@intentius/chant-lexicon-k8s 0.124.30 → 0.124.32

package/dist/composites/cron-workload.js

@@ -0,0 +1,109 @@
+/**
+ * CronWorkload composite — CronJob + ServiceAccount + Role + RoleBinding.
+ *
+ * A higher-level construct for deploying scheduled workloads with
+ * proper RBAC permissions.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { CronJob, ServiceAccount, Role, RoleBinding } from "../generated/index.js";
+import { validateCronJobSchedule } from "./cron-schedule.js";
+/**
+ * Create a CronWorkload composite — returns prop objects for
+ * a CronJob, ServiceAccount, Role, and RoleBinding.
+ *
+ * @example
+ * ```ts
+ * import { CronWorkload } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { cronJob, serviceAccount, role, roleBinding } = CronWorkload({
+ *   name: "db-backup",
+ *   image: "postgres:16",
+ *   schedule: "0 2 * * *",
+ *   command: ["pg_dump", "-h", "postgres", "mydb"],
+ *   rbacRules: [
+ *     { apiGroups: [""], resources: ["secrets"], verbs: ["get"] },
+ *   ],
+ * });
+ * ```
+ */
+export const CronWorkload = Composite((props) => {
+    const { name, image, schedule, command, args, rbacRules = [], successfulJobsHistoryLimit = 3, failedJobsHistoryLimit = 1, restartPolicy = "OnFailure", labels: extraLabels = {}, namespace, env, securityContext, defaults: defs, } = props;
+    validateCronJobSchedule(`CronWorkload "${name}"`, schedule);
+    const saName = `${name}-sa`;
+    const roleName = `${name}-role`;
+    const bindingName = `${name}-binding`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const cronJob = new CronJob(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "worker" },
+        },
+        spec: {
+            schedule,
+            successfulJobsHistoryLimit,
+            failedJobsHistoryLimit,
+            jobTemplate: {
+                spec: {
+                    template: {
+                        spec: {
+                            serviceAccountName: saName,
+                            restartPolicy,
+                            containers: [
+                                {
+                                    name,
+                                    image,
+                                    ...(command && { command }),
+                                    ...(args && { args }),
+                                    ...(env && { env }),
+                                    ...(securityContext && { securityContext }),
+                                },
+                            ],
+                        },
+                    },
+                },
+            },
+        },
+    }, defs?.cronJob));
+    const serviceAccount = new ServiceAccount(mergeDefaults({
+        metadata: {
+            name: saName,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "worker" },
+        },
+    }, defs?.serviceAccount));
+    const role = new Role(mergeDefaults({
+        metadata: {
+            name: roleName,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        rules: rbacRules.length > 0 ? rbacRules : [
+            { apiGroups: [""], resources: ["pods"], verbs: ["get", "list"] },
+        ],
+    }, defs?.role));
+    const roleBinding = new RoleBinding(mergeDefaults({
+        metadata: {
+            name: bindingName,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        roleRef: {
+            apiGroup: "rbac.authorization.k8s.io",
+            kind: "Role",
+            name: roleName,
+        },
+        subjects: [
+            {
+                kind: "ServiceAccount",
+                name: saName,
+                ...(namespace && { namespace }),
+            },
+        ],
+    }, defs?.roleBinding));
+    return { cronJob, serviceAccount, role, roleBinding };
+}, "CronWorkload");

package/dist/composites/ebs-storage-class.js

@@ -0,0 +1,54 @@
+/**
+ * EbsStorageClass composite — StorageClass for AWS EBS CSI driver.
+ *
+ * @eks Creates a StorageClass with the `ebs.csi.aws.com` provisioner.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { StorageClass } from "../generated/index.js";
+/**
+ * Create an EbsStorageClass composite — returns prop objects for
+ * a StorageClass with the EBS CSI provisioner.
+ *
+ * @eks
+ * @example
+ * ```ts
+ * import { EbsStorageClass } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { storageClass } = EbsStorageClass({
+ *   name: "gp3-encrypted",
+ *   type: "gp3",
+ *   encrypted: true,
+ * });
+ * ```
+ */
+export const EbsStorageClass = Composite((props) => {
+    const { name, type = "gp3", iops, throughput, encrypted = true, kmsKeyId, fsType = "ext4", reclaimPolicy = "Delete", volumeBindingMode = "WaitForFirstConsumer", allowVolumeExpansion = true, labels: extraLabels = {}, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const parameters = {
+        type,
+        fsType,
+        encrypted: String(encrypted),
+    };
+    if (iops !== undefined)
+        parameters.iops = String(iops);
+    if (throughput !== undefined)
+        parameters.throughput = String(throughput);
+    if (kmsKeyId)
+        parameters.kmsKeyId = kmsKeyId;
+    const storageClass = new StorageClass(mergeDefaults({
+        metadata: {
+            name,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "storage" },
+        },
+        provisioner: "ebs.csi.aws.com",
+        parameters,
+        reclaimPolicy,
+        volumeBindingMode,
+        allowVolumeExpansion,
+    }, defs?.storageClass));
+    return { storageClass };
+}, "EbsStorageClass");

