@intentius/chant-lexicon-k8s 0.124.30 → 0.124.32

package/dist/composites/flux-app.js

@@ -0,0 +1,156 @@
+/**
+ * Flux CD composites — turn Chant build targets into Flux sources and
+ * `Kustomization`s.
+ *
+ * The k8s lexicon stays runtime-agnostic: it only emits manifests. These
+ * composites are the opt-in bridge to Flux's reconciliation layer, the
+ * `ArgoAppFor` analogue for the source-controller/kustomize-controller pair.
+ * Authoring a `GitRepository` + `Kustomization` by hand is ~40 lines of YAML
+ * per app; `FluxAppFor` collapses the pair to one call with defaults taken
+ * from real Flux estates.
+ *
+ * - FluxGitSource(name, opts) → a single K8s::Flux::GitRepository
+ * - FluxAppFor(target, opts)  → a single K8s::Flux::Kustomization
+ *
+ * The two are split deliberately: the common estate shape is one source
+ * shared by many Kustomizations. A `GitRepository` per app is the mistake
+ * this split makes hard — declare the source once, hand its result to every
+ * `FluxAppFor` that reconciles a path out of it.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { GitRepository as GitRepositoryResource, Kustomization as KustomizationResource, } from "../generated/index.js";
+// ── Shared types ─────────────────────────────────────────────────────────────
+/** The namespace the Flux controllers run in and watch by default. */
+const FLUX_NAMESPACE = "flux-system";
+/** knr-ops's name for the bootstrap-injected age identity Secret, and the
+ * name `flux bootstrap` documentation uses. */
+const SOPS_AGE_SECRET_NAME = "sops-age";
+const FluxGitRepository = Composite((props) => {
+    const { name, url, branch = "main", tag, interval = "5m", secretRef, fluxNamespace = FLUX_NAMESPACE, labels = {}, defaults, } = props;
+    const gitRepository = new GitRepositoryResource(mergeDefaults({
+        metadata: {
+            name,
+            namespace: fluxNamespace,
+            labels: {
+                "app.kubernetes.io/name": name,
+                "app.kubernetes.io/managed-by": "chant",
+                ...labels,
+            },
+        },
+        spec: {
+            interval,
+            url,
+            // An unset spec.ref falls back to `master` — always pin (FLUX001).
+            ref: tag !== undefined ? { tag } : { branch },
+            ...(secretRef !== undefined && { secretRef: { name: secretRef } }),
+        },
+    }, defaults?.gitRepository));
+    return { gitRepository };
+}, "FluxGitRepository");
+/**
+ * Declare a Flux `GitRepository` source in one call.
+ *
+ * Declare it once and share it: every `FluxAppFor` that reconciles a path out
+ * of the same repo should take this result as its `source`.
+ *
+ * @example
+ * ```ts
+ * import { FluxGitSource } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const source = FluxGitSource("home-chant", {
+ *   url: "https://github.com/jhgaylor/home-chant",
+ *   branch: "main",
+ * });
+ * ```
+ */
+export function FluxGitSource(name, options) {
+    return FluxGitRepository({ name, ...options });
+}
+/** Resolve the `source` option to a rendered sourceRef. */
+function resolveSourceRef(target, source) {
+    if (typeof source === "string") {
+        return { kind: "GitRepository", name: source };
+    }
+    if ("gitRepository" in source && source.gitRepository !== undefined) {
+        const metadata = source.gitRepository
+            .props?.metadata;
+        const name = metadata?.name;
+        if (typeof name !== "string" || name === "") {
+            throw new Error(`FluxAppFor("${target}"): the supplied FluxGitSource result has no metadata.name to reference.`);
+        }
+        return {
+            kind: "GitRepository",
+            name,
+            ...(typeof metadata?.namespace === "string" && { namespace: metadata.namespace }),
+        };
+    }
+    const ref = source;
+    return {
+        kind: ref.kind ?? "GitRepository",
+        name: ref.name,
+        ...(ref.namespace !== undefined && { namespace: ref.namespace }),
+    };
+}
+const FluxKustomization = Composite((props) => {
+    const { target, source, path, targetNamespace, interval = "10m", prune = true, wait = true, dependsOn = [], timeout, suspend, serviceAccountName, decryption, fluxNamespace = FLUX_NAMESPACE, labels = {}, defaults, } = props;
+    const sourceRef = resolveSourceRef(target, source);
+    const decryptionSpec = decryption === undefined
+        ? undefined
+        : {
+            provider: "sops",
+            secretRef: {
+                name: typeof decryption === "string" ? SOPS_AGE_SECRET_NAME : decryption.secretRef ?? SOPS_AGE_SECRET_NAME,
+            },
+        };
+    // The Kustomization's namespace also scopes the sourceRef: an in-spec
+    // sourceRef without a namespace resolves in the Kustomization's own.
+    const kustomization = new KustomizationResource(mergeDefaults({
+        metadata: {
+            name: target,
+            namespace: fluxNamespace,
+            labels: {
+                "app.kubernetes.io/name": target,
+                "app.kubernetes.io/managed-by": "chant",
+                ...labels,
+            },
+        },
+        spec: {
+            interval,
+            path,
+            prune,
+            wait,
+            sourceRef,
+            ...(targetNamespace !== undefined && { targetNamespace }),
+            ...(dependsOn.length > 0 && { dependsOn: dependsOn.map((name) => ({ name })) }),
+            ...(timeout !== undefined && { timeout }),
+            ...(suspend !== undefined && { suspend }),
+            ...(serviceAccountName !== undefined && { serviceAccountName }),
+            ...(decryptionSpec !== undefined && { decryption: decryptionSpec }),
+        },
+    }, defaults?.kustomization));
+    return { kustomization };
+}, "FluxKustomization");
+/**
+ * Reconcile a Chant build target with Flux in one call — the `Kustomization`
+ * half of the GitRepository + Kustomization pair. The source is passed in,
+ * not created here, so many apps share one repo declaration.
+ *
+ * @example
+ * ```ts
+ * import { FluxGitSource, FluxAppFor } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const source = FluxGitSource("home-chant", {
+ *   url: "https://github.com/jhgaylor/home-chant",
+ * });
+ *
+ * export const hello = FluxAppFor("hello-chant", {
+ *   source,
+ *   path: "./apps/hello-chant/k8s",
+ *   targetNamespace: "default",
+ *   dependsOn: ["cert-manager", "traefik"],
+ * });
+ * ```
+ */
+export function FluxAppFor(target, options) {
+    return FluxKustomization({ target, ...options });
+}

