@intentius/chant-lexicon-k8s 0.124.31 → 0.124.32

package/dist/composites/cockroachdb-region-stack.js

@@ -0,0 +1,369 @@
+/**
+ * CockroachDbRegionStack composite — all K8s resources for one CockroachDB region.
+ *
+ * Collapses the 8-file per-region K8s pattern into a single composite call:
+ * namespace, storage, CockroachDB StatefulSet, External Secrets, GCE Ingress,
+ * ExternalDNS, Cloud Armor BackendConfig, TLS cert, and optional Prometheus monitoring.
+ *
+ * @gke Requires: External Secrets Operator (ESO), ExternalDNS (via GkeExternalDnsAgent).
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { createResource } from "@intentius/chant/runtime";
+import { NetworkPolicy, Deployment, Service, ConfigMap, } from "../generated/index.js";
+import { NamespaceEnv } from "./namespace-env.js";
+import { GcePdStorageClass } from "./gce-pd-storage-class.js";
+import { CockroachDbCluster } from "./cockroachdb-cluster.js";
+import { GceIngress } from "./gce-ingress.js";
+import { GkeExternalDnsAgent } from "./gke-external-dns-agent.js";
+// ── External CRDs (not in main generated index) ──────────────────────────────────
+const ClusterSecretStore = createResource("K8s::ExternalSecrets::ClusterSecretStore", "k8s", {});
+const ExternalSecret = createResource("K8s::ExternalSecrets::ExternalSecret", "k8s", {});
+const BackendConfig = createResource("K8s::GKE::BackendConfig", "k8s", {});
+const ManagedCertificate = createResource("K8s::NetworkingGKE::ManagedCertificate", "k8s", {});
+const FrontendConfig = createResource("K8s::NetworkingGKEBeta::FrontendConfig", "k8s", {});
+/**
+ * Create a CockroachDbRegionStack composite — returns all K8s resources for one
+ * CockroachDB region in a single call.
+ *
+ * Replaces: namespace.ts, storage.ts, cockroachdb.ts, external-secrets.ts,
+ * ingress.ts, tls.ts, backend-config.ts, monitoring.ts (8 files → 1 call).
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { CockroachDbRegionStack } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const east = CockroachDbRegionStack({
+ *   region: "east",
+ *   namespace: "crdb-east",
+ *   domain: `east.${CRDB_DOMAIN}`,
+ *   internalDomain: `east.${INTERNAL_DOMAIN}`,
+ *   publicRootDomain: CRDB_DOMAIN,
+ *   projectId: GCP_PROJECT_ID,
+ *   clusterName: "gke-crdb-east",
+ *   clusterRegion: "us-east4",
+ *   crdbGsaEmail: `gke-crdb-east-crdb@${GCP_PROJECT_ID}.iam.gserviceaccount.com`,
+ *   externalDnsGsaEmail: `gke-crdb-east-dns@${GCP_PROJECT_ID}.iam.gserviceaccount.com`,
+ *   cockroachdb: {
+ *     locality: "cloud=gcp,region=us-east4",
+ *     joinAddresses: [...],
+ *     advertiseHostDomain: `east.${INTERNAL_DOMAIN}`,
+ *     skipInit: false,
+ *     mountClientCerts: true,
+ *   },
+ *   tls: {
+ *     gcpSecretNames: {
+ *       ca: "crdb-ca-crt", nodeCrt: "crdb-node-crt", nodeKey: "crdb-node-key",
+ *       clientRootCrt: "crdb-client-root-crt", clientRootKey: "crdb-client-root-key",
+ *     },
+ *   },
+ *   allowCidrs: ALL_CIDRS,
+ *   cloudArmor: { policyName: "crdb-ui-waf" },
+ *   monitoring: true,
+ * });
+ * ```
+ */
+export const CockroachDbRegionStack = Composite((props) => {
+    const { region, namespace: ns, domain, internalDomain, publicRootDomain, projectId, clusterName, clusterRegion, crdbGsaEmail, externalDnsGsaEmail, cockroachdb: crdbProps, tls, quota, allowCidrs = [], cloudArmor, monitoring = false, labels: extraLabels = {}, } = props;
+    const crdbName = crdbProps.name ?? "cockroachdb";
+    const commonLabels = {
+        "app.kubernetes.io/managed-by": "chant",
+        "app.kubernetes.io/part-of": `cockroachdb-multi-region`,
+        "app.kubernetes.io/instance": region,
+        ...extraLabels,
+    };
+    // ── Namespace + Quotas ─────────────────────────────────────────────────────────
+    const nsResult = NamespaceEnv({
+        name: ns,
+        ...(quota?.cpu && { cpuQuota: quota.cpu }),
+        ...(quota?.memory && { memoryQuota: quota.memory }),
+        ...(quota?.maxPods !== undefined && { maxPods: quota.maxPods }),
+        defaultCpuRequest: "250m",
