feat: NetworkSecurity | add traefik middleware and valkey

network-security/traefik/index.ts

@@ -0,0 +1,2 @@
+export { RateLimitMiddleware } from "./rateLimit";
+export { IpAllowListMiddleware, IpAllowListMiddlewareTCP } from "./ipAllowList";

network-security/traefik/ipAllowList.ts

@@ -0,0 +1,64 @@
+import { Construct } from "constructs";
+import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
+import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
+
+type IpAllowListMiddlewareOptions = {
+  provider: KubernetesProvider;
+  namespace: string;
+  name: string;
+  sourceRanges: string[];
+};
+
+export class IpAllowListMiddleware extends Construct {
+  constructor(
+    scope: Construct,
+    id: string,
+    opts: IpAllowListMiddlewareOptions,
+  ) {
+    super(scope, id);
+
+    new Manifest(this, opts.name, {
+      provider: opts.provider,
+      manifest: {
+        apiVersion: "traefik.io/v1alpha1",
+        kind: "Middleware",
+        metadata: {
+          name: opts.name,
+          namespace: opts.namespace,
+        },
+        spec: {
+          ipAllowList: {
+            sourceRange: opts.sourceRanges,
+          },
+        },
+      },
+    });
+  }
+}
+
+export class IpAllowListMiddlewareTCP extends Construct {
+  constructor(
+    scope: Construct,
+    id: string,
+    opts: IpAllowListMiddlewareOptions,
+  ) {
+    super(scope, id);
+
+    new Manifest(this, opts.name, {
+      provider: opts.provider,
+      manifest: {
+        apiVersion: "traefik.io/v1alpha1",
+        kind: "MiddlewareTCP",
+        metadata: {
+          name: opts.name,
+          namespace: opts.namespace,
+        },
+        spec: {
+          ipAllowList: {
+            sourceRange: opts.sourceRanges,
+          },
+        },
+      },
+    });
+  }
+}

network-security/traefik/rateLimit.ts

@@ -0,0 +1,51 @@
+import { Construct } from "constructs";
+import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
+import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
+
+type RateLimitMiddlewareOptions = {
+  provider: KubernetesProvider;
+  namespace: string;
+  name: string;
+
+  average?: number; // default 10
+  burst?: number; // default 50
+  period?: string; // default "1s"
+};
+
+export class RateLimitMiddleware extends Construct {
+  public readonly ref: string;
+
+  constructor(scope: Construct, id: string, opts: RateLimitMiddlewareOptions) {
+    super(scope, id);
+
+    const average = opts.average ?? 10;
+    const burst = opts.burst ?? 50;
+    const period = opts.period ?? "1s";
+
+    this.ref = `${opts.namespace}/${opts.name}`;
+
+    new Manifest(this, opts.name, {
+      provider: opts.provider,
+      manifest: {
+        apiVersion: "traefik.io/v1alpha1",
+        kind: "Middleware",
+        metadata: {
+          name: opts.name,
+          namespace: opts.namespace,
+        },
+        spec: {
+          rateLimit: {
+            average,
+            burst,
+            period,
+            redis: {
+              endpoints: [`valkey.${opts.namespace}.svc.cluster.local:6379`],
+              secret: "valkey",
+              db: 5,
+            },
+          },
+        },
+      },
+    });
+  }
+}