package/dist/composites/gce-ingress.js

@@ -0,0 +1,83 @@
+/**
+ * GceIngress composite — Ingress with GCE Ingress Controller annotations.
+ *
+ * @gke Full `kubernetes.io/ingress.*` and `networking.gke.io/*` annotation set
+ * including static IP, managed certificates, and FrontendConfig.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Ingress } from "../generated/index.js";
+/**
+ * Create a GceIngress composite — returns prop objects for
+ * an Ingress with GCE Ingress Controller annotations.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { GceIngress } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { ingress } = GceIngress({
+ *   name: "api-ingress",
+ *   hosts: [
+ *     {
+ *       hostname: "api.example.com",
+ *       paths: [{ path: "/", serviceName: "api", servicePort: 80 }],
+ *     },
+ *   ],
+ *   staticIpName: "microservice-ip",
+ *   managedCertificate: "api-cert",
+ * });
+ * ```
+ */
+export const GceIngress = Composite((props) => {
+    const { name, hosts, staticIpName, managedCertificate, frontendConfig, healthCheckPath, sslRedirect, annotations: extraAnnotations = {}, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    // Build GCE annotations
+    const annotations = {
+        "kubernetes.io/ingress.class": "gce",
+        ...extraAnnotations,
+    };
+    if (staticIpName) {
+        annotations["kubernetes.io/ingress.global-static-ip-name"] = staticIpName;
+    }
+    if (managedCertificate) {
+        annotations["networking.gke.io/managed-certificates"] = managedCertificate;
+    }
+    if (frontendConfig) {
+        annotations["networking.gke.io/v1beta1.FrontendConfig"] = frontendConfig;
+    }
+    if (sslRedirect ?? !!managedCertificate) {
+        annotations["networking.gke.io/v1beta1.FrontendConfig"] =
+            annotations["networking.gke.io/v1beta1.FrontendConfig"] ?? `${name}-frontend-config`;
+    }
+    if (healthCheckPath) {
+        annotations["cloud.google.com/neg"] = '{"ingress": true}';
+    }
+    const ingressRules = hosts.map((host) => ({
+        host: host.hostname,
+        http: {
+            paths: host.paths.map((p) => ({
+                path: p.path,
+                pathType: p.pathType ?? "Prefix",
+                backend: {
+                    service: { name: p.serviceName, port: { number: p.servicePort } },
+                },
+            })),
+        },
+    }));
+    const ingress = new Ingress(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "ingress" },
+            annotations,
+        },
+        spec: {
+            rules: ingressRules,
+        },
+    }, defs?.ingress));
+    return { ingress };
+}, "GceIngress");

