@ydkn/pulumi-components 0.4.2 → 0.4.3

package/lib/cups/avahiService.ts

@@ -0,0 +1,66 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import * as avahi from "../avahi";
+
+export interface AvahiServiceArgs {
+  labelName: pulumi.Input<string>;
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  hostname: pulumi.Input<string>;
+  name: pulumi.Input<string>;
+  description: pulumi.Input<string>;
+}
+
+export class AvahiService extends avahi.AvahiService {
+  /**
+   * Create a new CUPS avahi service resource.
+   * @param name The name of the CUPS avahi service resource.
+   * @param args A bag of arguments to control the CUPS avahi service creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: AvahiServiceArgs, opts?: pulumi.CustomResourceOptions) {
+    super(
+      name,
+      {
+        labelName: args.labelName,
+        metadata: args.metadata,
+        name: args.name,
+        services: [
+          {
+            type: "_ipp._tcp",
+            subtype: "_universal._sub._ipp._tcp",
+            port: 631,
+            hostname: args.hostname,
+            txtRecords: [
+              "txtvers=1",
+              "qtotal=1",
+              "Transparent=T",
+              "URF=none",
+              `rp=printers/${args.name}`,
+              `note=${args.description}`,
+              "product=(GPL Ghostscript)",
+              "printer-state=3",
+              "printer-type=0x2900c",
+              "pdl=" +
+                [
+                  "application/octet-stream",
+                  "application/pdf",
+                  "application/postscript",
+                  "application/vnd.cups-raster",
+                  "image/gif",
+                  "image/jpeg",
+                  "image/png",
+                  "image/tiff",
+                  "image/urf",
+                  "text/html",
+                  "text/plain",
+                  "application/vnd.adobe-reader-postscript",
+                  "application/vnd.cups-pdf",
+                ].join(","),
+            ],
+          },
+        ],
+      },
+      opts
+    );
+  }
+}

