timonel 2.1.1 → 2.2.0

package/dist/lib/Rutter.js

@@ -1055,6 +1055,257 @@ export class Rutter {
         this.capture(spc, `${spec.name}-secretproviderclass`);
         return spc;
     }
+    /**
+     * Add Azure Workload Identity ServiceAccount.
+     * Creates a ServiceAccount with Azure Workload Identity annotations for secure authentication.
+     *
+     * @param spec - Azure Workload Identity ServiceAccount specification
+     * @returns The created ServiceAccount ApiObject
+     *
+     * @example
+     * ```typescript
+     * rutter.addAzureWorkloadIdentityServiceAccount({
+     *   name: 'workload-identity-sa',
+     *   clientId: '12345678-1234-1234-1234-123456789012',
+     *   tenantId: '87654321-4321-4321-4321-210987654321',
+     *   tokenExpiration: 3600
+     * });
+     * ```
+     */
+    addAzureWorkloadIdentityServiceAccount(spec) {
+        // Validate all inputs first for security
+        if (spec.tokenExpiration !== undefined &&
+            (spec.tokenExpiration < 3600 || spec.tokenExpiration > 86400)) {
+            throw new Error(`Azure Workload Identity ${spec.name}: tokenExpiration must be between 3600 and 86400 seconds`);
+        }
+        if (!spec.clientId?.match(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)) {
+            throw new Error(`Azure Workload Identity ${spec.name}: Invalid client ID format`);
+        }
+        if (!spec.tenantId?.match(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)) {
+            throw new Error(`Azure Workload Identity ${spec.name}: Invalid tenant ID format`);
+        }
+        const annotations = {
+            'azure.workload.identity/client-id': spec.clientId,
+            'azure.workload.identity/tenant-id': spec.tenantId,
+            ...(spec.tokenExpiration !== undefined
+                ? {
+                    'azure.workload.identity/service-account-token-expiration': String(spec.tokenExpiration),
+                }
+                : {}),
+            ...(spec.annotations ?? {}),
+        };
+        const sa = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'v1',
+            kind: 'ServiceAccount',
+            metadata: {
+                name: spec.name,
+                annotations,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+            },
+            automountServiceAccountToken: spec.automountServiceAccountToken,
+            imagePullSecrets: spec.imagePullSecrets?.map((n) => ({ name: n })),
+            secrets: spec.secrets?.map((n) => ({ name: n })),
+        });
+        this.capture(sa, `${spec.name}-serviceaccount`);
+        return sa;
+    }
+    /**
+     * Add Azure Key Vault SecretProviderClass.
+     * Creates a SecretProviderClass for mounting secrets from Azure Key Vault using CSI driver.
+     *
+     * @param spec - Azure Key Vault SecretProviderClass specification
+     * @returns The created SecretProviderClass ApiObject
+     *
+     * @example
+     * ```typescript
+     * rutter.addAzureKeyVaultSecretProviderClass({
+     *   name: 'app-secrets',
+     *   keyVaultName: 'my-keyvault',
+     *   tenantId: '87654321-4321-4321-4321-210987654321',
+     *   objects: [
+     *     { objectName: 'database-password', objectType: 'secret' },
+     *     { objectName: 'api-key', objectType: 'secret', objectAlias: 'API_KEY' }
+     *   ],
+     *   userAssignedIdentityID: '12345678-1234-1234-1234-123456789012'
+     * });
+     * ```
+     */
+    addAzureKeyVaultSecretProviderClass(spec) {
+        // Validate object names for security - prevent path traversal attacks
+        spec.objects.forEach((obj) => {
+            if (obj.objectName.includes('../') || obj.objectName.includes('..\\')) {
+                throw new Error(`Azure Key Vault ${spec.name}: Object name '${obj.objectName}' contains invalid path traversal sequences`);
+            }
+        });
+        const objects = spec.objects.map((obj) => {
+            const baseObj = {
+                objectName: obj.objectName,
+                objectType: obj.objectType,
+            };
+            if (obj.objectAlias) {
+                baseObj['objectAlias'] = obj.objectAlias;
+            }
+            if (obj.objectVersion) {
+                baseObj['objectVersion'] = obj.objectVersion;
+            }
+            return baseObj;
+        });
+        const objectsYaml = YAML.stringify(objects, { indent: 2 }).trim();
+        const parameters = {
+            keyvaultName: spec.keyVaultName,
+            tenantId: spec.tenantId,
+            objects: `|\n  ${objectsYaml.split('\n').join('\n  ')}`,
+        };
+        if (spec.userAssignedIdentityID) {
+            parameters['userAssignedIdentityID'] = spec.userAssignedIdentityID;
+        }
+        if (spec.cloudName) {
+            parameters['cloudName'] = spec.cloudName;
+        }
+        const spc = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'secrets-store.csi.x-k8s.io/v1',
+            kind: 'SecretProviderClass',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                provider: 'azure',
+                parameters,
+            },
+        });
+        this.capture(spc, `${spec.name}-secretproviderclass`);
+        return spc;
+    }
+    /**
+     * Add Azure Files StorageClass.
