@ydkn/pulumi-components 0.4.2 → 0.4.3

package/lib/traefik/controller.ts

@@ -0,0 +1,207 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import * as fs from "fs";
+import * as path from "path";
+import { ComponentResource } from "../common";
+import * as kubernetes from "../kubernetes";
+import { ServiceMonitor } from "../prometheus";
+import { Dashboard } from "../grafana";
+
+export interface TraefikArgs {
+  namespace?: pulumi.Input<string>;
+  replicas?: pulumi.Input<number>;
+  serviceType?: pulumi.Input<string>;
+  serviceAnnotations?: { [key: string]: pulumi.Input<string> };
+  ingressClass?: pulumi.Input<string>;
+  defaultIngressClass?: pulumi.Input<boolean>;
+  proxyProtocolIPs?: pulumi.Input<pulumi.Input<string>[]>;
+}
+
+export class Traefik extends ComponentResource {
+  private readonly helmRelease: kubernetes.helm.v3.Release;
+  private readonly metricsService: k8s.core.v1.Service;
+  private readonly serviceMonitor: ServiceMonitor;
+  private readonly grafanaDashboard: Dashboard;
+  public readonly namespace: pulumi.Output<string>;
+  public readonly ingressClassName: pulumi.Output<string>;
+
+  /**
+   * Create a new traefik ingress controller resource.
+   * @param name The name of the traefik ingress controller resource.
+   * @param args A bag of arguments to control the traefik ingress controller creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: TraefikArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("traefik:controller", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    if (args.replicas === undefined) {
+      args.replicas = 1;
+    }
+
+    if (args.serviceType === undefined) {
+      args.serviceType = "ClusterIP";
+    }
+
+    if (args.serviceAnnotations === undefined) {
+      args.serviceAnnotations = {};
+    }
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+
+    this.ingressClassName = pulumi.output(args.ingressClass ?? "traefik");
+
+    this.helmRelease = new kubernetes.helm.v3.Release(
+      name,
+      {
+        name,
+        namespace: this.namespace,
+        repositoryOpts: { repo: "https://helm.traefik.io/traefik" },
+        chart: "traefik",
+        values: {
+          fullnameOverride: name,
+          deployment: {
+            replicas: args.replicas,
+            minReadySeconds: 10,
+          },
+          globalArguments: [],
+          additionalArguments: pulumi.all([args.proxyProtocolIPs]).apply(([proxyProtocolIPs]) => {
+            const args = [
+              "--entrypoints.web.http.redirections.entryPoint.to=:443",
+              "--entrypoints.web.http.redirections.entryPoint.scheme=https",
+              "--entrypoints.web.http.redirections.entrypoint.permanent=true",
+              "--serversTransport.insecureSkipVerify=true",
+            ];
+
+            if (proxyProtocolIPs !== undefined && proxyProtocolIPs.length > 0) {
+              args.push(`--entrypoints.web.proxyprotocol.trustedips=${proxyProtocolIPs.join(",")}`);
+              args.push(`--entrypoints.websecure.proxyprotocol.trustedips=${proxyProtocolIPs.join(",")}`);
+            }
+
+            return args;
+          }),
+          providers: {
+            kubernetesCRD: {
+              ingressClass: args.ingressClass,
+            },
+            kubernetesIngress: {
+              ingressClass: args.ingressClass,
+              publishedService: { enabled: true },
+              allowExternalNameServices: true,
+            },
+          },
+          ingressClass: {
+            enabled: true,
+            isDefaultClass: args.defaultIngressClass ?? false,
+            fallbackApiVersion: "v1",
+          },
+          ingressRoute: { dashboard: { enabled: false } },
+          logs: {
+            general: { format: "json" },
+          },
+          service: {
+            type: args.serviceType,
+            annotations: args.serviceAnnotations,
+          },
+          metrics: {
+            prometheus: { entryPoint: "metrics", addRoutersLabels: true },
+          },
+          podDisruptionBudget: {
+            enabled: true,
+            maxUnavailable: "33%",
+          },
+          affinity: {
+            podAntiAffinity: {
+              preferredDuringSchedulingIgnoredDuringExecution: [
+                {
+                  weight: 100,
+                  podAffinityTerm: {
+                    labelSelector: {
+                      matchExpressions: [
+                        { key: "app.kubernetes.io/name", operator: "In", values: ["traefik"] },
+                        { key: "app.kubernetes.io/instance", operator: "In", values: [name] },
+                      ],
+                    },
+                    topologyKey: "kubernetes.io/hostname",
+                  },
+                },
+              ],
+            },
+          },
+          resources: {
+            requests: { memory: "64Mi" },
+            limits: { memory: "96Mi" },
+          },
+        },
+      },
+      opts
+    );
+
+    const metricsMetadata = {
+      name: `${name}-metrics`,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "traefik",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.metricsService = new k8s.core.v1.Service(
+      `${name}-metrics`,
+      {
+        metadata: metricsMetadata,
+        spec: {
+          selector: metricsMetadata.labels,
+          ports: [{ name: "metrics", port: 9100, targetPort: "metrics" }],
+        },
+      },
+      { ...opts, dependsOn: [this.helmRelease] }
+    );
+
+    this.serviceMonitor = new ServiceMonitor(
+      `${name}-metrics`,
+      {
+        metadata: metricsMetadata,
+        spec: {
+          namespaceSelector: { matchNames: [this.namespace] },
+          selector: { matchLabels: metricsMetadata.labels },
+          endpoints: [
+            {
+              port: "metrics",
+              honorLabels: true,
+              metricRelabelings: [
+                {
+                  action: "drop",
+                  sourceLabels: ["__name__"],
+                  regex: ["go_.*"].join("|"),
+                },
+                {
+                  action: "drop",
+                  sourceLabels: ["entrypoint"],
+                  regex: ["metrics", "traefik"].join("|"),
+                },
+              ],
+            },
+          ],
+        },
+      },
+      { ...opts, dependsOn: [this.metricsService] }
+    );
+
+    this.grafanaDashboard = new Dashboard(
+      `${name}-grafana-dashboard`,
+      {
+        metadata: { namespace: this.namespace, name: pulumi.interpolate`${name}-grafana-dashboard` },
+        name: "traefik",
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        data: fs.readFileSync(path.join(__dirname, "assets", "dashboard.json"), "utf-8"),
+      },
+      opts
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/traefik/{index.d.ts → index.ts}