package/dist/composites/efs-storage-class.js

@@ -0,0 +1,46 @@
+/**
+ * EfsStorageClass composite — StorageClass for AWS EFS CSI driver.
+ *
+ * @eks Creates a StorageClass with the `efs.csi.aws.com` provisioner.
+ * EFS provides ReadWriteMany access mode (shared across pods/nodes).
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { StorageClass } from "../generated/index.js";
+/**
+ * Create an EfsStorageClass composite — returns prop objects for
+ * a StorageClass with the EFS CSI provisioner.
+ *
+ * @eks
+ * @example
+ * ```ts
+ * import { EfsStorageClass } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { storageClass } = EfsStorageClass({
+ *   name: "efs-shared",
+ *   fileSystemId: "fs-12345678",
+ * });
+ * ```
+ */
+export const EfsStorageClass = Composite((props) => {
+    const { name, fileSystemId, directoryPerms = "700", basePath = "/dynamic_provisioning", reclaimPolicy = "Delete", provisioningMode = "efs-ap", labels: extraLabels = {}, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const storageClass = new StorageClass(mergeDefaults({
+        metadata: {
+            name,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "storage" },
+        },
+        provisioner: "efs.csi.aws.com",
+        parameters: {
+            provisioningMode,
+            fileSystemId,
+            directoryPerms,
+            basePath,
+        },
+        reclaimPolicy,
+    }, defs?.storageClass));
+    return { storageClass };
+}, "EfsStorageClass");

package/dist/composites/external-dns-agent.js

@@ -0,0 +1,122 @@
+/**
+ * ExternalDnsAgent composite — Deployment + IRSA ServiceAccount + ClusterRole + ClusterRoleBinding.
+ *
+ * @eks ExternalDNS for Route53 DNS management. Common in production EKS setups
+ * where Ingress/Service hostnames should automatically create DNS records.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment, ServiceAccount, ClusterRole, ClusterRoleBinding } from "../generated/index.js";
+/**
+ * Create an ExternalDnsAgent composite — returns prop objects for
+ * a Deployment, ServiceAccount (with IRSA), ClusterRole, and ClusterRoleBinding.
+ *
+ * @eks
+ * @example
+ * ```ts
+ * import { ExternalDnsAgent } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { deployment, serviceAccount, clusterRole, clusterRoleBinding } = ExternalDnsAgent({
+ *   iamRoleArn: "arn:aws:iam::123456789012:role/external-dns-role",
+ *   domainFilters: ["example.com"],
+ *   txtOwnerId: "my-cluster",
+ * });
+ * ```
+ */
+export const ExternalDnsAgent = Composite((props) => {
+    const { iamRoleArn, domainFilters, provider = "aws", source = "ingress", txtOwnerId, name = "external-dns", image = "registry.k8s.io/external-dns/external-dns:v0.14.0", namespace = "kube-system", labels: extraLabels = {}, defaults: defs, } = props;
+    const saName = `${name}-sa`;
+    const clusterRoleName = `${name}-role`;
+    const bindingName = `${name}-binding`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    // Build args for external-dns
+    const args = [
+        `--source=${source}`,
+        `--provider=${provider}`,
+        "--policy=upsert-only",
+        "--registry=txt",
+    ];
+    for (const domain of domainFilters) {
+        args.push(`--domain-filter=${domain}`);
+    }
+    if (txtOwnerId) {
+        args.push(`--txt-owner-id=${txtOwnerId}`);
+    }
+    const deployment = new Deployment(mergeDefaults({
+        metadata: {
+            name,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "dns" },
+        },
+        spec: {
+            replicas: 1,
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+            template: {
+                metadata: { labels: { "app.kubernetes.io/name": name, ...extraLabels } },
+                spec: {
+                    serviceAccountName: saName,
+                    containers: [
+                        {
+                            name,
+                            image,
+                            args,
+                            resources: {
+                                requests: { cpu: "50m", memory: "64Mi" },
+                                limits: { cpu: "100m", memory: "128Mi" },
+                            },
+                            securityContext: {
+                                runAsNonRoot: true,
+                                runAsUser: 65534,
+                                readOnlyRootFilesystem: true,
+                                allowPrivilegeEscalation: false,
+                            },
+                        },
+                    ],
+                },
+            },
+        },
+    }, defs?.deployment));
+    const serviceAccount = new ServiceAccount(mergeDefaults({
+        metadata: {
+            name: saName,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "dns" },
+            annotations: {
+                "eks.amazonaws.com/role-arn": iamRoleArn,
+            },
+        },
+    }, defs?.serviceAccount));
+    const clusterRole = new ClusterRole(mergeDefaults({
+        metadata: {
+            name: clusterRoleName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        rules: [
+            { apiGroups: [""], resources: ["services", "endpoints", "pods"], verbs: ["get", "watch", "list"] },
+            { apiGroups: ["extensions", "networking.k8s.io"], resources: ["ingresses"], verbs: ["get", "watch", "list"] },
+            { apiGroups: [""], resources: ["nodes"], verbs: ["list", "watch"] },
+        ],
+    }, defs?.clusterRole));
+    const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({
+        metadata: {
+            name: bindingName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        roleRef: {
+            apiGroup: "rbac.authorization.k8s.io",
+            kind: "ClusterRole",
+            name: clusterRoleName,
+        },
+        subjects: [
+            {
+                kind: "ServiceAccount",
+                name: saName,
+                namespace,
+            },
+        ],
+    }, defs?.clusterRoleBinding));
+    return { deployment, serviceAccount, clusterRole, clusterRoleBinding };
+}, "ExternalDnsAgent");