package/lib/cups/deployment.ts

@@ -0,0 +1,199 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+import { Service } from "../kubernetes/v1";
+import { SecureIngress } from "../traefik";
+import { AvahiService } from "./avahiService";
+
+export interface CupsPrinterArgs {
+  name: pulumi.Input<string>;
+  description: pulumi.Input<string>;
+}
+
+export interface CupsArgs {
+  namespace?: pulumi.Input<string>;
+  hostname: pulumi.Input<string>;
+  ingressClassName?: pulumi.Input<string>;
+  avahiLabelName?: pulumi.Input<string>;
+  storageClassName?: pulumi.Input<string>;
+  nodeSelector?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+  printers: pulumi.Input<{ [key: string]: pulumi.Input<CupsPrinterArgs> }>;
+  protect?: boolean;
+}
+
+export class Cups extends ComponentResource {
+  private readonly adminSecret: k8s.core.v1.Secret;
+  private readonly volumeClaim: k8s.core.v1.PersistentVolumeClaim;
+  private readonly deployment: k8s.apps.v1.Deployment;
+  private readonly service: Service;
+  private readonly ingress: SecureIngress;
+  private readonly avahiServices?: pulumi.Output<AvahiService[]>;
+  public readonly adminPassword: pulumi.Output<string>;
+  public readonly namespace: pulumi.Output<string>;
+
+  /**
+   * Create a new CUPS resource.
+   * @param name The name of the CUPS resource.
+   * @param args A bag of arguments to control the CUPS deployment.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: CupsArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("cups", name, args, opts);
+
+    const emptyOpts = this.opts();
+    const k8sOpts = this.opts(k8s.Provider);
+
+    this.adminPassword = pulumi.secret(
+      new random.RandomPassword(`${name}-admin-password`, { length: 24, special: true }, emptyOpts).result
+    );
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "cups",
+        "app.kubernetes.io/component": "cups",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.adminSecret = new k8s.core.v1.Secret(
+      name,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-admin` },
+        stringData: {
+          password: this.adminPassword,
+        },
+      },
+      k8sOpts
+    );
+
+    const volumeClaimName = pulumi.interpolate`${name}-data`;
+
+    this.volumeClaim = new k8s.core.v1.PersistentVolumeClaim(
+      name,
+      {
+        metadata: { ...metadata, name: volumeClaimName },
+        spec: {
+          storageClassName: args.storageClassName,
+          accessModes: ["ReadWriteOnce"],
+          resources: { requests: { storage: "1Gi" } },
+        },
+      },
+      { ...k8sOpts, protect: args.protect }
+    );
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: { labels: metadata.labels },
+            spec: {
+              nodeSelector: args.nodeSelector,
+              hostNetwork: true,
+              containers: [
+                {
+                  name: "cups",
+                  image: "docker.io/ydkn/cups:latest",
+                  imagePullPolicy: "Always",
+                  env: [
+                    {
+                      name: "ADMIN_PASSWORD",
+                      valueFrom: { secretKeyRef: { name: this.adminSecret.metadata.name, key: "password" } },
+                    },
+                  ],
+                  volumeMounts: [{ name: "data", mountPath: "/etc/cups" }],
+                  ports: [{ name: "cups", containerPort: 631 }],
+                  resources: {
+                    requests: { memory: "128Mi" },
+                    limits: { memory: "192Mi" },
+                  },
+                },
+              ],
+              volumes: [{ name: "data", persistentVolumeClaim: { claimName: volumeClaimName } }],
+            },
+          },
+        },
+      },
+      k8sOpts
+    );
+
+    this.service = new Service(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: metadata.labels,
+          ports: [{ name: "https", port: 631, targetPort: "cups" }],
+        },
+      },
+      { ...k8sOpts, dependsOn: [this.deployment] }
+    );
+
+    this.ingress = new SecureIngress(
+      name,
+      {
+        metadata,
+        spec: {
+          ingressClassName: args.ingressClassName,
+          rules: [
+            {
+              host: args.hostname,
+              http: {
+                paths: [
+                  {
+                    path: "/",
+                    pathType: "Prefix",
+                    backend: {
+                      service: { name: this.service.metadata.name, port: { name: this.service.spec.ports[0].name } },
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+      k8sOpts
+    );
+
+    if (args.avahiLabelName !== undefined) {
+      this.avahiServices = pulumi.all([args.printers, args.avahiLabelName]).apply(([printers, avahiLabelName]) => {
+        const avahiServices: AvahiService[] = [];
+
+        for (const printerName in printers) {
+          // eslint-disable-next-line security/detect-object-injection
+          const printer = printers[printerName];
+
+          avahiServices.push(
+            new AvahiService(
+              `${name}-${printerName}`,
+              {
+                labelName: avahiLabelName,
+                metadata: { ...metadata, name: `${name}-${printerName}` },
+                hostname: args.hostname,
+                name: printer.name,
+                description: printer.description,
+              },
+              k8sOpts
+            )
+          );
+        }
+
+        return avahiServices;
+      });
+    }
+
+    this.registerOutputs();
+  }
+}

package/lib/cups/index.ts

@@ -0,0 +1,4 @@
+import { CupsArgs, Cups } from "./deployment";
+import { AvahiServiceArgs, AvahiService } from "./avahiService";
+
+export { CupsArgs, Cups, AvahiServiceArgs, AvahiService };

package/lib/devcontainer/assets/init.sh

@@ -0,0 +1,44 @@
+#!/bin/bash -e
+
+function install_bg() {
+  # update package lists
+  apt-get update -y
+
+  # upgrade packages
+  apt-get dist-upgrade -y
+
+  # install additional packages
+  apt-get install $(cat /run/k8s/init/packages.txt) -y
+}
+
+# background installation of additional stuff
+install_bg &
+
+# setup new home directory
+usermod -d /code code
+
+# copy upstream home directory contents
+rsync -a /home/code/ /code/
+
+# fix permissions
+chmod -R g-w,o-w /code/.cache
+
+# setup ssh host keys
+rm -f /etc/ssh/ssh_host_*_key
+rm -f /etc/ssh/ssh_host_*_key.pub
+cp /run/k8s/ssh/ssh_host_*_key /run/k8s/ssh/ssh_host_*_key.pub /etc/ssh/
+chmod 600 /etc/ssh/ssh_host_*_key
+chmod 644 /etc/ssh/ssh_host_*_key.pub
+
+# install authorized keys for code
+mkdir -p /code/.ssh
+chmod 700 /code/.ssh
+cp /run/k8s/ssh/authorized_keys /code/.ssh/authorized_keys
+chmod 600 /code/.ssh/authorized_keys
+chown -R code:code /code/.ssh
+
+# remove motd
+rm -rf /etc/update-motd.d/*
+
+# start sshd
+/usr/sbin/sshd -D

