@intentius/chant-lexicon-k8s 0.0.18 → 0.0.24

package/src/composites/irsa-service-account.ts

@@ -5,6 +5,9 @@
  * annotation for IAM Roles for Service Accounts (IRSA).
  */
 
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { ServiceAccount, Role, RoleBinding } from "../generated";
+
 export interface IrsaServiceAccountProps {
   /** ServiceAccount name — used in metadata and labels. */
   name: string;
@@ -20,12 +23,18 @@ export interface IrsaServiceAccountProps {
   labels?: Record<string, string>;
   /** Namespace for all resources. */
   namespace?: string;
+  /** Per-member defaults for fine-grained overrides. */
+  defaults?: {
+    serviceAccount?: Partial<Record<string, unknown>>;
+    role?: Partial<Record<string, unknown>>;
+    roleBinding?: Partial<Record<string, unknown>>;
+  };
 }
 
 export interface IrsaServiceAccountResult {
-  serviceAccount: Record<string, unknown>;
-  role?: Record<string, unknown>;
-  roleBinding?: Record<string, unknown>;
+  serviceAccount: InstanceType<typeof ServiceAccount>;
+  role?: InstanceType<typeof Role>;
+  roleBinding?: InstanceType<typeof RoleBinding>;
 }
 
 /**
@@ -46,13 +55,14 @@ export interface IrsaServiceAccountResult {
  * });
  * ```
  */
-export function IrsaServiceAccount(props: IrsaServiceAccountProps): IrsaServiceAccountResult {
+export const IrsaServiceAccount = Composite<IrsaServiceAccountProps>((props) => {
   const {
     name,
     iamRoleArn,
     rbacRules,
     labels: extraLabels = {},
     namespace,
+    defaults: defs,
   } = props;
 
   const roleName = `${name}-role`;
@@ -64,7 +74,7 @@ export function IrsaServiceAccount(props: IrsaServiceAccountProps): IrsaServiceA
     ...extraLabels,
   };
 
-  const serviceAccountProps: Record<string, unknown> = {
+  const serviceAccount = new ServiceAccount(mergeDefaults({
     metadata: {
       name,
       ...(namespace && { namespace }),
@@ -73,23 +83,21 @@ export function IrsaServiceAccount(props: IrsaServiceAccountProps): IrsaServiceA
         "eks.amazonaws.com/role-arn": iamRoleArn,
       },
     },
-  };
+  }, defs?.serviceAccount));
 
-  const result: IrsaServiceAccountResult = {
-    serviceAccount: serviceAccountProps,
-  };
+  const result: Record<string, any> = { serviceAccount };
 
   if (rbacRules && rbacRules.length > 0) {
-    result.role = {
+    result.role = new Role(mergeDefaults({
       metadata: {
         name: roleName,
         ...(namespace && { namespace }),
         labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
       },
       rules: rbacRules,
-    };
+    }, defs?.role));
 
-    result.roleBinding = {
+    result.roleBinding = new RoleBinding(mergeDefaults({
       metadata: {
         name: bindingName,
         ...(namespace && { namespace }),
@@ -107,8 +115,8 @@ export function IrsaServiceAccount(props: IrsaServiceAccountProps): IrsaServiceA
           ...(namespace && { namespace }),
         },
       ],
-    };
+    }, defs?.roleBinding));
   }
 
   return result;
-}
+}, "IrsaServiceAccount");

package/src/composites/metrics-server.ts

@@ -5,6 +5,9 @@
  * EKS managed addon — it needs K8s workloads. Uses in-cluster RBAC only (no IRSA).
  */
 
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment, Service, ServiceAccount, ClusterRole, ClusterRoleBinding, APIService } from "../generated";
+
 export interface MetricsServerProps {
   /** Agent name (default: "metrics-server"). */
   name?: string;
@@ -16,20 +19,31 @@ export interface MetricsServerProps {
   namespace?: string;
   /** Additional labels. */
   labels?: Record<string, string>;
+  /** Per-member defaults for fine-grained overrides. */
+  defaults?: {
+    deployment?: Partial<Record<string, unknown>>;
+    service?: Partial<Record<string, unknown>>;
+    serviceAccount?: Partial<Record<string, unknown>>;
+    clusterRole?: Partial<Record<string, unknown>>;
+    clusterRoleBinding?: Partial<Record<string, unknown>>;
+    aggregatedClusterRole?: Partial<Record<string, unknown>>;
+    authDelegatorBinding?: Partial<Record<string, unknown>>;
+    apiService?: Partial<Record<string, unknown>>;
+  };
 }
 
 export interface MetricsServerResult {
-  deployment: Record<string, unknown>;
-  service: Record<string, unknown>;
-  serviceAccount: Record<string, unknown>;
-  clusterRole: Record<string, unknown>;
-  clusterRoleBinding: Record<string, unknown>;
+  deployment: InstanceType<typeof Deployment>;
+  service: InstanceType<typeof Service>;
+  serviceAccount: InstanceType<typeof ServiceAccount>;
+  clusterRole: InstanceType<typeof ClusterRole>;
+  clusterRoleBinding: InstanceType<typeof ClusterRoleBinding>;
   /** ClusterRole for aggregated API access. */
-  aggregatedClusterRole: Record<string, unknown>;
+  aggregatedClusterRole: InstanceType<typeof ClusterRole>;
   /** Binding for aggregated API auth-delegator. */
-  authDelegatorBinding: Record<string, unknown>;
+  authDelegatorBinding: InstanceType<typeof ClusterRoleBinding>;
   /** APIService registration for v1beta1.metrics.k8s.io. */
-  apiService: Record<string, unknown>;
+  apiService: InstanceType<typeof APIService>;
 }
 
 /**
@@ -43,13 +57,14 @@ export interface MetricsServerResult {
  * const ms = MetricsServer({});
  * ```
  */
-export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
+export const MetricsServer = Composite<MetricsServerProps>((props) => {
   const {
     name = "metrics-server",
     image = "registry.k8s.io/metrics-server/metrics-server:v0.7.2",
     replicas = 1,
     namespace = "kube-system",
     labels: extraLabels = {},
+    defaults: defs,
   } = props;
 
