@ydkn/pulumi-components 0.7.9 → 0.7.11

package/lib/minio/tenant.js

@@ -0,0 +1,194 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as random from "@pulumi/random";
+import * as k8s from "@pulumi/kubernetes";
+import { ComponentResource } from "../common/index.js";
+import * as kubernetes from "../kubernetes/index.js";
+import { SecureIngress } from "../traefik/index.js";
+export class Tenant extends ComponentResource {
+    helmRelease;
+    namespace;
+    region;
+    hostname;
+    adminUsername;
+    adminPassword;
+    users;
+    /**
+     * Create a new MinIO tenant resource.
+     * @param name The name of the MinIO tenant resource.
+     * @param args A bag of arguments to control the MinIO tenant creation.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name, args, opts) {
+        super("minio:tenant", name, args, opts);
+        const emptyOpts = this.opts();
+        const k8sOpts = this.opts(k8s.Provider);
+        if (args.region === undefined) {
+            args.region = "minio";
+        }
+        this.adminUsername = pulumi.secret(new random.RandomPassword(`${name}-admin-username`, { length: 24, special: false }, emptyOpts).result);
+        this.adminPassword = pulumi.secret(new random.RandomPassword(`${name}-admin-password`, { length: 40, special: false }, emptyOpts).result);
+        this.namespace = args.namespace
+            ? pulumi.output(args.namespace)
+            : new k8s.core.v1.Namespace(name, { metadata: { name } }, k8sOpts).metadata.name;
+        const adminCredentialsSecret = `${name}-admin-credentials`;
+        this.region = pulumi.output(args.region);
+        this.hostname = pulumi
+            .all([args.apiIngress, this.namespace])
+            .apply(([apiIngress, ns]) => apiIngress?.host ?? `${name}.${ns}.svc`);
+        this.users = pulumi.all([args.users]).apply(([users]) => pulumi.all(users ?? []).apply((users) => {
+            const usersMap = {};
+            for (const user of users ?? []) {
+                const accessKey = pulumi.secret(new random.RandomPassword(`${name}-${user.name}-username`, { length: 24, special: false }, emptyOpts)
+                    .result);
+                const secretKey = pulumi.secret(new random.RandomPassword(`${name}-${user.name}-password`, { length: 48, special: false }, emptyOpts)
+                    .result);
+                // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                const secret = new kubernetes.v1.Secret(`${name}-user-${user.name}`, {
+                    metadata: { name: `${name}-user-${user.name}`, namespace: this.namespace },
+                    stringData: {
+                        CONSOLE_ACCESS_KEY: accessKey,
+                        CONSOLE_SECRET_KEY: secretKey,
+                    },
+                }, k8sOpts);
+                usersMap[user.name] = { accessKey, secretKey };
+            }
+            return usersMap;
+        }));
+        this.helmRelease = new kubernetes.helm.v3.Release(name, {
+            namespace: this.namespace,
+            repositoryOpts: { repo: "https://operator.min.io/" },
+            chart: "tenant",
+            values: {
+                fullnameOverride: name,
+                secrets: {
+                    name: adminCredentialsSecret,
+                    accessKey: this.adminUsername,
+                    secretKey: this.adminPassword,
+                },
+                tenant: {
+                    name,
+                    configuration: { name: adminCredentialsSecret },
+                    env: [
+                        { name: "MINIO_STORAGE_CLASS_STANDARD", value: args.standardStorageClass ?? "EC:2" },
+                        { name: "MINIO_STORAGE_CLASS_RRS", value: args.reducedStorageClass ?? "EC:1" },
+                        { name: "MINIO_BROWSER", value: "on" },
+                        { name: "MINIO_BROWSER_LOGIN_ANIMATION", value: "off" },
+                        { name: "MINIO_BROWSER_REDIRECT", value: "false" },
+                        { name: "MINIO_PROMETHEUS_AUTH_TYPE", value: "public" },
+                        { name: "MINIO_PROMETHEUS_JOB_ID", value: "minio" },
+                        { name: "MINIO_UPDATE", value: "off" },
+                        { name: "MINIO_REGION", value: this.region },
+                        { name: "MINIO_SERVER_URL", value: this.hostname.apply((hostname) => `https://${hostname}/`) },
+                    ],
+                    logging: {
+                        anonymous: true,
+                        json: true,
+                        quiet: false,
+                    },
+                    pools: pulumi.all([args.pools]).apply(([pools]) => {
+                        return pools.map((pool) => {
+                            return {
+                                name: pool.name,
+                                servers: pool.servers,
+                                volumesPerServer: pool.volumesPerServer ?? 1,
+                                size: pool.size ?? "10Gi",
+                                storageClassName: pool.storageClassName,
+                                resources: pool.resources ?? args.resources,
+                                affinity: {
+                                    podAntiAffinity: {
+                                        preferredDuringSchedulingIgnoredDuringExecution: [
+                                            {
+                                                weight: 100,
+                                                podAffinityTerm: {
+                                                    labelSelector: {
+                                                        matchExpressions: [{ key: "v1.min.io/tenant", operator: "In", values: [name] }],
+                                                    },
+                                                    topologyKey: "kubernetes.io/hostname",
+                                                },
+                                            },
+                                        ],
+                                    },
+                                },
+                            };
+                        });
+                    }),
+                    features: {
+                        domains: {
+                            minio: pulumi
+                                .all([args.domains])
+                                .apply(([domains]) => (domains ?? []).map((domain) => `https://${domain}`)),
+                            console: pulumi
+                                .all([args.consoleIngress, this.hostname])
+                                .apply(([consoleIngress, hostname]) => `https://${consoleIngress?.host ?? hostname}`),
+                        },
+                    },
+                    buckets: pulumi.all([args.buckets]).apply(([buckets]) => pulumi.all(buckets ?? []).apply((buckets) => {
+                        return buckets.map((bucket) => {
+                            return {
+                                name: bucket.name,
+                                objectLock: bucket.objectLock ?? false,
+                            };
+                        });
+                    })),
+                    users: pulumi.all([args.users]).apply(([users]) => pulumi.all(users ?? []).apply((users) => {
+                        return users.map((user) => {
+                            return {
+                                name: `${name}-user-${user.name}`,
+                            };
+                        });
+                    })),
+                    metrics: { enabled: false },
+                    prometheusOperator: false,
+                    certificate: {
+                        requestAutoCert: true,
+                    },
+                },
+                ingress: {
+                    api: this.ingressValues(name, "api", args.apiIngress),
+                    console: this.ingressValues(name, "console", args.consoleIngress),
+                },
+            },
+        }, { ...k8sOpts, protect: args.protect });
+        pulumi.all([args.bucketsIngress]).apply(([bucketsIngress]) => {
+            if (bucketsIngress === undefined || bucketsIngress.hosts.length === 0) {
+                return;
+            }
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            const bucketsSecureIngress = new SecureIngress(`${name}-buckets`, {
+                metadata: { name: `${name}-buckets`, namespace: this.namespace, annotations: bucketsIngress.annotations },
+                spec: {
+                    ingressClassName: bucketsIngress.ingressClassName,
+                    rules: bucketsIngress.hosts.map((host) => {
+                        return {
+                            host: host,
+                            http: {
+                                paths: [{ path: "/", pathType: "Prefix", backend: { service: { name, port: { number: 443 } } } }],
+                            },
+                        };
+                    }),
+                },
+            }, k8sOpts);
+        });
+        this.registerOutputs();
+    }
+    ingressValues(name, type, args) {
+        return pulumi.all([args]).apply(([args]) => {
+            if (args === undefined || args.enabled === undefined || args.enabled === false) {
+                return { enabled: false, host: "", tls: [] };
+            }
+            return {
+                enabled: true,
+                ingressClassName: args.ingressClassName,
+                annotations: {
+                    "traefik.ingress.kubernetes.io/router.entrypoints": "websecure",
+                    "traefik.ingress.kubernetes.io/router.tls": "true",
+                    "cert-manager.io/cluster-issuer": "letsencrypt",
+                    ...args.annotations,
+                },
+                host: args.host,
+                tls: [{ hosts: [args.host], secretName: `${name}-${type}-tls` }],
+            };
+        });
+    }
+}
+//# sourceMappingURL=tenant.js.map

