Skip to content

Commit e1ddbeb

Browse files
rswansonrswanson
committed
fix: dry constants
1 parent 05a31ec commit e1ddbeb

File tree

9 files changed

+289
-109
lines changed

9 files changed

+289
-109
lines changed

‎pkg/aws/constants.go‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package aws
2+
3+
// IAM Policy version and effect constants
4+
const (
5+
// IAMPolicyVersion is the standard IAM policy language version
6+
IAMPolicyVersion = "2012-10-17"
7+
8+
// Policy effects
9+
EffectAllow = "Allow"
10+
EffectDeny = "Deny"
11+
)
12+
13+
// AWS Services
14+
const (
15+
// EKS pod identity service
16+
EKSPodsService = "pods.eks.amazonaws.com"
17+
// EC2 service
18+
EC2Service = "ec2.amazonaws.com"
19+
)
20+
21+
// STS Actions
22+
const (
23+
STSAssumeRoleAction = "sts:AssumeRole"
24+
STSTagSessionAction = "sts:TagSession"
25+
)
26+
27+
// KMS Actions
28+
const (
29+
KMSSignAction = "kms:Sign"
30+
KMSGetPublicKeyAction = "kms:GetPublicKey"
31+
)
32+
33+
// IAM statement identifiers
34+
const (
35+
EKSAssumeRoleStatementSid = "AllowEksAuthToAssumeRoleForPodIdentity"
36+
)
37+
38+
// Resource name suffixes
39+
const (
40+
RoleSuffix = "-role"
41+
PolicySuffix = "-policy"
42+
RolePolicyAttachmentSuffix = "-role-policy-attachment"
43+
)

‎pkg/aws/iam.go‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -56,22 +56,22 @@ func CreateIAMResources(
5656
) (*IAMResources, error) {
5757
// Create IAM role with assume role policy for EKS pod identity
5858
assumeRolePolicy := IAMPolicy{
59-
Version: "2012-10-17",
59+
Version: IAMPolicyVersion,
6060
Statement: []IAMStatement{
6161
{
62-
Sid: "AllowEksAuthToAssumeRoleForPodIdentity",
63-
Effect: "Allow",
62+
Sid: EKSAssumeRoleStatementSid,
63+
Effect: EffectAllow,
6464
Principal: struct {
6565
Service []string `json:"Service"`
6666
}{
6767
Service: []string{
68-
"pods.eks.amazonaws.com",
69-
"ec2.amazonaws.com",
68+
EKSPodsService,
69+
EC2Service,
7070
},
7171
},
7272
Action: []string{
73-
"sts:AssumeRole",
74-
"sts:TagSession",
73+
STSAssumeRoleAction,
74+
STSTagSessionAction,
7575
},
7676
},
7777
},
@@ -82,11 +82,11 @@ func CreateIAMResources(
8282
return nil, fmt.Errorf("failed to marshal assume role policy: %w", err)
8383
}
8484

85-
role, err := iam.NewRole(ctx, fmt.Sprintf("%s-role", name), &iam.RoleArgs{
85+
role, err := iam.NewRole(ctx, fmt.Sprintf("%s%s", name, RoleSuffix), &iam.RoleArgs{
8686
AssumeRolePolicy: pulumi.String(assumeRolePolicyJSON),
8787
Description: pulumi.String(fmt.Sprintf("Role for %s pod to assume", serviceName)),
8888
Tags: pulumi.StringMap{
89-
"Name": pulumi.String(fmt.Sprintf("%s-role", name)),
89+
"Name": pulumi.String(fmt.Sprintf("%s%s", name, RoleSuffix)),
9090
},
9191
}, pulumi.Parent(parent))
9292
if err != nil {
@@ -96,15 +96,15 @@ func CreateIAMResources(
9696
// Create KMS policy for the specified key
9797
policyJSON := CreateKMSPolicy(keyArn)
9898

99-
policy, err := iam.NewPolicy(ctx, fmt.Sprintf("%s-policy", name), &iam.PolicyArgs{
99+
policy, err := iam.NewPolicy(ctx, fmt.Sprintf("%s%s", name, PolicySuffix), &iam.PolicyArgs{
100100
Policy: policyJSON,
101101
}, pulumi.Parent(parent))
102102
if err != nil {
103103
return nil, fmt.Errorf("failed to create IAM policy: %w", err)
104104
}
105105

