fix: Init aks scanner

apps/event-worker/package.json

@@ -15,6 +15,8 @@
     "@aws-sdk/client-ec2": "^3.701.0",
     "@aws-sdk/client-eks": "^3.699.0",
     "@aws-sdk/client-sts": "^3.699.0",
+    "@azure/arm-containerservice": "^21.3.0",
+    "@azure/identity": "^4.5.0",
     "@ctrlplane/db": "workspace:*",
     "@ctrlplane/job-dispatch": "workspace:*",
     "@ctrlplane/logger": "workspace:*",

apps/event-worker/src/index.ts

@@ -2,23 +2,16 @@ import { logger } from "@ctrlplane/logger";
 
 import { createDispatchExecutionJobWorker } from "./job-dispatch/index.js";
 import { redis } from "./redis.js";
-import {
-  createAwsResourceScanWorker,
-  createGoogleResourceScanWorker,
-} from "./resource-scan/index.js";
+import { createResourceScanWorker } from "./resource-scan/index.js";
 
-const resourceGoogleScanWorker = createGoogleResourceScanWorker();
-const resourceAwsScanWorker = createAwsResourceScanWorker();
+const resourceScanWorker = createResourceScanWorker();
 const dispatchExecutionJobWorker = createDispatchExecutionJobWorker();
 
 const shutdown = () => {
   logger.warn("Exiting...");
-  resourceAwsScanWorker.close();
-  resourceGoogleScanWorker.close();
+  resourceScanWorker.close();
   dispatchExecutionJobWorker.close();
-
   redis.quit();
-
   process.exit(0);
 };
 

apps/event-worker/src/resource-scan/aws/eks.ts

@@ -146,6 +146,7 @@ export const getEksResources = async (
   workspace: Workspace,
   config: ResourceProviderAws,
 ) => {
+  if (!config.importEks) return [];
   const { awsRoleArn: workspaceRoleArn } = workspace;
   if (workspaceRoleArn == null) return [];
 
@@ -161,22 +162,20 @@ export const getEksResources = async (
   const credentials = await assumeWorkspaceRole(workspaceRoleArn);
   const workspaceStsClient = credentials.sts();
 
-  const resources = config.importEks
-    ? await _.chain(config.awsRoleArns)
-        .map((customerRoleArn) =>
-          scanEksClustersByAssumedRole(workspaceStsClient, customerRoleArn),
-        )
-        .thru((promises) => Promise.all(promises))
-        .value()
-        .then((results) => results.flat())
-        .then((resources) =>
-          resources.map((resource) => ({
-            ...resource,
-            workspaceId: workspace.id,
-            providerId: config.resourceProviderId,
-          })),
-        )
-    : [];
+  const resources = await _.chain(config.awsRoleArns)
+    .map((customerRoleArn) =>
+      scanEksClustersByAssumedRole(workspaceStsClient, customerRoleArn),
+    )
+    .thru((promises) => Promise.all(promises))
+    .value()
+    .then((results) => results.flat())
+    .then((resources) =>
+      resources.map((resource) => ({
+        ...resource,
+        workspaceId: workspace.id,
+        providerId: config.resourceProviderId,
+      })),
+    );
 
   const resourceTypes = _.countBy(resources, (resource) =>
     [resource.kind, resource.version].join("/"),

apps/event-worker/src/resource-scan/aws/vpc.ts

@@ -169,6 +169,8 @@ export const getVpcResources = async (
   workspace: Workspace,
   config: ResourceProviderAws,
 ) => {
+  if (!config.importVpc) return [];
+
   const { awsRoleArn: workspaceRoleArn } = workspace;
   if (workspaceRoleArn == null) return [];
 
@@ -184,22 +186,20 @@ export const getVpcResources = async (
   const credentials = await assumeWorkspaceRole(workspaceRoleArn);
   const workspaceStsClient = credentials.sts();
 