@@ -1,5 +1,5 @@
 import { TraefikArgs, Traefik } from "./controller";
 import { SecureIngressArgs, SecureIngress } from "./secureIngress";
 import { Middleware, MiddlewareArgs } from "./middleware";
+
 export { TraefikArgs, Traefik, SecureIngressArgs, SecureIngress, Middleware, MiddlewareArgs };
-//# sourceMappingURL=index.d.ts.map

package/lib/traefik/middleware.ts

@@ -0,0 +1,37 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+export interface MiddlewareHeadersArgs {
+  customRequestHeaders?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+  customResponseHeaders?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+}
+
+export interface MiddlewareSpecArgs {
+  headers?: pulumi.Input<MiddlewareHeadersArgs>;
+}
+
+export interface MiddlewareArgs {
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  spec: pulumi.Input<MiddlewareSpecArgs>;
+}
+
+export class Middleware extends k8s.apiextensions.CustomResource {
+  /**
+   * Create a new middlware resource.
+   * @param name The name of the middlware resource.
+   * @param args A bag of arguments to control the middlware creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: MiddlewareArgs, opts?: pulumi.CustomResourceOptions) {
+    super(
+      name,
+      {
+        apiVersion: "traefik.containo.us/v1alpha1",
+        kind: "Middleware",
+        metadata: args.metadata,
+        spec: args.spec,
+      },
+      opts
+    );
+  }
+}

