alchemy-effect 0.5.0 → 0.6.2

package/src/AWS/EKS/Cluster.ts

@@ -0,0 +1,655 @@
+import * as eks from "@distilled.cloud/aws/eks";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import {
+  deleteObjects,
+  reconcileObjects,
+  type KubernetesClusterConnection,
+} from "../../Kubernetes/client.ts";
+import {
+  type KubernetesObjectBinding,
+  type KubernetesObjectDefinition,
+  type KubernetesObjectRef,
+} from "../../Kubernetes/types.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
+import type { AccountID } from "../Account.ts";
+import type { RegionID } from "../Region.ts";
+
+export type ClusterName = string;
+export type ClusterArn =
+  `arn:aws:eks:${RegionID}:${AccountID}:cluster/${ClusterName}`;
+
+export interface ClusterProps {
+  /**
+   * Cluster name. If omitted, a unique name is generated.
+   */
+  clusterName?: string;
+  /**
+   * IAM role ARN assumed by the EKS control plane.
+   */
+  roleArn: string;
+  /**
+   * VPC configuration for the cluster control plane.
+   */
+  resourcesVpcConfig: eks.VpcConfigRequest;
+  /**
+   * Desired Kubernetes version.
+   */
+  version?: string;
+  /**
+   * Cluster access configuration.
+   */
+  accessConfig?: eks.CreateAccessConfigRequest;
+  /**
+   * Auto Mode compute configuration.
+   */
+  computeConfig?: eks.ComputeConfigRequest;
+  /**
+   * Auto Mode storage configuration.
+   */
+  storageConfig?: eks.StorageConfigRequest;
+  /**
+   * Kubernetes network configuration.
+   */
+  kubernetesNetworkConfig?: eks.KubernetesNetworkConfigRequest;
+  /**
+   * Control plane logging configuration.
+   */
+  logging?: eks.Logging;
+  /**
+   * Upgrade support policy for the cluster.
+   */
+  upgradePolicy?: eks.UpgradePolicyRequest;
+  /**
+   * Whether deletion protection is enabled.
+   * @default false
+   */
+  deletionProtection?: boolean;
+  /**
+   * User-defined tags to apply to the cluster.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Cluster extends Resource<
+  "AWS.EKS.Cluster",
+  ClusterProps,
+  {
+    clusterArn: ClusterArn;
+    clusterName: ClusterName;
+    status: string;
+    endpoint: string | undefined;
+    certificateAuthorityData: string | undefined;
+    version: string | undefined;
+    platformVersion: string | undefined;
+    roleArn: string;
+    resourcesVpcConfig: eks.VpcConfigResponse;
+    accessConfig: eks.AccessConfigResponse | undefined;
+    computeConfig: eks.ComputeConfigResponse | undefined;
+    storageConfig: eks.StorageConfigResponse | undefined;
+    kubernetesNetworkConfig: eks.KubernetesNetworkConfigResponse | undefined;
+    logging: eks.Logging | undefined;
+    upgradePolicy: eks.UpgradePolicyResponse | undefined;
+    deletionProtection: boolean;
+    oidcIssuer: string | undefined;
+    tags: Record<string, string>;
+    kubernetesObjects: KubernetesObjectRef[];
+  },
+  KubernetesObjectBinding
+> {}
+
+/**
+ * An Amazon EKS cluster with support for EKS Auto Mode settings.