+     * Creates a StorageClass for dynamic provisioning of Azure Files volumes.
+     *
+     * @param spec - Azure Files StorageClass specification
+     * @returns The created StorageClass ApiObject
+     *
+     * @example
+     * ```typescript
+     * rutter.addAzureFilesStorageClass({
+     *   name: 'azure-files-premium',
+     *   skuName: 'Premium_LRS',
+     *   protocol: 'smb',
+     *   allowSharedAccess: true
+     * });
+     * ```
+     */
+    addAzureFilesStorageClass(spec) {
+        // Validate Azure Files parameters for security and compliance
+        this.validateAzureFilesParameters(spec);
+        const parameters = this.buildAzureFilesParameters(spec);
+        const sc = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.STORAGE_API_VERSION,
+            kind: 'StorageClass',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            provisioner: Rutter.AZURE_FILES_CSI_DRIVER,
+            parameters,
+            reclaimPolicy: spec.reclaimPolicy ?? 'Delete',
+            allowVolumeExpansion: spec.allowVolumeExpansion ?? true,
+            volumeBindingMode: spec.volumeBindingMode ?? 'Immediate',
+            ...(spec.mountOptions ? { mountOptions: spec.mountOptions } : {}),
+        });
+        this.capture(sc, `${spec.name}-storageclass`);
+        return sc;
+    }
+    /**
+     * Add Azure Files PersistentVolume.
+     * Creates a PersistentVolume for static Azure Files volume provisioning.
+     *
+     * @param spec - Azure Files PersistentVolume specification
+     * @returns The created PersistentVolume ApiObject
+     */
+    addAzureFilesPersistentVolume(spec) {
+        const csiSpec = this.buildAzureFilesPVCSISpec(spec);
+        const pv = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'v1',
+            kind: 'PersistentVolume',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                capacity: { storage: spec.capacity },
+                accessModes: spec.accessModes ?? ['ReadWriteMany'],
+                persistentVolumeReclaimPolicy: spec.reclaimPolicy ?? 'Retain',
+                storageClassName: spec.storageClassName,
+                ...(spec.mountOptions ? { mountOptions: spec.mountOptions } : {}),
+                csi: csiSpec,
+            },
+        });
+        this.capture(pv, `${spec.name}-pv`);
+        return pv;
+    }
+    /**
+     * Add Azure Files PersistentVolumeClaim.
+     * Creates a PersistentVolumeClaim for Azure Files storage.
+     *
+     * @param spec - Azure Files PersistentVolumeClaim specification
+     * @returns The created PersistentVolumeClaim ApiObject
+     */
+    addAzureFilesPersistentVolumeClaim(spec) {
+        const pvc = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                accessModes: spec.accessModes ?? ['ReadWriteMany'],
+                storageClassName: spec.storageClassName,
+                resources: {
+                    requests: { storage: spec.size },
+                },
+            },
+        });
+        this.capture(pvc, `${spec.name}-pvc`);
+        return pvc;
+    }
+    /**
+     * Add Azure Container Registry ServiceAccount.
+     * Creates a ServiceAccount configured for ACR access.
+     *
+     * @param spec - Azure ACR ServiceAccount specification
+     * @returns The created ServiceAccount ApiObject
+     */
+    addAzureACRServiceAccount(spec) {
+        const annotations = {
+            ...(spec.annotations ?? {}),
+        };
+        // Add Workload Identity annotations if provided
+        if (spec.clientId) {
+            annotations['azure.workload.identity/client-id'] = spec.clientId;
+        }
+        if (spec.tenantId) {
+            annotations['azure.workload.identity/tenant-id'] = spec.tenantId;
+        }
+        const sa = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'v1',
+            kind: 'ServiceAccount',
+            metadata: {
+                name: spec.name,
+                ...(Object.keys(annotations).length ? { annotations } : {}),
+                ...(spec.labels ? { labels: spec.labels } : {}),
+            },
+            automountServiceAccountToken: spec.automountServiceAccountToken,
+            imagePullSecrets: spec.imagePullSecrets?.map((n) => ({ name: n })),
+            secrets: spec.secrets?.map((n) => ({ name: n })),
+        });
+        this.capture(sa, `${spec.name}-serviceaccount`);
+        return sa;
+    }
     addAzureDiskStorageClass(spec) {
         // Validate numeric parameters to prevent runtime errors
         this.validateAzureDiskNumericParameters(spec);
@@ -1435,6 +1686,76 @@ export class Rutter {
             throw new Error('Port 443 requires an SSL certificate to be specified');
         }
