this.name },
+        spec: pulumi
+          .all([this.nodes, args.k0s, args.hooks, args.cloudProvider])
+          .apply(([nodes, k0s, hooks, cloudProvider]) => {
+            return {
+              hosts: nodes.map((node) => {
+                let keyPath = "";
+
+                if (node.privateKey !== undefined) {
+                  const keyHash = crypto.createHash("sha1").update(node.privateKey, "utf8").digest("hex");
+
+                  keyPath = path.join(os.tmpdir(), `pulumi-components-k0s-${node.hostname}-${keyHash}.pem`);
+
+                  // eslint-disable-next-line security/detect-non-literal-fs-filename
+                  fs.writeFileSync(keyPath, node.privateKey);
+                  // eslint-disable-next-line security/detect-non-literal-fs-filename
+                  fs.chmodSync(keyPath, 0o600);
+                }
+
+                const installFlags: string[] = [];
+
+                let isController = false;
+                let isWorker = false;
+                for (const role of node.roles || []) {
+                  if (role === "controller") {
+                    isController = true;
+                  } else if (role === "worker") {
+                    isWorker = true;
+                  }
+                }
+
+                if (!cloudProvider && isController) {
+                  installFlags.push("--enable-k0s-cloud-provider=true");
+                }
+
+                if (isWorker) {
+                  installFlags.push("--enable-cloud-provider=true");
+                }
+
+                if (node.labels === undefined) {
+                  node.labels = {};
+                }
+
+                node.labels["node.kubernetes.io/role"] = isController ? "control-plane" : "worker";
+
+                const labels: string[] = [];
+
+                for (const key in node.labels) {
+                  // eslint-disable-next-line security/detect-object-injection
+                  labels.push(`${key}=${node.labels[key]}`);
+                }
+
+                if (labels.length > 0) {
+                  installFlags.push(`--labels=${labels.join(",")}`);
+                }
+
+                let noTaints = false;
+
+                if (node.taints !== undefined) {
+                  const taints: string[] = [];
+
+                  for (const taint of node.taints) {
+                    taints.push(`${taint.key}=${taint.value}:${taint.effect}`);
+                  }
+
+                  if (taints.length > 0) {
+                    installFlags.push(`--taints=${taints.join(",")}`);
+                  } else {
+                    noTaints = true;
+                  }
+                }
+
+                return Cluster.k0sNode(node, installFlags, keyPath, hooks, noTaints);
+              }),
+              k0s,
+            };
+          }),
+      },
+      { ...emptyOpts, provider: this.clusterProvider }
+    );
+
+    this.spec = this.cluster.spec;
+    this.kubeconfig = pulumi.secret(
+      Cluster.transformKubeconfig(
+        this.cluster.kubeconfig,
+        this.cluster.spec.apply((spec) => spec.k0s?.config?.spec?.api?.sans)
+      )
+    );
+
+    this.kubeletDirPath = pulumi.output("/var/lib/k0s/kubelet");
+
+    this.registerOutputs();
+  }
+
+  public static k0sRole(roles?: pulumi.Input<pulumi.Input<string>[]>): pulumi.Output<string> {
+    return pulumi.all([roles]).apply(([roles]) => {
+      let role = "worker";
+      let foundControllerRole = false;
+      let foundWorkerRole = false;
+
+      for (const r of roles || []) {
+        if (r === "controller") {
+          foundControllerRole = true;
+          role = "controller";
+        } else if (r === "worker") {
+          foundWorkerRole = true;
+          role = "worker";
+        }
+
+        if (foundControllerRole && foundWorkerRole) {
+          role = "controller+worker";
+          break;
+        }
+      }
+
+      return role;
+    });
+  }
+
+  public static k0sNode(
+    node: Node,
+    installFlags: string[],
+    keyPath: string,
+    hooks?: pulumi.UnwrappedObject<k0s.types.input.HooksArgs>,
+    noTaints?: boolean
+  ): k0s.types.input.HostArgs {
+    return {
+      hostname: node.hostname,
+      privateAddress: node.privateIpv4Address,
+      role: Cluster.k0sRole(node.roles),
+      ssh: { address: node.ipv4Address as string, user: node.username, port: 22, keyPath },
+      installFlags,
+      hooks: {
+        apply: {
+          before: (hooks?.apply?.before ?? []).concat(
+            "sudo sh -c 'if [ ! -L /var/lib/kubelet ]; then ln -s /var/lib/k0s/kubelet /var/lib/kubelet; fi'"
+          ),
+          after: hooks?.apply?.after ?? [],
+        },
+        reset: {
+          before: hooks?.reset?.before ?? [],
+          after: (hooks?.reset?.after ?? []).concat(
+            "sudo sh -c 'if [ -L /var/lib/kubelet ]; then rm -rf /var/lib/kubelet; fi'"
+          ),
+        },
+        backup: {
+          before: hooks?.backup?.before ?? [],
+          after: hooks?.backup?.after ?? [],
+        },
+      },
+      noTaints,
+    };
+  }
+
+  public static rolesHostname(roles?: pulumi.Input<pulumi.Input<string>[]>): pulumi.Output<string> {
+    const role = this.k0sRole(roles);
+
+    return role.apply((role) => {
+      if (role !== undefined && (role === "controller" || role === "controller+worker")) {
+        return "controller";
+      }
+
+      return "worker";
+    });
+  }
+
+  private static transformKubeconfig(
+    kubeconfig: pulumi.Input<string>,
+    sans?: pulumi.Input<pulumi.Input<string>[] | undefined>
+  ): pulumi.Output<string> {
+    return pulumi.all([kubeconfig, sans]).apply(([kubeconfig, sans]) => {
+      const transformedKubeconfig = yaml.load(kubeconfig, { schema: yaml.FAILSAFE_SCHEMA }) as any;
+
+      if (sans !== undefined && sans.length > 0) {
+        if (transformedKubeconfig !== undefined && transformedKubeconfig.clusters.length > 0) {
+          if (transformedKubeconfig.clusters[0].cluster !== undefined) {
+            transformedKubeconfig.clusters[0].cluster.server = `https://${sans[0]}:6443`;
+          }
+        }
+      }
+
+      return yaml.dump(transformedKubeconfig);
+    });
+  }
+}

package/lib/k0s/{index.d.ts → index.ts}

@@ -1,3 +1,3 @@
 import { ClusterArgs, Cluster } from "./cluster";
+
 export { ClusterArgs, Cluster };
-//# sourceMappingURL=index.d.ts.map