pepr 0.1.7 → 0.1.9

package/dist/pepr-cli.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 'use strict';
 
-var clientNode = require('@kubernetes/client-node');
 var json = require('@rollup/plugin-json');
 var nodeResolve = require('@rollup/plugin-node-resolve');
 var typescript = require('@rollup/plugin-typescript');
@@ -11,7 +10,9 @@ var rollup = require('rollup');
 require('@kubernetes/client-node/dist');
 require('ramda');
 require('fast-json-patch');
+var clientNode = require('@kubernetes/client-node');
 var zlib = require('zlib');
+var forge = require('node-forge');
 var util = require('util');
 var uuid = require('uuid');
 var prompt = require('prompts');
@@ -19,7 +20,7 @@ var commander = require('commander');
 var child_process = require('child_process');
 var chokidar = require('chokidar');
 
-var version = "0.1.7";
+var version = "0.1.9";
 var dependencies = {
 	"@kubernetes/client-node": "^0.18.1",
 	"@rollup/plugin-json": "^6.0.0",
@@ -30,21 +31,23 @@ var dependencies = {
 	commander: "^10.0.0",
 	express: "^4.18.2",
 	"fast-json-patch": "^3.1.1",
+	"node-forge": "^1.3.1",
+	prettier: "^2.8.7",
 	prompts: "^2.4.2",
 	ramda: "^0.28.0",
 	rollup: "^3.20.2",
-	uuid: "^9.0.0",
 	tslib: "^2.5.0",
-	typescript: "^5.0.2"
+	typescript: "^5.0.2",
+	uuid: "^9.0.0"
 };
 var devDependencies = {
+	"@types/node-forge": "^1.3.2",
 	"@types/prompts": "^2.4.4",
 	"@types/uuid": "^9.0.1",
 	"@typescript-eslint/eslint-plugin": "^5.57.0",
 	"@typescript-eslint/parser": "^5.57.0",
 	ava: "^5.2.0",
 	eslint: "^8.37.0",
-	prettier: "^2.8.7",
 	"rollup-plugin-visualizer": "^5.9.0",
 	"ts-node": "^10.9.1",
 	"tsconfig-paths": "^4.1.2"
@@ -278,21 +281,341 @@ var Event;
 })(Event || (Event = {}));
 
 // SPDX-License-Identifier: Apache-2.0
-function moduleSecret(uuid, data) {
-    // Compress the data
-    const compressed = zlib.gzipSync(data);
-    return {
-        apiVersion: "v1",
-        kind: "Secret",
-        metadata: {
-            name: `module-${uuid}`,
-            namespace: "pepr-system",
+function genTLS(name) {
+    // Generate a new CA key pair
+    const caKeys = forge.pki.rsa.generateKeyPair(2048);
+    const caCert = forge.pki.createCertificate();
+    caCert.publicKey = caKeys.publicKey;
+    caCert.serialNumber = "01";
+    caCert.validity.notBefore = new Date();
+    caCert.validity.notAfter = new Date();
+    caCert.validity.notAfter.setFullYear(caCert.validity.notBefore.getFullYear() + 1);
+    const caAttrs = [
+        {
+            name: "commonName",
+            value: "Pepr Ephemeral CA",
         },
-        type: "Opaque",
-        data: {
-            module: compressed.toString("base64"),
+    ];
+    caCert.setSubject(caAttrs);
+    caCert.setIssuer(caAttrs);
+    caCert.sign(caKeys.privateKey, forge.md.sha256.create());
+    // Generate a new key pair
+    const keys = forge.pki.rsa.generateKeyPair(2048);
+    const cert = forge.pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = "01";
+    cert.validity.notBefore = new Date();
+    cert.validity.notAfter = new Date();
+    cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1);
+    const attrs = [
+        {
+            name: "commonName",
+            value: `${name}.pepr-system.svc`,
         },
-    };
+    ];
+    cert.setSubject(attrs);
+    cert.setIssuer(caCert.subject.attributes);
+    cert.sign(caKeys.privateKey, forge.md.sha256.create());
+    // Convert the keys and certificates to PEM format
+    const ca = Buffer.from(forge.pki.certificateToPem(caCert)).toString("base64");
+    const key = Buffer.from(forge.pki.privateKeyToPem(keys.privateKey)).toString("base64");
+    const crt = Buffer.from(forge.pki.certificateToPem(cert)).toString("base64");
+    return { ca, key, crt };
+}
+
+// SPDX-License-Identifier: Apache-2.0
+const peprIgnore = {
+    key: "pepr.dev",
+    operator: "NotIn",
+    values: ["ignore"],
+};
+class Webhook {
+    constructor(config) {
+        this.config = config;
+        this.name = `pepr-${config.uuid}`;
+        this.image = `ghcr.io/defenseunicorns/pepr-controller:${config.version}`;
+        // Generate the ephemeral tls things
+        this.tls = genTLS(this.name);
+    }
+    /** Generate the pepr-system namespace */
+    namespace() {
+        return {
+            apiVersion: "v1",
+            kind: "Namespace",
+            metadata: { name: "pepr-system" },
+        };
+    }
+    /**
+     * Grants the controller access to cluster resources beyond the mutating webhook.
