timonel 0.4.0 → 1.0.0

package/dist/lib/Rutter.js

@@ -1,23 +1,17 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Rutter = void 0;
-const cdk8s_1 = require("cdk8s");
-const yaml_1 = __importDefault(require("yaml"));
-const helm_1 = require("./helm");
-const HelmChartWriter_1 = require("./HelmChartWriter");
+import { App, Chart, Testing, ApiObject } from 'cdk8s';
+import YAML from 'yaml';
+import { include, helm } from './helm.js';
+import { HelmChartWriter } from './HelmChartWriter.js';
 /**
  * Rutter builds Kubernetes manifests using cdk8s and writes a Helm chart.
  */
-class Rutter {
+export class Rutter {
     constructor(props) {
         this.assets = [];
         this.valueOverrides = {};
         this.props = props;
-        this.app = new cdk8s_1.App();
-        this.chart = new cdk8s_1.Chart(this.app, props.manifestName ?? props.meta.name);
+        this.app = new App();
+        this.chart = new Chart(this.app, props.manifestName ?? props.meta.name);
     }
     /**
      * Set dynamic value overrides (from --set flags)
@@ -68,8 +62,8 @@ class Rutter {
     }
     addDeployment(spec) {
         const match = spec.matchLabels ?? {
-            [Rutter.LABEL_NAME]: (0, helm_1.include)(Rutter.HELPER_NAME),
-            [Rutter.LABEL_INSTANCE]: helm_1.helm.releaseName,
+            [Rutter.LABEL_NAME]: include(Rutter.HELPER_NAME),
+            [Rutter.LABEL_INSTANCE]: helm.releaseName,
         };
         const envEntries = spec.env
             ? Object.entries(spec.env).map(([name, value]) => ({ name, value }))
@@ -99,7 +93,7 @@ class Rutter {
             }))
             : undefined;
         const templateLabels = { ...match, ...(spec.podLabels ?? {}) };
-        const dep = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const dep = new ApiObject(this.chart, spec.name, {
             apiVersion: 'apps/v1',
             kind: 'Deployment',
             metadata: {
@@ -140,7 +134,7 @@ class Rutter {
         return dep;
     }
     addService(spec) {
-        const svc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const svc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'Service',
             metadata: {
@@ -175,8 +169,8 @@ class Rutter {
     }
     addReplicaSet(spec) {
         const match = spec.matchLabels ?? {
-            [Rutter.LABEL_NAME]: (0, helm_1.include)(Rutter.HELPER_NAME),
-            [Rutter.LABEL_INSTANCE]: helm_1.helm.releaseName,
+            [Rutter.LABEL_NAME]: include(Rutter.HELPER_NAME),
+            [Rutter.LABEL_INSTANCE]: helm.releaseName,
         };
         const envEntries = spec.env
             ? Object.entries(spec.env).map(([name, value]) => ({ name, value }))
@@ -206,7 +200,7 @@ class Rutter {
             }))
             : undefined;
         const templateLabels = { ...match, ...(spec.podLabels ?? {}) };
-        const rs = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const rs = new ApiObject(this.chart, spec.name, {
             apiVersion: 'apps/v1',
             kind: 'ReplicaSet',
             metadata: {
@@ -247,8 +241,8 @@ class Rutter {
         return rs;
     }
     addIngress(spec) {
-        const ing = new cdk8s_1.ApiObject(this.chart, spec.name, {
-            apiVersion: 'networking.k8s.io/v1',
+        const ing = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
             kind: 'Ingress',
             metadata: {
                 name: spec.name,
@@ -321,7 +315,7 @@ class Rutter {
                 pvSpec[key] = value;
             }
         }
-        const pv = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pv = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolume',
             metadata: {
@@ -378,7 +372,7 @@ class Rutter {
     addPersistentVolumeClaim(spec) {
         // Validate access modes compatibility
         this.validatePVCAccessModes(spec);
-        const pvc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pvc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolumeClaim',
             metadata: {
@@ -413,7 +407,7 @@ class Rutter {
         }
     }
     addConfigMap(spec) {
-        const cm = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const cm = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'ConfigMap',
             metadata: {
@@ -429,7 +423,7 @@ class Rutter {
         return cm;
     }
     addSecret(spec) {
-        const sec = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sec = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'Secret',
             metadata: {
@@ -447,7 +441,7 @@ class Rutter {
     }
     addServiceAccount(spec) {
         const annotations = this.buildServiceAccountAnnotations(spec);