+        defaultMemoryRequest: "512Mi",
+        defaultCpuLimit: "1",
+        defaultMemoryLimit: "4Gi",
+        defaultDenyIngress: true,
+        labels: {
+            "pod-security.kubernetes.io/enforce": "baseline",
+            "pod-security.kubernetes.io/enforce-version": "latest",
+            "pod-security.kubernetes.io/warn": "restricted",
+            "pod-security.kubernetes.io/audit": "restricted",
+            ...commonLabels,
+        },
+    });
+    // Allow CockroachDB inter-node (26257) + HTTP UI (8080) from all region CIDRs.
+    const crdbNetworkPolicy = new NetworkPolicy(mergeDefaults({
+        metadata: {
+            name: "allow-cockroachdb",
+            namespace: ns,
+            labels: commonLabels,
+        },
+        spec: {
+            podSelector: { matchLabels: { "app.kubernetes.io/name": crdbName } },
+            policyTypes: ["Ingress"],
+            ingress: allowCidrs.length > 0
+                ? [{
+                        from: allowCidrs.map((cidr) => ({ ipBlock: { cidr } })),
+                        ports: [
+                            { protocol: "TCP", port: 26257 },
+                            { protocol: "TCP", port: 8080 },
+                        ],
+                    }]
+                : [],
+        },
+    }, {}));
+    // ── Storage ────────────────────────────────────────────────────────────────────
+    const { storageClass } = GcePdStorageClass({
+        name: "pd-ssd",
+        type: "pd-ssd",
+        labels: commonLabels,
+    });
+    // ── CockroachDB Cluster ────────────────────────────────────────────────────────
+    const crdb = CockroachDbCluster({
+        name: crdbName,
+        namespace: ns,
+        replicas: crdbProps.replicas ?? 3,
+        image: crdbProps.image,
+        storageSize: crdbProps.storageSize,
+        storageClassName: "pd-ssd",
+        cpuLimit: crdbProps.cpuLimit,
+        memoryLimit: crdbProps.memoryLimit,
+        locality: crdbProps.locality,
+        joinAddresses: crdbProps.joinAddresses,
+        secure: true,
+        skipCertGen: true,
+        skipInit: crdbProps.skipInit,
+        mountClientCerts: crdbProps.mountClientCerts,
+        advertiseHostDomain: crdbProps.advertiseHostDomain,
+        extraCertNodeAddresses: crdbProps.extraCertNodeAddresses,
+        labels: commonLabels,
+        defaults: {
+            serviceAccount: {
+                metadata: {
+                    annotations: {
+                        "iam.gke.io/gcp-service-account": crdbGsaEmail,
+                    },
+                },
+            },
+            publicService: {
+                metadata: {
+                    annotations: {
+                        "cloud.google.com/backend-config": `{"default":"${crdbName}-ui-backend"}`,
+                        "cloud.google.com/app-protocols": `{"http":"HTTPS"}`,
+                    },
+                },
+            },
+            headlessService: {
+                metadata: {
+                    annotations: {
+                        "external-dns.alpha.kubernetes.io/hostname": internalDomain,
+                    },
+                },
+            },
+        },
+    });
+    // ── External Secrets (TLS certs from GCP Secret Manager) ──────────────────────
+    const secretStoreName = "gcp-secret-manager";
+    const gcpSecretStore = new ClusterSecretStore({
+        metadata: { name: secretStoreName },
+        spec: {
+            provider: {
+                gcpsm: {
+                    projectID: projectId,
+                    auth: {
+                        workloadIdentity: {
+                            clusterLocation: clusterRegion,
+                            clusterName,
+                            serviceAccountRef: { name: "external-secrets-sa", namespace: "kube-system" },
+                        },
+                    },
+                },
+            },
+        },
+    });
+    const nodeCertsSecret = new ExternalSecret({
+        metadata: { name: `${crdbName}-node-certs-eso`, namespace: ns },