package/dist/composites/filestore-storage-class.js

@@ -0,0 +1,49 @@
+/**
+ * FilestoreStorageClass composite — StorageClass for GCP Filestore CSI driver.
+ *
+ * @gke Creates a StorageClass with the `filestore.csi.storage.gke.io` provisioner.
+ * Filestore provides ReadWriteMany access mode (shared across pods/nodes).
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { StorageClass } from "../generated/index.js";
+/**
+ * Create a FilestoreStorageClass composite — returns prop objects for
+ * a StorageClass with the GCP Filestore CSI provisioner.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { FilestoreStorageClass } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { storageClass } = FilestoreStorageClass({
+ *   name: "filestore-standard",
+ *   tier: "standard",
+ *   network: "default",
+ * });
+ * ```
+ */
+export const FilestoreStorageClass = Composite((props) => {
+    const { name, tier = "standard", network, reclaimPolicy = "Delete", volumeBindingMode = "WaitForFirstConsumer", labels: extraLabels = {}, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const parameters = {
+        tier,
+    };
+    if (network) {
+        parameters.network = network;
+    }
+    const storageClass = new StorageClass(mergeDefaults({
+        metadata: {
+            name,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "storage" },
+        },
+        provisioner: "filestore.csi.storage.gke.io",
+        parameters,
+        reclaimPolicy,
+        volumeBindingMode,
+    }, defs?.storageClass));
+    return { storageClass };
+}, "FilestoreStorageClass");

