@ydkn/pulumi-components 0.4.3 → 0.4.5

package/lib/ubuntu/deployment.ts

@@ -1,275 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as tls from "@pulumi/tls";
-import * as k8s from "@pulumi/kubernetes";
-import * as path from "path";
-import * as fs from "fs";
-import { ComponentResource } from "../common";
-import * as kubernetes from "../kubernetes";
-
-export interface UbuntuArgs {
-  namespace?: pulumi.Input<string>;
-  hostname?: pulumi.Input<string>;
-  authorizedKeys?: pulumi.Input<pulumi.Input<string>[]>;
-  packages?: pulumi.Input<pulumi.Input<string>[]>;
-  volumes?: pulumi.Input<pulumi.Input<k8s.types.input.core.v1.Volume>[]>;
-  volumeMounts?: pulumi.Input<pulumi.Input<k8s.types.input.core.v1.VolumeMount>[]>;
-  nodeSelector?: pulumi.Input<{ [key: string]: pulumi.Input<string> }>;
-  replicas?: pulumi.Input<number>;
-  hostNetwork?: pulumi.Input<boolean>;
-}
-
-export class Ubuntu extends ComponentResource {
-  private static readonly sshContainerPort = 22;
-
-  private readonly sshPrivateKeysRSA: tls.PrivateKey;
-  private readonly sshPrivateKeysECDSA: tls.PrivateKey;
-  private readonly sshPrivateKeysED25519: tls.PrivateKey;
-  private readonly serviceAccount: k8s.core.v1.ServiceAccount;
-  private readonly clusterRole: k8s.rbac.v1.ClusterRole;
-  private readonly clusterRoleBinding: k8s.rbac.v1.ClusterRoleBinding;
-  private readonly initScript: k8s.core.v1.ConfigMap;
-  private readonly sshSecret: k8s.core.v1.Secret;
-  private readonly deployment: k8s.apps.v1.Deployment;
-  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
-  private readonly service: kubernetes.v1.Service;
-  public readonly namespace: pulumi.Output<string>;
-
-  /**
-   * Create a new Ubuntu resource.
-   * @param name The name of the Ubuntu resource.
-   * @param args A bag of arguments to control the Ubuntu creation.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: UbuntuArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("ubuntu", name, args, opts);
-
-    const emptyOpts = this.opts();
-    const k8sOpts = this.opts(k8s.Provider);
-
-    if (args.replicas === undefined) {
-      args.replicas = 1;
-    }
-
-    this.sshPrivateKeysRSA = new tls.PrivateKey(`${name}-rsa`, { algorithm: "RSA", rsaBits: 8192 }, emptyOpts);
-    this.sshPrivateKeysECDSA = new tls.PrivateKey(
-      `${name}-ecdsa`,
-      { algorithm: "ECDSA", ecdsaCurve: "P521" },
-      emptyOpts
-    );
-    this.sshPrivateKeysED25519 = new tls.PrivateKey(`${name}-ed25519`, { algorithm: "ED25519" }, emptyOpts);
-
-    this.namespace = args.namespace
-      ? pulumi.output(args.namespace)
-      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
-
-    const metadata = {
-      name,
-      namespace: this.namespace,
-      labels: {
-        "app.kubernetes.io/name": "ubuntu",
-        "app.kubernetes.io/component": "ubuntu",
-        "app.kubernetes.io/instance": name,
-      },
-    };
-
-    this.serviceAccount = new k8s.core.v1.ServiceAccount(name, { metadata }, k8sOpts);
-
-    this.clusterRole = new k8s.rbac.v1.ClusterRole(
-      name,
-      {
-        metadata,
-        rules: [{ apiGroups: ["*"], resources: ["*"], verbs: ["*"] }],
-      },
-      k8sOpts
-    );
-
-    this.clusterRoleBinding = new k8s.rbac.v1.ClusterRoleBinding(
-      name,
-      {
-        metadata,
-        subjects: [
-          {
-            kind: this.serviceAccount.kind,
-            namespace: this.serviceAccount.metadata.namespace,
-            name: this.serviceAccount.metadata.name,
-          },
-        ],
-        roleRef: {
-          apiGroup: "rbac.authorization.k8s.io",
-          kind: this.clusterRole.kind,
-          name: this.clusterRole.metadata.name,
-        },
-      },
-      k8sOpts
-    );
-
-    this.initScript = new k8s.core.v1.ConfigMap(
-      name,
-      {
-        metadata: { ...metadata, name: pulumi.interpolate`${name}-init` },
