Extend DevX by creating a firewall transformer for AKS #104
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,4 @@ | ||
| builders.cue | ||
| stack.cue | ||
| test.stack.cue | ||
| test.builder.cue |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,173 @@ | ||
| { | ||
| "data": { | ||
| "azurerm_kubernetes_service_versions": { | ||
| "demo": { | ||
| "version_prefix": "1.28.", | ||
| "location": "East US" | ||
| } | ||
| } | ||
| }, | ||
| "provider": { | ||
| "azurerm": { | ||
| "features": {} | ||
| } | ||
| }, | ||
| "terraform": { | ||
| "required_providers": { | ||
| "azurerm": { | ||
| "source": "hashicorp/azurerm", | ||
| "version": "3.106.1" | ||
| } | ||
| } | ||
| }, | ||
| "resource": { | ||
| "azurerm_resource_group": { | ||
| "demo-resource-group": { | ||
| "name": "resource", | ||
| "location": "East US" | ||
| } | ||
| }, | ||
| "azurerm_kubernetes_cluster": { | ||
| "demo": { | ||
| "name": "demo", | ||
| "location": "East US", | ||
| "resource_group_name": "${azurerm_resource_group.demo-resource-group.name}", | ||
| "kubernetes_version": "${data.azurerm_kubernetes_service_versions.demo.latest_version}", | ||
| "identity": { | ||
| "type": "SystemAssigned" | ||
| }, | ||
| "dns_prefix": "demo", | ||
| "default_node_pool": { | ||
| "name": "workerpool1", | ||
| "vm_size": "Standard_D8s_v3", | ||
| "orchestrator_version": "${data.azurerm_kubernetes_service_versions.demo.latest_version}", | ||
| "enable_auto_scaling": true, | ||
| "tags": { | ||
| "name": "workerpool1", | ||
| "source": "terraform" | ||
| }, | ||
| "min_count": 3, | ||
| "temporary_name_for_rotation": "temppool1", | ||
| "max_count": 8 | ||
| } | ||
| } | ||
| }, | ||
| "azurerm_subnet": { | ||
| "demo_aks_subnet": { | ||
| "name": "demo-aks-subnet", | ||
| "resource_group_name": "resource", | ||
| "virtual_network_name": "AKS-FW-Vnet", | ||
| "address_prefixes": [ | ||
| "10.0.1.0/24" | ||
| ] | ||
| }, | ||
| "demo_firewall_subnet": { | ||
| "name": "AzureFirewallSubnet", | ||
| "resource_group_name": "resource", | ||
| "virtual_network_name": "AKS-FW-Vnet", | ||
| "address_prefixes": [ | ||
| "10.0.2.0/24" | ||
| ] | ||
| } | ||
| }, | ||
| "azurerm_public_ip": { | ||
| "demo_firewall_public_ip": { | ||
| "name": "demo-firewall-public-ip", | ||
| "location": "East US", | ||
| "resource_group_name": "resource", | ||
| "allocation_method": "Static", | ||
| "sku": "Standard" | ||
| } | ||
| }, | ||
| "azurerm_firewall": { | ||
| "demo_firewall": { | ||
| "name": "demo-firewall", | ||
| "location": "East US", | ||
| "resource_group_name": "resource", | ||
| "sku_name": "AZFW_VNet", | ||
| "sku_tier": "Standard", | ||
| "ip_configuration": { | ||
| "name": "firewall-ip-config", | ||
| "public_ip_address_id": "azurerm_public_ip.demo_firewall_public_ip.id", | ||
| "subnet_id": "azurerm_subnet.demo_firewall_subnet.id" | ||
| } | ||
| } | ||
| }, | ||
| "azurerm_firewall_policy": { | ||
| "demo_firewall_policy": { | ||
| "name": "demo-firewall-policy", | ||
| "resource_group_name": "resource", | ||
| "location": "East US" | ||
| } | ||
| }, | ||
| "azurerm_firewall_policy_rule_collection_group": { | ||
| "demo_firewall_rule_collection": { | ||
| "name": "demo-firewall-rule-collection", | ||
| "firewall_policy_id": "azurerm_firewall_policy.demo_firewall_policy.id", | ||
| "priority": 100, | ||
| "network_rule_collection": { | ||
| "name": "fwtesting", | ||
| "priority": 100, | ||
| "action": "Allow", | ||
| "rule": { | ||
| "name": "fwtesting", | ||
| "description": "", | ||
| "source_addresses": [ | ||
| "*" | ||
| ], | ||
| "destination_addresses": [ | ||
| "*" | ||
| ], | ||
| "destination_ports": [ | ||
| 8080, | ||
| 9090 | ||
| ], | ||
| "protocols": [ | ||
| "UDP", | ||
| "TCP" | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "azurerm_route_table": { | ||
| "demo_aks_route_table": { | ||
| "name": "demo-aks-route-table", | ||
| "location": "East US", | ||
| "resource_group_name": "resource" | ||
| } | ||
| }, | ||
| "data": { | ||
| "azurerm_subnet": { | ||
| "demo_aks_subnet": { | ||
| "name": "demo-aks-subnet", | ||
| "resource_group_name": "resource" | ||
| } | ||
| }, | ||
