@intentius/behold 0.4.1 → 0.5.0

package/example-k8s/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "behold-example-k8s",
+  "private": true,
+  "type": "module",
+  "description": "A small nginx Deployment+Service on k3d — behold's k3d turnkey demo (#88), the Kubernetes counterpart to Loom-on-Floci.",
+  "scripts": {
+    "build": "./node_modules/.bin/chant build src --lexicon k8s -o app.yaml"
+  },
+  "dependencies": {
+    "@intentius/chant": "^0.32.0",
+    "@intentius/chant-lexicon-k8s": "^0.32.0",
+    "@intentius/chant-lexicon-temporal": "^0.32.0"
+  }
+}

package/example-k8s/scripts/local/local-down.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Tear down behold's k3d turnkey demo cluster (#88) and restore whatever
+# kubectl context was current before local-up.sh ran. Safe to run even if the
+# cluster is already gone (k3d's delete is then a no-op).
+set -euo pipefail
+cd "$(dirname "$0")"
+
+CLUSTER=behold-k3d-demo
+STATE=".prev-context"
+
+if command -v k3d >/dev/null 2>&1; then
+  k3d cluster delete "$CLUSTER" >/dev/null 2>&1 || true
+fi
+
+if [ -f "$STATE" ]; then
+  prev="$(cat "$STATE")"
+  rm -f "$STATE"
+  if [ -n "$prev" ] && kubectl config get-contexts "$prev" >/dev/null 2>&1; then
+    kubectl config use-context "$prev" >/dev/null 2>&1 || true
+    echo "behold k3d demo: restored kubectl context \"$prev\"."
+  fi
+fi
+echo "behold k3d demo: cluster \"$CLUSTER\" removed."

package/example-k8s/scripts/local/local-up.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Bring up the local, single-node k3d cluster behold's k3d turnkey demo (#88)
+# deploys to. Docker + k3d only — no cloud account, no credentials. Idempotent:
+# a cluster of this name already up is left alone.
+#
+# Safety: never touches any OTHER kubeconfig context. Whatever context is
+# current before k3d switches it is saved to .prev-context and restored by
+# local-down.sh; the cluster and its context are uniquely named to this demo
+# (behold-k3d-demo / k3d-behold-k3d-demo) so nothing pre-existing is renamed,
+# reused, or deleted.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+CLUSTER=behold-k3d-demo
+CONTEXT="k3d-${CLUSTER}"
+STATE=".prev-context"
+
+if ! docker info >/dev/null 2>&1; then
+  echo "behold k3d demo: Docker is not running — start Docker and re-run this script." >&2
+  exit 1
+fi
+if ! command -v k3d >/dev/null 2>&1; then
+  echo "behold k3d demo: k3d is not installed — see https://k3d.io/#installation." >&2
+  exit 1
+fi
+
+if k3d cluster list "$CLUSTER" --no-headers 2>/dev/null | grep -q .; then
+  echo "behold k3d demo: cluster \"$CLUSTER\" already up — reusing."
+else
+  # Save whatever context is current BEFORE k3d switches it, so local-down.sh
+  # can restore it. Only written once: a later local-up (already-up cluster,
+  # different code path above) must never overwrite an earlier save with our
+  # own context.
+  if [ ! -f "$STATE" ]; then
+    kubectl config current-context > "$STATE" 2>/dev/null || : > "$STATE"
+  fi
+  echo "behold k3d demo: creating single-node cluster \"$CLUSTER\"…"
+  k3d cluster create "$CLUSTER" --servers 1 --agents 0 --wait --timeout 120s
+fi
+
+current="$(kubectl config current-context 2>/dev/null || true)"
+if [ "$current" != "$CONTEXT" ]; then
+  echo "behold k3d demo: expected kubectl context \"$CONTEXT\" to be current after cluster create, got \"$current\" — aborting rather than reading the wrong cluster." >&2
+  exit 1
+fi
+echo "behold k3d demo: cluster \"$CLUSTER\" up, kubectl context \"$CONTEXT\" active."

package/example-k8s/src/config.ts

@@ -0,0 +1,5 @@
+// Shared, static configuration — plain `const` values, resolved at synthesis.
+export const appName = "web";
+
+// A pinned image tag — chant's lint flags `:latest` or an untagged image.
+export const image = "nginxinc/nginx-unprivileged:1.27-alpine";

package/example-k8s/src/web.ts

@@ -0,0 +1,29 @@
+// The whole "infra": one small web app. `WebApp` is a composite — a typed call
+// that expands to a Deployment, a Service, and a PodDisruptionBudget — deployed
+// via `ops/k3d-apply.op.ts` to a local k3d cluster (scripts/local/local-up.sh),
+// no cloud account. The Deployment's replicas are the runtime tier's example:
+// its Pods aren't declared here, but a live cluster owns them.
+import { WebApp } from "@intentius/chant-lexicon-k8s";
+import { appName, image } from "./config";
+
+const web = WebApp({
+  name: appName,
+  image,
+  port: 8080,
+  replicas: 2,
+  minAvailable: 1,
+  cpuRequest: "50m",
+  memoryRequest: "64Mi",
+  cpuLimit: "200m",
+  memoryLimit: "128Mi",
+  securityContext: {
+    runAsNonRoot: true,
+    runAsUser: 101,
+    allowPrivilegeEscalation: false,
+    capabilities: { drop: ["ALL"] },
+  },
+});
+
+export const deployment = web.deployment;
+export const service = web.service;
+export const pdb = web.pdb!;

package/example-k8s/tsconfig.json

@@ -0,0 +1 @@
+{ "compilerOptions": { "target": "ES2022", "module": "ESNext", "moduleResolution": "Bundler", "strict": true, "skipLibCheck": true, "noEmit": true }, "include": ["src/**/*", "ops/**/*", "chant.config.ts"] }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/behold",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "type": "module",
   "description": "behold — a live control plane on chant. See your whole estate (every substrate in one graph), coloured by drift; act through delegated, gated Ops.",
   "bin": {
@@ -11,6 +11,8 @@
     "dist",
     "web",
     "example-writes",
+    "example-k8s",
+    "demos.json",
     "AGENTS.md"
   ],
   "publishConfig": {