79 lines
2.2 KiB
TypeScript
79 lines
2.2 KiB
TypeScript
import { Construct } from "constructs";
|
|
import { IngressRoute, IngressRouteOptions } from "./ingress";
|
|
import { DataTerraformRemoteStateS3 } from "cdktf";
|
|
import { DataKubernetesNamespaceV1 } from "@cdktf/provider-kubernetes/lib/data-kubernetes-namespace-v1";
|
|
import { PrivateCertificate } from "../../cert-manager";
|
|
|
|
type InternalIngressRouteOptions = Omit<
|
|
IngressRouteOptions,
|
|
"entryPoints" | "tlsSecretName" | "middlewares"
|
|
>;
|
|
|
|
export class InternalIngressRoute extends Construct {
|
|
constructor(scope: Construct, id: string, opts: InternalIngressRouteOptions) {
|
|
super(scope, id);
|
|
|
|
const r2Endpoint = `${process.env.ACCOUNT_ID!}.r2.cloudflarestorage.com`;
|
|
|
|
const coreServicesState = new DataTerraformRemoteStateS3(
|
|
this,
|
|
"core-services-state",
|
|
{
|
|
usePathStyle: true,
|
|
skipRegionValidation: true,
|
|
skipCredentialsValidation: true,
|
|
skipRequestingAccountId: true,
|
|
skipS3Checksum: true,
|
|
encrypt: true,
|
|
bucket: "terraform-state",
|
|
key: "core-services/terraform.tfstate",
|
|
endpoints: {
|
|
s3: `https://${r2Endpoint}`,
|
|
},
|
|
region: "auto",
|
|
accessKey: process.env.ACCESS_KEY,
|
|
secretKey: process.env.SECRET_KEY,
|
|
},
|
|
);
|
|
const namespaceName = coreServicesState.getString("namespace-output");
|
|
const namespaceResource = new DataKubernetesNamespaceV1(
|
|
this,
|
|
"core-services-namespace",
|
|
{
|
|
provider: opts.provider,
|
|
metadata: {
|
|
name: namespaceName,
|
|
},
|
|
},
|
|
);
|
|
const namespace = namespaceResource.metadata.name;
|
|
|
|
const { provider, name, host, serviceName, servicePort, serviceProtocol } =
|
|
opts;
|
|
|
|
const tlsSecretName = `${name}-tls`;
|
|
|
|
new PrivateCertificate(this, `${name}-cert`, {
|
|
provider,
|
|
namespace,
|
|
name: host,
|
|
secretName: tlsSecretName,
|
|
dnsNames: [host],
|
|
});
|
|
|
|
new IngressRoute(this, opts.name, {
|
|
provider,
|
|
namespace,
|
|
host,
|
|
serviceName,
|
|
servicePort,
|
|
serviceProtocol,
|
|
tlsSecretName,
|
|
name,
|
|
path: opts.path ?? "/",
|
|
entryPoints: ["websecure"],
|
|
middlewares: [`${namespace}/ip-allow-list`],
|
|
});
|
|
}
|
|
}
|