@intentius/chant-lexicon-gcp 0.124.31 → 0.124.33

package/dist/composites/cloud-function.js

@@ -0,0 +1,65 @@
+/**
+ * CloudFunctionWithTrigger composite — CloudFunction + source bucket + optional PubSub/HTTP trigger + invoker IAM.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { CloudFunction as CloudFunctionResource, StorageBucket, IAMPolicyMember, } from "../generated/index.js";
+export const CloudFunctionWithTrigger = Composite((props) => {
+    const { name, runtime, entryPoint, region, availableMemoryMb = "256M", timeout = 60, triggerType = "http", triggerTopic, publicAccess = false, environmentVariables, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const sourceBucket = new StorageBucket(mergeDefaults({
+        metadata: {
+            name: `${name}-source`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "source" },
+        },
+        location: region ?? "US",
+        uniformBucketLevelAccess: true,
+    }, defs?.sourceBucket));
+    const eventTrigger = triggerType === "pubsub" && triggerTopic
+        ? { eventType: "google.cloud.pubsub.topic.v1.messagePublished", pubsubTopic: triggerTopic }
+        : undefined;
+    const fn = new CloudFunctionResource(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "function" },
+        },
+        ...(region && { location: region }),
+        runtime,
+        entryPoint,
+        availableMemoryMb,
+        timeout: `${timeout}s`,
+        buildConfig: {
+            sourceRef: {
+                storageBucketRef: { name: `${name}-source` },
+            },
+        },
+        ...(eventTrigger && { eventTrigger }),
+        ...(environmentVariables && { environmentVariables }),
+    }, defs?.function));
+    const result = {
+        function: fn,
+        sourceBucket,
+    };
+    if (publicAccess && triggerType === "http") {
+        result.invokerIam = new IAMPolicyMember(mergeDefaults({
+            metadata: {
+                name: `${name}-invoker`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "iam" },
+            },
+            member: "allUsers",
+            role: "roles/cloudfunctions.invoker",
+            resourceRef: {
+                apiVersion: "cloudfunctions.cnrm.cloud.google.com/v1beta1",
+                kind: "CloudFunctionsFunction",
+                name,
+            },
+        }, defs?.invokerIam));
+    }
+    return result;
+}, "CloudFunctionWithTrigger");

package/dist/composites/cloud-run-service.d.ts

@@ -7,8 +7,10 @@ export interface CloudRunServiceProps {
     name: string;
     /** Container image. */
     image: string;
-    /** GCP region. */
+    /** GCP region (default: GCP.Region, resolved from GCP_REGION at build). */
     location?: string;
+    /** GCP project the service runs in, as `projectRef.external` (default: GCP.ProjectId, resolved from GCP_PROJECT_ID at build). */
+    projectId?: string;
     /** Port the container listens on (default: 8080). */
     port?: number;
     /** CPU limit (default: "1000m"). */
@@ -43,10 +45,12 @@ export interface CloudRunServiceProps {
  *
  * @example
  * ```ts
- * import { CloudRunService } from "@intentius/chant-lexicon-gcp";
+ * import { CloudRunServiceComposite } from "@intentius/chant-lexicon-gcp";
  *
- * const { service, publicIam } = CloudRunService({
+ * const { service, publicIam } = CloudRunServiceComposite({
  *   name: "my-api",
+ *   projectId: "my-project",
+ *   location: "us-central1",
  *   image: "gcr.io/my-project/my-api:latest",
  *   publicAccess: true,
  * });

package/dist/composites/cloud-run-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-run-service.d.ts","sourceRoot":"","sources":["../../src/composites/cloud-run-service.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,eAAe,IAAI,uBAAuB,EAC1C,eAAe,EAChB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,oBAAoB;IACnC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvE,CAAC;CACH;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,2FAwEP,CAAC"}
+{"version":3,"file":"cloud-run-service.d.ts","sourceRoot":"","sources":["../../src/composites/cloud-run-service.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,eAAe,IAAI,uBAAuB,EAC1C,eAAe,EAChB,MAAM,cAAc,CAAC;AAGtB,MAAM,WAAW,oBAAoB;IACnC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iIAAiI;IACjI,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvE,CAAC;CACH;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,2FA0EP,CAAC"}

package/dist/composites/cloud-run-service.js

@@ -0,0 +1,75 @@
+/**
+ * CloudRunServiceComposite composite — RunService + optional IAMPolicyMember for public access.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { CloudRunService as CloudRunServiceResource, IAMPolicyMember, } from "../generated/index.js";
+import { GCP } from "../pseudo.js";
+/**
+ * Create a CloudRunService composite.