+     *
+     * @todo: should dynamically generate this based on resources used by the module. will also need to explore how this should work for multiple modules.
+     * @returns
+     */
+    clusterRole() {
+        return {
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "ClusterRole",
+            metadata: { name: this.name },
+            rules: [
+                {
+                    // @todo: make this configurable
+                    apiGroups: ["*"],
+                    resources: ["*"],
+                    verbs: ["create", "delete", "get", "list", "patch", "update", "watch"],
+                },
+            ],
+        };
+    }
+    clusterRoleBinding() {
+        const name = this.name;
+        return {
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "ClusterRoleBinding",
+            metadata: { name },
+            roleRef: {
+                apiGroup: "rbac.authorization.k8s.io",
+                kind: "ClusterRole",
+                name,
+            },
+            subjects: [
+                {
+                    kind: "ServiceAccount",
+                    name,
+                    namespace: "pepr-system",
+                },
+            ],
+        };
+    }
+    serviceAccount() {
+        return {
+            apiVersion: "v1",
+            kind: "ServiceAccount",
+            metadata: {
+                name: this.name,
+                namespace: "pepr-system",
+            },
+        };
+    }
+    tlsSecret() {
+        return {
+            apiVersion: "v1",
+            kind: "Secret",
+            metadata: {
+                name: `${this.name}-tls`,
+                namespace: "pepr-system",
+            },
+            type: "kubernetes.io/tls",
+            data: {
+                "tls.crt": this.tls.crt,
+                "tls.key": this.tls.key,
+            },
+        };
+    }
+    mutatingWebhook() {
+        const { name } = this;
+        const ignore = [peprIgnore];
+        // Add any namespaces to ignore
+        if (this.config.alwaysIgnore.namespaces.length > 0) {
+            ignore.push({
+                key: "kubernetes.io/metadata.name",
+                operator: "NotIn",
+                values: this.config.alwaysIgnore.namespaces,
+            });
+        }
+        return {
+            apiVersion: "admissionregistration.k8s.io/v1",
+            kind: "MutatingWebhookConfiguration",
+            metadata: { name },
+            webhooks: [
+                {
+                    name: `${name}.pepr.dev`,
+                    admissionReviewVersions: ["v1", "v1beta1"],
+                    clientConfig: {
+                        caBundle: this.tls.ca,
+                        service: {
+                            name: this.name,
+                            namespace: "pepr-system",
+                            path: "/mutate",
+                        },
+                    },
+                    failurePolicy: "Ignore",
+                    matchPolicy: "Equivalent",
+                    timeoutSeconds: 15,
+                    namespaceSelector: {
+                        matchExpressions: ignore,
+                    },
+                    objectSelector: {
+                        matchExpressions: ignore,
+                    },
+                    // @todo: make this configurable
+                    rules: [
+                        {
+                            apiGroups: ["*"],
+                            apiVersions: ["*"],
+                            operations: ["CREATE", "UPDATE", "DELETE"],
+                            resources: ["*"],
+                        },
+                    ],
+                    // @todo: track side effects state
+                    sideEffects: "None",
+                },
+            ],
+        };
+    }
+    deployment() {
+        return {
+            apiVersion: "apps/v1",
+            kind: "Deployment",
+            metadata: {
+                name: this.name,
+                namespace: "pepr-system",
+                labels: {
+                    app: this.name,
+                },
+            },
+            spec: {
+                replicas: 2,
+                selector: {
+                    matchLabels: {
+                        app: this.name,
+                    },
+                },
+                template: {
+                    metadata: {
+                        labels: {
+                            app: this.name,
+                        },
+                    },
+                    spec: {
+                        priorityClassName: "system-node-critical",
+                        serviceAccountName: this.name,
