@intentius/chant-lexicon-k8s 0.124.31 → 0.124.32

package/dist/composites/adot-collector.js

@@ -0,0 +1,184 @@
+/**
+ * AdotCollector composite — DaemonSet + RBAC + ConfigMap for AWS Distro for OpenTelemetry.
+ *
+ * @eks ADOT collector for CloudWatch and X-Ray. NodeAgent specialization
+ * with pre-configured pipelines for AWS observability.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, ConfigMap } from "../generated/index.js";
+/**
+ * Create an AdotCollector composite — returns prop objects for
+ * a DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, and ConfigMap.
+ *
+ * @eks
+ * @example
+ * ```ts
+ * import { AdotCollector } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { daemonSet, serviceAccount, clusterRole, clusterRoleBinding, configMap } = AdotCollector({
+ *   region: "us-east-1",
+ *   clusterName: "my-cluster",
+ *   exporters: ["cloudwatch", "xray"],
+ * });
+ * ```
+ */
+export const AdotCollector = Composite((props) => {
+    const { region, clusterName, exporters = ["cloudwatch", "xray"], name = "adot-collector", image = "public.ecr.aws/aws-observability/aws-otel-collector:latest", namespace = "amazon-metrics", labels: extraLabels = {}, cpuRequest = "100m", memoryRequest = "256Mi", cpuLimit = "500m", memoryLimit = "512Mi", iamRoleArn, defaults: defs, } = props;
+    const saName = `${name}-sa`;
+    const clusterRoleName = `${name}-role`;
+    const bindingName = `${name}-binding`;
+    const configMapName = `${name}-config`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    // Build ADOT config YAML
+    const exporterConfigs = [];
+    const exporterNames = [];
+    if (exporters.includes("cloudwatch")) {
+        exporterConfigs.push(`  awsemf:
+    region: ${region}
+    namespace: ContainerInsights
+    log_group_name: '/aws/containerinsights/${clusterName}/performance'
+    dimension_rollup_option: NoDimensionRollup`);
+        exporterNames.push("awsemf");
+    }
+    if (exporters.includes("xray")) {
+        exporterConfigs.push(`  awsxray:
+    region: ${region}`);
+        exporterNames.push("awsxray");
+    }
+    if (exporters.includes("prometheus")) {
+        exporterConfigs.push(`  prometheusremotewrite:
+    endpoint: http://prometheus:9090/api/v1/write`);
+        exporterNames.push("prometheusremotewrite");
+    }
+    const adotConfig = `receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: 0.0.0.0:4317
+      http:
+        endpoint: 0.0.0.0:4318
+
+processors:
+  batch:
+    timeout: 30s
+    send_batch_size: 8192
+
+exporters:
+${exporterConfigs.join("\n")}
+
+service:
+  pipelines:
+    metrics:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [${exporterNames.filter((e) => e !== "awsxray").join(", ") || "awsemf"}]
+    traces:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [${exporterNames.filter((e) => e !== "awsemf").join(", ") || "awsxray"}]
+`;
+    const container = {
+        name,
+        image,
+        args: ["--config=/etc/adot/config.yaml"],
+        ports: [
+            { containerPort: 4317, name: "otlp-grpc" },
+            { containerPort: 4318, name: "otlp-http" },
+        ],
+        resources: {
+            requests: { cpu: cpuRequest, memory: memoryRequest },
+            limits: { cpu: cpuLimit, memory: memoryLimit },
+        },
+        volumeMounts: [
+            { name: "config", mountPath: "/etc/adot", readOnly: true },
+        ],
+        securityContext: {
+            runAsNonRoot: true,
+            runAsUser: 10001,
+            readOnlyRootFilesystem: true,
+            allowPrivilegeEscalation: false,
+        },
+    };
+    const daemonSet = new DaemonSet(mergeDefaults({
+        metadata: {
+            name,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "agent" },
+        },
+        spec: {
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+            template: {
+                metadata: { labels: { "app.kubernetes.io/name": name, ...extraLabels } },
+                spec: {
+                    serviceAccountName: saName,
+                    containers: [container],
+                    volumes: [
+                        { name: "config", configMap: { name: configMapName } },
+                    ],
+                    tolerations: [{ operator: "Exists" }],
+                },
+            },
+        },
+    }, defs?.daemonSet));
+    const serviceAccount = new ServiceAccount(mergeDefaults({
+        metadata: {
+            name: saName,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "agent" },
+            ...(iamRoleArn ? { annotations: { "eks.amazonaws.com/role-arn": iamRoleArn } } : {}),
+        },
+    }, defs?.serviceAccount));
+    const clusterRole = new ClusterRole(mergeDefaults({
+        metadata: {
+            name: clusterRoleName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        rules: [
+            { apiGroups: [""], resources: ["pods", "nodes", "endpoints"], verbs: ["get", "list", "watch"] },
+            { apiGroups: ["apps"], resources: ["replicasets"], verbs: ["get", "list", "watch"] },
+            { apiGroups: ["batch"], resources: ["jobs"], verbs: ["get", "list", "watch"] },
+            { apiGroups: [""], resources: ["nodes/proxy"], verbs: ["get"] },
+            { apiGroups: [""], resources: ["nodes/stats", "configmaps", "events"], verbs: ["create", "get"] },
+            { apiGroups: [""], resources: ["configmaps"], verbs: ["get", "update", "create"], resourceNames: ["otel-container-insight-clusterleader"] },
+        ],
+    }, defs?.clusterRole));
+    const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({
+        metadata: {
+            name: bindingName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        roleRef: {
+            apiGroup: "rbac.authorization.k8s.io",
+            kind: "ClusterRole",
+            name: clusterRoleName,
+        },
+        subjects: [
+            {
+                kind: "ServiceAccount",
+                name: saName,
+                namespace,
+            },
+        ],
+    }, defs?.clusterRoleBinding));
+    const configMap = new ConfigMap(mergeDefaults({
+        metadata: {
+            name: configMapName,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "config" },
+        },
+        data: {
+            "config.yaml": adotConfig,
+        },
+    }, defs?.configMap));
+    return {
+        daemonSet,
+        serviceAccount,
+        clusterRole,
+        clusterRoleBinding,
+        configMap,
+    };
+}, "AdotCollector");

