@ydkn/pulumi-components 0.4.2 → 0.4.4

package/lib/dhcpd/deployment.ts

@@ -0,0 +1,164 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+
+export interface Subnet {
+  subnet: string;
+  nameservers: string[];
+  start: string;
+  end: string;
+  netmask: string;
+  router: string;
+}
+
+export interface DhcpdArgs {
+  namespace?: pulumi.Input<string>;
+  subnets: pulumi.Input<pulumi.Input<Subnet>[]>;
+  nodeSelector?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+}
+
+export class Dhcpd extends ComponentResource {
+  private readonly deployment: k8s.apps.v1.Deployment;
+
+  /**
+   * Create a new DHCPd resource.
+   * @param name The name of the DHCPd resource.
+   * @param args A bag of arguments to control the DHCPd deployment.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: DhcpdArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("dhcpd", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    let namespace = args.namespace;
+
+    if (args.namespace === undefined) {
+      namespace = new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+    }
+
+    const metadata = {
+      name,
+      namespace,
+      labels: {
+        "app.kubernetes.io/name": "dhcpd",
+        "app.kubernetes.io/component": "dhcpd",
+        "app.kubernetes.io/instance": name,
+      },
+    };
+
+    const conf = new k8s.core.v1.ConfigMap(
+      name,
+      {
+        metadata,
+        data: {
+          "dhcpd.conf": pulumi.all([args.subnets]).apply(([subnets]) => {
+            const confOptions = ["authoritative;", "ddns-update-style none;"];
+
+            for (const s of subnets) {
+              confOptions.push(
+                `subnet ${s.subnet} netmask ${s.netmask} {`,
+                `range ${s.start} ${s.end};`,
+                `option domain-name-servers ${s.nameservers.join(", ")};`,
+                `option routers ${s.router};`,
+                "default-lease-time 3600;",
+                "max-lease-time 86400;",
+                "}"
+              );
+            }
+
+            return confOptions.join("\n");
+          }),
+        },
+      },
+      opts
+    );
+
+    this.deployment = new k8s.apps.v1.Deployment(
+      name,
+      {
+        metadata,
+        spec: {
+          selector: { matchLabels: metadata.labels },
+          strategy: { type: "Recreate" },
+          replicas: 1,
+          template: {
+            metadata: { labels: metadata.labels },
+            spec: {
+              nodeSelector: args.nodeSelector,
+              tolerations: [
+                { effect: "NoSchedule", operator: "Exists" },
+                { effect: "NoExecute", operator: "Exists" },
+              ],
+              hostNetwork: true,
+              initContainers: [
+                {
+                  name: "settings",
+                  image: "busybox:latest",
+                  command: ["/bin/sh"],
+                  args: ["-c", "cat /config/dhcpd.conf > /data/dhcpd.conf"],
+                  volumeMounts: [
+                    { name: "config", mountPath: "/config" },
+                    { name: "data", mountPath: "/data" },
+                  ],
+                  resources: {
+                    requests: { memory: "8Mi", cpu: "100m" },
+                    limits: { memory: "16Mi", cpu: "200m" },
+                  },
+                },
+              ],
+              containers: [
+                {
+                  name: "dhcpd",
+                  image: "networkboot/dhcpd:latest",
+                  securityContext: {
+                    privileged: true,
+                    capabilities: { add: ["NET_ADMIN"] },
+                  },
+                  volumeMounts: [{ name: "data", mountPath: "/data" }],
+                  resources: {
+                    requests: { memory: "16Mi", cpu: "100m" },
+                    limits: { memory: "32Mi", cpu: "400m" },
+                  },
+                },
+              ],
+              volumes: [
+                { name: "config", configMap: { name: conf.metadata.name } },
+                { name: "data", emptyDir: {} },
+              ],
+              affinity: {
+                podAntiAffinity: {
+                  preferredDuringSchedulingIgnoredDuringExecution: [
+                    {
+                      weight: 100,
+                      podAffinityTerm: {
+                        labelSelector: {
+                          matchExpressions: [
+                            {
+                              key: "app.kubernetes.io/name",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/name"]],
+                            },
+                            {
+                              key: "app.kubernetes.io/instance",
+                              operator: "In",
+                              values: [metadata.labels["app.kubernetes.io/instance"]],
+                            },
+                          ],
+                        },
+                        topologyKey: "kubernetes.io/hostname",
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+      opts
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/dhcpd/index.ts