+                        containers: [
+                            {
+                                name: "server",
+                                image: this.image,
+                                imagePullPolicy: "IfNotPresent",
+                                livenessProbe: {
+                                    httpGet: {
+                                        path: "/healthz",
+                                        port: 3000,
+                                        scheme: "HTTPS",
+                                    },
+                                },
+                                ports: [
+                                    {
+                                        containerPort: 3000,
+                                    },
+                                ],
+                                resources: {
+                                    requests: {
+                                        memory: "64Mi",
+                                        cpu: "100m",
+                                    },
+                                    limits: {
+                                        memory: "256Mi",
+                                        cpu: "500m",
+                                    },
+                                },
+                                volumeMounts: [
+                                    {
+                                        name: "tls-certs",
+                                        mountPath: "/etc/certs",
+                                        readOnly: true,
+                                    },
+                                ],
+                            },
+                        ],
+                        volumes: [
+                            {
+                                name: "tls-certs",
+                                secret: {
+                                    secretName: `${this.name}-tls`,
+                                },
+                            },
+                        ],
+                    },
+                },
+            },
+        };
+    }
+    service() {
+        return {
+            apiVersion: "v1",
+            kind: "Service",
+            metadata: {
+                name: this.name,
+                namespace: "pepr-system",
+            },
+            spec: {
+                selector: {
+                    app: this.name,
+                },
+                ports: [
+                    {
+                        port: 443,
+                        targetPort: 3000,
+                    },
+                ],
+            },
+        };
+    }
+    moduleSecret(data) {
+        // Compress the data
+        const compressed = zlib.gzipSync(data);
+        return {
+            apiVersion: "v1",
+            kind: "Secret",
+            metadata: {
+                name: `${this.name}-module`,
+                namespace: "pepr-system",
+            },
+            type: "Opaque",
+            data: {
+                module: compressed.toString("base64"),
+            },
+        };
+    }
+    zarfYaml(path) {
+        const zarfCfg = {
+            kind: "ZarfPackageConfig",
+            metadata: {
+                name: this.name,
+                description: `Pepr Module: ${this.config.description}`,
+                url: "https://github.com/defenseunicorns/pepr",
+                version: this.config.version,
+            },
+            components: [
+                {
+                    name: "module",
+                    required: true,
+                    manifests: [
+                        {
+                            name: "module",
+                            namespace: "pepr-system",
+                            files: [path],
+                        },
+                    ],
+                    images: [this.image],
+                },
+            ],
+        };
+        return clientNode.dumpYaml(zarfCfg, { noRefs: true });
+    }
+    allYaml(code) {
+        const resources = [
+            this.namespace(),
+            this.clusterRole(),
+            this.clusterRoleBinding(),
+            this.serviceAccount(),
+            this.tlsSecret(),
+            this.mutatingWebhook(),
+            this.deployment(),
+            this.service(),
+            this.moduleSecret(code),
+        ];
+        // Convert the resources to a single YAML string
+        return resources.map(r => clientNode.dumpYaml(r, { noRefs: true })).join("---\n");
+    }
 }
 
 // SPDX-License-Identifier: Apache-2.0
@@ -303,14 +626,21 @@ function build (program) {
         .option("-d, --dir [directory]", "Pepr module directory", ".")
