pepr 0.1.19 → 0.1.21

package/README.md

@@ -1,6 +1,6 @@
 # Pepr
 
-<img align="right" width="350" src=".images/pepr.png" />
+<img align="right" width="40%" src=".images/pepr.png" />
 
 Pepr is an open-source project that helps IT Ops teams of all skill levels manage and modify resources in a Kubernetes (K8s) cluster using TypeScript. Kubernetes simplifies the management of multiple computers working together to run and scale applications. Pepr acts as a smart assistant, automatically changing or validating parts of the system as needed.
 

package/dist/pepr-cli.js

@@ -7,6 +7,7 @@ var typescript = require('@rollup/plugin-typescript');
 var fs = require('fs');
 var path = require('path');
 var rollup = require('rollup');
+var types = require('./types-672dd6e4.js');
 require('@kubernetes/client-node/dist');
 require('ramda');
 require('fast-json-patch');
@@ -20,7 +21,7 @@ var uuid = require('uuid');
 var commander = require('commander');
 var chokidar = require('chokidar');
 
-var version = "0.1.19";
+var version = "0.1.21";
 
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: 2023-Present The Pepr Authors
@@ -90,207 +91,66 @@ const banner = `    [38;5;
                                                                                                                                                 
     `;
 
-// SPDX-License-Identifier: Apache-2.0
-// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
-/**
- * Enumeration representing different logging levels.
- */
-var LogLevel;
-(function (LogLevel) {
-    LogLevel[LogLevel["debug"] = 0] = "debug";
-    LogLevel[LogLevel["info"] = 1] = "info";
-    LogLevel[LogLevel["warn"] = 2] = "warn";
-    LogLevel[LogLevel["error"] = 3] = "error";
-})(LogLevel || (LogLevel = {}));
-var ConsoleColors;
-(function (ConsoleColors) {
-    ConsoleColors["Reset"] = "\u001B[0m";
-    ConsoleColors["Bright"] = "\u001B[1m";
-    ConsoleColors["Dim"] = "\u001B[2m";
-    ConsoleColors["Underscore"] = "\u001B[4m";
-    ConsoleColors["Blink"] = "\u001B[5m";
-    ConsoleColors["Reverse"] = "\u001B[7m";
-    ConsoleColors["Hidden"] = "\u001B[8m";
-    ConsoleColors["FgBlack"] = "\u001B[30m";
-    ConsoleColors["FgRed"] = "\u001B[31m";
-    ConsoleColors["FgGreen"] = "\u001B[32m";
-    ConsoleColors["FgYellow"] = "\u001B[33m";
-    ConsoleColors["FgBlue"] = "\u001B[34m";
-    ConsoleColors["FgMagenta"] = "\u001B[35m";
-    ConsoleColors["FgCyan"] = "\u001B[36m";
-    ConsoleColors["FgWhite"] = "\u001B[37m";
-    ConsoleColors["BgBlack"] = "\u001B[40m";
-    ConsoleColors["BgRed"] = "\u001B[41m";
-    ConsoleColors["BgGreen"] = "\u001B[42m";
-    ConsoleColors["BgYellow"] = "\u001B[43m";
-    ConsoleColors["BgBlue"] = "\u001B[44m";
-    ConsoleColors["BgMagenta"] = "\u001B[45m";
-    ConsoleColors["BgCyan"] = "\u001B[46m";
-    ConsoleColors["BgWhite"] = "\u001B[47m";
-})(ConsoleColors || (ConsoleColors = {}));
+const caName = "Pepr Ephemeral CA";
 /**
- * Simple logger class that logs messages at different log levels.
- */
-class Logger {
-    /**
-     * Create a new logger instance.
-     * @param logLevel - The minimum log level to log messages for.
-     */
-    constructor(logLevel) {
-        this._logLevel = logLevel;
-    }
-    /**
-     * Change the log level of the logger.
-     * @param logLevel - The log level to log the message at.
-     */
-    SetLogLevel(logLevel) {
-        this._logLevel = LogLevel[logLevel];
-        this.debug(`Log level set to ${logLevel}`);
-    }
-    /**
-     * Log a debug message.
