@ydkn/pulumi-components 0.4.4 → 0.4.6

package/lib/hcloud/kubernetes.ts

@@ -1,237 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as k8s from "@pulumi/kubernetes";
-import { request } from "urllib";
-import { ComponentResource } from "../common";
-import { transformations } from "../kubernetes";
-import { ServiceMonitor } from "../prometheus";
-
-/**
- * Arguments for hcloud Kubernetes resource
- */
-export interface KubernetesArgs {
-  token: pulumi.Input<string>;
-  network?: pulumi.Input<string>;
-  podCIDR?: pulumi.Input<string>;
-  kubeletDirPath?: pulumi.Input<string>;
-}
-
-export class Kubernetes extends ComponentResource {
-  private readonly secret: k8s.core.v1.Secret;
-  private readonly cloudControllerManager: pulumi.Output<k8s.yaml.ConfigFile>;
-  private readonly csiDriver: pulumi.Output<k8s.yaml.ConfigFile>;
-  private readonly csiMetrics: ServiceMonitor;
-
-  /**
-   * Create a new Hetzner cloud kubernetes resource.
-   * @param name The name of Hetzner cloud kubernetes resource.
-   * @param args A bag of arguments to control the Hetzner cloud kubernetes creation.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: KubernetesArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("hcloud:kubernetes", name, args, opts);
-
-    opts = this.opts(k8s.Provider);
-
-    this.secret = new k8s.core.v1.Secret(
-      `${name}-hcloud-secret`,
-      {
-        metadata: { namespace: "kube-system", name: "hcloud" },
-        stringData: {
-          token: args.token,
-          network: args.network ? args.network : "",
-        },
-      },
-      opts
-    );
-
-    this.cloudControllerManager = pulumi.all([args.network, args.podCIDR]).apply(([network, podCIDR]) => {
-      const transformations = [
-        (o: any) => {
-          if (o.kind === "Deployment" && o.metadata.name === "hcloud-cloud-controller-manager") {
-            for (const c of o.spec.template.spec.containers) {
-              c.command = c.command.filter((c: string) => {
-                return (
-                  !c.match(/--secure-port=/i) &&
-                  !c.match(/--cluster-cidr=/i) &&
-                  !c.match(/--allocate-node-cidrs=/i) &&
-                  !c.match(/--configure-cloud-routes=/i)
-                );
-              });
-
-              c.command.push(`--secure-port=11258`);
-              c.command.push(`--cluster-cidr=${podCIDR}`);
-              c.command.push(`--allocate-node-cidrs=true`);
-              c.command.push(`--configure-cloud-routes=${network !== undefined ? "false" : "false"}`); // TODO enable
-
-              c.env = c.env.filter((e: { name: string }) => {
-                return e.name !== "HCLOUD_INSTANCES_ADDRESS_FAMILY";
-              });
-
-              c.env.push({ name: "HCLOUD_INSTANCES_ADDRESS_FAMILY", value: "dualstack" });
-            }
-          }
-        },
-      ];
-
-      if (network !== undefined) {
-        return this.githubAssetURL("hetznercloud/hcloud-cloud-controller-manager", "ccm-networks.yaml").apply((url) => {
-          return new k8s.yaml.ConfigFile(
-            `${name}-hcloud-cloud-controller-manager`,
-            { file: url, transformations },
-            { ...opts, dependsOn: [this.secret] }
-          );
-        });
-      } else {
-        return this.githubAssetURL("hetznercloud/hcloud-cloud-controller-manager", "ccm.yaml").apply((url) => {
-          return new k8s.yaml.ConfigFile(
-            `${name}-hcloud-cloud-controller-manager`,
-            { file: url, transformations },
-            { ...opts, dependsOn: [this.secret] }
-          );
-        });
-      }
-    });
-
-    this.csiDriver = pulumi
-      .all([this.githubRepoURL("hetznercloud/csi-driver", "deploy/kubernetes/hcloud-csi.yml"), args.kubeletDirPath])
-      .apply(([url, kubeletDirPath]) => {
-        return new k8s.yaml.ConfigFile(
-          `${name}-hcloud-csi`,
-          {
-            file: url,
