@ydkn/pulumi-components 0.4.4 → 0.4.6

package/lib/freeradius/deployment.ts

@@ -1,244 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as random from "@pulumi/random";
-import * as k8s from "@pulumi/kubernetes";
-import * as path from "path";
-import * as templateFile from "template-file";
-import { ComponentResource } from "../common";
-import * as kubernetes from "../kubernetes";
-import * as certManager from "../certManager";
-
-export interface LdapArgs {
-  hostname: pulumi.Input<string>;
-  username: pulumi.Input<string>;
-  password: pulumi.Input<string>;
-  baseDN: pulumi.Input<string>;
-}
-
-export interface FreeRadiusServerArgs {
-  namespace?: pulumi.Input<string>;
-  hostname: pulumi.Input<string>;
-  domain: pulumi.Input<string>;
-  ldap: pulumi.Input<LdapArgs>;
-  resources?: pulumi.Input<k8s.types.input.core.v1.ResourceRequirements>;
-  protect?: boolean;
-}
-
-export class FreeRadiusServer extends ComponentResource {
-  private readonly localSecret: pulumi.Output<string>;
-  private readonly configs: k8s.core.v1.Secret;
-  private readonly issuer: certManager.Issuer;
-  private readonly caCertificate: certManager.Certificate;
-  private readonly caIssuer: certManager.Issuer;
-  private readonly certificate: certManager.Certificate;
-  private readonly deployment: k8s.apps.v1.Deployment;
-  private readonly podDisruptionBudget: k8s.policy.v1.PodDisruptionBudget;
-  private readonly service: kubernetes.v1.Service;
-  public readonly namespace: pulumi.Output<string>;
-  public readonly clientSecret: pulumi.Output<string>;
-  public readonly ip: pulumi.Output<string>;
-
-  /**
-   * Create a new FreeRadius server resource.
-   * @param name The name of the FreeRadius server resource.
-   * @param args A bag of arguments to control the FreeRadius server creation.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: FreeRadiusServerArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("freeradius", name, args, opts);
-
-    if (args.resources === undefined) {
-      args.resources = { requests: { memory: "96Mi" }, limits: { memory: "128Mi" } };
-    }
-
-    const emptyOpts = this.opts();
-    const k8sOpts = this.opts(k8s.Provider);
-
-    this.namespace = args.namespace
-      ? pulumi.output(args.namespace)
-      : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
-
-    const metadata = {
-      name,
-      namespace: this.namespace,
-      labels: {
-        "app.kubernetes.io/name": "freeradius",
-        "app.kubernetes.io/component": "freeradius",
-        "app.kubernetes.io/instance": name,
-      },
-    };
-
-    this.localSecret = pulumi.secret(
-      new random.RandomString(`${name}-local-secret`, { special: false, length: 48 }, emptyOpts).result
-    );
-
-    this.clientSecret = pulumi.secret(
-      new random.RandomString(
-        `${name}-client-secret`,
-        { special: false, length: 48 },
-        { ...emptyOpts, protect: args.protect }
-      ).result
-    );
-
-    this.configs = new k8s.core.v1.Secret(
-      `${name}-configs`,
-      {
-        metadata: { ...metadata, name: pulumi.interpolate`${name}-configs` },
-        stringData: pulumi
-          .all([args.domain, args.ldap, this.localSecret, this.clientSecret])
-          .apply(([domain, ldap, localSecret, clientSecret]) => {
-            const vars = {
-              ldap: { hostname: ldap.hostname, username: ldap.username, password: ldap.password, baseDN: ldap.baseDN },
-              domain,
-              localSecret,
