@ydkn/pulumi-components 0.4.2 → 0.4.3

package/lib/fcos/host.ts

@@ -0,0 +1,91 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as tls from "@pulumi/tls";
+import { ComponentResource } from "../common";
+import { UserArgs, ConfigArgs, Config } from "./config";
+
+export interface HostUserArgs {
+  /**
+   * Username
+   */
+  name: pulumi.Input<string>;
+  /**
+   * Optional: Groups
+   */
+  groups?: pulumi.Input<pulumi.Input<string>[]>;
+}
+
+export interface HostArgs extends ConfigArgs {
+  /**
+   * Optional: Users with SSH access
+   */
+  sshUsers?: pulumi.Input<pulumi.Input<HostUserArgs>[]>;
+}
+
+export class Host extends ComponentResource {
+  public readonly sshPrivateKeys: pulumi.Output<{ [key: string]: tls.PrivateKey }>;
+  public readonly ignitionConfig: pulumi.Output<string>;
+
+  /**
+   * Create a new FCOS host resource.
+   * @param name The name of the FCOS host resource.
+   * @param args A bag of arguments to control the FCOS host creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: HostArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("fcos:host", name, args, opts);
+
+    const emptyOpts = this.opts();
+
+    this.sshPrivateKeys = pulumi.all([args.sshUsers]).apply(([sshUsers]) => {
+      const sshPrivateKeys: { [key: string]: tls.PrivateKey } = {};
+
+      for (const sshUser of sshUsers || []) {
+        sshPrivateKeys[sshUser.name] = new tls.PrivateKey(
+          `${name}-${sshUser.name}`,
+          { algorithm: "ED25519" },
+          emptyOpts
+        );
+      }
+
+      return sshPrivateKeys;
+    });
+
+    this.ignitionConfig = new Config(
+      name,
+      {
+        ...args,
+        modules: pulumi.all([args.modules]).apply(([modules]) => (modules || []).concat("wireguard")),
+        packages: pulumi
+          .all([args.packages])
+          .apply(([packages]) => (packages || []).concat("netcat", "tcpdump", "iperf3", "htop", "golang-gvisor")),
+        users: pulumi
+          .all([args.users, args.sshUsers, this.sshPrivateKeys])
+          .apply(([users, sshUsers, sshPrivateKeys]) => {
+            const allUsers: pulumi.Input<UserArgs>[] = [];
+
+            for (const user of users || []) {
+              allUsers.push(user);
+            }
+
+            for (const sshUser of sshUsers || []) {
+              allUsers.push({
+                name: sshUser.name,
+                groups: sshUser.groups,
+                sshAuthorizedKeys: sshPrivateKeys[sshUser.name].publicKeyOpenssh.apply((key) => [key.trim()]),
+              });
+            }
+
+            return allUsers;
+          }),
+        systemdUnits: pulumi
+          .all([args.systemdUnits])
+          .apply(([systemdUnits]) =>
+            (systemdUnits || []).concat({ mask: true, name: "docker.service" }, { mask: true, name: "docker.socket" })
+          ),
+      },
+      emptyOpts
+    ).ignitionConfig;
+
+    this.registerOutputs();
+  }
+}

package/lib/fcos/index.ts

@@ -0,0 +1,27 @@
+import {
+  PartitionArgs,
+  DiskArgs,
+  FilesystemArgs,
+  UserArgs,
+  FilesArgs,
+  SystemdUnitArgs,
+  IgnitionArgs,
+  ConfigArgs,
+  Config,
+} from "./config";
+import { HostUserArgs, HostArgs, Host } from "./host";
+
+export {
+  PartitionArgs,
+  DiskArgs,
+  FilesystemArgs,
+  UserArgs,
+  FilesArgs,
+  SystemdUnitArgs,
+  IgnitionArgs,
+  ConfigArgs,
+  Config,
+  HostUserArgs,
+  HostArgs,
+  Host,
+};