+ *
+ * @example
+ * ```ts
+ * import { CloudRunServiceComposite } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { service, publicIam } = CloudRunServiceComposite({
+ *   name: "my-api",
+ *   projectId: "my-project",
+ *   location: "us-central1",
+ *   image: "gcr.io/my-project/my-api:latest",
+ *   publicAccess: true,
+ * });
+ * ```
+ */
+export const CloudRunServiceComposite = Composite((props) => {
+    const { name, image, location, projectId, port = 8080, cpuLimit = "1000m", memoryLimit = "512Mi", maxInstanceRequestConcurrency = 80, minInstanceCount = 0, maxInstanceCount = 100, publicAccess = false, env, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const containers = [
+        {
+            image,
+            ports: [{ containerPort: port, name: "http1" }],
+            resources: {
+                limits: { cpu: cpuLimit, memory: memoryLimit },
+            },
+            ...(env && env.length > 0 && { env }),
+        },
+    ];
+    const service = new CloudRunServiceResource(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "service" },
+        },
+        location: location ?? GCP.Region,
+        projectRef: { external: projectId ?? GCP.ProjectId },
+        template: {
+            maxInstanceRequestConcurrency,
+            scaling: {
+                minInstanceCount,
+                maxInstanceCount,
+            },
+            containers,
+        },
+    }, defs?.service));
+    const result = { service };
+    if (publicAccess) {
+        result.publicIam = new IAMPolicyMember(mergeDefaults({
+            metadata: {
+                name: `${name}-public`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "iam" },
+            },
+            member: "allUsers",
+            role: "roles/run.invoker",
+            resourceRef: {
+                apiVersion: "run.cnrm.cloud.google.com/v1beta1",
+                kind: "RunService",
+                name,
+            },
+        }, defs?.publicIam));
+    }
+    return result;
+}, "CloudRunServiceComposite");

package/dist/composites/cloud-sql-instance.js

@@ -0,0 +1,85 @@
+/**
+ * CloudSqlInstance composite — SQLInstance + SQLDatabase + SQLUser.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { SQLInstance, SQLDatabase, SQLUser } from "../generated/index.js";
+/**
+ * Create a CloudSqlInstance composite.
+ *
+ * @example
+ * ```ts
+ * import { CloudSqlInstance } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { instance, database, user } = CloudSqlInstance({
+ *   name: "my-db",
+ *   databaseVersion: "POSTGRES_15",
+ *   tier: "db-custom-2-7680",
+ * });
+ * ```
+ */
+export const CloudSqlInstance = Composite((props) => {
+    const { name, databaseVersion = "POSTGRES_15", tier = "db-f1-micro", region, databaseName = name, userName = "admin", diskSize = 10, diskAutoresize = true, backupEnabled = true, highAvailability = false, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    // K8s metadata name must be a valid DNS subdomain (no underscores).
+    // When databaseName differs from the instance name, prefix with instance name
+    // to guarantee uniqueness across instances sharing the same databaseName.
+    const sanitizedDbName = databaseName.replace(/_/g, "-");
+    const databaseK8sName = databaseName === name ? sanitizedDbName : `${name}-${sanitizedDbName}`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const settings = {
+        tier,
+        diskSize,
+        diskAutoresize,
+        ...(highAvailability && { availabilityType: "REGIONAL" }),
+    };
+    if (backupEnabled) {
+        settings.backupConfiguration = {
+            enabled: true,
+            startTime: "03:00",
+        };
+    }
+    const instance = new SQLInstance(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "database" },
+        },
+        databaseVersion,
+        ...(region && { region }),
+        settings,
+    }, defs?.instance));
+    const database = new SQLDatabase(mergeDefaults({
+        metadata: {
+            name: databaseK8sName,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "database" },
+        },
+        instanceRef: { name },
+        // resourceID sets the actual Cloud SQL database name when the K8s-safe name differs
+        ...(databaseName !== sanitizedDbName && { resourceID: databaseName }),
+    }, defs?.database));
+    const user = new SQLUser(mergeDefaults({
+        metadata: {
+            // K8s name scoped to the instance for uniqueness (e.g. "mydb-admin").
