pepr 0.1.8 → 0.1.10

package/src/lib/k8s/tls.ts

@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+// @todo: quick and dirty temp tls chain for testing, to be replaced at runtime
+// Don't freak out, this is a self-signed cert for testing purposes only.
+import forge from "node-forge";
+
+export interface TLSOut {
+  ca: string;
+  crt: string;
+  key: string;
+}
+
+export function genTLS(name: string): TLSOut {
+  // Generate a new CA key pair
+  const caKeys = forge.pki.rsa.generateKeyPair(2048);
+  const caCert = forge.pki.createCertificate();
+  caCert.publicKey = caKeys.publicKey;
+  caCert.serialNumber = "01";
+  caCert.validity.notBefore = new Date();
+  caCert.validity.notAfter = new Date();
+  caCert.validity.notAfter.setFullYear(caCert.validity.notBefore.getFullYear() + 1);
+  const caAttrs = [
+    {
+      name: "commonName",
+      value: "Pepr Ephemeral CA",
+    },
+  ];
+  caCert.setSubject(caAttrs);
+  caCert.setIssuer(caAttrs);
+  caCert.sign(caKeys.privateKey, forge.md.sha256.create());
+
+  // Generate a new key pair
+  const keys = forge.pki.rsa.generateKeyPair(2048);
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = "01";
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = new Date();
+  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1);
+  const attrs = [
+    {
+      name: "commonName",
+      value: `${name}.pepr-system.svc`,
+    },
+  ];
+  cert.setSubject(attrs);
+  cert.setIssuer(caCert.subject.attributes);
+  cert.sign(caKeys.privateKey, forge.md.sha256.create());
+
+  // Convert the keys and certificates to PEM format
+  const ca = Buffer.from(forge.pki.certificateToPem(caCert)).toString("base64");
+  const key = Buffer.from(forge.pki.privateKeyToPem(keys.privateKey)).toString("base64");
+  const crt = Buffer.from(forge.pki.certificateToPem(cert)).toString("base64");
+
+  return { ca, key, crt };
+}

package/src/lib/k8s/types.ts

@@ -149,11 +149,6 @@ export interface Response {
 }
 
 export type WebhookIgnore = {
-  /**
-   * List of Kubernetes resource kinds to always ignore.
-   * This prevents Pepr from processing the specified resource kinds.
-   */
-  kinds?: GroupVersionKind[];
   /**
    * List of Kubernetes namespaces to always ignore.
    * Any resources in these namespaces will be ignored by Pepr.

package/src/lib/k8s/webhook.ts

@@ -5,274 +5,329 @@ import {
   V1ClusterRole,
   V1ClusterRoleBinding,
   V1Deployment,
+  V1LabelSelectorRequirement,
   V1MutatingWebhookConfiguration,
+  V1Namespace,
   V1Secret,
   V1Service,
   V1ServiceAccount,
+  dumpYaml,
 } from "@kubernetes/client-node";
 import { gzipSync } from "zlib";
-import { tlsCA, tlsCert, tlsKey } from "./stub-tls";
 import { ModuleConfig } from "../types";
+import { TLSOut, genTLS } from "./tls";
 
-const peprIgnore = {
+const peprIgnore: V1LabelSelectorRequirement = {
   key: "pepr.dev",
   operator: "NotIn",
   values: ["ignore"],
 };
 
-// @todo: make all this 💩 real
+export class Webhook {
+  private name: string;
+  private image: string;
+  private tls: TLSOut;
 
-/**
- * Grants the controller access to cluster resources beyond the mutating webhook.
- *
- * @todo: should dynamically generate this based on resources used by the module. will also need to explore how this should work for multiple modules.
- * @returns
- */
-export function role(config: ModuleConfig): V1ClusterRole {
-  return {
-    apiVersion: "rbac.authorization.k8s.io/v1",
-    kind: "ClusterRole",
-    metadata: {
-      name: `pepr-${config.uuid}`,
-    },
-    rules: [
-      {
-        // @todo: make this configurable
-        apiGroups: ["*"],
-        resources: ["*"],
-        verbs: ["create", "delete", "get", "list", "patch", "update", "watch"],
-      },
-      {
-        apiGroups: ["admissionregistration.k8s.io/v1"],
-        resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"],
-        verbs: ["get", "list", "update"],
-      },
-    ],
-  };
-}
-
-export function roleBinding(config: ModuleConfig): V1ClusterRoleBinding {
-  const name = `pepr-${config.uuid}`;
-  return {
-    apiVersion: "rbac.authorization.k8s.io/v1",
-    kind: "ClusterRoleBinding",
-    metadata: { name },
-    roleRef: {
-      apiGroup: "rbac.authorization.k8s.io",
-      kind: "ClusterRole",
-      name,
-    },
-    subjects: [
-      {
-        kind: "ServiceAccount",
-        name: "pepr",
-        namespace: "pepr-system",
-      },
-    ],
-  };
-}
-
-export function serviceAccoutn(): V1ServiceAccount {
-  return {
-    apiVersion: "v1",
-    kind: "ServiceAccount",
-    metadata: {
-      name: "pepr",
-      namespace: "pepr-system",
-    },
-  };
-}
-
-export function tlsSecret(): V1Secret {
-  return {
-    apiVersion: "v1",
-    kind: "Secret",
-    metadata: {
-      name: "controller-tls",
-      namespace: "pepr-system",
-    },
-    type: "kubernetes.io/tls",
-    data: {
-      "tls.crt": tlsCert(),
-      "tls.key": tlsKey(),
-    },
-  };
-}
+  constructor(private readonly config: ModuleConfig) {
+    this.name = `pepr-${config.uuid}`;
 