   const saName = `${name}-sa`;
@@ -60,7 +75,7 @@ export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
     ...extraLabels,
   };
 
-  const deployment: Record<string, unknown> = {
+  const deployment = new Deployment(mergeDefaults({
     metadata: {
       name,
       namespace,
@@ -114,9 +129,9 @@ export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
         },
       },
     },
-  };
+  }, defs?.deployment));
 
-  const service: Record<string, unknown> = {
+  const service = new Service(mergeDefaults({
     metadata: {
       name,
       namespace,
@@ -131,17 +146,17 @@ export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
       selector: { "app.kubernetes.io/name": name },
       ports: [{ port: 443, targetPort: 10250, protocol: "TCP", name: "https" }],
     },
-  };
+  }, defs?.service));
 
-  const serviceAccount: Record<string, unknown> = {
+  const serviceAccount = new ServiceAccount(mergeDefaults({
     metadata: {
       name: saName,
       namespace,
       labels: { ...commonLabels, "app.kubernetes.io/component": "metrics" },
     },
-  };
+  }, defs?.serviceAccount));
 
-  const clusterRole: Record<string, unknown> = {
+  const clusterRole = new ClusterRole(mergeDefaults({
     metadata: {
       name: `system:${name}`,
       labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
@@ -150,9 +165,9 @@ export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
       { apiGroups: [""], resources: ["pods", "nodes", "namespaces", "configmaps"], verbs: ["get", "list", "watch"] },
       { apiGroups: [""], resources: ["nodes/metrics", "nodes/stats"], verbs: ["get"] },
     ],
-  };
+  }, defs?.clusterRole));
 
-  const clusterRoleBinding: Record<string, unknown> = {
+  const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({
     metadata: {
       name: `system:${name}`,
       labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
@@ -163,9 +178,9 @@ export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
       name: `system:${name}`,
     },
     subjects: [{ kind: "ServiceAccount", name: saName, namespace }],
-  };
+  }, defs?.clusterRoleBinding));
 
-  const aggregatedClusterRole: Record<string, unknown> = {
+  const aggregatedClusterRole = new ClusterRole(mergeDefaults({
     metadata: {
       name: `system:${name}-aggregated-reader`,
       labels: {
@@ -179,9 +194,9 @@ export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
     rules: [
       { apiGroups: ["metrics.k8s.io"], resources: ["pods", "nodes"], verbs: ["get", "list", "watch"] },
     ],
-  };
+  }, defs?.aggregatedClusterRole));
 
-  const authDelegatorBinding: Record<string, unknown> = {
+  const authDelegatorBinding = new ClusterRoleBinding(mergeDefaults({
     metadata: {
       name: `${name}:system:auth-delegator`,
       labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
@@ -192,9 +207,9 @@ export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
       name: "system:auth-delegator",
     },
     subjects: [{ kind: "ServiceAccount", name: saName, namespace }],
-  };
+  }, defs?.authDelegatorBinding));
 