@@ -0,0 +1,3 @@
+import { DhcpdArgs, Dhcpd } from "./deployment";
+
+export { DhcpdArgs, Dhcpd };

package/lib/externalDns/dnsEndpoint.ts

@@ -0,0 +1,70 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+export interface ProviderSpecificArgs {
+  /**
+   * Name
+   */
+  name: pulumi.Input<string>;
+  /**
+   * Value
+   */
+  value: pulumi.Input<string>;
+}
+
+export interface DnsEndpointsArgs {
+  /**
+   * The hostname of the DNS record
+   */
+  dnsName: pulumi.Input<string>;
+  /**
+   * The targets the DNS record points to
+   */
+  targets: pulumi.Input<pulumi.Input<string>[]>;
+  /**
+   * ype of record, e.g. CNAME, A, SRV, TXT etc.
+   */
+  recordType: pulumi.Input<string>;
+  /**
+   * Optional: TTL for the record
+   */
+  recordTTL?: pulumi.Input<number>;
+  /**
+   * Optional: Labels stores labels defined for the endpoint
+   */
+  labels?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
+  /**
+   * Optional: ProviderSpecific stores provider specific config
+   */
+  providerSpecific?: pulumi.Input<pulumi.Input<ProviderSpecificArgs>[]>;
+}
+
+export interface DnsEndpointSpecArgs {
+  /**
+   * Endpoints
+   */
+  endpoints: pulumi.Input<pulumi.Input<DnsEndpointsArgs>[]>;
+}
+
+export interface DnsEndpointArgs {
+  /**
+   * Metadata for the DNS endpoint resource
+   */
+  metadata: pulumi.Input<k8s.types.input.meta.v1.ObjectMeta>;
+  /**
+   * Spec for the DNS endpoint resource
+   */
+  spec: pulumi.Input<DnsEndpointSpecArgs>;
+}
+
+export class DnsEndpoint extends k8s.apiextensions.CustomResource {
+  /**
+   * Create a new DNS endpoint resource.
+   * @param name The name of the DNS endpoint resource.
+   * @param args A bag of arguments to control the DNS endpoint creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: DnsEndpointArgs, opts?: pulumi.CustomResourceOptions) {
+    super(name, { ...args, apiVersion: "externaldns.k8s.io/v1alpha1", kind: "DNSEndpoint" }, opts);
+  }
+}

package/lib/externalDns/index.ts

@@ -0,0 +1,18 @@
+import { ExternalDnsArgs, ExternalDns } from "./operator";
+import {
+  ProviderSpecificArgs,
+  DnsEndpointsArgs,
+  DnsEndpointSpecArgs,
+  DnsEndpointArgs,
+  DnsEndpoint,
+} from "./dnsEndpoint";
+
+export {
+  ProviderSpecificArgs,
+  DnsEndpointsArgs,
+  DnsEndpointSpecArgs,
+  DnsEndpointArgs,
+  DnsEndpoint,
+  ExternalDnsArgs,
+  ExternalDns,
+};