-export function mutatingWebhook(config: ModuleConfig): V1MutatingWebhookConfiguration {
-  const name = `pepr-${config.uuid}`;
+    this.image = `ghcr.io/defenseunicorns/pepr-controller:${config.version}`;
 
-  const ignore = [peprIgnore];
-  if (config.alwaysIgnore.kinds.length > 0) {
-    // ignore.push({
-    //   key: "pepr.dev/kind",
-    //   operator: "NotIn",
-    //   values: config.alwaysIgnore.kinds,
-    // });
+    // Generate the ephemeral tls things
+    this.tls = genTLS(this.name);
   }
 
-  // Add any namespaces to ignore
-  if (config.alwaysIgnore.namespaces.length > 0) {
-    ignore.push({
-      key: "kubernetes.io/metadata.name",
-      operator: "NotIn",
-      values: config.alwaysIgnore.namespaces,
-    });
+  /** Generate the pepr-system namespace */
+  namespace(): V1Namespace {
+    return {
+      apiVersion: "v1",
+      kind: "Namespace",
+      metadata: { name: "pepr-system" },
+    };
   }
 
-  return {
-    apiVersion: "admissionregistration.k8s.io/v1",
-    kind: "MutatingWebhookConfiguration",
-    metadata: { name },
-    webhooks: [
-      {
-        admissionReviewVersions: ["v1", "v1beta1"],
-        clientConfig: {
-          caBundle: tlsCA(),
-          service: {
-            name: "controller",
-            namespace: "pepr-system",
-            path: "/mutate",
-          },
+  /**
+   * Grants the controller access to cluster resources beyond the mutating webhook.
+   *
+   * @todo: should dynamically generate this based on resources used by the module. will also need to explore how this should work for multiple modules.
+   * @returns
+   */
+  clusterRole(): V1ClusterRole {
+    return {
+      apiVersion: "rbac.authorization.k8s.io/v1",
+      kind: "ClusterRole",
+      metadata: { name: this.name },
+      rules: [
+        {
+          // @todo: make this configurable
+          apiGroups: ["*"],
+          resources: ["*"],
+          verbs: ["create", "delete", "get", "list", "patch", "update", "watch"],
         },
-        failurePolicy: "Ignore",
-        matchPolicy: "Equivalent",
+      ],
+    };
+  }
+
+  clusterRoleBinding(): V1ClusterRoleBinding {
+    const name = this.name;
+    return {
+      apiVersion: "rbac.authorization.k8s.io/v1",
+      kind: "ClusterRoleBinding",
+      metadata: { name },
+      roleRef: {
+        apiGroup: "rbac.authorization.k8s.io",
+        kind: "ClusterRole",
         name,
-        timeoutSeconds: 15,
-        namespaceSelector: {
-          matchExpressions: ignore,
-        },
-        objectSelector: {
-          matchExpressions: ignore,
+      },
+      subjects: [
+        {
+          kind: "ServiceAccount",
+          name,
+          namespace: "pepr-system",
         },
-        // @todo: make this configurable
-        rules: [
-          {
-            apiGroups: ["*"],
-            apiVersions: ["*"],
-            operations: ["CREATE", "UPDATE", "DELETE"],
-            resources: ["*"],
-          },
-        ],
-        // @todo: track side effects state
-        sideEffects: "None",
+      ],
+    };
+  }
+
+  serviceAccount(): V1ServiceAccount {
+    return {
+      apiVersion: "v1",
+      kind: "ServiceAccount",
+      metadata: {
+        name: this.name,
+        namespace: "pepr-system",
       },
-    ],
-  };
-}
+    };
+  }
 