+ *
+ * @section Creating Clusters
+ * @example Auto Mode Cluster from Existing Roles and Subnets
+ * ```typescript
+ * const cluster = yield* Cluster("AppCluster", {
+ *   roleArn: clusterRole.roleArn,
+ *   resourcesVpcConfig: {
+ *     subnetIds: network.privateSubnetIds,
+ *     endpointPublicAccess: true,
+ *     endpointPrivateAccess: true,
+ *   },
+ *   accessConfig: {
+ *     authenticationMode: "API",
+ *   },
+ *   computeConfig: {
+ *     enabled: true,
+ *     nodeRoleArn: nodeRole.roleArn,
+ *     nodePools: ["system", "general-purpose"],
+ *   },
+ *   kubernetesNetworkConfig: {
+ *     elasticLoadBalancing: { enabled: true },
+ *   },
+ *   storageConfig: {
+ *     blockStorage: { enabled: true },
+ *   },
+ * });
+ * ```
+ */
+export const Cluster = Resource<Cluster>("AWS.EKS.Cluster");
+
+class ClusterNotReady extends Data.TaggedError("EKS.ClusterNotReady")<{
+  status: string | undefined;
+}> {}
+
+class ClusterStillExists extends Data.TaggedError(
+  "EKS.ClusterStillExists",
+)<{}> {}
+
+class ClusterUpdateNotComplete extends Data.TaggedError(
+  "EKS.ClusterUpdateNotComplete",
+)<{
+  status: eks.UpdateStatus | undefined;
+}> {}
+
+const normalizeTags = (tags: Record<string, string | undefined> | undefined) =>
+  Object.fromEntries(
+    Object.entries(tags ?? {}).filter(
+      (entry): entry is [string, string] => entry[1] !== undefined,
+    ),
+  );
+
+const jsonEqual = (a: unknown, b: unknown) =>
+  JSON.stringify(a ?? undefined) === JSON.stringify(b ?? undefined);
+
+const updateRetrySchedule = Schedule.exponential("1 second").pipe(
+  Schedule.both(Schedule.recurs(120)),
+);
+
+const getKubernetesConnection = (
+  state: Pick<
+    Cluster["Attributes"],
+    "clusterName" | "endpoint" | "certificateAuthorityData"
+  >,
+): KubernetesClusterConnection => {
+  if (!state.endpoint || !state.certificateAuthorityData) {
+    throw new Error(
+      `EKS cluster '${state.clusterName}' is missing endpoint or certificate authority data`,
+    );
+  }
+
+  return {
+    clusterName: state.clusterName,
+    endpoint: state.endpoint,
+    certificateAuthorityData: state.certificateAuthorityData,
+  };
+};
+
+const getDesiredKubernetesObjects = (
+  bindings: ReadonlyArray<ResourceBinding<KubernetesObjectBinding>>,
+): KubernetesObjectDefinition[] =>
+  bindings
+    .filter(
+      (binding): binding is ResourceBinding<KubernetesObjectBinding> =>
+        binding.data.type === "kubernetes-object",
+    )
+    .map((binding) => binding.data.object);
+
+const clusterConfigChanged = (olds: ClusterProps, news: ClusterProps) =>
+  !jsonEqual(olds.resourcesVpcConfig, news.resourcesVpcConfig) ||
+  !jsonEqual(
+    olds.accessConfig?.authenticationMode,
+    news.accessConfig?.authenticationMode,
+  ) ||
+  !jsonEqual(olds.computeConfig, news.computeConfig) ||
+  !jsonEqual(olds.storageConfig, news.storageConfig) ||
+  !jsonEqual(olds.kubernetesNetworkConfig, news.kubernetesNetworkConfig) ||
+  !jsonEqual(olds.logging, news.logging) ||
+  !jsonEqual(olds.upgradePolicy, news.upgradePolicy) ||
+  (olds.deletionProtection ?? false) !== (news.deletionProtection ?? false);
+
+const mapClusterState = (
+  cluster: eks.Cluster,
+  tags: Record<string, string>,
+  kubernetesObjects: KubernetesObjectRef[],
+): Cluster["Attributes"] => ({
+  clusterArn: cluster.arn as ClusterArn,
+  clusterName: cluster.name!,
+  status: cluster.status ?? "CREATING",
+  endpoint: cluster.endpoint,
+  certificateAuthorityData: cluster.certificateAuthority?.data,
+  version: cluster.version,
+  platformVersion: cluster.platformVersion,
+  roleArn: cluster.roleArn!,
+  resourcesVpcConfig: {
+    subnetIds: cluster.resourcesVpcConfig?.subnetIds ?? [],
+    securityGroupIds: cluster.resourcesVpcConfig?.securityGroupIds ?? [],
+    clusterSecurityGroupId: cluster.resourcesVpcConfig?.clusterSecurityGroupId,
+    vpcId: cluster.resourcesVpcConfig?.vpcId,
+    endpointPublicAccess: cluster.resourcesVpcConfig?.endpointPublicAccess,
+    endpointPrivateAccess: cluster.resourcesVpcConfig?.endpointPrivateAccess,
+    publicAccessCidrs: cluster.resourcesVpcConfig?.publicAccessCidrs ?? [],
+  },
+  accessConfig: cluster.accessConfig,
+  computeConfig: cluster.computeConfig,
+  storageConfig: cluster.storageConfig,
+  kubernetesNetworkConfig: cluster.kubernetesNetworkConfig,
+  logging: cluster.logging,
+  upgradePolicy: cluster.upgradePolicy,
+  deletionProtection: cluster.deletionProtection ?? false,
+  oidcIssuer: cluster.identity?.oidc?.issuer,
+  tags,
+  kubernetesObjects,
+});
+
