pepr 0.1.21 → 0.1.22

package/dist/pepr-cli.js

@@ -21,7 +21,7 @@ var uuid = require('uuid');
 var commander = require('commander');
 var chokidar = require('chokidar');
 
-var version = "0.1.21";
+var version = "0.1.22";
 
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: 2023-Present The Pepr Authors
@@ -118,15 +118,21 @@ function genTLS(name) {
     ]);
     // Generate a new server key pair and create a server certificate signed by the CA
     const serverKeys = forge.pki.rsa.generateKeyPair(2048);
-    const serverCert = genCert(serverKeys, `${name}.pepr-system.svc`, caCert.subject.attributes);
+    const serverCert = genCert(serverKeys, name, caCert.subject.attributes);
     // Sign both certificates with the CA private key
     caCert.sign(caKeys.privateKey, forge.md.sha256.create());
     serverCert.sign(caKeys.privateKey, forge.md.sha256.create());
-    // Convert the keys and certificates to PEM format and Base64-encode them
-    const ca = Buffer.from(forge.pki.certificateToPem(caCert)).toString("base64");
-    const key = Buffer.from(forge.pki.privateKeyToPem(serverKeys.privateKey)).toString("base64");
-    const crt = Buffer.from(forge.pki.certificateToPem(serverCert)).toString("base64");
-    return { ca, key, crt };
+    // Convert the keys and certificates to PEM format
+    const pem = {
+        ca: forge.pki.certificateToPem(caCert),
+        crt: forge.pki.certificateToPem(serverCert),
+        key: forge.pki.privateKeyToPem(serverKeys.privateKey),
+    };
+    // Base64-encode the PEM strings
+    const ca = Buffer.from(pem.ca).toString("base64");
+    const key = Buffer.from(pem.key).toString("base64");
+    const crt = Buffer.from(pem.crt).toString("base64");
+    return { ca, key, crt, pem };
 }
 function genCert(key, name, issuer) {
     const crt = forge.pki.createCertificate();
@@ -159,12 +165,16 @@ const peprIgnore = {
     values: ["ignore"],
 };
 class Webhook {
-    constructor(config) {
+    get tls() {
+        return this._tls;
+    }
+    constructor(config, host) {
         this.config = config;
+        this.host = host;
         this.name = `pepr-${config.uuid}`;
         this.image = `ghcr.io/defenseunicorns/pepr/controller:${config.version}`;
         // Generate the ephemeral tls things
-        this.tls = genTLS(this.name);
+        this._tls = genTLS(this.host || `${this.name}.pepr-system.svc`);
     }
     /** Generate the pepr-system namespace */
     namespace() {
@@ -235,8 +245,8 @@ class Webhook {
             },
             type: "kubernetes.io/tls",
             data: {
-                "tls.crt": this.tls.crt,
-                "tls.key": this.tls.key,
+                "tls.crt": this._tls.crt,
+                "tls.key": this._tls.key,
             },
         };
     }
@@ -251,6 +261,21 @@ class Webhook {
                 values: this.config.alwaysIgnore.namespaces,
             });
         }
+        const clientConfig = {
+            caBundle: this._tls.ca,
+        };
+        // If a host is specified, use that with a port of 3000
+        if (this.host) {
+            clientConfig.url = `https://${this.host}:3000/mutate`;
+        }
+        else {
+            // Otherwise, use the service
+            clientConfig.service = {
+                name: this.name,
+                namespace: "pepr-system",
+                path: "/mutate",
+            };
+        }
         return {
             apiVersion: "admissionregistration.k8s.io/v1",
             kind: "MutatingWebhookConfiguration",
@@ -259,14 +284,7 @@ class Webhook {
                 {
                     name: `${name}.pepr.dev`,
                     admissionReviewVersions: ["v1", "v1beta1"],
-                    clientConfig: {
-                        caBundle: this.tls.ca,
-                        service: {
-                            name: this.name,
-                            namespace: "pepr-system",
-                            path: "/mutate",
-                        },
-                    },
+                    clientConfig,
                     failurePolicy: "Ignore",
                     matchPolicy: "Equivalent",
                     timeoutSeconds: 15,
@@ -351,6 +369,11 @@ class Webhook {
                                         mountPath: "/etc/certs",
                                         readOnly: true,
                                     },
+                                    {
+                                        name: "module",
+                                        mountPath: "/app/module.js.gz",
+                                        readOnly: true,
+                                    },
                                 ],
                             },
                         ],
@@ -361,12 +384,56 @@ class Webhook {
                                     secretName: `${this.name}-tls`,
                                 },
                             },
+                            {
+                                name: "module",
+                                secret: {
+                                    secretName: `${this.name}-module`,
+                                },
+                            },
                         ],
                     },
                 },
             },
         };
     }
+    /** Only permit the  */
+    networkPolicy() {
+        return {
+            apiVersion: "networking.k8s.io/v1",
+            kind: "NetworkPolicy",
+            metadata: {
+                name: this.name,
+                namespace: "pepr-system",
+            },
+            spec: {
+                podSelector: {
+                    matchLabels: {
+                        app: this.name,
+                    },
+                },
+                policyTypes: ["Ingress"],
+                ingress: [
+                    {
+                        from: [
+                            {
+                                namespaceSelector: {
+                                    matchLabels: {
+                                        "kubernetes.io/metadata.name": "kube-system",
+                                    },
+                                },
+                            },
+                        ],
+                        ports: [
+                            {
+                                protocol: "TCP",
+                                port: 443,
+                            },
+                        ],
+                    },
+                ],
+            },
+        };
+    }
     service() {
         return {
             apiVersion: "v1",
@@ -433,6 +500,7 @@ class Webhook {
     allYaml(code) {
         const resources = [
             this.namespace(),
+            this.networkPolicy(),
             this.clusterRole(),
             this.clusterRoleBinding(),
             this.serviceAccount(),
@@ -455,6 +523,7 @@ class Webhook {
         const rbacApi = kubeConfig.makeApiClient(clientNode.RbacAuthorizationV1Api);
         const appsApi = kubeConfig.makeApiClient(clientNode.AppsV1Api);
         const admissionApi = kubeConfig.makeApiClient(clientNode.AdmissionregistrationV1Api);
+        const networkApi = kubeConfig.makeApiClient(clientNode.NetworkingV1Api);
         const ns = this.namespace();
         try {
             types.Log.info("Checking for namespace");
@@ -465,6 +534,16 @@ class Webhook {
             types.Log.info("Creating namespace");
             await coreV1Api.createNamespace(ns);
         }
+        const netpol = this.networkPolicy();
+        try {
+            types.Log.info("Checking for network policy");
+            await networkApi.readNamespacedNetworkPolicy(netpol.metadata.name, namespace);
+        }
+        catch (e) {
+            types.Log.debug(e.body);
+            types.Log.info("Creating network policy");
+            await networkApi.createNamespacedNetworkPolicy(namespace, netpol);
+        }
         const wh = this.mutatingWebhook();
         try {
             types.Log.info("Creating mutating webhook");
@@ -514,6 +593,10 @@ class Webhook {
             await coreV1Api.deleteNamespacedServiceAccount(sa.metadata.name, namespace);
             await coreV1Api.createNamespacedServiceAccount(namespace, sa);
         }
+        // If a host is specified, we don't need to deploy the rest of the resources
+        if (this.host) {
+            return;
+        }
         const mod = this.moduleSecret(code);
         try {
             types.Log.info("Creating module secret");
@@ -707,6 +790,47 @@ function deploy (program) {
     });
 }
 
