@intentius/chant-lexicon-helm 0.124.31 → 0.124.32

package/dist/composites/helm-batch-job.js

@@ -0,0 +1,148 @@
+/**
+ * HelmBatchJob composite — Job + optional ServiceAccount + RBAC.
+ *
+ * One-shot batch job pattern with optional RBAC for jobs that need
+ * Kubernetes API access (e.g., data migrations, cluster operations).
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Chart, Values, Job, ServiceAccount, Role, RoleBinding } from "../resources.js";
+import { values, include, printf, toYaml, With } from "../intrinsics.js";
+export const HelmBatchJob = Composite((props) => {
+    const { name, imageRepository = "busybox", imageTag = "latest", backoffLimit = 6, completions = 1, parallelism = 1, restartPolicy = "OnFailure", serviceAccount = true, rbac = false, appVersion = "1.0.0", defaults: defs, } = props;
+    const chart = new Chart(mergeDefaults({
+        apiVersion: "v2",
+        name,
+        version: "0.1.0",
+        appVersion,
+        type: "application",
+        description: `A Helm chart for ${name} batch job`,
+    }, defs?.chart));
+    const valuesObj = {
+        image: {
+            repository: imageRepository,
+            tag: imageTag,
+            pullPolicy: "IfNotPresent",
+        },
+        job: {
+            backoffLimit,
+            completions,
+            parallelism,
+        },
+        restartPolicy,
+        command: [],
+        args: [],
+        resources: {},
+    };
+    if (props.ttlSecondsAfterFinished !== undefined) {
+        valuesObj.job.ttlSecondsAfterFinished = props.ttlSecondsAfterFinished;
+    }
+    if (props.podSecurityContext)
+        valuesObj.podSecurityContext = props.podSecurityContext;
+    if (props.securityContext)
+        valuesObj.securityContext = props.securityContext;
+    if (props.nodeSelector)
+        valuesObj.nodeSelector = props.nodeSelector;
+    if (props.tolerations)
+        valuesObj.tolerations = props.tolerations;
+    if (serviceAccount) {
+        valuesObj.serviceAccount = {
+            create: true,
+            name: "",
+            annotations: {},
+        };
+    }
+    if (rbac) {
+        valuesObj.rbac = {
+            create: true,
+            rules: [],
+        };
+    }
+    const valuesRes = new Values(mergeDefaults(valuesObj, defs?.values));
+    const containerSpec = {
+        name,
+        image: printf("%s:%s", values.image.repository, values.image.tag),
+        imagePullPolicy: values.image.pullPolicy,
+        command: values.command,
+        args: values.args,
+        resources: toYaml(values.resources),
+    };
+    if (props.securityContext)
+        containerSpec.securityContext = toYaml(values.securityContext);
+    const podSpec = {
+        restartPolicy: values.restartPolicy,
+        containers: [containerSpec],
+    };