package/lib/minio/tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../../lib/minio/tenant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAqDpD,MAAM,OAAO,MAAO,SAAQ,iBAAiB;IAC1B,WAAW,CAA6B;IACzC,SAAS,CAAwB;IACjC,MAAM,CAAwB;IAC9B,QAAQ,CAAwB;IAChC,aAAa,CAAwB;IACrC,aAAa,CAAwB;IACrC,KAAK,CAElB;IAEH;;;;;OAKG;IACH,YAAY,IAAY,EAAE,IAAgB,EAAE,IAAsC;QAChF,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAChC,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,MAAM,CACtG,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAChC,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC,MAAM,CACtG,CAAC;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEnF,MAAM,sBAAsB,GAAG,GAAG,IAAI,oBAAoB,CAAC;QAE3D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,MAAM;aACnB,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;aACtC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,IAAI,IAAI,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;QAExE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CACtD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtC,MAAM,QAAQ,GAA8F,EAAE,CAAC;YAE/G,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;gBAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC;qBAClG,MAAM,CACV,CAAC;gBAEF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC;qBAClG,MAAM,CACV,CAAC;gBAEF,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,CACrC,GAAG,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,EAC3B;oBACE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBAC1E,UAAU,EAAE;wBACV,kBAAkB,EAAE,SAAS;wBAC7B,kBAAkB,EAAE,SAAS;qBAC9B;iBACF,EACD,OAAO,CACR,CAAC;gBAEF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;YACjD,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC/C,IAAI,EACJ;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;YACpD,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE;gBACN,gBAAgB,EAAE,IAAI;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAE,sBAAsB;oBAC5B,SAAS,EAAE,IAAI,CAAC,aAAa;oBAC7B,SAAS,EAAE,IAAI,CAAC,aAAa;iBAC9B;gBACD,MAAM,EAAE;oBACN,IAAI;oBACJ,aAAa,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;oBAC/C,GAAG,EAAE;wBACH,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,IAAI,CAAC,oBAAoB,IAAI,MAAM,EAAE;wBACpF,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,IAAI,CAAC,mBAAmB,IAAI,MAAM,EAAE;wBAC9E,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE;wBACtC,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,KAAK,EAAE;wBACvD,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE;wBAClD,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,QAAQ,EAAE;wBACvD,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE;wBACnD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE;wBACtC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;wBAC5C,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,QAAQ,GAAG,CAAC,EAAE;qBAC/F;oBACD,OAAO,EAAE;wBACP,SAAS,EAAE,IAAI;wBACf,IAAI,EAAE,IAAI;wBACV,KAAK,EAAE,KAAK;qBACb;oBACD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE;wBAChD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;4BACxB,OAAO;gCACL,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,OAAO,EAAE,IAAI,CAAC,OAAO;gCACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,CAAC;gCAC5C,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM;gCACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gCACvC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;gCAC3C,QAAQ,EAAE;oCACR,eAAe,EAAE;wCACf,+CAA+C,EAAE;4CAC/C;gDACE,MAAM,EAAE,GAAG;gDACX,eAAe,EAAE;oDACf,aAAa,EAAE;wDACb,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;qDAChF;oDACD,WAAW,EAAE,wBAAwB;iDACtC;6CACF;yCACF;qCACF;iCACF;6BACF,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC;oBACF,QAAQ,EAAE;wBACR,OAAO,EAAE;4BACP,KAAK,EAAE,MAAM;iCACV,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iCACnB,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;4BAC7E,OAAO,EAAE,MAAM;iCACZ,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;iCACzC,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,WAAW,cAAc,EAAE,IAAI,IAAI,QAAQ,EAAE,CAAC;yBACxF;qBACF;oBACD,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CACtD,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;wBAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;4BAC5B,OAAO;gCACL,IAAI,EAAE,MAAM,CAAC,IAAI;gCACjB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;6BACvC,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC,CACH;oBACD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAChD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACtC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;4BACxB,OAAO;gCACL,IAAI,EAAE,GAAG,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE;6BAClC,CAAC;wBACJ,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC,CACH;oBACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;oBAC3B,kBAAkB,EAAE,KAAK;oBACzB,WAAW,EAAE;wBACX,eAAe,EAAE,IAAI;qBACtB;iBACF;gBACD,OAAO,EAAE;oBACP,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC;oBACrD,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC;iBAClE;aACF;SACF,EACD,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CACtC,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE;YAC3D,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtE,OAAO;YACT,CAAC;YAED,6DAA6D;YAC7D,MAAM,oBAAoB,GAAG,IAAI,aAAa,CAC5C,GAAG,IAAI,UAAU,EACjB;gBACE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE;gBACzG,IAAI,EAAE;oBACJ,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;oBACjD,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBACvC,OAAO;4BACL,IAAI,EAAE,IAAI;4BACV,IAAI,EAAE;gCACJ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC;6BAClG;yBACF,CAAC;oBACJ,CAAC,CAAC;iBACH;aACF,EACD,OAAO,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAEO,aAAa,CACnB,IAAY,EACZ,IAAY,EACZ,IAAgC;QAEhC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE;YACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;YAC/C,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,WAAW,EAAE;oBACX,kDAAkD,EAAE,WAAW;oBAC/D,0CAA0C,EAAE,MAAM;oBAClD,gCAAgC,EAAE,aAAa;oBAC/C,GAAG,IAAI,CAAC,WAAW;iBACpB;gBACD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;aACjE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/lib/nats/cluster.js