-            transformations: [
-              transformations.v1beta1Deprecations,
-              (o: any) => {
-                if (o.kind === "StatefulSet" || o.kind === "DaemonSet") {
-                  for (const c of o.spec.template.spec.containers) {
-                    if (c.env !== undefined) {
-                      for (const env of c.env) {
-                        if (
-                          env.name === "HCLOUD_TOKEN" &&
-                          env.valueFrom !== undefined &&
-                          env.valueFrom.secretKeyRef !== undefined
-                        ) {
-                          env.valueFrom.secretKeyRef.name = this.secret.metadata.name;
-                        }
-                      }
-                    }
-                  }
-                }
-              },
-              (o: any) => {
-                if (o.kind === "StatefulSet" && o.metadata.name === "hcloud-csi-controller") {
-                  o.spec.template.spec.tolerations = [
-                    { key: "CriticalAddonsOnly", operator: "Exists" },
-                    { key: "node-role.kubernetes.io/master", operator: "Exists", effect: "NoSchedule" },
-                    { key: "node-role.kubernetes.io/control-plane", operator: "Exists", effect: "NoSchedule" },
-                  ];
-                }
-              },
-              (o: any) => {
-                if (o.kind === "DaemonSet" && o.metadata.name === "hcloud-csi-node") {
-                  if (kubeletDirPath !== undefined) {
-                    for (const v of o.spec.template.spec.volumes) {
-                      if (v.hostPath !== undefined) {
-                        if (v.hostPath.path.startsWith("/var/lib/kubelet")) {
-                          v.hostPath.path = v.hostPath.path.replace("/var/lib/kubelet", kubeletDirPath);
-                        }
-                      }
-                    }
-
-                    for (const c of o.spec.template.spec.containers) {
-                      for (const v of c.volumeMounts) {
-                        if (v.mountPath !== undefined) {
-                          if (v.mountPath.startsWith("/var/lib/kubelet")) {
-                            v.mountPath = v.mountPath.replace("/var/lib/kubelet", kubeletDirPath);
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              },
-            ],
-          },
-          opts
-        );
-      });
-
-    this.csiMetrics = new ServiceMonitor(
-      `${name}-hcloud-csi`,
-      {
-        metadata: {
-          name: "hcloud-csi",
-          namespace: "kube-system",
-          labels: { app: "hcloud-csi" },
-        },
-        spec: {
-          selector: { matchLabels: { app: "hcloud-csi" } },
-          endpoints: [
-            {
-              port: "metrics",
-              honorLabels: true,
-              metricRelabelings: [
-                {
-                  action: "drop",
-                  sourceLabels: ["__name__"],
-                  regex: ["go_.*", "grpc_server_.*"].join("|"),
-                },
-              ],
-            },
-          ],
-        },
-      },
-      { ...opts, dependsOn: [this.csiDriver] }
-    );
-
-    this.registerOutputs();
-  }
-
-  private githubAssetURL(repo: string, filename: string, version?: string): pulumi.Output<string | undefined> {
-    if (version === undefined) {
-      version = "latest";
-    }
-
-    const promise = new Promise<string | undefined>((resolve, reject) => {
-      request(`https://api.github.com/repos/${repo}/releases/${version}`, { dataType: "json", gzip: true })
-        .then((body) => {
-          if (body.statusCode !== 200) {
-            return reject(new Error(`failed to fetch releases for repo: ${repo}`));
-          }
-
-          resolve(`https://github.com/${repo}/releases/download/${body.data.tag_name as string}/${filename}`);
-        })
-        .catch(() => {