package/lib/traefik/secureIngress.ts

@@ -0,0 +1,81 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+export interface SecureIngressArgs {
+  /**
+   * Metadata for the ingress resource
+   */
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  /**
+   * Spec for the ingress resource
+   */
+  spec: pulumi.Input<k8s.types.input.networking.v1.IngressSpec>;
+  /**
+   * Optional: Name of issuer
+   */
+  issuer?: pulumi.Input<string>;
+  /**
+   * Optional: Name of cluster issuer
+   */
+  clusterIssuer?: pulumi.Input<string>;
+}
+
+export class SecureIngress extends k8s.networking.v1.Ingress {
+  private static readonly defaultClusterIssuer = "letsencrypt";
+
+  /**
+   * Create a new secure ingress resource.
+   * @param name The name of the secure ingress resource.
+   * @param args A bag of arguments to control the secure ingress creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: SecureIngressArgs, opts?: pulumi.CustomResourceOptions) {
+    const ingressArgs = pulumi
+      .all([args.metadata, args.spec, args.issuer, args.clusterIssuer])
+      .apply(([metadataWrapped, specWrapped, issuer, clusterIssuer]) => {
+        const metadata = metadataWrapped as k8s.types.input.meta.v1.ObjectMeta;
+        const spec = specWrapped as k8s.types.input.networking.v1.IngressSpec;
+
+        if (metadata.annotations === undefined) {
+          metadata.annotations = {};
+        }
+
+        const annotations: { [key: string]: pulumi.Input<string> } = {
+          "traefik.ingress.kubernetes.io/router.entrypoints": "websecure",
+          "traefik.ingress.kubernetes.io/router.tls": "true",
+        };
+
+        if (issuer !== undefined) {
+          annotations["cert-manager.io/issuer"] = issuer;
+        } else if (clusterIssuer !== undefined) {
+          annotations["cert-manager.io/cluster-issuer"] = clusterIssuer;
+        } else {
+          annotations["cert-manager.io/cluster-issuer"] = SecureIngress.defaultClusterIssuer;
+        }
+
+        metadata.annotations = { ...annotations, ...metadata.annotations };
+
+        if (spec.tls === undefined) {
+          spec.tls = [{ hosts: SecureIngress.hosts(spec.rules), secretName: pulumi.interpolate`${name}-tls` }];
+        }
+
+        return { metadata, spec };
+      });
+
+    super(name, ingressArgs, opts);
+  }
+
+  private static hosts(rules?: pulumi.Input<pulumi.Input<k8s.types.input.networking.v1.IngressRule>[]>): string[] {
+    if (rules === undefined) {
+      return [];
+    }
+
+    return (rules as k8s.types.input.networking.v1.IngressRule[])
+      .map((r) => {
+        return r.host;
+      })
+      .filter((h) => {
+        return h !== undefined;
+      }) as string[];
+  }
+}

