import * as pulumi from “@pulumi/pulumi”;
import * as resources from “@pulumi/azure-native/resources”;
import * as azuread from “@pulumi/azuread”;
import * as containerservice from “@pulumi/azure-native/containerservice”;
import * as k8s from “@pulumi/kubernetes”;
import * as certmanager from ‘@pulumi/kubernetes-cert-manager’;
import {FileAsset} from “@pulumi/pulumi/asset”;

// Grab some values from the Pulumi stack configuration (or use defaults)
const projCfg = new pulumi.Config();
const numWorkerNodes = projCfg.getNumber(“numWorkerNodes”) || 3;
const k8sVersion = projCfg.get(“kubernetesVersion”) || “1.26.3”;
const nodeVmSize = projCfg.get(“nodeVmSize”) || “Standard_DS2_v2”;
const resourceGroupName = projCfg.get(“resourceGroupName”) || “ac-rg”;
const clusterName = projCfg.get(“resourceName”) || “pulumi-poc”;
const enterpriseLicense = “../license.json”; // path to license


// Get existing Azure Resource Group Name
const resourceGroup = pulumi.output(resources.getResourceGroup({
resourceGroupName: resourceGroupName,
}));

// Get existing Azure AD Application named “poc”
const adAppName = “poc”;
const adApp = pulumi.output(azuread.getApplication({
displayName: adAppName,
}));

// Retrieve the existing Azure AD Service Principal by its Application ID
const servicePrincipal = adApp.apply(app => azuread.getServicePrincipal({
applicationId: app.applicationId,
}));

// Create a new Service Principal Password for the existing AD App “poc”
const spPassword = servicePrincipal.apply(sp => new azuread.ServicePrincipalPassword(“servicePrincipalPassword”, {
servicePrincipalId: sp.id,
endDate: “2099-02-02T00:00:00Z”,
}));

// Create an Azure Kubernetes Cluster
const aksCluster = new containerservice.ManagedCluster(“aksCluster”, {
resourceName: clusterName, // Set the resourceName to “pulumi-poc”
resourceGroupName: resourceGroup.name,
location: resourceGroup.location,
dnsPrefix: clusterName,
agentPoolProfiles: [{
availabilityZones: [“1”,“2”,“3”],
count: numWorkerNodes,
enableNodePublicIP: false,
mode: “System”,
name: “systempool”,
osType: “Linux”,
osDiskSizeGB: 30,
type: “VirtualMachineScaleSets”,
vmSize: nodeVmSize,
}],
kubernetesVersion: k8sVersion,
servicePrincipalProfile: {
clientId: adApp.applicationId,
secret: spPassword.value,
},
});

// Build a Kubeconfig to access the cluster
const creds = pulumi.all([aksCluster.name, resourceGroup.name]).apply(([kubeconfigName, rgName]) =>
containerservice.listManagedClusterUserCredentials({
resourceGroupName: rgName,
resourceName: kubeconfigName,
}));

const encodedKubeconfig = creds.kubeconfigs[0].value!;
const kubeconfig = encodedKubeconfig.apply(kubeconfigYaml => Buffer.from(kubeconfigYaml, “base64”).toString());

// Create the k8s provider using the kubeconfig from the existing AKS cluster
const k8sProvider = new k8s.Provider(“k8s-provider”, { kubeconfig });

// Create a namespace for Kong
const kongNamespace = new k8s.core.v1.Namespace(“namespace”, {
metadata: {
name: “kong”,
},
}, { provider: k8sProvider });

// Create a secret from the content of the license.json file
const licenseFile = pulumi.interpolate`${enterpriseLicense}`
const kongEnterpriseLicense = new k8s.core.v1.Secret(“kong-enterprise-license”, {
metadata: {
name: “kong-enterprise-license”,
namespace: kongNamespace.metadata.name,
},
data: {
license: licenseFile.apply(content => Buffer.from(content).toString(“base64”)),
},
}, { provider: k8sProvider });

// Define the secret data
const sessionConfigSecretData = {
“portal_session_conf”: ‘{“storage”:”kong”,”secret”:”super_secret_salt_string”,”cookie_name”:”portal_session”,”cookie_samesite”:”off”,”cookie_secure”:false, “cookie_domain”: “.create9.io”}’,
“admin_gui_session_conf”: ‘{“cookie_name”:”admin_session”,”cookie_samesite”:”off”,”secret”:”super_secret_salt_string”,”cookie_secure”:false,”storage”:”kong”, “cookie_domain”: “.create9.io”}’,
“pg_host”: “enterprise-postgresql.kong.svc.cluster.local”,
“kong_admin_password”: “kong”,
“password”: “kong”,
};