-        const sa = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sa = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'ServiceAccount',
             metadata: {
@@ -515,7 +509,7 @@ class Rutter {
                 },
             },
         ];
-        const hpa = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const hpa = new ApiObject(this.chart, spec.name, {
             apiVersion: 'autoscaling/v2',
             kind: 'HorizontalPodAutoscaler',
             metadata: {
@@ -535,7 +529,7 @@ class Rutter {
         return hpa;
     }
     addVerticalPodAutoscaler(spec) {
-        const vpa = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const vpa = new ApiObject(this.chart, spec.name, {
             apiVersion: 'autoscaling.k8s.io/v1',
             kind: 'VerticalPodAutoscaler',
             metadata: {
@@ -554,7 +548,7 @@ class Rutter {
         return vpa;
     }
     addPodDisruptionBudget(spec) {
-        const pdb = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pdb = new ApiObject(this.chart, spec.name, {
             apiVersion: 'policy/v1',
             kind: 'PodDisruptionBudget',
             metadata: {
@@ -588,7 +582,7 @@ class Rutter {
         if (spec.throughput && spec.volumeType === DEFAULT_VOLUME_TYPE) {
             parameters['throughput'] = String(spec.throughput);
         }
-        const sc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'storage.k8s.io/v1',
             kind: 'StorageClass',
             metadata: {
@@ -606,7 +600,7 @@ class Rutter {
         return sc;
     }
     addAWSEBSPersistentVolumeClaim(spec) {
-        const pvc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pvc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolumeClaim',
             metadata: {
@@ -628,7 +622,7 @@ class Rutter {
         return pvc;
     }
     addAWSEFSStorageClass(spec) {
-        const sc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'storage.k8s.io/v1',
             kind: 'StorageClass',
             metadata: {
@@ -670,7 +664,7 @@ class Rutter {
         if (Object.keys(volumeAttributes).length > 0) {
             csiSpec['volumeAttributes'] = volumeAttributes;
         }
-        const pv = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pv = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolume',
             metadata: {
@@ -692,7 +686,7 @@ class Rutter {
         return pv;
     }
     addAWSEFSPersistentVolumeClaim(spec) {
-        const pvc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pvc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolumeClaim',
             metadata: {
@@ -715,8 +709,8 @@ class Rutter {
     }
     addAWSALBIngress(spec) {
         const annotations = this.buildALBAnnotations(spec);
-        const ingress = new cdk8s_1.ApiObject(this.chart, spec.name, {
-            apiVersion: 'networking.k8s.io/v1',
+        const ingress = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
             kind: 'Ingress',
             metadata: {
                 name: spec.name,
@@ -812,7 +806,7 @@ class Rutter {
                 : {}),
             ...(spec.annotations ?? {}),
         };
-        const sa = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sa = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'ServiceAccount',
             metadata: {
@@ -841,14 +835,14 @@ class Rutter {
             }
             return baseObj;
         });
-        const objectsYaml = yaml_1.default.stringify(objects, { indent: 2 }).trim();
+        const objectsYaml = YAML.stringify(objects, { indent: 2 }).trim();
         const parameters = {
             objects: `|\n  ${objectsYaml.split('\n').join('\n  ')}`,
         };
         if (spec.region) {
             parameters['region'] = spec.region;
         }
-        const spc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const spc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'secrets-store.csi.x-k8s.io/v1',
             kind: 'SecretProviderClass',
             metadata: {
@@ -864,6 +858,190 @@ class Rutter {
         this.capture(spc, `${spec.name}-secretproviderclass`);
         return spc;
     }
+    addNetworkPolicy(spec) {
+        // Validate policy types
+        this.validateNetworkPolicyTypes(spec);
+        // Validate CIDR blocks if present
+        this.validateNetworkPolicyCIDRs(spec);
+        const np = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
+            kind: 'NetworkPolicy',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                podSelector: spec.podSelector ?? {},
+                policyTypes: spec.policyTypes,
+                ...(spec.ingress ? { ingress: spec.ingress } : {}),
