@intentius/chant-lexicon-aws 0.41.11 → 0.41.12

package/dist/composites/eks-cluster.d.ts

@@ -17,6 +17,19 @@ export interface EksClusterProps {
         /** Subnets the nodes land in. Default: the cluster's own `subnetIds`. */
         subnetIds?: string[];
     };
+    /**
+     * Managed add-ons to install, by name (e.g. "eks-pod-identity-agent" —
+     * without which an AWS::EKS::PodIdentityAssociation delivers no
+     * credentials and the workload it binds crashloops on startup, found on
+     * kubemicrovm-ops' first real deploy). Named by the caller, never guessed;
+     * versions omitted take EKS's default. Up to three (fixed member slots
+     * `addon1..addon3`, keyed by position — the statically-evaluable shape);
+     * an estate needing more declares the rest as bare Addon resources.
+     */
+    addons?: Array<{
+        name: string;
+        version?: string;
+    }>;
     tags?: Array<{
         Key: string;
         Value: string;
@@ -29,11 +42,15 @@ export interface EksClusterProps {
     };
 }
 export declare const EksCluster: import("@intentius/chant").CompositeDefinition<EksClusterProps, {
+    addon3?: (import("@intentius/chant").Declarable & Record<string, string>) | undefined;
+    addon2?: (import("@intentius/chant").Declarable & Record<string, string>) | undefined;
+    addon1?: (import("@intentius/chant").Declarable & Record<string, string>) | undefined;
     clusterRole: import("@intentius/chant").Declarable & Record<string, string>;
     cluster: import("@intentius/chant").Declarable & Record<string, string>;
-    nodeRole?: undefined;
-    nodegroup?: undefined;
 } | {
+    addon3?: (import("@intentius/chant").Declarable & Record<string, string>) | undefined;
+    addon2?: (import("@intentius/chant").Declarable & Record<string, string>) | undefined;
+    addon1?: (import("@intentius/chant").Declarable & Record<string, string>) | undefined;
     clusterRole: import("@intentius/chant").Declarable & Record<string, string>;
     cluster: import("@intentius/chant").Declarable & Record<string, string>;
     nodeRole: import("@intentius/chant").Declarable & Record<string, string>;

package/dist/composites/eks-cluster.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eks-cluster.d.ts","sourceRoot":"","sources":["../../src/composites/eks-cluster.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAG3D,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,SAAS,CAAC,EAAE;QACV,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,yEAAyE;QACzE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAID,eAAO,MAAM,UAAU;;;;;;;;;;EA6DP,CAAC"}
+{"version":3,"file":"eks-cluster.d.ts","sourceRoot":"","sources":["../../src/composites/eks-cluster.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAS,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAGlE,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,SAAS,CAAC,EAAE;QACV,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,yEAAyE;QACzE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAID,eAAO,MAAM,UAAU;;;;;;;;;;;;;;EA8FP,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "eaab3a1b932cbd387d26b69caf57a0247fa005e85ea447a54f86f7b907488752",
+    "manifest.json": "c30f447783709ca1501f1c4dbc4648568b08f07fc63fb322cbfeb75cd713740b",
     "meta.json": "2e4cae67cbc2eb2962c3dd0aa57008ae96fb725dd0118af7b04b2b44eab7722a",
     "types/index.d.ts": "6d6b37bd14a9b40fb3ff5c66e1cb49be1ae1032de47a4e167cf5f411c943b7f5",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
@@ -59,5 +59,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "f4c6fe1c702250665f90d82b3bdaba5ea50ae75e380a8ae321dad6eb1c39683e"
   },
-  "composite": "681d59c798f87b5621cd38e258f4841d94f78268b04c71debaf203ba56d70ce2"
+  "composite": "d028551030c4fcd1fce01daf33202ddd5bc1e33fe417025dd6df378e7f2a6cbb"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.41.11",
+  "version": "0.41.12",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.41.11",
+  "version": "0.41.12",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.41.11",
+    "@intentius/chant": "^0.41.12",
     "typescript": "^5.9.3"
   }
 }

package/src/composites/eks-cluster.test.ts

@@ -15,21 +15,26 @@ describe("EksCluster", () => {
     expect(clusterProps.ResourcesVpcConfig.SubnetIds).toEqual(subnets);
   });
 
+  // The composite's return is a union (nodegroup-less vs full), and the
+  // repo-wide typecheck rightly refuses to narrow it structurally — tests go
+  // through a member map, the same access the expander itself uses.
+  type Members = Record<string, { props?: Record<string, any> } | undefined>;
+
   test("with a nodegroup: node role carries the three worker policies, nodes default into the cluster subnets", () => {
     const c = EksCluster({
       name: "kmv-prod",
       subnetIds: subnets,
       version: "1.31",
       nodegroup: { desiredSize: 2 },
-    });
+    }) as unknown as Members;
     expect(c.nodegroup).toBeDefined();
     expect(c.nodeRole).toBeDefined();
-    const ngProps = (c.nodegroup as any).props;
+    const ngProps = c.nodegroup!.props!;
     expect(ngProps.ClusterName).toBe("kmv-prod");
     expect(ngProps.Subnets).toEqual(subnets);
     expect(ngProps.ScalingConfig.MinSize).toBe(2);
     expect(ngProps.ScalingConfig.MaxSize).toBe(2);
-    expect((c.nodeRole as any).props.ManagedPolicyArns).toHaveLength(3);
+    expect(c.nodeRole!.props!.ManagedPolicyArns).toHaveLength(3);
   });
 