package/dist/composites/fluent-bit-agent.js

@@ -0,0 +1,157 @@
+/**
+ * FluentBitAgent composite — DaemonSet + RBAC + ConfigMap for Fluent Bit.
+ *
+ * @eks Thin wrapper around the NodeAgent pattern with Fluent Bit defaults
+ * (image, RBAC, CloudWatch output config).
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, ConfigMap } from "../generated/index.js";
+/**
+ * Create a FluentBitAgent composite — returns prop objects for
+ * a DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, and ConfigMap.
+ *
+ * @eks
+ * @example
+ * ```ts
+ * import { FluentBitAgent } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { daemonSet, serviceAccount, clusterRole, clusterRoleBinding, configMap } = FluentBitAgent({
+ *   logGroup: "/aws/eks/my-cluster/containers",
+ *   region: "us-east-1",
+ *   clusterName: "my-cluster",
+ * });
+ * ```
+ */
+export const FluentBitAgent = Composite((props) => {
+    const { name = "fluent-bit", image = "public.ecr.aws/aws-observability/aws-for-fluent-bit:stable", logGroup, region, clusterName, namespace = "amazon-cloudwatch", labels: extraLabels = {}, cpuRequest = "50m", memoryRequest = "64Mi", cpuLimit = "200m", memoryLimit = "128Mi", iamRoleArn, defaults: defs, } = props;
+    const saName = `${name}-sa`;
+    const clusterRoleName = `${name}-role`;
+    const bindingName = `${name}-binding`;
+    const configMapName = `${name}-config`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const fluentBitConfig = `[SERVICE]
+    Flush         5
+    Log_Level     info
+    Daemon        off
+    Parsers_File  parsers.conf
+
+[INPUT]
+    Name              tail
+    Tag               kube.*
+    Path              /var/log/containers/*.log
+    Parser            docker
+    DB                /var/fluent-bit/state/flb_container.db
+    Mem_Buf_Limit     5MB
+    Skip_Long_Lines   On
+    Refresh_Interval  10
+
+[FILTER]
+    Name                kubernetes
+    Match               kube.*
+    Kube_URL            https://kubernetes.default.svc:443
+    Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+    Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
+    Merge_Log           On
+    K8S-Logging.Parser  On
+    K8S-Logging.Exclude Off
+
+[OUTPUT]
+    Name                cloudwatch_logs
+    Match               *
+    region              ${region}
+    log_group_name      ${logGroup}
+    log_stream_prefix   ${clusterName}/
+    auto_create_group   true
+`;
+    const container = {
+        name,
+        image,
+        resources: {
+            requests: { cpu: cpuRequest, memory: memoryRequest },
+            limits: { cpu: cpuLimit, memory: memoryLimit },
+        },
+        volumeMounts: [
+            { name: "varlog", mountPath: "/var/log", readOnly: true },
+            { name: "config", mountPath: `/etc/${name}`, readOnly: true },
+            { name: "state", mountPath: "/var/fluent-bit/state" },
+        ],
+        securityContext: {
+            runAsUser: 0,
+            readOnlyRootFilesystem: true,
+            allowPrivilegeEscalation: false,
+        },
+    };
+    const daemonSet = new DaemonSet(mergeDefaults({
+        metadata: {
+            name,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "agent" },
+        },
+        spec: {
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+            template: {
+                metadata: { labels: { "app.kubernetes.io/name": name, ...extraLabels } },
+                spec: {
+                    serviceAccountName: saName,
+                    containers: [container],
+                    volumes: [
+                        { name: "varlog", hostPath: { path: "/var/log" } },
+                        { name: "config", configMap: { name: configMapName } },
+                        { name: "state", hostPath: { path: `/var/fluent-bit/state/${name}` } },
+                    ],
+                    tolerations: [{ operator: "Exists" }],
+                },
+            },
+        },
+    }, defs?.daemonSet));
+    const serviceAccount = new ServiceAccount(mergeDefaults({
+        metadata: {
+            name: saName,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "agent" },
+            ...(iamRoleArn ? { annotations: { "eks.amazonaws.com/role-arn": iamRoleArn } } : {}),
+        },
+    }, defs?.serviceAccount));
+    const clusterRole = new ClusterRole(mergeDefaults({
+        metadata: {
+            name: clusterRoleName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        rules: [
+            { apiGroups: [""], resources: ["namespaces", "pods"], verbs: ["get", "list", "watch"] },
+        ],
+    }, defs?.clusterRole));
+    const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({
+        metadata: {
+            name: bindingName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        roleRef: {
+            apiGroup: "rbac.authorization.k8s.io",
+            kind: "ClusterRole",
+            name: clusterRoleName,
+        },
+        subjects: [
+            {
+                kind: "ServiceAccount",
+                name: saName,
+                namespace,
+            },
+        ],
+    }, defs?.clusterRoleBinding));
+    const configMap = new ConfigMap(mergeDefaults({
+        metadata: {
+            name: configMapName,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "config" },
+        },
+        data: {
+            "fluent-bit.conf": fluentBitConfig,
+        },
+    }, defs?.configMap));
+    return { daemonSet, serviceAccount, clusterRole, clusterRoleBinding, configMap };
+}, "FluentBitAgent");