@@ -115,7 +115,6 @@ export class Cluster extends ComponentResource {
                 if (body.statusCode !== 200) {
                     return reject(new Error(`failed to fetch dashboard json`));
                 }
-                // eslint-disable-next-line no-template-curly-in-string
                 resolve(body.data.replaceAll("${DS__NATS-PROMETHEUS}", "prometheus"));
             })
                 .catch(() => {
@@ -125,7 +124,6 @@ export class Cluster extends ComponentResource {
         this.grafanaDashboard = new Dashboard(`${name}-grafana-dashboard`, {
             metadata: { namespace: this.namespace, name: pulumi.interpolate `${name}-grafana-dashboard` },
             name: "nats-jetstream",
-            // eslint-disable-next-line security/detect-non-literal-fs-filename
             data: pulumi.all([dashboardPromise]).apply(([promise]) => promise ?? ""),
         }, opts);
         this.registerOutputs();

package/lib/nats/cluster.js.map

@@ -1 +1 @@
-{"version":3,"file":"cluster.js","sourceRoot":"","sources":["../../../lib/nats/cluster.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgBhD,MAAM,OAAO,OAAQ,SAAQ,iBAAiB;IACpC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC;IAE9B,OAAO,CAAsB;IAC7B,WAAW,CAA6B;IACxC,eAAe,CAA6B;IAC5C,gBAAgB,CAAY;IAC7B,SAAS,CAAwB;IAEjD;;;;;OAKG;IACH,YAAY,IAAY,EAAE,IAAiB,EAAE,IAAsC;QACjF,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,GAAG;gBACf,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;gBAC7B,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE;YACvE,MAAM,QAAQ,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC;YACtD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEtD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,IAAI,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAEjC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,KAAK,IAAI,IAAI,CAAC;YAChB,CAAC;YAED,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YAEhC,OAAO,GAAG,KAAK,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CACpC,IAAI,EACJ,EAAE,IAAI,EAAE,CAAC,gDAAgD,EAAE,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC5G,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEhF,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC/C,IAAI,EACJ;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,2CAA2C,EAAE;YACrE,KAAK,EAAE,MAAM;YACb,MAAM,EAAE;gBACN,gBAAgB,EAAE,IAAI;gBACtB,MAAM,EAAE;oBACN,SAAS,EAAE;wBACT,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE;4BACV,OAAO,EAAE,IAAI;4BACb,IAAI,EAAE,MAAM;yBACb;wBACD,WAAW,EAAE;4BACX,OAAO,EAAE,IAAI;4BACb,GAAG,EAAE;gCACH,OAAO,EAAE,IAAI;gCACb,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC;gCAC3E,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;6BAC1F;yBACF;qBACF;iBACF;gBACD,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;oBAClC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;iBACrC;gBACD,OAAO,EAAE;oBACP,KAAK,EAAE;wBACL,QAAQ,EAAE;4BACR,WAAW,EAAE,IAAI,CAAC,QAAQ;gCACxB,CAAC,CAAC;oCACE,2CAA2C,EAAE,IAAI,CAAC,QAAQ;iCAC3D;gCACH,CAAC,CAAC,EAAE;yBACP;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,WAAW;4BACrC,iBAAiB,EAAE,IAAI,CAAC,wBAAwB;4BAChD,cAAc,EAAE,iBAAiB;yBAClC;qBACF;iBACF;gBACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC3B,YAAY,EAAE;oBACZ,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;iBAC9B;aACF;SACF,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,eAAe,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CACnD,GAAG,IAAI,OAAO,EACd;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,2CAA2C,EAAE;YACrE,KAAK,EAAE,MAAM;YACb,MAAM,EAAE;gBACN,YAAY,EAAE,GAAG,IAAI,OAAO;gBAC5B,IAAI,EAAE;oBACJ,GAAG,EAAE,MAAM,CAAC,WAAW,CAAA,UAAU,IAAI,IAAI,IAAI,CAAC,SAAS,WAAW;iBACnE;gBACD,SAAS,EAAE;oBACT,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oBAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;iBAC3B;aACF;SACF,EACD,IAAI,CACL,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3E,OAAO,CACL,sHAAsH,EACtH,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CACjC;iBACE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACb,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC5B,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBAC7D,CAAC;gBAED,uDAAuD;gBACvD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC,CAAC;YACxE,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE;gBACV,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,GAAG,IAAI,SAAS,CACnC,GAAG,IAAI,oBAAoB,EAC3B;YACE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAA,GAAG,IAAI,oBAAoB,EAAE;YAC5F,IAAI,EAAE,gBAAgB;YACtB,mEAAmE;YACnE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;SACzE,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC"}