package/dist/composites/agic-ingress.js

@@ -0,0 +1,85 @@
+/**
+ * AgicIngress composite — Ingress with Azure Application Gateway Ingress Controller annotations.
+ *
+ * @aks Full `appgw.ingress.kubernetes.io/*` annotation set including SSL redirect,
+ * WAF policy, backend path prefix, and cookie-based affinity.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Ingress } from "../generated/index.js";
+/**
+ * Create an AgicIngress composite — returns prop objects for
+ * an Ingress with Azure Application Gateway Ingress Controller annotations.
+ *
+ * @aks
+ * @example
+ * ```ts
+ * import { AgicIngress } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { ingress } = AgicIngress({
+ *   name: "api-ingress",
+ *   hosts: [
+ *     {
+ *       hostname: "api.example.com",
+ *       paths: [{ path: "/", serviceName: "api", servicePort: 80 }],
+ *     },
+ *   ],
+ *   certificateArn: "keyvault-secret-name",
+ *   wafPolicyId: "/subscriptions/.../Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/my-waf",
+ * });
+ * ```
+ */
+export const AgicIngress = Composite((props) => {
+    const { name, hosts, certificateArn, wafPolicyId, healthCheckPath, sslRedirect, backendPathPrefix, cookieAffinity = false, annotations: extraAnnotations = {}, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    // Build AGIC annotations
+    const annotations = {
+        "kubernetes.io/ingress.class": "azure/application-gateway",
+        ...extraAnnotations,
+    };
+    if (sslRedirect ?? (certificateArn !== undefined)) {
+        annotations["appgw.ingress.kubernetes.io/ssl-redirect"] = "true";
+    }
+    if (certificateArn) {
+        annotations["appgw.ingress.kubernetes.io/appgw-ssl-certificate"] = certificateArn;
+    }
+    if (wafPolicyId) {
+        annotations["appgw.ingress.kubernetes.io/waf-policy-for-path"] = wafPolicyId;
+    }
+    if (healthCheckPath) {
+        annotations["appgw.ingress.kubernetes.io/health-probe-path"] = healthCheckPath;
+    }
+    if (backendPathPrefix) {
+        annotations["appgw.ingress.kubernetes.io/backend-path-prefix"] = backendPathPrefix;
+    }
+    if (cookieAffinity) {
+        annotations["appgw.ingress.kubernetes.io/cookie-based-affinity"] = "true";
+    }
+    const ingressRules = hosts.map((host) => ({
+        host: host.hostname,
+        http: {
+            paths: host.paths.map((p) => ({
+                path: p.path,
+                pathType: p.pathType ?? "Prefix",
+                backend: {
+                    service: { name: p.serviceName, port: { number: p.servicePort } },
+                },
+            })),
+        },
+    }));
+    const ingress = new Ingress(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "ingress" },
+            annotations,
+        },
+        spec: {
+            rules: ingressRules,
+        },
+    }, defs?.ingress));
+    return { ingress };
+}, "AgicIngress");