+        spec: {
+            refreshInterval: "1h",
+            secretStoreRef: { name: secretStoreName, kind: "ClusterSecretStore" },
+            target: { name: `${crdbName}-node-certs`, creationPolicy: "Owner" },
+            data: [
+                { secretKey: "ca.crt", remoteRef: { key: tls.gcpSecretNames.ca } },
+                { secretKey: "node.crt", remoteRef: { key: tls.gcpSecretNames.nodeCrt } },
+                { secretKey: "node.key", remoteRef: { key: tls.gcpSecretNames.nodeKey } },
+            ],
+        },
+    });
+    const clientCertsSecret = new ExternalSecret({
+        metadata: { name: `${crdbName}-client-certs-eso`, namespace: ns },
+        spec: {
+            refreshInterval: "1h",
+            secretStoreRef: { name: secretStoreName, kind: "ClusterSecretStore" },
+            target: { name: `${crdbName}-client-certs`, creationPolicy: "Owner" },
+            data: [
+                { secretKey: "ca.crt", remoteRef: { key: tls.gcpSecretNames.ca } },
+                { secretKey: "client.root.crt", remoteRef: { key: tls.gcpSecretNames.clientRootCrt } },
+                { secretKey: "client.root.key", remoteRef: { key: tls.gcpSecretNames.clientRootKey } },
+            ],
+        },
+    });
+    // ── TLS: Managed Certificate + FrontendConfig ─────────────────────────────────
+    const certName = `${crdbName}-ui-cert`;
+    const frontendName = `${crdbName}-ui-frontend`;
+    const backendName = `${crdbName}-ui-backend`;
+    const crdbManagedCert = new ManagedCertificate({
+        metadata: {
+            name: certName,
+            namespace: ns,
+            labels: commonLabels,
+        },
+        spec: { domains: [domain] },
+    });
+    const crdbFrontendConfig = new FrontendConfig({
+        metadata: {
+            name: frontendName,
+            namespace: ns,
+            labels: commonLabels,
+        },
+        spec: {
+            redirectToHttps: {
+                enabled: true,
+                responseCodeName: "MOVED_PERMANENTLY_DEFAULT",
+            },
+        },
+    });
+    // ── GCE Ingress ────────────────────────────────────────────────────────────────
+    const { ingress: gceIngress } = GceIngress({
+        name: `${crdbName}-ui`,
+        hosts: [{
+                hostname: domain,
+                paths: [{ path: "/", serviceName: `${crdbName}-public`, servicePort: 8080 }],
+            }],
+        namespace: ns,
+        managedCertificate: certName,
+        frontendConfig: frontendName,
+        labels: commonLabels,
+    });
+    // ── ExternalDNS ────────────────────────────────────────────────────────────────
+    const dnsAgent = GkeExternalDnsAgent({
+        gcpServiceAccountEmail: externalDnsGsaEmail,
+        gcpProjectId: projectId,
+        domainFilters: [publicRootDomain, internalDomain.split(".").slice(1).join(".")],
+        txtOwnerId: clusterName,
+        source: ["service", "ingress"],
+        labels: commonLabels,
+    });
+    // ── Result object ─────────────────────────────────────────────────────────────
+    const result = {
+        // Namespace
+        ...nsResult,
+        crdbNetworkPolicy,
+        // Storage
+        storageClass,
+        // CockroachDB
+        cockroachdbServiceAccount: crdb.serviceAccount,
+        cockroachdbRole: crdb.role,
+        cockroachdbRoleBinding: crdb.roleBinding,
+        cockroachdbClusterRole: crdb.clusterRole,
+        cockroachdbClusterRoleBinding: crdb.clusterRoleBinding,
+        cockroachdbPublicService: crdb.publicService,
+        cockroachdbHeadlessService: crdb.headlessService,
+        cockroachdbPdb: crdb.pdb,
+        cockroachdbStatefulSet: crdb.statefulSet,
+        ...(crdb.initJob && { cockroachdbInitJob: crdb.initJob }),
+        // External Secrets
+        gcpSecretStore,
+        nodeCertsSecret,
+        clientCertsSecret,
+        // TLS
+        crdbManagedCert,
+        crdbFrontendConfig,
+        // Ingress + ExternalDNS
+        gceIngress,
