@cyc-seattle/platform 0.1.0 → 0.2.0

package/README.md

@@ -6,28 +6,59 @@ app owns. The apps that run on it live in their own repos, such as
 
 ## Stacks
 
-| Stack                           | Holds                                                                                                                                                                                                   | Applied by                                                                                                        |
-| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
-| [`bootstrap`](stacks/bootstrap) | Service accounts and project IAM, the Pulumi state buckets and KMS keys, and the org's GitHub repos and settings                                                                                        | A human with project Owner and `gh` `admin:org`. Never CI.                                                        |
-| [`cloud`](stacks/cloud)         | The VPC, the cluster subnet and its Cloud NAT, the private services peering, the prod and dev Cloud SQL instances, the DNS zones, and Artifact Registry                                                 | `deploy-runner`, from Actions after approval. A deployer, with `mise run deploy`, when breaking glass.            |
-| [`cluster`](stacks/cluster)     | The GKE Autopilot cluster, the shared Gateway, its address, certificates, and DNS records, the `dev` namespace with its RBAC, quota, and network policy, and each environment's `platform/outputs.json` | `deploy-runner`, from Actions after approval. A deployer, with `mise run deploy`, when breaking glass.            |
-| [`smoke`](stacks/smoke)         | One `WebService` in dev, at `smoke.dev.cycsail.team`, for the integration tests                                                                                                                         | `deploy-dev`, from Actions on every PR. A deployer, with `PULUMI_STACK=dev mise run deploy`, when breaking glass. |
+| Stack                           | Holds                                                                                                                                                                                                                                                    | Applied by                                                                                                        |
+| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| [`bootstrap`](stacks/bootstrap) | Service accounts and project IAM, the Pulumi state buckets and KMS keys, and the org's GitHub repos and settings                                                                                                                                         | A human with project Owner and `gh` `admin:org`. Never CI.                                                        |
+| [`cloud`](stacks/cloud)         | The VPC, the cluster subnet and its Cloud NAT on a static address, the private services peering, the prod and dev Cloud SQL instances, the DNS zones, and Artifact Registry                                                                              | `deploy-runner`, from Actions after approval. A deployer, with `mise run deploy`, when breaking glass.            |
+| [`cluster`](stacks/cluster)     | The GKE Autopilot cluster, the shared Gateway, its address, certificates, and dev's DNS records, the `dev` and `prod` namespaces with their quotas and network policies, dev's RBAC, the prod Job alerts, and each environment's `platform/outputs.json` | `deploy-runner`, from Actions after approval. A deployer, with `mise run deploy`, when breaking glass.            |
+| [`smoke`](stacks/smoke)         | One `WebService` in dev, at `smoke.dev.cycsail.team`, for the integration tests                                                                                                                                                                          | `deploy-dev`, from Actions on every PR. A deployer, with `PULUMI_STACK=dev mise run deploy`, when breaking glass. |
 
 ## @cyc-seattle/platform
 
 `src/` is the `@cyc-seattle/platform` package, which the stacks here and the apps' stacks import:
 
 - `getPlatformOutputs()` reads an environment's `platform/outputs.json` from its state bucket. The
-  `cluster` stack writes it. Dev stacks can't read prod's backend, so this replaces a
+  `cluster` stack writes it. It holds the environment's namespace and domain, the Gateway and its
+  address (`gatewayAddress`, for an app's own DNS records), and the Cloud SQL instance's connection
+  name and private IP (`sqlHost`). Dev stacks can't read prod's backend, so this replaces a
   StackReference for platform values (cyc-seattle/isthmia#215).
 - `clusterProvider(platform)` builds a Kubernetes provider for the cluster. Its kubeconfig runs
   `gke-gcloud-auth-plugin` with Application Default Credentials, so Pulumi must run under mise,
   where `mise run install` puts the plugin on `PATH`.
-- `WebService` runs an HTTP service behind the environment's Gateway, with secure defaults. Its pods
-  get no IAM; grant roles to its `member`, a Workload Identity principal.
+- `Workload` runs a long-lived process with no route: a Deployment, a ServiceAccount, and, when it
+  has `ports`, a ClusterIP Service that other pods in the namespace reach at `host`.
+- `WebService` is a `Workload` behind the environment's Gateway at `hostname`. Its Service exposes
+  `port` as port 80, and its readiness probe must be an HTTP GET, which the load balancer's health
+  check reuses.
+- `ScheduledJob` runs a CronJob on `schedule`, in `America/Los_Angeles` unless `timeZone` says
+  otherwise. A run never overlaps the one before it, gets an hour, and doesn't retry, by default.
+- All three run non-root with a read-only root filesystem, no capabilities, and no service account
+  token, on Spot pods in dev only. Their limits equal their requests. Their pods get no IAM; grant
+  roles to `member`, a Workload Identity principal, or set `serviceAccountAnnotations` to run as a
+  Google service account.
 - `enableService` enables a Google Cloud API.
 
