@ydkn/pulumi-components 0.4.2 → 0.4.3

package/lib/openldap/deployment.ts

@@ -0,0 +1,226 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+import * as kubernetes from "../kubernetes";
+import * as certManager from "../certManager";
+
+export interface OpenLdapServerArgs {
+  namespace?: pulumi.Input<string>;
+  rootDN: pulumi.Input<string>;
+  hostname: pulumi.Input<string>;
+  storage?: pulumi.Input<string>;
+  resources?: pulumi.Input<k8s.types.input.core.v1.ResourceRequirements>;
+  clusterIssuer: pulumi.Input<string>;
+  protect?: boolean;
+}
+
+export class OpenLdapServer extends ComponentResource {
+  private readonly dataVolumeClaim: k8s.core.v1.PersistentVolumeClaim;
+  private readonly adminSecret: k8s.core.v1.Secret;
+  private readonly certificate: certManager.Certificate;
+  private readonly deployment: k8s.apps.v1.Deployment;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  private readonly service: kubernetes.v1.Service;
+  public readonly namespace: pulumi.Output<string>;
+  public readonly adminCN: pulumi.Output<string>;
+  public readonly adminPassword: pulumi.Output<string>;
+  public readonly hostname: pulumi.Output<string>;
+  public readonly rootDN: pulumi.Output<string>;
+
+  /**
+   * Create a new OpenLDAP server resource.
+   * @param name The name of the OpenLDAP server resource.
+   * @param args A bag of arguments to control the OpenLDAP server creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: OpenLdapServerArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("openldap", name, args, opts);
+
+    if (args.storage === undefined) {
+      args.storage = "10Gi";
+    }
+
+    if (args.resources === undefined) {
+      args.resources = { requests: { memory: "32Mi" }, limits: { memory: "48Mi" } };
+    }
+
+    const emptyOpts = this.opts();
+    const k8sOpts = this.opts(k8s.Provider);
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "openldap",
+        "app.kubernetes.io/component": "openldap",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    const dataVolumeClaimName = pulumi.interpolate`${name}-data`;
+
+    this.dataVolumeClaim = new k8s.core.v1.PersistentVolumeClaim(
+      `${name}-data`,
+      {
+        metadata: { ...metadata, name: dataVolumeClaimName },
+        spec: {
+          accessModes: ["ReadWriteOnce"],
+          resources: { requests: { storage: args.storage } },
+        },
+      },
+      { ...k8sOpts, protect: args.protect }
+    );
+
+    this.adminCN = pulumi.secret(pulumi.interpolate`cn=admin,${args.rootDN}`);
+
+    this.adminPassword = pulumi.secret(
+      new random.RandomPassword(`${name}-admin-password`, { length: 64, special: false }, emptyOpts).result
+    );
+
+    this.adminSecret = new k8s.core.v1.Secret(
+      `${name}-admin`,
+      {
+        metadata,
+        stringData: {
+          username: "admin",
+          password: this.adminPassword,
+        },
+      },
+      k8sOpts
+    );
+
+    this.certificate = new certManager.Certificate(
+      name,
+      {
+        metadata,
+        spec: {
+          dnsNames: [args.hostname],
+          privateKey: { rotationPolicy: "Always" },
+          issuerRef: { kind: "ClusterIssuer", name: args.clusterIssuer },
+        },
+      },
+      k8sOpts
+    );
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: {
+              labels: metadata.labels,
+              annotations: { "backup.velero.io/backup-volumes": "data" },
+            },
+            spec: {
+              initContainers: [
+                {
