@ydkn/pulumi-components 0.4.2 → 0.4.3

package/lib/rethinkdb/deployment.ts

@@ -0,0 +1,424 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+import * as kubernetes from "../kubernetes";
+import * as certManager from "../certManager";
+import * as traefik from "../traefik";
+
+export interface RethinkDbArgs {
+  namespace?: pulumi.Input<string>;
+  hostname: pulumi.Input<string>;
+  ingressClassName?: pulumi.Input<string>;
+  replicas?: pulumi.Input<number>;
+  storage?: pulumi.Input<string>;
+  resources?: pulumi.Input<k8s.types.input.core.v1.ResourceRequirements>;
+  protect?: boolean;
+}
+
+export class RethinkDb extends ComponentResource {
+  private static readonly adminPort = 8080;
+  private static readonly clientsPort = 28015;
+  private static readonly clusterPort = 29015;
+
+  private readonly clusterIssuer: certManager.Issuer;
+  private readonly clusterCACertificate: certManager.Certificate;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  private readonly adminService: k8s.core.v1.Service;
+  private readonly clientsService: kubernetes.v1.Service;
+  private readonly adminIngress: traefik.SecureIngress;
+  public readonly adminPassword: pulumi.Output<string>;
+  public readonly namespace: pulumi.Output<string>;
+  public readonly address: pulumi.Output<string>;
+  public readonly addresses: pulumi.Output<pulumi.Output<string>[]>;
+
+  /**
+   * Create a new RethinkDB cluster resource.
+   * @param name The name of the RethinkDB cluster resource.
+   * @param args A bag of arguments to control the RethinkDB cluster creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: RethinkDbArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("rethinkdb", name, args, opts);
+
+    if (args.replicas === undefined) {
+      args.replicas = 1;
+    }
+
+    if (args.resources === undefined) {
+      args.resources = { requests: { memory: "256Mi" }, limits: { memory: "384Mi" } };
+    }
+
+    const emptyOpts = this.opts();
+    const k8sOpts = this.opts(k8s.Provider);
+
+    this.adminPassword = pulumi.secret(
+      new random.RandomPassword(`${name}-admin-password`, { length: 32, special: false }, emptyOpts).result
+    );
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "rethinkdb",
+        "app.kubernetes.io/component": "rethinkdb",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    const adminServiceName = pulumi.interpolate`${name}-admin`;
+    const clientsServiceName = pulumi.interpolate`${name}-clients`;
+
+    this.clusterCACertificate = new certManager.Certificate(
+      `${name}-cluster-ca`,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-cluster-ca` },
+        spec: {
+          isCA: true,
+          commonName: name,
+          dnsNames: [name],
+          duration: "87600h",
+          renewBefore: "8760h",
+          privateKey: { rotationPolicy: "Always" },
+          issuerRef: { name: "self-signed", kind: "ClusterIssuer" },
+        },
+      },
+      k8sOpts
+    );
+
+    this.clusterIssuer = new certManager.Issuer(
+      `${name}-cluster`,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-cluster` },
+        spec: {
+          ca: { secretName: this.clusterCACertificate.secretName },
+        },
+      },
+      k8sOpts
+    );
+
+    this.addresses = pulumi.all([args.replicas]).apply(([replicas]) => {
+      const addresses: pulumi.Output<string>[] = [];
+
+      for (let i = 0; i < replicas; i++) {
+        const deployment = this.replicaDeployment(
+          name,
+          replicas,
+          i,
+          metadata,
+          args.hostname,
+          args.storage || "10Gi",
+          args.resources,
+          args.protect,
+          k8sOpts
+        );
+
+        addresses.push(deployment.clientsHostname);
+      }
+
+      return addresses;
+    });
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          minAvailable: 1,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      k8sOpts
+    );
+
+    this.adminService = new k8s.core.v1.Service(
+      `${name}-admin`,
+      {
+        metadata: {
+          ...metadata,
+          name: adminServiceName,
+          annotations: {
+            "traefik.ingress.kubernetes.io/service.sticky.cookie": "true",
+            "traefik.ingress.kubernetes.io/service.sticky.cookie.name": "_affinity",
+            "traefik.ingress.kubernetes.io/service.sticky.cookie.secure": "true",
+          },
+        },
+        spec: {
+          selector: metadata.labels,
+          ports: [{ name: "http", protocol: "TCP", port: RethinkDb.adminPort, targetPort: "admin" }],
+          sessionAffinity: "ClientIP",
+        },
+      },
+      k8sOpts
+    );
+
+    this.clientsService = new kubernetes.v1.Service(
+      `${name}-clients`,
+      {
+        metadata: { ...metadata, name: clientsServiceName },
+        spec: {
+          selector: metadata.labels,
+          ports: [{ name: "clients", protocol: "TCP", port: RethinkDb.clientsPort, targetPort: "clients" }],
+          sessionAffinity: "ClientIP",
