@ydkn/pulumi-components 0.4.2 → 0.4.4

package/lib/unifi/controller.ts

@@ -0,0 +1,234 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+import * as kubernetes from "../kubernetes";
+import * as traefik from "../traefik";
+
+export interface UnifiControllerArgs {
+  namespace?: pulumi.Input<string>;
+  ingressClassName?: pulumi.Input<string>;
+  hostname: pulumi.Input<string>;
+  informHostname: pulumi.Input<string>;
+  storageClassName?: pulumi.Input<string>;
+  storage?: pulumi.Input<string>;
+  protect?: boolean;
+}
+
+export class UnifiController extends ComponentResource {
+  private readonly volumeClaim: k8s.core.v1.PersistentVolumeClaim;
+  private readonly deployment: k8s.apps.v1.Deployment;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  private readonly service: kubernetes.v1.Service;
+  private readonly ingress: traefik.SecureIngress;
+  public readonly namespace: pulumi.Output<string>;
+  public readonly informUrl: pulumi.Output<string>;
+
+  /**
+   * Create a new UniFi controller resource.
+   * @param name The name of the UniFi controller resource.
+   * @param args A bag of arguments to control the UniFi controller creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: UnifiControllerArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("unifi:controller", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    if (args.storage === undefined) {
+      args.storage = "10Gi";
+    }
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+
+    const metadata = {
+      name: pulumi.interpolate`${name}-controller`,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "unifi",
+        "app.kubernetes.io/component": "controller",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    const volumeClaimName = `${name}-controller-data`;
+
+    this.volumeClaim = new k8s.core.v1.PersistentVolumeClaim(
+      name,
+      {
+        metadata: { ...metadata, name: volumeClaimName },
+        spec: {
+          accessModes: ["ReadWriteOnce"],
+          storageClassName: args.storageClassName,
+          resources: { requests: { storage: args.storage } },
+        },
+      },
+      { ...opts, protect: args.protect }
+    );
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: {
+              labels: metadata.labels,
+              annotations: {
+                "backup.velero.io/backup-volumes": "backup",
+                "pre.hook.backup.velero.io/command":
+                  '["/bin/sh", "-c", "rm -rf /backup/* && cp -rp /config/data/backup/* /backup/"]',
+                "pre.hook.backup.velero.io/container": "controller",
+                "pre.hook.backup.velero.io/timeout": "5m",
+              },
+            },
+            spec: {
+              containers: [
+                {
+                  name: "controller",
+                  image: "ghcr.io/linuxserver/unifi-controller:latest",
+                  imagePullPolicy: "Always",
+                  securityContext: { runAsNonRoot: false },
+                  env: [{ name: "MEM_LIMIT", value: "896M" }],
+                  ports: [
+                    { protocol: "UDP", containerPort: 3478, name: "p3478" },
+                    { protocol: "UDP", containerPort: 10001, name: "p10001" },
+                    { protocol: "TCP", containerPort: 8080, name: "p8080" },
+                    { protocol: "TCP", containerPort: 8081, name: "p8081" },
+                    { protocol: "TCP", containerPort: 8443, name: "p8443" },
+                    { protocol: "TCP", containerPort: 8843, name: "p8843" },
+                    { protocol: "TCP", containerPort: 8880, name: "p8880" },
+                    { protocol: "TCP", containerPort: 6789, name: "p6789" },