-`mise run build` builds it into `dist/`, which is all it publishes.
+`mise run build` builds it into `dist/`, which is all it publishes. `.github/workflows/release.yml`
+releases each merge to `main` with semantic-release, versioned by the conventional commits.
+
+## Environments
+
+| Stack  | Namespace | Domain             | Deploy identity |
+| ------ | --------- | ------------------ | --------------- |
+| `dev`  | `dev`     | `dev.cycsail.team` | `deploy-dev`    |
+| `prod` | `prod`    | `cycsail.team`     | `deploy-runner` |
+
+Each namespace denies ingress from other namespaces except the load balancer's. Dev also admits the
+Kubernetes API's service proxy, which the integration tests use, and denies egress to the mail ports
+(25, 465, 587) outside the cluster. `cluster` writes dev's A records; each prod app writes its own,
+pointing at `gatewayAddress`.
+
+`deploy-dev` may administer the `cyc-dev` Cloud SQL instance and read Secret Manager secrets whose IDs
+start with `dev-`. Read them with `gcp.secretmanager.getSecretVersionAccess`, which needs only the
+accessor role.
+
+A Job that fails in `prod`, or a CronJob there with no successful Job in 3 hours, emails each address
+in `cluster:alertEmails`.
 
 ## Setup
 

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { clusterProvider, type ClusterProviderArgs } from "./kubernetes";
 export { getPlatformOutputs, parsePlatformOutputs, platformOutputsSchema, readPlatformOutputs, stateBucket, type PlatformOutputs, type PlatformOutputsArgs, } from "./outputs";
+export { ScheduledJob, type ScheduledJobArgs } from "./scheduled-job";
 export { enableService } from "./services";
 export { WebService, type WebServiceArgs } from "./web-service";
+export { Workload, type PodArgs, type WorkloadArgs, type WorkloadVolume } from "./workload";

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WebService = exports.enableService = exports.stateBucket = exports.readPlatformOutputs = exports.platformOutputsSchema = exports.parsePlatformOutputs = exports.getPlatformOutputs = exports.clusterProvider = void 0;
+exports.Workload = exports.WebService = exports.enableService = exports.ScheduledJob = exports.stateBucket = exports.readPlatformOutputs = exports.platformOutputsSchema = exports.parsePlatformOutputs = exports.getPlatformOutputs = exports.clusterProvider = void 0;
 var kubernetes_1 = require("./kubernetes");
 Object.defineProperty(exports, "clusterProvider", { enumerable: true, get: function () { return kubernetes_1.clusterProvider; } });
 var outputs_1 = require("./outputs");
@@ -9,7 +9,11 @@ Object.defineProperty(exports, "parsePlatformOutputs", { enumerable: true, get:
 Object.defineProperty(exports, "platformOutputsSchema", { enumerable: true, get: function () { return outputs_1.platformOutputsSchema; } });
 Object.defineProperty(exports, "readPlatformOutputs", { enumerable: true, get: function () { return outputs_1.readPlatformOutputs; } });
 Object.defineProperty(exports, "stateBucket", { enumerable: true, get: function () { return outputs_1.stateBucket; } });
+var scheduled_job_1 = require("./scheduled-job");
+Object.defineProperty(exports, "ScheduledJob", { enumerable: true, get: function () { return scheduled_job_1.ScheduledJob; } });
 var services_1 = require("./services");
 Object.defineProperty(exports, "enableService", { enumerable: true, get: function () { return services_1.enableService; } });
 var web_service_1 = require("./web-service");
 Object.defineProperty(exports, "WebService", { enumerable: true, get: function () { return web_service_1.WebService; } });
+var workload_1 = require("./workload");
+Object.defineProperty(exports, "Workload", { enumerable: true, get: function () { return workload_1.Workload; } });

