typekro 0.33.9 → 0.34.0

package/dist/factories/traefik/resources/tls.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Traefik TLS resources: `TLSOption` and `TLSStore`.
+ *
+ * The intended cert-manager wiring is:
+ *
+ * 1. A cert-manager `Certificate` (`src/factories/cert-manager`) issues a
+ *    certificate into a Secret in Traefik's namespace.
+ * 2. A `TLSStore` named `default` points `defaultCertificate.secretName` at
+ *    that Secret, so any HTTPS request whose SNI matches no router
+ *    certificate is still served a valid certificate.
+ * 3. Individual `IngressRoute`s reference the same Secret through
+ *    `tls.secretName`, and reference the hardened `TLSOption` through
+ *    `tls.options`.
+ *
+ * `TLSStore`/`TLSOption` named `default` are cluster-wide singletons in
+ * Traefik. Only one namespace should own them; chart 41.5.0 can restrict which
+ * namespace that is via `providers.kubernetesCRD.defaultTLSResourcesNamespace`.
+ */
+import type { Composable, Enhanced } from '../../../core/types/index.js';
+import type { TraefikTLSOptionSpec, TraefikTLSStoreSpec } from '../types.js';
+import { type TraefikResourceConfig } from './common.js';
+import type { TraefikNoStatus } from './routing.js';
+/**
+ * Hardened `TLSOption` defaults applied by {@link traefikTLSOption} when the
+ * corresponding field is omitted.
+ *
+ * @security TLS 1.2 is the floor (TLS 1.0/1.1 are deprecated by RFC 8996), and
+ * `sniStrict` rejects handshakes that would otherwise fall back to Traefik's
+ * self-signed default certificate — a fallback that turns a certificate
+ * misconfiguration into a silently insecure connection.
+ */
+export declare const TRAEFIK_TLS_OPTION_SECURE_DEFAULTS: {
+    readonly minVersion: "VersionTLS12";
+    readonly sniStrict: true;
+};
+/**
+ * Create a Traefik `TLSOption`.
+ *
+ * Unspecified `minVersion` / `sniStrict` take the hardened values in
+ * {@link TRAEFIK_TLS_OPTION_SECURE_DEFAULTS}. Pass them explicitly to opt out.
+ *
+ * @example A cluster default with mutual TLS for internal callers
+ * ```typescript
+ * traefikTLSOption({
+ *   name: 'default',
+ *   namespace: 'traefik',
+ *   spec: {
+ *     minVersion: 'VersionTLS13',
+ *     clientAuth: {
+ *       clientAuthType: 'VerifyClientCertIfGiven',
+ *       secretNames: ['internal-ca'],
+ *     },
+ *   },
+ *   id: 'defaultTlsOption',
+ * });
+ * ```
+ */
+export declare function traefikTLSOption(config: Composable<TraefikResourceConfig<TraefikTLSOptionSpec>>): Enhanced<TraefikTLSOptionSpec, TraefikNoStatus>;
+/**
+ * Create a Traefik `TLSStore`.
+ *
+ * @example Default certificate supplied by a cert-manager `Certificate`
+ * ```typescript
+ * const certificate = certManager.certificate({
+ *   name: 'edge-wildcard',
+ *   namespace: 'traefik',
+ *   spec: {
+ *     secretName: 'edge-wildcard-tls',
+ *     dnsNames: ['*.example.com'],
+ *     issuerRef: { name: 'letsencrypt', kind: 'ClusterIssuer' },
+ *   },
+ *   id: 'edgeCertificate',
+ * });
+ *
+ * const store = traefikTLSStore({
+ *   name: 'default',
+ *   namespace: 'traefik',
+ *   spec: { defaultCertificate: { secretName: 'edge-wildcard-tls' } },
+ *   id: 'defaultTlsStore',
+ * });
+ * store.dependsOn(certificate);
+ * ```
+ */
+export declare function traefikTLSStore(config: Composable<TraefikResourceConfig<TraefikTLSStoreSpec>>): Enhanced<TraefikTLSStoreSpec, TraefikNoStatus>;
+//# sourceMappingURL=tls.d.ts.map

package/dist/factories/traefik/resources/tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.d.ts","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/tls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAGzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EACL,KAAK,qBAAqB,EAG3B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC;;;CAGrC,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,CAAC,GAC9D,QAAQ,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAUjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC,GAC7D,QAAQ,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAKhD"}