-              clientSecret,
-            };
-
-            return {
-              default: FreeRadiusServer.renderAssetTemplate("default", vars),
-              eap: FreeRadiusServer.renderAssetTemplate("eap", vars),
-              "inner-tunnel": FreeRadiusServer.renderAssetTemplate("inner-tunnel", vars),
-              ldap: FreeRadiusServer.renderAssetTemplate("ldap", vars),
-              "proxy.conf": FreeRadiusServer.renderAssetTemplate("proxy.conf", vars),
-              "clients.conf": FreeRadiusServer.renderAssetTemplate("clients.conf", vars),
-            };
-          }),
-      },
-      k8sOpts
-    );
-
-    this.issuer = new certManager.Issuer(name, { metadata, spec: { selfSigned: {} } }, k8sOpts);
-
-    this.caCertificate = new certManager.Certificate(
-      `${name}-ca`,
-      {
-        metadata: { ...metadata, name: pulumi.interpolate`${name}-ca` },
-        spec: {
-          isCA: true,
-          commonName: "RADIUS",
-          dnsNames: [args.hostname],
-          duration: "876000h", // 100y
-          renewBefore: "8760h", // 1y
-          privateKey: { algorithm: "RSA", size: 4096, rotationPolicy: "Always" },
-          issuerRef: { kind: this.issuer.kind, name: this.issuer.metadata.name },
-        },
-      },
-      k8sOpts
-    );
-
-    this.caIssuer = new certManager.Issuer(
-      `${name}-ca`,
-      {
-        metadata: { ...metadata, name: pulumi.interpolate`${name}-ca` },
-        spec: { ca: { secretName: this.caCertificate.secretName } },
-      },
-      k8sOpts
-    );
-
-    this.certificate = new certManager.Certificate(
-      name,
-      {
-        metadata,
-        spec: {
-          isCA: true,
-          commonName: args.hostname,
-          dnsNames: [args.hostname],
-          duration: "87600h", // 10y
-          renewBefore: "2160h", // 90d
-          privateKey: { algorithm: "RSA", size: 4096, rotationPolicy: "Always" },
-          issuerRef: { kind: this.caIssuer.kind, name: this.caIssuer.metadata.name },
-        },
-      },
-      k8sOpts
-    );
-
-    this.deployment = new k8s.apps.v1.Deployment(
-      name,
-      {
-        metadata,
-        spec: {
-          selector: { matchLabels: metadata.labels },
-          strategy: { type: "Recreate" },
-          replicas: 1,
-          template: {
-            metadata: {
-              labels: metadata.labels,
-              annotations: { "backup.velero.io/backup-volumes": "data" },
-            },
-            spec: {
-              containers: [
-                {
-                  name: "freeradius",
-                  image: "freeradius/freeradius-server:latest-alpine",
-                  imagePullPolicy: "Always",
-                  ports: [
-                    { name: "radius", containerPort: 1812, protocol: "UDP" },
-                    { name: "radius-acct", containerPort: 1813, protocol: "UDP" },
-                  ],
-                  resources: args.resources,
-                  volumeMounts: [
-                    { name: "configs", mountPath: "/opt/etc/raddb/sites-enabled/default", subPath: "default" },
-                    { name: "configs", mountPath: "/opt/etc/raddb/mods-enabled/eap", subPath: "eap" },
-                    {
-                      name: "configs",
-                      mountPath: "/opt/etc/raddb/sites-enabled/inner-tunnel",
-                      subPath: "inner-tunnel",
-                    },
-                    { name: "configs", mountPath: "/opt/etc/raddb/mods-enabled/ldap", subPath: "ldap" },