package/dist/composites/aks-external-dns-agent.js

@@ -0,0 +1,146 @@
+/**
+ * AksExternalDnsAgent composite — Deployment + ServiceAccount + ClusterRole + ClusterRoleBinding.
+ *
+ * @aks Like ExternalDnsAgent but uses --provider=azure and AKS Workload Identity
+ * instead of IRSA for Azure DNS management.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment, ServiceAccount, ClusterRole, ClusterRoleBinding } from "../generated/index.js";
+/**
+ * Create an AksExternalDnsAgent composite — returns prop objects for
+ * a Deployment, ServiceAccount (with AKS Workload Identity), ClusterRole, and ClusterRoleBinding.
+ *
+ * @aks
+ * @example
+ * ```ts
+ * import { AksExternalDnsAgent } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { deployment, serviceAccount, clusterRole, clusterRoleBinding } = AksExternalDnsAgent({
+ *   clientId: "00000000-0000-0000-0000-000000000000",
+ *   resourceGroup: "my-rg",
+ *   subscriptionId: "00000000-0000-0000-0000-000000000000",
+ *   tenantId: "00000000-0000-0000-0000-000000000000",
+ *   domainFilters: ["example.com"],
+ *   txtOwnerId: "my-cluster",
+ * });
+ * ```
+ */
+export const AksExternalDnsAgent = Composite((props) => {
+    const { clientId, resourceGroup, subscriptionId, tenantId, domainFilters, txtOwnerId, source = "ingress", name = "external-dns", image = "registry.k8s.io/external-dns/external-dns:v0.14.0", namespace = "kube-system", labels: extraLabels = {}, defaults: defs, } = props;
+    const saName = `${name}-sa`;
+    const clusterRoleName = `${name}-role`;
+    const bindingName = `${name}-binding`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const args = [
+        `--source=${source}`,
+        "--provider=azure",
+        `--azure-resource-group=${resourceGroup}`,
+        `--azure-subscription-id=${subscriptionId}`,
+        "--policy=upsert-only",
+        "--registry=txt",
+    ];
+    for (const domain of domainFilters) {
+        args.push(`--domain-filter=${domain}`);
+    }
+    if (txtOwnerId) {
+        args.push(`--txt-owner-id=${txtOwnerId}`);
+    }
+    const deployment = new Deployment(mergeDefaults({
+        metadata: {
+            name,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "dns" },
+        },
+        spec: {
+            replicas: 1,
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+            template: {
+                metadata: {
+                    labels: {
+                        "app.kubernetes.io/name": name,
+                        "azure.workload.identity/use": "true",
+                        ...extraLabels,
+                    },
+                },
+                spec: {
+                    serviceAccountName: saName,
+                    containers: [
+                        {
+                            name,
+                            image,
+                            args,
+                            env: [
+                                { name: "AZURE_TENANT_ID", value: tenantId },
+                                { name: "AZURE_SUBSCRIPTION_ID", value: subscriptionId },
+                                { name: "AZURE_RESOURCE_GROUP", value: resourceGroup },
+                            ],
+                            resources: {
+                                requests: { cpu: "50m", memory: "64Mi" },
+                                limits: { cpu: "100m", memory: "128Mi" },
+                            },
+                            securityContext: {
+                                runAsNonRoot: true,
+                                runAsUser: 65534,
+                                readOnlyRootFilesystem: true,
+                                allowPrivilegeEscalation: false,
+                            },
+                        },
+                    ],
+                },
+            },
+        },
+    }, defs?.deployment));
+    const serviceAccount = new ServiceAccount(mergeDefaults({
+        metadata: {
+            name: saName,
+            namespace,
+            labels: {
+                ...commonLabels,
+                "app.kubernetes.io/component": "dns",
+                "azure.workload.identity/use": "true",
+            },
+            annotations: {
+                "azure.workload.identity/client-id": clientId,
+            },
+        },
+    }, defs?.serviceAccount));
+    const clusterRole = new ClusterRole(mergeDefaults({
+        metadata: {
+            name: clusterRoleName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        rules: [
+            { apiGroups: [""], resources: ["services", "endpoints", "pods"], verbs: ["get", "watch", "list"] },
+            { apiGroups: ["extensions", "networking.k8s.io"], resources: ["ingresses"], verbs: ["get", "watch", "list"] },
+            { apiGroups: [""], resources: ["nodes"], verbs: ["list", "watch"] },
+        ],
+    }, defs?.clusterRole));
+    const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({
+        metadata: {
+            name: bindingName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        roleRef: {
+            apiGroup: "rbac.authorization.k8s.io",
+            kind: "ClusterRole",
+            name: clusterRoleName,
+        },
+        subjects: [
+            {
+                kind: "ServiceAccount",
+                name: saName,
+                namespace,
+            },
+        ],
+    }, defs?.clusterRoleBinding));
+    return {
+        deployment,
+        serviceAccount,
+        clusterRole,
+        clusterRoleBinding,
+    };
+}, "AksExternalDnsAgent");