+                  ],
+                  livenessProbe: {
+                    httpGet: { path: "/", port: "p8443", scheme: "HTTPS" },
+                    initialDelaySeconds: 60,
+                    periodSeconds: 30,
+                    failureThreshold: 6,
+                  },
+                  readinessProbe: {
+                    httpGet: { path: "/", port: "p8443", scheme: "HTTPS" },
+                    initialDelaySeconds: 60,
+                    periodSeconds: 20,
+                    failureThreshold: 3,
+                  },
+                  volumeMounts: [
+                    { name: "data", mountPath: "/config/data" },
+                    { name: "backup", mountPath: "/backup" },
+                  ],
+                  resources: {
+                    requests: { memory: "768Mi" },
+                    limits: { memory: "1024Mi" },
+                  },
+                },
+              ],
+              volumes: [
+                { name: "data", persistentVolumeClaim: { claimName: volumeClaimName } },
+                { name: "backup", emptyDir: {} },
+              ],
+              affinity: {
+                podAntiAffinity: {
+                  preferredDuringSchedulingIgnoredDuringExecution: [
+                    {
+                      weight: 100,
+                      podAffinityTerm: {
+                        labelSelector: {
+                          matchExpressions: [
+                            {
+                              key: "app.kubernetes.io/name",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/name"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/component",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/component"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/instance",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/instance"]],
+                            },
+                          ],
+                        },
+                        topologyKey: "kubernetes.io/hostname",
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+      opts
+    );
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          minAvailable: 1,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      opts
+    );
+
+    this.service = new kubernetes.v1.Service(
+      name,
+      {
+        hostnames: [args.informHostname],
+        metadata,
+        spec: {
+          selector: metadata.labels,
+          ports: [
+            { protocol: "UDP", port: 3478, name: "p3478" },
+            { protocol: "TCP", port: 6789, name: "p6789" },
+            { protocol: "TCP", port: 8080, name: "p8080" },
+            { protocol: "TCP", port: 8081, name: "p8081" },
+            { protocol: "TCP", port: 8443, name: "https" },
+            { protocol: "TCP", port: 8843, name: "p8843" },
+            { protocol: "TCP", port: 8880, name: "p8880" },
+            { protocol: "UDP", port: 10001, name: "p10001" },
+          ],
+        },
+      },
+      { ...opts, dependsOn: [this.deployment] }
+    );
+
+    this.ingress = new traefik.SecureIngress(
+      name,
+      {
+        metadata,
+        spec: {
+          ingressClassName: args.ingressClassName,
+          rules: [
+            {
+              host: args.hostname,
+              http: {
+                paths: [
+                  {
+                    path: "/",
+                    pathType: "Prefix",
+                    backend: { service: { name: this.service.metadata.name, port: { name: "https" } } },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+      opts
+    );
+
+    this.informUrl = pulumi.concat("http://", args.informHostname, ":8080", "/inform");
+
+    this.registerOutputs();
+  }
+}