+{"version":3,"file":"cluster.js","sourceRoot":"","sources":["../../../lib/nats/cluster.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgBhD,MAAM,OAAO,OAAQ,SAAQ,iBAAiB;IACpC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC;IAE9B,OAAO,CAAsB;IAC7B,WAAW,CAA6B;IACxC,eAAe,CAA6B;IAC5C,gBAAgB,CAAY;IAC7B,SAAS,CAAwB;IAEjD;;;;;OAKG;IACH,YAAY,IAAY,EAAE,IAAiB,EAAE,IAAsC;QACjF,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,GAAG;gBACf,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;gBAC7B,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE;YACvE,MAAM,QAAQ,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC;YACtD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEtD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,IAAI,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAEjC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,KAAK,IAAI,IAAI,CAAC;YAChB,CAAC;YAED,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YAEhC,OAAO,GAAG,KAAK,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CACpC,IAAI,EACJ,EAAE,IAAI,EAAE,CAAC,gDAAgD,EAAE,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC5G,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEhF,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAC/C,IAAI,EACJ;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,2CAA2C,EAAE;YACrE,KAAK,EAAE,MAAM;YACb,MAAM,EAAE;gBACN,gBAAgB,EAAE,IAAI;gBACtB,MAAM,EAAE;oBACN,SAAS,EAAE;wBACT,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE;4BACV,OAAO,EAAE,IAAI;4BACb,IAAI,EAAE,MAAM;yBACb;wBACD,WAAW,EAAE;4BACX,OAAO,EAAE,IAAI;4BACb,GAAG,EAAE;gCACH,OAAO,EAAE,IAAI;gCACb,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC;gCAC3E,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;6BAC1F;yBACF;qBACF;iBACF;gBACD,SAAS,EAAE;oBACT,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;oBAClC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;iBACrC;gBACD,OAAO,EAAE;oBACP,KAAK,EAAE;wBACL,QAAQ,EAAE;4BACR,WAAW,EAAE,IAAI,CAAC,QAAQ;gCACxB,CAAC,CAAC;oCACE,2CAA2C,EAAE,IAAI,CAAC,QAAQ;iCAC3D;gCACH,CAAC,CAAC,EAAE;yBACP;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,WAAW;4BACrC,iBAAiB,EAAE,IAAI,CAAC,wBAAwB;4BAChD,cAAc,EAAE,iBAAiB;yBAClC;qBACF;iBACF;gBACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC3B,YAAY,EAAE;oBACZ,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;iBAC9B;aACF;SACF,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,eAAe,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CACnD,GAAG,IAAI,OAAO,EACd;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,2CAA2C,EAAE;YACrE,KAAK,EAAE,MAAM;YACb,MAAM,EAAE;gBACN,YAAY,EAAE,GAAG,IAAI,OAAO;gBAC5B,IAAI,EAAE;oBACJ,GAAG,EAAE,MAAM,CAAC,WAAW,CAAA,UAAU,IAAI,IAAI,IAAI,CAAC,SAAS,WAAW;iBACnE;gBACD,SAAS,EAAE;oBACT,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oBAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;iBAC3B;aACF;SACF,EACD,IAAI,CACL,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3E,OAAO,CACL,sHAAsH,EACtH,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CACjC;iBACE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACb,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC5B,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBAC7D,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC,CAAC;YACxE,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE;gBACV,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,GAAG,IAAI,SAAS,CACnC,GAAG,IAAI,oBAAoB,EAC3B;YACE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAA,GAAG,IAAI,oBAAoB,EAAE;YAC5F,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;SACzE,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC"}

package/lib/netbird/agent.d.ts

@@ -11,11 +11,15 @@ export interface AgentArgs {
     nodeSelector?: pulumi.Input<{
         [key: string]: pulumi.Input<string>;
     }>;
+    extraBlacklistInterfaces?: pulumi.Input<pulumi.Input<string>[]>;
 }
 export declare class Agent extends ComponentResource {
+    private static readonly extraBlacklistInterfaces;
     static readonly interfaceName = "wt0";
     static readonly interfacePort = 51820;
+    private readonly extraBlacklistInterfaces;
     private readonly secret;
+    private readonly fixNFTScript;
     private readonly daemonSet;
     private readonly podDisruptionBudget;
     readonly namespace: pulumi.Output<string>;