package/lib/externalDns/operator.ts

@@ -0,0 +1,165 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common";
+import * as helm from "../kubernetes/helm";
+
+export interface CloudflareArgs {
+  /**
+   * Cloudflare API token
+   */
+  apiToken: pulumi.Input<string>;
+  /**
+   * Proxy records
+   */
+  proxied?: pulumi.Input<boolean>;
+}
+
+export interface ExternalDnsArgs {
+  /**
+   * Optional: Namespace
+   */
+  namespace?: pulumi.Input<string>;
+  /**
+   * Cluster name
+   */
+  clusterName: pulumi.Input<string>;
+  /**
+   * Optional: Number of replicas
+   */
+  replicas?: pulumi.Input<number>;
+  /**
+   * Optional: Cloudflare configuration
+   */
+  cloudflare?: pulumi.Input<CloudflareArgs>;
+}
+
+export class ExternalDns extends ComponentResource {
+  private static crdBranch = "master";
+
+  private readonly crd: k8s.yaml.ConfigFile;
+  private readonly providerSecret?: k8s.core.v1.Secret;
+  private readonly helmRelease: helm.v3.Release;
+  public readonly namespace: pulumi.Output<string>;
+
+  /**
+   * Create a new external-dns resource.
+   * @param name The name of external-dns resource.
+   * @param args A bag of arguments to control the external-dns creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: ExternalDnsArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("external-dns", name, args, opts);
+
+    opts = this.opts(k8s.Provider);
+
+    if (args.replicas === undefined) {
+      args.replicas = 1;
+    }
+
+    this.crd = new k8s.yaml.ConfigFile(
+      name,
+      {
+        file: [
+          "https://raw.githubusercontent.com/kubernetes-sigs/external-dns",
+          ExternalDns.crdBranch,
+          "docs/contributing/crd-source/crd-manifest.yaml",
+        ].join("/"),
+      },
+      opts
+    );
+
+    this.namespace = args.namespace
+      ? pulumi.output(args.namespace)
+      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
+
+    const helmValues = {
+      fullnameOverride: name,
+      logLevel: "info",
+      logFormat: "json",
+      policy: "sync",
+      registry: "txt",
+      txtOwnerId: args.clusterName,
+      txtPrefix: "_external-dns.",
+      sources: ["crd", "service", "ingress"],
+      extraArgs: ["--publish-internal-services", "--publish-host-ip"] as pulumi.Input<pulumi.Input<string>[]>,
+      env: [] as pulumi.Input<pulumi.Input<any>[]>,
+      provider: undefined as string | undefined,
+      serviceMonitor: { enabled: true },
+      affinity: {
+        podAntiAffinity: {
+          preferredDuringSchedulingIgnoredDuringExecution: [
+            {
+              weight: 100,
+              podAffinityTerm: {
+                labelSelector: {
+                  matchExpressions: [
+                    { key: "app.kubernetes.io/name", operator: "In", values: ["external-dns"] },
+                    { key: "app.kubernetes.io/instance", operator: "In", values: [name] },
+                  ],
+                },
+                topologyKey: "kubernetes.io/hostname",
+              },
+            },
+          ],
+        },
+      },
+      resources: {
+        requests: { memory: "48Mi" },
+        limits: { memory: "64Mi" },
+      },
+    };
+
+    if (args.cloudflare !== undefined) {
+      this.providerSecret = new k8s.core.v1.Secret(
+        name,
+        {
+          metadata: { namespace: this.namespace, name: pulumi.interpolate`${name}-cloudflare` },
+          stringData: {
+            cloudflare_api_token: pulumi.all([args.cloudflare]).apply(([cloudflare]) => cloudflare.apiToken),
+          },
+        },
+        opts
+      );
+
+      helmValues.provider = "cloudflare";
+
+      helmValues.extraArgs = pulumi.all([helmValues.extraArgs, args.cloudflare]).apply(([extraArgs, cloudflare]) => {
+        if (cloudflare.proxied) {
+          extraArgs.push("--cloudflare-proxied");
+        }
+
+        return extraArgs;
+      });
+
+      helmValues.env = pulumi.all([helmValues.env, args.cloudflare]).apply(([env, cloudflare]) => {
+        if (this.providerSecret !== undefined) {
+          env.push({
+            name: "CF_API_TOKEN",
+            valueFrom: {
+              secretKeyRef: {
+                name: this.providerSecret.metadata.name,
+                key: "cloudflare_api_token",
+              },
+            },
+          });
+        }
+
+        return env;
+      });
+    }
+
+    this.helmRelease = new helm.v3.Release(
+      name,
+      {
+        name,
+        namespace: this.namespace,
+        repositoryOpts: { repo: "https://kubernetes-sigs.github.io/external-dns" },
+        chart: "external-dns",
+        values: helmValues,
+      },
+      opts
+    );
+
+    this.registerOutputs();
+  }
+}