+        dnsDeployment: dnsAgent.deployment,
+        dnsServiceAccount: dnsAgent.serviceAccount,
+        dnsClusterRole: dnsAgent.clusterRole,
+        dnsClusterRoleBinding: dnsAgent.clusterRoleBinding,
+    };
+    // Optional: Cloud Armor BackendConfig
+    if (cloudArmor) {
+        result.crdbBackendConfig = new BackendConfig({
+            metadata: {
+                name: backendName,
+                namespace: ns,
+                labels: commonLabels,
+            },
+            spec: {
+                securityPolicy: { name: cloudArmor.policyName },
+                healthCheck: { type: "HTTPS", requestPath: "/health", port: 8080 },
+            },
+        });
+    }
+    // Optional: Prometheus monitoring
+    if (monitoring) {
+        result.prometheusConfig = new ConfigMap({
+            metadata: { name: "prometheus-config", namespace: ns },
+            data: {
+                "prometheus.yml": [
+                    `global:`,
+                    `  scrape_interval: 15s`,
+                    `scrape_configs:`,
+                    `  - job_name: "cockroachdb"`,
+                    `    kubernetes_sd_configs:`,
+                    `      - role: pod`,
+                    `        namespaces:`,
+                    `          names: ["${ns}"]`,
+                    `    relabel_configs:`,
+                    `      - source_labels: [__meta_kubernetes_pod_label_app_kubernetes_io_name]`,
+                    `        regex: "cockroachdb"`,
+                    `        action: keep`,
+                    `      - source_labels: [__meta_kubernetes_pod_ip]`,
+                    `        target_label: __address__`,
+                    `        replacement: "$1:8080"`,
+                    `      - source_labels: [__meta_kubernetes_pod_name]`,
+                    `        target_label: instance`,
+                    `    metrics_path: "/_status/vars"`,
+                ].join("\n"),
+            },
+        });
+        result.prometheusDeployment = new Deployment({
+            metadata: {
+                name: "prometheus",
+                namespace: ns,
+                labels: { "app.kubernetes.io/name": "prometheus", ...commonLabels },
+            },
+            spec: {
+                replicas: 1,
+                selector: { matchLabels: { "app.kubernetes.io/name": "prometheus" } },
+                template: {
+                    metadata: { labels: { "app.kubernetes.io/name": "prometheus" } },
+                    spec: {
+                        containers: [{
+                                name: "prometheus",
+                                image: "prom/prometheus:v2.51.0",
+                                args: [
+                                    "--config.file=/etc/prometheus/prometheus.yml",
+                                    "--storage.tsdb.retention.time=15d",
+                                ],
+                                ports: [{ name: "http", containerPort: 9090 }],
+                                resources: {
+                                    requests: { cpu: "500m", memory: "1Gi" },
+                                    limits: { cpu: "1", memory: "2Gi" },
+                                },
+                                volumeMounts: [{ name: "config", mountPath: "/etc/prometheus" }],
+                            }],
+                        volumes: [{ name: "config", configMap: { name: "prometheus-config" } }],
+                    },
+                },
+            },
+        });
+        result.prometheusService = new Service({
+            metadata: { name: "prometheus", namespace: ns },
+            spec: {
+                selector: { "app.kubernetes.io/name": "prometheus" },
+                ports: [{ name: "http", port: 9090, targetPort: "http" }],
+            },
+        });
+    }
+    return result;
+}, "CockroachDbRegionStack");

package/dist/composites/config-connector-context.js

@@ -0,0 +1,40 @@
+/**
+ * ConfigConnectorContext composite — bootstrap Config Connector per-namespace context.