+// SPDX-License-Identifier: Apache-2.0
+function dev (program) {
+    program
+        .command("dev")
+        .description("Setup a local webhook development environment")
+        .option("-d, --dir [directory]", "Pepr module directory", ".")
+        .option("-h, --host [host]", "Host to listen on", "host.docker.internal")
+        .action(async (opts) => {
+        // Prompt the user to confirm
+        const confirm = await prompt.prompt({
+            type: "confirm",
+            name: "confirm",
+            message: "This will remove and redeploy the module. Continue?",
+        });
+        // Exit if the user doesn't confirm
+        if (!confirm.confirm) {
+            process.exit(0);
+        }
+        // Build the module
+        const { cfg, path } = await buildModule(opts.dir);
+        // Read the compiled module code
+        const code = await fs.promises.readFile(path, { encoding: "utf-8" });
+        // Generate a secret for the module
+        const webhook = new Webhook({
+            ...cfg.pepr,
+            description: cfg.description,
+        }, opts.host);
+        // Write the TLS cert and key to disk
+        await fs.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
+        await fs.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
+        try {
+            await webhook.deploy(code);
+            types.Log.info(`Module deployed successfully`);
+        }
+        catch (e) {
+            types.Log.error(`Error deploying module: ${e}`);
+            process.exit(1);
+        }
+    });
+}
+
 // SPDX-License-Identifier: Apache-2.0
 /**
  * Sanitize a user input name to be used as a pepr module directory name
@@ -1027,11 +1151,7 @@ function walkthrough() {
             },
         ],
     };
-    return prompt([
-        askName,
-        askDescription,
-        askErrorBehavior,
-    ]);
+    return prompt([askName, askDescription, askErrorBehavior]);
 }
 async function confirm(dirName, packageJSON, peprTSPath) {
     console.log(`
@@ -1165,4 +1285,5 @@ build(program);
 capability(program);
 test(program);
 deploy(program);
+dev(program);
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pepr",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Kubernetes application engine",
   "author": "Defense Unicorns",
   "homepage": "https://github.com/defenseunicorns/pepr",
@@ -29,7 +29,10 @@
     "prettier": "npx prettier src --check",
     "prettier:fix": "npm run prettier -- --write",
     "prepublishOnly": "rm -fr dist/* && npm run lint:fix && npm run prettier:fix && npm run test && npm run build",
-    "e2e-dev": "npm run build && docker buildx build --tag pepr:dev . && k3d image import pepr:dev && node dist/pepr-cli.js deploy -f -i pepr:dev"
+    "e2e-dev-setup": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev",
+    "e2e-dev": "npm run build && docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev && node dist/pepr-cli.js deploy -f -i pepr:dev",
+    "prestart": "ts-node src/cli dev",
+    "start": "chokidar 'src/**/*.ts' -c 'SSL_KEY_PATH=insecure-tls.key SSL_CERT_PATH=insecure-tls.crt ts-node src/controller/index.ts' --initial --silent"
   },
   "dependencies": {
     "@kubernetes/client-node": "^0.18.1",
@@ -59,6 +62,7 @@
     "@typescript-eslint/eslint-plugin": "^5.57.0",
     "@typescript-eslint/parser": "^5.57.0",
     "ava": "^5.2.0",
+    "chokidar-cli": "^3.0.0",
     "eslint": "^8.37.0",
     "ts-node": "^10.9.1",
     "tsconfig-paths": "^4.1.2"