package/dist/composites/gce-pd-storage-class.js

@@ -0,0 +1,49 @@
+/**
+ * GcePdStorageClass composite — StorageClass for GCE Persistent Disk CSI driver.
+ *
+ * @gke Creates a StorageClass with the `pd.csi.storage.gke.io` provisioner.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { StorageClass } from "../generated/index.js";
+/**
+ * Create a GcePdStorageClass composite — returns prop objects for
+ * a StorageClass with the GCE Persistent Disk CSI provisioner.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { GcePdStorageClass } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { storageClass } = GcePdStorageClass({
+ *   name: "pd-ssd",
+ *   type: "pd-ssd",
+ * });
+ * ```
+ */
+export const GcePdStorageClass = Composite((props) => {
+    const { name, type = "pd-balanced", replicationType = "none", fsType = "ext4", reclaimPolicy = "Delete", volumeBindingMode = "WaitForFirstConsumer", allowVolumeExpansion = true, labels: extraLabels = {}, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const parameters = {
+        type,
+        "csi.storage.k8s.io/fstype": fsType,
+    };
+    if (replicationType !== "none") {
+        parameters["replication-type"] = replicationType;
+    }
+    const storageClass = new StorageClass(mergeDefaults({
+        metadata: {
+            name,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "storage" },
+        },
+        provisioner: "pd.csi.storage.gke.io",
+        parameters,
+        reclaimPolicy,
+        volumeBindingMode,
+        allowVolumeExpansion,
+    }, defs?.storageClass));
+    return { storageClass };
+}, "GcePdStorageClass");

package/dist/composites/gke-external-dns-agent.js

@@ -0,0 +1,129 @@
+/**
+ * GkeExternalDnsAgent composite — Deployment + ServiceAccount + ClusterRole + ClusterRoleBinding.
+ *
+ * @gke Like ExternalDnsAgent but uses --provider=google and GKE Workload Identity
+ * instead of IRSA for Cloud DNS management.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment, ServiceAccount, ClusterRole, ClusterRoleBinding } from "../generated/index.js";
+/**
+ * Create a GkeExternalDnsAgent composite — returns prop objects for
+ * a Deployment, ServiceAccount (with Workload Identity), ClusterRole, and ClusterRoleBinding.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { GkeExternalDnsAgent } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { deployment, serviceAccount, clusterRole, clusterRoleBinding } = GkeExternalDnsAgent({
+ *   gcpServiceAccountEmail: "external-dns@my-project.iam.gserviceaccount.com",
+ *   gcpProjectId: "my-project",
+ *   domainFilters: ["example.com"],
+ *   txtOwnerId: "my-cluster",
+ * });
+ * ```
+ */
+export const GkeExternalDnsAgent = Composite((props) => {
+    const { gcpServiceAccountEmail, gcpProjectId, domainFilters, txtOwnerId, source = "ingress", name = "external-dns", image = "registry.k8s.io/external-dns/external-dns:v0.14.0", namespace = "kube-system", labels: extraLabels = {}, defaults: defs, } = props;
+    const saName = `${name}-sa`;
+    const clusterRoleName = `${name}-role`;
+    const bindingName = `${name}-binding`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const sources = Array.isArray(source) ? source : [source];
+    const args = [
+        ...sources.map((s) => `--source=${s}`),
+        "--provider=google",
+        `--google-project=${gcpProjectId}`,
+        "--policy=upsert-only",
+        "--registry=txt",
+    ];
+    for (const domain of domainFilters) {
+        args.push(`--domain-filter=${domain}`);
+    }
+    if (txtOwnerId) {
+        args.push(`--txt-owner-id=${txtOwnerId}`);
+    }
+    const deployment = new Deployment(mergeDefaults({
+        metadata: {
+            name,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "dns" },
+        },
+        spec: {
+            replicas: 1,
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+            template: {
+                metadata: { labels: { "app.kubernetes.io/name": name, ...extraLabels } },
+                spec: {
+                    serviceAccountName: saName,
+                    containers: [
+                        {
+                            name,
+                            image,
+                            args,
+                            resources: {
+                                requests: { cpu: "50m", memory: "64Mi" },
+                                limits: { cpu: "100m", memory: "128Mi" },
+                            },
+                            securityContext: {
+                                runAsNonRoot: true,
+                                runAsUser: 65534,
+                                readOnlyRootFilesystem: true,
+                                allowPrivilegeEscalation: false,
+                            },
+                        },
+                    ],
+                },
+            },
+        },
+    }, defs?.deployment));
+    const serviceAccount = new ServiceAccount(mergeDefaults({
+        metadata: {
+            name: saName,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "dns" },
+            annotations: {
+                "iam.gke.io/gcp-service-account": gcpServiceAccountEmail,
+            },
+        },
+    }, defs?.serviceAccount));
+    const clusterRole = new ClusterRole(mergeDefaults({
+        metadata: {
+            name: clusterRoleName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        rules: [
+            { apiGroups: [""], resources: ["services", "endpoints", "pods"], verbs: ["get", "watch", "list"] },
+            { apiGroups: ["extensions", "networking.k8s.io"], resources: ["ingresses"], verbs: ["get", "watch", "list"] },
+            { apiGroups: [""], resources: ["nodes"], verbs: ["list", "watch"] },
+        ],
+    }, defs?.clusterRole));
+    const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({
+        metadata: {
+            name: bindingName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        roleRef: {
+            apiGroup: "rbac.authorization.k8s.io",
+            kind: "ClusterRole",
+            name: clusterRoleName,
+        },
+        subjects: [
+            {
+                kind: "ServiceAccount",
+                name: saName,
+                namespace,
+            },
+        ],
+    }, defs?.clusterRoleBinding));
+    return {
+        deployment,
+        serviceAccount,
+        clusterRole,
+        clusterRoleBinding,
+    };
+}, "GkeExternalDnsAgent");