-        data: {
-          // eslint-disable-next-line security/detect-non-literal-fs-filename
-          "init.sh": fs.readFileSync(path.join(__dirname, "assets", "init.sh"), "utf-8"),
-          "packages.txt": pulumi
-            .all([args.packages])
-            .apply(([packages]) => pulumi.all(packages ?? []).apply((packages) => packages.join(" "))),
-        },
-      },
-      k8sOpts
-    );
-
-    this.sshSecret = new k8s.core.v1.Secret(
-      name,
-      {
-        metadata: { ...metadata, name: pulumi.interpolate`${name}-ssh` },
-        stringData: {
-          ssh_host_rsa_key: this.sshPrivateKeysRSA.privateKeyOpenssh,
-          "ssh_host_rsa_key.pub": this.sshPrivateKeysRSA.publicKeyOpenssh,
-          ssh_host_ecdsa_key: this.sshPrivateKeysECDSA.privateKeyOpenssh,
-          "ssh_host_ecdsa_key.pub": this.sshPrivateKeysECDSA.publicKeyOpenssh,
-          ssh_host_ed25519_key: this.sshPrivateKeysED25519.privateKeyOpenssh,
-          "ssh_host_ed25519_key.pub": this.sshPrivateKeysED25519.publicKeyOpenssh,
-          authorized_keys: pulumi
-            .all([args.authorizedKeys])
-            .apply(([authorizedKeys]) =>
-              pulumi.all(authorizedKeys ?? []).apply((authorizedKeys) => authorizedKeys.join("\n"))
-            ),
-        },
-      },
-      k8sOpts
-    );
-
-    this.deployment = new k8s.apps.v1.Deployment(
-      name,
-      {
-        metadata,
-        spec: {
-          selector: { matchLabels: metadata.labels },
-          strategy: { type: "Recreate" },
-          replicas: args.replicas,
-          template: {
-            metadata: { labels: metadata.labels },
-            spec: {
-              securityContext: { runAsUser: 0, runAsGroup: 0, fsGroup: 0 },
-              serviceAccountName: this.serviceAccount.metadata.name,
-              nodeSelector: args.nodeSelector,
-              hostNetwork: args.hostNetwork,
-              containers: [
-                {
-                  name: "ubuntu",
-                  image: "ubuntu:rolling",
-                  imagePullPolicy: "Always",
-                  command: ["/run/k8s/init/init.sh"],
-                  env: [
-                    { name: "KUBERNETES_NODE_NAME", valueFrom: { fieldRef: { fieldPath: "spec.nodeName" } } },
-                    { name: "KUBERNETES_POD_NAMESPACE", valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } },
-                    { name: "KUBERNETES_POD_NAME", valueFrom: { fieldRef: { fieldPath: "metadata.name" } } },
-                    { name: "KUBERNETES_POD_IP", valueFrom: { fieldRef: { fieldPath: "status.podIP" } } },
-                  ],
-                  ports: [{ name: "ssh", containerPort: Ubuntu.sshContainerPort, protocol: "TCP" }],
-                  resources: {
-                    requests: { memory: "128Mi" },
-                    limits: { memory: "256Mi" },
-                  },
-                  startupProbe: {
-                    periodSeconds: 30,
-                    timeoutSeconds: 3,
-                    successThreshold: 1,
-                    failureThreshold: 30,
-                    tcpSocket: { port: "ssh" },
-                  },
-                  livenessProbe: {
-                    periodSeconds: 30,
-                    timeoutSeconds: 3,
-                    successThreshold: 1,
-                    failureThreshold: 3,
-                    tcpSocket: { port: "ssh" },
-                  },
-                  volumeMounts: pulumi.all([args.volumeMounts]).apply(([volumeMounts]) => {
-                    return (
-                      [
-                        { name: "init", mountPath: "/run/k8s/init" },
-                        { name: "ssh", mountPath: "/run/k8s/ssh" },
-                      ] as k8s.types.input.core.v1.VolumeMount[]
-                    ).concat(volumeMounts ?? []);
-                  }),
-                },