-          return reject(new Error(`failed to fetch asset URL for repo: ${repo}`));
-        });
-    });
-
-    return pulumi.all([promise]).apply(([promise]) => {
-      return promise;
-    });
-  }
-
-  private githubRepoURL(repo: string, filename: string, version?: string): pulumi.Output<string | undefined> {
-    if (version === undefined) {
-      version = "latest";
-    }
-
-    const promise = new Promise<string | undefined>((resolve, reject) => {
-      request(`https://api.github.com/repos/${repo}/releases/${version}`, { dataType: "json", gzip: true })
-        .then((body) => {
-          if (body.statusCode !== 200) {
-            return reject(new Error(`failed to fetch releases for repo: ${repo}`));
-          }
-
-          resolve(`https://raw.githubusercontent.com/${repo}/${body.data.tag_name as string}/${filename}`);
-        })
-        .catch(() => {
-          return reject(new Error(`failed to get repo url for repo: ${repo}`));
-        });
-    });
-
-    return pulumi.all([promise]).apply(([promise]) => {
-      return promise;
-    });
-  }
-}

package/lib/hcloud/wireguard.ts

@@ -1,155 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as hcloud from "@pulumi/hcloud";
-import * as k8s from "@pulumi/kubernetes";
-import { ComponentResource } from "../common";
-import * as wireguard from "../wireguard";
-import { Node } from "../node";
-import { DnsEndpoint, DnsEndpointsArgs } from "../externalDns";
-
-export interface WireguardArgs extends wireguard.WireguardArgs {
-  nodes: pulumi.Input<pulumi.Input<Node>[]>;
-  networkId: pulumi.Input<number>;
-  hostnames?: pulumi.Input<pulumi.Input<string>[]>;
-}
-
-export class Wireguard extends ComponentResource {
-  private readonly wireguard: wireguard.Wireguard;
-  private readonly firewall: hcloud.Firewall;
-  private readonly networkRoutes: pulumi.Output<hcloud.NetworkRoute[]>;
-  private readonly dnsEndpoint?: DnsEndpoint;
-
-  /**
-   * Create a new wireguard resource.
-   * @param name The name of the wireguard resource.
-   * @param args A bag of arguments to control the wireguard deployment.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: WireguardArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("hcloud:wireguard", name, args, opts);
-
-    const hcloudOpts = this.opts(hcloud.Provider);
-    const k8sOpts = this.opts(k8s.Provider);
-
-    this.wireguard = new wireguard.Wireguard(name, args, { ...opts, parent: this });
-
-    const gatewayNodes = Wireguard.gatewayNodes(args.nodes);
-
-    this.firewall = new hcloud.Firewall(
-      name,
-      {
-        name,
-        applyTos: gatewayNodes.apply((nodes) =>
-          pulumi.all(nodes).apply((nodes) =>
-            nodes.map((node) => {
-              return { server: parseInt(node.id as string) };
-            })
-          )
-        ),
-        rules: [
-          {
-            description: "UDP",
-            direction: "in",
-            protocol: "udp",
-            port: pulumi.interpolate`${this.wireguard.interfacePort}`,
-            sourceIps: ["0.0.0.0/0", "::/0"],
-          },
-        ],
-      },
-      hcloudOpts
-    );
-
-    this.networkRoutes = pulumi.all([gatewayNodes, args.peers]).apply(([gatewayNodes, peers]) =>
-      pulumi.all(gatewayNodes ?? []).apply((gatewayNodes) => {
-        const gatewayIPs = gatewayNodes.map((node) => node.privateIpv4Address as string);
-
-        if (gatewayIPs.length === 0) {
-          return pulumi.output([] as hcloud.NetworkRoute[]);
-        }
-
-        return pulumi.all(peers ?? []).apply((peers) => {
-          const peerIPRanges: string[] = [];
-
-          for (const peer of peers) {
-            for (const ip of peer.allowedIPs) {
-              if (ip.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}$/)) {
-                peerIPRanges.push(ip);
-              }
-            }
-          }
-
-          return peerIPRanges.map(
-            (peerIPRange) =>