package/lib/fcos/config.ts

@@ -0,0 +1,237 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as path from "path";
+import * as fs from "fs";
+import * as compress from "zlib";
+import { ComponentResource } from "../common";
+
+export interface UserArgs {
+  name: pulumi.Input<string>;
+  groups?: pulumi.Input<pulumi.Input<string>[]>;
+  sshAuthorizedKeys?: pulumi.Input<pulumi.Input<string>[]>;
+  passwordHash?: pulumi.Input<string>;
+}
+
+export interface PartitionArgs {
+  label: pulumi.Input<string>;
+  size: pulumi.Input<number>;
+  start?: pulumi.Input<number>;
+  number?: pulumi.Input<number>;
+  resize?: pulumi.Input<boolean>;
+}
+
+export interface DiskArgs {
+  device: pulumi.Input<string>;
+  partitions: pulumi.Input<pulumi.Input<PartitionArgs>[]>;
+  wipeTable?: pulumi.Input<boolean>;
+}
+
+export interface FilesystemArgs {
+  device: pulumi.Input<string>;
+  path: pulumi.Input<string>;
+  format: pulumi.Input<string>;
+  label?: pulumi.Input<string>;
+}
+
+export interface FilesArgs {
+  path: pulumi.Input<string>;
+  contents: pulumi.Input<string>;
+  mode?: pulumi.Input<number>;
+}
+
+export interface SystemdUnitArgs {
+  name: pulumi.Input<string>;
+  enabled?: pulumi.Input<boolean>;
+  mask?: pulumi.Input<boolean>;
+  contents?: pulumi.Input<string>;
+}
+
+export interface IgnitionArgs {
+  modules?: pulumi.Input<pulumi.Input<string>[]>;
+  packages?: pulumi.Input<pulumi.Input<string>[]>;
+  users?: pulumi.Input<pulumi.Input<UserArgs>[]>;
+  disks?: pulumi.Input<pulumi.Input<DiskArgs>[]>;
+  filesystems?: pulumi.Input<pulumi.Input<FilesystemArgs>[]>;
+  files?: pulumi.Input<pulumi.Input<FilesArgs>[]>;
+  systemdUnits?: pulumi.Input<pulumi.Input<SystemdUnitArgs>[]>;
+}
+
+export interface ConfigArgs extends IgnitionArgs {
+  hostname: pulumi.Input<string>;
+}
+
+export class Config extends ComponentResource {
+  public readonly ignitionConfig: pulumi.Output<string>;
+
+  /**
+   * Create a new FCOS config resource.
+   * @param name The name of the FCOS config resource.
+   * @param args A bag of arguments to control the FCOS config creation.
+   * @param opts A bag of options that control this resource's behavior.
+   */
+  constructor(name: string, args: ConfigArgs, opts?: pulumi.ComponentResourceOptions) {
+    super("fcos:config", name, args, opts);
+
+    this.ignitionConfig = pulumi
+      .all([
+        this.defaultConfig(),
+        args.hostname,
+        args.modules,
+        args.packages,
+        args.users,
+        args.disks,
+        args.filesystems,
+        args.files,
+        args.systemdUnits,
+      ])
+      .apply(([config, hostname, modules, packages, users, disks, filesystems, files, systemdUnits]) => {
+        if (hostname !== undefined) {
+          config.storage.files.push({
+            path: "/etc/hostname",
+            contents: this.storageContents(hostname),
+            mode: 0o644,
+          });
+        }
+
+        for (const module of modules || []) {
+          config.storage.files.push({
+            path: `/etc/modules-load.d/${module}.conf`,
+            contents: this.storageContents(module),
+            mode: 0o644,
+          });
+        }
+
+        for (const pkg of packages || []) {
+          config.storage.files.push({ path: `/etc/rpm-opstree-install/${pkg}` });
+        }
+
+        for (const user of users || []) {
+          config.passwd.users.push(user);
+        }
+
+        for (const disk of disks || []) {
+          config.storage.disks.push({
+            device: disk.device,
+            partitions: disk.partitions.map((partition: PartitionArgs) => {
+              return {
+                label: partition.label,
+                size_mib: partition.size,
+                start_mib: partition.start,
+                number: partition.number,