+    if (props.podSecurityContext)
+        podSpec.securityContext = toYaml(values.podSecurityContext);
+    if (props.nodeSelector)
+        podSpec.nodeSelector = With(values.nodeSelector, toYaml(values.nodeSelector));
+    if (props.tolerations)
+        podSpec.tolerations = With(values.tolerations, toYaml(values.tolerations));
+    if (serviceAccount)
+        podSpec.serviceAccountName = include(`${name}.serviceAccountName`);
+    const jobSpec = {
+        backoffLimit: values.job.backoffLimit,
+        completions: values.job.completions,
+        parallelism: values.job.parallelism,
+        template: {
+            metadata: {
+                labels: include(`${name}.selectorLabels`),
+            },
+            spec: podSpec,
+        },
+    };
+    if (props.ttlSecondsAfterFinished !== undefined) {
+        jobSpec.ttlSecondsAfterFinished = values.job.ttlSecondsAfterFinished;
+    }
+    const job = new Job(mergeDefaults({
+        apiVersion: "batch/v1",
+        kind: "Job",
+        metadata: {
+            name: include(`${name}.fullname`),
+            labels: include(`${name}.labels`),
+        },
+        spec: jobSpec,
+    }, defs?.job));
+    const result = { chart, values: valuesRes, job };
+    if (serviceAccount) {
+        result.serviceAccount = new ServiceAccount(mergeDefaults({
+            apiVersion: "v1",
+            kind: "ServiceAccount",
+            metadata: {
+                name: include(`${name}.serviceAccountName`),
+                labels: include(`${name}.labels`),
+                annotations: toYaml(values.serviceAccount.annotations),
+            },
+        }, defs?.serviceAccount));
+    }
+    if (rbac) {
+        result.role = new Role(mergeDefaults({
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "Role",
+            metadata: {
+                name: include(`${name}.fullname`),
+                labels: include(`${name}.labels`),
+            },
+            rules: toYaml(values.rbac.rules),
+        }, defs?.role));
+        result.roleBinding = new RoleBinding(mergeDefaults({
+            apiVersion: "rbac.authorization.k8s.io/v1",
+            kind: "RoleBinding",
+            metadata: {
+                name: include(`${name}.fullname`),
+                labels: include(`${name}.labels`),
+            },
+            roleRef: {
+                apiGroup: "rbac.authorization.k8s.io",
+                kind: "Role",
+                name: include(`${name}.fullname`),
+            },
+            subjects: [{
+                    kind: "ServiceAccount",
+                    name: include(`${name}.serviceAccountName`),
+                    namespace: values.namespace ?? undefined,
+                }],
+        }, defs?.roleBinding));
+    }
+    return result;
+}, "HelmBatchJob");