   test("nodegroup subnets override; scaling bounds honor explicit min/max", () => {
@@ -37,8 +42,8 @@ describe("EksCluster", () => {
       name: "kmv-ha",
       subnetIds: subnets,
       nodegroup: { subnetIds: ["subnet-nodes"], desiredSize: 2, minSize: 1, maxSize: 4 },
-    });
-    const ng2 = (c.nodegroup as any).props;
+    }) as unknown as Members;
+    const ng2 = c.nodegroup!.props!;
     expect(ng2.Subnets).toEqual(["subnet-nodes"]);
     expect(ng2.ScalingConfig.MinSize).toBe(1);
     expect(ng2.ScalingConfig.MaxSize).toBe(4);
@@ -52,4 +57,17 @@ describe("EksCluster", () => {
     });
     expect((c.cluster as any).props.DeletionProtection).toBe(true);
   });
+
+  test("addons become keyed members, DependsOn the cluster (the pod-identity agent case)", () => {
+    const c = EksCluster({
+      name: "kmv-real",
+      subnetIds: subnets,
+      nodegroup: {},
+      addons: [{ name: "eks-pod-identity-agent" }],
+    }) as unknown as Members;
+    const addon = c.addon1;
+    expect(addon).toBeDefined();
+    expect(addon!.props?.AddonName).toBe("eks-pod-identity-agent");
+    expect(addon!.props?.ClusterName).toBe("kmv-real");
+  });
 });

package/src/composites/eks-cluster.ts

@@ -25,7 +25,7 @@
  * emulator being honest about what a laptop can host.
  */
 import { Composite, mergeDefaults } from "@intentius/chant";
-import { EKSCluster, Nodegroup, Role } from "../generated";
+import { Addon, EKSCluster, Nodegroup, Role } from "../generated";
 import { Sub } from "../intrinsics";
 
 export interface EksClusterProps {
@@ -46,6 +46,16 @@ export interface EksClusterProps {
     /** Subnets the nodes land in. Default: the cluster's own `subnetIds`. */
     subnetIds?: string[];
   };
+  /**
+   * Managed add-ons to install, by name (e.g. "eks-pod-identity-agent" —
+   * without which an AWS::EKS::PodIdentityAssociation delivers no
+   * credentials and the workload it binds crashloops on startup, found on
+   * kubemicrovm-ops' first real deploy). Named by the caller, never guessed;
+   * versions omitted take EKS's default. Up to three (fixed member slots
+   * `addon1..addon3`, keyed by position — the statically-evaluable shape);
+   * an estate needing more declares the rest as bare Addon resources.
+   */
+  addons?: Array<{ name: string; version?: string }>;
   tags?: Array<{ Key: string; Value: string }>;
   defaults?: {
     cluster?: Partial<ConstructorParameters<typeof EKSCluster>[0]>;
@@ -82,8 +92,33 @@ export const EksCluster = Composite((props: EksClusterProps) => {
     Tags: props.tags,
   }, defaults?.cluster));
 
+  // Three fixed add-on slots, the same statically-evaluable shape
+  // vpc-default uses for its optional third AZ: a ternary is an expression
+  // (EVL-clean); a loop-built member map is control flow the reference
+  // composites must not contain (EVL002/EVL003). Members are addon1..addon3
+  // in the caller's order — logical ids stay stable as long as the order
+  // does, which the caller controls.
+  const a1 = props.addons?.[0];
+  const a2 = props.addons?.[1];
+  const a3 = props.addons?.[2];
+  const addon1 = a1
+    ? new Addon({ ClusterName: props.name, AddonName: a1.name, AddonVersion: a1.version, Tags: props.tags }, { DependsOn: [cluster] })
+    : undefined;
+  const addon2 = a2
+    ? new Addon({ ClusterName: props.name, AddonName: a2.name, AddonVersion: a2.version, Tags: props.tags }, { DependsOn: [cluster] })
+    : undefined;
+  const addon3 = a3
+    ? new Addon({ ClusterName: props.name, AddonName: a3.name, AddonVersion: a3.version, Tags: props.tags }, { DependsOn: [cluster] })
+    : undefined;
+
   if (!props.nodegroup) {
-    return { clusterRole, cluster };
+    return {
+      clusterRole,
+      cluster,
+      ...(addon1 ? { addon1 } : {}),
+      ...(addon2 ? { addon2 } : {}),
+      ...(addon3 ? { addon3 } : {}),
+    };
   }
 
   const nodeRole = new Role(mergeDefaults({
@@ -117,5 +152,13 @@ export const EksCluster = Composite((props: EksClusterProps) => {
     Tags: props.tags ? Object.fromEntries(props.tags.map((t) => [t.Key, t.Value])) : undefined,
   }, defaults?.nodegroup), { DependsOn: [cluster] });
 
-  return { clusterRole, cluster, nodeRole, nodegroup };
+  return {
+    clusterRole,
+    cluster,
+    nodeRole,
+    nodegroup,
+    ...(addon1 ? { addon1 } : {}),
+    ...(addon2 ? { addon2 } : {}),
+    ...(addon3 ? { addon3 } : {}),
+  };
 }, "EksCluster");