-  const apiService: Record<string, unknown> = {
+  const apiService = new APIService(mergeDefaults({
     apiVersion: "apiregistration.k8s.io/v1",
     kind: "APIService",
     metadata: {
@@ -209,7 +224,7 @@ export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
       groupPriorityMinimum: 100,
       versionPriority: 100,
     },
-  };
+  }, defs?.apiService));
 
   return {
     deployment,
@@ -221,4 +236,4 @@ export function MetricsServer(props: MetricsServerProps): MetricsServerResult {
     authDelegatorBinding,
     apiService,
   };
-}
+}, "MetricsServer");

package/src/composites/monitored-service.ts

@@ -6,6 +6,8 @@
  * as raw objects that can be serialized alongside native K8s resources.
  */
 
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment, Service } from "../generated";
 import type { ContainerSecurityContext } from "./security-context";
 
 export interface AlertRule {
@@ -54,13 +56,20 @@ export interface MonitoredServiceProps {
   env?: Array<{ name: string; value: string }>;
   /** Container security context (supports PSS restricted fields). */
   securityContext?: ContainerSecurityContext;
+  /** Per-member defaults for fine-grained overrides. */
+  defaults?: {
+    deployment?: Partial<Record<string, unknown>>;
+    service?: Partial<Record<string, unknown>>;
+    serviceMonitor?: Partial<Record<string, unknown>>;
+    prometheusRule?: Partial<Record<string, unknown>>;
+  };
 }
 
 export interface MonitoredServiceResult {
-  deployment: Record<string, unknown>;
-  service: Record<string, unknown>;
-  serviceMonitor: Record<string, unknown>;
-  prometheusRule?: Record<string, unknown>;
+  deployment: InstanceType<typeof Deployment>;
+  service: InstanceType<typeof Service>;
+  serviceMonitor: InstanceType<typeof Deployment>; // CRD — use Deployment as proxy type
+  prometheusRule?: InstanceType<typeof Deployment>; // CRD — use Deployment as proxy type
 }
 
 /**
@@ -82,7 +91,7 @@ export interface MonitoredServiceResult {
  * });
  * ```
  */
-export function MonitoredService(props: MonitoredServiceProps): MonitoredServiceResult {
+export const MonitoredService = Composite<MonitoredServiceProps>((props) => {
   const {
     name,
     image,
@@ -100,6 +109,7 @@ export function MonitoredService(props: MonitoredServiceProps): MonitoredService
     namespace,
     env,
     securityContext,
+    defaults: defs,
   } = props;
 
   const commonLabels: Record<string, string> = {
@@ -115,7 +125,7 @@ export function MonitoredService(props: MonitoredServiceProps): MonitoredService
     ports.push({ containerPort: metricsPort, name: "metrics" });
   }
 
-  const deploymentProps: Record<string, unknown> = {
+  const deployment = new Deployment(mergeDefaults({
     metadata: {
       name,
       ...(namespace && { namespace }),
@@ -143,7 +153,7 @@ export function MonitoredService(props: MonitoredServiceProps): MonitoredService
         },
       },
     },
-  };
+  }, defs?.deployment));
 
   const servicePorts: Array<Record<string, unknown>> = [
     { port: 80, targetPort: port, protocol: "TCP", name: "http" },
@@ -152,7 +162,7 @@ export function MonitoredService(props: MonitoredServiceProps): MonitoredService
     servicePorts.push({ port: metricsPort, targetPort: metricsPort, protocol: "TCP", name: "metrics" });
   }
 
-  const serviceProps: Record<string, unknown> = {
+  const service = new Service(mergeDefaults({
     metadata: {
       name,
       ...(namespace && { namespace }),
@@ -163,9 +173,10 @@ export function MonitoredService(props: MonitoredServiceProps): MonitoredService
       ports: servicePorts,
       type: "ClusterIP",
     },
-  };
+  }, defs?.service));
 
-  const serviceMonitorProps: Record<string, unknown> = {
+  // ServiceMonitor is a CRD — use Deployment constructor as a generic Declarable wrapper
+  const serviceMonitor = new Deployment(mergeDefaults({
     metadata: {
       name,
       ...(namespace && { namespace }),
@@ -183,16 +194,12 @@ export function MonitoredService(props: MonitoredServiceProps): MonitoredService
         },
       ],
     },
-  };
+  }, defs?.serviceMonitor));
 
-  const result: MonitoredServiceResult = {
-    deployment: deploymentProps,
-    service: serviceProps,
-    serviceMonitor: serviceMonitorProps,
-  };
+  const result: Record<string, any> = { deployment, service, serviceMonitor };
 
   if (alertRules && alertRules.length > 0) {
-    result.prometheusRule = {
+    result.prometheusRule = new Deployment(mergeDefaults({
       metadata: {
         name: `${name}-alerts`,
         ...(namespace && { namespace }),
@@ -214,8 +221,8 @@ export function MonitoredService(props: MonitoredServiceProps): MonitoredService
           },
         ],
       },
-    };
+    }, defs?.prometheusRule));
   }
 
   return result;
-}
+}, "MonitoredService");

package/src/composites/namespace-env.ts

@@ -5,6 +5,9 @@
  * resource guardrails and network isolation.
  */
 
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Namespace, ResourceQuota, LimitRange, NetworkPolicy } from "../generated";
+
 export interface NamespaceEnvProps {
   /** Namespace name. */
   name: string;
@@ -28,13 +31,20 @@ export interface NamespaceEnvProps {
   defaultDenyEgress?: boolean;
   /** Additional labels to apply to all resources. */
   labels?: Record<string, string>;
+  /** Per-member defaults for fine-grained overrides. */
+  defaults?: {
+    namespace?: Partial<Record<string, unknown>>;
+    resourceQuota?: Partial<Record<string, unknown>>;
+    limitRange?: Partial<Record<string, unknown>>;
+    networkPolicy?: Partial<Record<string, unknown>>;
+  };
 }
 
 export interface NamespaceEnvResult {
-  namespace: Record<string, unknown>;
-  resourceQuota?: Record<string, unknown>;
-  limitRange?: Record<string, unknown>;
-  networkPolicy?: Record<string, unknown>;
+  namespace: InstanceType<typeof Namespace>;
+  resourceQuota?: InstanceType<typeof ResourceQuota>;
+  limitRange?: InstanceType<typeof LimitRange>;
+  networkPolicy?: InstanceType<typeof NetworkPolicy>;
 }
 
 /**
@@ -55,7 +65,7 @@ export interface NamespaceEnvResult {
  * });
  * ```
  */
-export function NamespaceEnv(props: NamespaceEnvProps): NamespaceEnvResult {
+export const NamespaceEnv = Composite<NamespaceEnvProps>((props) => {
   const {
     name,
     cpuQuota,
@@ -68,6 +78,7 @@ export function NamespaceEnv(props: NamespaceEnvProps): NamespaceEnvResult {
     defaultDenyIngress = true,
     defaultDenyEgress = false,
     labels: extraLabels = {},
+    defaults: defs,
   } = props;
 