+            // Without resourceID, Config Connector uses metadata.name as the actual
+            // Cloud SQL username — so the PG username IS the K8s resource name.
+            // Callers can override via defaults.user.resourceID if a shorter name is needed.
+            name: `${name}-${userName}`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "database" },
+        },
+        instanceRef: { name },
+        password: {
+            valueFrom: {
+                secretKeyRef: {
+                    name: `${name}-db-password`,
+                    key: "password",
+                },
+            },
+        },
+    }, defs?.user));
+    return { instance, database, user };
+}, "CloudSqlInstance");

package/dist/composites/gcs-bucket.js

@@ -0,0 +1,64 @@
+/**
+ * GcsBucket composite — StorageBucket with encryption, uniform access, and lifecycle.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { StorageBucket } from "../generated/index.js";
+/**
+ * Create a GcsBucket composite.
+ *
+ * @example
+ * ```ts
+ * import { GcsBucket } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { bucket } = GcsBucket({
+ *   name: "my-data-bucket",
+ *   location: "US",
+ *   versioning: true,
+ *   lifecycleDeleteAfterDays: 365,
+ * });
+ * ```
+ */
+export const GcsBucket = Composite((props) => {
+    const { name, location = "US", storageClass = "STANDARD", uniformBucketLevelAccess = true, versioning = false, kmsKeyName, lifecycleDeleteAfterDays, lifecycleNearlineAfterDays, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const spec = {
+        location,
+        storageClass,
+        uniformBucketLevelAccess,
+    };
+    if (versioning) {
+        spec.versioning = { enabled: true };
+    }
+    if (kmsKeyName) {
+        spec.encryption = { kmsKeyRef: { external: kmsKeyName } };
+    }
+    const lifecycleRules = [];
+    if (lifecycleDeleteAfterDays) {
+        lifecycleRules.push({
+            action: { type: "Delete" },
+            condition: { age: lifecycleDeleteAfterDays },
+        });
+    }
+    if (lifecycleNearlineAfterDays) {
+        lifecycleRules.push({
+            action: { type: "SetStorageClass", storageClass: "NEARLINE" },
+            condition: { age: lifecycleNearlineAfterDays },
+        });
+    }
+    if (lifecycleRules.length > 0) {
+        spec.lifecycleRule = lifecycleRules;
+    }
+    const bucket = new StorageBucket(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "storage" },
+        },
+        ...spec,
+    }, defs?.bucket));
+    return { bucket };
+}, "GcsBucket");

package/dist/composites/gke-cluster.js

@@ -0,0 +1,113 @@
+/**
+ * GkeCluster composite — ContainerCluster + ContainerNodePool.
+ *
+ * Creates a GKE cluster with a default node pool configured for
+ * workload identity and autoscaling.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { GKECluster, NodePool } from "../generated/index.js";
+/**
+ * Create a GkeCluster composite — returns declarable instances for
+ * a ContainerCluster and ContainerNodePool.
+ *
+ * @example
+ * ```ts
+ * import { GkeCluster } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { cluster, nodePool } = GkeCluster({
+ *   name: "my-cluster",
+ *   projectId: "my-project",
+ *   location: "us-central1",
+ *   maxNodeCount: 10,
+ * });
+ * ```
+ */
+export const GkeCluster = Composite((props) => {
+    const { name, projectId, location, initialNodeCount = 1, machineType = "e2-medium", minNodeCount = 1, maxNodeCount = 5, workloadIdentity = true, diskSizeGb = 100, diskType = "pd-standard", network: networkName, subnetwork: subnetworkName, privateNodes = false, masterCidr, nodeLocations, releaseChannel = "REGULAR", labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const clusterSpec = {
+        // GKE API requires initialNodeCount > 0 even when using a separate
+        // ContainerNodePool. Force pd-standard so the default pool doesn't
+        // consume SSD_TOTAL_GB quota (pd-balanced counts as SSD).
