pepr 0.1.25 → 0.1.27

package/src/lib/k8s/webhook.ts

@@ -1,540 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
-
-import {
-  AdmissionregistrationV1Api,
-  AdmissionregistrationV1WebhookClientConfig,
-  AppsV1Api,
-  CoreV1Api,
-  KubeConfig,
-  NetworkingV1Api,
-  RbacAuthorizationV1Api,
-  V1ClusterRole,
-  V1ClusterRoleBinding,
-  V1Deployment,
-  V1LabelSelectorRequirement,
-  V1MutatingWebhookConfiguration,
-  V1Namespace,
-  V1NetworkPolicy,
-  V1Secret,
-  V1Service,
-  V1ServiceAccount,
-  dumpYaml,
-} from "@kubernetes/client-node";
-import { gzipSync } from "zlib";
-import Log from "../logger";
-import { ModuleConfig } from "../types";
-import { TLSOut, genTLS } from "./tls";
-
-const peprIgnore: V1LabelSelectorRequirement = {
-  key: "pepr.dev",
-  operator: "NotIn",
-  values: ["ignore"],
-};
-
-export class Webhook {
-  private name: string;
-  private _tls: TLSOut;
-
-  public image: string;
-
-  public get tls(): TLSOut {
-    return this._tls;
-  }
-
-  constructor(private readonly config: ModuleConfig, private readonly host?: string) {
-    this.name = `pepr-${config.uuid}`;
-
-    this.image = `ghcr.io/defenseunicorns/pepr/controller:${config.version}`;
-
-    // Generate the ephemeral tls things
-    this._tls = genTLS(this.host || `${this.name}.pepr-system.svc`);
-  }
-
-  /** Generate the pepr-system namespace */
-  namespace(): V1Namespace {
-    return {
-      apiVersion: "v1",
-      kind: "Namespace",
-      metadata: { name: "pepr-system" },
-    };
-  }
-
-  /**
-   * Grants the controller access to cluster resources beyond the mutating webhook.
-   *
-   * @todo: should dynamically generate this based on resources used by the module. will also need to explore how this should work for multiple modules.
-   * @returns
-   */
-  clusterRole(): V1ClusterRole {
-    return {
-      apiVersion: "rbac.authorization.k8s.io/v1",
-      kind: "ClusterRole",
-      metadata: { name: this.name },
-      rules: [
-        {
-          // @todo: make this configurable
-          apiGroups: ["*"],
-          resources: ["*"],
-          verbs: ["create", "delete", "get", "list", "patch", "update", "watch"],
-        },
-      ],
-    };
-  }
-
-  clusterRoleBinding(): V1ClusterRoleBinding {
-    const name = this.name;
-    return {
-      apiVersion: "rbac.authorization.k8s.io/v1",
-      kind: "ClusterRoleBinding",
-      metadata: { name },
-      roleRef: {
-        apiGroup: "rbac.authorization.k8s.io",
-        kind: "ClusterRole",
-        name,
-      },
-      subjects: [
-        {
-          kind: "ServiceAccount",
-          name,
-          namespace: "pepr-system",
-        },
-      ],
-    };
-  }
-
-  serviceAccount(): V1ServiceAccount {
-    return {
-      apiVersion: "v1",
-      kind: "ServiceAccount",
-      metadata: {
-        name: this.name,
-        namespace: "pepr-system",
-      },
-    };
-  }
-
-  tlsSecret(): V1Secret {
-    return {
-      apiVersion: "v1",
-      kind: "Secret",
-      metadata: {
-        name: `${this.name}-tls`,
-        namespace: "pepr-system",
-      },
-      type: "kubernetes.io/tls",
-      data: {
-        "tls.crt": this._tls.crt,
-        "tls.key": this._tls.key,
-      },
-    };
-  }
-
-  mutatingWebhook(): V1MutatingWebhookConfiguration {
-    const { name } = this;
-    const ignore = [peprIgnore];
-
-    // Add any namespaces to ignore
-    if (this.config.alwaysIgnore.namespaces.length > 0) {
-      ignore.push({
-        key: "kubernetes.io/metadata.name",
-        operator: "NotIn",
-        values: this.config.alwaysIgnore.namespaces,
-      });
-    }
-
-    const clientConfig: AdmissionregistrationV1WebhookClientConfig = {
-      caBundle: this._tls.ca,
-    };
-
-    // If a host is specified, use that with a port of 3000
-    if (this.host) {
-      clientConfig.url = `https://${this.host}:3000/mutate`;
-    } else {
-      // Otherwise, use the service
-      clientConfig.service = {
-        name: this.name,
-        namespace: "pepr-system",
-        path: "/mutate",
-      };
-    }
-
-    return {
-      apiVersion: "admissionregistration.k8s.io/v1",
-      kind: "MutatingWebhookConfiguration",
-      metadata: { name },
-      webhooks: [
-        {
-          name: `${name}.pepr.dev`,
-          admissionReviewVersions: ["v1", "v1beta1"],
-          clientConfig,
-          failurePolicy: "Ignore",
-          matchPolicy: "Equivalent",
-          timeoutSeconds: 15,
-          namespaceSelector: {
-            matchExpressions: ignore,
-          },
-          objectSelector: {
-            matchExpressions: ignore,
-          },
-          // @todo: make this configurable
-          rules: [
-            {
-              apiGroups: ["*"],
-              apiVersions: ["*"],
-              operations: ["CREATE", "UPDATE", "DELETE"],
-              resources: ["*/*"],
-            },
-          ],
-          // @todo: track side effects state