-export function deployment(config: ModuleConfig): V1Deployment {
-  return {
-    apiVersion: "apps/v1",
-    kind: "Deployment",
-    metadata: {
-      name: "controller",
-      namespace: "pepr-system",
-      labels: {
-        app: "controller",
+  tlsSecret(): V1Secret {
+    return {
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: {
+        name: `${this.name}-tls`,
+        namespace: "pepr-system",
       },
-    },
-    spec: {
-      replicas: 2,
-      selector: {
-        matchLabels: {
-          app: "controller",
+      type: "kubernetes.io/tls",
+      data: {
+        "tls.crt": this.tls.crt,
+        "tls.key": this.tls.key,
+      },
+    };
+  }
+
+  mutatingWebhook(): V1MutatingWebhookConfiguration {
+    const { name } = this;
+    const ignore = [peprIgnore];
+
+    // Add any namespaces to ignore
+    if (this.config.alwaysIgnore.namespaces.length > 0) {
+      ignore.push({
+        key: "kubernetes.io/metadata.name",
+        operator: "NotIn",
+        values: this.config.alwaysIgnore.namespaces,
+      });
+    }
+
+    return {
+      apiVersion: "admissionregistration.k8s.io/v1",
+      kind: "MutatingWebhookConfiguration",
+      metadata: { name },
+      webhooks: [
+        {
+          name: `${name}.pepr.dev`,
+          admissionReviewVersions: ["v1", "v1beta1"],
+          clientConfig: {
+            caBundle: this.tls.ca,
+            service: {
+              name: this.name,
+              namespace: "pepr-system",
+              path: "/mutate",
+            },
+          },
+          failurePolicy: "Ignore",
+          matchPolicy: "Equivalent",
+          timeoutSeconds: 15,
+          namespaceSelector: {
+            matchExpressions: ignore,
+          },
+          objectSelector: {
+            matchExpressions: ignore,
+          },
+          // @todo: make this configurable
+          rules: [
+            {
+              apiGroups: ["*"],
+              apiVersions: ["*"],
+              operations: ["CREATE", "UPDATE", "DELETE"],
+              resources: ["*"],
+            },
+          ],
+          // @todo: track side effects state
+          sideEffects: "None",
+        },
+      ],
+    };
+  }
+
+  deployment(): V1Deployment {
+    return {
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: {
+        name: this.name,
+        namespace: "pepr-system",
+        labels: {
+          app: this.name,
         },
       },
-      template: {
-        metadata: {
-          labels: {
-            app: "controller",
+      spec: {
+        replicas: 2,
+        selector: {
+          matchLabels: {
+            app: this.name,
           },
         },
-        spec: {
-          priorityClassName: "system-node-critical",
-          serviceAccountName: `pepr-${config.uuid}`,
-          containers: [
-            {
-              name: "server",
-              image: "ghcr.io/defenseunicorns/pepr-controller:latest",
-              imagePullPolicy: "IfNotPresent",
-              livenessProbe: {
-                httpGet: {
-                  path: "/healthz",
-                  port: 3000,
-                  scheme: "HTTPS",
-                },
-              },
-              ports: [
-                {
-                  containerPort: 3000,
-                },
-              ],
-              resources: {
-                requests: {
-                  memory: "64Mi",
-                  cpu: "100m",
+        template: {
+          metadata: {
+            labels: {
+              app: this.name,
+            },
+          },
+          spec: {
+            priorityClassName: "system-node-critical",
+            serviceAccountName: this.name,
+            containers: [
+              {
+                name: "server",
+                image: this.image,
+                imagePullPolicy: "IfNotPresent",
+                livenessProbe: {
+                  httpGet: {
+                    path: "/healthz",
+                    port: 3000,
+                    scheme: "HTTPS",
+                  },
                 },
-                limits: {
-                  memory: "256Mi",
-                  cpu: "500m",
+                ports: [
+                  {
+                    containerPort: 3000,
+                  },
+                ],
+                resources: {
+                  requests: {
+                    memory: "64Mi",
+                    cpu: "100m",
+                  },
+                  limits: {
+                    memory: "256Mi",
+                    cpu: "500m",
+                  },
                 },
+                volumeMounts: [
+                  {
+                    name: "tls-certs",
+                    mountPath: "/etc/certs",
+                    readOnly: true,
+                  },
+                ],
               },
-              volumeMounts: [
-                {
-                  name: "tls-certs",
-                  mountPath: "/etc/certs",
-                  readOnly: true,
+            ],
+            volumes: [
+              {
+                name: "tls-certs",
+                secret: {
+                  secretName: `${this.name}-tls`,
                 },
-              ],
-            },
-          ],
-          volumes: [
-            {
-              name: "tls-certs",
-              secret: {
-                secretName: "controller-tls",
               },
-            },
-          ],
+            ],
+          },
         },
       },
-    },
-  };
-}
+    };
+  }
+
+  service(): V1Service {
+    return {
+      apiVersion: "v1",
+      kind: "Service",
+      metadata: {
+        name: this.name,
+        namespace: "pepr-system",
+      },
+      spec: {
+        selector: {
+          app: this.name,
+        },
+        ports: [
+          {
+            port: 443,
+            targetPort: 3000,
+          },
+        ],
+      },
+    };
+  }
 