+export const ClusterProvider = () =>
+  Cluster.provider.effect(
+    Effect.gen(function* () {
+      const toClusterName = (
+        id: string,
+        props: { clusterName?: string } = {},
+      ) =>
+        props.clusterName
+          ? Effect.succeed(props.clusterName)
+          : createPhysicalName({ id, maxLength: 100 });
+
+      const toClientRequestToken = (id: string, action: string) =>
+        createPhysicalName({
+          id: `${id}-${action}`,
+          maxLength: 64,
+          delimiter: "-",
+        });
+
+      const validateProps = Effect.fn(function* (props: ClusterProps) {
+        const subnetIds = props.resourcesVpcConfig.subnetIds ?? [];
+        if (subnetIds.length < 2) {
+          return yield* Effect.fail(
+            new Error("AWS.EKS.Cluster requires at least two subnet IDs"),
+          );
+        }
+        if (
+          props.computeConfig?.enabled &&
+          props.accessConfig?.authenticationMode === "CONFIG_MAP"
+        ) {
+          return yield* Effect.fail(
+            new Error(
+              "AWS.EKS.Cluster Auto Mode requires accessConfig.authenticationMode to include API access",
+            ),
+          );
+        }
+      });
+
+      const readCluster = Effect.fn(function* ({
+        clusterName,
+        kubernetesObjects,
+      }: {
+        clusterName: string;
+        kubernetesObjects?: KubernetesObjectRef[];
+      }) {
+        const described = yield* eks
+          .describeCluster({
+            name: clusterName,
+          })
+          .pipe(
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        const cluster = described?.cluster;
+        if (!cluster?.arn || !cluster.name || !cluster.roleArn) {
+          return undefined;
+        }
+        const listedTags = yield* eks
+          .listTagsForResource({
+            resourceArn: cluster.arn,
+          })
+          .pipe(
+            Effect.catchTag("NotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        const tags = normalizeTags(listedTags?.tags ?? cluster.tags);
+        return mapClusterState(cluster, tags, kubernetesObjects ?? []);
+      });
+
+      const resolveOwnedCluster = Effect.fn(function* (
+        id: string,
+        clusterName: string,
+      ) {
+        const state = yield* readCluster({
+          clusterName,
+        });
+        if (!state) {
+          return yield* Effect.fail(
+            new Error(`cluster '${clusterName}' exists but could not be read`),
+          );
+        }
+        if (!(yield* hasAlchemyTags(id, state.tags))) {
+          return yield* Effect.fail(
+            new Error(
+              `cluster '${clusterName}' already exists and is not managed by alchemy`,
+            ),
+          );
+        }
+        return state;
+      });
+
+      const waitForClusterActive = (
+        clusterName: string,
+        kubernetesObjects: KubernetesObjectRef[] = [],
+      ) =>
+        readCluster({
+          clusterName,
+          kubernetesObjects,
+        }).pipe(
+          Effect.flatMap((state) => {
+            if (!state) {
+              return Effect.fail(
+                new ClusterNotReady({
+                  status: undefined,
+                }),
+              );
+            }
+            if (state.status === "ACTIVE") {
+              return Effect.succeed(state);
+            }
+            if (state.status === "FAILED") {
+              return Effect.fail(
+                new Error(`EKS cluster '${clusterName}' entered FAILED state`),
+              );
+            }
+            return Effect.fail(
+              new ClusterNotReady({
+                status: state.status,
+              }),
+            );
+          }),
+          Effect.retry({
+            while: (error) => error instanceof ClusterNotReady,
+            schedule: updateRetrySchedule,
+          }),
+        );
+
+      const waitForClusterDeleted = (clusterName: string) =>
+        readCluster({
+          clusterName,
+        }).pipe(
+          Effect.flatMap((state) =>
+            state
+              ? Effect.fail(new ClusterStillExists())
+              : Effect.succeed(undefined),
+          ),
+          Effect.retry({
+            while: (error) => error instanceof ClusterStillExists,
+            schedule: updateRetrySchedule,
+          }),
+        );
+
+      const waitForUpdate = (clusterName: string, updateId: string) =>
+        eks
+          .describeUpdate({
+            name: clusterName,
+            updateId,
+          })
+          .pipe(