         .action(async (opts) => {
         // Build the module
-        const { path: path$1, uuid } = await buildModule(opts.dir);
+        const { cfg, path: path$1, uuid } = await buildModule(opts.dir);
         // Read the compiled module code
         const code = await fs.promises.readFile(path$1, { encoding: "utf-8" });
         // Generate a secret for the module
-        const secret = moduleSecret(uuid, code);
-        const yaml = clientNode.dumpYaml(secret);
-        const yamlPath = path.resolve("dist", `pepr-module-${uuid}.yaml`);
+        const webhook = new Webhook({
+            ...cfg.pepr,
+            description: cfg.description,
+        });
+        const yamlFile = `pepr-module-${uuid}.yaml`;
+        const yamlPath = path.resolve("dist", yamlFile);
+        const yaml = webhook.allYaml(code);
+        const zarfPath = path.resolve("dist", "zarf.yaml");
+        const zarf = webhook.zarfYaml(yamlFile);
         await fs.promises.writeFile(yamlPath, yaml);
+        await fs.promises.writeFile(zarfPath, zarf);
         Log.debug(`Module compiled successfully at ${path$1}`);
         Log.info(`K8s resource for the module saved to ${yamlPath}`);
     });
@@ -320,6 +650,7 @@ const externalLibs = [
     "commander",
     "express",
     "fast-json-patch",
+    "pepr",
     "ramda",
 ];
 async function buildModule(moduleDir) {
@@ -329,7 +660,8 @@ async function buildModule(moduleDir) {
         const input = path.resolve(moduleDir, "pepr.ts");
         // Read the module's UUID from the package.json filel
         const moduleText = await fs.promises.readFile(cfgPath, { encoding: "utf-8" });
-        const uuid = JSON.parse(moduleText).pepr.uuid;
+        const cfg = JSON.parse(moduleText);
+        const { uuid } = cfg.pepr;
         const name = `pepr-${uuid}.js`;
         // Exit if the module's UUID could not be found
         if (!uuid) {
@@ -363,7 +695,8 @@ async function buildModule(moduleDir) {
         });
         return {
             path: path.resolve("dist", name),
-            uuid: uuid,
+            cfg,
+            uuid,
         };
     }
     catch (e) {
@@ -445,12 +778,7 @@ import cfg from "./package.json";
 // import { HelloPepr } from "./capabilities/hello-pepr";
 
 // This initializes the Pepr module with the configuration from package.json
-export const { ProcessRequest, Register } = new PeprModule(cfg, {
-  alwaysIgnore: {
-    namespaces: [],
-    labels: [],
-  },
-});
+export const { ProcessRequest, Register } = new PeprModule(cfg);
 
 /**
  * Each Pepr Capability is registered with the module using the Register function.
@@ -490,6 +818,10 @@ function genPkgJSON(opts) {
             version,
             uuid: uuid$1,
             onError: opts.errorBehavior,
+            alwaysIgnore: {
+                namespaces: [],
+                labels: [],
+            },
         },
         scripts: {
             build: "pepr build",
@@ -576,72 +908,72 @@ const capabilityHelloPeprTS = {
     path: "hello-pepr.ts",
     data: `import { Capability, a } from "pepr";
 
-  const { Register, When } = new Capability({
-    name: "hello-pepr",
-    description: "A simple example capability to show how things work.",
-    namespaces: ["pepr-demo"],
-  });
-  
-  export { Register as HelloPepr };
-  
-  /**
-   * This is a single Capability Action. They can be in the same file or put imported from other files.
-   * In this exmaple, when a ConfigMap is created with the name \`example-1\`, then add a label and annotation.
-   *
-   * Equivelant to manually running:
-   * \`kubectl label configmap example-1 pepr=was-here\`
-   * \`kubectl annotate configmap example-1 pepr.dev=annotations-work-too\`
-   */
-  When(a.ConfigMap)
-    .IsCreated()
-    .WithName("example-1")
-    .Then(request =>
-      request
-        .SetLabel("pepr", "was-here")
-        .SetAnnotation("pepr.dev", "annotations-work-too")
-    );
-  
-  /**
-   * This Capabiility Action does the exact same changes for example-2, except this time it uses the \`.ThenSet()\` feature.