| "azurerm_route_table": { | ||
| "demo_aks_route_table": { | ||
| "name": "demo-aks-route-table", | ||
| "resource_group_name": "resource" | ||
| } | ||
| } | ||
| }, | ||
| "azurerm_subnet_route_table_association": { | ||
| "demo_aks_route_table_assoc": { | ||
| "subnet_id": "${data.azurerm_subnet.demo_aks_subnet.id}", | ||
| "route_table_id": "${data.azurerm_route_table.demo_aks_route_table.id}" | ||
| } | ||
| }, | ||
| "azurerm_route": { | ||
| "demo_route_through_firewall": { | ||
| "name": "demo_firewall-route", | ||
| "address_prefix": [ | ||
| "0.0.0.0" | ||
| ], | ||
| "next_hop_type": "VirtualAppliance", | ||
| "next_hop_in_ip_address": "azurerm_firewall.demo_firewall.ip_configuration[0].private_ip_address", | ||
| "route_table_name": "${data.azurerm_route_table.demo_aks_route_table.name}", | ||
| "resource_group_name": "resource" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,144 @@ | ||
| package azure | ||
|
|
||
| import ( | ||
| "net" | ||
| "stakpak.dev/devx/v1" | ||
| "stakpak.dev/devx/v1/traits" | ||
| schema "stakpak.dev/devx/v1/transformers/terraform" | ||
| helpers "stakpak.dev/devx/v1/transformers/terraform/azure/helpers" | ||
| ) | ||
|
|
||
| #AddAzureAKSFirewall: v1.#Transformer & { | ||
| // This transformer accepts traits or values. | ||
| // The #KubernetesCluster trait fetches cluster information such as the cluster name "\(k8s.name)" | ||
| traits.#KubernetesCluster | ||
|
|
||
| // Declare the `k8s` field. The value is left open (underscore `_`), | ||
| // and it will be specified later. | ||
| k8s: _ | ||
|
|
||
| // Define version constraints for the Kubernetes cluster. | ||
| k8s: version: { | ||
| major: 1 // Major version must be 1. | ||
| minor: <=29 & >=27 // Minor version must be between 27 and 29 (inclusive). | ||
| } | ||
|
|
||
| // Define Azure-related variables such as location, resource group, and virtual network name. | ||
| azure: { | ||
| location: helpers.#Location // Fetch the location using a helper transformer. | ||
| resourceGroupName: string // The name of the Azure resource group (provided as input). | ||
| // vnetName: string // The name of the Azure virtual network (provided as input). | ||
| addressFirewall: [... string & net.IPCIDR] | ||
| ... // added three dots to firwall transformer to which allow fields not defined | ||
| addressSourceFW: [...net.IP] // Add Source Ips for Firewall | ||
| } | ||
|
|
||
| // Define firewall policy structure (removing the previously open field `policy: _`). | ||
| policy: { | ||
| priority: uint // Priority for the firewall policy (unsigned integer). | ||
| collection: { | ||
| priority: uint // Priority for the rule collection. | ||
| name: string // Name of the rule collection (string). | ||
| action: "Allow" | "Deny" // Action: Either "Allow" or "Deny". | ||
| } | ||
| rule: { | ||
| name: string // Name of the rule (string). | ||
| description: string | *"" // Optional description with a default value of an empty string. | ||
| source_addresses: [...net.IP] | ["*"] // List of source IPs or wildcard "*" for all IPs. | ||
| destination_addresses: [...net.IP] | ["*"] // List of destination IPs or wildcard "*". | ||
| destination_ports: [...uint] // List of destination ports (unsigned integers). | ||
| protocols: ["UDP", "TCP"] // Protocols allowed: UDP and TCP. | ||
| } | ||
| } | ||
|
|
||
|
|
||
| // Define the resources section, which generates the necessary Terraform resources. | ||
| $resources: terraform: schema.#Terraform & { | ||
| resource: { | ||
| // Define the Azure subnet for the firewall. | ||
| azurerm_subnet: "\(k8s.name)_firewall_subnet": { | ||
| name: "AzureFirewallSubnet" // Name of the subnet. | ||
| resource_group_name: azure.resourceGroupName // Resource group name for the subnet. | ||
| virtual_network_name: azure.vnetName // Virtual network name where the subnet resides. | ||
| address_prefixes: azure.addressFirewall // CIDR block for the subnet. | ||
| } | ||
|
|
||
| // Define the public IP address resource for the firewall. | ||
| azurerm_public_ip: "\(k8s.name)_firewall_public_ip": { | ||
| name: "\(k8s.name)-firewall-public-ip" // Name of the public IP. | ||