+                  name: "fix-permissions",
+                  image: "busybox:latest",
+                  command: ["/bin/chown", "-R", "1001", "/bitnami/openldap"],
+                  resources: {
+                    requests: { memory: "16Mi" },
+                    limits: { memory: "24Mi" },
+                  },
+                  volumeMounts: [{ name: "data", mountPath: "/bitnami/openldap" }],
+                },
+              ],
+              containers: [
+                {
+                  name: "openldap",
+                  image: "docker.io/bitnami/openldap:latest",
+                  imagePullPolicy: "Always",
+                  env: [
+                    {
+                      name: "LDAP_ADMIN_USERNAME",
+                      valueFrom: { secretKeyRef: { name: this.adminSecret.metadata.name, key: "username" } },
+                    },
+                    {
+                      name: "LDAP_ADMIN_PASSWORD",
+                      valueFrom: { secretKeyRef: { name: this.adminSecret.metadata.name, key: "password" } },
+                    },
+                    { name: "LDAP_ROOT", value: args.rootDN },
+                    { name: "LDAP_ENABLE_TLS", value: "yes" },
+                    { name: "LDAP_TLS_CERT_FILE", value: "/tls/tls.crt" },
+                    { name: "LDAP_TLS_KEY_FILE", value: "/tls/tls.key" },
+                    { name: "LDAP_TLS_CA_FILE", value: "/tls/tls.crt" },
+                    { name: "LDAP_ALLOW_ANON_BINDING", value: "no" },
+                  ],
+                  ports: [
+                    { name: "ldap", containerPort: 1389 },
+                    { name: "ldaps", containerPort: 1636 },
+                  ],
+                  livenessProbe: {
+                    periodSeconds: 10,
+                    timeoutSeconds: 10,
+                    successThreshold: 1,
+                    failureThreshold: 3,
+                    tcpSocket: { port: "ldap" },
+                  },
+                  readinessProbe: {
+                    periodSeconds: 10,
+                    timeoutSeconds: 10,
+                    successThreshold: 1,
+                    failureThreshold: 3,
+                    tcpSocket: { port: "ldap" },
+                  },
+                  resources: args.resources,
+                  volumeMounts: [
+                    { name: "tls", mountPath: "/tls" },
+                    { name: "data", mountPath: "/bitnami/openldap" },
+                  ],
+                },
+              ],
+              volumes: [
+                { name: "tls", secret: { secretName: this.certificate.secretName } },
+                { name: "data", persistentVolumeClaim: { claimName: dataVolumeClaimName } },
+              ],
+            },
+          },
+        },
+      },
+      k8sOpts
+    );
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          minAvailable: 1,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      k8sOpts
+    );
+
+    this.service = new kubernetes.v1.Service(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: metadata.labels,
+          ports: [
+            { name: "ldap", port: 389, targetPort: "ldap" },
+            { name: "ldaps", port: 636, targetPort: "ldaps" },
+          ],
+        },
+        hostnames: [args.hostname],
+      },
+      { ...k8sOpts, dependsOn: [this.deployment] }
+    );
+
+    this.hostname = pulumi.output(args.hostname);
+    this.rootDN = pulumi.output(args.rootDN);
+
+    this.registerOutputs();
+  }
+}