package/lib/freeradius/deployment.ts

@@ -0,0 +1,244 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as k8s from "@pulumi/kubernetes";
+import * as path from "path";
+import * as templateFile from "template-file";
+import { ComponentResource } from "../common";
+import * as kubernetes from "../kubernetes";
+import * as certManager from "../certManager";
+
+export interface LdapArgs {
+  hostname: pulumi.Input<string>;
+  username: pulumi.Input<string>;
+  password: pulumi.Input<string>;
+  baseDN: pulumi.Input<string>;
+}
+
+export interface FreeRadiusServerArgs {
+  namespace?: pulumi.Input<string>;
+  hostname: pulumi.Input<string>;
+  domain: pulumi.Input<string>;
+  ldap: pulumi.Input<LdapArgs>;
+  resources?: pulumi.Input<k8s.types.input.core.v1.ResourceRequirements>;
+  protect?: boolean;
+}
+
+export class FreeRadiusServer extends ComponentResource {
+  private readonly localSecret: pulumi.Output<string>;
+  private readonly configs: k8s.core.v1.Secret;
+  private readonly issuer: certManager.Issuer;
+  private readonly caCertificate: certManager.Certificate;
+  private readonly caIssuer: certManager.Issuer;
+  private readonly certificate: certManager.Certificate;
+  private readonly deployment: k8s.apps.v1.Deployment;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  private readonly service: kubernetes.v1.Service;
+  public readonly namespace: pulumi.Output<string>;
+  public readonly clientSecret: pulumi.Output<string>;
+  public readonly ip: pulumi.Output<string>;
+
+  /**
+   * Create a new FreeRadius server resource.
+   * @param name The name of the FreeRadius server resource.
+   * @param args A bag of arguments to control the FreeRadius server creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: FreeRadiusServerArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("freeradius", name, args, opts);
+
+    if (args.resources === undefined) {
+      args.resources = { requests: { memory: "96Mi" }, limits: { memory: "128Mi" } };
+    }
+
+    const emptyOpts = this.opts();
+    const k8sOpts = this.opts(k8s.Provider);
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "freeradius",
+        "app.kubernetes.io/component": "freeradius",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.localSecret = pulumi.secret(
+      new random.RandomString(`${name}-local-secret`, { special: false, length: 48 }, emptyOpts).result
+    );
+
+    this.clientSecret = pulumi.secret(
+      new random.RandomString(
+        `${name}-client-secret`,
+        { special: false, length: 48 },
+        { ...emptyOpts, protect: args.protect }
+      ).result
+    );
+
+    this.configs = new k8s.core.v1.Secret(
+      `${name}-configs`,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-configs` },
+        stringData: pulumi
+          .all([args.domain, args.ldap, this.localSecret, this.clientSecret])
+          .apply(([domain, ldap, localSecret, clientSecret]) => {
+            const vars = {
+              ldap: { hostname: ldap.hostname, username: ldap.username, password: ldap.password, baseDN: ldap.baseDN },
+              domain,
+              localSecret,
+              clientSecret,
+            };
+
+            return {
+              default: FreeRadiusServer.renderAssetTemplate("default", vars),
+              eap: FreeRadiusServer.renderAssetTemplate("eap", vars),
+              "inner-tunnel": FreeRadiusServer.renderAssetTemplate("inner-tunnel", vars),
+              ldap: FreeRadiusServer.renderAssetTemplate("ldap", vars),
+              "proxy.conf": FreeRadiusServer.renderAssetTemplate("proxy.conf", vars),
+              "clients.conf": FreeRadiusServer.renderAssetTemplate("clients.conf", vars),
+            };
+          }),
+      },
+      k8sOpts
+    );
+
+    this.issuer = new certManager.Issuer(name, { metadata, spec: { selfSigned: {} } }, k8sOpts);
+
+    this.caCertificate = new certManager.Certificate(
+      `${name}-ca`,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-ca` },
+        spec: {
+          isCA: true,
+          commonName: "RADIUS",
+          dnsNames: [args.hostname],
+          duration: "876000h", // 100y