+ *
+ * @gke Creates a ConfigConnectorContext resource that configures
+ * Config Connector to manage GCP resources in a specific namespace.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment } from "../generated/index.js";
+/**
+ * Create a ConfigConnectorContext composite — returns prop objects for
+ * a ConfigConnectorContext resource.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { ConfigConnectorContext } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { context } = ConfigConnectorContext({
+ *   googleServiceAccountEmail: "cnrm@my-project.iam.gserviceaccount.com",
+ *   namespace: "config-connector",
+ * });
+ * ```
+ */
+export const ConfigConnectorContext = Composite((props) => {
+    const { name = "configconnectorcontext.core.cnrm.cloud.google.com", googleServiceAccountEmail, namespace = "default", stateIntoSpec = "Absent", defaults: defs, } = props;
+    // ConfigConnectorContext is a CRD — use Deployment constructor as a generic Declarable wrapper
+    const context = new Deployment(mergeDefaults({
+        apiVersion: "core.cnrm.cloud.google.com/v1beta1",
+        kind: "ConfigConnectorContext",
+        metadata: {
+            name,
+            namespace,
+        },
+        spec: {
+            googleServiceAccount: googleServiceAccountEmail,
+            stateIntoSpec,
+        },
+    }, defs?.context));
+    return { context };
+}, "ConfigConnectorContext");

package/dist/composites/configured-app.js

@@ -0,0 +1,135 @@
+/**
+ * ConfiguredApp composite — Deployment + Service + optional ConfigMap.
+ *
+ * Wires ConfigMap→Volume→VolumeMount and Secret→Volume→VolumeMount
+ * triangles, plus envFrom injection. Covers cdk8s-plus Volume.fromConfigMap(),
+ * Volume.fromSecret(), and container.mount() patterns.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment, Service, ConfigMap } from "../generated/index.js";
+/**
+ * Create a ConfiguredApp composite — returns prop objects for
+ * a Deployment, Service, and optional ConfigMap.
+ *
+ * @example
+ * ```ts
+ * import { ConfiguredApp } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { deployment, service, configMap } = ConfiguredApp({
+ *   name: "api",
+ *   image: "api:1.0",
+ *   port: 8080,
+ *   configData: { "app.conf": "key=value" },
+ *   configMountPath: "/etc/api",
+ *   secretName: "api-creds",
+ *   secretMountPath: "/secrets",
+ *   envFrom: { secretRef: "api-env-secret" },
+ * });
+ * ```
+ */
+export const ConfiguredApp = Composite((props) => {
+    const { name, image, port = 80, replicas = 2, configData, configMountPath, secretName, secretMountPath, envFrom, initContainers, labels: extraLabels = {}, cpuLimit = "500m", memoryLimit = "256Mi", cpuRequest = "100m", memoryRequest = "128Mi", namespace, env, securityContext, defaults: defs, } = props;
+    const configMapName = `${name}-config`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    // Build volumes and volumeMounts
+    const volumes = [];
+    const volumeMounts = [];
+    if (configData && configMountPath) {
+        volumes.push({
+            name: "config",
+            configMap: { name: configMapName },
+        });
+        volumeMounts.push({
+            name: "config",
+            mountPath: configMountPath,
+            readOnly: true,
+        });
+    }
+    if (secretName && secretMountPath) {
+        volumes.push({
+            name: "secret",
+            secret: { secretName },
+        });
+        volumeMounts.push({
+            name: "secret",
+            mountPath: secretMountPath,
+            readOnly: true,
+        });
+    }
+    // Build envFrom array
+    const envFromList = [];
+    if (envFrom?.configMapRef) {
+        envFromList.push({ configMapRef: { name: envFrom.configMapRef } });
+    }
+    if (envFrom?.secretRef) {
+        envFromList.push({ secretRef: { name: envFrom.secretRef } });
+    }
+    const container = {
+        name,
+        image,
+        ports: [{ containerPort: port, name: "http" }],
+        resources: {
+            limits: { cpu: cpuLimit, memory: memoryLimit },
+            requests: { cpu: cpuRequest, memory: memoryRequest },