+        initialNodeCount: 1,
+        nodeConfig: {
+            machineType,
+            diskType: "pd-standard",
+            diskSizeGb: 50,
+        },
+        releaseChannel: { channel: releaseChannel },
+        ...(location && { location }),
+        ...(networkName && { networkRef: { name: networkName } }),
+        ...(subnetworkName && { subnetworkRef: { name: subnetworkName } }),
+        ...(nodeLocations && { nodeLocations }),
+        ...(privateNodes && {
+            privateClusterConfig: {
+                enablePrivateNodes: true,
+                // Keep master endpoint public so kubectl works from outside the VPC.
+                enablePrivateEndpoint: false,
+                ...(masterCidr && { masterIpv4CidrBlock: masterCidr }),
+            },
+        }),
+    };
+    if (workloadIdentity) {
+        clusterSpec.workloadIdentityConfig = {
+            workloadPool: `${projectId}.svc.id.goog`,
+        };
+    }
+    const cluster = new GKECluster(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "cluster" },
+        },
+        ...clusterSpec,
+    }, defs?.cluster));
+    const nodePoolName = `${name}-nodes`;
+    const nodePool = new NodePool(mergeDefaults({
+        metadata: {
+            name: nodePoolName,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "node-pool" },
+        },
+        clusterRef: { name },
+        initialNodeCount,
+        autoscaling: {
+            minNodeCount,
+            maxNodeCount,
+        },
+        nodeConfig: {
+            machineType,
+            diskSizeGb,
+            diskType,
+            oauthScopes: ["https://www.googleapis.com/auth/cloud-platform"],
+            ...(workloadIdentity && {
+                workloadMetadataConfig: { mode: "GKE_METADATA" },
+            }),
+        },
+        management: {
+            autoRepair: true,
+            autoUpgrade: true,
+        },
+        ...(location && { location }),
+    }, defs?.nodePool));
+    // Adopt and scale the GKE-required default pool to 0.
+    // resourceID maps this K8s resource to the GCP pool named "default-pool".
+    // Config Connector retries until the workload pool has nodes, at which
+    // point GKE accepts the resize-to-zero.
+    const defaultPool = new NodePool(mergeDefaults({
+        metadata: {
+            name: `${name}-default-pool`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "default-pool" },
+        },
+        resourceID: "default-pool",
+        clusterRef: { name },
+        nodeCount: 0,
+        ...(location && { location }),
+    }, defs?.defaultPool));
+    return { cluster, nodePool, defaultPool };
+}, "GkeCluster");

package/dist/composites/gke-crdb-region.js

@@ -0,0 +1,137 @@
+/**
+ * GkeCrdbRegion composite — GKE cluster + public DNS zone + per-region IAM for a CockroachDB region.
+ *
+ * Replaces the 2-file per-region GCP infra pattern (infra/cluster.ts + infra/dns.ts) with
+ * a single composite call. Handles the GKE cluster, the public DNS zone, and all per-region
+ * Workload Identity IAM bindings for both ExternalDNS and CockroachDB pods.
+ */
+import { Composite } from "@intentius/chant";
+import { GkeCluster } from "./gke-cluster.js";
+import { DNSManagedZone, GCPServiceAccount, IAMPolicyMember } from "../generated/index.js";
+/**
+ * Create a GkeCrdbRegion composite — returns all GCP resources for one CockroachDB region:
+ * GKE cluster, public DNS zone, per-region GSAs, and Workload Identity IAM bindings.