106106
// Attach the KMS policy to the role
107-
policyAttachment, err := iam.NewRolePolicyAttachment(ctx, fmt.Sprintf("%s-role-policy-attachment", name), &iam.RolePolicyAttachmentArgs{
107+
policyAttachment, err := iam.NewRolePolicyAttachment(ctx, fmt.Sprintf("%s%s", name, RolePolicyAttachmentSuffix), &iam.RolePolicyAttachmentArgs{
108108
Role: role.Name,
109109
PolicyArn: policy.Arn,
110110
}, pulumi.Parent(parent))
@@ -133,13 +133,13 @@ func CreateIAMResources(
133133
// - kms:GetPublicKey: Allows retrieving the public key associated with the KMS key
134134
func CreateKMSPolicy(key pulumi.StringInput) pulumi.StringOutput {
135135
policy := KMSPolicy{
136-
Version: "2012-10-17",
136+
Version: IAMPolicyVersion,
137137
Statement: []KMSStatement{
138138
{
139-
Effect: "Allow",
139+
Effect: EffectAllow,
140140
Action: []string{
141-
"kms:Sign",
142-
"kms:GetPublicKey",
141+
KMSSignAction,
142+
KMSGetPublicKeyAction,
143143
},
144144
Resource: key,
145145
},

‎pkg/builder/builder.go‎

Lines changed: 20 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package builder
33

44
import (
55
"fmt"
6-
"strconv"
76

87
"github.com/init4tech/signet-infra-components/pkg/utils"
98
crd "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/apiextensions"
@@ -15,14 +14,7 @@ import (
1514

1615
// parseBuilderPort converts a port string to an integer with a default fallback
1716
func parseBuilderPort(portStr pulumi.StringInput) pulumi.IntOutput {
18-
return pulumi.All(portStr).ApplyT(func(inputs []interface{}) int {
19-
portStr := inputs[0].(string)
20-
if port, err := strconv.Atoi(portStr); err == nil {
21-
return port
22-
}
23-
// Default to 8080 if there's an error parsing the port
24-
return 8080
25-
}).(pulumi.IntOutput)
17+
return utils.ParsePortWithDefault(portStr, DefaultBuilderPort)
2618
}
2719

2820
// NewBuilder creates a new builder component with the given configuration.
@@ -34,13 +26,13 @@ func NewBuilder(ctx *pulumi.Context, args BuilderComponentArgs, opts ...pulumi.R
3426
component := &BuilderComponent{
3527
BuilderComponentArgs: args,
3628
}
37-
err := ctx.RegisterComponentResource("signet:index:Builder", args.Name, component)
29+
err := ctx.RegisterComponentResource(ComponentKind, args.Name, component)
3830
if err != nil {
3931
return nil, fmt.Errorf("failed to register component resource: %w", err)
4032
}
4133

4234
// Create service account
43-
serviceAccountName := fmt.Sprintf("%s-sa", args.Name)
35+
serviceAccountName := fmt.Sprintf("%s%s", args.Name, ServiceAccountSuffix)
4436
sa, err := corev1.NewServiceAccount(ctx, serviceAccountName, &corev1.ServiceAccountArgs{
4537
Metadata: &metav1.ObjectMetaArgs{
4638
Name: pulumi.String(serviceAccountName),
@@ -54,7 +46,7 @@ func NewBuilder(ctx *pulumi.Context, args BuilderComponentArgs, opts ...pulumi.R
5446
component.ServiceAccount = sa
5547

5648
// Create ConfigMap for environment variables
57-
configMapName := fmt.Sprintf("%s-env", args.Name)
49+
configMapName := fmt.Sprintf("%s%s", args.Name, ConfigMapSuffix)
5850
configMap, err := utils.CreateConfigMap(
5951
ctx,
6052
configMapName,
@@ -72,7 +64,7 @@ func NewBuilder(ctx *pulumi.Context, args BuilderComponentArgs, opts ...pulumi.R
7264
podLabels["app"] = pulumi.String(args.Name)
7365