+                resize: partition.resize,
+              };
+            }),
+            wipe_table: disk.wipeTable,
+          });
+        }
+
+        for (const filesystem of filesystems || []) {
+          config.storage.filesystems.push({
+            device: filesystem.device,
+            path: filesystem.path,
+            format: filesystem.format,
+            label: filesystem.label,
+          });
+
+          const checkSystemdName = filesystem.device.replace(/-/g, "\\x2d").replace(/^\//, "").replace(/\//g, "-");
+
+          config.systemd.units.push({
+            name: `${filesystem.path.replace(/^\//, "").replace(/\//g, "-")}.mount`,
+            enabled: true,
+            contents: [
+              "[Unit]",
+              "Before=local-fs.target",
+              `Requires=systemd-fsck@${checkSystemdName}.service`,
+              `After=systemd-fsck@${checkSystemdName}.service`,
+              "[Mount]",
+              `Where=${filesystem.path}`,
+              `What=${filesystem.device}`,
+              `Type=${filesystem.format}`,
+              "[Install]",
+              "RequiredBy=local-fs.target",
+            ].join("\n"),
+          });
+        }
+
+        for (const file of files || []) {
+          config.storage.files.push({
+            path: file.path,
+            contents: this.storageContents(file.contents),
+            mode: file.mode ?? 0o644,
+          });
+        }
+
+        for (const unit of systemdUnits || []) {
+          config.systemd.units.push(unit);
+        }
+
+        return JSON.stringify(config);
+      });
+
+    this.registerOutputs();
+  }
+
+  private defaultConfig(): any {
+    return {
+      ignition: { version: "3.3.0" },
+      passwd: {
+        users: [],
+      },
+      storage: {
+        disks: [],
+        filesystems: [],
+        directories: [{ path: "/etc/rpm-opstree-install" }],
+        files: [
+          {
+            path: "/etc/sysctl.d/20-silence-audit.conf",
+            contents: this.storageContents("kernel.printk=4"),
+            mode: 0o644,
+          },
+          {
+            overwrite: true,
+            path: "/etc/sysctl.d/10-fs-inotify.conf",
+            contents: this.storageContents(
+              "fs.inotify.max_user_instances = 8192\nfs.inotify.max_user_watches = 524288"
+            ),
+          },
+          {
+            overwrite: true,
+            path: "/etc/sysctl.d/90-ipv4-ip-forward.conf",
+            contents: this.storageContents("net.ipv4.ip_forward = 1"),
+          },
+          {
+            overwrite: true,
+            path: "/etc/sysctl.d/90-ipv6-ip-forwarding.conf",
+            contents: this.storageContents("net.ipv6.conf.all.forwarding = 1"),
+          },
+          { overwrite: false, path: "/etc/systemd/resolved.conf", append: [this.storageContents("LLMNR=no")] },
+          {
+            path: "/usr/local/sbin/rpm-opstree-install",
+            contents: this.storageContents(this.assetContent("rpm-opstree-install.sh")),
+            mode: 0o755,
+          },
+        ],
+      },
+      systemd: {
+        units: [
+          {
+            name: "rpm-ostree-install.service",
+            enabled: true,
+            contents: this.assetContent("rpm-ostree-install.service"),
+          },
+        ],
+      },
+    };
+  }
+
+  private assetContent(filename: string): string {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    return fs.readFileSync(path.join(__dirname, "assets", filename), "utf-8");
+  }
+
+  private storageContents(data: string): { compression: string; source: string } {
+    return {
+      compression: "gzip",
+      source: `data:;base64,${compress.gzipSync(Buffer.from(data), { level: 9 }).toString("base64")}`,
+    };
+  }
+}