package/dist/outputs.d.ts

@@ -13,6 +13,8 @@ export declare const platformOutputsSchema: z.ZodObject<{
     }, z.core.$strip>;
     domain: z.ZodString;
     sqlConnectionName: z.ZodString;
+    sqlHost: z.ZodString;
+    gatewayAddress: z.ZodString;
     registry: z.ZodString;
 }, z.core.$strip>;
 /** One environment's platform values: where its cluster, Gateway, database, and registry are. */

package/dist/outputs.js

@@ -53,6 +53,10 @@ exports.platformOutputsSchema = zod_1.z.object({
     gateway: zod_1.z.object({ name: zod_1.z.string().min(1), namespace: zod_1.z.string().min(1) }),
     domain: zod_1.z.string().min(1),
     sqlConnectionName: zod_1.z.string().min(1),
+    /** The environment's Cloud SQL private IP, which pods reach directly. */
+    sqlHost: zod_1.z.string().min(1),
+    /** The shared Gateway's IPv4 address, for an app's own DNS records. */
+    gatewayAddress: zod_1.z.string().min(1),
     registry: zod_1.z.string().min(1),
 });
 exports.outputsObject = "platform/outputs.json";

package/dist/scheduled-job.d.ts

@@ -0,0 +1,22 @@
+import * as pulumi from "@pulumi/pulumi";
+import { type PodArgs } from "./workload";
+export interface ScheduledJobArgs extends PodArgs {
+    /** A cron schedule, such as `0 * * * *`. */
+    schedule: string;
+    /** The schedule's time zone. Defaults to `America/Los_Angeles`. */
+    timeZone?: string;
+    /** How long one run may take, in seconds. Defaults to 3600. */
+    activeDeadlineSeconds?: number;
+    /** How many times a failed run retries. Defaults to 0, so the next scheduled run is the retry. */
+    backoffLimit?: number;
+}
+/**
+ * A CronJob with the platform's secure defaults, and a Kubernetes ServiceAccount, both named `name`.
+ * A run never overlaps the one before it. Its pods get no IAM; grant roles to `member`.
+ */
+export declare class ScheduledJob extends pulumi.ComponentResource {
+    /** The pods' Workload Identity principal, for IAM grants. */
+    readonly member: pulumi.Output<string>;
+    readonly serviceAccountName: pulumi.Output<string>;
+    constructor(name: string, args: ScheduledJobArgs, opts?: pulumi.ComponentResourceOptions);
+}