package/lib/ubuntu/deployment.ts

@@ -0,0 +1,275 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as tls from "@pulumi/tls";
+import * as k8s from "@pulumi/kubernetes";
+import * as path from "path";
+import * as fs from "fs";
+import { ComponentResource } from "../common";
+import * as kubernetes from "../kubernetes";
+
+export interface UbuntuArgs {
+  namespace?: pulumi.Input<string>;
+  hostname?: pulumi.Input<string>;
+  authorizedKeys?: pulumi.Input<pulumi.Input<string>[]>;
+  packages?: pulumi.Input<pulumi.Input<string>[]>;
+  volumes?: pulumi.Input<pulumi.Input<k8s.types.input.core.v1.Volume>[]>;
+  volumeMounts?: pulumi.Input<pulumi.Input<k8s.types.input.core.v1.VolumeMount>[]>;
+  nodeSelector?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+  replicas?: pulumi.Input<number>;
+  hostNetwork?: pulumi.Input<boolean>;
+}
+
+export class Ubuntu extends ComponentResource {
+  private static readonly sshContainerPort = 22;
+
+  private readonly sshPrivateKeysRSA: tls.PrivateKey;
+  private readonly sshPrivateKeysECDSA: tls.PrivateKey;
+  private readonly sshPrivateKeysED25519: tls.PrivateKey;
+  private readonly serviceAccount: k8s.core.v1.ServiceAccount;
+  private readonly clusterRole: k8s.rbac.v1.ClusterRole;
+  private readonly clusterRoleBinding: k8s.rbac.v1.ClusterRoleBinding;
+  private readonly initScript: k8s.core.v1.ConfigMap;
+  private readonly sshSecret: k8s.core.v1.Secret;
+  private readonly deployment: k8s.apps.v1.Deployment;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  private readonly service: kubernetes.v1.Service;
+  public readonly namespace: pulumi.Output<string>;
+
+  /**
+   * Create a new Ubuntu resource.
+   * @param name The name of the Ubuntu resource.
+   * @param args A bag of arguments to control the Ubuntu creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: UbuntuArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("ubuntu", name, args, opts);
+
+    const emptyOpts = this.opts();
+    const k8sOpts = this.opts(k8s.Provider);
+
+    if (args.replicas === undefined) {
+      args.replicas = 1;
+    }
+
+    this.sshPrivateKeysRSA = new tls.PrivateKey(`${name}-rsa`, { algorithm: "RSA", rsaBits: 8192 }, emptyOpts);
+    this.sshPrivateKeysECDSA = new tls.PrivateKey(
+      `${name}-ecdsa`,
+      { algorithm: "ECDSA", ecdsaCurve: "P521" },
+      emptyOpts
+    );
+    this.sshPrivateKeysED25519 = new tls.PrivateKey(`${name}-ed25519`, { algorithm: "ED25519" }, emptyOpts);
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "ubuntu",
+        "app.kubernetes.io/component": "ubuntu",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.serviceAccount = new k8s.core.v1.ServiceAccount(name, { metadata }, k8sOpts);
+
+    this.clusterRole = new k8s.rbac.v1.ClusterRole(
+      name,
+      {
+        metadata,
+        rules: [{ apiGroups: ["*"], resources: ["*"], verbs: ["*"] }],
+      },
+      k8sOpts
+    );
+
+    this.clusterRoleBinding = new k8s.rbac.v1.ClusterRoleBinding(
+      name,
+      {
+        metadata,
+        subjects: [
+          {
+            kind: this.serviceAccount.kind,
+            namespace: this.serviceAccount.metadata.namespace,
+            name: this.serviceAccount.metadata.name,
+          },
+        ],
+        roleRef: {
+          apiGroup: "rbac.authorization.k8s.io",
+          kind: this.clusterRole.kind,
+          name: this.clusterRole.metadata.name,
+        },
+      },
+      k8sOpts
+    );
+
+    this.initScript = new k8s.core.v1.ConfigMap(
+      name,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-init` },
+        data: {
+          // eslint-disable-next-line security/detect-non-literal-fs-filename
+          "init.sh": fs.readFileSync(path.join(__dirname, "assets", "init.sh"), "utf-8"),
+          "packages.txt": pulumi
+            .all([args.packages])
+            .apply(([packages]) => pulumi.all(packages ?? []).apply((packages) => packages.join(" "))),
+        },
+      },
+      k8sOpts
+    );
+
+    this.sshSecret = new k8s.core.v1.Secret(
+      name,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-ssh` },
+        stringData: {
+          ssh_host_rsa_key: this.sshPrivateKeysRSA.privateKeyOpenssh,
+          "ssh_host_rsa_key.pub": this.sshPrivateKeysRSA.publicKeyOpenssh,
+          ssh_host_ecdsa_key: this.sshPrivateKeysECDSA.privateKeyOpenssh,
+          "ssh_host_ecdsa_key.pub": this.sshPrivateKeysECDSA.publicKeyOpenssh,
+          ssh_host_ed25519_key: this.sshPrivateKeysED25519.privateKeyOpenssh,
+          "ssh_host_ed25519_key.pub": this.sshPrivateKeysED25519.publicKeyOpenssh,
+          authorized_keys: pulumi
+            .all([args.authorizedKeys])
+            .apply(([authorizedKeys]) =>
+              pulumi.all(authorizedKeys ?? []).apply((authorizedKeys) => authorizedKeys.join("\n"))
+            ),
