fix: Init aks scanner

apps/event-worker/package.json

@@ -15,6 +15,8 @@
     "@aws-sdk/client-ec2": "^3.701.0",
     "@aws-sdk/client-eks": "^3.699.0",
     "@aws-sdk/client-sts": "^3.699.0",
+    "@azure/arm-containerservice": "^21.3.0",
+    "@azure/identity": "^4.5.0",
     "@ctrlplane/db": "workspace:*",
     "@ctrlplane/job-dispatch": "workspace:*",
     "@ctrlplane/logger": "workspace:*",

apps/event-worker/src/config.ts

@@ -12,6 +12,8 @@ export const env = createEnv({
     GITHUB_BOT_PRIVATE_KEY: z.string().optional(),
     GITHUB_BOT_CLIENT_ID: z.string().optional(),
     GITHUB_BOT_CLIENT_SECRET: z.string().optional(),
+    AZURE_APP_CLIENT_ID: z.string().optional(),
+    AZURE_APP_CLIENT_SECRET: z.string().optional(),
   },
   runtimeEnv: process.env,
 });

apps/event-worker/src/index.ts

@@ -2,23 +2,16 @@ import { logger } from "@ctrlplane/logger";
 
 import { createDispatchExecutionJobWorker } from "./job-dispatch/index.js";
 import { redis } from "./redis.js";
-import {
-  createAwsResourceScanWorker,
-  createGoogleResourceScanWorker,
-} from "./resource-scan/index.js";
+import { createResourceScanWorker } from "./resource-scan/index.js";
 
-const resourceGoogleScanWorker = createGoogleResourceScanWorker();
-const resourceAwsScanWorker = createAwsResourceScanWorker();
+const resourceScanWorker = createResourceScanWorker();
 const dispatchExecutionJobWorker = createDispatchExecutionJobWorker();
 
 const shutdown = () => {
   logger.warn("Exiting...");
-  resourceAwsScanWorker.close();
-  resourceGoogleScanWorker.close();
+  resourceScanWorker.close();
   dispatchExecutionJobWorker.close();
-
   redis.quit();
-
   process.exit(0);
 };
 

apps/event-worker/src/resource-scan/aws/eks.ts

@@ -146,6 +146,7 @@ export const getEksResources = async (
   workspace: Workspace,
   config: ResourceProviderAws,
 ) => {
+  if (!config.importEks) return [];
   const { awsRoleArn: workspaceRoleArn } = workspace;
   if (workspaceRoleArn == null) return [];
 
@@ -161,22 +162,20 @@ export const getEksResources = async (
   const credentials = await assumeWorkspaceRole(workspaceRoleArn);
   const workspaceStsClient = credentials.sts();
 
-  const resources = config.importEks
-    ? await _.chain(config.awsRoleArns)
-        .map((customerRoleArn) =>
-          scanEksClustersByAssumedRole(workspaceStsClient, customerRoleArn),
-        )
-        .thru((promises) => Promise.all(promises))
-        .value()
-        .then((results) => results.flat())
-        .then((resources) =>
-          resources.map((resource) => ({
-            ...resource,
-            workspaceId: workspace.id,
-            providerId: config.resourceProviderId,
-          })),
-        )
-    : [];
+  const resources = await _.chain(config.awsRoleArns)
+    .map((customerRoleArn) =>
+      scanEksClustersByAssumedRole(workspaceStsClient, customerRoleArn),
+    )
+    .thru((promises) => Promise.all(promises))
+    .value()
+    .then((results) => results.flat())
+    .then((resources) =>
+      resources.map((resource) => ({
+        ...resource,
+        workspaceId: workspace.id,
+        providerId: config.resourceProviderId,
+      })),
+    );
 
   const resourceTypes = _.countBy(resources, (resource) =>
     [resource.kind, resource.version].join("/"),

apps/event-worker/src/resource-scan/aws/vpc.ts

@@ -169,6 +169,8 @@ export const getVpcResources = async (
   workspace: Workspace,
   config: ResourceProviderAws,
 ) => {
+  if (!config.importVpc) return [];
+
   const { awsRoleArn: workspaceRoleArn } = workspace;
   if (workspaceRoleArn == null) return [];
 