+            Effect.flatMap(({ update }) => {
+              if (update?.status === "Successful") {
+                return Effect.succeed(update);
+              }
+              if (
+                update?.status === "Failed" ||
+                update?.status === "Cancelled"
+              ) {
+                return Effect.fail(
+                  new Error(
+                    `EKS cluster update '${updateId}' failed with status '${update?.status}'`,
+                  ),
+                );
+              }
+              return Effect.fail(
+                new ClusterUpdateNotComplete({
+                  status: update?.status,
+                }),
+              );
+            }),
+            Effect.retry({
+              while: (error) => error instanceof ClusterUpdateNotComplete,
+              schedule: updateRetrySchedule,
+            }),
+          );
+
+      return {
+        stables: ["clusterArn", "clusterName"],
+        diff: Effect.fn(function* ({ id, olds = {} as ClusterProps, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toClusterName(id, olds)) !==
+            (yield* toClusterName(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (olds.roleArn !== news.roleArn) {
+            return { action: "replace" } as const;
+          }
+          if (
+            olds.accessConfig?.bootstrapClusterCreatorAdminPermissions !==
+            news.accessConfig?.bootstrapClusterCreatorAdminPermissions
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            olds.kubernetesNetworkConfig?.serviceIpv4Cidr !==
+              news.kubernetesNetworkConfig?.serviceIpv4Cidr ||
+            olds.kubernetesNetworkConfig?.ipFamily !==
+              news.kubernetesNetworkConfig?.ipFamily
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            olds.computeConfig?.nodeRoleArn !==
+              news.computeConfig?.nodeRoleArn &&
+            (olds.computeConfig?.enabled || news.computeConfig?.enabled)
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const clusterName =
+            output?.clusterName ?? (yield* toClusterName(id, olds ?? {}));
+          return yield* readCluster({
+            clusterName,
+            kubernetesObjects: output?.kubernetesObjects,
+          });
+        }),
+        create: Effect.fn(function* ({ id, news, bindings, session }) {
+          yield* validateProps(news);
+
+          const clusterName = yield* toClusterName(id, news);
+          const desiredObjects = getDesiredKubernetesObjects(bindings);
+          const tags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          yield* eks
+            .createCluster({
+              name: clusterName,
+              version: news.version,
+              roleArn: news.roleArn,
+              resourcesVpcConfig: news.resourcesVpcConfig,
+              kubernetesNetworkConfig: news.kubernetesNetworkConfig,
+              logging: news.logging,
+              accessConfig: news.accessConfig,
+              computeConfig: news.computeConfig,
+              storageConfig: news.storageConfig,
+              deletionProtection: news.deletionProtection,
+              upgradePolicy: news.upgradePolicy,
+              tags,
+              clientRequestToken: yield* toClientRequestToken(id, "create"),
+            })
+            .pipe(
+              Effect.catchTag("ResourceInUseException", () =>
+                resolveOwnedCluster(id, clusterName).pipe(Effect.asVoid),
+              ),
+            );
+
+          yield* session.note(`Creating EKS cluster ${clusterName}...`);
+          const cluster = yield* waitForClusterActive(clusterName);
+          const kubernetesObjects = yield* reconcileObjects({
+            connection: getKubernetesConnection(cluster),
+            previousObjects: [],
+            desiredObjects,
+          });
+          return {
+            ...cluster,
+            kubernetesObjects,
+          };
+        }),
+        update: Effect.fn(function* ({
+          id,
+          news,
+          olds,
+          output,
+          bindings,
+          session,
+        }) {
+          yield* validateProps(news);
+
+          if (clusterConfigChanged(olds, news)) {
+            const configUpdate = yield* eks.updateClusterConfig({
+              name: output.clusterName,
+              resourcesVpcConfig: news.resourcesVpcConfig,
+              logging: news.logging,
+              accessConfig: news.accessConfig
+                ? {
+                    authenticationMode: news.accessConfig.authenticationMode,
+                  }