-     * @param message - The message to log.
-     */
-    debug(message, prefix) {
-        this.log(LogLevel.debug, message, prefix);
-    }
-    /**
-     * Log an info message.
-     * @param message - The message to log.
-     */
-    info(message, prefix) {
-        this.log(LogLevel.info, message, prefix);
-    }
-    /**
-     * Log a warning message.
-     * @param message - The message to log.
-     */
-    warn(message, prefix) {
-        this.log(LogLevel.warn, message, prefix);
-    }
-    /**
-     * Log an error message.
-     * @param message - The message to log.
-     */
-    error(message, prefix) {
-        this.log(LogLevel.error, message, prefix);
-    }
-    /**
-     * Log a message at the specified log level.
-     * @param logLevel - The log level of the message.
-     * @param message - The message to log.
-     */
-    log(logLevel, message, callerPrefix = "") {
-        const color = {
-            [LogLevel.debug]: ConsoleColors.FgBlack,
-            [LogLevel.info]: ConsoleColors.FgCyan,
-            [LogLevel.warn]: ConsoleColors.FgYellow,
-            [LogLevel.error]: ConsoleColors.FgRed,
-        };
-        if (logLevel >= this._logLevel) {
-            // Prefix the message with the colored log level.
-            let prefix = "[" + LogLevel[logLevel] + "]\t" + callerPrefix;
-            prefix = this.colorize(prefix, color[logLevel]);
-            // If the message is not a string, use the debug method to log the object.
-            if (typeof message !== "string") {
-                console.log(prefix);
-                console.debug("%o", message);
-            }
-            else {
-                console.log(prefix + "\t" + message);
-            }
-        }
-    }
-    colorize(text, color) {
-        return color + text + ConsoleColors.Reset;
-    }
-}
-var Log = new Logger(LogLevel.info);
-
-// SPDX-License-Identifier: Apache-2.0
-// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
-var Operation;
-(function (Operation) {
-    Operation["CREATE"] = "CREATE";
-    Operation["UPDATE"] = "UPDATE";
-    Operation["DELETE"] = "DELETE";
-    Operation["CONNECT"] = "CONNECT";
-})(Operation || (Operation = {}));
-
-// SPDX-License-Identifier: Apache-2.0
-// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
-/**
- * The behavior of this module when an error occurs.
- */
-var ErrorBehavior;
-(function (ErrorBehavior) {
-    ErrorBehavior["ignore"] = "ignore";
-    ErrorBehavior["audit"] = "audit";
-    ErrorBehavior["reject"] = "reject";
-})(ErrorBehavior || (ErrorBehavior = {}));
-/**
- * The phase of the Kubernetes admission webhook that the capability is registered for.
+ * Generates a self-signed CA and server certificate with Subject Alternative Names (SANs) for the K8s webhook.
  *
- * Currently only `mutate` is supported.
+ * @param {string} name - The name to use for the server certificate's Common Name and SAN DNS entry.
+ * @returns {TLSOut} - An object containing the Base64-encoded CA, server certificate, and server private key.
  */
-var HookPhase;
-(function (HookPhase) {
-    HookPhase["mutate"] = "mutate";
-    HookPhase["valdiate"] = "validate";
-})(HookPhase || (HookPhase = {}));
-/**
- * The type of Kubernetes mutating webhook event ethat the capability action is registered for.
- */
-var Event;
-(function (Event) {
-    Event["Create"] = "create";
-    Event["Update"] = "update";
-    Event["Delete"] = "delete";
-    Event["CreateOrUpdate"] = "createOrUpdate";
-})(Event || (Event = {}));
-
-// SPDX-License-Identifier: Apache-2.0