-          sideEffects: "None",
-        },
-      ],
-    };
-  }
-
-  deployment(): V1Deployment {
-    return {
-      apiVersion: "apps/v1",
-      kind: "Deployment",
-      metadata: {
-        name: this.name,
-        namespace: "pepr-system",
-        labels: {
-          app: this.name,
-        },
-      },
-      spec: {
-        replicas: 2,
-        selector: {
-          matchLabels: {
-            app: this.name,
-          },
-        },
-        template: {
-          metadata: {
-            labels: {
-              app: this.name,
-            },
-          },
-          spec: {
-            priorityClassName: "system-node-critical",
-            serviceAccountName: this.name,
-            containers: [
-              {
-                name: "server",
-                image: this.image,
-                imagePullPolicy: "IfNotPresent",
-                livenessProbe: {
-                  httpGet: {
-                    path: "/healthz",
-                    port: 3000,
-                    scheme: "HTTPS",
-                  },
-                },
-                ports: [
-                  {
-                    containerPort: 3000,
-                  },
-                ],
-                resources: {
-                  requests: {
-                    memory: "64Mi",
-                    cpu: "100m",
-                  },
-                  limits: {
-                    memory: "256Mi",
-                    cpu: "500m",
-                  },
-                },
-                volumeMounts: [
-                  {
-                    name: "tls-certs",
-                    mountPath: "/etc/certs",
-                    readOnly: true,
-                  },
-                  {
-                    name: "module",
-                    mountPath: "/app/module.js.gz",
-                    readOnly: true,
-                  },
-                ],
-              },
-            ],
-            volumes: [
-              {
-                name: "tls-certs",
-                secret: {
-                  secretName: `${this.name}-tls`,
-                },
-              },
-              {
-                name: "module",
-                secret: {
-                  secretName: `${this.name}-module`,
-                },
-              },
-            ],
-          },
-        },
-      },
-    };
-  }
-
-  /** Only permit the  */
-  networkPolicy(): V1NetworkPolicy {
-    return {
-      apiVersion: "networking.k8s.io/v1",
-      kind: "NetworkPolicy",
-      metadata: {
-        name: this.name,
-        namespace: "pepr-system",
-      },
-      spec: {
-        podSelector: {
-          matchLabels: {
-            app: this.name,
-          },
-        },
-        policyTypes: ["Ingress"],
-        ingress: [
-          {
-            from: [
-              {
-                namespaceSelector: {
-                  matchLabels: {
-                    "kubernetes.io/metadata.name": "kube-system",
-                  },
-                },
-              },
-            ],
-            ports: [
-              {
-                protocol: "TCP",
-                port: 443,
-              },
-            ],
-          },
-        ],
-      },
-    };
-  }
-
-  service(): V1Service {
-    return {
-      apiVersion: "v1",
-      kind: "Service",
-      metadata: {
-        name: this.name,
-        namespace: "pepr-system",
-      },
-      spec: {
-        selector: {
-          app: this.name,
-        },
-        ports: [
-          {
-            port: 443,
-            targetPort: 3000,
-          },
-        ],
-      },
-    };
-  }
-
-  moduleSecret(data: string): V1Secret {
-    // Compress the data
-    const compressed = gzipSync(data);
-    return {
-      apiVersion: "v1",
-      kind: "Secret",
-      metadata: {
-        name: `${this.name}-module`,
-        namespace: "pepr-system",
-      },
-      type: "Opaque",
-      data: {
-        module: compressed.toString("base64"),
-      },
-    };
-  }
-
-  zarfYaml(path: string) {
-    const zarfCfg = {
-      kind: "ZarfPackageConfig",
-      metadata: {
-        name: this.name,
-        description: `Pepr Module: ${this.config.description}`,
-        url: "https://github.com/defenseunicorns/pepr",
-        version: this.config.version,
-      },
-      components: [
-        {
-          name: "module",
-          required: true,
-          manifests: [
-            {
-              name: "module",
-              namespace: "pepr-system",
-              files: [path],
-            },
-          ],
-          images: [this.image],
-        },
-      ],
-    };
-
-    return dumpYaml(zarfCfg, { noRefs: true });
-  }
-
-  allYaml(code: string) {
-    const resources = [
-      this.namespace(),
-      this.networkPolicy(),
-      this.clusterRole(),
-      this.clusterRoleBinding(),
-      this.serviceAccount(),
-      this.tlsSecret(),
-      this.mutatingWebhook(),