package/src/lib/k8s/tls.ts

@@ -6,6 +6,11 @@ export interface TLSOut {
   ca: string;
   crt: string;
   key: string;
+  pem: {
+    ca: string;
+    crt: string;
+    key: string;
+  };
 }
 
 /**
@@ -36,18 +41,25 @@ export function genTLS(name: string): TLSOut {
 
   // Generate a new server key pair and create a server certificate signed by the CA
   const serverKeys = forge.pki.rsa.generateKeyPair(2048);
-  const serverCert = genCert(serverKeys, `${name}.pepr-system.svc`, caCert.subject.attributes);
+  const serverCert = genCert(serverKeys, name, caCert.subject.attributes);
 
   // Sign both certificates with the CA private key
   caCert.sign(caKeys.privateKey, forge.md.sha256.create());
   serverCert.sign(caKeys.privateKey, forge.md.sha256.create());
 
-  // Convert the keys and certificates to PEM format and Base64-encode them
-  const ca = Buffer.from(forge.pki.certificateToPem(caCert)).toString("base64");
-  const key = Buffer.from(forge.pki.privateKeyToPem(serverKeys.privateKey)).toString("base64");
-  const crt = Buffer.from(forge.pki.certificateToPem(serverCert)).toString("base64");
+  // Convert the keys and certificates to PEM format
+  const pem = {
+    ca: forge.pki.certificateToPem(caCert),
+    crt: forge.pki.certificateToPem(serverCert),
+    key: forge.pki.privateKeyToPem(serverKeys.privateKey),
+  };
 
-  return { ca, key, crt };
+  // Base64-encode the PEM strings
+  const ca = Buffer.from(pem.ca).toString("base64");
+  const key = Buffer.from(pem.key).toString("base64");
+  const crt = Buffer.from(pem.crt).toString("base64");
+
+  return { ca, key, crt, pem };
 }
 
 function genCert(key: forge.pki.rsa.KeyPair, name: string, issuer: forge.pki.CertificateField[]) {

package/src/lib/k8s/webhook.ts

@@ -3,9 +3,11 @@
 
 import {
   AdmissionregistrationV1Api,
+  AdmissionregistrationV1WebhookClientConfig,
   AppsV1Api,
   CoreV1Api,
   KubeConfig,
+  NetworkingV1Api,
   RbacAuthorizationV1Api,
   V1ClusterRole,
   V1ClusterRoleBinding,
@@ -13,6 +15,7 @@ import {
   V1LabelSelectorRequirement,
   V1MutatingWebhookConfiguration,
   V1Namespace,
+  V1NetworkPolicy,
   V1Secret,
   V1Service,
   V1ServiceAccount,
@@ -31,17 +34,21 @@ const peprIgnore: V1LabelSelectorRequirement = {
 
 export class Webhook {
   private name: string;
-  private tls: TLSOut;
+  private _tls: TLSOut;
 
   public image: string;
 
-  constructor(private readonly config: ModuleConfig) {
+  public get tls(): TLSOut {
+    return this._tls;
+  }
+
+  constructor(private readonly config: ModuleConfig, private readonly host?: string) {
     this.name = `pepr-${config.uuid}`;
 
     this.image = `ghcr.io/defenseunicorns/pepr/controller:${config.version}`;
 