 function genTLS(name) {
-    // Generate a new CA key pair
+    // Generate a new CA key pair and create a self-signed CA certificate
     const caKeys = forge.pki.rsa.generateKeyPair(2048);
-    const caCert = forge.pki.createCertificate();
-    caCert.publicKey = caKeys.publicKey;
-    caCert.serialNumber = "01";
-    caCert.validity.notBefore = new Date();
-    caCert.validity.notAfter = new Date();
-    caCert.validity.notAfter.setFullYear(caCert.validity.notBefore.getFullYear() + 1);
-    const caAttrs = [
+    const caCert = genCert(caKeys, caName, [{ name: "commonName", value: caName }]);
+    caCert.setExtensions([
         {
-            name: "commonName",
-            value: "Pepr Ephemeral CA",
+            name: "basicConstraints",
+            cA: true,
         },
-    ];
-    caCert.setSubject(caAttrs);
-    caCert.setIssuer(caAttrs);
-    caCert.sign(caKeys.privateKey, forge.md.sha256.create());
-    // Generate a new key pair
-    const keys = forge.pki.rsa.generateKeyPair(2048);
-    const cert = forge.pki.createCertificate();
-    cert.publicKey = keys.publicKey;
-    cert.serialNumber = "01";
-    cert.validity.notBefore = new Date();
-    cert.validity.notAfter = new Date();
-    cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1);
-    const attrs = [
         {
-            name: "commonName",
-            value: `${name}.pepr-system.svc`,
+            name: "keyUsage",
+            keyCertSign: true,
+            digitalSignature: true,
+            nonRepudiation: true,
+            keyEncipherment: true,
+            dataEncipherment: true,
         },
-    ];
-    cert.setSubject(attrs);
-    cert.setIssuer(caCert.subject.attributes);
-    cert.sign(caKeys.privateKey, forge.md.sha256.create());
-    // Convert the keys and certificates to PEM format
+    ]);
+    // Generate a new server key pair and create a server certificate signed by the CA
+    const serverKeys = forge.pki.rsa.generateKeyPair(2048);
+    const serverCert = genCert(serverKeys, `${name}.pepr-system.svc`, caCert.subject.attributes);
+    // Sign both certificates with the CA private key
+    caCert.sign(caKeys.privateKey, forge.md.sha256.create());
+    serverCert.sign(caKeys.privateKey, forge.md.sha256.create());
+    // Convert the keys and certificates to PEM format and Base64-encode them
     const ca = Buffer.from(forge.pki.certificateToPem(caCert)).toString("base64");
-    const key = Buffer.from(forge.pki.privateKeyToPem(keys.privateKey)).toString("base64");
-    const crt = Buffer.from(forge.pki.certificateToPem(cert)).toString("base64");
+    const key = Buffer.from(forge.pki.privateKeyToPem(serverKeys.privateKey)).toString("base64");
+    const crt = Buffer.from(forge.pki.certificateToPem(serverCert)).toString("base64");
     return { ca, key, crt };
 }
+function genCert(key, name, issuer) {
+    const crt = forge.pki.createCertificate();
+    crt.publicKey = key.publicKey;
+    crt.serialNumber = "01";
+    crt.validity.notBefore = new Date();
+    crt.validity.notAfter = new Date();
+    crt.validity.notAfter.setFullYear(crt.validity.notBefore.getFullYear() + 1);
+    // Add SANs to the server certificate
+    crt.setExtensions([
+        {
+            name: "subjectAltName",
+            altNames: [
+                {
+                    type: 2,
+                    value: name,
+                },
+            ],
+        },
+    ]);
+    // Set the server certificate's issuer to the CA
+    crt.setIssuer(issuer);
+    return crt;
+}
 