package/lib/netbird/agent.js

@@ -1,11 +1,17 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as k8s from "@pulumi/kubernetes";
+import * as fs from "fs";
+import * as path from "path";
+import * as url from "url";
 import { ComponentResource } from "../common/index.js";
 import * as kubernetes from "../kubernetes/index.js";
 export class Agent extends ComponentResource {
+    static extraBlacklistInterfaces = ["wireguard.cali", "wg-v6.cali"];
     static interfaceName = "wt0";
     static interfacePort = 51820;
+    extraBlacklistInterfaces;
     secret;
+    fixNFTScript;
     daemonSet;
     podDisruptionBudget;
     namespace;
@@ -22,6 +28,18 @@ export class Agent extends ComponentResource {
         opts = this.opts(k8s.Provider);
         this.interfaceName = args.interfaceName ? pulumi.output(args.interfaceName) : pulumi.output(Agent.interfaceName);
         this.interfacePort = args.interfacePort ? pulumi.output(args.interfacePort) : pulumi.output(Agent.interfacePort);
+        this.extraBlacklistInterfaces = pulumi
+            .all([args.extraBlacklistInterfaces, this.interfaceName])
+            .apply(([extraBlacklistInterfaces, interfaceName]) => pulumi.all(extraBlacklistInterfaces ?? []).apply((extraBlacklistInterfaces) => {
+            const interfaces = Agent.extraBlacklistInterfaces;
+            interfaces.push(interfaceName);
+            for (const iface of extraBlacklistInterfaces) {
+                if (!interfaces.includes(iface)) {
+                    interfaces.push(iface);
+                }
+            }
+            return interfaces.map((iface) => pulumi.output(iface));
+        }));
         this.namespace = args.namespace
             ? pulumi.output(args.namespace)
             : new k8s.core.v1.Namespace(name, { metadata: { name } }, opts).metadata.name;
@@ -35,6 +53,7 @@ export class Agent extends ComponentResource {
             },
         };
         const secretName = name;
+        const fixNFTScriptName = `${metadata.name}-fix-nftables`;
         this.secret = new kubernetes.v1.Secret(name, {
             metadata: { ...metadata, name: secretName },
             stringData: {
@@ -43,6 +62,14 @@ export class Agent extends ComponentResource {
                 MANAGEMENT_URL: args.managementUrl,
                 INTERFACE_NAME: this.interfaceName,
                 WIREGUARD_PORT: pulumi.interpolate `${this.interfacePort}`,
+                LOG_LEVEL: "info",
+                DISABLE_CUSTOM_ROUTING: "true",
+            },
+        }, opts);
+        this.fixNFTScript = new k8s.core.v1.ConfigMap(name, {
+            metadata: { ...metadata, name: fixNFTScriptName },
+            data: {
+                "fix-nftables.sh": fs.readFileSync(path.join(path.dirname(url.fileURLToPath(import.meta.url)), "assets", "fix-nftables.sh"), "utf-8"),
             },
         }, opts);
         this.daemonSet = new k8s.apps.v1.DaemonSet(name, {
@@ -63,12 +90,19 @@ export class Agent extends ComponentResource {
                                 name: "netbird",
                                 image: pulumi.interpolate `netbirdio/netbird:${args.version ?? "latest"}`,
                                 imagePullPolicy: "Always",
-                                securityContext: { capabilities: { add: ["NET_ADMIN"] } },
+                                securityContext: {
+                                    privileged: true,
+                                    capabilities: { add: ["NET_ADMIN", "SYS_RESOURCE", "SYS_ADMIN"] },
+                                },
+                                args: [
+                                    "--extra-iface-blacklist",
+                                    this.extraBlacklistInterfaces.apply((interfaces) => pulumi.all(interfaces).apply((interfaces) => interfaces.join(","))),
+                                ],
                                 envFrom: [{ secretRef: { name: secretName }, prefix: "NB_" }],
                                 volumeMounts: [{ name: "config", mountPath: "/etc/netbird/" }],
                                 resources: {
-                                    requests: { memory: "32Mi" },
-                                    limits: { memory: "48Mi" },
+                                    requests: { memory: "48Mi" },
+                                    limits: { memory: "64Mi" },
                                 },
                             },
                         ].concat(args.networkRange
@@ -76,26 +110,23 @@ export class Agent extends ComponentResource {
                                 name: "fix-nftables",
                                 image: "alpine:latest",
                                 imagePullPolicy: "Always",
-                                command: pulumi.all([this.interfaceName, args.networkRange]).apply(([ifname, cidr]) => {
-                                    return [
-                                        "sh",
-                                        "-c",
-                                        [
-                                            "apk --quiet --no-cache add nftables",
-                                            `nft add rule netbird netbird-acl-input-filter position 8 iifname "${ifname}" ip saddr ${cidr} ip daddr ${cidr} jump netbird-acl-input-rules`,
-                                            `nft add rule netbird netbird-acl-output-filter position 13 oifname "${ifname}" ip saddr ${cidr} ip daddr ${cidr} jump netbird-acl-output-rules`,
-                                            "sleep infinity",
-                                        ].join(" && "),
-                                    ];
-                                }),
                                 securityContext: { capabilities: { add: ["NET_ADMIN"] } },
+                                command: [
+                                    pulumi.interpolate `/usr/local/bin/fix-nftables.sh`,
+                                    this.interfaceName,
+                                    args.networkRange,
+                                ],
+                                volumeMounts: [{ name: "fix-nftables", mountPath: "/usr/local/bin" }],
                                 resources: {
                                     requests: { memory: "16Mi" },
                                     limits: { memory: "96Mi" },
                                 },
                             }
                             : []),
-                        volumes: [{ name: "config", hostPath: { path: "/var/lib/netbird", type: "DirectoryOrCreate" } }],
+                        volumes: [
+                            { name: "config", hostPath: { path: `/var/lib/netbird/${name}`, type: "DirectoryOrCreate" } },
+                            { name: "fix-nftables", configMap: { name: fixNFTScriptName, defaultMode: 0o755 } },
+                        ],
                         terminationGracePeriodSeconds: 10,
                     },
                 },