// Create a Kubernetes Secret with the specified literals
const kongSessionConfig = new k8s.core.v1.Secret(“kong-session-config”, {
metadata: {
name: “kong-config-secret”,
namespace: kongNamespace.metadata.name,
},
data: pulumi.interpolate`${JSON.stringify(sessionConfigSecretData)}`
.apply(content => JSON.parse(content))
.apply(content => {
const ret: Record<string, pulumi.Input<string>> = {};
for (const key of Object.keys(content)) {
ret[key] = pulumi.interpolate`${content[key]}`
.apply(contentStr => Buffer.from(contentStr).toString(“base64”));
}
return ret;
}),
}, { provider: k8sProvider });

// Cert Manager Namespace
const certManagerNamespace = new k8s.core.v1.Namespace(“cert-manager-namespace”, {
metadata: {name: “cert-manager”},
}, { provider: k8sProvider });

// Install cert manager
const certManager = new certmanager.CertManager(“cert-manager”, {
installCRDs: true,
helmOptions: {
name: “cert-manager”,
namespace: certManagerNamespace.metadata.name,
values: {
global: {
operatorNamespace: certManagerNamespace.metadata.name,
rbac: {
create: true,
},
logLevel: “debug”,
leaderElection: {
namespace: “kube-system”,
},
},
serviceAccount: {
create: true,
automountServiceAccountToken: true,
},
securityContext: {
runAsNonRoot: true,
},
webhook: {
enabled: true,
namespace: certManagerNamespace.metadata.name,
timeoutSeconds: 30,
serviceAccount: {
create: true,
automountServiceAccountToken: true,
},
hostNetwork: false,
serviceType: “ClusterIP”,
},
},
},
}, { provider: k8sProvider, dependsOn: certManagerNamespace });

// Create Self Signed Root Certificate Authority.
const rootIssuer = new k8s.apiextensions.CustomResource(“issuerRoot”, {
apiVersion: “cert-manager.io/v1”,
kind: “Issuer”,
metadata: {
name: “quickstart-kong-selfsigned-issuer-root”,
namespace: kongNamespace.metadata.name,
},
spec: {
selfSigned: {}
},
}, { provider: k8sProvider, dependsOn: [certManager, kongNamespace] });

// Certificate for Self Signed ClusterIssuer.
const selfSignedCa = new k8s.apiextensions.CustomResource(“selfSignCertificateAuthority”, {
apiVersion: “cert-manager.io/v1”,
kind: “Certificate”,
metadata: {
name: “quickstart-kong-selfsigned-issuer-ca”,
namespace: kongNamespace.metadata.name,
},
spec: {
commonName: “quickstart-kong-selfsigned-issuer-ca”,
duration: “2160h0m0s”,
isCA: true,
issuerRef: {
group: “cert-manager.io”,
kind: “Issuer”,
name: “quickstart-kong-selfsigned-issuer-root”
},
privateKey: {
algorithm: “ECDSA”,
size: 256
},
renewBefore: “360h0m0s”,
secretName: “quickstart-kong-selfsigned-issuer-ca”
},
}, { provider: k8sProvider, dependsOn: [certManager, kongNamespace] });

// Create Self Signed Issuer
const selfsignedIssuer = new k8s.apiextensions.CustomResource(“selfSignIssuer”, {
apiVersion: “cert-manager.io/v1”,
kind: “Issuer”,
metadata: {
name: “quickstart-kong-selfsigned-issuer”,
namespace: kongNamespace.metadata.name,
},
spec: {
ca: {
secretName: “quickstart-kong-selfsigned-issuer-ca”,
},
},
}, { provider: k8sProvider, dependsOn: [certManager, kongNamespace] });

// Deploying Kong Gateway on AKS
const kongHelmChart = new k8s.helm.v3.Release(“quickstart”, {
namespace: kongNamespace.metadata.name,
chart: “kong”,
name: “quickstart”,
version: “2.23.0”,
repositoryOpts: {
repo: “https://charts.konghq.com”,
},
skipAwait: false,
valueYamlFiles: [new FileAsset(“./quickstart-values.yaml”)],
timeout: 600,
}, { provider: k8sProvider, dependsOn: kongNamespace });