   const commonLabels: Record<string, string> = {
@@ -76,16 +87,14 @@ export function NamespaceEnv(props: NamespaceEnvProps): NamespaceEnvResult {
     ...extraLabels,
   };
 
-  const namespaceProps: Record<string, unknown> = {
+  const namespace = new Namespace(mergeDefaults({
     metadata: {
       name,
       labels: { ...commonLabels, "app.kubernetes.io/component": "namespace" },
     },
-  };
+  }, defs?.namespace));
 
-  const result: NamespaceEnvResult = {
-    namespace: namespaceProps,
-  };
+  const result: Record<string, any> = { namespace };
 
   // ResourceQuota — only if at least one quota prop is set
   const hasQuota = cpuQuota || memoryQuota || maxPods !== undefined;
@@ -95,14 +104,14 @@ export function NamespaceEnv(props: NamespaceEnvProps): NamespaceEnvResult {
     if (memoryQuota) hard["limits.memory"] = memoryQuota;
     if (maxPods !== undefined) hard.pods = String(maxPods);
 
-    result.resourceQuota = {
+    result.resourceQuota = new ResourceQuota(mergeDefaults({
       metadata: {
         name: `${name}-quota`,
         namespace: name,
         labels: { ...commonLabels, "app.kubernetes.io/component": "quota" },
       },
       spec: { hard },
-    };
+    }, defs?.resourceQuota));
   }
 
   // LimitRange — only if at least one default limit prop is set
@@ -127,7 +136,7 @@ export function NamespaceEnv(props: NamespaceEnvProps): NamespaceEnvResult {
     if (Object.keys(defaultLimits).length > 0) limit.default = defaultLimits;
     if (Object.keys(defaultRequests).length > 0) limit.defaultRequest = defaultRequests;
 
-    result.limitRange = {
+    result.limitRange = new LimitRange(mergeDefaults({
       metadata: {
         name: `${name}-limits`,
         namespace: name,
@@ -136,7 +145,7 @@ export function NamespaceEnv(props: NamespaceEnvProps): NamespaceEnvResult {
       spec: {
         limits: [limit],
       },
-    };
+    }, defs?.limitRange));
   }
 