+                ...(spec.egress ? { egress: spec.egress } : {}),
+            },
+        });
+        this.capture(np, `${spec.name}-networkpolicy`);
+        return np;
+    }
+    /**
+     * Create a deny-all ingress NetworkPolicy for the current namespace
+     */
+    addDenyAllIngressNetworkPolicy(name = 'deny-all-ingress') {
+        return this.addNetworkPolicy({
+            name,
+            podSelector: Rutter.EMPTY_POD_SELECTOR,
+            policyTypes: ['Ingress'],
+        });
+    }
+    /**
+     * Create a deny-all egress NetworkPolicy for the current namespace
+     */
+    addDenyAllEgressNetworkPolicy(name = 'deny-all-egress') {
+        return this.addNetworkPolicy({
+            name,
+            podSelector: Rutter.EMPTY_POD_SELECTOR,
+            policyTypes: ['Egress'],
+        });
+    }
+    /**
+     * Create a deny-all NetworkPolicy for both ingress and egress
+     */
+    addDenyAllNetworkPolicy(name = 'deny-all') {
+        return this.addNetworkPolicy({
+            name,
+            podSelector: Rutter.EMPTY_POD_SELECTOR,
+            policyTypes: ['Ingress', 'Egress'],
+        });
+    }
+    /**
+     * Allow traffic from specific pods to target pods on specific ports
+     */
+    addAllowFromPodsNetworkPolicy(spec) {
+        return this.addNetworkPolicy({
+            name: spec.name,
+            podSelector: { matchLabels: spec.targetPodSelector },
+            policyTypes: ['Ingress'],
+            ingress: [
+                {
+                    from: [{ podSelector: { matchLabels: spec.sourcePodSelector } }],
+                    ...(spec.ports ? { ports: spec.ports } : {}),
+                },
+            ],
+            ...(spec.labels ? { labels: spec.labels } : {}),
+            ...(spec.annotations ? { annotations: spec.annotations } : {}),
+        });
+    }
+    /**
+     * Allow traffic from specific namespace to target pods
+     */
+    addAllowFromNamespaceNetworkPolicy(spec) {
+        return this.addNetworkPolicy({
+            name: spec.name,
+            podSelector: { matchLabels: spec.targetPodSelector },
+            policyTypes: ['Ingress'],
+            ingress: [
+                {
+                    from: [{ namespaceSelector: { matchLabels: spec.sourceNamespaceSelector } }],
+                    ...(spec.ports ? { ports: spec.ports } : {}),
+                },
+            ],
+            ...(spec.labels ? { labels: spec.labels } : {}),
+            ...(spec.annotations ? { annotations: spec.annotations } : {}),
+        });
+    }
+    validateNetworkPolicyTypes(spec) {
+        if (!spec.policyTypes || spec.policyTypes.length === 0) {
+            throw new Error(`NetworkPolicy ${spec.name}: policyTypes must be specified`);
+        }
+        this.validatePolicyTypeValues(spec);
+        this.validatePolicyTypeRules(spec);
+    }
+    validatePolicyTypeValues(spec) {
+        const validTypes = ['Ingress', 'Egress'];
+        for (const type of spec.policyTypes) {
+            if (!validTypes.includes(type)) {
+                throw new Error(`NetworkPolicy ${spec.name}: invalid policyType '${type}', must be 'Ingress' or 'Egress'`);
+            }
+        }
+    }
+    validatePolicyTypeRules(spec) {
+        if (spec.policyTypes.includes('Ingress') && spec.ingress === undefined) {
+            console.warn(`NetworkPolicy ${spec.name}: policyType 'Ingress' specified but no ingress rules defined (will deny all ingress)`);
+        }
+        if (spec.policyTypes.includes('Egress') && spec.egress === undefined) {
+            console.warn(`NetworkPolicy ${spec.name}: policyType 'Egress' specified but no egress rules defined (will deny all egress)`);
+        }
+    }
+    validateNetworkPolicyCIDRs(spec) {
+        const validateCIDR = (cidr, context) => {
+            if (!this.isValidCIDR(cidr)) {
+                throw new Error(`NetworkPolicy ${spec.name}: invalid CIDR '${cidr}' in ${context}`);
+            }
+        };
+        this.validateIngressCIDRs(spec, validateCIDR);
+        this.validateEgressCIDRs(spec, validateCIDR);
+    }
+    isValidCIDR(cidr) {
+        // IPv4 CIDR validation
+        const ipv4Parts = cidr.split('/');
+        if (ipv4Parts.length === 2) {
+            const [ip, prefix] = ipv4Parts;
+            if (ip && prefix && this.isValidIPv4(ip) && this.isValidPrefix(prefix, 32)) {
+                return true;
+            }
+        }
+        // IPv6 CIDR validation (basic)
+        if (cidr.includes(':') && ipv4Parts.length === 2) {
+            const [, prefix] = ipv4Parts;
+            if (prefix) {
+                return this.isValidPrefix(prefix, 128);
+            }