package/dist/scheduled-job.js

@@ -0,0 +1,82 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScheduledJob = void 0;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const workload_1 = require("./workload");
+/**
+ * A CronJob with the platform's secure defaults, and a Kubernetes ServiceAccount, both named `name`.
+ * A run never overlaps the one before it. Its pods get no IAM; grant roles to `member`.
+ */
+class ScheduledJob extends pulumi.ComponentResource {
+    /** The pods' Workload Identity principal, for IAM grants. */
+    member;
+    serviceAccountName;
+    constructor(name, args, opts) {
+        super("cyc-seattle:platform:ScheduledJob", name, {}, opts);
+        (0, workload_1.checkRequests)("ScheduledJob", name, args.requests);
+        const platform = pulumi.output(args.platform);
+        const labels = { "app.kubernetes.io/name": name };
+        const child = { parent: this, provider: args.provider };
+        const account = (0, workload_1.serviceAccount)(name, args, child);
+        new k8s.batch.v1.CronJob(name, {
+            metadata: { name, namespace: platform.namespace, labels },
+            spec: {
+                schedule: args.schedule,
+                timeZone: args.timeZone ?? "America/Los_Angeles",
+                concurrencyPolicy: "Forbid",
+                jobTemplate: {
+                    metadata: { labels },
+                    spec: {
+                        activeDeadlineSeconds: args.activeDeadlineSeconds ?? 3600,
+                        backoffLimit: args.backoffLimit ?? 0,
+                        template: {
+                            metadata: { labels },
+                            spec: (0, workload_1.podSpec)(name, args, account.metadata.name).apply((spec) => ({
+                                ...spec,
+                                restartPolicy: "Never",
+                            })),
+                        },
+                    },
+                },
+            },
+        }, child);
+        this.serviceAccountName = account.metadata.name;
+        this.member = (0, workload_1.workloadMember)(platform, this.serviceAccountName);
+        this.registerOutputs({ member: this.member, serviceAccountName: this.serviceAccountName });
+    }
+}
+exports.ScheduledJob = ScheduledJob;

package/dist/web-service.d.ts

@@ -1,40 +1,30 @@
 import * as k8s from "@pulumi/kubernetes";
 import * as pulumi from "@pulumi/pulumi";
-import type { PlatformOutputs } from "./outputs";
+import { type WorkloadArgs } from "./workload";
 type Probe = k8s.types.input.core.v1.Probe;
-export interface WebServiceArgs {
-    /** The environment's platform values, from `getPlatformOutputs`. */
-    platform: pulumi.Input<PlatformOutputs>;
-    /** The environment's cluster, from `clusterProvider`. Required, so it never uses a local kubeconfig. */
-    provider: k8s.Provider;
+export interface WebServiceArgs extends WorkloadArgs {
     /** The public hostname. It must be in the environment's domain. */
     hostname: string;
-    image: pulumi.Input<string>;
-    /** The port the container serves HTTP on. */
+    /** The port the container serves HTTP on. The Service exposes it as port 80, named `http`. */
     port: number;
-    requests: {
-        cpu: pulumi.Input<string>;
-        memory: pulumi.Input<string>;
-    };
     /** An HTTP GET probe. The load balancer's health check uses the same path. */
     readinessProbe: Probe & {
         httpGet: pulumi.Input<k8s.types.input.core.v1.HTTPGetAction>;
     };
-    livenessProbe?: Probe;
-    env?: pulumi.Input<k8s.types.input.core.v1.EnvVar>[];
-    replicas?: number;
-    /** Needed when the image's user is a name, which `runAsNonRoot` can't check. */
-    runAsUser?: number;
 }
 /** Returns `hostname` if it is the environment's domain or a name under it, and throws otherwise. */
 export declare function checkHostname(hostname: string, domain: string): string;
 /**
- * An HTTP service behind the environment's shared Gateway: a Deployment, a Service, an HTTPRoute, a
- * Kubernetes ServiceAccount, and a HealthCheckPolicy. Its pods get no IAM; grant roles to `member`.
+ * An HTTP service behind the environment's shared Gateway: a `Workload`'s Deployment, Service, and
+ * Kubernetes ServiceAccount, plus an HTTPRoute and a HealthCheckPolicy. Its pods get no IAM; grant
+ * roles to `member`.
  */
 export declare class WebService extends pulumi.ComponentResource {
     /** The pods' Workload Identity principal, for IAM grants. */
     readonly member: pulumi.Output<string>;
+    readonly serviceAccountName: pulumi.Output<string>;
+    /** The name other pods in the namespace reach its Service by, on port 80. */
+    readonly host: string;
     readonly url: pulumi.Output<string>;
     constructor(name: string, args: WebServiceArgs, opts?: pulumi.ComponentResourceOptions);
 }