package/dist/composites/gke-fluent-bit-agent.js

@@ -0,0 +1,165 @@
+/**
+ * GkeFluentBitAgent composite — DaemonSet + RBAC + ConfigMap for Fluent Bit on GKE.
+ *
+ * @gke Like FluentBitAgent but targets Cloud Logging via the stackdriver
+ * output plugin and uses GKE Workload Identity instead of IRSA.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, ConfigMap } from "../generated/index.js";
+/**
+ * Create a GkeFluentBitAgent composite — returns prop objects for
+ * a DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, and ConfigMap.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { GkeFluentBitAgent } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { daemonSet, serviceAccount, clusterRole, clusterRoleBinding, configMap } = GkeFluentBitAgent({
+ *   clusterName: "my-cluster",
+ *   projectId: "my-project",
+ *   gcpServiceAccountEmail: "fluent-bit@my-project.iam.gserviceaccount.com",
+ * });
+ * ```
+ */
+export const GkeFluentBitAgent = Composite((props) => {
+    const { clusterName, projectId, gcpServiceAccountEmail, name = "fluent-bit", image = "fluent/fluent-bit:latest", namespace = "gke-logging", labels: extraLabels = {}, cpuRequest = "50m", memoryRequest = "64Mi", cpuLimit = "200m", memoryLimit = "128Mi", defaults: defs, } = props;
+    const saName = `${name}-sa`;
+    const clusterRoleName = `${name}-role`;
+    const bindingName = `${name}-binding`;
+    const configMapName = `${name}-config`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const fluentBitConfig = `[SERVICE]
+    Flush         5
+    Log_Level     info
+    Daemon        off
+    Parsers_File  parsers.conf
+
+[INPUT]
+    Name              tail
+    Tag               kube.*
+    Path              /var/log/containers/*.log
+    Parser            docker
+    DB                /var/fluent-bit/state/flb_container.db
+    Mem_Buf_Limit     5MB
+    Skip_Long_Lines   On
+    Refresh_Interval  10
+
+[FILTER]
+    Name                kubernetes
+    Match               kube.*
+    Kube_URL            https://kubernetes.default.svc:443
+    Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+    Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
+    Merge_Log           On
+    K8S-Logging.Parser  On
+    K8S-Logging.Exclude Off
+
+[OUTPUT]
+    Name                stackdriver
+    Match               *
+    google_service_credentials /var/run/secrets/kubernetes.io/serviceaccount/token
+    resource            k8s_container
+    k8s_cluster_name    ${clusterName}
+    k8s_cluster_location ${projectId}
+`;
+    const container = {
+        name,
+        image,
+        resources: {
+            requests: { cpu: cpuRequest, memory: memoryRequest },
+            limits: { cpu: cpuLimit, memory: memoryLimit },
+        },
+        volumeMounts: [
+            { name: "varlog", mountPath: "/var/log", readOnly: true },
+            { name: "config", mountPath: `/etc/${name}`, readOnly: true },
+            { name: "state", mountPath: "/var/fluent-bit/state" },
+        ],
+        securityContext: {
+            runAsUser: 0,
+            readOnlyRootFilesystem: true,
+            allowPrivilegeEscalation: false,
+        },
+    };
+    const daemonSet = new DaemonSet(mergeDefaults({
+        metadata: {
+            name,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "agent" },
+        },
+        spec: {
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+            template: {
+                metadata: { labels: { "app.kubernetes.io/name": name, ...extraLabels } },
+                spec: {
+                    serviceAccountName: saName,
+                    containers: [container],
+                    volumes: [
+                        { name: "varlog", hostPath: { path: "/var/log" } },
+                        { name: "config", configMap: { name: configMapName } },
+                        { name: "state", hostPath: { path: `/var/fluent-bit/state/${name}` } },
+                    ],
+                    tolerations: [{ operator: "Exists" }],
+                },
+            },
+        },
+    }, defs?.daemonSet));
+    const serviceAccount = new ServiceAccount(mergeDefaults({
+        metadata: {
+            name: saName,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "agent" },
+            ...(gcpServiceAccountEmail
+                ? { annotations: { "iam.gke.io/gcp-service-account": gcpServiceAccountEmail } }
+                : {}),
+        },
+    }, defs?.serviceAccount));
+    const clusterRole = new ClusterRole(mergeDefaults({
+        metadata: {
+            name: clusterRoleName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        rules: [
+            { apiGroups: [""], resources: ["namespaces", "pods"], verbs: ["get", "list", "watch"] },
+        ],
+    }, defs?.clusterRole));
+    const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({
+        metadata: {
+            name: bindingName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        roleRef: {
+            apiGroup: "rbac.authorization.k8s.io",
+            kind: "ClusterRole",
+            name: clusterRoleName,
+        },
+        subjects: [
+            {
+                kind: "ServiceAccount",
+                name: saName,
+                namespace,
+            },
+        ],
+    }, defs?.clusterRoleBinding));
+    const configMap = new ConfigMap(mergeDefaults({
+        metadata: {
+            name: configMapName,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "config" },
+        },
+        data: {
+            "fluent-bit.conf": fluentBitConfig,
+        },
+    }, defs?.configMap));
+    return {
+        daemonSet,
+        serviceAccount,
+        clusterRole,
+        clusterRoleBinding,
+        configMap,
+    };
+}, "GkeFluentBitAgent");