     }
+    buildAzureFilesParameters(spec) {
+        const parameters = {
+            skuName: spec.skuName ?? 'Standard_LRS',
+        };
+        if (spec.protocol) {
+            parameters['protocol'] = spec.protocol;
+        }
+        if (spec.allowSharedAccess !== undefined) {
+            parameters['allowSharedAccess'] = String(spec.allowSharedAccess);
+        }
+        if (spec.resourceGroup) {
+            parameters['resourceGroup'] = spec.resourceGroup;
+        }
+        if (spec.storageAccount) {
+            parameters['storageAccount'] = spec.storageAccount;
+        }
+        if (spec.location) {
+            parameters['location'] = spec.location;
+        }
+        if (spec.networkEndpointType) {
+            parameters['networkEndpointType'] = spec.networkEndpointType;
+        }
+        // NFS-specific parameters
+        if (spec.protocol === 'nfs' && spec.mountPermissions) {
+            parameters['mountPermissions'] = spec.mountPermissions;
+        }
+        if (spec.protocol === 'nfs' && spec.rootSquashType) {
+            parameters['rootSquashType'] = spec.rootSquashType;
+        }
+        return parameters;
+    }
+    buildAzureFilesPVCSISpec(spec) {
+        // Validate protocol and secret configuration
+        if (spec.protocol === 'nfs' && spec.secretName) {
+            throw new Error(`Azure Files PV ${spec.name}: NFS protocol does not use secrets for authentication`);
+        }
+        const volumeHandle = this.sanitizeVolumeHandle(spec.storageAccount, spec.shareName);
+        const volumeAttributes = {
+            storageAccount: spec.storageAccount,
+            shareName: spec.shareName,
+        };
+        if (spec.resourceGroup) {
+            volumeAttributes['resourceGroup'] = spec.resourceGroup;
+        }
+        if (spec.protocol) {
+            volumeAttributes['protocol'] = spec.protocol;
+        }
+        if (spec.server) {
+            volumeAttributes['server'] = spec.server;
+        }
+        if (spec.folderName) {
+            volumeAttributes['folderName'] = spec.folderName;
+        }
+        if (spec.mountPermissions) {
+            volumeAttributes['mountPermissions'] = spec.mountPermissions;
+        }
+        const csiSpec = {
+            driver: Rutter.AZURE_FILES_CSI_DRIVER,
+            volumeHandle,
+            volumeAttributes,
+        };
+        // Add secret reference for SMB protocol
+        if (spec.protocol !== 'nfs' && spec.secretName) {
+            csiSpec['nodeStageSecretRef'] = {
+                name: spec.secretName,
+                namespace: spec.secretNamespace ?? 'default',
+            };
+        }
+        return csiSpec;
+    }
     buildPodEnvironment(spec) {
         const envEntries = spec.env
             ? Object.entries(spec.env).map(([name, value]) => this.sanitizeEnvVar(name, value))
@@ -1641,6 +1962,37 @@ export class Rutter {
             },
         };
     }
+    /**
+     * Validate Azure Files parameters for security and compliance
+     */
+    validateAzureFilesParameters(spec) {
+        const validSkuNames = [
+            'Standard_LRS',
+            'Standard_GRS',
+            'Standard_RAGRS',
+            'Standard_ZRS',
+            'Premium_LRS',
+            'Premium_ZRS',
+        ];
+        if (spec.skuName && !validSkuNames.includes(spec.skuName)) {
+            throw new Error(`Invalid skuName: ${spec.skuName}. Must be one of: ${validSkuNames.join(', ')}`);
+        }
+        if (spec.protocol === 'nfs' && spec.mountPermissions) {
+            const permRegex = /^[0-7]{3,4}$/;
+            if (!permRegex.test(spec.mountPermissions)) {
+                throw new Error('mountPermissions must be a valid octal permission string (e.g., "0777")');
+            }
+        }
+    }
+    /**
+     * Sanitize volume handle to ensure valid format for CSI driver
+     */
+    sanitizeVolumeHandle(account, share) {
+        // Remove special characters and ensure valid format
+        const sanitizedAccount = account.replace(/[^a-z0-9]/gi, '').toLowerCase();
+        const sanitizedShare = share.replace(/[^a-z0-9-]/gi, '').toLowerCase();
+        return `${sanitizedAccount}#${sanitizedShare}`;
+    }
     /**
      * Capture the YAML of an ApiObject or Construct into assets.
      */
@@ -1781,5 +2133,6 @@ Rutter.NETWORKING_API_VERSION = 'networking.k8s.io/v1';
 Rutter.STORAGE_API_VERSION = 'storage.k8s.io/v1';
 Rutter.AZURE_DISK_CSI_DRIVER = 'disk.csi.azure.com';
 Rutter.AZURE_DISK_PROVISIONER_ANNOTATION = 'volume.beta.kubernetes.io/storage-provisioner';
+Rutter.AZURE_FILES_CSI_DRIVER = 'file.csi.azure.com';
 Rutter.EMPTY_POD_SELECTOR = {};
 //# sourceMappingURL=Rutter.js.map