-              ],
-              volumes: pulumi.all([args.volumes]).apply(([volumes]) => {
-                return (
-                  [
-                    { name: "init", configMap: { name: this.initScript.metadata.name, defaultMode: 0o755 } },
-                    { name: "ssh", secret: { secretName: this.sshSecret.metadata.name, defaultMode: 0o400 } },
-                  ] as k8s.types.input.core.v1.Volume[]
-                ).concat(volumes ?? []);
-              }),
-              tolerations: [
-                { key: "node-role.kubernetes.io/master", operator: "Exists", effect: "NoSchedule" },
-                { key: "node-role.kubernetes.io/control-plane", operator: "Exists", effect: "NoSchedule" },
-              ],
-              affinity: {
-                podAntiAffinity: {
-                  preferredDuringSchedulingIgnoredDuringExecution: [
-                    {
-                      weight: 100,
-                      podAffinityTerm: {
-                        labelSelector: {
-                          matchExpressions: [
-                            {
-                              key: "app.kubernetes.io/name",
-                              operator: "In",
-                              values: [metadata.labels["app.kubernetes.io/name"]],
-                            },
-                            {
-                              key: "app.kubernetes.io/component",
-                              operator: "In",
-                              values: [metadata.labels["app.kubernetes.io/component"]],
-                            },
-                            {
-                              key: "app.kubernetes.io/instance",
-                              operator: "In",
-                              values: [metadata.labels["app.kubernetes.io/instance"]],
-                            },
-                          ],
-                        },
-                        topologyKey: "kubernetes.io/hostname",
-                      },
-                    },
-                  ],
-                },
-              },
-            },
-          },
-        },
-      },
-      k8sOpts
-    );
-
-    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
-      name,
-      {
-        metadata,
-        spec: {
-          minAvailable: 1,
-          selector: { matchLabels: metadata.labels },
-        },
-      },
-      k8sOpts
-    );
-
-    this.service = new kubernetes.v1.Service(
-      name,
-      {
-        metadata,
-        spec: {
-          selector: metadata.labels,
-          ports: [{ name: "ssh", port: 22, targetPort: "ssh" }],
-        },
-        hostnames: args.hostname ? [args.hostname] : undefined,
-      },
-      { ...k8sOpts, dependsOn: [this.deployment] }
-    );
-
-    this.registerOutputs();
-  }
-}

package/lib/unifi/controller.ts

@@ -1,234 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as k8s from "@pulumi/kubernetes";
-import { ComponentResource } from "../common";
-import * as kubernetes from "../kubernetes";
-import * as traefik from "../traefik";
-
-export interface UnifiControllerArgs {
-  namespace?: pulumi.Input<string>;
-  ingressClassName?: pulumi.Input<string>;
-  hostname: pulumi.Input<string>;
-  informHostname: pulumi.Input<string>;
-  storageClassName?: pulumi.Input<string>;
-  storage?: pulumi.Input<string>;
-  protect?: boolean;
-}
-
-export class UnifiController extends ComponentResource {
-  private readonly volumeClaim: k8s.core.v1.PersistentVolumeClaim;
-  private readonly deployment: k8s.apps.v1.Deployment;
-  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
-  private readonly service: kubernetes.v1.Service;
-  private readonly ingress: traefik.SecureIngress;
-  public readonly namespace: pulumi.Output<string>;
-  public readonly informUrl: pulumi.Output<string>;
-
-  /**
-   * Create a new UniFi controller resource.