 // SPDX-License-Identifier: Apache-2.0
 const peprIgnore = {
@@ -301,7 +161,6 @@ const peprIgnore = {
 class Webhook {
     constructor(config) {
         this.config = config;
-        this.ns = "pepr-system";
         this.name = `pepr-${config.uuid}`;
         this.image = `ghcr.io/defenseunicorns/pepr/controller:${config.version}`;
         // Generate the ephemeral tls things
@@ -423,7 +282,7 @@ class Webhook {
                             apiGroups: ["*"],
                             apiVersions: ["*"],
                             operations: ["CREATE", "UPDATE", "DELETE"],
-                            resources: ["*"],
+                            resources: ["*/*"],
                         },
                     ],
                     // @todo: track side effects state
@@ -587,7 +446,7 @@ class Webhook {
         return resources.map(r => clientNode.dumpYaml(r, { noRefs: true })).join("---\n");
     }
     async deploy(code) {
-        Log.info("Establishing connection to Kubernetes");
+        types.Log.info("Establishing connection to Kubernetes");
         const namespace = "pepr-system";
         // Deploy the resources using the k8s API
         const kubeConfig = new clientNode.KubeConfig();
@@ -598,104 +457,104 @@ class Webhook {
         const admissionApi = kubeConfig.makeApiClient(clientNode.AdmissionregistrationV1Api);
         const ns = this.namespace();
         try {
-            Log.info("Checking for namespace");
+            types.Log.info("Checking for namespace");
             await coreV1Api.readNamespace(namespace);
         }
         catch (e) {
-            Log.debug(e.body);
-            Log.info("Creating namespace");
+            types.Log.debug(e.body);
+            types.Log.info("Creating namespace");
             await coreV1Api.createNamespace(ns);
         }
         const wh = this.mutatingWebhook();
         try {
-            Log.info("Creating mutating webhook");
+            types.Log.info("Creating mutating webhook");
             await admissionApi.createMutatingWebhookConfiguration(wh);
         }
         catch (e) {
-            Log.debug(e.body);
-            Log.info("Removing and re-creating mutating webhook");
+            types.Log.debug(e.body);
+            types.Log.info("Removing and re-creating mutating webhook");
             await admissionApi.deleteMutatingWebhookConfiguration(wh.metadata.name);
             await admissionApi.createMutatingWebhookConfiguration(wh);
         }
         const crb = this.clusterRoleBinding();
         try {
-            Log.info("Creating cluster role binding");
+            types.Log.info("Creating cluster role binding");
             await rbacApi.createClusterRoleBinding(crb);
         }
         catch (e) {
-            Log.debug(e.body);
-            Log.info("Removing and re-creating cluster role binding");
+            types.Log.debug(e.body);
+            types.Log.info("Removing and re-creating cluster role binding");
             await rbacApi.deleteClusterRoleBinding(crb.metadata.name);
             await rbacApi.createClusterRoleBinding(crb);
         }
         const cr = this.clusterRole();
         try {
-            Log.info("Creating cluster role");
+            types.Log.info("Creating cluster role");
             await rbacApi.createClusterRole(cr);
         }
         catch (e) {
-            Log.debug(e.body);
-            Log.info("Removing and re-creating  the cluster role");
+            types.Log.debug(e.body);
+            types.Log.info("Removing and re-creating  the cluster role");
             try {
                 await rbacApi.deleteClusterRole(cr.metadata.name);
                 await rbacApi.createClusterRole(cr);
             }
             catch (e) {
-                Log.debug(e.body);
+                types.Log.debug(e.body);
             }
         }
         const sa = this.serviceAccount();
         try {
-            Log.info("Creating service account");
+            types.Log.info("Creating service account");
             await coreV1Api.createNamespacedServiceAccount(namespace, sa);
         }
         catch (e) {
-            Log.debug(e.body);
-            Log.info("Removing and re-creating service account");
+            types.Log.debug(e.body);
+            types.Log.info("Removing and re-creating service account");
             await coreV1Api.deleteNamespacedServiceAccount(sa.metadata.name, namespace);