package/dist/composites/helm-crd-lifecycle.js

@@ -0,0 +1,145 @@
+/**
+ * HelmCRDLifecycle composite — managed CRD lifecycle via Helm hooks.
+ *
+ * Produces a Job-based CRD installer that runs as a pre-install/pre-upgrade
+ * hook, solving the Helm limitation that CRDs in crds/ are never upgraded
+ * or deleted.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Chart, Values, Job, ConfigMap, ServiceAccount, ClusterRole, ClusterRoleBinding } from "../resources.js";
+import { values, include, printf } from "../intrinsics.js";
+export const HelmCRDLifecycle = Composite((props) => {
+    const { name, crdContent, kubectlImage = "bitnami/kubectl", kubectlTag = "latest", serviceAccountName, defaults: defs, } = props;
+    const saName = serviceAccountName ?? `${name}-crd-installer`;
+    const chart = new Chart(mergeDefaults({
+        apiVersion: "v2",
+        name,
+        version: "0.1.0",
+        type: "application",
+        description: `CRD lifecycle management for ${name}`,
+    }, defs?.chart));
+    const valuesRes = new Values(mergeDefaults({
+        crdLifecycle: {
+            enabled: true,
+            kubectl: {
+                image: kubectlImage,
+                tag: kubectlTag,
+            },
+            serviceAccount: {
+                name: saName,
+            },
+        },
+    }, defs?.values));
+    const hookAnnotations = {
+        "helm.sh/hook": "pre-install,pre-upgrade",
+        "helm.sh/hook-weight": "-5",
+        "helm.sh/hook-delete-policy": "before-hook-creation",
+    };
+    const crdConfigMap = new ConfigMap(mergeDefaults({
+        apiVersion: "v1",
+        kind: "ConfigMap",
+        metadata: {
+            name: printf("%s-crd-content", include(`${name}.fullname`)),
+            labels: include(`${name}.labels`),
+            annotations: hookAnnotations,
+        },
+        data: {
+            "crds.yaml": crdContent,
+        },
+    }, defs?.crdConfigMap));
+    const serviceAccount = new ServiceAccount(mergeDefaults({
+        apiVersion: "v1",
+        kind: "ServiceAccount",
+        metadata: {
+            name: values.crdLifecycle.serviceAccount.name,
+            labels: include(`${name}.labels`),
+            annotations: hookAnnotations,
+        },
+    }, defs?.serviceAccount));
+    const clusterRole = new ClusterRole(mergeDefaults({
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRole",
+        metadata: {
+            name: printf("%s-crd-installer", include(`${name}.fullname`)),
+            labels: include(`${name}.labels`),
+            annotations: hookAnnotations,
+        },
+        rules: [{
+                apiGroups: ["apiextensions.k8s.io"],
+                resources: ["customresourcedefinitions"],
+                verbs: ["get", "list", "create", "update", "patch"],
+            }],
+    }, defs?.clusterRole));
+    const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRoleBinding",
+        metadata: {
+            name: printf("%s-crd-installer", include(`${name}.fullname`)),
+            labels: include(`${name}.labels`),
+            annotations: hookAnnotations,
+        },
+        roleRef: {
+            apiGroup: "rbac.authorization.k8s.io",
+            kind: "ClusterRole",
+            name: printf("%s-crd-installer", include(`${name}.fullname`)),
+        },
+        subjects: [{
+                kind: "ServiceAccount",
+                name: values.crdLifecycle.serviceAccount.name,
+                namespace: "{{ .Release.Namespace }}",
+            }],
+    }, defs?.clusterRoleBinding));
+    const crdInstallJob = new Job(mergeDefaults({
+        apiVersion: "batch/v1",
+        kind: "Job",
+        metadata: {
+            name: printf("%s-crd-install", include(`${name}.fullname`)),
+            labels: include(`${name}.labels`),
+            annotations: hookAnnotations,
+        },
+        spec: {
+            template: {
+                metadata: {
+                    labels: include(`${name}.selectorLabels`),
+                },
+                spec: {
+                    serviceAccountName: values.crdLifecycle.serviceAccount.name,
+                    restartPolicy: "Never",
+                    securityContext: {
+                        runAsNonRoot: true,
+                        runAsUser: 1000,
+                    },
+                    containers: [{
+                            name: "crd-installer",
+                            image: printf("%s:%s", values.crdLifecycle.kubectl.image, values.crdLifecycle.kubectl.tag),
+                            command: ["kubectl", "apply", "-f", "/crds/"],
+                            securityContext: {
+                                readOnlyRootFilesystem: true,
+                                allowPrivilegeEscalation: false,
+                            },
+                            volumeMounts: [{
+                                    name: "crd-content",
+                                    mountPath: "/crds",
+                                    readOnly: true,
+                                }],
+                        }],
+                    volumes: [{
+                            name: "crd-content",
+                            configMap: {
+                                name: printf("%s-crd-content", include(`${name}.fullname`)),
+                            },
+                        }],
+                },
+            },
+        },
+    }, defs?.crdInstallJob));
+    return {
+        chart,
+        values: valuesRes,
+        crdInstallJob,
+        crdConfigMap,
+        serviceAccount,
+        clusterRole,
+        clusterRoleBinding,
+    };
+}, "HelmCRDLifecycle");