-              new hcloud.NetworkRoute(
-                `${name}-${peerIPRange}`,
-                { networkId: args.networkId, destination: peerIPRange, gateway: gatewayIPs[0] },
-                hcloudOpts
-              )
-          );
-        });
-      })
-    );
-
-    if (args.hostnames !== undefined) {
-      this.dnsEndpoint = new DnsEndpoint(
-        name,
-        {
-          metadata: { namespace: this.wireguard.namespace, name },
-          spec: {
-            endpoints: pulumi.all([args.hostnames, gatewayNodes]).apply(([hostnames, gatewayNodes]) =>
-              pulumi.all(hostnames).apply((hostnames) =>
-                pulumi.all(gatewayNodes).apply((nodes) => {
-                  const ipv4Endpoints: string[] = [];
-                  const ipv6Endpoints: string[] = [];
-
-                  for (const node of nodes) {
-                    if (node.ipv4Address !== undefined) {
-                      ipv4Endpoints.push(node.ipv4Address);
-                    }
-
-                    if (node.ipv6Address !== undefined) {
-                      ipv6Endpoints.push(node.ipv6Address);
-                    }
-                  }
-
-                  const endpoints: DnsEndpointsArgs[] = [];
-
-                  for (const dnsName of hostnames) {
-                    if (ipv4Endpoints.length > 0) {
-                      endpoints.push({ dnsName, recordType: "A", targets: ipv4Endpoints });
-                    }
-
-                    if (ipv6Endpoints.length > 0) {
-                      endpoints.push({ dnsName, recordType: "AAAA", targets: ipv6Endpoints });
-                    }
-                  }
-
-                  return endpoints;
-                })
-              )
-            ),
-          },
-        },
-        k8sOpts
-      );
-    }
-
-    this.registerOutputs();
-  }
-
-  private static gatewayNodes(nodes: pulumi.Input<pulumi.Input<Node>[]>): pulumi.Output<pulumi.Output<Node>[]> {
-    return pulumi.all([nodes]).apply(([nodes]) =>
-      pulumi.all(nodes ?? []).apply((nodes) => {
-        return nodes
-          .filter(
-            (node) =>
-              node.id !== undefined &&
-              node.labels !== undefined &&
-              node.labels[wireguard.Wireguard.gatewayLabel] !== undefined &&
-              node.labels[wireguard.Wireguard.gatewayLabel] === wireguard.Wireguard.gatewayLabelValue &&
-              node.privateIpv4Address !== undefined
-          )
-          .map((node) => pulumi.output(node));
-      })
-    );
-  }
-}

package/lib/k0s/cluster.ts

@@ -1,264 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as random from "@pulumi/random";
-import * as k0s from "@ydkn/pulumi-k0s";
-import * as os from "os";
-import * as fs from "fs";
-import * as path from "path";
-import * as crypto from "crypto";
-import * as yaml from "js-yaml";
-import { ComponentResource } from "../common";
-import { Node } from "../node";
-
-export interface ClusterArgs {
-  /**
-   * Optional: Name
-   */
-  name?: pulumi.Input<string>;
-  /**
-   * Nodes
-   */
-  nodes: pulumi.Input<pulumi.Input<Node>[]>;
-  /**
-   * Optional: k0s config
-   */
-  k0s?: pulumi.Input<k0s.types.input.K0sArgs>;
-  /**
-   * Optional: k0s host hooks
-   */
-  hooks?: pulumi.Input<k0s.types.input.HooksArgs>;
-  /**
-   * Optional: Cloud provider
-   */
-  cloudProvider?: pulumi.Input<boolean>;
-  /**
-   * Optional: Protect critical resources
-   */
-  protect?: boolean;
-}
-
-export class Cluster extends ComponentResource {
-  private readonly clusterProvider: k0s.Provider;
-  private readonly cluster: k0s.Cluster;
-  public readonly name: pulumi.Output<string>;
-  public readonly nodes: pulumi.Output<pulumi.Output<Node>[]>;
-  public readonly spec: pulumi.Output<k0s.types.output.Spec>;
-  public readonly kubeconfig: pulumi.Output<string>;
-  public readonly kubeletDirPath: pulumi.Output<string>;
-
-  /**
-   * Create a new cluster resource.