package/dist/web-service.js

@@ -37,6 +37,7 @@ exports.WebService = void 0;
 exports.checkHostname = checkHostname;
 const k8s = __importStar(require("@pulumi/kubernetes"));
 const pulumi = __importStar(require("@pulumi/pulumi"));
+const workload_1 = require("./workload");
 /** Returns `hostname` if it is the environment's domain or a name under it, and throws otherwise. */
 function checkHostname(hostname, domain) {
     const host = hostname.toLowerCase();
@@ -47,76 +48,29 @@ function checkHostname(hostname, domain) {
     return hostname;
 }
 /**
- * An HTTP service behind the environment's shared Gateway: a Deployment, a Service, an HTTPRoute, a
- * Kubernetes ServiceAccount, and a HealthCheckPolicy. Its pods get no IAM; grant roles to `member`.
+ * An HTTP service behind the environment's shared Gateway: a `Workload`'s Deployment, Service, and
+ * Kubernetes ServiceAccount, plus an HTTPRoute and a HealthCheckPolicy. Its pods get no IAM; grant
+ * roles to `member`.
  */
 class WebService extends pulumi.ComponentResource {
     /** The pods' Workload Identity principal, for IAM grants. */
     member;
+    serviceAccountName;
+    /** The name other pods in the namespace reach its Service by, on port 80. */
+    host;
     url;
     constructor(name, args, opts) {
         super("cyc-seattle:platform:WebService", name, {}, opts);
-        // The types already require these, but a JavaScript caller or a cast can skip them.
-        if (!args.requests?.cpu || !args.requests?.memory) {
-            throw new Error(`WebService "${name}" needs CPU and memory requests.`);
-        }
+        (0, workload_1.checkRequests)("WebService", name, args.requests);
         if (!args.readinessProbe?.httpGet) {
             throw new Error(`WebService "${name}" needs an HTTP readiness probe.`);
         }
         const platform = pulumi.output(args.platform);
-        const namespace = platform.namespace;
         // A bad hostname fails the HTTPRoute's registration, so preview fails before anything applies.
         const hostname = platform.domain.apply((domain) => checkHostname(args.hostname, domain));
-        // The namespace is the environment's name.
-        const spot = namespace.apply((ns) => ns === "dev");
-        const labels = { "app.kubernetes.io/name": name };
-        const metadata = { name, namespace, labels };
+        const metadata = { name, namespace: platform.namespace, labels: { "app.kubernetes.io/name": name } };
         const child = { parent: this, provider: args.provider };
-        const serviceAccount = new k8s.core.v1.ServiceAccount(name, { metadata, automountServiceAccountToken: false }, child);
-        new k8s.apps.v1.Deployment(name, {
-            metadata,
-            spec: {
-                replicas: args.replicas ?? 1,
-                selector: { matchLabels: labels },
-                template: {
-                    metadata: { labels },
-                    spec: {
-                        serviceAccountName: serviceAccount.metadata.name,
-                        automountServiceAccountToken: false,
-                        // Autopilot schedules a pod with this selector on Spot capacity.
-                        nodeSelector: spot.apply((s) => (s ? { "cloud.google.com/gke-spot": "true" } : {})),
-                        securityContext: {
-                            runAsNonRoot: true,
-                            seccompProfile: { type: "RuntimeDefault" },
-                            ...(args.runAsUser !== undefined && { runAsUser: args.runAsUser, runAsGroup: args.runAsUser }),
-                        },
-                        containers: [
-                            {
-                                name,
-                                image: args.image,
-                                ports: [{ name: "http", containerPort: args.port }],
-                                resources: { requests: args.requests },
-                                readinessProbe: args.readinessProbe,
-                                ...(args.livenessProbe && { livenessProbe: args.livenessProbe }),
-                                ...(args.env && { env: args.env }),
-                                securityContext: {
-                                    allowPrivilegeEscalation: false,
-                                    readOnlyRootFilesystem: true,
-                                    capabilities: { drop: ["ALL"] },
-                                },
-                            },
-                        ],
-                    },
-                },
-            },
-        }, child);
-        const service = new k8s.core.v1.Service(name, {
-            metadata,
-            spec: {
-                selector: labels,
-                ports: [{ name: "http", port: 80, targetPort: "http" }],
-            },
-        }, child);
+        const { serviceAccount, service } = (0, workload_1.deployment)(this, name, args, args.port);
         new k8s.apiextensions.CustomResource(name, {
             apiVersion: "gateway.networking.k8s.io/v1",
             kind: "HTTPRoute",
@@ -145,9 +99,16 @@ class WebService extends pulumi.ComponentResource {
                 targetRef: { group: "", kind: "Service", name: service.metadata.name },
             },
         }, child);
-        this.member = pulumi.interpolate `principal://iam.googleapis.com/projects/${platform.projectNumber}/locations/global/workloadIdentityPools/${platform.project}.svc.id.goog/subject/ns/${namespace}/sa/${serviceAccount.metadata.name}`;
+        this.serviceAccountName = serviceAccount.metadata.name;
+        this.member = (0, workload_1.workloadMember)(platform, this.serviceAccountName);
+        this.host = name;
         this.url = pulumi.interpolate `https://${hostname}/`;
-        this.registerOutputs({ member: this.member, url: this.url });
+        this.registerOutputs({
+            member: this.member,
+            serviceAccountName: this.serviceAccountName,
+            host: this.host,
+            url: this.url,
+        });
     }
 }
 exports.WebService = WebService;