+        },
+      },
+      k8sOpts
+    );
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: args.replicas,
+          template: {
+            metadata: { labels: metadata.labels },
+            spec: {
+              securityContext: { runAsUser: 0, runAsGroup: 0, fsGroup: 0 },
+              serviceAccountName: this.serviceAccount.metadata.name,
+              nodeSelector: args.nodeSelector,
+              hostNetwork: args.hostNetwork,
+              containers: [
+                {
+                  name: "ubuntu",
+                  image: "ubuntu:rolling",
+                  imagePullPolicy: "Always",
+                  command: ["/run/k8s/init/init.sh"],
+                  env: [
+                    { name: "KUBERNETES_NODE_NAME", valueFrom: { fieldRef: { fieldPath: "spec.nodeName" } } },
+                    { name: "KUBERNETES_POD_NAMESPACE", valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } },
+                    { name: "KUBERNETES_POD_NAME", valueFrom: { fieldRef: { fieldPath: "metadata.name" } } },
+                    { name: "KUBERNETES_POD_IP", valueFrom: { fieldRef: { fieldPath: "status.podIP" } } },
+                  ],
+                  ports: [{ name: "ssh", containerPort: Ubuntu.sshContainerPort, protocol: "TCP" }],
+                  resources: {
+                    requests: { memory: "128Mi" },
+                    limits: { memory: "256Mi" },
+                  },
+                  startupProbe: {
+                    periodSeconds: 30,
+                    timeoutSeconds: 3,
+                    successThreshold: 1,
+                    failureThreshold: 30,
+                    tcpSocket: { port: "ssh" },
+                  },
+                  livenessProbe: {
+                    periodSeconds: 30,
+                    timeoutSeconds: 3,
+                    successThreshold: 1,
+                    failureThreshold: 3,
+                    tcpSocket: { port: "ssh" },
+                  },
+                  volumeMounts: pulumi.all([args.volumeMounts]).apply(([volumeMounts]) => {
+                    return (
+                      [
+                        { name: "init", mountPath: "/run/k8s/init" },
+                        { name: "ssh", mountPath: "/run/k8s/ssh" },
+                      ] as k8s.types.input.core.v1.VolumeMount[]
+                    ).concat(volumeMounts ?? []);
+                  }),
+                },
+              ],
+              volumes: pulumi.all([args.volumes]).apply(([volumes]) => {
+                return (
+                  [
+                    { name: "init", configMap: { name: this.initScript.metadata.name, defaultMode: 0o755 } },
+                    { name: "ssh", secret: { secretName: this.sshSecret.metadata.name, defaultMode: 0o400 } },
+                  ] as k8s.types.input.core.v1.Volume[]
+                ).concat(volumes ?? []);
+              }),
+              tolerations: [
+                { key: "node-role.kubernetes.io/master", operator: "Exists", effect: "NoSchedule" },
+                { key: "node-role.kubernetes.io/control-plane", operator: "Exists", effect: "NoSchedule" },
+              ],
+              affinity: {
+                podAntiAffinity: {
+                  preferredDuringSchedulingIgnoredDuringExecution: [
+                    {
+                      weight: 100,
+                      podAffinityTerm: {
+                        labelSelector: {
+                          matchExpressions: [
+                            {
+                              key: "app.kubernetes.io/name",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/name"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/component",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/component"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/instance",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/instance"]],
+                            },
+                          ],
+                        },
+                        topologyKey: "kubernetes.io/hostname",
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+      k8sOpts
+    );
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          minAvailable: 1,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      k8sOpts
+    );
+
+    this.service = new kubernetes.v1.Service(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: metadata.labels,
+          ports: [{ name: "ssh", port: 22, targetPort: "ssh" }],
+        },
+        hostnames: args.hostname ? [args.hostname] : undefined,
+      },
+      { ...k8sOpts, dependsOn: [this.deployment] }
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/ubuntu/{index.d.ts → index.ts}

@@ -1,3 +1,3 @@
 import { UbuntuArgs, Ubuntu } from "./deployment";
+
 export { UbuntuArgs, Ubuntu };
-//# sourceMappingURL=index.d.ts.map