-  const resources = config.importVpc
-    ? await _.chain(config.awsRoleArns)
-        .map((customerRoleArn) =>
-          scanVpcsByAssumedRole(workspaceStsClient, customerRoleArn),
-        )
-        .thru((promises) => Promise.all(promises))
-        .value()
-        .then((results) => results.flat())
-        .then((resources) =>
-          resources.map((resource) => ({
-            ...resource,
-            workspaceId: workspace.id,
-            providerId: config.resourceProviderId,
-          })),
-        )
-    : [];
+  const resources = await _.chain(config.awsRoleArns)
+    .map((customerRoleArn) =>
+      scanVpcsByAssumedRole(workspaceStsClient, customerRoleArn),
+    )
+    .thru((promises) => Promise.all(promises))
+    .value()
+    .then((results) => results.flat())
+    .then((resources) =>
+      resources.map((resource) => ({
+        ...resource,
+        workspaceId: workspace.id,
+        providerId: config.resourceProviderId,
+      })),
+    );
 
   log.info(`Found ${resources.length} VPC resources`);
 

apps/event-worker/src/resource-scan/azure/aks.ts

@@ -0,0 +1,62 @@
+import type { ManagedCluster } from "@azure/arm-containerservice";
+import { ContainerServiceClient } from "@azure/arm-containerservice";
+import { ClientSecretCredential } from "@azure/identity";
+import { isPresent } from "ts-is-present";
+
+import { eq, takeFirstOrNull } from "@ctrlplane/db";
+import { db } from "@ctrlplane/db/client";
+import * as SCHEMA from "@ctrlplane/db/schema";
+import { logger } from "@ctrlplane/logger";
+
+import { convertManagedClusterToResource } from "./cluster-to-resource.js";
+
+const log = logger.child({ label: "resource-scan/azure" });
+
+const AZURE_CLIENT_ID = process.env.AZURE_APP_CLIENT_ID;
+const AZURE_CLIENT_SECRET = process.env.AZURE_APP_CLIENT_SECRET;
+
+export const getAksResources = async (
+  workspace: SCHEMA.Workspace,
+  azureProvider: SCHEMA.ResourceProviderAzure,
+) => {
+  if (!AZURE_CLIENT_ID || !AZURE_CLIENT_SECRET) {
+    log.error("Invalid azure credentials, skipping resource scan");
+    return [];
+  }
+
+  const tenant = await db
+    .select()
+    .from(SCHEMA.azureTenant)
+    .where(eq(SCHEMA.azureTenant.id, azureProvider.tenantId))
+    .then(takeFirstOrNull);
+
+  if (!tenant) {
+    log.error("Tenant not found, skipping resource scan");
+    return [];
+  }
+
+  const credential = new ClientSecretCredential(
+    tenant.tenantId,
+    AZURE_CLIENT_ID,
+    AZURE_CLIENT_SECRET,
+  );
+
+  const client = new ContainerServiceClient(
+    credential,
+    azureProvider.subscriptionId,
+  );
+
+  const res = client.managedClusters.list();
+
+  const clusters: ManagedCluster[] = [];
+  for await (const cluster of res) {
+    clusters.push(cluster);
+  }
+
+  const { resourceProviderId: providerId } = azureProvider;
+  return clusters
+    .map((cluster) =>
+      convertManagedClusterToResource(workspace.id, providerId, cluster),
+    )
+    .filter(isPresent);
+};