-   * @param name The name of the UniFi controller resource.
-   * @param args A bag of arguments to control the UniFi controller creation.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: UnifiControllerArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("unifi:controller", name, args, opts);
-
-    opts = this.opts(k8s.Provider);
-
-    if (args.storage === undefined) {
-      args.storage = "10Gi";
-    }
-
-    this.namespace = args.namespace
-      ? pulumi.output(args.namespace)
-      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
-
-    const metadata = {
-      name: pulumi.interpolate`${name}-controller`,
-      namespace: this.namespace,
-      labels: {
-        "app.kubernetes.io/name": "unifi",
-        "app.kubernetes.io/component": "controller",
-        "app.kubernetes.io/instance": name,
-      },
-    };
-
-    const volumeClaimName = `${name}-controller-data`;
-
-    this.volumeClaim = new k8s.core.v1.PersistentVolumeClaim(
-      name,
-      {
-        metadata: { ...metadata, name: volumeClaimName },
-        spec: {
-          accessModes: ["ReadWriteOnce"],
-          storageClassName: args.storageClassName,
-          resources: { requests: { storage: args.storage } },
-        },
-      },
-      { ...opts, protect: args.protect }
-    );
-
-    this.deployment = new k8s.apps.v1.Deployment(
-      name,
-      {
-        metadata,
-        spec: {
-          selector: { matchLabels: metadata.labels },
-          strategy: { type: "Recreate" },
-          replicas: 1,
-          template: {
-            metadata: {
-              labels: metadata.labels,
-              annotations: {
-                "backup.velero.io/backup-volumes": "backup",
-                "pre.hook.backup.velero.io/command":
-                  '["/bin/sh", "-c", "rm -rf /backup/* && cp -rp /config/data/backup/* /backup/"]',
-                "pre.hook.backup.velero.io/container": "controller",
-                "pre.hook.backup.velero.io/timeout": "5m",
-              },
-            },
-            spec: {
-              containers: [
-                {
-                  name: "controller",
-                  image: "ghcr.io/linuxserver/unifi-controller:latest",
-                  imagePullPolicy: "Always",
-                  securityContext: { runAsNonRoot: false },
-                  env: [{ name: "MEM_LIMIT", value: "896M" }],
-                  ports: [
-                    { protocol: "UDP", containerPort: 3478, name: "p3478" },
-                    { protocol: "UDP", containerPort: 10001, name: "p10001" },
-                    { protocol: "TCP", containerPort: 8080, name: "p8080" },
-                    { protocol: "TCP", containerPort: 8081, name: "p8081" },
-                    { protocol: "TCP", containerPort: 8443, name: "p8443" },
-                    { protocol: "TCP", containerPort: 8843, name: "p8843" },
-                    { protocol: "TCP", containerPort: 8880, name: "p8880" },
-                    { protocol: "TCP", containerPort: 6789, name: "p6789" },
-                  ],
-                  livenessProbe: {
-                    httpGet: { path: "/", port: "p8443", scheme: "HTTPS" },
-                    initialDelaySeconds: 60,
-                    periodSeconds: 30,
-                    failureThreshold: 6,
-                  },
-                  readinessProbe: {
-                    httpGet: { path: "/", port: "p8443", scheme: "HTTPS" },
-                    initialDelaySeconds: 60,
-                    periodSeconds: 20,
-                    failureThreshold: 3,
-                  },
-                  volumeMounts: [
-                    { name: "data", mountPath: "/config/data" },
-                    { name: "backup", mountPath: "/backup" },
-                  ],
-                  resources: {
-                    requests: { memory: "768Mi" },
-                    limits: { memory: "1024Mi" },
-                  },
-                },
-              ],
-              volumes: [
-                { name: "data", persistentVolumeClaim: { claimName: volumeClaimName } },
-                { name: "backup", emptyDir: {} },
-              ],
-              affinity: {