package/lib/netbird/agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../lib/netbird/agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAarD,MAAM,OAAO,KAAM,SAAQ,iBAAiB;IACnC,MAAM,CAAU,aAAa,GAAG,KAAK,CAAC;IACtC,MAAM,CAAU,aAAa,GAAG,KAAK,CAAC;IAE5B,MAAM,CAAuB;IAC7B,SAAS,CAAwB;IACjC,mBAAmB,CAAoC;IACxD,SAAS,CAAwB;IACjC,aAAa,CAAwB;IACrC,aAAa,CAAwB;IAErD;;;;;OAKG;IACH,YAAY,IAAY,EAAE,IAAe,EAAE,IAAsC;QAC/E,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEzC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACjH,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAEjH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEhF,MAAM,QAAQ,GAAG;YACf,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE;gBACN,wBAAwB,EAAE,SAAS;gBACnC,6BAA6B,EAAE,OAAO;gBACtC,4BAA4B,EAAE,IAAI;aACnC;SACF,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,CACpC,IAAI,EACJ;YACE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;YAC3C,UAAU,EAAE;gBACV,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,SAAS,EAAE,IAAI,CAAC,aAAa;gBAC7B,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAA,GAAG,IAAI,CAAC,aAAa,EAAE;aAC1D;SACF,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CACxC,IAAI,EACJ;YACE,QAAQ;YACR,IAAI,EAAE;gBACJ,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE;gBAC1C,QAAQ,EAAE;oBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACrC,IAAI,EAAE;wBACJ,WAAW,EAAE;4BACX,EAAE,GAAG,EAAE,gCAAgC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;4BACnF,EAAE,GAAG,EAAE,uCAAuC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;yBAC3F;wBACD,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,WAAW,EAAE,IAAI;wBACjB,UAAU,EAAE;4BACV;gCACE,IAAI,EAAE,SAAS;gCACf,KAAK,EAAE,MAAM,CAAC,WAAW,CAAA,qBAAqB,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE;gCACxE,eAAe,EAAE,QAAQ;gCACzB,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE;gCACzD,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gCAC7D,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;gCAC9D,SAAS,EAAE;oCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oCAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;iCAC3B;6BACmC;yBACvC,CAAC,MAAM,CACN,IAAI,CAAC,YAAY;4BACf,CAAC,CAAC;gCACE,IAAI,EAAE,cAAc;gCACpB,KAAK,EAAE,eAAe;gCACtB,eAAe,EAAE,QAAQ;gCACzB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;oCACpF,OAAO;wCACL,IAAI;wCACJ,IAAI;wCACJ;4CACE,qCAAqC;4CACrC,qEAAqE,MAAM,cAAc,IAAI,aAAa,IAAI,+BAA+B;4CAC7I,uEAAuE,MAAM,cAAc,IAAI,aAAa,IAAI,gCAAgC;4CAChJ,gBAAgB;yCACjB,CAAC,IAAI,CAAC,MAAM,CAAC;qCACf,CAAC;gCACJ,CAAC,CAAC;gCACF,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE;gCACzD,SAAS,EAAE;oCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oCAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;iCAC3B;6BACF;4BACH,CAAC,CAAC,EAAE,CACP;wBACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC;wBAChG,6BAA6B,EAAE,EAAE;qBAClC;iBACF;aACF;SACF,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,mBAAmB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAC9D,IAAI,EACJ;YACE,QAAQ;YACR,IAAI,EAAE;gBACJ,YAAY,EAAE,CAAC;gBACf,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE;aAC3C;SACF,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC"}
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../lib/netbird/agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAcrD,MAAM,OAAO,KAAM,SAAQ,iBAAiB;IAClC,MAAM,CAAU,wBAAwB,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAC7E,MAAM,CAAU,aAAa,GAAG,KAAK,CAAC;IACtC,MAAM,CAAU,aAAa,GAAG,KAAK,CAAC;IAE5B,wBAAwB,CAAyC;IACjE,MAAM,CAAuB;IAC7B,YAAY,CAAwB;IACpC,SAAS,CAAwB;IACjC,mBAAmB,CAAoC;IACxD,SAAS,CAAwB;IACjC,aAAa,CAAwB;IACrC,aAAa,CAAwB;IAErD;;;;;OAKG;IACH,YAAY,IAAY,EAAE,IAAe,EAAE,IAAsC;QAC/E,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEzC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACjH,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACjH,IAAI,CAAC,wBAAwB,GAAG,MAAM;aACnC,GAAG,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;aACxD,KAAK,CAAC,CAAC,CAAC,wBAAwB,EAAE,aAAa,CAAC,EAAE,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,EAAE;YAC5E,MAAM,UAAU,GAAG,KAAK,CAAC,wBAAwB,CAAC;YAElD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAE/B,KAAK,MAAM,KAAK,IAAI,wBAAwB,EAAE,CAAC;gBAC7C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAED,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CACH,CAAC;QAEJ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEhF,MAAM,QAAQ,GAAG;YACf,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE;gBACN,wBAAwB,EAAE,SAAS;gBACnC,6BAA6B,EAAE,OAAO;gBACtC,4BAA4B,EAAE,IAAI;aACnC;SACF,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC;QACxB,MAAM,gBAAgB,GAAG,GAAG,QAAQ,CAAC,IAAI,eAAe,CAAC;QAEzD,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,CACpC,IAAI,EACJ;YACE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;YAC3C,UAAU,EAAE;gBACV,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,SAAS,EAAE,IAAI,CAAC,aAAa;gBAC7B,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAA,GAAG,IAAI,CAAC,aAAa,EAAE;gBACzD,SAAS,EAAE,MAAM;gBACjB,sBAAsB,EAAE,MAAM;aAC/B;SACF,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAC3C,IAAI,EACJ;YACE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE;YACjD,IAAI,EAAE;gBACJ,iBAAiB,EAAE,EAAE,CAAC,YAAY,CAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,CAAC,EACxF,OAAO,CACR;aACF;SACF,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CACxC,IAAI,EACJ;YACE,QAAQ;YACR,IAAI,EAAE;gBACJ,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE;gBAC1C,QAAQ,EAAE;oBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;oBACrC,IAAI,EAAE;wBACJ,WAAW,EAAE;4BACX,EAAE,GAAG,EAAE,gCAAgC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;4BACnF,EAAE,GAAG,EAAE,uCAAuC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;yBAC3F;wBACD,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,WAAW,EAAE,IAAI;wBACjB,UAAU,EAAE;4BACV;gCACE,IAAI,EAAE,SAAS;gCACf,KAAK,EAAE,MAAM,CAAC,WAAW,CAAA,qBAAqB,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE;gCACxE,eAAe,EAAE,QAAQ;gCACzB,eAAe,EAAE;oCACf,UAAU,EAAE,IAAI;oCAChB,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE;iCAClE;gCACD,IAAI,EAAE;oCACJ,yBAAyB;oCACzB,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CACjD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACnE;iCACF;gCACD,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gCAC7D,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;gCAC9D,SAAS,EAAE;oCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oCAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;iCAC3B;6BACmC;yBACvC,CAAC,MAAM,CACN,IAAI,CAAC,YAAY;4BACf,CAAC,CAAC;gCACE,IAAI,EAAE,cAAc;gCACpB,KAAK,EAAE,eAAe;gCACtB,eAAe,EAAE,QAAQ;gCACzB,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE;gCACzD,OAAO,EAAE;oCACP,MAAM,CAAC,WAAW,CAAA,gCAAgC;oCAClD,IAAI,CAAC,aAAa;oCAClB,IAAI,CAAC,YAAY;iCAClB;gCACD,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;gCACrE,SAAS,EAAE;oCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oCAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;iCAC3B;6BACF;4BACH,CAAC,CAAC,EAAE,CACP;wBACD,OAAO,EAAE;4BACP,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,oBAAoB,IAAI,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;4BAC7F,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;yBACpF;wBACD,6BAA6B,EAAE,EAAE;qBAClC;iBACF;aACF;SACF,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,mBAAmB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAC9D,IAAI,EACJ;YACE,QAAQ;YACR,IAAI,EAAE;gBACJ,YAAY,EAAE,CAAC;gBACf,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE;aAC3C;SACF,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC"}