+        }
+        return false;
+    }
+    isValidIPv4(ip) {
+        const parts = ip.split('.');
+        if (parts.length !== 4)
+            return false;
+        return parts.every((part) => {
+            const num = parseInt(part, 10);
+            return !isNaN(num) && num >= 0 && num <= 255 && String(num) === part;
+        });
+    }
+    isValidPrefix(prefix, maxPrefix) {
+        const num = parseInt(prefix, 10);
+        return !isNaN(num) && num >= 0 && num <= maxPrefix && String(num) === prefix;
+    }
+    validateIngressCIDRs(spec, validateCIDR) {
+        if (!spec.ingress)
+            return;
+        for (const rule of spec.ingress) {
+            if (rule.from) {
+                for (const peer of rule.from) {
+                    this.validatePeerCIDRs(peer, validateCIDR, 'ingress rule');
+                }
+            }
+        }
+    }
+    validateEgressCIDRs(spec, validateCIDR) {
+        if (!spec.egress)
+            return;
+        for (const rule of spec.egress) {
+            if (rule.to) {
+                for (const peer of rule.to) {
+                    this.validatePeerCIDRs(peer, validateCIDR, 'egress rule');
+                }
+            }
+        }
+    }
+    validatePeerCIDRs(peer, validateCIDR, context) {
+        if (peer.ipBlock?.cidr) {
+            validateCIDR(peer.ipBlock.cidr, context);
+            if (peer.ipBlock.except) {
+                for (const except of peer.ipBlock.except) {
+                    validateCIDR(except, `${context} except block`);
+                }
+            }
+        }
+    }
     /**
      * Capture the YAML of an ApiObject or Construct into assets.
      */
@@ -898,7 +1076,7 @@ class Rutter {
      */
     write(outDir) {
         // Use cdk8s Testing.synth to obtain manifest objects
-        const manifestObjs = cdk8s_1.Testing.synth(this.chart);
+        const manifestObjs = Testing.synth(this.chart);
         // Enforce common labels best-practice on all rendered objects
         const enriched = manifestObjs.map((obj) => {
             if (obj && typeof obj === 'object') {
@@ -908,11 +1086,11 @@ class Rutter {
                 const labels = o.metadata.labels;
                 const defaults = {
                     'helm.sh/chart': '{{ .Chart.Name }}-{{ .Chart.Version }}',
-                    'app.kubernetes.io/name': (0, helm_1.include)(Rutter.HELPER_NAME),
-                    'app.kubernetes.io/instance': helm_1.helm.releaseName,
-                    'app.kubernetes.io/version': helm_1.helm.chartVersion,
+                    'app.kubernetes.io/name': include(Rutter.HELPER_NAME),
+                    'app.kubernetes.io/instance': helm.releaseName,
+                    'app.kubernetes.io/version': helm.chartVersion,
                     'app.kubernetes.io/managed-by': '{{ .Release.Service }}',
-                    'app.kubernetes.io/part-of': helm_1.helm.chartName,
+                    'app.kubernetes.io/part-of': helm.chartName,
                 };
                 for (const [k, v] of Object.entries(defaults)) {
                     if (!(k in labels)) {
@@ -926,7 +1104,7 @@ class Rutter {
         if (this.props.singleManifestFile) {
             // Combine all resources into a single manifest file
             const combinedYaml = enriched
-                .map((obj) => yaml_1.default.stringify(obj).trim())
+                .map((obj) => YAML.stringify(obj).trim())
                 .filter(Boolean)
                 .join('\n---\n');
             this.assets.length = 0;
@@ -937,7 +1115,7 @@ class Rutter {
             // Create separate files for each resource (default behavior)
             this.assets.length = 0;
             enriched.forEach((obj, _index) => {
-                const yaml = yaml_1.default.stringify(obj).trim();
+                const yaml = YAML.stringify(obj).trim();
                 if (yaml) {
                     const resourceName = this.getResourceName(obj);
                     const manifestId = this.props.manifestName
@@ -994,11 +1172,12 @@ class Rutter {
             ...(this.props.notesTpl !== undefined ? { notesTpl: this.props.notesTpl } : {}),
             ...(this.props.valuesSchema !== undefined ? { valuesSchema: this.props.valuesSchema } : {}),
         };
-        HelmChartWriter_1.HelmChartWriter.write(options);
+        HelmChartWriter.write(options);
     }
 }
-exports.Rutter = Rutter;
 Rutter.LABEL_NAME = 'app.kubernetes.io/name';
 Rutter.LABEL_INSTANCE = 'app.kubernetes.io/instance';
 Rutter.HELPER_NAME = 'timonel.name';
+Rutter.NETWORKING_API_VERSION = 'networking.k8s.io/v1';
+Rutter.EMPTY_POD_SELECTOR = {};
 //# sourceMappingURL=Rutter.js.map