package/dist/workload.d.ts

@@ -0,0 +1,83 @@
+import * as k8s from "@pulumi/kubernetes";
+import * as pulumi from "@pulumi/pulumi";
+import type { PlatformOutputs } from "./outputs";
+type Probe = k8s.types.input.core.v1.Probe;
+type EnvVar = k8s.types.input.core.v1.EnvVar;
+type EnvFromSource = k8s.types.input.core.v1.EnvFromSource;
+/** A volume and where the container mounts it. Give exactly one of `emptyDir`, `configMap`, or `secret`. */
+export interface WorkloadVolume {
+    name: string;
+    mountPath: string;
+    emptyDir?: {
+        sizeLimit?: string;
+    };
+    /** A ConfigMap's name. */
+    configMap?: pulumi.Input<string>;
+    /** A Secret's name. */
+    secret?: pulumi.Input<string>;
+    subPath?: string;
+    readOnly?: boolean;
+}
+/** What every pod of `Workload`, `WebService`, and `ScheduledJob` takes. */
+export interface PodArgs {
+    /** The environment's platform values, from `getPlatformOutputs`. */
+    platform: pulumi.Input<PlatformOutputs>;
+    /** The environment's cluster, from `clusterProvider`. Required, so it never uses a local kubeconfig. */
+    provider: k8s.Provider;
+    image: pulumi.Input<string>;
+    command?: string[];
+    args?: string[];
+    /** The container's requests, which are also its limits. */
+    requests: {
+        cpu: pulumi.Input<string>;
+        memory: pulumi.Input<string>;
+    };
+    env?: pulumi.Input<EnvVar>[];
+    envFrom?: pulumi.Input<EnvFromSource>[];
+    volumes?: WorkloadVolume[];
+    /** Needed when the image's user is a name, which `runAsNonRoot` can't check. Also sets the group. */
+    runAsUser?: number;
+    /** Annotations on the Kubernetes ServiceAccount, such as `iam.gke.io/gcp-service-account`. */
+    serviceAccountAnnotations?: Record<string, string>;
+}
+export interface WorkloadArgs extends PodArgs {
+    /** The container's ports. The Service exposes each at the same number. Without any, there's no Service. */
+    ports?: {
+        name: string;
+        port: number;
+    }[];
+    readinessProbe?: Probe;
+    livenessProbe?: Probe;
+    startupProbe?: Probe;
+    /** Defaults to 1. */
+    replicas?: number;
+}
+/** The pods' Workload Identity principal, for IAM grants. */
+export declare function workloadMember(platform: pulumi.Output<PlatformOutputs>, serviceAccountName: pulumi.Input<string>): pulumi.Output<string>;
+export declare function checkRequests(kind: string, name: string, requests: PodArgs["requests"] | undefined): void;
+/** A ServiceAccount named `name` that mounts no token. */
+export declare function serviceAccount(name: string, args: PodArgs, opts: pulumi.CustomResourceOptions): k8s.core.v1.ServiceAccount;
+/** A pod spec with the platform's secure defaults: non-root, read-only, no token, and Spot in dev only. */
+export declare function podSpec(name: string, args: PodArgs, serviceAccountName: pulumi.Input<string>, container?: Partial<k8s.types.input.core.v1.Container>): pulumi.Output<k8s.types.input.core.v1.PodSpec>;
+export interface DeploymentParts {
+    serviceAccount: k8s.core.v1.ServiceAccount;
+    service?: k8s.core.v1.Service;
+}
+/**
+ * The Deployment, ServiceAccount, and Service of a `Workload` or a `WebService`, as children of
+ * `parent`. `http` is a `WebService`'s port, which its Service exposes as port 80.
+ */
+export declare function deployment(parent: pulumi.Resource, name: string, args: WorkloadArgs, http?: number): DeploymentParts;
+/**
+ * A long-running process with no route: a Deployment, a Kubernetes ServiceAccount, and, when it has
+ * ports, a ClusterIP Service, all named `name`. Its pods get no IAM; grant roles to `member`.
+ */
+export declare class Workload extends pulumi.ComponentResource {
+    /** The pods' Workload Identity principal, for IAM grants. */
+    readonly member: pulumi.Output<string>;
+    readonly serviceAccountName: pulumi.Output<string>;
+    /** The name other pods in the namespace reach its Service by. */
+    readonly host: string;
+    constructor(name: string, args: WorkloadArgs, opts?: pulumi.ComponentResourceOptions);
+}
+export {};