+          renewBefore: "8760h", // 1y
+          privateKey: { algorithm: "RSA", size: 4096, rotationPolicy: "Always" },
+          issuerRef: { kind: this.issuer.kind, name: this.issuer.metadata.name },
+        },
+      },
+      k8sOpts
+    );
+
+    this.caIssuer = new certManager.Issuer(
+      `${name}-ca`,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-ca` },
+        spec: { ca: { secretName: this.caCertificate.secretName } },
+      },
+      k8sOpts
+    );
+
+    this.certificate = new certManager.Certificate(
+      name,
+      {
+        metadata,
+        spec: {
+          isCA: true,
+          commonName: args.hostname,
+          dnsNames: [args.hostname],
+          duration: "87600h", // 10y
+          renewBefore: "2160h", // 90d
+          privateKey: { algorithm: "RSA", size: 4096, rotationPolicy: "Always" },
+          issuerRef: { kind: this.caIssuer.kind, name: this.caIssuer.metadata.name },
+        },
+      },
+      k8sOpts
+    );
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: {
+              labels: metadata.labels,
+              annotations: { "backup.velero.io/backup-volumes": "data" },
+            },
+            spec: {
+              containers: [
+                {
+                  name: "freeradius",
+                  image: "freeradius/freeradius-server:latest-alpine",
+                  imagePullPolicy: "Always",
+                  ports: [
+                    { name: "radius", containerPort: 1812, protocol: "UDP" },
+                    { name: "radius-acct", containerPort: 1813, protocol: "UDP" },
+                  ],
+                  resources: args.resources,
+                  volumeMounts: [
+                    { name: "configs", mountPath: "/opt/etc/raddb/sites-enabled/default", subPath: "default" },
+                    { name: "configs", mountPath: "/opt/etc/raddb/mods-enabled/eap", subPath: "eap" },
+                    {
+                      name: "configs",
+                      mountPath: "/opt/etc/raddb/sites-enabled/inner-tunnel",
+                      subPath: "inner-tunnel",
+                    },
+                    { name: "configs", mountPath: "/opt/etc/raddb/mods-enabled/ldap", subPath: "ldap" },
+                    { name: "configs", mountPath: "/opt/etc/raddb/proxy.conf", subPath: "proxy.conf" },
+                    { name: "configs", mountPath: "/opt/etc/raddb/clients.conf", subPath: "clients.conf" },
+
+                    { name: "ca-tls", mountPath: "/opt/etc/raddb/certs/ca.crt", subPath: "tls.crt" },
+                    { name: "tls", mountPath: "/opt/etc/raddb/certs/server.crt", subPath: "tls.crt" },
+                    { name: "tls", mountPath: "/opt/etc/raddb/certs/server.key", subPath: "tls.key" },
+                  ],
+                },
+              ],
+              volumes: [
+                { name: "configs", secret: { secretName: this.configs.metadata.name } },
+                { name: "ca-tls", secret: { secretName: this.caCertificate.secretName } },
+                { name: "tls", secret: { secretName: this.certificate.secretName } },
+              ],
+            },
+          },
+        },
+      },
+      k8sOpts
+    );
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          minAvailable: 1,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      k8sOpts
+    );
+
+    this.service = new kubernetes.v1.Service(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: metadata.labels,
+          ports: [
+            { name: "radius", port: 1812, targetPort: "radius", protocol: "UDP" },
+            { name: "radius-acct", port: 1813, targetPort: "radius-acct", protocol: "UDP" },
+          ],
+        },
+        hostnames: [args.hostname],
+      },
+      { ...k8sOpts, dependsOn: [this.deployment] }
+    );
+
+    this.ip = this.service.spec.clusterIP;
+
+    this.registerOutputs();
+  }
+
+  private static renderAssetTemplate(filename: string, data: templateFile.Data): pulumi.Output<string> {
+    return pulumi.output(templateFile.renderFile(path.join(__dirname, "assets", `${filename}.tmpl`), data));
+  }
+}