package/lib/unifi/{index.d.ts → index.ts}

@@ -1,3 +1,3 @@
 import { UnifiControllerArgs, UnifiController } from "./controller";
+
 export { UnifiControllerArgs, UnifiController };
-//# sourceMappingURL=index.d.ts.map

package/lib/velero/{index.d.ts → index.ts}

@@ -1,3 +1,3 @@
 import { VeleroArgs, Velero } from "./operator";
+
 export { VeleroArgs, Velero };
-//# sourceMappingURL=index.d.ts.map

package/lib/velero/operator.ts

@@ -0,0 +1,182 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as k8s from "@pulumi/kubernetes";
+import * as aws from "@pulumi/aws";
+import { ComponentResource } from "../common";
+import * as helm from "../kubernetes/helm";
+import { Bucket } from "../aws";
+
+export interface VeleroArgs {
+  /**
+   * Optional: Namespace
+   */
+  namespace?: pulumi.Input<string>;
+  /**
+   * Cluster name
+   */
+  clusterName: pulumi.Input<string>;
+  /**
+   * Optional: Protect critical resources
+   */
+  protect?: boolean;
+}
+
+export class Velero extends ComponentResource {
+  private readonly resticPasswordSecret: k8s.core.v1.Secret;
+  private readonly helmRelease: helm.v3.Release;
+  private readonly bucket: Bucket;
+  public readonly resticPassword: pulumi.Output<string>;
+  public readonly namespace: pulumi.Output<string>;
+
+  /**
+   * Create a new Velero resource.
+   * @param name The name of the Velero resource.
+   * @param args A bag of arguments to control the Velero creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: VeleroArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("velero", name, {}, opts);
+
+    const emptyOpts = this.opts();
+    const awsOpts = this.opts(aws.Provider);
+    const k8sOpts = this.opts(k8s.Provider);
+
+    this.bucket = new Bucket(
+      name,
+      { name: pulumi.interpolate`${name}-${args.clusterName}`, protect: args.protect },
+      awsOpts
+    );
+
+    this.resticPassword = pulumi.secret(
+      new random.RandomPassword(name, { length: 64, special: false }, emptyOpts).result
+    );
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "velero",
+        "app.kubernetes.io/component": "velero",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    this.resticPasswordSecret = new k8s.core.v1.Secret(
+      name,
+      {
+        metadata: { ...metadata, name: pulumi.interpolate`${name}-restic-credentials` },
+        stringData: {
+          "repository-password": this.resticPassword,
+        },
+      },
+      k8sOpts
+    );
+
+    this.helmRelease = new helm.v3.Release(
+      name,
+      {
+        name: metadata.name,
+        namespace: metadata.namespace,
+        repositoryOpts: { repo: "https://vmware-tanzu.github.io/helm-charts" },
+        chart: "velero",
+        values: {
+          fullnameOverride: name,
+          backupsEnabled: true,
+          snapshotsEnabled: false,
+          deployRestic: true,
+          configuration: {
+            provider: "aws",
+            backupStorageLocation: {
+              name: "default",
+              provider: "aws",
+              bucket: this.bucket.bucket.id,
+              config: {
+                region: this.bucket.bucket.region,
+              },
+            },
+          },
+          credentials: {
+            extraEnvVars: {
+              AWS_ACCESS_KEY_ID: this.bucket.accessKey.accessKey.id,
+              AWS_SECRET_ACCESS_KEY: this.bucket.accessKey.accessKey.secret,
+              AWS_DEFAULT_REGION: this.bucket.bucket.region,
+            },
+          },
+          restic: {
+            privileged: true,
+            resources: {
+              requests: { memory: "192Mi" },
+              limits: { memory: "256Mi" },
+            },
+            tolerations: [
+              { key: "node-role.kubernetes.io/master", operator: "Exists", effect: "NoSchedule" },
+              { key: "node-role.kubernetes.io/control-plane", operator: "Exists", effect: "NoSchedule" },
+            ],
+          },
+          initContainers: [
+            {
+              name: "velero-plugin-for-aws",
+              image: "velero/velero-plugin-for-aws:latest",
+              volumeMounts: [{ name: "plugins", mountPath: "/target" }],
+              resources: {
+                requests: { memory: "32Mi" },
+                limits: { memory: "48Mi" },
+              },
+            },
+          ],
+          schedules: {
+            daily: {
+              schedule: "0 2 * * *",
+              template: {
+                ttl: "170h", // ~7 days
+              },
+            },
+            weekly: {
+              schedule: "0 3 * * 0",
+              template: {
+                ttl: "730h", // ~4 weeks
+              },
+            },
+            monthly: {
+              schedule: "0 4 1 * *",
+              template: {
+                ttl: "2200h", // ~3 months
+              },
+            },
+          },
+          affinity: {
+            podAntiAffinity: {
+              preferredDuringSchedulingIgnoredDuringExecution: [
+                {
+                  weight: 100,
+                  podAffinityTerm: {
+                    labelSelector: {
+                      matchExpressions: [
+                        { key: "app.kubernetes.io/name", operator: "In", values: ["velero"] },
+                        { key: "app.kubernetes.io/instance", operator: "In", values: [name] },
+                      ],
+                    },
+                    topologyKey: "kubernetes.io/hostname",
+                  },
+                },
+              ],
+            },
+          },
+          resources: {
+            requests: { memory: "256Mi" },
+            limits: { memory: "512Mi" },
+          },
+          metrics: { serviceMonitor: { enabled: true } },
+          kubectl: { image: { repository: "appscode/kubectl", tag: "v1.23" } },
+        },
+      },
+      k8sOpts
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/wireguard/deployment.ts