package/dist/workload.js

@@ -0,0 +1,180 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Workload = void 0;
+exports.workloadMember = workloadMember;
+exports.checkRequests = checkRequests;
+exports.serviceAccount = serviceAccount;
+exports.podSpec = podSpec;
+exports.deployment = deployment;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+/** The pods' Workload Identity principal, for IAM grants. */
+function workloadMember(platform, serviceAccountName) {
+    return pulumi.interpolate `principal://iam.googleapis.com/projects/${platform.projectNumber}/locations/global/workloadIdentityPools/${platform.project}.svc.id.goog/subject/ns/${platform.namespace}/sa/${serviceAccountName}`;
+}
+function checkRequests(kind, name, requests) {
+    // The types already require them, but a JavaScript caller or a cast can skip them.
+    if (!requests?.cpu || !requests?.memory) {
+        throw new Error(`${kind} "${name}" needs CPU and memory requests.`);
+    }
+}
+/** A ServiceAccount named `name` that mounts no token. */
+function serviceAccount(name, args, opts) {
+    const platform = pulumi.output(args.platform);
+    return new k8s.core.v1.ServiceAccount(name, {
+        metadata: {
+            name,
+            namespace: platform.namespace,
+            labels: { "app.kubernetes.io/name": name },
+            ...(args.serviceAccountAnnotations && { annotations: args.serviceAccountAnnotations }),
+        },
+        automountServiceAccountToken: false,
+    }, opts);
+}
+/** A pod spec with the platform's secure defaults: non-root, read-only, no token, and Spot in dev only. */
+function podSpec(name, args, serviceAccountName, container = {}) {
+    const volumes = args.volumes ?? [];
+    // The namespace is the environment's name.
+    return pulumi.output(args.platform).namespace.apply((namespace) => ({
+        serviceAccountName,
+        automountServiceAccountToken: false,
+        // Autopilot schedules a pod with this selector on Spot capacity.
+        nodeSelector: namespace === "dev" ? { "cloud.google.com/gke-spot": "true" } : {},
+        securityContext: {
+            runAsNonRoot: true,
+            seccompProfile: { type: "RuntimeDefault" },
+            ...(args.runAsUser !== undefined && { runAsUser: args.runAsUser, runAsGroup: args.runAsUser }),
+        },
+        ...(volumes.length > 0 && {
+            volumes: volumes.map((v) => ({
+                name: v.name,
+                ...(v.emptyDir && { emptyDir: v.emptyDir }),
+                ...(v.configMap !== undefined && { configMap: { name: v.configMap } }),
+                ...(v.secret !== undefined && { secret: { secretName: v.secret } }),
+            })),
+        }),
+        containers: [
+            {
+                name,
+                image: args.image,
+                ...(args.command && { command: args.command }),
+                ...(args.args && { args: args.args }),
+                ...container,
+                // A LimitRange's default limit could otherwise sit below the request, which the API refuses.
+                resources: { requests: args.requests, limits: args.requests },
+                ...(args.env && { env: args.env }),
+                ...(args.envFrom && { envFrom: args.envFrom }),
+                ...(volumes.length > 0 && {
+                    volumeMounts: volumes.map((v) => ({
+                        name: v.name,
+                        mountPath: v.mountPath,
+                        ...(v.subPath !== undefined && { subPath: v.subPath }),