package/dist/factories/traefik/resources/tls.js

@@ -0,0 +1,93 @@
+/**
+ * Traefik TLS resources: `TLSOption` and `TLSStore`.
+ *
+ * The intended cert-manager wiring is:
+ *
+ * 1. A cert-manager `Certificate` (`src/factories/cert-manager`) issues a
+ *    certificate into a Secret in Traefik's namespace.
+ * 2. A `TLSStore` named `default` points `defaultCertificate.secretName` at
+ *    that Secret, so any HTTPS request whose SNI matches no router
+ *    certificate is still served a valid certificate.
+ * 3. Individual `IngressRoute`s reference the same Secret through
+ *    `tls.secretName`, and reference the hardened `TLSOption` through
+ *    `tls.options`.
+ *
+ * `TLSStore`/`TLSOption` named `default` are cluster-wide singletons in
+ * Traefik. Only one namespace should own them; chart 41.5.0 can restrict which
+ * namespace that is via `providers.kubernetesCRD.defaultTLSResourcesNamespace`.
+ */
+import { createResource } from '../../shared.js';
+import { TRAEFIK_API_VERSION } from '../constants.js';
+import { traefikResourceDefinition, traefikStatuslessReadinessEvaluator, } from './common.js';
+/**
+ * Hardened `TLSOption` defaults applied by {@link traefikTLSOption} when the
+ * corresponding field is omitted.
+ *
+ * @security TLS 1.2 is the floor (TLS 1.0/1.1 are deprecated by RFC 8996), and
+ * `sniStrict` rejects handshakes that would otherwise fall back to Traefik's
+ * self-signed default certificate — a fallback that turns a certificate
+ * misconfiguration into a silently insecure connection.
+ */
+export const TRAEFIK_TLS_OPTION_SECURE_DEFAULTS = {
+    minVersion: 'VersionTLS12',
+    sniStrict: true,
+};
+/**
+ * Create a Traefik `TLSOption`.
+ *
+ * Unspecified `minVersion` / `sniStrict` take the hardened values in
+ * {@link TRAEFIK_TLS_OPTION_SECURE_DEFAULTS}. Pass them explicitly to opt out.
+ *
+ * @example A cluster default with mutual TLS for internal callers
+ * ```typescript
+ * traefikTLSOption({
+ *   name: 'default',
+ *   namespace: 'traefik',
+ *   spec: {
+ *     minVersion: 'VersionTLS13',
+ *     clientAuth: {
+ *       clientAuthType: 'VerifyClientCertIfGiven',
+ *       secretNames: ['internal-ca'],
+ *     },
+ *   },
+ *   id: 'defaultTlsOption',
+ * });
+ * ```
+ */
+export function traefikTLSOption(config) {
+    const spec = {
+        ...config.spec,
+        minVersion: config.spec.minVersion ?? TRAEFIK_TLS_OPTION_SECURE_DEFAULTS.minVersion,
+        sniStrict: config.spec.sniStrict ?? TRAEFIK_TLS_OPTION_SECURE_DEFAULTS.sniStrict,
+    };
+    return createResource(traefikResourceDefinition(TRAEFIK_API_VERSION, 'TLSOption', { ...config, spec }), { scope: 'namespaced' }).withReadinessEvaluator(traefikStatuslessReadinessEvaluator('TLSOption'));
+}
+/**
+ * Create a Traefik `TLSStore`.
+ *
+ * @example Default certificate supplied by a cert-manager `Certificate`
+ * ```typescript
+ * const certificate = certManager.certificate({
+ *   name: 'edge-wildcard',
+ *   namespace: 'traefik',
+ *   spec: {
+ *     secretName: 'edge-wildcard-tls',
+ *     dnsNames: ['*.example.com'],
+ *     issuerRef: { name: 'letsencrypt', kind: 'ClusterIssuer' },
+ *   },
+ *   id: 'edgeCertificate',
+ * });
+ *
+ * const store = traefikTLSStore({
+ *   name: 'default',
+ *   namespace: 'traefik',
+ *   spec: { defaultCertificate: { secretName: 'edge-wildcard-tls' } },
+ *   id: 'defaultTlsStore',
+ * });
+ * store.dependsOn(certificate);
+ * ```
+ */
+export function traefikTLSStore(config) {
+    return createResource(traefikResourceDefinition(TRAEFIK_API_VERSION, 'TLSStore', config), { scope: 'namespaced' }).withReadinessEvaluator(traefikStatuslessReadinessEvaluator('TLSStore'));
+}
+//# sourceMappingURL=tls.js.map

package/dist/factories/traefik/resources/tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../../../src/factories/traefik/resources/tls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAEL,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,aAAa,CAAC;AAGrB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,IAAI;CACP,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA+D;IAE/D,MAAM,IAAI,GAAyB;QACjC,GAAI,MAAM,CAAC,IAA6B;QACxC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,kCAAkC,CAAC,UAAU;QACnF,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,kCAAkC,CAAC,SAAS;KACjF,CAAC;IACF,OAAO,cAAc,CACnB,yBAAyB,CAAC,mBAAmB,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,EAChF,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA8D;IAE9D,OAAO,cAAc,CACnB,yBAAyB,CAAC,mBAAmB,EAAE,UAAU,EAAE,MAAM,CAAC,EAClE,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC,sBAAsB,CAAC,mCAAmC,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5E,CAAC"}