-      this.deployment(),
-      this.service(),
-      this.moduleSecret(code),
-    ];
-
-    // Convert the resources to a single YAML string
-    return resources.map(r => dumpYaml(r, { noRefs: true })).join("---\n");
-  }
-
-  async deploy(code: string) {
-    Log.info("Establishing connection to Kubernetes");
-
-    const namespace = "pepr-system";
-
-    // Deploy the resources using the k8s API
-    const kubeConfig = new KubeConfig();
-    kubeConfig.loadFromDefault();
-
-    const coreV1Api = kubeConfig.makeApiClient(CoreV1Api);
-    const rbacApi = kubeConfig.makeApiClient(RbacAuthorizationV1Api);
-    const appsApi = kubeConfig.makeApiClient(AppsV1Api);
-    const admissionApi = kubeConfig.makeApiClient(AdmissionregistrationV1Api);
-    const networkApi = kubeConfig.makeApiClient(NetworkingV1Api);
-
-    const ns = this.namespace();
-    try {
-      Log.info("Checking for namespace");
-      await coreV1Api.readNamespace(namespace);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Creating namespace");
-      await coreV1Api.createNamespace(ns);
-    }
-
-    const netpol = this.networkPolicy();
-    try {
-      Log.info("Checking for network policy");
-      await networkApi.readNamespacedNetworkPolicy(netpol.metadata.name, namespace);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Creating network policy");
-      await networkApi.createNamespacedNetworkPolicy(namespace, netpol);
-    }
-
-    const wh = this.mutatingWebhook();
-    try {
-      Log.info("Creating mutating webhook");
-      await admissionApi.createMutatingWebhookConfiguration(wh);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Removing and re-creating mutating webhook");
-      await admissionApi.deleteMutatingWebhookConfiguration(wh.metadata.name);
-      await admissionApi.createMutatingWebhookConfiguration(wh);
-    }
-
-    const crb = this.clusterRoleBinding();
-    try {
-      Log.info("Creating cluster role binding");
-      await rbacApi.createClusterRoleBinding(crb);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Removing and re-creating cluster role binding");
-      await rbacApi.deleteClusterRoleBinding(crb.metadata.name);
-      await rbacApi.createClusterRoleBinding(crb);
-    }
-
-    const cr = this.clusterRole();
-    try {
-      Log.info("Creating cluster role");
-      await rbacApi.createClusterRole(cr);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Removing and re-creating  the cluster role");
-      try {
-        await rbacApi.deleteClusterRole(cr.metadata.name);
-        await rbacApi.createClusterRole(cr);
-      } catch (e) {
-        Log.debug(e.body);
-      }
-    }
-
-    const sa = this.serviceAccount();
-    try {
-      Log.info("Creating service account");
-      await coreV1Api.createNamespacedServiceAccount(namespace, sa);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Removing and re-creating service account");
-      await coreV1Api.deleteNamespacedServiceAccount(sa.metadata.name, namespace);
-      await coreV1Api.createNamespacedServiceAccount(namespace, sa);
-    }
-
-    // If a host is specified, we don't need to deploy the rest of the resources
-    if (this.host) {
-      return;
-    }
-
-    const mod = this.moduleSecret(code);
-    try {
-      Log.info("Creating module secret");
-      await coreV1Api.createNamespacedSecret(namespace, mod);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Removing and re-creating module secret");
-      await coreV1Api.deleteNamespacedSecret(mod.metadata.name, namespace);
-      await coreV1Api.createNamespacedSecret(namespace, mod);
-    }
-
-    const svc = this.service();
-    try {
-      Log.info("Creating service");
-      await coreV1Api.createNamespacedService(namespace, svc);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Removing and re-creating service");
-      await coreV1Api.deleteNamespacedService(svc.metadata.name, namespace);
-      await coreV1Api.createNamespacedService(namespace, svc);
-    }
-
-    const tls = this.tlsSecret();
-    try {
-      Log.info("Creating TLS secret");
-      await coreV1Api.createNamespacedSecret(namespace, tls);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Removing and re-creating TLS secret");
-      await coreV1Api.deleteNamespacedSecret(tls.metadata.name, namespace);
-      await coreV1Api.createNamespacedSecret(namespace, tls);
-    }
-
-    const dep = this.deployment();
-    try {
-      Log.info("Creating deployment");
-      await appsApi.createNamespacedDeployment(namespace, dep);
-    } catch (e) {
-      Log.debug(e.body);
-      Log.info("Removing and re-creating deployment");
-      await appsApi.deleteNamespacedDeployment(dep.metadata.name, namespace);
-      await appsApi.createNamespacedDeployment(namespace, dep);
-    }
-  }
-}

package/src/lib/logger.ts

@@ -1,131 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
-
-/**
- * Enumeration representing different logging levels.