+ *
+ * @example
+ * ```ts
+ * import { GkeCrdbRegion } from "@intentius/chant-lexicon-gcp";
+ *
+ * export const east = GkeCrdbRegion({
+ *   region: "us-east4",
+ *   clusterName: "gke-crdb-east",
+ *   network: "crdb-multi-region",
+ *   subnetwork: "crdb-multi-region-east-nodes",
+ *   domain: "east.crdb.example.com",
+ *   project: GCP_PROJECT_ID,
+ *   crdbNamespace: "crdb-east",
+ *   masterCidr: "172.16.0.0/28",
+ * });
+ * ```
+ */
+export const GkeCrdbRegion = Composite((props) => {
+    const { region, clusterName, network, subnetwork, domain, project, crdbNamespace, crdbK8sSa = "cockroachdb", masterCidr = "172.16.0.0/28", nodeConfig = {}, releaseChannel = "REGULAR", backupBucket, labels: extraLabels = {}, namespace, } = props;
+    const { machineType = "n2-standard-2", diskSizeGb = 100, nodeCount = 1, maxNodeCount = 3, } = nodeConfig;
+    const commonLabels = {
+        "app.kubernetes.io/name": clusterName,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const meta = (component, resourceName) => ({
+        name: resourceName,
+        ...(namespace && { namespace }),
+        labels: { ...commonLabels, "app.kubernetes.io/component": component },
+    });
+    // ── GKE Cluster ──────────────────────────────────────────────────────────────
+    const { cluster, nodePool, defaultPool } = GkeCluster({
+        name: clusterName,
+        projectId: project,
+        location: region,
+        machineType,
+        diskSizeGb,
+        initialNodeCount: nodeCount,
+        minNodeCount: nodeCount,
+        maxNodeCount,
+        network,
+        subnetwork,
+        workloadIdentity: true,
+        privateNodes: true,
+        masterCidr,
+        releaseChannel,
+        labels: extraLabels,
+        ...(namespace && { namespace }),
+    });
+    // ── Public DNS Zone ───────────────────────────────────────────────────────────
+    const dnsZoneName = `${clusterName}-zone`;
+    const dnsZone = new DNSManagedZone({
+        metadata: meta("dns", dnsZoneName),
+        dnsName: `${domain}.`,
+        description: `CockroachDB ${region} UI — managed by chant`,
+    });
+    // ── ExternalDNS Service Account ───────────────────────────────────────────────
+    const dnsGsaName = `${clusterName}-dns`;
+    const dnsGsa = new GCPServiceAccount({
+        metadata: meta("iam", dnsGsaName),
+        displayName: `CockroachDB ${region} ExternalDNS workload identity`,
+    });
+    const dnsWiBinding = new IAMPolicyMember({
+        metadata: meta("iam", `${dnsGsaName}-wi`),
+        member: `serviceAccount:${project}.svc.id.goog[kube-system/external-dns-sa]`,
+        role: "roles/iam.workloadIdentityUser",
+        resourceRef: {
+            apiVersion: "iam.cnrm.cloud.google.com/v1beta1",
+            kind: "IAMServiceAccount",
+            name: dnsGsaName,
+        },
+    });
+    const dnsAdminBinding = new IAMPolicyMember({
+        metadata: meta("iam", `${dnsGsaName}-admin`),
+        member: `serviceAccount:${dnsGsaName}@${project}.iam.gserviceaccount.com`,
+        role: "roles/dns.admin",
+        resourceRef: {
+            apiVersion: "resourcemanager.cnrm.cloud.google.com/v1beta1",
+            kind: "Project",
+            external: `projects/${project}`,
+        },
+    });
+    // ── CockroachDB Service Account ───────────────────────────────────────────────
+    const crdbGsaName = `${clusterName}-crdb`;
+    const crdbGsa = new GCPServiceAccount({
+        metadata: meta("iam", crdbGsaName),
+        displayName: `CockroachDB ${region} workload identity`,
+    });
+    const crdbWiBinding = new IAMPolicyMember({
+        metadata: meta("iam", `${crdbGsaName}-wi`),
+        member: `serviceAccount:${project}.svc.id.goog[${crdbNamespace}/${crdbK8sSa}]`,
+        role: "roles/iam.workloadIdentityUser",
+        resourceRef: {
+            apiVersion: "iam.cnrm.cloud.google.com/v1beta1",
+            kind: "IAMServiceAccount",
+            name: crdbGsaName,
+        },
+    });
+    const result = {
+        cluster,
+        nodePool,
+        defaultPool,
+        dnsZone,
+        dnsGsa,
+        dnsWiBinding,
+        dnsAdminBinding,
+        crdbGsa,
+        crdbWiBinding,
+    };
+    // Optional: GCS backup access for CRDB GSA
+    if (backupBucket) {
+        result.crdbBackupBinding = new IAMPolicyMember({
+            metadata: meta("iam", `${crdbGsaName}-backup`),
+            member: `serviceAccount:${crdbGsaName}@${project}.iam.gserviceaccount.com`,
+            role: "roles/storage.objectAdmin",
+            resourceRef: {
+                apiVersion: "storage.cnrm.cloud.google.com/v1beta1",
+                kind: "StorageBucket",
+                name: backupBucket,
+            },
+        });
+    }
+    return result;
+}, "GkeCrdbRegion");

package/dist/composites/gpu-node-pool.js

@@ -0,0 +1,74 @@
+/**
+ * GpuNodePool composite — ContainerNodePool with GPU accelerators.