package/lib/devcontainer/deployment.ts

@@ -0,0 +1,253 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as tls from "@pulumi/tls";
+import * as k8s from "@pulumi/kubernetes";
+import * as path from "path";
+import * as fs from "fs";
+import { ComponentResource } from "../common";
+import * as kubernetes from "../kubernetes";
+
+export interface DevContainerArgs {
+  namespace?: pulumi.Input<string>;
+  image: pulumi.Input<string>;
+  hostname?: pulumi.Input<string>;
+  authorizedKeys?: pulumi.Input<pulumi.Input<string>[]>;
+  packages?: pulumi.Input<pulumi.Input<string>[]>;
+  volumes?: pulumi.Input<pulumi.Input<k8s.types.input.core.v1.Volume>[]>;
+  volumeMounts?: pulumi.Input<pulumi.Input<k8s.types.input.core.v1.VolumeMount>[]>;
+  nodeSelector?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+  storageClassName?: pulumi.Input<string>;
+  storageSize?: pulumi.Input<string>;
+  resources?: pulumi.Input<k8s.types.input.core.v1.ResourceRequirements>;
+}
+
+export class DevContainer extends ComponentResource {
+  private static readonly sshContainerPort = 22;
+
+  private readonly sshPrivateKeysRSA: tls.PrivateKey;
+  private readonly sshPrivateKeysECDSA: tls.PrivateKey;
+  private readonly sshPrivateKeysED25519: tls.PrivateKey;
+  private readonly initScript: k8s.core.v1.ConfigMap;
+  private readonly sshSecret: k8s.core.v1.Secret;
+  private readonly volumeClaim: k8s.core.v1.PersistentVolumeClaim;
+  private readonly deployment: k8s.apps.v1.Deployment;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  private readonly service: kubernetes.v1.Service;
+  public readonly namespace: pulumi.Output<string>;
+
+  /**
+   * Create a new DevContainer resource.
+   * @param name The name of the DevContainer resource.
+   * @param args A bag of arguments to control the DevContainer creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: DevContainerArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("devcontainer", name, args, opts);
+
+    const emptyOpts = this.opts();
+    const k8sOpts = this.opts(k8s.Provider);
+
+    if (args.storageSize === undefined) {
+      args.storageSize = "10Gi";
+    }
+
+    if (args.resources === undefined) {
+      args.resources = {
+        requests: { memory: "768Mi" },
+        limits: { memory: "1024Mi" },
+      };
+    }
+
+    this.sshPrivateKeysRSA = new tls.PrivateKey(`${name}-rsa`, { algorithm: "RSA", rsaBits: 8192 }, emptyOpts);
+    this.sshPrivateKeysECDSA = new tls.PrivateKey(
+      `${name}-ecdsa`,
+      { algorithm: "ECDSA", ecdsaCurve: "P521" },
+      emptyOpts
+    );
+    this.sshPrivateKeysED25519 = new tls.PrivateKey(`${name}-ed25519`, { algorithm: "ED25519" }, emptyOpts);
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "devcontainer",
+        "app.kubernetes.io/component": "devcontainer",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.initScript = new k8s.core.v1.ConfigMap(
+      name,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-init` },
+        data: {
+          // eslint-disable-next-line security/detect-non-literal-fs-filename
+          "init.sh": fs.readFileSync(path.join(__dirname, "assets", "init.sh"), "utf-8"),
+          "packages.txt": pulumi
+            .all([args.packages])
+            .apply(([packages]) => pulumi.all(packages ?? []).apply((packages) => packages.join(" "))),
+        },
+      },
+      k8sOpts
+    );
+
+    this.sshSecret = new k8s.core.v1.Secret(
+      name,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-ssh` },
+        stringData: {
+          ssh_host_rsa_key: this.sshPrivateKeysRSA.privateKeyOpenssh,
+          "ssh_host_rsa_key.pub": this.sshPrivateKeysRSA.publicKeyOpenssh,
+          ssh_host_ecdsa_key: this.sshPrivateKeysECDSA.privateKeyOpenssh,
+          "ssh_host_ecdsa_key.pub": this.sshPrivateKeysECDSA.publicKeyOpenssh,
+          ssh_host_ed25519_key: this.sshPrivateKeysED25519.privateKeyOpenssh,
+          "ssh_host_ed25519_key.pub": this.sshPrivateKeysED25519.publicKeyOpenssh,
+          authorized_keys: pulumi
+            .all([args.authorizedKeys])
+            .apply(([authorizedKeys]) =>
+              pulumi.all(authorizedKeys ?? []).apply((authorizedKeys) => authorizedKeys.join("\n"))
+            ),
+        },
+      },
+      k8sOpts
+    );
+