             await coreV1Api.createNamespacedServiceAccount(namespace, sa);
         }
         const mod = this.moduleSecret(code);
         try {
-            Log.info("Creating module secret");
+            types.Log.info("Creating module secret");
             await coreV1Api.createNamespacedSecret(namespace, mod);
         }
         catch (e) {
-            Log.debug(e.body);
-            Log.info("Removing and re-creating module secret");
+            types.Log.debug(e.body);
+            types.Log.info("Removing and re-creating module secret");
             await coreV1Api.deleteNamespacedSecret(mod.metadata.name, namespace);
             await coreV1Api.createNamespacedSecret(namespace, mod);
         }
         const svc = this.service();
         try {
-            Log.info("Creating service");
+            types.Log.info("Creating service");
             await coreV1Api.createNamespacedService(namespace, svc);
         }
         catch (e) {
-            Log.debug(e.body);
-            Log.info("Removing and re-creating service");
+            types.Log.debug(e.body);
+            types.Log.info("Removing and re-creating service");
             await coreV1Api.deleteNamespacedService(svc.metadata.name, namespace);
             await coreV1Api.createNamespacedService(namespace, svc);
         }
         const tls = this.tlsSecret();
         try {
-            Log.info("Creating TLS secret");
+            types.Log.info("Creating TLS secret");
             await coreV1Api.createNamespacedSecret(namespace, tls);
         }
         catch (e) {
-            Log.debug(e.body);
-            Log.info("Removing and re-creating TLS secret");
+            types.Log.debug(e.body);
+            types.Log.info("Removing and re-creating TLS secret");
             await coreV1Api.deleteNamespacedSecret(tls.metadata.name, namespace);
             await coreV1Api.createNamespacedSecret(namespace, tls);
         }
         const dep = this.deployment();
         try {
-            Log.info("Creating deployment");
+            types.Log.info("Creating deployment");
             await appsApi.createNamespacedDeployment(namespace, dep);
         }
         catch (e) {
-            Log.debug(e.body);
-            Log.info("Removing and re-creating deployment");
+            types.Log.debug(e.body);
+            types.Log.info("Removing and re-creating deployment");
             await appsApi.deleteNamespacedDeployment(dep.metadata.name, namespace);
             await appsApi.createNamespacedDeployment(namespace, dep);
         }
@@ -725,8 +584,8 @@ function build (program) {
         const zarf = webhook.zarfYaml(yamlFile);
         await fs.promises.writeFile(yamlPath, yaml);
         await fs.promises.writeFile(zarfPath, zarf);
-        Log.debug(`Module compiled successfully at ${path$1}`);
-        Log.info(`K8s resource for the module saved to ${yamlPath}`);
+        types.Log.debug(`Module compiled successfully at ${path$1}`);
+        types.Log.info(`K8s resource for the module saved to ${yamlPath}`);
     });
 }
 const externalLibs = [
@@ -785,8 +644,8 @@ async function buildModule(moduleDir) {
     }
     catch (e) {
         // On any other error, exit with a non-zero exit code
-        Log.debug(e);
-        Log.error(e.message);
+        types.Log.debug(e);
+        types.Log.error(e.message);
         process.exit(1);
     }
 }
@@ -810,16 +669,20 @@ function deploy (program) {
         .command("deploy")
         .description("Deploy a Pepr Module")
         .option("-d, --dir [directory]", "Pepr module directory", ".")
+        .option("-i, --image [image]", "Override the image tag")
+        .option("-f, --force", "Force redeployment")
         .action(async (opts) => {
-        // Prompt the user to confirm
-        const confirm = await prompt.prompt({
-            type: "confirm",
-            name: "confirm",
-            message: "This will remove and redeploy the module. Continue?",
-        });
-        // Exit if the user doesn't confirm
-        if (!confirm.confirm) {
-            process.exit(0);
+        if (!opts.force) {
+            // Prompt the user to confirm
+            const confirm = await prompt.prompt({
+                type: "confirm",
+                name: "confirm",
+                message: "This will remove and redeploy the module. Continue?",
+            });
+            // Exit if the user doesn't confirm
+            if (!confirm.confirm) {
+                process.exit(0);