     // Generate the ephemeral tls things
-    this.tls = genTLS(this.name);
+    this._tls = genTLS(this.host || `${this.name}.pepr-system.svc`);
   }
 
   /** Generate the pepr-system namespace */
@@ -117,8 +124,8 @@ export class Webhook {
       },
       type: "kubernetes.io/tls",
       data: {
-        "tls.crt": this.tls.crt,
-        "tls.key": this.tls.key,
+        "tls.crt": this._tls.crt,
+        "tls.key": this._tls.key,
       },
     };
   }
@@ -136,6 +143,22 @@ export class Webhook {
       });
     }
 
+    const clientConfig: AdmissionregistrationV1WebhookClientConfig = {
+      caBundle: this._tls.ca,
+    };
+
+    // If a host is specified, use that with a port of 3000
+    if (this.host) {
+      clientConfig.url = `https://${this.host}:3000/mutate`;
+    } else {
+      // Otherwise, use the service
+      clientConfig.service = {
+        name: this.name,
+        namespace: "pepr-system",
+        path: "/mutate",
+      };
+    }
+
     return {
       apiVersion: "admissionregistration.k8s.io/v1",
       kind: "MutatingWebhookConfiguration",
@@ -144,14 +167,7 @@ export class Webhook {
         {
           name: `${name}.pepr.dev`,
           admissionReviewVersions: ["v1", "v1beta1"],
-          clientConfig: {
-            caBundle: this.tls.ca,
-            service: {
-              name: this.name,
-              namespace: "pepr-system",
-              path: "/mutate",
-            },
-          },
+          clientConfig,
           failurePolicy: "Ignore",
           matchPolicy: "Equivalent",
           timeoutSeconds: 15,
@@ -237,6 +253,11 @@ export class Webhook {
                     mountPath: "/etc/certs",
                     readOnly: true,
                   },
+                  {
+                    name: "module",
+                    mountPath: "/app/module.js.gz",
+                    readOnly: true,
+                  },
                 ],
               },
             ],
@@ -247,6 +268,12 @@ export class Webhook {
                   secretName: `${this.name}-tls`,
                 },
               },
+              {
+                name: "module",
+                secret: {
+                  secretName: `${this.name}-module`,
+                },
+              },
             ],
           },
         },
@@ -254,6 +281,45 @@ export class Webhook {
     };
   }
 
+  /** Only permit the  */
+  networkPolicy(): V1NetworkPolicy {
+    return {
+      apiVersion: "networking.k8s.io/v1",
+      kind: "NetworkPolicy",
+      metadata: {
+        name: this.name,
+        namespace: "pepr-system",
+      },
+      spec: {
+        podSelector: {
+          matchLabels: {
+            app: this.name,
+          },
+        },
+        policyTypes: ["Ingress"],
+        ingress: [
+          {
+            from: [
+              {
+                namespaceSelector: {
+                  matchLabels: {
+                    "kubernetes.io/metadata.name": "kube-system",
+                  },
+                },
+              },
+            ],
+            ports: [
+              {
+                protocol: "TCP",
+                port: 443,
+              },
+            ],
+          },
+        ],
+      },
+    };
+  }
+
   service(): V1Service {
     return {
       apiVersion: "v1",
@@ -324,6 +390,7 @@ export class Webhook {
   allYaml(code: string) {
     const resources = [
       this.namespace(),
+      this.networkPolicy(),
       this.clusterRole(),
       this.clusterRoleBinding(),
       this.serviceAccount(),
@@ -351,6 +418,7 @@ export class Webhook {
     const rbacApi = kubeConfig.makeApiClient(RbacAuthorizationV1Api);
     const appsApi = kubeConfig.makeApiClient(AppsV1Api);
     const admissionApi = kubeConfig.makeApiClient(AdmissionregistrationV1Api);
+    const networkApi = kubeConfig.makeApiClient(NetworkingV1Api);
 
     const ns = this.namespace();
     try {
@@ -362,6 +430,16 @@ export class Webhook {
       await coreV1Api.createNamespace(ns);
     }
 
+    const netpol = this.networkPolicy();
+    try {
+      logger.info("Checking for network policy");
+      await networkApi.readNamespacedNetworkPolicy(netpol.metadata.name, namespace);
+    } catch (e) {
+      logger.debug(e.body);
+      logger.info("Creating network policy");
+      await networkApi.createNamespacedNetworkPolicy(namespace, netpol);
+    }
+
     const wh = this.mutatingWebhook();
     try {
       logger.info("Creating mutating webhook");
@@ -410,6 +488,11 @@ export class Webhook {
       await coreV1Api.createNamespacedServiceAccount(namespace, sa);
     }
 
+    // If a host is specified, we don't need to deploy the rest of the resources
+    if (this.host) {
+      return;
+    }
+
     const mod = this.moduleSecret(code);
     try {
       logger.info("Creating module secret");