+                        ...(v.readOnly !== undefined && { readOnly: v.readOnly }),
+                    })),
+                }),
+                securityContext: {
+                    allowPrivilegeEscalation: false,
+                    readOnlyRootFilesystem: true,
+                    capabilities: { drop: ["ALL"] },
+                },
+            },
+        ],
+    }));
+}
+/**
+ * The Deployment, ServiceAccount, and Service of a `Workload` or a `WebService`, as children of
+ * `parent`. `http` is a `WebService`'s port, which its Service exposes as port 80.
+ */
+function deployment(parent, name, args, http) {
+    const platform = pulumi.output(args.platform);
+    const labels = { "app.kubernetes.io/name": name };
+    const metadata = { name, namespace: platform.namespace, labels };
+    const child = { parent, provider: args.provider };
+    const account = serviceAccount(name, args, child);
+    const ports = [...(http !== undefined ? [{ name: "http", port: http }] : []), ...(args.ports ?? [])];
+    new k8s.apps.v1.Deployment(name, {
+        metadata,
+        spec: {
+            replicas: args.replicas ?? 1,
+            selector: { matchLabels: labels },
+            template: {
+                metadata: { labels },
+                spec: podSpec(name, args, account.metadata.name, {
+                    ...(ports.length > 0 && { ports: ports.map((p) => ({ name: p.name, containerPort: p.port })) }),
+                    ...(args.readinessProbe && { readinessProbe: args.readinessProbe }),
+                    ...(args.livenessProbe && { livenessProbe: args.livenessProbe }),
+                    ...(args.startupProbe && { startupProbe: args.startupProbe }),
+                }),
+            },
+        },
+    }, child);
+    if (ports.length === 0) {
+        return { serviceAccount: account };
+    }
+    const service = new k8s.core.v1.Service(name, {
+        metadata,
+        spec: {
+            selector: labels,
+            ports: ports.map((p) => ({
+                name: p.name,
+                port: p.name === "http" && http !== undefined ? 80 : p.port,
+                targetPort: p.name,
+            })),
+        },
+    }, child);
+    return { serviceAccount: account, service };
+}
+/**
+ * A long-running process with no route: a Deployment, a Kubernetes ServiceAccount, and, when it has
+ * ports, a ClusterIP Service, all named `name`. Its pods get no IAM; grant roles to `member`.
+ */
+class Workload extends pulumi.ComponentResource {
+    /** The pods' Workload Identity principal, for IAM grants. */
+    member;
+    serviceAccountName;
+    /** The name other pods in the namespace reach its Service by. */
+    host;
+    constructor(name, args, opts) {
+        super("cyc-seattle:platform:Workload", name, {}, opts);
+        checkRequests("Workload", name, args.requests);
+        const { serviceAccount } = deployment(this, name, args);
+        this.serviceAccountName = serviceAccount.metadata.name;
+        this.member = workloadMember(pulumi.output(args.platform), this.serviceAccountName);
+        this.host = name;
+        this.registerOutputs({ member: this.member, serviceAccountName: this.serviceAccountName, host: this.host });
+    }
+}
+exports.Workload = Workload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyc-seattle/platform",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Pulumi components for CYC's shared Google Cloud platform: WebService, the platform outputs reader, and the stacks that build the platform",
   "author": "CYC Community Sailing Center",
   "license": "Apache-2.0",