+    const volumeClaimName = pulumi.interpolate`${name}-data`;
+
+    this.volumeClaim = new k8s.core.v1.PersistentVolumeClaim(
+      name,
+      {
+        metadata: { ...metadata, name: volumeClaimName },
+        spec: {
+          storageClassName: args.storageClassName,
+          accessModes: ["ReadWriteOnce"],
+          resources: { requests: { storage: args.storageSize } },
+        },
+      },
+      k8sOpts
+    );
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: { labels: metadata.labels },
+            spec: {
+              securityContext: { runAsUser: 0, runAsGroup: 0, fsGroup: 0 },
+              nodeSelector: args.nodeSelector,
+              containers: [
+                {
+                  name: "devcontainer",
+                  image: args.image,
+                  imagePullPolicy: "Always",
+                  command: ["/run/k8s/init/init.sh"],
+                  ports: [{ name: "ssh", containerPort: DevContainer.sshContainerPort, protocol: "TCP" }],
+                  resources: args.resources,
+                  startupProbe: {
+                    periodSeconds: 30,
+                    timeoutSeconds: 3,
+                    successThreshold: 1,
+                    failureThreshold: 30,
+                    tcpSocket: { port: "ssh" },
+                  },
+                  livenessProbe: {
+                    periodSeconds: 30,
+                    timeoutSeconds: 3,
+                    successThreshold: 1,
+                    failureThreshold: 3,
+                    tcpSocket: { port: "ssh" },
+                  },
+                  volumeMounts: pulumi.all([args.volumeMounts]).apply(([volumeMounts]) => {
+                    return (
+                      [
+                        { name: "init", mountPath: "/run/k8s/init" },
+                        { name: "ssh", mountPath: "/run/k8s/ssh" },
+                        { name: "storage", mountPath: "/workspace" },
+                      ] as k8s.types.input.core.v1.VolumeMount[]
+                    ).concat(volumeMounts ?? []);
+                  }),
+                },
+              ],
+              volumes: pulumi.all([args.volumes]).apply(([volumes]) => {
+                return (
+                  [
+                    { name: "init", configMap: { name: this.initScript.metadata.name, defaultMode: 0o755 } },
+                    { name: "ssh", secret: { secretName: this.sshSecret.metadata.name, defaultMode: 0o400 } },
+                    { name: "storage", persistentVolumeClaim: { claimName: volumeClaimName } },
+                  ] as k8s.types.input.core.v1.Volume[]
+                ).concat(volumes ?? []);
+              }),
+              affinity: {
+                podAntiAffinity: {
+                  preferredDuringSchedulingIgnoredDuringExecution: [
+                    {
+                      weight: 100,
+                      podAffinityTerm: {
+                        labelSelector: {
+                          matchExpressions: [
+                            {
+                              key: "app.kubernetes.io/name",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/name"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/component",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/component"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/instance",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/instance"]],
+                            },
+                          ],
+                        },
+                        topologyKey: "kubernetes.io/hostname",
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+      k8sOpts
+    );
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          minAvailable: 1,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      k8sOpts
+    );
+
+    this.service = new kubernetes.v1.Service(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: metadata.labels,
+          ports: [{ name: "ssh", port: 22, targetPort: "ssh" }],
+        },
+        hostnames: args.hostname ? [args.hostname] : undefined,
+      },
+      { ...k8sOpts, dependsOn: [this.deployment] }
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/devcontainer/index.ts

@@ -0,0 +1,3 @@
+import { DevContainerArgs, DevContainer } from "./deployment";
+
+export { DevContainerArgs, DevContainer };