+        },
+        hostnames: [pulumi.interpolate`clients.${args.hostname}`],
+      },
+      k8sOpts
+    );
+
+    this.address = this.clientsService.hostnames!.apply(
+      (hostnames) => pulumi.interpolate`${hostnames[0]}:${this.clientsService.spec.ports[0].port}`
+    );
+
+    this.adminIngress = new traefik.SecureIngress(
+      `${name}-admin`,
+      {
+        metadata: { ...metadata, name: adminServiceName },
+        spec: {
+          ingressClassName: args.ingressClassName,
+          rules: [
+            {
+              host: args.hostname,
+              http: {
+                paths: [
+                  {
+                    path: "/",
+                    pathType: "Prefix",
+                    backend: {
+                      service: { name: adminServiceName, port: { name: "http" } },
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+      k8sOpts
+    );
+
+    this.registerOutputs();
+  }
+
+  private replicaDeployment(
+    name: string,
+    replicas: number,
+    idx: number,
+    metadata: k8s.types.input.meta.v1.ObjectMeta,
+    hostname: pulumi.Input<string>,
+    storage: pulumi.Input<string>,
+    resources?: pulumi.Input<k8s.types.input.core.v1.ResourceRequirements>,
+    protect?: boolean,
+    opts?: pulumi.ComponentResourceOptions
+  ): { clientsHostname: pulumi.Output<string> } {
+    const replicaMetadata = {
+      ...metadata,
+      name: `${name}-${idx}`,
+      labels: { ...metadata.labels, replica: `${idx}` } as { [key: string]: pulumi.Input<string> },
+    };
+
+    const clusterCertificate = new certManager.Certificate(
+      `${name}-${idx}-cluster`,
+      {
+        metadata: { ...replicaMetadata, name: `${replicaMetadata.name}-cluster` },
+        spec: {
+          commonName: replicaMetadata.name,
+          dnsNames: [replicaMetadata.name],
+          privateKey: { rotationPolicy: "Always" },
+          issuerRef: { name: this.clusterIssuer.metadata.name, kind: this.clusterIssuer.kind },
+        },
+      },
+      opts
+    );
+
+    const clientsCertificate = new certManager.Certificate(
+      `${name}-${idx}-clients`,
+      {
+        metadata: { ...replicaMetadata, name: `${replicaMetadata.name}-clients` },
+        spec: {
+          dnsNames: [pulumi.interpolate`${idx}.clients.${hostname}`, pulumi.interpolate`clients.${hostname}`],
+          privateKey: { rotationPolicy: "Always" },
+          issuerRef: { name: "letsencrypt", kind: "ClusterIssuer" },
+        },
+      },
+      opts
+    );
+
+    const volumeClaimName = pulumi.interpolate`${replicaMetadata.name}-data`;
+
+    // eslint-disable-next-line no-unused-vars
+    const volumeClaim = new k8s.core.v1.PersistentVolumeClaim(
+      `${name}-${idx}`,
+      {
+        metadata: { ...replicaMetadata, name: volumeClaimName },
+        spec: {
+          accessModes: ["ReadWriteOnce"],
+          resources: { requests: { storage } },
+        },
+      },
+      { ...opts, protect }
+    );
+
+    // eslint-disable-next-line no-unused-vars
+    const deployment = new k8s.apps.v1.Deployment(
+      `${name}-${idx}`,
+      {
+        metadata: replicaMetadata,
+        spec: {
+          selector: { matchLabels: replicaMetadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: { labels: replicaMetadata.labels },
+            spec: {
+              containers: [
+                {
+                  name: "rethinkdb",
+                  image: "rethinkdb:2",
+                  imagePullPolicy: "Always",
+                  command: ["sh", "-c"],
+                  args: [
+                    pulumi.all([replicas]).apply(([replicas]) => {
+                      const args = [
+                        "rethinkdb",
+                        "--runuser",
+                        "rethinkdb",
+                        "--rungroup",
+                        "rethinkdb",
+                        "--bind",
+                        "all",
+                        "--server-name",
+                        "${REPLICA_NAME}", // eslint-disable-line no-template-curly-in-string
+                        "--server-tag",
+                        "${NODE_NAME}", // eslint-disable-line no-template-curly-in-string
+                        "--driver-tls-cert",
+                        "/run/secrets/kubernetes.io/clients-tls/tls.crt",
+                        "--driver-tls-key",
+                        "/run/secrets/kubernetes.io/clients-tls/tls.key",
+                        "--cluster-tls-ca",
+                        "/run/secrets/kubernetes.io/cluster-ca/tls.crt",
+                        "--cluster-tls-cert",
+                        "/run/secrets/kubernetes.io/cluster-tls/tls.crt",
+                        "--cluster-tls-key",
+                        "/run/secrets/kubernetes.io/cluster-tls/tls.key",
+                        "--canonical-address",
+                        `${name}-${idx}-cluster:${RethinkDb.clusterPort}`,
+                        "--no-update-check",
+                        "--log-file",