package/lib/openldap/{index.d.ts → index.ts}

@@ -1,3 +1,3 @@
 import { OpenLdapServerArgs, OpenLdapServer } from "./deployment";
+
 export { OpenLdapServerArgs, OpenLdapServer };
-//# sourceMappingURL=index.d.ts.map

package/lib/plex/{index.d.ts → index.ts}

@@ -1,4 +1,4 @@
 import { MediaServerArgs, MediaServer } from "./mediaServer";
 import { PlaylistConfigArgs, PlaylistArgs, Playlist } from "./playlists";
+
 export { MediaServerArgs, MediaServer, PlaylistConfigArgs, PlaylistArgs, Playlist };
-//# sourceMappingURL=index.d.ts.map

package/lib/plex/mediaServer.ts

@@ -0,0 +1,265 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+import * as kubernetes from "../kubernetes";
+import * as certManager from "../certManager";
+import * as avahi from "../avahi";
+
+export interface MediaServerArgs {
+  namespace?: pulumi.Input<string>;
+  name: pulumi.Input<string>;
+  hostname: pulumi.Input<string>;
+  ingressClassName?: pulumi.Input<string>;
+  storageClassName?: pulumi.Input<string>;
+  storage?: pulumi.Input<string>;
+  resources?: pulumi.Input<k8s.types.input.core.v1.ResourceRequirements>;
+  uid: pulumi.Input<number>;
+  gid: pulumi.Input<number>;
+  volumes?: { [key: string]: pulumi.Input<string> };
+  clusterIssuer: pulumi.Input<string>;
+  avahiLabelName?: pulumi.Input<string>;
+  claimToken?: pulumi.Input<string>;
+  protect?: boolean;
+}
+
+export class MediaServer extends ComponentResource {
+  private readonly configVolumeClaim: k8s.core.v1.PersistentVolumeClaim;
+  private readonly certificatePassword: k8s.core.v1.Secret;
+  private readonly certificate: certManager.Certificate;
+  private readonly claimToken: k8s.core.v1.Secret;
+  private readonly deployment: k8s.apps.v1.Deployment;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  private readonly service: kubernetes.v1.Service;
+  private readonly avahiService?: avahi.AvahiService;
+  public readonly namespace: pulumi.Output<string>;
+  public readonly pkcs12Password: pulumi.Output<string>;
+  public readonly url: pulumi.Output<string>;
+
+  /**
+   * Create a new Plex media server resource.
+   * @param name The name of the Plex media server resource.
+   * @param args A bag of arguments to control the Plex media server creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: MediaServerArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("plex:media-server", name, args, opts);
+
+    if (args.storage === undefined) {
+      args.storage = "100Gi";
+    }
+
+    if (args.resources === undefined) {
+      args.resources = { requests: { memory: "512Mi" }, limits: { memory: "768Mi" } };
+    }
+
+    const emptyOpts = this.opts();
+    const k8sOpts = this.opts(k8s.Provider);
+
+    this.url = pulumi.interpolate`https://${args.hostname}`;
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "plex",
+        "app.kubernetes.io/component": "media-server",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.configVolumeClaim = new k8s.core.v1.PersistentVolumeClaim(
+      `${name}-config`,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-config` },
+        spec: {
+          storageClassName: args.storageClassName,
+          accessModes: ["ReadWriteOnce"],
+          resources: { requests: { storage: args.storage } },
+        },
+      },
+      { ...k8sOpts, protect: args.protect }
+    );
+
+    this.pkcs12Password = pulumi.secret(
+      new random.RandomPassword(`${name}-pkcs12-password`, { length: 64, special: false }, emptyOpts).result
+    );
+
+    this.certificatePassword = new k8s.core.v1.Secret(
+      `${name}-pkcs12-password`,
+      {
+        metadata: { ...metadata, name: `${name}-pkcs12-password` },
+        stringData: {
+          password: this.pkcs12Password,
+        },
+      },
+      k8sOpts
+    );
+
+    this.certificate = new certManager.Certificate(
+      name,
+      {
+        metadata,
+        spec: {
+          dnsNames: [args.hostname],
+          privateKey: { rotationPolicy: "Always" },
+          issuerRef: { name: args.clusterIssuer, kind: "ClusterIssuer" },
+          keystores: {
+            pkcs12: {
+              create: true,
+              passwordSecretRef: { name: this.certificatePassword.metadata.name, key: "password" },
+            },
+          },
+        },
+      },
+      k8sOpts
+    );
+
+    this.claimToken = new k8s.core.v1.Secret(
+      `${name}-claim-token`,
+      {
+        metadata: { ...metadata, name: `${name}-claim-token` },
+        stringData: {
+          claimToken: args.claimToken ?? "",