+            }
         }
         // Build the module
         const { cfg, path } = await buildModule(opts.dir);
@@ -830,12 +693,15 @@ function deploy (program) {
             ...cfg.pepr,
             description: cfg.description,
         });
+        if (opts.image) {
+            webhook.image = opts.image;
+        }
         try {
             await webhook.deploy(code);
-            Log.info(`Module deployed successfully`);
+            types.Log.info(`Module deployed successfully`);
         }
         catch (e) {
-            Log.error(`Error deploying module: ${e}`);
+            types.Log.error(`Error deploying module: ${e}`);
             process.exit(1);
         }
     });
@@ -1140,23 +1006,23 @@ function walkthrough() {
     const askErrorBehavior = {
         type: "select",
         name: "errorBehavior",
-        validate: val => ErrorBehavior[val],
+        validate: val => types.ErrorBehavior[val],
         message: "How do you want Pepr to handle errors encountered during K8s operations?",
         choices: [
             {
                 title: "Ignore",
-                value: ErrorBehavior.ignore,
+                value: types.ErrorBehavior.ignore,
                 description: "Pepr will continue processing and generate an entry in the Pepr Controller log.",
                 selected: true,
             },
             {
                 title: "Log an audit event",
-                value: ErrorBehavior.audit,
+                value: types.ErrorBehavior.audit,
                 description: "Pepr will continue processing and generate an entry in the Pepr Controller log as well as an audit event in the cluster.",
             },
             {
                 title: "Reject the operation",
-                value: ErrorBehavior.reject,
+                value: types.ErrorBehavior.reject,
                 description: "Pepr will reject the operation and return an error to the client.",
             },
         ],
@@ -1224,8 +1090,8 @@ function init (program) {
                 console.log(`Open VSCode or your editor of choice in ${dirName} to get started!`);
             }
             catch (e) {
-                Log.debug(e);
-                Log.error(e.message);
+                types.Log.debug(e);
+                types.Log.error(e.message);
                 process.exit(1);
             }
         }
@@ -1238,7 +1104,7 @@ class RootCmd extends commander.Command {
         const cmd = new commander.Command(name);
         cmd.option("-l, --log-level [level]", "Log level: debug, info, warn, error", "info");
         cmd.hook("preAction", run => {
-            Log.SetLogLevel(run.opts().logLevel);
+            types.Log.SetLogLevel(run.opts().logLevel);
         });
         return cmd;
     }
@@ -1253,15 +1119,15 @@ function test (program) {
         .option("-d, --dir [directory]", "Pepr module directory", ".")
         .option("-w, --watch", "Watch for changes and re-run the test")
         .action(async (opts) => {
-        Log.info("Test Module");
+        types.Log.info("Test Module");
         await buildAndTest(opts.dir);
         if (opts.watch) {
             const moduleFiles = path.resolve(opts.dir, "**", "*.ts");
             const watcher = chokidar.watch(moduleFiles);
             watcher.on("ready", () => {
-                Log.info(`Watching for changes in ${moduleFiles}`);
+                types.Log.info(`Watching for changes in ${moduleFiles}`);
                 watcher.on("all", async (event, path) => {
-                    Log.debug({ event, path }, "File changed");
+                    types.Log.debug({ event, path }, "File changed");
                     await buildAndTest(opts.dir);
                 });
             });
@@ -1270,15 +1136,15 @@ function test (program) {
 }
 async function buildAndTest(dir) {
     const { path } = await buildModule(dir);
-    Log.info(`Module built successfully at ${path}`);
+    types.Log.info(`Module built successfully at ${path}`);
     try {
         const { stdout, stderr } = await exec(`node ${path}`);
         console.log(stdout);
         console.log(stderr);
     }
     catch (e) {
-        Log.debug(e);
-        Log.error(`Error running module: ${e}`);
+        types.Log.debug(e);
+        types.Log.error(`Error running module: ${e}`);
         process.exit(1);
     }
 }
@@ -1300,4 +1166,3 @@ capability(program);
 test(program);
 deploy(program);
 program.parse();
-//# sourceMappingURL=pepr-cli.js.map