apps/event-worker/src/resource-scan/azure/cluster-to-resource.ts

@@ -0,0 +1,172 @@
+import type { ManagedCluster } from "@azure/arm-containerservice";
+import type { KubernetesClusterAPIV1 } from "@ctrlplane/validators/resources";
+
+import { logger } from "@ctrlplane/logger";
+import { ReservedMetadataKey } from "@ctrlplane/validators/conditions";
+
+import { omitNullUndefined } from "../../utils.js";
+
+const log = logger.child({ module: "resource-scan/azure/cluster-to-resource" });
+
+type ClusterResource = KubernetesClusterAPIV1 & {
+  workspaceId: string;
+  providerId: string;
+};
+
+export const convertManagedClusterToResource = (
+  workspaceId: string,
+  providerId: string,
+  cluster: ManagedCluster,
+): ClusterResource | null => {
+  if (!cluster.name || !cluster.id) {
+    log.error("Invalid cluster", { cluster });
+    return null;
+  }
+
+  return {
+    workspaceId,
+    providerId,
+    name: cluster.name,
+    identifier: cluster.id,
+    version: "kubernetes/v1",
+    kind: "ClusterAPI",
+    config: {
+      name: cluster.name,
+      auth: {
+        method: "azure/aks",
+        clusterName: cluster.name,
+        resourceGroup: cluster.nodeResourceGroup ?? "",
+      },
+      status: cluster.provisioningState ?? "UNKNOWN",
+      server: {
+        endpoint: cluster.fqdn ?? "",
+        certificateAuthorityData: cluster.servicePrincipalProfile?.clientId,
+      },
+    },
+    metadata: omitNullUndefined({
+      [ReservedMetadataKey.Links]: cluster.azurePortalFqdn
+        ? JSON.stringify({ "Azure Portal": cluster.azurePortalFqdn })
+        : undefined,
+      [ReservedMetadataKey.ExternalId]: cluster.id ?? "",
+      [ReservedMetadataKey.KubernetesFlavor]: "aks",
+      [ReservedMetadataKey.KubernetesVersion]: cluster.currentKubernetesVersion,
+
+      "azure/self-link": cluster.id,
+      "azure/resource-group": cluster.nodeResourceGroup,
+      "azure/location": cluster.location,
+      "azure/platform-version": cluster.kubernetesVersion,
+      "azure/enable-rbac": cluster.enableRbac,
+      "azure/enable-oidc": cluster.oidcIssuerProfile?.enabled,
+      "azure/enable-disk-csi-driver":
+        cluster.storageProfile?.diskCSIDriver?.enabled,
+      "azure/enable-file-csi-driver":
+        cluster.storageProfile?.fileCSIDriver?.enabled,
+      "azure/enable-snapshot-controller":
+        cluster.storageProfile?.snapshotController?.enabled,
+      "azure/service-principal-profile/client-id":
+        cluster.servicePrincipalProfile?.clientId,
+      "azure/oidc-issuer-profile/enabled": cluster.oidcIssuerProfile?.enabled,
+      "azure/oidc-issuer-profile/issuer-url":
+        cluster.oidcIssuerProfile?.issuerURL,
+      "azure/storage-profile/disk-csi-driver/enabled":
+        cluster.storageProfile?.diskCSIDriver?.enabled,
+      "azure/storage-profile/file-csi-driver/enabled":
+        cluster.storageProfile?.fileCSIDriver?.enabled,
+      "azure/storage-profile/snapshot-controller/enabled":
+        cluster.storageProfile?.snapshotController?.enabled,
+      "azure/network-profile/network-plugin":
+        cluster.networkProfile?.networkPlugin,
+      "azure/network-profile/network-policy":
+        cluster.networkProfile?.networkPolicy,
+      "azure/network-profile/pod-cidr": cluster.networkProfile?.podCidr,
+      "azure/network-profile/service-cidr": cluster.networkProfile?.serviceCidr,
+      "azure/network-profile/dns-service-ip":
+        cluster.networkProfile?.dnsServiceIP,
+      "azure/network-profile/load-balancer-sku":
+        cluster.networkProfile?.loadBalancerSku,
+      "azure/network-profile/outbound-type":
+        cluster.networkProfile?.outboundType,
+      "azure/addon-profiles/http-application-routing/enabled":
+        cluster.addonProfiles?.httpApplicationRouting?.enabled,
+      "azure/addon-profiles/monitoring/enabled":
+        cluster.addonProfiles?.omsagent?.enabled,
+      "azure/addon-profiles/azure-policy/enabled":
+        cluster.addonProfiles?.azurepolicy?.enabled,
+      "azure/addon-profiles/ingress-application-gateway/enabled":
+        cluster.addonProfiles?.ingressApplicationGateway?.enabled,
+      "azure/addon-profiles/open-service-mesh/enabled":
+        cluster.addonProfiles?.openServiceMesh?.enabled,
+      "azure/identity/type": cluster.identity?.type,