+        },
+      },
+      k8sOpts
+    );
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: {
+              labels: metadata.labels,
+              // annotations: { "backup.velero.io/backup-volumes": "backups" },
+            },
+            spec: {
+              containers: [
+                {
+                  name: "plex-media-server",
+                  image: "plexinc/pms-docker:latest",
+                  imagePullPolicy: "Always",
+                  env: [
+                    { name: "HOSTNAME", value: args.name },
+                    { name: "TZ", value: "Etc/UTC" },
+                    { name: "ADVERTISE_IP", value: this.url },
+                    { name: "PLEX_UID", value: pulumi.all([args.uid]).apply(([uid]) => `${uid}`) },
+                    { name: "PLEX_GID", value: pulumi.all([args.gid]).apply(([gid]) => `${gid}`) },
+                    {
+                      name: "PLEX_CLAIM",
+                      valueFrom: { secretKeyRef: { name: this.claimToken.metadata.name, key: "claimToken" } },
+                    },
+                  ],
+                  ports: [{ name: "plex", containerPort: 32400 }],
+                  livenessProbe: {
+                    periodSeconds: 30,
+                    timeoutSeconds: 10,
+                    successThreshold: 1,
+                    failureThreshold: 8,
+                    httpGet: { path: "/identity", port: "plex", scheme: "HTTPS" },
+                  },
+                  readinessProbe: {
+                    periodSeconds: 30,
+                    timeoutSeconds: 10,
+                    successThreshold: 1,
+                    failureThreshold: 3,
+                    httpGet: { path: "/identity", port: "plex", scheme: "HTTPS" },
+                  },
+                  resources: args.resources,
+                  volumeMounts: pulumi.all([args.volumes]).apply(([volumes]) => {
+                    volumes = volumes ?? {};
+
+                    const volumeMounts: k8s.types.input.core.v1.VolumeMount[] = [
+                      { name: "tls", mountPath: "/tls" },
+                      { name: "config", mountPath: "/config" },
+                      { name: "transcode", mountPath: "/transcode" },
+                      { name: "backups", mountPath: "/backups" },
+                    ];
+
+                    for (const volumeName in volumes) {
+                      volumeMounts.push({ name: volumeName, mountPath: `/mnt/${volumeName}` });
+                    }
+
+                    return volumeMounts;
+                  }),
+                },
+              ],
+              terminationGracePeriodSeconds: 120,
+              volumes: pulumi.all([args.volumes]).apply(([volumes]) => {
+                volumes = volumes ?? {};
+
+                const volumeSpecs: k8s.types.input.core.v1.Volume[] = [
+                  { name: "tls", secret: { secretName: this.certificate.secretName } },
+                  { name: "config", persistentVolumeClaim: { claimName: this.configVolumeClaim.metadata.name } },
+                  { name: "transcode", emptyDir: {} },
+                  { name: "backups", emptyDir: {} },
+                ];
+
+                for (const volumeName in volumes) {
+                  // eslint-disable-next-line security/detect-object-injection
+                  const claimName = volumes[volumeName];
+
+                  volumeSpecs.push({ name: volumeName, persistentVolumeClaim: { claimName } });
+                }
+
+                return volumeSpecs;
+              }),
+            },
+          },
+        },
+      },
+      k8sOpts
+    );
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          minAvailable: 1,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      k8sOpts
+    );
+
+    this.service = new kubernetes.v1.Service(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: metadata.labels,
+          type: "LoadBalancer",
+          ports: [{ name: "https", port: 443, targetPort: "plex" }],
+        },
+        hostnames: [args.hostname],
+      },
+      { ...k8sOpts, dependsOn: [this.deployment] }
+    );
+
+    if (args.avahiLabelName !== undefined) {
+      this.avahiService = new avahi.AvahiService(
+        name,
+        {
+          metadata,
+          labelName: args.avahiLabelName,
+          name,
+          services: [{ type: "_plexmediasvr._tcp", port: 443, hostname: args.hostname }],
+        },
+        k8sOpts
+      );
+    }
+
+    this.registerOutputs();
+  }
+}