@@ -0,0 +1,168 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+
+export interface Interface {
+  addresses: pulumi.Input<pulumi.Input<string>[]>;
+  port?: pulumi.Input<number>;
+  privateKey: pulumi.Input<string>;
+  name?: pulumi.Input<string>;
+}
+
+export interface Peer {
+  publicKey: pulumi.Input<string>;
+  presharedKey?: pulumi.Input<string>;
+  allowedIPs: pulumi.Input<pulumi.Input<string>[]>;
+  endpoint?: pulumi.Input<string>;
+}
+
+export interface WireguardArgs {
+  namespace?: pulumi.Input<string>;
+  interface: pulumi.Input<Interface>;
+  peers?: pulumi.Input<pulumi.Input<Peer>[]>;
+  nodeSelector?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+}
+
+export class Wireguard extends ComponentResource {
+  public static readonly gatewayLabel = "network.ydkn.network/vpn-gateway";
+  public static readonly gatewayLabelValue = "true";
+  public static readonly defaultInterfaceName = "wireguard";
+  public static readonly defaultInterfacePort = 51920;
+
+  private readonly config: k8s.core.v1.Secret;
+  private readonly daemonSet: k8s.apps.v1.DaemonSet;
+  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
+  public readonly interfaceName: pulumi.Output<string>;
+  public readonly interfacePort: pulumi.Output<number>;
+  public readonly namespace: pulumi.Output<string>;
+
+  /**
+   * Create a new wireguard resource.
+   * @param name The name of the wireguard resource.
+   * @param args A bag of arguments to control the wireguard deployment.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: WireguardArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("wireguard", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    this.interfaceName = pulumi.all([args.interface]).apply(([iface]) => iface.name ?? Wireguard.defaultInterfaceName);
+    this.interfacePort = pulumi.all([args.interface]).apply(([iface]) => iface.port ?? Wireguard.defaultInterfacePort);
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+
+    const metadata = {
+      name,
+      namespace: this.namespace,
+      labels: {
+        "app.kubernetes.io/name": "wireguard",
+        "app.kubernetes.io/component": "wireguard",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    const configData = pulumi
+      .all([args.interface, this.interfaceName, this.interfacePort, args.peers ?? []])
+      .apply(([iface, interfaceName, interfacePort, peers]) =>
+        pulumi.all([iface.addresses]).apply((addresses) =>
+          pulumi.all(peers).apply((peers) => {
+            const conf = [
+              "[Interface]",
+              `Address = ${addresses.join(",")}`,
+              `ListenPort = ${interfacePort}`,
+              `PrivateKey = ${iface.privateKey}`,
+            ];
+
+            for (const peer of peers) {
+              conf.push(
+                "[Peer]",
+                "PersistentKeepalive = 10",
+                `AllowedIPs = ${peer.allowedIPs.join(",")}`,
+                `PublicKey = ${peer.publicKey}`
+              );
+
+              if (peer.presharedKey !== undefined) {
+                conf.push(`PresharedKey = ${peer.presharedKey}`);
+              }
+
+              if (peer.endpoint !== undefined) {
+                const endpoint = peer.endpoint.match(/:\d{1,5}$/)
+                  ? peer.endpoint
+                  : `${peer.endpoint}:${Wireguard.defaultInterfacePort}`;
+
+                conf.push(`Endpoint = ${endpoint}`);
+              }
+            }
+
+            const data: { [key: string]: string } = {};
+            data[`${interfaceName}.conf`] = conf.join("\n");
+
+            return data;
+          })
+        )
+      );
+
+    this.config = new k8s.core.v1.Secret(name, { metadata, stringData: configData }, opts);
+
+    const nodeSelector: { [key: string]: string } = {};
+    nodeSelector[Wireguard.gatewayLabel] = Wireguard.gatewayLabelValue;
+
+    this.daemonSet = new k8s.apps.v1.DaemonSet(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          template: {
+            metadata: { labels: metadata.labels },
+            spec: {
+              nodeSelector: args.nodeSelector ?? nodeSelector,
+              tolerations: [
+                { key: "node-role.kubernetes.io/master", operator: "Exists", effect: "NoSchedule" },
+                { key: "node-role.kubernetes.io/control-plane", operator: "Exists", effect: "NoSchedule" },
+              ],
+              hostNetwork: true,
+              containers: [
+                {
+                  name: "wireguard",
+                  image: "ydkn/k8s-wireguard:latest",
+                  imagePullPolicy: "Always",
+                  env: [
+                    { name: "IFACE", value: this.interfaceName },
+                    { name: "IPTABLES_ALLOW_FORWARD", value: "true" },
+                  ],
+                  securityContext: { privileged: true, capabilities: { add: ["NET_ADMIN"] } },
+                  volumeMounts: [{ name: "conf", mountPath: "/etc/wireguard", readOnly: true }],
+                  ports: [{ name: "wireguard", containerPort: this.interfacePort, protocol: "UDP" }],
+                  resources: {
+                    requests: { memory: "8Mi" },
+                    limits: { memory: "12Mi" },
+                  },
+                },
+              ],
+              volumes: [{ name: "conf", secret: { secretName: this.config.metadata.name, defaultMode: 0o400 } }],
+            },
+          },
+        },
+      },
+      opts
+    );
+
+    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
+      name,
+      {
+        metadata,
+        spec: {
+          maxUnavailable: 0,
+          selector: { matchLabels: metadata.labels },
+        },
+      },
+      opts
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/wireguard/{index.d.ts → index.ts}

@@ -1,3 +1,3 @@
 import { Interface, Peer, WireguardArgs, Wireguard } from "./deployment";
+
 export { Interface, Peer, WireguardArgs, Wireguard };
-//# sourceMappingURL=index.d.ts.map