@intentius/chant-lexicon-k8s 0.0.14 → 0.0.16

package/src/composites/azure-monitor-collector.ts

@@ -0,0 +1,232 @@
+/**
+ * AzureMonitorCollector composite — DaemonSet + RBAC + ConfigMap for Azure Monitor / OTel collector.
+ *
+ * @aks Azure Monitor agent with OpenTelemetry collector config for
+ * Log Analytics workspace integration on AKS clusters.
+ */
+
+export interface AzureMonitorCollectorProps {
+  /** Azure Log Analytics workspace ID. */
+  workspaceId: string;
+  /** AKS cluster name. */
+  clusterName: string;
+  /** Agent name (default: "azure-monitor-collector"). */
+  name?: string;
+  /** Collector image (default: "mcr.microsoft.com/azuremonitor/containerinsights/ciprod:3.1.35"). */
+  image?: string;
+  /** Namespace (default: "azure-monitor"). */
+  namespace?: string;
+  /** Additional labels. */
+  labels?: Record<string, string>;
+  /** CPU request (default: "100m"). */
+  cpuRequest?: string;
+  /** Memory request (default: "256Mi"). */
+  memoryRequest?: string;
+  /** CPU limit (default: "500m"). */
+  cpuLimit?: string;
+  /** Memory limit (default: "512Mi"). */
+  memoryLimit?: string;
+  /** Azure AD client ID for Workload Identity (adds azure.workload.identity annotations to ServiceAccount). */
+  clientId?: string;
+}
+
+export interface AzureMonitorCollectorResult {
+  daemonSet: Record<string, unknown>;
+  serviceAccount: Record<string, unknown>;
+  clusterRole: Record<string, unknown>;
+  clusterRoleBinding: Record<string, unknown>;
+  configMap: Record<string, unknown>;
+}
+
+/**
+ * Create an AzureMonitorCollector composite — returns prop objects for
+ * a DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, and ConfigMap.
+ *
+ * @aks
+ * @example
+ * ```ts
+ * import { AzureMonitorCollector } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { daemonSet, serviceAccount, clusterRole, clusterRoleBinding, configMap } = AzureMonitorCollector({
+ *   workspaceId: "00000000-0000-0000-0000-000000000000",
+ *   clusterName: "my-aks-cluster",
+ * });
+ * ```
+ */
+export function AzureMonitorCollector(props: AzureMonitorCollectorProps): AzureMonitorCollectorResult {
+  const {
+    workspaceId,
+    clusterName,
+    name = "azure-monitor-collector",
+    image = "mcr.microsoft.com/azuremonitor/containerinsights/ciprod:3.1.35",
+    namespace = "azure-monitor",
+    labels: extraLabels = {},
+    cpuRequest = "100m",
+    memoryRequest = "256Mi",
+    cpuLimit = "500m",
+    memoryLimit = "512Mi",
+    clientId,
+  } = props;
+
+  const saName = `${name}-sa`;
+  const clusterRoleName = `${name}-role`;
+  const bindingName = `${name}-binding`;
+  const configMapName = `${name}-config`;
+
+  const commonLabels: Record<string, string> = {
+    "app.kubernetes.io/name": name,
+    "app.kubernetes.io/managed-by": "chant",
+    ...extraLabels,
+  };
+
+  // Build OTel collector config YAML for Azure Monitor
+  const collectorConfig = `receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: 0.0.0.0:4317
+      http:
+        endpoint: 0.0.0.0:4318
+
+processors:
+  batch:
+    timeout: 30s
+    send_batch_size: 8192
+
+exporters:
+  azuremonitor:
+    connection_string: InstrumentationKey=\${APPINSIGHTS_INSTRUMENTATIONKEY}
+    endpoint: https://dc.services.visualstudio.com/v2/track
+  azuremonitor/logs:
+    workspace_id: ${workspaceId}
+    cluster_name: ${clusterName}
+
+service:
+  pipelines:
+    metrics:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [azuremonitor]
+    traces:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [azuremonitor]
+    logs:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [azuremonitor/logs]
+`;
+
+  const container: Record<string, unknown> = {
+    name,
+    image,
+    ports: [
+      { containerPort: 4317, name: "otlp-grpc" },
+      { containerPort: 4318, name: "otlp-http" },
+    ],
+    env: [
+      { name: "AKS_CLUSTER_NAME", value: clusterName },
+      { name: "WORKSPACE_ID", value: workspaceId },
+    ],
+    resources: {
+      requests: { cpu: cpuRequest, memory: memoryRequest },
+      limits: { cpu: cpuLimit, memory: memoryLimit },
+    },
+    volumeMounts: [
+      { name: "config", mountPath: "/etc/otel", readOnly: true },
+    ],
+  };
+
+  const daemonSetProps: Record<string, unknown> = {
+    metadata: {
+      name,
+      namespace,
+      labels: { ...commonLabels, "app.kubernetes.io/component": "agent" },
+    },
+    spec: {
+      selector: { matchLabels: { "app.kubernetes.io/name": name } },
+      template: {
+        metadata: { labels: { "app.kubernetes.io/name": name, ...extraLabels } },
+        spec: {
+          serviceAccountName: saName,
+          containers: [container],
+          volumes: [
+            { name: "config", configMap: { name: configMapName } },
+          ],
+          tolerations: [{ operator: "Exists" }],
+        },
+      },
+    },
+  };
+
+  const saLabels: Record<string, string> = {
+    ...commonLabels,
+    "app.kubernetes.io/component": "agent",
+  };
+
+  if (clientId) {
+    saLabels["azure.workload.identity/use"] = "true";
+  }
+
+  const serviceAccountProps: Record<string, unknown> = {
+    metadata: {
+      name: saName,
+      namespace,
+      labels: saLabels,
+      ...(clientId ? { annotations: { "azure.workload.identity/client-id": clientId } } : {}),
+    },
+  };
+
+  const clusterRoleProps: Record<string, unknown> = {
+    metadata: {
+      name: clusterRoleName,
+      labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+    },
+    rules: [
+      { apiGroups: [""], resources: ["pods", "nodes", "endpoints"], verbs: ["get", "list", "watch"] },
+      { apiGroups: ["apps"], resources: ["replicasets"], verbs: ["get", "list", "watch"] },
+      { apiGroups: ["batch"], resources: ["jobs"], verbs: ["get", "list", "watch"] },
+      { apiGroups: [""], resources: ["nodes/proxy"], verbs: ["get"] },
+      { apiGroups: [""], resources: ["nodes/stats", "configmaps", "events"], verbs: ["create", "get"] },
+      { apiGroups: [""], resources: ["configmaps"], verbs: ["get", "update", "create"], resourceNames: ["otel-container-insight-clusterleader"] },
+    ],
+  };
+
+  const clusterRoleBindingProps: Record<string, unknown> = {
+    metadata: {
+      name: bindingName,
+      labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+    },
+    roleRef: {
+      apiGroup: "rbac.authorization.k8s.io",
+      kind: "ClusterRole",
+      name: clusterRoleName,
+    },
+    subjects: [
+      {
+        kind: "ServiceAccount",
+        name: saName,
+        namespace,
+      },
+    ],
+  };
+
+  const configMapProps: Record<string, unknown> = {
+    metadata: {
+      name: configMapName,
+      namespace,
+      labels: { ...commonLabels, "app.kubernetes.io/component": "config" },
+    },
+    data: {
+      "config.yaml": collectorConfig,
+    },
+  };
+
+  return {
+    daemonSet: daemonSetProps,
+    serviceAccount: serviceAccountProps,
+    clusterRole: clusterRoleProps,
+    clusterRoleBinding: clusterRoleBindingProps,
+    configMap: configMapProps,
+  };
+}