+                : undefined,
+              upgradePolicy: news.upgradePolicy,
+              computeConfig: news.computeConfig,
+              kubernetesNetworkConfig: news.kubernetesNetworkConfig,
+              storageConfig: news.storageConfig,
+              deletionProtection: news.deletionProtection,
+              clientRequestToken: yield* toClientRequestToken(id, "config"),
+            });
+            if (configUpdate.update?.id) {
+              yield* session.note(
+                `Updating EKS cluster config ${output.clusterName}...`,
+              );
+              yield* waitForUpdate(output.clusterName, configUpdate.update.id);
+              yield* waitForClusterActive(
+                output.clusterName,
+                output.kubernetesObjects ?? [],
+              );
+            }
+          }
+
+          if (olds.version !== news.version && news.version) {
+            const versionUpdate = yield* eks.updateClusterVersion({
+              name: output.clusterName,
+              version: news.version,
+              clientRequestToken: yield* toClientRequestToken(id, "version"),
+            });
+            if (versionUpdate.update?.id) {
+              yield* session.note(
+                `Updating EKS cluster version ${output.clusterName}...`,
+              );
+              yield* waitForUpdate(output.clusterName, versionUpdate.update.id);
+              yield* waitForClusterActive(
+                output.clusterName,
+                output.kubernetesObjects ?? [],
+              );
+            }
+          }
+
+          const oldTags = {
+            ...(yield* createInternalTags(id)),
+            ...olds.tags,
+          };
+          const newTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          const { removed, upsert } = diffTags(oldTags, newTags);
+
+          if (upsert.length > 0) {
+            yield* eks.tagResource({
+              resourceArn: output.clusterArn,
+              tags: Object.fromEntries(
+                upsert.map((tag) => [tag.Key, tag.Value] as const),
+              ),
+            });
+          }
+          if (removed.length > 0) {
+            yield* eks.untagResource({
+              resourceArn: output.clusterArn,
+              tagKeys: removed,
+            });
+          }
+
+          yield* session.note(output.clusterArn);
+
+          const state = yield* readCluster({
+            clusterName: output.clusterName,
+            kubernetesObjects: output.kubernetesObjects ?? [],
+          }).pipe(
+            Effect.flatMap((state) =>
+              state
+                ? Effect.succeed(state)
+                : Effect.fail(
+                    new Error(
+                      `EKS cluster '${output.clusterName}' could not be read after update`,
+                    ),
+                  ),
+            ),
+          );
+
+          const kubernetesObjects = yield* reconcileObjects({
+            connection: getKubernetesConnection(state),
+            previousObjects: output.kubernetesObjects ?? [],
+            desiredObjects: getDesiredKubernetesObjects(bindings),
+          });
+
+          return {
+            ...state,
+            kubernetesObjects,
+          };
+        }),
+        delete: Effect.fn(function* ({ id, output }) {
+          if ((output.kubernetesObjects ?? []).length > 0) {
+            yield* deleteObjects({
+              connection: getKubernetesConnection(output),
+              objects: output.kubernetesObjects ?? [],
+            });
+          }
+
+          if (output.deletionProtection) {
+            const disableDeletionProtection = yield* eks.updateClusterConfig({
+              name: output.clusterName,
+              deletionProtection: false,
+              clientRequestToken: yield* toClientRequestToken(
+                id,
+                "disable-deletion-protection",
+              ),
+            });
+            if (disableDeletionProtection.update?.id) {
+              yield* waitForUpdate(
+                output.clusterName,
+                disableDeletionProtection.update.id,
+              );
+              yield* waitForClusterActive(
+                output.clusterName,
+                output.kubernetesObjects ?? [],
+              );
+            }
+          }
+
+          yield* eks
+            .deleteCluster({
+              name: output.clusterName,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+
+          yield* waitForClusterDeleted(output.clusterName);
+        }),
+      };
+    }),
+  );