package/lib/freeradius/{index.d.ts → index.ts}

@@ -1,3 +1,3 @@
 import { FreeRadiusServerArgs, FreeRadiusServer } from "./deployment";
+
 export { FreeRadiusServerArgs, FreeRadiusServer };
-//# sourceMappingURL=index.d.ts.map

package/lib/gitlab/{index.d.ts → index.ts}

@@ -1,5 +1,16 @@
 import { ProjectArgs, Project } from "./project";
 import { RunnerArgs, Runner, RunnersArgs, Runners, RunnerCleanupArgs, RunnerCleanup } from "./runners";
 import { RenovateArgs, Renovate } from "./renovate";
-export { ProjectArgs, Project, RunnerArgs, Runner, RunnersArgs, Runners, RunnerCleanupArgs, RunnerCleanup, RenovateArgs, Renovate, };
-//# sourceMappingURL=index.d.ts.map
+
+export {
+  ProjectArgs,
+  Project,
+  RunnerArgs,
+  Runner,
+  RunnersArgs,
+  Runners,
+  RunnerCleanupArgs,
+  RunnerCleanup,
+  RenovateArgs,
+  Renovate,
+};

package/lib/gitlab/project.ts

@@ -0,0 +1,148 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as gitlab from "@pulumi/gitlab";
+import { ComponentResource } from "../common";
+
+export interface ProjectArgs extends gitlab.ProjectArgs {
+  protect?: boolean;
+}
+
+export class Project extends ComponentResource {
+  private readonly project: gitlab.Project;
+  private readonly pipelineBadge: gitlab.ProjectBadge;
+
+  /**
+   * Create a new GitLab project resource.
+   * @param name The name of the GitLab project resource.
+   * @param args A bag of arguments to control the GitLab project creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: ProjectArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("gitlab:project", name, args, opts);
+
+    opts = this.opts(gitlab.Provider);
+
+    if (args.autoCancelPendingPipelines === undefined) {
+      args.autoCancelPendingPipelines = "enabled";
+    }
+
+    if (args.autoDevopsEnabled === undefined) {
+      args.autoDevopsEnabled = false;
+    }
+
+    if (args.autocloseReferencedIssues === undefined) {
+      args.autocloseReferencedIssues = true;
+    }
+
+    if (args.buildsAccessLevel === undefined) {
+      args.buildsAccessLevel = "private";
+    }
+
+    if (args.containerRegistryEnabled === undefined) {
+      args.containerRegistryEnabled = true;
+    }
+
+    args.containerExpirationPolicy = pulumi
+      .all([args.containerRegistryEnabled, args.containerExpirationPolicy])
+      .apply(([enabled, policy]) => {
+        if (enabled && policy === undefined) {
+          return {
+            enabled: true,
+            cadence: "7d",
+            olderThan: "14d",
+            keepN: 10,
+            nameRegexDelete: ".*",
+            nameRegexKeep: "^v\\d(\\.\\d)+$",
+          };
+        } else {
+          return {};
+        }
+      });
+
+    if (args.defaultBranch === undefined) {
+      args.defaultBranch = "main";
+    }
+
+    if (args.initializeWithReadme === undefined) {
+      args.initializeWithReadme = false;
+    }
+
+    if (args.issuesEnabled === undefined) {
+      args.issuesEnabled = true;
+    }
+
+    if (args.lfsEnabled === undefined) {
+      args.lfsEnabled = false;
+    }
+
+    if (args.mergeRequestsEnabled === undefined) {
+      args.mergeRequestsEnabled = true;
+    }
+
+    if (args.onlyAllowMergeIfAllDiscussionsAreResolved === undefined) {
+      args.onlyAllowMergeIfAllDiscussionsAreResolved = true;
+    }
+
+    if (args.onlyAllowMergeIfPipelineSucceeds === undefined) {
+      args.onlyAllowMergeIfPipelineSucceeds = true;
+    }
+
+    if (args.operationsAccessLevel === undefined) {
+      args.operationsAccessLevel = "disabled";
+    }
+
+    if (args.packagesEnabled === undefined) {
+      args.packagesEnabled = false;
+    }
+
+    if (args.pagesAccessLevel === undefined) {
+      args.pagesAccessLevel = "disabled";
+    }
+
+    if (args.pipelinesEnabled === undefined) {
+      args.pipelinesEnabled = true;
+    }
+
+    if (args.printingMergeRequestLinkEnabled === undefined) {
+      args.printingMergeRequestLinkEnabled = true;
+    }
+
+    if (args.removeSourceBranchAfterMerge === undefined) {
+      args.removeSourceBranchAfterMerge = true;
+    }
+
+    if (args.sharedRunnersEnabled === undefined) {
+      args.sharedRunnersEnabled = true;
+    }
+
+    if (args.snippetsEnabled === undefined) {
+      args.snippetsEnabled = false;
+    }
+
+    if (args.squashOption === undefined) {
+      args.squashOption = "default_on";
+    }
+
+    if (args.visibilityLevel === undefined) {
+      args.visibilityLevel = "private";
+    }
+
+    if (args.wikiEnabled === undefined) {
+      args.wikiEnabled = false;
+    }
+
+    this.project = new gitlab.Project(name, args, { ...opts, protect: args.protect });
+
+    this.pipelineBadge = new gitlab.ProjectBadge(
+      `${name}-pipeline-badge`,
+      {
+        project: this.project.id,
+        name: "Pipeline Status",
+        linkUrl: "https://gitlab.com/%{project_path}/pipelines",
+        imageUrl: "https://gitlab.com/%{project_path}/badges/main/pipeline.svg",
+      },
+      opts
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/gitlab/renovate.ts