- */
-export enum LogLevel {
-  debug = 0,
-  info = 1,
-  warn = 2,
-  error = 3,
-}
-
-enum ConsoleColors {
-  Reset = "\x1b[0m",
-  Bright = "\x1b[1m",
-  Dim = "\x1b[2m",
-  Underscore = "\x1b[4m",
-  Blink = "\x1b[5m",
-  Reverse = "\x1b[7m",
-  Hidden = "\x1b[8m",
-
-  FgBlack = "\x1b[30m",
-  FgRed = "\x1b[31m",
-  FgGreen = "\x1b[32m",
-  FgYellow = "\x1b[33m",
-  FgBlue = "\x1b[34m",
-  FgMagenta = "\x1b[35m",
-  FgCyan = "\x1b[36m",
-  FgWhite = "\x1b[37m",
-
-  BgBlack = "\x1b[40m",
-  BgRed = "\x1b[41m",
-  BgGreen = "\x1b[42m",
-  BgYellow = "\x1b[43m",
-  BgBlue = "\x1b[44m",
-  BgMagenta = "\x1b[45m",
-  BgCyan = "\x1b[46m",
-  BgWhite = "\x1b[47m",
-}
-
-/**
- * Simple logger class that logs messages at different log levels.
- */
-export class Logger {
-  private _logLevel: LogLevel;
-
-  /**
-   * Create a new logger instance.
-   * @param logLevel - The minimum log level to log messages for.
-   */
-  constructor(logLevel: LogLevel) {
-    this._logLevel = logLevel;
-  }
-
-  /**
-   * Change the log level of the logger.
-   * @param logLevel - The log level to log the message at.
-   */
-  public SetLogLevel(logLevel: string): void {
-    this._logLevel = LogLevel[logLevel];
-    this.debug(`Log level set to ${logLevel}`);
-  }
-
-  /**
-   * Log a debug message.
-   * @param message - The message to log.
-   */
-  public debug<T>(message: T, prefix?: string): void {
-    this.log(LogLevel.debug, message, prefix);
-  }
-
-  /**
-   * Log an info message.
-   * @param message - The message to log.
-   */
-  public info<T>(message: T, prefix?: string): void {
-    this.log(LogLevel.info, message, prefix);
-  }
-
-  /**
-   * Log a warning message.
-   * @param message - The message to log.
-   */
-  public warn<T>(message: T, prefix?: string): void {
-    this.log(LogLevel.warn, message, prefix);
-  }
-
-  /**
-   * Log an error message.
-   * @param message - The message to log.
-   */
-  public error<T>(message: T, prefix?: string): void {
-    this.log(LogLevel.error, message, prefix);
-  }
-
-  /**
-   * Log a message at the specified log level.
-   * @param logLevel - The log level of the message.
-   * @param message - The message to log.
-   */
-  private log<T>(logLevel: LogLevel, message: T, callerPrefix = ""): void {
-    const color = {
-      [LogLevel.debug]: ConsoleColors.FgBlack,
-      [LogLevel.info]: ConsoleColors.FgCyan,
-      [LogLevel.warn]: ConsoleColors.FgYellow,
-      [LogLevel.error]: ConsoleColors.FgRed,
-    };
-
-    if (logLevel >= this._logLevel) {
-      // Prefix the message with the colored log level.
-      let prefix = "[" + LogLevel[logLevel] + "]\t" + callerPrefix;
-
-      prefix = this.colorize(prefix, color[logLevel]);
-
-      // If the message is not a string, use the debug method to log the object.
-      if (typeof message !== "string") {
-        console.log(prefix);
-        console.debug("%o", message);
-      } else {
-        console.log(prefix + "\t" + message);
-      }
-    }
-  }
-
-  private colorize(text: string, color: ConsoleColors): string {
-    return color + text + ConsoleColors.Reset;
-  }
-}
-
-export default new Logger(LogLevel.info);