+                        "/dev/null",
+                        "--initial-password",
+                        "${PASSWORD}", // eslint-disable-line no-template-curly-in-string
+                      ];
+
+                      for (let i = 0; i < replicas; i++) {
+                        args.push(
+                          [
+                            `$(if [ "\${REPLICA_NAME}" != "${name}-${i}" ];`,
+                            `then echo "--join ${name}-${i}-cluster:${RethinkDb.clusterPort}";`,
+                            `else echo ""; fi)`,
+                          ].join(" ")
+                        );
+                      }
+
+                      return args.join(" ");
+                    }),
+                  ],
+                  env: [
+                    { name: "NODE_NAME", valueFrom: { fieldRef: { fieldPath: "spec.nodeName" } } },
+                    { name: "REPLICA_NAME", value: pulumi.interpolate`${name}-${idx}` },
+                    { name: "PASSWORD", value: this.adminPassword },
+                  ],
+                  ports: [
+                    { name: "admin", protocol: "TCP", containerPort: RethinkDb.adminPort },
+                    { name: "clients", protocol: "TCP", containerPort: RethinkDb.clientsPort },
+                    { name: "cluster", protocol: "TCP", containerPort: RethinkDb.clusterPort },
+                  ],
+                  volumeMounts: [
+                    { name: "data", mountPath: "/data" },
+                    { name: "admin-tls", mountPath: "/run/secrets/kubernetes.io/admin-tls" },
+                    { name: "clients-tls", mountPath: "/run/secrets/kubernetes.io/clients-tls" },
+                    { name: "cluster-ca", mountPath: "/run/secrets/kubernetes.io/cluster-ca" },
+                    { name: "cluster-tls", mountPath: "/run/secrets/kubernetes.io/cluster-tls" },
+                  ],
+                  resources,
+                },
+              ],
+              volumes: [
+                { name: "data", persistentVolumeClaim: { claimName: volumeClaimName } },
+                { name: "admin-tls", secret: { secretName: this.adminIngress.spec.tls[0].secretName } },
+                { name: "clients-tls", secret: { secretName: clientsCertificate.secretName } },
+                { name: "cluster-ca", secret: { secretName: this.clusterCACertificate.secretName } },
+                { name: "cluster-tls", secret: { secretName: clusterCertificate.secretName } },
+              ],
+              affinity: {
+                podAntiAffinity: {
+                  preferredDuringSchedulingIgnoredDuringExecution: [
+                    {
+                      weight: 100,
+                      podAffinityTerm: {
+                        labelSelector: {
+                          matchExpressions: [
+                            {
+                              key: "app.kubernetes.io/name",
+                              operator: "In",
+                              values: [replicaMetadata.labels["app.kubernetes.io/name"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/component",
+                              operator: "In",
+                              values: [replicaMetadata.labels["app.kubernetes.io/component"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/instance",
+                              operator: "In",
+                              values: [replicaMetadata.labels["app.kubernetes.io/instance"]],
+                            },
+                          ],
+                        },
+                        topologyKey: "kubernetes.io/hostname",
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+      opts
+    );
+
+    // eslint-disable-next-line no-unused-vars
+    const clusterService = new kubernetes.v1.Service(
+      `${name}-${idx}-cluster`,
+      {
+        metadata: { ...replicaMetadata, name: pulumi.interpolate`${replicaMetadata.name}-cluster` },
+        spec: {
+          selector: replicaMetadata.labels,
+          ports: [{ name: "cluster", protocol: "TCP", port: RethinkDb.clusterPort, targetPort: "cluster" }],
+        },
+      },
+      opts
+    );
+
+    const clientsService = new kubernetes.v1.Service(
+      `${name}-${idx}-clients`,
+      {
+        metadata: { ...replicaMetadata, name: pulumi.interpolate`${replicaMetadata.name}-clients` },
+        spec: {
+          selector: replicaMetadata.labels,
+          ports: [{ name: "clients", protocol: "TCP", port: RethinkDb.clientsPort, targetPort: "clients" }],
+          sessionAffinity: "ClientIP",
+        },
+        hostnames: [pulumi.interpolate`${idx}.clients.${hostname}`],
+      },
+      opts
+    );
+
+    return { clientsHostname: clientsService.hostnames!.apply((hostnames) => hostnames[0]) };
+  }
+}

package/lib/rethinkdb/{index.d.ts → index.ts}

@@ -1,3 +1,3 @@
 import { RethinkDbArgs, RethinkDb } from "./deployment";
+
 export { RethinkDbArgs, RethinkDb };
-//# sourceMappingURL=index.d.ts.map