-                    { name: "configs", mountPath: "/opt/etc/raddb/proxy.conf", subPath: "proxy.conf" },
-                    { name: "configs", mountPath: "/opt/etc/raddb/clients.conf", subPath: "clients.conf" },
-
-                    { name: "ca-tls", mountPath: "/opt/etc/raddb/certs/ca.crt", subPath: "tls.crt" },
-                    { name: "tls", mountPath: "/opt/etc/raddb/certs/server.crt", subPath: "tls.crt" },
-                    { name: "tls", mountPath: "/opt/etc/raddb/certs/server.key", subPath: "tls.key" },
-                  ],
-                },
-              ],
-              volumes: [
-                { name: "configs", secret: { secretName: this.configs.metadata.name } },
-                { name: "ca-tls", secret: { secretName: this.caCertificate.secretName } },
-                { name: "tls", secret: { secretName: this.certificate.secretName } },
-              ],
-            },
-          },
-        },
-      },
-      k8sOpts
-    );
-
-    this.podDisruptionBudget = new k8s.policy.v1.PodDisruptionBudget(
-      name,
-      {
-        metadata,
-        spec: {
-          minAvailable: 1,
-          selector: { matchLabels: metadata.labels },
-        },
-      },
-      k8sOpts
-    );
-
-    this.service = new kubernetes.v1.Service(
-      name,
-      {
-        metadata,
-        spec: {
-          selector: metadata.labels,
-          ports: [
-            { name: "radius", port: 1812, targetPort: "radius", protocol: "UDP" },
-            { name: "radius-acct", port: 1813, targetPort: "radius-acct", protocol: "UDP" },
-          ],
-        },
-        hostnames: [args.hostname],
-      },
-      { ...k8sOpts, dependsOn: [this.deployment] }
-    );
-
-    this.ip = this.service.spec.clusterIP;
-
-    this.registerOutputs();
-  }
-
-  private static renderAssetTemplate(filename: string, data: templateFile.Data): pulumi.Output<string> {
-    return pulumi.output(templateFile.renderFile(path.join(__dirname, "assets", `${filename}.tmpl`), data));
-  }
-}

package/lib/gitlab/project.ts

@@ -1,148 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as gitlab from "@pulumi/gitlab";
-import { ComponentResource } from "../common";
-
-export interface ProjectArgs extends gitlab.ProjectArgs {
-  protect?: boolean;
-}
-
-export class Project extends ComponentResource {
-  private readonly project: gitlab.Project;
-  private readonly pipelineBadge: gitlab.ProjectBadge;
-
-  /**
-   * Create a new GitLab project resource.
-   * @param name The name of the GitLab project resource.
-   * @param args A bag of arguments to control the GitLab project creation.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: ProjectArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("gitlab:project", name, args, opts);
-
-    opts = this.opts(gitlab.Provider);
-
-    if (args.autoCancelPendingPipelines === undefined) {
-      args.autoCancelPendingPipelines = "enabled";
-    }
-
-    if (args.autoDevopsEnabled === undefined) {
-      args.autoDevopsEnabled = false;
-    }
-
-    if (args.autocloseReferencedIssues === undefined) {
-      args.autocloseReferencedIssues = true;
-    }
-
-    if (args.buildsAccessLevel === undefined) {
-      args.buildsAccessLevel = "private";
-    }
-
-    if (args.containerRegistryEnabled === undefined) {
-      args.containerRegistryEnabled = true;
-    }
-
-    args.containerExpirationPolicy = pulumi