-   * @param name The name of the cluster resource.
-   * @param args A bag of arguments to control the cluster creation.
-   * @param opts A bag of options that control this resource's behavior.
-   */
-  constructor(name: string, args: ClusterArgs, opts?: pulumi.ComponentResourceOptions) {
-    super("k0s:cluster", name, args, opts);
-
-    const emptyOpts = this.opts();
-
-    if (args.name === undefined) {
-      this.name = new random.RandomId(name, { byteLength: 3 }, { ...emptyOpts, protect: args.protect }).hex;
-    } else {
-      this.name = pulumi.output(args.name);
-    }
-
-    this.nodes = pulumi.all([args.nodes]).apply(([nodes]) => {
-      const outputNodes: pulumi.Output<Node>[] = [];
-
-      for (const node of nodes) {
-        outputNodes.push(pulumi.output(node));
-      }
-
-      return outputNodes;
-    });
-
-    this.clusterProvider = new k0s.Provider(name, { noDrain: true }, emptyOpts);
-
-    this.cluster = new k0s.Cluster(
-      name,
-      {
-        metadata: { name: this.name },
-        spec: pulumi
-          .all([this.nodes, args.k0s, args.hooks, args.cloudProvider])
-          .apply(([nodes, k0s, hooks, cloudProvider]) => {
-            return {
-              hosts: nodes.map((node) => {
-                let keyPath = "";
-
-                if (node.privateKey !== undefined) {
-                  const keyHash = crypto.createHash("sha1").update(node.privateKey, "utf8").digest("hex");
-
-                  keyPath = path.join(os.tmpdir(), `pulumi-components-k0s-${node.hostname}-${keyHash}.pem`);
-
-                  // eslint-disable-next-line security/detect-non-literal-fs-filename
-                  fs.writeFileSync(keyPath, node.privateKey);
-                  // eslint-disable-next-line security/detect-non-literal-fs-filename
-                  fs.chmodSync(keyPath, 0o600);
-                }
-
-                const installFlags: string[] = [];
-
-                let isController = false;
-                let isWorker = false;
-                for (const role of node.roles || []) {
-                  if (role === "controller") {
-                    isController = true;
-                  } else if (role === "worker") {
-                    isWorker = true;
-                  }
-                }
-
-                if (!cloudProvider && isController) {
-                  installFlags.push("--enable-k0s-cloud-provider=true");
-                }
-
-                if (isWorker) {
-                  installFlags.push("--enable-cloud-provider=true");
-                }
-
-                if (node.labels === undefined) {
-                  node.labels = {};
-                }
-
-                node.labels["node.kubernetes.io/role"] = isController ? "control-plane" : "worker";
-
-                const labels: string[] = [];
-
-                for (const key in node.labels) {
-                  // eslint-disable-next-line security/detect-object-injection
-                  labels.push(`${key}=${node.labels[key]}`);
-                }
-
-                if (labels.length > 0) {
-                  installFlags.push(`--labels=${labels.join(",")}`);
-                }
-
-                let noTaints = false;
-
-                if (node.taints !== undefined) {
-                  const taints: string[] = [];
-
-                  for (const taint of node.taints) {
-                    taints.push(`${taint.key}=${taint.value}:${taint.effect}`);
-                  }
-
-                  if (taints.length > 0) {
-                    installFlags.push(`--taints=${taints.join(",")}`);
-                  } else {