| location: azure.location // Location (from input). | ||
| resource_group_name: azure.resourceGroupName // Resource group name for the public IP. | ||
| allocation_method: "Static" // Static IP allocation method. | ||
| sku: "Standard" // IP SKU (Standard tier). | ||
| } | ||
|
|
||
| // Define the Azure firewall resource. | ||
| azurerm_firewall: "\(k8s.name)_firewall": { | ||
| name: "\(k8s.name)-firewall" // Name of the firewall. | ||
| location: azure.location // Location (from input). | ||
| resource_group_name: azure.resourceGroupName // Resource group name for the firewall. | ||
| sku_name: "AZFW_VNet" // Firewall SKU name (Virtual Network SKU). | ||
| sku_tier: "Standard" // Firewall SKU tier (Standard tier). | ||
| ip_configuration: { | ||
| name: "firewall-ip-config" // IP configuration name. | ||
| public_ip_address_id: "azurerm_public_ip.\(k8s.name)_firewall_public_ip.id" // Reference to public IP. | ||
| subnet_id: "azurerm_subnet.\(k8s.name)_firewall_subnet.id" // Reference to subnet. | ||
| } | ||
| } | ||
|
|
||
| // Define the Azure firewall policy resource. | ||
| azurerm_firewall_policy: "\(k8s.name)_firewall_policy": { | ||
| name: "\(k8s.name)-firewall-policy" // Name of the firewall policy. | ||
| resource_group_name: azure.resourceGroupName // Resource group name for the firewall policy. | ||
| location: azure.location // Location (from input). | ||
| } | ||
|
|
||
| // Define the Azure firewall policy rule collection group. | ||
| azurerm_firewall_policy_rule_collection_group: "\(k8s.name)_firewall_rule_collection": { | ||
| name: "\(k8s.name)-firewall-rule-collection" // Name of the rule collection group. | ||
| firewall_policy_id: "azurerm_firewall_policy.\(k8s.name)_firewall_policy.id" // Reference to firewall policy. | ||
| priority: policy.priority // Priority for the rule collection group. | ||
| network_rule_collection: { | ||
| name: policy.collection.name // Name of the network rule collection. | ||
| priority: policy.collection.priority // Priority of the network rule collection. | ||
| action: policy.collection.action // Action for the rule collection ("Allow" or "Deny"). | ||
|
|
||
| // Define individual rules for the firewall network rule collection. | ||
| rule: { | ||
| name: policy.rule.name // Name of the rule. | ||
| description: policy.rule.description // Description of the rule. | ||
| source_addresses: policy.rule.source_addresses // Source addresses for the rule. | ||
| destination_addresses: policy.rule.destination_addresses // Destination addresses for the rule. | ||
| destination_ports: policy.rule.destination_ports // Destination ports for the rule. | ||
| protocols: policy.rule.protocols // Allowed protocols for the rule (TCP, UDP). | ||
| } | ||
| } | ||
| } | ||
| // | ||
| data: azurerm_subnet: "\(k8s.name)_aks_subnet": { | ||
| name : "\(k8s.name)-aks-subnet" | ||
| resource_group_name : azure.resourceGroupName | ||
| } | ||
| data: azurerm_route_table: "\(k8s.name)_aks_route_table": { | ||
| name : "\(k8s.name)-aks-route-table" | ||
| resource_group_name : azure.resourceGroupName | ||
| } | ||
| // Associate Route Table with AKS Subnet | ||
| azurerm_subnet_route_table_association: "\(k8s.name)_aks_route_table_assoc": { | ||
| subnet_id : "${data.azurerm_subnet.\(k8s.name)_aks_subnet.id}" // Correct reference to the AKS subnet | ||
| route_table_id : "${data.azurerm_route_table.\(k8s.name)_aks_route_table.id}" // Correct reference to the AKS route table | ||
| } | ||
| // Route through Azure Firewall | ||
| azurerm_route: "\(k8s.name)_route_through_firewall": { | ||
| name : "\(k8s.name)_firewall-route" | ||
| // address_prefix : "0.0.0.0/0" | ||
| address_prefix : azure.addressSourceFW | ||
| next_hop_type : "VirtualAppliance" | ||
| next_hop_in_ip_address : "azurerm_firewall.\(k8s.name)_firewall.ip_configuration[0].private_ip_address" | ||
| route_table_name : "${data.azurerm_route_table.\(k8s.name)_aks_route_table.name}" | ||
| resource_group_name : azure.resourceGroupName | ||
| } | ||
|
|
||
| } | ||
| } | ||
| } |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please delete the generated file from the PR