   // NetworkPolicy — default-deny ingress and/or egress
@@ -146,7 +155,7 @@ export function NamespaceEnv(props: NamespaceEnvProps): NamespaceEnvResult {
     if (defaultDenyIngress) policyTypes.push("Ingress");
     if (defaultDenyEgress) policyTypes.push("Egress");
 
-    result.networkPolicy = {
+    result.networkPolicy = new NetworkPolicy(mergeDefaults({
       metadata: {
         name: `${name}-default-deny`,
         namespace: name,
@@ -156,8 +165,8 @@ export function NamespaceEnv(props: NamespaceEnvProps): NamespaceEnvResult {
         podSelector: {},
         policyTypes,
       },
-    };
+    }, defs?.networkPolicy));
   }
 
   return result;
-}
+}, "NamespaceEnv");

package/src/composites/network-isolated-app.ts

@@ -5,6 +5,8 @@
  * Creates fine-grained ingress/egress policies for a single application.
  */
 
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment, Service, NetworkPolicy } from "../generated";
 import type { ContainerSecurityContext } from "./security-context";
 
 export interface NetworkPolicyPeer {
@@ -48,12 +50,18 @@ export interface NetworkIsolatedAppProps {
   env?: Array<{ name: string; value: string }>;
   /** Container security context (supports PSS restricted fields). */
   securityContext?: ContainerSecurityContext;
+  /** Per-member defaults for fine-grained overrides. */
+  defaults?: {
+    deployment?: Partial<Record<string, unknown>>;
+    service?: Partial<Record<string, unknown>>;
+    networkPolicy?: Partial<Record<string, unknown>>;
+  };
 }
 
 export interface NetworkIsolatedAppResult {
-  deployment: Record<string, unknown>;
-  service: Record<string, unknown>;
-  networkPolicy: Record<string, unknown>;
+  deployment: InstanceType<typeof Deployment>;
+  service: InstanceType<typeof Service>;
+  networkPolicy: InstanceType<typeof NetworkPolicy>;
 }
 
 /**
@@ -77,7 +85,7 @@ export interface NetworkIsolatedAppResult {
  * });
  * ```
  */
-export function NetworkIsolatedApp(props: NetworkIsolatedAppProps): NetworkIsolatedAppResult {
+export const NetworkIsolatedApp = Composite<NetworkIsolatedAppProps>((props) => {
   const {
     name,
     image,
@@ -93,6 +101,7 @@ export function NetworkIsolatedApp(props: NetworkIsolatedAppProps): NetworkIsola
     namespace,
     env,
     securityContext,
+    defaults: defs,
   } = props;
 
   const commonLabels: Record<string, string> = {
@@ -101,7 +110,7 @@ export function NetworkIsolatedApp(props: NetworkIsolatedAppProps): NetworkIsola
     ...extraLabels,
   };
 
-  const deploymentProps: Record<string, unknown> = {
+  const deployment = new Deployment(mergeDefaults({
     metadata: {
       name,
       ...(namespace && { namespace }),
@@ -129,9 +138,9 @@ export function NetworkIsolatedApp(props: NetworkIsolatedAppProps): NetworkIsola
         },
       },
     },
-  };
+  }, defs?.deployment));
 
-  const serviceProps: Record<string, unknown> = {
+  const service = new Service(mergeDefaults({
     metadata: {
       name,
       ...(namespace && { namespace }),
@@ -142,7 +151,7 @@ export function NetworkIsolatedApp(props: NetworkIsolatedAppProps): NetworkIsola
       ports: [{ port: 80, targetPort: port, protocol: "TCP", name: "http" }],
       type: "ClusterIP",
     },
-  };
+  }, defs?.service));
 
   // Build network policy
   const policyTypes: string[] = [];
@@ -185,18 +194,14 @@ export function NetworkIsolatedApp(props: NetworkIsolatedAppProps): NetworkIsola
     policySpec.policyTypes = policyTypes;
   }
 
-  const networkPolicyProps: Record<string, unknown> = {
+  const networkPolicy = new NetworkPolicy(mergeDefaults({
     metadata: {
       name: `${name}-policy`,
       ...(namespace && { namespace }),
       labels: { ...commonLabels, "app.kubernetes.io/component": "network-policy" },
     },
     spec: policySpec,
-  };
+  }, defs?.networkPolicy));
 
-  return {
-    deployment: deploymentProps,
-    service: serviceProps,
-    networkPolicy: networkPolicyProps,
-  };
-}
+  return { deployment, service, networkPolicy };
+}, "NetworkIsolatedApp");