-                    noTaints = true;
-                  }
-                }
-
-                return Cluster.k0sNode(node, installFlags, keyPath, hooks, noTaints);
-              }),
-              k0s,
-            };
-          }),
-      },
-      { ...emptyOpts, provider: this.clusterProvider }
-    );
-
-    this.spec = this.cluster.spec;
-    this.kubeconfig = pulumi.secret(
-      Cluster.transformKubeconfig(
-        this.cluster.kubeconfig,
-        this.cluster.spec.apply((spec) => spec.k0s?.config?.spec?.api?.sans)
-      )
-    );
-
-    this.kubeletDirPath = pulumi.output("/var/lib/k0s/kubelet");
-
-    this.registerOutputs();
-  }
-
-  public static k0sRole(roles?: pulumi.Input<pulumi.Input<string>[]>): pulumi.Output<string> {
-    return pulumi.all([roles]).apply(([roles]) => {
-      let role = "worker";
-      let foundControllerRole = false;
-      let foundWorkerRole = false;
-
-      for (const r of roles || []) {
-        if (r === "controller") {
-          foundControllerRole = true;
-          role = "controller";
-        } else if (r === "worker") {
-          foundWorkerRole = true;
-          role = "worker";
-        }
-
-        if (foundControllerRole && foundWorkerRole) {
-          role = "controller+worker";
-          break;
-        }
-      }
-
-      return role;
-    });
-  }
-
-  public static k0sNode(
-    node: Node,
-    installFlags: string[],
-    keyPath: string,
-    hooks?: pulumi.UnwrappedObject<k0s.types.input.HooksArgs>,
-    noTaints?: boolean
-  ): k0s.types.input.HostArgs {
-    return {
-      hostname: node.hostname,
-      privateAddress: node.privateIpv4Address,
-      role: Cluster.k0sRole(node.roles),
-      ssh: { address: node.ipv4Address as string, user: node.username, port: 22, keyPath },
-      installFlags,
-      hooks: {
-        apply: {
-          before: (hooks?.apply?.before ?? []).concat(
-            "sudo sh -c 'if [ ! -L /var/lib/kubelet ]; then ln -s /var/lib/k0s/kubelet /var/lib/kubelet; fi'"
-          ),
-          after: hooks?.apply?.after ?? [],
-        },
-        reset: {
-          before: hooks?.reset?.before ?? [],
-          after: (hooks?.reset?.after ?? []).concat(
-            "sudo sh -c 'if [ -L /var/lib/kubelet ]; then rm -rf /var/lib/kubelet; fi'"
-          ),
-        },
-        backup: {
-          before: hooks?.backup?.before ?? [],
-          after: hooks?.backup?.after ?? [],
-        },
-      },
-      noTaints,
-    };
-  }
-
-  public static rolesHostname(roles?: pulumi.Input<pulumi.Input<string>[]>): pulumi.Output<string> {
-    const role = this.k0sRole(roles);
-
-    return role.apply((role) => {
-      if (role !== undefined && (role === "controller" || role === "controller+worker")) {
-        return "controller";
-      }
-
-      return "worker";
-    });
-  }
-
-  private static transformKubeconfig(
-    kubeconfig: pulumi.Input<string>,
-    sans?: pulumi.Input<pulumi.Input<string>[] | undefined>
-  ): pulumi.Output<string> {
-    return pulumi.all([kubeconfig, sans]).apply(([kubeconfig, sans]) => {
-      const transformedKubeconfig = yaml.load(kubeconfig, { schema: yaml.FAILSAFE_SCHEMA }) as any;
-
-      if (sans !== undefined && sans.length > 0) {
-        if (transformedKubeconfig !== undefined && transformedKubeconfig.clusters.length > 0) {
-          if (transformedKubeconfig.clusters[0].cluster !== undefined) {
-            transformedKubeconfig.clusters[0].cluster.server = `https://${sans[0]}:6443`;
-          }
-        }
-      }
-
-      return yaml.dump(transformedKubeconfig);
-    });
-  }
-}