package/lib/netbird/assets/fix-nftables.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+
+IFACE="${1}"
+CIDR="${2}"
+
+apk --quiet --no-cache add nftables
+
+while true; do
+  input_handle=$(nft -a -n list ruleset 2>/dev/null | grep "iifname \"${IFACE}\" ip saddr ${CIDR} ip daddr ${CIDR} jump netbird-acl-input-rules" | awk '{print $NF}')
+  if [ -z "${input_handle}" ]; then
+    nft add rule netbird netbird-acl-input-filter position 8 iifname "${IFACE}" ip saddr "${CIDR}" ip daddr "${CIDR}" jump netbird-acl-input-rules
+  fi
+
+  output_handle=$(nft -a -n list ruleset 2>/dev/null | grep "oifname \"${IFACE}\" ip saddr ${CIDR} ip daddr ${CIDR} jump netbird-acl-output-rules" | awk '{print $NF}')
+  if [ -z "${output_handle}" ]; then
+    nft add rule netbird netbird-acl-output-filter position 13 oifname "${IFACE}" ip saddr "${CIDR}" ip daddr "${CIDR}" jump netbird-acl-output-rules
+  fi
+
+  sleep 10
+done

package/lib/netbird/management.d.ts

@@ -24,9 +24,16 @@ export interface ManagementArgs {
         [key: string]: pulumi.Input<string>;
     }>;
     version?: pulumi.Input<string>;
+    coturnIPs?: pulumi.Input<pulumi.Input<string>[]>;
     protect?: boolean;
 }
 export declare class Management extends ComponentResource {
+    static readonly coturnPort = 3478;
+    static readonly coturnPortAlt = 3479;
+    static readonly coturnPortTLS = 5349;
+    static readonly coturnPortTLSAlt = 5350;
+    static readonly coturnPortMin = 49152;
+    static readonly coturnPortMax = 65535;
     private readonly turnUsername;
     private readonly turnPassword;
     private readonly dataEncryptionKey;