-                podAntiAffinity: {
-                  preferredDuringSchedulingIgnoredDuringExecution: [
-                    {
-                      weight: 100,
-                      podAffinityTerm: {
-                        labelSelector: {
-                          matchExpressions: [
-                            {
-                              key: "app.kubernetes.io/name",
-                              operator: "In",
-                              values: [metadata.labels["app.kubernetes.io/name"]],
-                            },
-                            {
-                              key: "app.kubernetes.io/component",
-                              operator: "In",
-                              values: [metadata.labels["app.kubernetes.io/component"]],
-                            },
-                            {
-                              key: "app.kubernetes.io/instance",
-                              operator: "In",
-                              values: [metadata.labels["app.kubernetes.io/instance"]],
-                            },
-                          ],
-                        },
-                        topologyKey: "kubernetes.io/hostname",
-                      },
-                    },
-                  ],
-                },
-              },
-            },
-          },
-        },
-      },
-      opts
-    );
-
-    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
-      name,
-      {
-        metadata,
-        spec: {
-          minAvailable: 1,
-          selector: { matchLabels: metadata.labels },
-        },
-      },
-      opts
-    );
-
-    this.service = new kubernetes.v1.Service(
-      name,
-      {
-        hostnames: [args.informHostname],
-        metadata,
-        spec: {
-          selector: metadata.labels,
-          ports: [
-            { protocol: "UDP", port: 3478, name: "p3478" },
-            { protocol: "TCP", port: 6789, name: "p6789" },
-            { protocol: "TCP", port: 8080, name: "p8080" },
-            { protocol: "TCP", port: 8081, name: "p8081" },
-            { protocol: "TCP", port: 8443, name: "https" },
-            { protocol: "TCP", port: 8843, name: "p8843" },
-            { protocol: "TCP", port: 8880, name: "p8880" },
-            { protocol: "UDP", port: 10001, name: "p10001" },
-          ],
-        },
-      },
-      { ...opts, dependsOn: [this.deployment] }
-    );
-
-    this.ingress = new traefik.SecureIngress(
-      name,
-      {
-        metadata,
-        spec: {
-          ingressClassName: args.ingressClassName,
-          rules: [
-            {
-              host: args.hostname,
-              http: {
-                paths: [
-                  {
-                    path: "/",
-                    pathType: "Prefix",
-                    backend: { service: { name: this.service.metadata.name, port: { name: "https" } } },
-                  },
-                ],
-              },
-            },
-          ],
-        },
-      },
-      opts
-    );
-
-    this.informUrl = pulumi.concat("http://", args.informHostname, ":8080", "/inform");
-
-    this.registerOutputs();
-  }
-}

package/lib/velero/operator.ts

@@ -1,182 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as random from "@pulumi/random";
-import * as k8s from "@pulumi/kubernetes";
-import * as aws from "@pulumi/aws";
-import { ComponentResource } from "../common";
-import * as helm from "../kubernetes/helm";
-import { Bucket } from "../aws";
-
-export interface VeleroArgs {
-  /**
-   * Optional: Namespace
-   */
-  namespace?: pulumi.Input<string>;
-  /**
-   * Cluster name
-   */
-  clusterName: pulumi.Input<string>;
-  /**
-   * Optional: Protect critical resources
-   */
-  protect?: boolean;
-}
-
-export class Velero extends ComponentResource {
-  private readonly resticPasswordSecret: k8s.core.v1.Secret;
-  private readonly helmRelease: helm.v3.Release;
-  private readonly bucket: Bucket;
-  public readonly resticPassword: pulumi.Output<string>;
-  public readonly namespace: pulumi.Output<string>;
-
-  /**
-   * Create a new Velero resource.
-   * @param name The name of the Velero resource.