+ *
+ * Promoted from the hand-wired `gpuNodePool` in the ray-kuberay-gke example
+ * (examples/ray-kuberay-gke/src/infra/cluster.ts). Attaches to an existing
+ * GKE cluster (e.g. one created by `GkeCluster`) and adds a separate,
+ * scale-to-zero pool for GPU-tainted workloads.
+ *
+ * NOTE: GKE auto-installs the nvidia-device-plugin DaemonSet when a node
+ * pool has accelerators. Do NOT emit it as a K8s manifest — it will
+ * conflict with the GKE-managed version.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { NodePool } from "../generated/index.js";
+const DEFAULT_TAINT = [
+    { key: "nvidia.com/gpu", value: "present", effect: "NO_SCHEDULE" },
+];
+/**
+ * Create a GpuNodePool composite — a scale-to-zero ContainerNodePool with
+ * GPU accelerators, tainted so only pods with a matching toleration land there.
+ *
+ * @example
+ * ```ts
+ * import { GpuNodePool } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { nodePool } = GpuNodePool({
+ *   name: "ray-gke-gpu",
+ *   clusterRef: { name: "ray-gke" },
+ *   location: "us-central1",
+ *   acceleratorType: "nvidia-tesla-t4",
+ *   maxNodeCount: 4,
+ * });
+ * ```
+ */
+export const GpuNodePool = Composite((props) => {
+    const { name, clusterRef, location, machineType = "n1-standard-8", acceleratorType = "nvidia-tesla-t4", acceleratorCount = 1, minNodeCount = 0, maxNodeCount = 4, diskSizeGb = 200, diskType = "pd-ssd", taint = DEFAULT_TAINT, workloadMetadata = true, gpuSharingConfig, gpuPartitionSize, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const guestAccelerator = {
+        count: acceleratorCount,
+        type: acceleratorType,
+        ...(gpuSharingConfig && { gpuSharingConfig }),
+        ...(gpuPartitionSize && { gpuPartitionSize }),
+    };
+    const nodePool = new NodePool(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "gpu-node-pool" },
+        },
+        clusterRef,
+        location,
+        initialNodeCount: 0,
+        autoscaling: {
+            minNodeCount,
+            maxNodeCount,
+            locationPolicy: "ANY",
+        },
+        nodeConfig: {
+            machineType,
+            diskSizeGb,
+            diskType,
+            guestAccelerator: [guestAccelerator],
+            ...(taint.length > 0 && { taint }),
+            ...(workloadMetadata && { workloadMetadataConfig: { mode: "GKE_METADATA" } }),
+            oauthScopes: ["https://www.googleapis.com/auth/cloud-platform"],
+        },
+        management: { autoRepair: true, autoUpgrade: true },
+    }, defs?.nodePool));
+    return { nodePool };
+}, "GpuNodePool");

package/dist/composites/index.js

@@ -0,0 +1,15 @@
+export { GovernanceFoundation, LocationRestriction, OrganizationAuditConfig } from "./landing-zone.js";
+export { GkeCluster } from "./gke-cluster.js";
+export { CloudRunServiceComposite } from "./cloud-run-service.js";
+export { CloudSqlInstance } from "./cloud-sql-instance.js";
+export { GcsBucket } from "./gcs-bucket.js";
+export { VpcNetwork } from "./vpc-network.js";
+export { PubSubPipeline } from "./pubsub-pipeline.js";
+export { CloudFunctionWithTrigger } from "./cloud-function.js";
+export { PrivateService } from "./private-service.js";
+export { ManagedCertificate } from "./managed-certificate.js";
+export { SecureProject } from "./secure-project.js";
+export { MemorystoreRedis } from "./memorystore-redis.js";
+export { MultiRegionVpc } from "./multi-region-vpc.js";
+export { GkeCrdbRegion } from "./gke-crdb-region.js";
+export { GpuNodePool } from "./gpu-node-pool.js";