7466
// Create deployment
75-
deploymentName := fmt.Sprintf("%s-deployment", args.Name)
67+
deploymentName := fmt.Sprintf("%s%s", args.Name, DeploymentSuffix)
7668
deployment, err := appsv1.NewDeployment(ctx, deploymentName, &appsv1.DeploymentArgs{
7769
Metadata: &metav1.ObjectMetaArgs{
7870
Name: pulumi.String(deploymentName),
@@ -109,33 +101,24 @@ func NewBuilder(ctx *pulumi.Context, args BuilderComponentArgs, opts ...pulumi.R
109101
ContainerPort: pulumi.Int(MetricsPort),
110102
},
111103
},
112-
Resources: &corev1.ResourceRequirementsArgs{
113-
Limits: pulumi.StringMap{
114-
"cpu": pulumi.String("2"),
115-
"memory": pulumi.String("2Gi"),
116-
},
117-
Requests: pulumi.StringMap{
118-
"cpu": pulumi.String("1"),
119-
"memory": pulumi.String("1Gi"),
120-
},
121-
},
104+
Resources: utils.CreateResourceRequirements(DefaultCPULimit, DefaultMemoryLimit, DefaultCPURequest, DefaultMemoryRequest),
122105
LivenessProbe: &corev1.ProbeArgs{
123106
HttpGet: &corev1.HTTPGetActionArgs{
124-
Path: pulumi.String("/healthcheck"),
107+
Path: pulumi.String(HealthCheckPath),
125108
Port: parseBuilderPort(args.BuilderEnv.BuilderPort),
126109
},
127-
InitialDelaySeconds: pulumi.Int(5),
128-
PeriodSeconds: pulumi.Int(1),
129-
TimeoutSeconds: pulumi.Int(1),
130-
FailureThreshold: pulumi.Int(3),
110+
InitialDelaySeconds: pulumi.Int(ProbeInitialDelaySeconds),
111+
PeriodSeconds: pulumi.Int(LivenessProbePeriod),
112+
TimeoutSeconds: pulumi.Int(ProbeTimeoutSeconds),
113+
FailureThreshold: pulumi.Int(ProbeFailureThreshold),
131114
},
132115
ReadinessProbe: &corev1.ProbeArgs{
133116
HttpGet: &corev1.HTTPGetActionArgs{
134-
Path: pulumi.String("/healthcheck"),
117+
Path: pulumi.String(HealthCheckPath),
135118
Port: parseBuilderPort(args.BuilderEnv.BuilderPort),
136119
},
137-
InitialDelaySeconds: pulumi.Int(5),
138-
PeriodSeconds: pulumi.Int(10),
120+
InitialDelaySeconds: pulumi.Int(ProbeInitialDelaySeconds),
121+
PeriodSeconds: pulumi.Int(ProbePeriodSeconds),
139122
},
140123
},
141124
},
@@ -149,16 +132,16 @@ func NewBuilder(ctx *pulumi.Context, args BuilderComponentArgs, opts ...pulumi.R
149132
component.Deployment = deployment
150133

151134
// Create service
152-
serviceName := fmt.Sprintf("%s-service", args.Name)
135+
serviceName := fmt.Sprintf("%s%s", args.Name, ServiceSuffix)
153136
service, err := corev1.NewService(ctx, serviceName, &corev1.ServiceArgs{
154137
Metadata: &metav1.ObjectMetaArgs{
155138
Name: pulumi.String(serviceName),
156139
Namespace: pulumi.String(args.Namespace),
157140
Labels: utils.CreateResourceLabels(args.Name, serviceName, args.Name, nil),
158141
Annotations: pulumi.StringMap{
159-
"prometheus.io/scrape": pulumi.String("true"),
160-
"prometheus.io/port": pulumi.Sprintf("%d", MetricsPort),
161-
"prometheus.io/path": pulumi.String("/metrics"),
142+
PrometheusScrapeAnnotation: pulumi.String("true"),
143+
PrometheusPortAnnotation: pulumi.Sprintf("%d", MetricsPort),
144+
PrometheusPathAnnotation: pulumi.String(MetricsPath),
162145
},
163146
},
164147
Spec: &corev1.ServiceSpecArgs{
@@ -183,8 +166,8 @@ func NewBuilder(ctx *pulumi.Context, args BuilderComponentArgs, opts ...pulumi.R
183166
component.Service = service
184167

185168
// Create pod monitor
186-
podMonitorName := fmt.Sprintf("%s-pod-monitor", args.Name)
187-
_, err = crd.NewCustomResource(ctx, fmt.Sprintf("%s-svcmon", args.Name), &crd.CustomResourceArgs{
169+
podMonitorName := fmt.Sprintf("%s%s", args.Name, PodMonitorSuffix)
170+
_, err = crd.NewCustomResource(ctx, fmt.Sprintf("%s%s", args.Name, ServiceMonitorSuffix), &crd.CustomResourceArgs{
188171
ApiVersion: pulumi.String("monitoring.coreos.com/v1"),
189172
Kind: pulumi.String("PodMonitor"),
190173
Metadata: &metav1.ObjectMetaArgs{