-      .all([args.containerRegistryEnabled, args.containerExpirationPolicy])
-      .apply(([enabled, policy]) => {
-        if (enabled && policy === undefined) {
-          return {
-            enabled: true,
-            cadence: "7d",
-            olderThan: "14d",
-            keepN: 10,
-            nameRegexDelete: ".*",
-            nameRegexKeep: "^v\\d(\\.\\d)+$",
-          };
-        } else {
-          return {};
-        }
-      });
-
-    if (args.defaultBranch === undefined) {
-      args.defaultBranch = "main";
-    }
-
-    if (args.initializeWithReadme === undefined) {
-      args.initializeWithReadme = false;
-    }
-
-    if (args.issuesEnabled === undefined) {
-      args.issuesEnabled = true;
-    }
-
-    if (args.lfsEnabled === undefined) {
-      args.lfsEnabled = false;
-    }
-
-    if (args.mergeRequestsEnabled === undefined) {
-      args.mergeRequestsEnabled = true;
-    }
-
-    if (args.onlyAllowMergeIfAllDiscussionsAreResolved === undefined) {
-      args.onlyAllowMergeIfAllDiscussionsAreResolved = true;
-    }
-
-    if (args.onlyAllowMergeIfPipelineSucceeds === undefined) {
-      args.onlyAllowMergeIfPipelineSucceeds = true;
-    }
-
-    if (args.operationsAccessLevel === undefined) {
-      args.operationsAccessLevel = "disabled";
-    }
-
-    if (args.packagesEnabled === undefined) {
-      args.packagesEnabled = false;
-    }
-
-    if (args.pagesAccessLevel === undefined) {
-      args.pagesAccessLevel = "disabled";
-    }
-
-    if (args.pipelinesEnabled === undefined) {
-      args.pipelinesEnabled = true;
-    }
-
-    if (args.printingMergeRequestLinkEnabled === undefined) {
-      args.printingMergeRequestLinkEnabled = true;
-    }
-
-    if (args.removeSourceBranchAfterMerge === undefined) {
-      args.removeSourceBranchAfterMerge = true;
-    }
-
-    if (args.sharedRunnersEnabled === undefined) {
-      args.sharedRunnersEnabled = true;
-    }
-
-    if (args.snippetsEnabled === undefined) {
-      args.snippetsEnabled = false;
-    }
-
-    if (args.squashOption === undefined) {
-      args.squashOption = "default_on";
-    }
-
-    if (args.visibilityLevel === undefined) {
-      args.visibilityLevel = "private";
-    }
-
-    if (args.wikiEnabled === undefined) {
-      args.wikiEnabled = false;
-    }
-
-    this.project = new gitlab.Project(name, args, { ...opts, protect: args.protect });
-
-    this.pipelineBadge = new gitlab.ProjectBadge(
-      `${name}-pipeline-badge`,
-      {
-        project: this.project.id,
-        name: "Pipeline Status",
-        linkUrl: "https://gitlab.com/%{project_path}/pipelines",
-        imageUrl: "https://gitlab.com/%{project_path}/badges/main/pipeline.svg",
-      },
-      opts
-    );
-
-    this.registerOutputs();
-  }
-}

package/lib/gitlab/renovate.ts

@@ -1,98 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as k8s from "@pulumi/kubernetes";
-import { ComponentResource } from "../common";
-
-export interface RenovateArgs {
-  namespace?: pulumi.Input<string>;
-  accessToken: pulumi.Input<string>;
-  githubAccessToken?: pulumi.Input<string>;
-  schedule?: pulumi.Input<string>;
-  resources?: pulumi.Input<k8s.types.input.core.v1.ResourceRequirements>;
-}
-
-export class Renovate extends ComponentResource {
-  private readonly secret: k8s.core.v1.Secret;
-  private readonly cronjob: k8s.batch.v1.CronJob;
-  public readonly namespace: pulumi.Output<string>;
-
-  /**
-   * Create a new renovate resource.
-   * @param name The name of the renovate resource.