-   * @param args A bag of arguments to control the Velero creation.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: VeleroArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("velero", name, {}, opts);
-
-    const emptyOpts = this.opts();
-    const awsOpts = this.opts(aws.Provider);
-    const k8sOpts = this.opts(k8s.Provider);
-
-    this.bucket = new Bucket(
-      name,
-      { name: pulumi.interpolate`${name}-${args.clusterName}`, protect: args.protect },
-      awsOpts
-    );
-
-    this.resticPassword = pulumi.secret(
-      new random.RandomPassword(name, { length: 64, special: false }, emptyOpts).result
-    );
-
-    this.namespace = args.namespace
-      ? pulumi.output(args.namespace)
-      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
-
-    const metadata = {
-      name,
-      namespace: this.namespace,
-      labels: {
-        "app.kubernetes.io/name": "velero",
-        "app.kubernetes.io/component": "velero",
-        "app.kubernetes.io/instance": name,
-      },
-    };
-
-    this.resticPasswordSecret = new k8s.core.v1.Secret(
-      name,
-      {
-        metadata: { ...metadata, name: pulumi.interpolate`${name}-restic-credentials` },
-        stringData: {
-          "repository-password": this.resticPassword,
-        },
-      },
-      k8sOpts
-    );
-
-    this.helmRelease = new helm.v3.Release(
-      name,
-      {
-        name: metadata.name,
-        namespace: metadata.namespace,
-        repositoryOpts: { repo: "https://vmware-tanzu.github.io/helm-charts" },
-        chart: "velero",
-        values: {
-          fullnameOverride: name,
-          backupsEnabled: true,
-          snapshotsEnabled: false,
-          deployRestic: true,
-          configuration: {
-            provider: "aws",
-            backupStorageLocation: {
-              name: "default",
-              provider: "aws",
-              bucket: this.bucket.bucket.id,
-              config: {
-                region: this.bucket.bucket.region,
-              },
-            },
-          },
-          credentials: {
-            extraEnvVars: {
-              AWS_ACCESS_KEY_ID: this.bucket.accessKey.accessKey.id,
-              AWS_SECRET_ACCESS_KEY: this.bucket.accessKey.accessKey.secret,
-              AWS_DEFAULT_REGION: this.bucket.bucket.region,
-            },
-          },
-          restic: {
-            privileged: true,
-            resources: {
-              requests: { memory: "192Mi" },
-              limits: { memory: "256Mi" },
-            },
-            tolerations: [
-              { key: "node-role.kubernetes.io/master", operator: "Exists", effect: "NoSchedule" },
-              { key: "node-role.kubernetes.io/control-plane", operator: "Exists", effect: "NoSchedule" },
-            ],
-          },
-          initContainers: [
-            {
-              name: "velero-plugin-for-aws",
-              image: "velero/velero-plugin-for-aws:latest",
-              volumeMounts: [{ name: "plugins", mountPath: "/target" }],
-              resources: {
-                requests: { memory: "32Mi" },
-                limits: { memory: "48Mi" },
-              },
-            },
-          ],
-          schedules: {
-            daily: {
-              schedule: "0 2 * * *",
-              template: {
-                ttl: "170h", // ~7 days
-              },
-            },
-            weekly: {
-              schedule: "0 3 * * 0",
-              template: {
-                ttl: "730h", // ~4 weeks
-              },
-            },
-            monthly: {
-              schedule: "0 4 1 * *",
-              template: {
-                ttl: "2200h", // ~3 months
-              },
-            },
-          },
-          affinity: {
-            podAntiAffinity: {
-              preferredDuringSchedulingIgnoredDuringExecution: [
-                {
-                  weight: 100,
-                  podAffinityTerm: {
-                    labelSelector: {
-                      matchExpressions: [
-                        { key: "app.kubernetes.io/name", operator: "In", values: ["velero"] },
-                        { key: "app.kubernetes.io/instance", operator: "In", values: [name] },
-                      ],
-                    },
-                    topologyKey: "kubernetes.io/hostname",
-                  },
-                },
-              ],
-            },
-          },
-          resources: {
-            requests: { memory: "256Mi" },
-            limits: { memory: "512Mi" },
-          },
-          metrics: { serviceMonitor: { enabled: true } },
-          kubectl: { image: { repository: "appscode/kubectl", tag: "v1.23" } },
-        },
-      },
-      k8sOpts
-    );
-
-    this.registerOutputs();
-  }
-}