package/dist/composites/helm-cron-job.js

@@ -0,0 +1,130 @@
+/**
+ * HelmCronJob composite — CronJob chart.
+ *
+ * Produces a Helm chart for scheduled batch workloads.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Chart, Values, CronJob, ServiceAccount } from "../resources.js";
+import { values, include, printf, toYaml, With } from "../intrinsics.js";
+export const HelmCronJob = Composite((props) => {
+    const { name, imageRepository = "busybox", imageTag = "latest", schedule = "0 * * * *", restartPolicy = "OnFailure", appVersion = "1.0.0", serviceAccount = false, defaults: defs, } = props;
+    const chart = new Chart(mergeDefaults({
+        apiVersion: "v2",
+        name,
+        version: "0.1.0",
+        appVersion,
+        type: "application",
+        description: `A Helm chart for ${name} (cron job)`,
+    }, defs?.chart));
+    const valuesObj = {
+        image: {
+            repository: imageRepository,
+            tag: imageTag,
+            pullPolicy: "IfNotPresent",
+        },
+        schedule,
+        restartPolicy,
+        command: [],
+        args: [],
+        resources: {},
+    };
+    if (props.podSecurityContext)
+        valuesObj.podSecurityContext = props.podSecurityContext;
+    if (props.securityContext)
+        valuesObj.securityContext = props.securityContext;
+    if (props.nodeSelector)
+        valuesObj.nodeSelector = props.nodeSelector;
+    if (props.tolerations)
+        valuesObj.tolerations = props.tolerations;
+    if (props.affinity)
+        valuesObj.affinity = props.affinity;
+    if (props.podAnnotations)
+        valuesObj.podAnnotations = props.podAnnotations;
+    if (props.concurrencyPolicy)
+        valuesObj.concurrencyPolicy = props.concurrencyPolicy;
+    if (props.successfulJobsHistoryLimit !== undefined)
+        valuesObj.successfulJobsHistoryLimit = props.successfulJobsHistoryLimit;
+    if (props.failedJobsHistoryLimit !== undefined)
+        valuesObj.failedJobsHistoryLimit = props.failedJobsHistoryLimit;
+    if (props.backoffLimit !== undefined)
+        valuesObj.backoffLimit = props.backoffLimit;
+    if (serviceAccount) {
+        valuesObj.serviceAccount = {
+            create: true,
+            name: "",
+            annotations: {},
+        };
+    }
+    const valuesRes = new Values(mergeDefaults(valuesObj, defs?.values));
+    const containerSpec = {
+        name,
+        image: printf("%s:%s", values.image.repository, values.image.tag),
+        imagePullPolicy: values.image.pullPolicy,
+        command: values.command,
+        args: values.args,
+        resources: toYaml(values.resources),
+    };
+    if (props.securityContext)
+        containerSpec.securityContext = toYaml(values.securityContext);
+    const podSpec = {
+        restartPolicy: values.restartPolicy,
+        containers: [containerSpec],
+    };
+    if (props.podSecurityContext)
+        podSpec.securityContext = toYaml(values.podSecurityContext);
+    if (props.nodeSelector)
+        podSpec.nodeSelector = With(values.nodeSelector, toYaml(values.nodeSelector));
+    if (props.tolerations)
+        podSpec.tolerations = With(values.tolerations, toYaml(values.tolerations));
+    if (props.affinity)
+        podSpec.affinity = With(values.affinity, toYaml(values.affinity));
+    if (serviceAccount)
+        podSpec.serviceAccountName = include(`${name}.serviceAccountName`);
+    const templateMetadata = {
+        labels: include(`${name}.selectorLabels`),
+    };
+    if (props.podAnnotations)
+        templateMetadata.annotations = toYaml(values.podAnnotations);
+    const jobSpec = {
+        template: {
+            metadata: templateMetadata,
+            spec: podSpec,
+        },
+    };
+    if (props.backoffLimit !== undefined)
+        jobSpec.backoffLimit = values.backoffLimit;
+    const cronJobSpec = {
+        schedule: values.schedule,
+        jobTemplate: {
+            spec: jobSpec,
+        },
+    };
+    if (props.concurrencyPolicy)
+        cronJobSpec.concurrencyPolicy = values.concurrencyPolicy;
+    if (props.successfulJobsHistoryLimit !== undefined)
+        cronJobSpec.successfulJobsHistoryLimit = values.successfulJobsHistoryLimit;
+    if (props.failedJobsHistoryLimit !== undefined)
+        cronJobSpec.failedJobsHistoryLimit = values.failedJobsHistoryLimit;
+    const cronJob = new CronJob(mergeDefaults({
+        apiVersion: "batch/v1",
+        kind: "CronJob",
+        metadata: {
+            name: include(`${name}.fullname`),
+            labels: include(`${name}.labels`),
+        },
+        spec: cronJobSpec,
+    }, defs?.cronJob));
+    const result = { chart, values: valuesRes, cronJob };
+    if (serviceAccount) {
+        result.serviceAccount = new ServiceAccount(mergeDefaults({
+            apiVersion: "v1",
+            kind: "ServiceAccount",
+            metadata: {
+                name: include(`${name}.serviceAccountName`),
+                labels: include(`${name}.labels`),
+                annotations: toYaml(values.serviceAccount.annotations),
+            },
+        }, defs?.serviceAccount));
+    }
+    return result;
+}, "HelmCronJob");