+        },
+        ...(env && { env }),
+        ...(envFromList.length > 0 && { envFrom: envFromList }),
+        ...(volumeMounts.length > 0 && { volumeMounts }),
+        ...(securityContext && { securityContext }),
+    };
+    const podSpec = {
+        containers: [container],
+        ...(volumes.length > 0 && { volumes }),
+        ...(initContainers && {
+            initContainers: initContainers.map((ic) => ({
+                name: ic.name,
+                image: ic.image,
+                ...(ic.command && { command: ic.command }),
+                ...(ic.args && { args: ic.args }),
+            })),
+        }),
+    };
+    const deployment = new Deployment(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "server" },
+        },
+        spec: {
+            replicas,
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+            template: {
+                metadata: { labels: { "app.kubernetes.io/name": name, ...extraLabels } },
+                spec: podSpec,
+            },
+        },
+    }, defs?.deployment));
+    const service = new Service(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "server" },
+        },
+        spec: {
+            selector: { "app.kubernetes.io/name": name },
+            ports: [{ port: 80, targetPort: port, protocol: "TCP", name: "http" }],
+            type: "ClusterIP",
+        },
+    }, defs?.service));
+    const result = { deployment, service };
+    if (configData) {
+        result.configMap = new ConfigMap(mergeDefaults({
+            metadata: {
+                name: configMapName,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "config" },
+            },
+            data: configData,
+        }, defs?.configMap));
+    }
+    return result;
+}, "ConfiguredApp");

package/dist/composites/cron-schedule.js

@@ -0,0 +1,38 @@
+/**
+ * Shared CronJob schedule validation (issue #2071 item 4).
+ *
+ * `OperatorStack` and `CronWorkload` both hand their `schedule` field
+ * straight to a k8s `CronJob`, which parses only five fields (minute hour
+ * day-of-month month day-of-week). Core's own cron parser
+ * (`isValidCronExpression`, `packages/core/src/op/cron.ts`, #2120) is
+ * deliberately more permissive: it also accepts the 6-field Quartz form
+ * (`second minute hour dom month dow`) that a `ConvergeOp`'s own `schedule`
+ * may legitimately carry, since the final word on cron syntax belongs to
+ * whichever scheduler runs the string. A k8s CronJob is that scheduler here,
+ * and it is stricter than core's parser, so a 6-field `ConvergeOp` schedule
+ * reused as-is on a CronJob fails at `kubectl apply`, not at build time.
+ *
+ * This module gives both composites one place to catch that at construction,
+ * reusing core's parser rather than a second copy of it.
+ */
+import { isValidCronExpression } from "@intentius/chant/op";
+/**
+ * Validate `schedule` for a k8s CronJob, throwing before a bad value ever
+ * reaches `kubectl apply`. `context` names the composite (and host, for
+ * `OperatorStack`) so the thrown message reads like the rest of that
+ * composite's build-time refusals, e.g. `OperatorStack "chant-operator",
+ * host "fountain-observe"` or `CronWorkload "backup"`.
+ */
+export function validateCronJobSchedule(context, schedule) {
+    if (!schedule || schedule.trim().length === 0) {
+        throw new Error(`${context}: schedule is required. A CronJob with no schedule never ticks.`);
+    }
+    const fields = schedule.trim().split(/\s+/);
+    if (!isValidCronExpression(schedule)) {
+        throw new Error(`${context}: schedule "${schedule}" is not valid cron syntax. A Kubernetes CronJob takes five fields: minute hour day-of-month month day-of-week.`);
+    }
+    if (fields.length === 6) {
+        throw new Error(`${context}: schedule "${schedule}" is 6-field cron. A Kubernetes CronJob takes five fields (minute hour day-of-month month day-of-week) and has no seconds column. ` +
+            `A ConvergeOp schedule string in that form must be converted before it reaches a CronJob: drop the leading seconds field and keep the remaining five.`);
+    }
+}