-   * @param args A bag of arguments to control the renovate creation.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: RenovateArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("gitlab:renovate", name, args, opts);
-
-    opts = this.opts(k8s.Provider);
-
-    if (args.schedule === undefined) {
-      args.schedule = "0 2 * * 0";
-    }
-
-    if (args.resources === undefined) {
-      args.resources = { requests: { memory: "1024Mi" }, limits: { memory: "1280Mi" } };
-    }
-
-    this.namespace = args.namespace
-      ? pulumi.output(args.namespace)
-      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
-
-    const metadata = {
-      name,
-      namespace: this.namespace,
-      labels: {
-        "app.kubernetes.io/name": "gitlab",
-        "app.kubernetes.io/component": "renovate",
-        "app.kubernetes.io/instance": name,
-      },
-    };
-
-    this.secret = new k8s.core.v1.Secret(
-      name,
-      {
-        metadata,
-        stringData: pulumi.all([args.accessToken, args.githubAccessToken]).apply(([accessToken, githubAccessToken]) => {
-          return { RENOVATE_TOKEN: accessToken, GITHUB_COM_TOKEN: githubAccessToken };
-        }),
-      },
-      opts
-    );
-
-    this.cronjob = new k8s.batch.v1.CronJob(
-      name,
-      {
-        metadata,
-        spec: {
-          schedule: args.schedule,
-          concurrencyPolicy: "Forbid",
-          successfulJobsHistoryLimit: 0,
-          failedJobsHistoryLimit: 1,
-          jobTemplate: {
-            metadata: { labels: metadata.labels },
-            spec: {
-              template: {
-                spec: {
-                  restartPolicy: "OnFailure",
-                  containers: [
-                    {
-                      name: "renovate",
-                      image: "renovate/renovate:latest",
-                      imagePullPolicy: "Always",
-                      args: ["--platform=gitlab", "--autodiscover"],
-                      envFrom: [{ secretRef: { name: this.secret.metadata.name } }],
-                      resources: args.resources,
-                    },
-                  ],
-                },
-              },
-            },
-          },
-        },
-      },
-      opts
-    );
-
-    this.registerOutputs();
-  }
-}

package/lib/gitlab/runners/cleanup.ts

@@ -1,104 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as k8s from "@pulumi/kubernetes";
-import { ComponentResource } from "../../common";
-
-export interface RunnerCleanupArgs {
-  namespace?: pulumi.Input<string>;
-  accessToken: pulumi.Input<string>;
-  schedule?: pulumi.Input<string>;
-}
-
-export class RunnerCleanup extends ComponentResource {
-  private readonly secret: k8s.core.v1.Secret;
-  private readonly cronjob: k8s.batch.v1.CronJob;
-  public readonly namespace: pulumi.Output<string>;
-
-  /**
-   * Create a new GitLab runner cleanup resource.
-   * @param name The name of the GitLab runner cleanup resource.
-   * @param args A bag of arguments to control the GitLab runner cleanup creation.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: RunnerCleanupArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("gitlab:runners:cleanup", name, args, opts);
-
-    opts = this.opts(k8s.Provider);
-
-    if (args.schedule === undefined) {
-      args.schedule = "0 1 * * *";
-    }
-
-    this.namespace = args.namespace
-      ? pulumi.output(args.namespace)
-      : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
-
-    const metadata = {
-      name,
-      namespace: this.namespace,
-      labels: {
-        "app.kubernetes.io/name": "gitlab-runners",
-        "app.kubernetes.io/component": "cleanup",
-        "app.kubernetes.io/instance": name,
-      },
-    };
-
-    this.secret = new k8s.core.v1.Secret(
-      name,
-      {
-        metadata,
-        stringData: {
-          token: args.accessToken,
-        },
-      },
-      opts
-    );
-
-    this.cronjob = new k8s.batch.v1.CronJob(
-      name,
-      {
-        metadata,
-        spec: {
-          schedule: args.schedule,
-          concurrencyPolicy: "Forbid",
-          successfulJobsHistoryLimit: 0,
-          failedJobsHistoryLimit: 1,
-          jobTemplate: {
-            metadata: { labels: metadata.labels },
-            spec: {
-              template: {
-                spec: {
-                  restartPolicy: "OnFailure",
-                  containers: [
-                    {
-                      name: "gitlab-runner-cleanup",
-                      image: "registry.gitlab.com/ydkn/gitlab-runner-cleanup:latest",
-                      imagePullPolicy: "Always",
-                      env: [
-                        {
-                          name: "TOKEN",
-                          valueFrom: { secretKeyRef: { name: this.secret.metadata.name, key: "token" } },
-                        },
-                      ],
-                      securityContext: {
-                        runAsUser: 65532,
-                        runAsGroup: 65532,
-                        readOnlyRootFilesystem: true,
-                      },
-                      resources: {
-                        requests: { memory: "32Mi" },
-                        limits: { memory: "48Mi" },
-                      },
-                    },
-                  ],
-                },
-              },
-            },
-          },
-        },
-      },
-      opts
-    );
-
-    this.registerOutputs();
-  }
-}