@hulumi/k8s-baseline

Hardened-by-default Pulumi component resources for Kubernetes / EKS / Istio / RDS / Secrets-Manager. Drop-in replacements for raw Helm releases, EKS subnet tagging, Istio installation, and ALB-meshed entrypoints with PSA-baseline-clean defaults wired up correctly out of the box.

Part of the Hulumi toolkit. Apache-2.0. SLSA Build L3 attestation on every published tarball.

Install

pnpm add @hulumi/k8s-baseline @pulumi/kubernetes @pulumi/aws @pulumi/pulumi

@hulumi/[email protected] accepts any caret-compatible Pulumi SDK (@pulumi/kubernetes 4.x, @pulumi/aws 7.x, @pulumi/pulumi 3.x). The versions Hulumi is tested against are listed in this package's peerDependencies — that's the floor, not a ceiling.

Components

| Component | Purpose | | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | EksClusterFoundation | Create/adopt EKS cluster foundation with private/restricted endpoint posture, audit logging, Pod Identity association hooks, and IMDSv2 managed node launch templates | | HardenedHelmRelease | Helm release with exact chart-version pinning (no latest, no semver ranges), enforced https:///oci:// repository scheme, PSA-baseline labels, default release-name stability | | MetricsServer | Kubernetes Metrics API install for HPA telemetry with secure-by-default APIService TLS | | EksSubnetTagger | Auto-tag EKS-bound subnets with kubernetes.io/role/{,internal-}elb | | EksAdminAccessPath | Auditable EKS operator access path for private or restricted-public control-plane hardening | | IstioFoundation | Bundled hardened Istio install (istiod + istio-cni + ingressgateway, PSA-baseline-clean) | | AlbMeshedHttpEntrypoint | ALB Ingress + Istio Gateway + VirtualService + AuthorizationPolicy for one workload | | KubernetesSecretFromAwsSecretsManager | K8s Secret from an AWS Secrets Manager value, fail-closed on JSON-shape violations | | RdsCredentialSecret | Extract RDS auto-managed master credential into a K8s Secret with fail-closed semantics | | GitHubAppCredential | Secrets Manager container + JWT-mint helper bundle for GitHub App credential rotation |

Quick-start — IstioFoundation

import { IstioFoundation } from "@hulumi/k8s-baseline";

const istio = new IstioFoundation("istio", {
  k8sProvider: cluster.provider,
  meshId: "my-mesh",
  network: "primary",
});

Quick-start — KubernetesSecretFromAwsSecretsManager

import { KubernetesSecretFromAwsSecretsManager } from "@hulumi/k8s-baseline";

const apiKey = new KubernetesSecretFromAwsSecretsManager("api-key", {
  k8sProvider: cluster.provider,
  namespace: "production",
  secretName: "third-party-api-key",
  awsSecretArn: "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/api-key-XYZ",
  failureMode: "fail", // or "degrade"
});

failureMode: "fail" (the default) refuses to apply the K8s Secret if the AWS source value is not a JSON object — preventing accidental plaintext leakage. See docs/components/kubernetes-secret-from-asm.md.

Compatibility

Tested chart and Pulumi-provider version matrix lives in COMPATIBILITY.md. Bumps to chart pins go through the same supply-chain discipline as @pulumi/* exact pins.

Verifying SLSA attestations

Every published tarball ships with GitHub Artifact Attestations provenance from the reusable sign-and-publish.yml release lane. Verify before installing:

pnpm pack @hulumi/[email protected] --pack-destination .
gh attestation verify ./hulumi-k8s-baseline-1.5.0.tgz \
  --repo kerberosmansour/hulumi

Documentation

• Component reference
• Cookbooks — including psa-baseline-istio-sidecar.md
• Architecture

License

Apache-2.0 — see LICENSE and the project-level NOTICE.