package/src/composites/batch-job.ts

@@ -5,6 +5,28 @@
  * seed tasks, backups). For scheduled workloads, use CronWorkload instead.
  */
 
+import type { ContainerSecurityContext } from "./security-context";
+
+/** Parse a K8s memory string (e.g. "256Mi", "1Gi") to bytes for comparison. */
+function parseMemoryBytes(mem: string): number {
+  const match = mem.match(/^(\d+(?:\.\d+)?)\s*(Ki|Mi|Gi|Ti|k|M|G|T|[eE]\d+)?$/);
+  if (!match) return 0;
+  const value = parseFloat(match[1]);
+  const unit = match[2] ?? "";
+  const multipliers: Record<string, number> = {
+    "": 1, Ki: 1024, Mi: 1024 ** 2, Gi: 1024 ** 3, Ti: 1024 ** 4,
+    k: 1e3, M: 1e6, G: 1e9, T: 1e12,
+  };
+  if (unit.startsWith("e") || unit.startsWith("E")) return value * 10 ** parseInt(unit.slice(1));
+  return value * (multipliers[unit] ?? 1);
+}
+
+/** Parse a K8s CPU string (e.g. "500m", "1") to millicores for comparison. */
+function parseCpuMillis(cpu: string): number {
+  if (cpu.endsWith("m")) return parseFloat(cpu.slice(0, -1));
+  return parseFloat(cpu) * 1000;
+}
+
 export interface BatchJobProps {
   /** Job name — used in metadata and labels. */
   name: string;
@@ -44,6 +66,8 @@ export interface BatchJobProps {
   memoryLimit?: string;
   /** Environment variables for the container. */
   env?: Array<{ name: string; value: string }>;
+  /** Container security context (supports PSS restricted fields). */
+  securityContext?: ContainerSecurityContext;
 }
 
 export interface BatchJobResult {
@@ -85,12 +109,20 @@ export function BatchJob(props: BatchJobProps): BatchJobResult {
     labels: extraLabels = {},
     namespace,
     cpuRequest = "100m",
-    memoryRequest = "128Mi",
-    cpuLimit = "500m",
-    memoryLimit = "256Mi",
+    memoryRequest: rawMemoryRequest = "128Mi",
+    cpuLimit: rawCpuLimit = "500m",
+    memoryLimit: rawMemoryLimit = "256Mi",
     env,
+    securityContext,
   } = props;
 
+  // Ensure limits >= requests (K8s rejects pods where request > limit).
+  const memoryRequest = rawMemoryRequest;
+  const memoryLimit = parseMemoryBytes(rawMemoryRequest) > parseMemoryBytes(rawMemoryLimit)
+    ? rawMemoryRequest : rawMemoryLimit;
+  const cpuLimit = parseCpuMillis(cpuRequest) > parseCpuMillis(rawCpuLimit)
+    ? cpuRequest : rawCpuLimit;
+
   const saName = `${name}-sa`;
   const roleName = `${name}-role`;
   const bindingName = `${name}-binding`;
@@ -117,6 +149,7 @@ export function BatchJob(props: BatchJobProps): BatchJobResult {
       requests: { cpu: cpuRequest, memory: memoryRequest },
     },
     ...(env && { env }),
+    ...(securityContext && { securityContext }),
   };
 
   const jobProps: Record<string, unknown> = {