package/dist/composites/gke-gateway.js

@@ -0,0 +1,91 @@
+/**
+ * GkeGateway composite — Gateway + HTTPRoute for GKE Gateway API.
+ *
+ * @gke Creates a Gateway with a GKE-specific `gatewayClassName` and
+ * HTTPRoute resources for traffic routing.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment } from "../generated/index.js";
+/**
+ * Create a GkeGateway composite — returns prop objects for
+ * a Gateway and HTTPRoute with GKE-specific gateway class.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { GkeGateway } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { gateway, httpRoute } = GkeGateway({
+ *   name: "api-gateway",
+ *   hosts: [
+ *     {
+ *       hostname: "api.example.com",
+ *       paths: [{ path: "/", serviceName: "api", servicePort: 80 }],
+ *     },
+ *   ],
+ *   certificateName: "api-cert",
+ * });
+ * ```
+ */
+export const GkeGateway = Composite((props) => {
+    const { name, gatewayClassName = "gke-l7-global-external-managed", hosts, certificateName, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const routeName = `${name}-route`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    // Build Gateway listeners
+    const listeners = [];
+    if (certificateName) {
+        listeners.push({
+            name: "https",
+            protocol: "HTTPS",
+            port: 443,
+            tls: {
+                mode: "Terminate",
+                certificateRefs: [{ kind: "ManagedCertificate", name: certificateName }],
+            },
+        });
+    }
+    else {
+        listeners.push({
+            name: "http",
+            protocol: "HTTP",
+            port: 80,
+        });
+    }
+    // Gateway and HTTPRoute are CRDs — use Deployment constructor as a generic Declarable wrapper
+    const gateway = new Deployment(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "gateway" },
+        },
+        spec: {
+            gatewayClassName,
+            listeners,
+        },
+    }, defs?.gateway));
+    // Build HTTPRoute rules
+    const hostnames = hosts.map((h) => h.hostname);
+    const rules = hosts.flatMap((host) => host.paths.map((p) => ({
+        matches: [{ path: { type: "PathPrefix", value: p.path } }],
+        backendRefs: [
+            { name: p.serviceName, port: p.servicePort },
+        ],
+    })));
+    const httpRoute = new Deployment(mergeDefaults({
+        metadata: {
+            name: routeName,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "route" },
+        },
+        spec: {
+            parentRefs: [{ name }],
+            hostnames,
+            rules,
+        },
+    }, defs?.httpRoute));
+    return { gateway, httpRoute };
+}, "GkeGateway");