-export function service(): V1Service {
-  return {
-    apiVersion: "v1",
-    kind: "Service",
-    metadata: {
-      name: "controller",
-      namespace: "pepr-system",
-    },
-    spec: {
-      selector: {
-        app: "controller",
+  moduleSecret(data: string): V1Secret {
+    // Compress the data
+    const compressed = gzipSync(data);
+    return {
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: {
+        name: `${this.name}-module`,
+        namespace: "pepr-system",
       },
-      ports: [
+      type: "Opaque",
+      data: {
+        module: compressed.toString("base64"),
+      },
+    };
+  }
+
+  zarfYaml(path: string) {
+    const zarfCfg = {
+      kind: "ZarfPackageConfig",
+      metadata: {
+        name: this.name,
+        description: `Pepr Module: ${this.config.description}`,
+        url: "https://github.com/defenseunicorns/pepr",
+        version: this.config.version,
+      },
+      components: [
         {
-          port: 443,
-          targetPort: 3000,
+          name: "module",
+          required: true,
+          manifests: [
+            {
+              name: "module",
+              namespace: "pepr-system",
+              files: [path],
+            },
+          ],
+          images: [this.image],
         },
       ],
-    },
-  };
-}
+    };
+
+    return dumpYaml(zarfCfg, { noRefs: true });
+  }
 
-export function moduleSecret(uuid: string, data: string): V1Secret {
-  // Compress the data
-  const compressed = gzipSync(data);
-  return {
-    apiVersion: "v1",
-    kind: "Secret",
-    metadata: {
-      name: `module-${uuid}`,
-      namespace: "pepr-system",
-    },
-    type: "Opaque",
-    data: {
-      module: compressed.toString("base64"),
-    },
-  };
+  allYaml(code: string) {
+    const resources = [
+      this.namespace(),
+      this.clusterRole(),
+      this.clusterRoleBinding(),
+      this.serviceAccount(),
+      this.tlsSecret(),
+      this.mutatingWebhook(),
+      this.deployment(),
+      this.service(),
+      this.moduleSecret(code),
+    ];
+
+    // Convert the resources to a single YAML string
+    return resources.map(r => dumpYaml(r, { noRefs: true })).join("---\n");
+  }
 }

package/src/lib/module.ts

@@ -1,20 +1,21 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: 2023-Present The Pepr Authors
 
+import R from "ramda";
 import { Capability } from "./capability";
 import { GroupVersionKind, Request, Response } from "./k8s";
 import logger from "./logger";
 import { processor } from "./processor";
-import { ModuleAdditionalCfg, ModuleConfig } from "./types";
+import { ModuleConfig } from "./types";
+
+const alwaysIgnore = {
+  namespaces: ["kube-system", "pepr-system"],
+  labels: [{ "pepr.dev": "ignore" }],
+};
 
 export type PackageJSON = {
   description: string;
-  pepr: {
-    uuid: string;
-    name: string;
-    version: string;
-    onError: string;
-  };
+  pepr: ModuleConfig;
 };
 
 export class PeprModule {
@@ -35,17 +36,9 @@ export class PeprModule {
    *
    * @param config The configuration for the Pepr runtime
    */
-  constructor({ description, pepr }: PackageJSON, additionalCfg: ModuleAdditionalCfg) {
-    this._config = {
-      // Hardcode default values
-      alwaysIgnore: {
-        namespaces: ["kube-system", "pepr-system"],
-        labels: [{ "pepr.dev": "ignore" }],
-      },
-      ...pepr,
-      ...additionalCfg,
-      description,
-    } as ModuleConfig;
+  constructor({ description, pepr }: PackageJSON) {
+    pepr.description = description;
+    this._config = R.mergeDeepWith(R.concat, pepr, alwaysIgnore);
   }
 
   Register = (capability: Capability) => {