‎pkg/builder/constants.go‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
package builder
2+
3+
// Resource defaults
4+
const (
5+
// Port defaults
6+
DefaultBuilderPort = 8080
7+
MetricsPort = 9000
8+
9+
// Deployment defaults
10+
DefaultReplicas = 1
11+
12+
// Resource allocation defaults
13+
DefaultCPULimit = "2"
14+
DefaultMemoryLimit = "2Gi"
15+
DefaultCPURequest = "1"
16+
DefaultMemoryRequest = "1Gi"
17+
18+
// Component kind
19+
ComponentKind = "signet:index:Builder"
20+
)
21+
22+
// Resource name suffixes
23+
const (
24+
ServiceSuffix = "-service"
25+
DeploymentSuffix = "-deployment"
26+
ServiceAccountSuffix = "-sa"
27+
ConfigMapSuffix = "-env"
28+
PodMonitorSuffix = "-pod-monitor"
29+
ServiceMonitorSuffix = "-svcmon"
30+
)
31+
32+
// Health check paths
33+
const (
34+
HealthCheckPath = "/healthcheck"
35+
MetricsPath = "/metrics"
36+
)
37+
38+
// Probe settings
39+
const (
40+
ProbeInitialDelaySeconds = 5
41+
ProbePeriodSeconds = 10
42+
LivenessProbePeriod = 1
43+
ProbeTimeoutSeconds = 1
44+
ProbeFailureThreshold = 3
45+
)
46+
47+
// Prometheus annotations
48+
const (
49+
PrometheusScrapeAnnotation = "prometheus.io/scrape"
50+
PrometheusPortAnnotation = "prometheus.io/port"
51+
PrometheusPathAnnotation = "prometheus.io/path"
52+
)

‎pkg/builder/types.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,6 @@ import (
77
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
88
)
99

10-
const (
11-
// Service ports
12-
MetricsPort = 9000
13-
14-
// Deployment settings
15-
DefaultReplicas = 1
16-
)
17-
1810
// AppLabels represents the Kubernetes labels to be applied to the builder resources.
1911
type AppLabels struct {
2012
Labels pulumi.StringMap

‎pkg/quincey/constants.go‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
package quincey
2+
3+
// Resource defaults
4+
const (
5+
// Port defaults
6+
DefaultQuinceyPort = 8080
7+
DefaultMetricsPort = 9000
8+
9+
// Deployment defaults
10+
DefaultReplicas = 1
11+
12+
// Component kind
13+
ComponentKind = "signet:index:Quincey"
14+
)
15+
16+
// Resource names and identifiers
17+
const (
18+
// ServiceName is the name of the Quincey service
19+
ServiceName = "quincey-server"
20+
// AppLabel is the label used to identify Quincey resources
21+
AppLabel = "quincey-server"
22+
// ComponentName is the name of this component
23+
ComponentName = "quincey"
24+
)
25+
26+
// Resource name suffixes
27+
const (
28+
ServiceSuffix = "-service"
29+
DeploymentSuffix = "-deployment"
30+
ServiceAccountSuffix = "-sa"
31+
ConfigMapSuffix = "-configmap"
32+
VirtualServiceSuffix = "-vservice"
33+
RequestAuthSuffix = "-request-auth"
34+
AuthPolicySuffix = "-auth-policy"
35+
)
36+
37+
// Service types
38+
const (
39+
ServiceTypeClusterIP = "ClusterIP"
40+
)
41+
42+
// Istio API versions and kinds
43+
const (
44+
IstioNetworkingAPIVersion = "networking.istio.io/v1alpha3"
45+
IstioSecurityAPIVersion = "security.istio.io/v1beta1"
46+
VirtualServiceKind = "VirtualService"
47+
RequestAuthenticationKind = "RequestAuthentication"
48+
AuthorizationPolicyKind = "AuthorizationPolicy"
49+
)
50+
51+
// JWT and OAuth constants
52+
const (
53+
JWTTokenHeader = "authorization"
54+
JWTTokenPrefix = "Bearer "
55+
OAuthIssuerClaim = "iss"
56+
DefaultAppSelector = "signet"
57+
)

0 commit comments

Comments
 (0)