package/lib/netbird/management.js

@@ -6,6 +6,12 @@ import * as kubernetes from "../kubernetes/index.js";
 import * as traefik from "../traefik/index.js";
 import * as node from "../node/index.js";
 export class Management extends ComponentResource {
+    static coturnPort = 3478;
+    static coturnPortAlt = 3479;
+    static coturnPortTLS = 5349;
+    static coturnPortTLSAlt = 5350;
+    static coturnPortMin = 49152;
+    static coturnPortMax = 65535;
     turnUsername;
     turnPassword;
     dataEncryptionKey;
@@ -134,23 +140,33 @@ export class Management extends ComponentResource {
             metadata: coturnMetadata,
             stringData: {
                 "turnserver.conf": pulumi
-                    .all([args.relayHostname, this.turnUsername, this.turnPassword])
-                    .apply(([relayHostname, turnUsername, turnPassword]) => [
-                    "listening-port=3478",
-                    "tls-listening-port=5349",
-                    "min-port=49152",
-                    "max-port=65535",
-                    "fingerprint",
-                    "lt-cred-mech",
-                    `user=${turnUsername}:${turnPassword}`,
-                    `realm=${relayHostname}`,
-                    "cert=/etc/coturn/certs/cert.pem",
-                    "pkey=/etc/coturn/private/privkey.pem",
-                    "log-file=stdout",
-                    "no-software-attribute",
-                    `pidfile="/var/tmp/turnserver.pid"`,
-                    "no-cli",
-                ].join("\n")),
+                    .all([args.relayHostname, this.turnUsername, this.turnPassword, args.coturnIPs])
+                    .apply(([relayHostname, turnUsername, turnPassword, coturnIPs]) => pulumi.all(coturnIPs ?? []).apply((coturnIPs) => {
+                    const config = [
+                        `listening-port=${Management.coturnPort}`,
+                        `alt-listening-port=${Management.coturnPortAlt}`,
+                        `tls-listening-port=${Management.coturnPortTLS}`,
+                        `alt-tls-listening-port=${Management.coturnPortTLSAlt}`,
+                        `min-port=${Management.coturnPortMin}`,
+                        `max-port=${Management.coturnPortMax}`,
+                        "fingerprint",
+                        "lt-cred-mech",
+                        `user=${turnUsername}:${turnPassword}`,
+                        `realm=${relayHostname}`,
+                        "cert=/etc/coturn/certs/cert.pem",
+                        "pkey=/etc/coturn/private/privkey.pem",
+                        "log-file=stdout",
+                        "no-software-attribute",
+                        `pidfile="/var/tmp/turnserver.pid"`,
+                        "no-cli",
+                        "no-tls",
+                    ];
+                    for (const coturnIP of coturnIPs) {
+                        config.push(`listening-ip=${coturnIP}`);
+                        config.push(`relay-ip=${coturnIP}`);
+                    }
+                    return config.join("\n");
+                })),
             },
         }, k8sOpts);
         this.coturnDaemonSet = new k8s.apps.v1.DaemonSet(`${name}-coturn`, {
@@ -171,10 +187,12 @@ export class Management extends ComponentResource {
                                 name: "coturn",
                                 image: "coturn/coturn:latest",
                                 imagePullPolicy: "Always",
-                                args: ["-c /etc/turnserver.conf"],
+                                args: ["-c", "/etc/turnserver.conf"],
                                 ports: [
-                                    { name: "turn", protocol: "UDP", containerPort: 3478 },
-                                    { name: "turn-tls", protocol: "UDP", containerPort: 5349 },
+                                    { name: "turn", protocol: "UDP", containerPort: Management.coturnPort },
+                                    { name: "turn-alt", protocol: "UDP", containerPort: Management.coturnPortAlt },
+                                    { name: "turn-tls", protocol: "UDP", containerPort: Management.coturnPortTLS },
+                                    { name: "turn-tls-alt", protocol: "UDP", containerPort: Management.coturnPortTLSAlt },
                                 ],
                                 volumeMounts: [
                                     { name: "config", mountPath: "/etc/turnserver.conf", subPath: "turnserver.conf", readOnly: true },
@@ -203,8 +221,10 @@ export class Management extends ComponentResource {
             spec: {
                 selector: coturnMetadata.labels,
                 ports: [
-                    { name: "turn", protocol: "UDP", port: 3478, targetPort: "turn" },
-                    { name: "turn-tls", protocol: "UDP", port: 5349, targetPort: "turn-tls" },
+                    { name: "turn", protocol: "UDP", port: Management.coturnPort, targetPort: "turn" },
+                    { name: "turn-alt", protocol: "UDP", port: Management.coturnPortAlt, targetPort: "turn-atl" },
+                    { name: "turn-tls", protocol: "UDP", port: Management.coturnPortTLS, targetPort: "turn-tls" },
+                    { name: "turn-tls-alt", protocol: "UDP", port: Management.coturnPortTLSAlt, targetPort: "turn-tls-alt" },
                 ],
             },
         }, { ...k8sOpts, dependsOn: [this.coturnDaemonSet] });
@@ -230,10 +250,15 @@ export class Management extends ComponentResource {
                     this.dataEncryptionKey,
                 ])
                     .apply(([idp, hostname, relayHostname, turnUsername, turnPassword, dataEncryptionKey]) => JSON.stringify({
-                    Stuns: [{ Proto: "udp", URI: `stun:${relayHostname}:3478` }],
+                    Stuns: [{ Proto: "udp", URI: `stun:${relayHostname}:${Management.coturnPort}` }],
                     TURNConfig: {
                         Turns: [
-                            { Proto: "udp", URI: `stun:${relayHostname}:3478`, Username: turnUsername, Password: turnPassword },
+                            {
+                                Proto: "udp",
+                                URI: `stun:${relayHostname}:${Management.coturnPort}`,
+                                Username: turnUsername,
+                                Password: turnPassword,
+                            },
                         ],
                         TimeBasedCredentials: false,
                     },