@@ -184,22 +186,20 @@ export const getVpcResources = async (
   const credentials = await assumeWorkspaceRole(workspaceRoleArn);
   const workspaceStsClient = credentials.sts();
 
-  const resources = config.importVpc
-    ? await _.chain(config.awsRoleArns)
-        .map((customerRoleArn) =>
-          scanVpcsByAssumedRole(workspaceStsClient, customerRoleArn),
-        )
-        .thru((promises) => Promise.all(promises))
-        .value()
-        .then((results) => results.flat())
-        .then((resources) =>
-          resources.map((resource) => ({
-            ...resource,
-            workspaceId: workspace.id,
-            providerId: config.resourceProviderId,
-          })),
-        )
-    : [];
+  const resources = await _.chain(config.awsRoleArns)
+    .map((customerRoleArn) =>
+      scanVpcsByAssumedRole(workspaceStsClient, customerRoleArn),
+    )
+    .thru((promises) => Promise.all(promises))
+    .value()
+    .then((results) => results.flat())
+    .then((resources) =>
+      resources.map((resource) => ({
+        ...resource,
+        workspaceId: workspace.id,
+        providerId: config.resourceProviderId,
+      })),
+    );
 
   log.info(`Found ${resources.length} VPC resources`);
 

apps/event-worker/src/resource-scan/azure/aks.ts

@@ -0,0 +1,63 @@
+import type { ManagedCluster } from "@azure/arm-containerservice";
+import { ContainerServiceClient } from "@azure/arm-containerservice";
+import { ClientSecretCredential } from "@azure/identity";
+import { isPresent } from "ts-is-present";
+
+import { eq, takeFirstOrNull } from "@ctrlplane/db";
+import { db } from "@ctrlplane/db/client";
+import * as SCHEMA from "@ctrlplane/db/schema";
+import { logger } from "@ctrlplane/logger";
+
+import { env } from "../../config.js";
+import { convertManagedClusterToResource } from "./cluster-to-resource.js";
+
+const log = logger.child({ label: "resource-scan/azure" });
+
+const AZURE_CLIENT_ID = env.AZURE_APP_CLIENT_ID;
+const AZURE_CLIENT_SECRET = env.AZURE_APP_CLIENT_SECRET;
+
+export const getAksResources = async (
+  workspace: SCHEMA.Workspace,
+  azureProvider: SCHEMA.ResourceProviderAzure,
+) => {
+  if (!AZURE_CLIENT_ID || !AZURE_CLIENT_SECRET) {
+    log.error("Invalid azure credentials, skipping resource scan");
+    return [];
+  }
+
+  const tenant = await db
+    .select()
+    .from(SCHEMA.azureTenant)
+    .where(eq(SCHEMA.azureTenant.id, azureProvider.tenantId))
+    .then(takeFirstOrNull);
+
+  if (!tenant) {
+    log.error("Tenant not found, skipping resource scan");
+    return [];
+  }
+
+  const credential = new ClientSecretCredential(
+    tenant.tenantId,
+    AZURE_CLIENT_ID,
+    AZURE_CLIENT_SECRET,
+  );
+
+  const client = new ContainerServiceClient(
+    credential,
+    azureProvider.subscriptionId,
+  );
+
+  const res = client.managedClusters.list();
+
+  const clusters: ManagedCluster[] = [];
+  for await (const cluster of res) {
+    clusters.push(cluster);
+  }
+
+  const { resourceProviderId: providerId } = azureProvider;
+  return clusters
+    .map((cluster) =>
+      convertManagedClusterToResource(workspace.id, providerId, cluster),
+    )
+    .filter(isPresent);
+};