package/dist/composites/helm-daemon-set.js

@@ -0,0 +1,125 @@
+/**
+ * HelmDaemonSet composite — DaemonSet + optional ServiceAccount.
+ *
+ * Common pattern for logging agents, monitoring sidecars, and node-level
+ * infrastructure that needs to run on every node.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Chart, Values, DaemonSet, ServiceAccount } from "../resources.js";
+import { values, include, printf, toYaml, With } from "../intrinsics.js";
+export const HelmDaemonSet = Composite((props) => {
+    const { name, imageRepository = "fluent/fluent-bit", imageTag = "latest", port, hostPaths = [], serviceAccount = true, appVersion = "1.0.0", defaults: defs, } = props;
+    const chart = new Chart(mergeDefaults({
+        apiVersion: "v2",
+        name,
+        version: "0.1.0",
+        appVersion,
+        type: "application",
+        description: `A Helm chart for ${name} DaemonSet`,
+    }, defs?.chart));
+    const valuesObj = {
+        image: {
+            repository: imageRepository,
+            tag: imageTag,
+            pullPolicy: "IfNotPresent",
+        },
+        resources: {
+            limits: { cpu: "200m", memory: "256Mi" },
+            requests: { cpu: "100m", memory: "128Mi" },
+        },
+        nodeSelector: {},
+        tolerations: [],
+        updateStrategy: {
+            type: "RollingUpdate",
+            rollingUpdate: {
+                maxUnavailable: 1,
+            },
+        },
+    };
+    if (serviceAccount) {
+        valuesObj.serviceAccount = {
+            create: true,
+            name: "",
+            annotations: {},
+        };
+    }
+    const valuesRes = new Values(mergeDefaults(valuesObj, defs?.values));
+    const containerSpec = {
+        name,
+        image: printf("%s:%s", values.image.repository, values.image.tag),
+        imagePullPolicy: values.image.pullPolicy,
+        resources: toYaml(values.resources),
+        securityContext: {
+            runAsNonRoot: true,
+            readOnlyRootFilesystem: true,
+            allowPrivilegeEscalation: false,
+        },
+    };
+    if (port !== undefined) {
+        containerSpec.ports = [{ containerPort: port, name: "http" }];
+    }
+    if (hostPaths.length > 0) {
+        containerSpec.volumeMounts = hostPaths.map((hp) => ({
+            name: hp.name,
+            mountPath: hp.mountPath,
+            readOnly: hp.readOnly ?? true,
+        }));
+    }
+    const podSpec = {
+        containers: [containerSpec],
+        securityContext: {
+            runAsNonRoot: true,
+        },
+        nodeSelector: With(values.nodeSelector, toYaml(values.nodeSelector)),
+        tolerations: With(values.tolerations, toYaml(values.tolerations)),
+    };
+    if (serviceAccount) {
+        podSpec.serviceAccountName = include(`${name}.serviceAccountName`);
+    }
+    if (hostPaths.length > 0) {
+        podSpec.volumes = hostPaths.map((hp) => ({
+            name: hp.name,
+            hostPath: {
+                path: hp.hostPath,
+                type: "Directory",
+            },
+        }));
+    }
+    const daemonSet = new DaemonSet(mergeDefaults({
+        apiVersion: "apps/v1",
+        kind: "DaemonSet",
+        metadata: {
+            name: include(`${name}.fullname`),
+            labels: include(`${name}.labels`),
+        },
+        spec: {
+            selector: {
+                matchLabels: include(`${name}.selectorLabels`),
+            },
+            updateStrategy: toYaml(values.updateStrategy),
+            template: {
+                metadata: {
+                    labels: include(`${name}.selectorLabels`),
+                },
+                spec: podSpec,
+            },
+        },
+    }, defs?.daemonSet));
+    const result = {
+        chart,
+        values: valuesRes,
+        daemonSet,
+    };
+    if (serviceAccount) {
+        result.serviceAccount = new ServiceAccount(mergeDefaults({
+            apiVersion: "v1",
+            kind: "ServiceAccount",
+            metadata: {
+                name: include(`${name}.serviceAccountName`),
+                labels: include(`${name}.labels`),
+                annotations: toYaml(values.serviceAccount.annotations),
+            },
+        }, defs?.serviceAccount));
+    }
+    return result;
+}, "HelmDaemonSet");