-   * You can stack multiple \`.Then()\` calls, but only a single \`.ThenSet()\`
-   */
-  When(a.ConfigMap)
-    .IsCreated()
-    .WithName("example-2")
-    .ThenSet({
-      metadata: {
-        labels: {
-          pepr: "was-here",
-        },
-        annotations: {
-          "pepr.dev": "annotations-work-too",
-        },
+const { Register, When } = new Capability({
+  name: "hello-pepr",
+  description: "A simple example capability to show how things work.",
+  namespaces: ["pepr-demo"],
+});
+
+export { Register as HelloPepr };
+
+/**
+ * This is a single Capability Action. They can be in the same file or put imported from other files.
+ * In this exmaple, when a ConfigMap is created with the name \`example-1\`, then add a label and annotation.
+ *
+ * Equivelant to manually running:
+ * \`kubectl label configmap example-1 pepr=was-here\`
+ * \`kubectl annotate configmap example-1 pepr.dev=annotations-work-too\`
+ */
+When(a.ConfigMap)
+  .IsCreated()
+  .WithName("example-1")
+  .Then(request =>
+    request
+      .SetLabel("pepr", "was-here")
+      .SetAnnotation("pepr.dev", "annotations-work-too")
+  );
+
+/**
+ * This Capabiility Action does the exact same changes for example-2, except this time it uses the \`.ThenSet()\` feature.
+ * You can stack multiple \`.Then()\` calls, but only a single \`.ThenSet()\`
+ */
+When(a.ConfigMap)
+  .IsCreated()
+  .WithName("example-2")
+  .ThenSet({
+    metadata: {
+      labels: {
+        pepr: "was-here",
       },
-    });
-  
-  /**
-   * This Capability Action combines different styles. Unlike the previous actions, this one will look for any ConfigMap
-   * in the \`pepr-demo\` namespace that has the label \`change=by-label\`. Note that all conditions added such as \`WithName()\`,
-   * \`WithLabel()\`, \`InNamespace()\`, are ANDs so all conditions must be true for the request to be procssed.
-   */
-  When(a.ConfigMap)
-    .IsCreated()
-    .WithLabel("change", "by-label")
-    .Then(request => {
-      // The K8s object e are going to mutate
-      const cm = request.Raw;
-  
-      // Get the username and uid of the K8s reuest
-      const { username, uid } = request.Request.userInfo;
-  
-      // Store some data about the request in the configmap
-      cm.data["username"] = username;
-      cm.data["uid"] = uid;
-  
-      // You can still mix other ways of making changes too
-      request.SetAnnotation("pepr.dev", "making-waves");
-    });    
-  `,
+      annotations: {
+        "pepr.dev": "annotations-work-too",
+      },
+    },
+  });
+
+/**
+ * This Capability Action combines different styles. Unlike the previous actions, this one will look for any ConfigMap
+ * in the \`pepr-demo\` namespace that has the label \`change=by-label\`. Note that all conditions added such as \`WithName()\`,
+ * \`WithLabel()\`, \`InNamespace()\`, are ANDs so all conditions must be true for the request to be procssed.
+ */
+When(a.ConfigMap)
+  .IsCreated()
+  .WithLabel("change", "by-label")
+  .Then(request => {
+    // The K8s object e are going to mutate
+    const cm = request.Raw;
+
+    // Get the username and uid of the K8s reuest
+    const { username, uid } = request.Request.userInfo;
+
+    // Store some data about the request in the configmap
+    cm.data["username"] = username;
+    cm.data["uid"] = uid;
+
+    // You can still mix other ways of making changes too
+    request.SetAnnotation("pepr.dev", "making-waves");
+  });    
+`,
 };
 const capabilitySnippet = {
     path: "pepr.code-snippets",