@@ -0,0 +1,98 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+
+export interface RenovateArgs {
+  namespace?: pulumi.Input<string>;
+  accessToken: pulumi.Input<string>;
+  githubAccessToken?: pulumi.Input<string>;
+  schedule?: pulumi.Input<string>;
+  resources?: pulumi.Input<k8s.types.input.core.v1.ResourceRequirements>;
+}
+
+export class Renovate extends ComponentResource {
+  private readonly secret: k8s.core.v1.Secret;
+  private readonly cronjob: k8s.batch.v1.CronJob;
+  public readonly namespace: pulumi.Output<string>;
+
+  /**
+   * Create a new renovate resource.
+   * @param name The name of the renovate resource.
+   * @param args A bag of arguments to control the renovate creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: RenovateArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("gitlab:renovate", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    if (args.schedule === undefined) {
+      args.schedule = "0 2 * * 0";
+    }
+
+    if (args.resources === undefined) {
+      args.resources = { requests: { memory: "1024Mi" }, limits: { memory: "1280Mi" } };
+    }
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "gitlab",
+        "app.kubernetes.io/component": "renovate",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.secret = new k8s.core.v1.Secret(
+      name,
+      {
+        metadata,
+        stringData: pulumi.all([args.accessToken, args.githubAccessToken]).apply(([accessToken, githubAccessToken]) => {
+          return { RENOVATE_TOKEN: accessToken, GITHUB_COM_TOKEN: githubAccessToken };
+        }),
+      },
+      opts
+    );
+
+    this.cronjob = new k8s.batch.v1.CronJob(
+      name,
+      {
+        metadata,
+        spec: {
+          schedule: args.schedule,
+          concurrencyPolicy: "Forbid",
+          successfulJobsHistoryLimit: 0,
+          failedJobsHistoryLimit: 1,
+          jobTemplate: {
+            metadata: { labels: metadata.labels },
+            spec: {
+              template: {
+                spec: {
+                  restartPolicy: "OnFailure",
+                  containers: [
+                    {
+                      name: "renovate",
+                      image: "renovate/renovate:latest",
+                      imagePullPolicy: "Always",
+                      args: ["--platform=gitlab", "--autodiscover"],
+                      envFrom: [{ secretRef: { name: this.secret.metadata.name } }],
+                      resources: args.resources,
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+      opts
+    );
+
+    this.registerOutputs();
+  }
+}