package/dist/composites/helm-external-secret.js

@@ -0,0 +1,63 @@
+/**
+ * HelmExternalSecret composite — ExternalSecret CR for secret management.
+ *
+ * Uses the external-secrets.io operator to sync secrets from external
+ * providers (AWS Secrets Manager, Vault, etc.) into Kubernetes Secrets.
+ *
+ * Thanks to the serializer's fallback GVK resolution, this composite
+ * returns a plain object with apiVersion/kind and the serializer handles
+ * it like any other K8s resource.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Chart, Values, ExternalSecret } from "../resources.js";
+import { values, include } from "../intrinsics.js";
+export const HelmExternalSecret = Composite((props) => {
+    const { name, secretStoreName, secretStoreKind = "ClusterSecretStore", data, refreshInterval = "1h", defaults: defs, } = props;
+    const chart = new Chart(mergeDefaults({
+        apiVersion: "v2",
+        name,
+        version: "0.1.0",
+        type: "application",
+        description: `External secret management for ${name}`,
+    }, defs?.chart));
+    const secretDataEntries = Object.entries(data).map(([key, remotePath]) => ({
+        secretKey: key,
+        remoteRef: {
+            key: remotePath,
+        },
+    }));
+    const valuesRes = new Values(mergeDefaults({
+        externalSecret: {
+            refreshInterval,
+            secretStore: {
+                name: secretStoreName,
+                kind: secretStoreKind,
+            },
+        },
+    }, defs?.values));
+    const externalSecret = new ExternalSecret(mergeDefaults({
+        apiVersion: "external-secrets.io/v1beta1",
+        kind: "ExternalSecret",
+        metadata: {
+            name: include(`${name}.fullname`),
+            labels: include(`${name}.labels`),
+        },
+        spec: {
+            refreshInterval: values.externalSecret.refreshInterval,
+            secretStoreRef: {
+                name: values.externalSecret.secretStore.name,
+                kind: values.externalSecret.secretStore.kind,
+            },
+            target: {
+                name: include(`${name}.fullname`),
+                creationPolicy: "Owner",
+            },
+            data: secretDataEntries,
+        },
+    }, defs?.externalSecret));
+    return {
+        chart,
+        values: valuesRes,
+        externalSecret,
+    };
+}, "HelmExternalSecret");

package/dist/composites/helm-library.js

@@ -0,0 +1,24 @@
+/**
+ * HelmLibrary composite — Library chart (type: library, no templates).
+ *
+ * Produces a Helm library chart with only Chart.yaml and _helpers.tpl.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Chart, Values } from "../resources.js";
+export const HelmLibrary = Composite((props) => {
+    const { name, version = "0.1.0", description = `A Helm library chart for ${name}`, dependencies = [], helpers = ["name", "fullname", "chart", "labels", "selectorLabels"], defaults: defs, } = props;
+    const chartProps = {
+        apiVersion: "v2",
+        name,
+        version,
+        type: "library",
+        description,
+    };
+    if (dependencies.length > 0) {
+        chartProps.dependencies = dependencies;
+    }
+    const chart = new Chart(mergeDefaults(chartProps, defs?.chart));
+    // Store helpers list in a Values resource so it's a Declarable member
+    const helpersRes = new Values(mergeDefaults({ helpers }, defs?.helpers));
+    return { chart, helpers: helpersRes };
+}, "HelmLibrary");