package/lib/plex/playlists.ts

@@ -0,0 +1,123 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+
+export interface PlexArgs {
+  serverURL: pulumi.Input<string>;
+  token: pulumi.Input<string>;
+}
+
+export interface PlaylistConfigArgs {
+  name: pulumi.Input<string>;
+  libraries: pulumi.Input<pulumi.Input<string>[]>;
+  genres?: pulumi.Input<pulumi.Input<string>[]>;
+}
+
+export interface PlaylistArgs {
+  namespace?: pulumi.Input<string>;
+  plex: pulumi.Input<PlexArgs>;
+  playlist: pulumi.Input<PlaylistConfigArgs>;
+  schedule: pulumi.Input<string>;
+}
+
+export class Playlist extends ComponentResource {
+  private readonly plexConfig: k8s.core.v1.Secret;
+  private readonly playlistConfig: k8s.core.v1.Secret;
+  private readonly cronjob: k8s.batch.v1.CronJob;
+  public readonly namespace: pulumi.Output<string>;
+
+  /**
+   * Create a new Plex playlists resource.
+   * @param name The name of the Plex playlists resource.
+   * @param args A bag of arguments to control the Plex playlists creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: PlaylistArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("plex:playlists", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "plex",
+        "app.kubernetes.io/component": "playlists",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.plexConfig = new k8s.core.v1.Secret(
+      `${name}-plex`,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${metadata.name}-plex` },
+        stringData: pulumi.all([args.plex]).apply(([plex]) => {
+          return {
+            URL: plex.serverURL,
+            TOKEN: plex.token,
+          };
+        }),
+      },
+      opts
+    );
+
+    this.playlistConfig = new k8s.core.v1.Secret(
+      name,
+      {
+        metadata,
+        stringData: pulumi.all([args.playlist]).apply(([playlist]) => {
+          return {
+            PLAYLIST: playlist.name,
+            LIBRARIES: playlist.libraries.join(","),
+            GENRES: playlist.genres ? playlist.genres.join(",") : "",
+          };
+        }),
+      },
+      opts
+    );
+
+    this.cronjob = new k8s.batch.v1.CronJob(
+      name,
+      {
+        metadata,
+        spec: {
+          schedule: args.schedule,
+          successfulJobsHistoryLimit: 0,
+          failedJobsHistoryLimit: 1,
+          jobTemplate: {
+            metadata: { labels: metadata.labels },
+            spec: {
+              template: {
+                spec: {
+                  restartPolicy: "OnFailure",
+                  containers: [
+                    {
+                      name: "plex-random-playlists",
+                      image: "registry.gitlab.com/ydkn/plex-random-playlists:latest",
+                      imagePullPolicy: "Always",
+                      envFrom: [
+                        { secretRef: { name: this.plexConfig.metadata.name }, prefix: "PLEX_" },
+                        { secretRef: { name: this.playlistConfig.metadata.name } },
+                      ],
+                      resources: {
+                        requests: { memory: "64Mi" },
+                        limits: { memory: "96Mi" },
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+      opts
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/postgresql/cluster.ts

@@ -0,0 +1,61 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+export interface PostgreSqlArgs {
+  version?: pulumi.Input<string>;
+}
+
+export interface VolumeArgs {
+  size: pulumi.Input<string>;
+}
+
+export interface ClusterSpecArgs {
+  databases?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+  numberOfInstances?: pulumi.Input<number>;
+  postgresql?: pulumi.Input<PostgreSqlArgs>;
+  users?: pulumi.Input<{ [key: string]: pulumi.Input<pulumi.Input<string>[]> }>;
+  volume: pulumi.Input<VolumeArgs>;
+  teamId?: pulumi.Input<string>;
+}
+
+export interface ClusterArgs {
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  spec: pulumi.Input<ClusterSpecArgs>;
+}
+
+export class Cluster extends k8s.apiextensions.CustomResource {
+  private static readonly defaultVersion = "14";
+
+  /**
+   * Create a new PostgreSQL cluster resource.
+   * @param name The name of the PostgreSQL cluster resource.
+   * @param args A bag of arguments to control the PostgreSQL cluster creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: ClusterArgs, opts?: pulumi.CustomResourceOptions) {
+    super(
+      name,
+      {
+        apiVersion: "acid.zalan.do/v1",
+        kind: "postgresql",
+        metadata: args.metadata,
+        spec: pulumi.all([args.spec]).apply(([spec]) => {
+          const s = {
+            ...spec,
+            databases: spec.databases ?? {},
+            numberOfInstances: spec.numberOfInstances ?? 1,
+            postgresql: spec.postgresql ?? {},
+            teamId: spec.teamId ?? "not-available",
+          };
+
+          if (s.postgresql.version === undefined) {
+            s.postgresql.version = Cluster.defaultVersion;
+          }
+
+          return s;
+        }),
+      },
+      opts
+    );
+  }
+}

package/lib/postgresql/index.ts

@@ -0,0 +1,4 @@
+import { OperatorArgs, Operator } from "./operator";
+import { ClusterArgs, Cluster } from "./cluster";
+
+export { OperatorArgs, Operator, ClusterArgs, Cluster };