+      "azure/provisioning-state": cluster.provisioningState,
+      "azure/power-state": cluster.powerState?.code,
+      "azure/max-agent-pools": String(cluster.maxAgentPools),
+      "azure/dns-prefix": cluster.dnsPrefix,
+      "azure/fqdn": cluster.fqdn,
+      "azure/portal-fqdn": cluster.azurePortalFqdn,
+      "azure/support-plan": cluster.supportPlan,
+      "azure/disable-local-accounts": cluster.disableLocalAccounts,
+      "azure/auto-upgrade-profile/channel":
+        cluster.autoUpgradeProfile?.upgradeChannel,
+      "azure/sku/name": cluster.sku?.name,
+      "azure/sku/tier": cluster.sku?.tier,
+      "azure/agent-pool-profiles": JSON.stringify(cluster.agentPoolProfiles),
+      "azure/windows-profile/admin-username":
+        cluster.windowsProfile?.adminUsername,
+      "azure/windows-profile/enable-csi-proxy":
+        cluster.windowsProfile?.enableCSIProxy,
+      "azure/addon-profiles/azure-policy/identity/resource-id":
+        cluster.addonProfiles?.azurepolicy?.identity?.resourceId,
+      "azure/addon-profiles/azure-policy/identity/client-id":
+        cluster.addonProfiles?.azurepolicy?.identity?.clientId,
+      "azure/addon-profiles/azure-policy/identity/object-id":
+        cluster.addonProfiles?.azurepolicy?.identity?.objectId,
+      "azure/addon-profiles/ingress-application-gateway/config/application-gateway-id":
+        cluster.addonProfiles?.ingressApplicationGateway?.config
+          ?.applicationGatewayId,
+      "azure/addon-profiles/ingress-application-gateway/config/effective-application-gateway-id":
+        cluster.addonProfiles?.ingressApplicationGateway?.config
+          ?.effectiveApplicationGatewayId,
+      "azure/addon-profiles/ingress-application-gateway/identity/resource-id":
+        cluster.addonProfiles?.ingressApplicationGateway?.identity?.resourceId,
+      "azure/addon-profiles/ingress-application-gateway/identity/client-id":
+        cluster.addonProfiles?.ingressApplicationGateway?.identity?.clientId,
+      "azure/addon-profiles/ingress-application-gateway/identity/object-id":
+        cluster.addonProfiles?.ingressApplicationGateway?.identity?.objectId,
+      "azure/network-profile/network-dataplane":
+        cluster.networkProfile?.networkDataplane,
+      "azure/network-profile/load-balancer-profile/managed-outbound-ips/count":
+        cluster.networkProfile?.loadBalancerProfile?.managedOutboundIPs?.count,
+      "azure/network-profile/load-balancer-profile/managed-outbound-ips/count-ipv6":
+        cluster.networkProfile?.loadBalancerProfile?.managedOutboundIPs
+          ?.countIPv6,
+      "azure/network-profile/load-balancer-profile/effective-outbound-ips":
+        JSON.stringify(
+          cluster.networkProfile?.loadBalancerProfile?.effectiveOutboundIPs,
+        ),
+      "azure/network-profile/load-balancer-profile/allocated-outbound-ports":
+        cluster.networkProfile?.loadBalancerProfile?.allocatedOutboundPorts,
+      "azure/network-profile/load-balancer-profile/idle-timeout-in-minutes":
+        cluster.networkProfile?.loadBalancerProfile?.idleTimeoutInMinutes,
+      "azure/network-profile/load-balancer-profile/backend-pool-type":
+        cluster.networkProfile?.loadBalancerProfile?.backendPoolType,
+      "azure/network-profile/service-cidrs": JSON.stringify(
+        cluster.networkProfile?.serviceCidrs,
+      ),
+      "azure/network-profile/ip-families": JSON.stringify(
+        cluster.networkProfile?.ipFamilies,
+      ),
+      "azure/identity-profile/kubeletidentity/resource-id":
+        cluster.identityProfile?.kubeletidentity?.resourceId,
+      "azure/identity-profile/kubeletidentity/client-id":
+        cluster.identityProfile?.kubeletidentity?.clientId,
+      "azure/identity-profile/kubeletidentity/object-id":
+        cluster.identityProfile?.kubeletidentity?.objectId,
+      "azure/security-profile/defender/enable-defender":
+        cluster.securityProfile?.defender?.securityMonitoring?.enabled,
+      "azure/security-profile/defender/log-analytics-workspace-id":
+        cluster.securityProfile?.defender?.logAnalyticsWorkspaceResourceId,
+      "azure/security-profile/defender/security-monitoring/enabled":
+        cluster.securityProfile?.defender?.securityMonitoring?.enabled,
+    }),
+  };
+};