package/dist/composites/alb-ingress.js

@@ -0,0 +1,86 @@
+/**
+ * AlbIngress composite — Ingress with AWS Load Balancer Controller annotations.
+ *
+ * @eks Full `alb.ingress.kubernetes.io/*` annotation set including group name
+ * (shared ALB), SSL redirect, subnets, security groups.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Ingress } from "../generated/index.js";
+/**
+ * Create an AlbIngress composite — returns prop objects for
+ * an Ingress with AWS ALB Controller annotations.
+ *
+ * @eks
+ * @example
+ * ```ts
+ * import { AlbIngress } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { ingress } = AlbIngress({
+ *   name: "api-ingress",
+ *   hosts: [
+ *     {
+ *       hostname: "api.example.com",
+ *       paths: [{ path: "/", serviceName: "api", servicePort: 80 }],
+ *     },
+ *   ],
+ *   scheme: "internet-facing",
+ *   certificateArn: "arn:aws:acm:us-east-1:123456789012:certificate/abc-123",
+ *   groupName: "shared-alb",
+ * });
+ * ```
+ */
+export const AlbIngress = Composite((props) => {
+    const { name, hosts, scheme = "internet-facing", targetType = "ip", certificateArn, wafAclArn, healthCheckPath, groupName, sslRedirect, annotations: extraAnnotations = {}, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    // Build ALB annotations
+    const annotations = {
+        "alb.ingress.kubernetes.io/scheme": scheme,
+        "alb.ingress.kubernetes.io/target-type": targetType,
+        ...extraAnnotations,
+    };
+    if (certificateArn) {
+        annotations["alb.ingress.kubernetes.io/certificate-arn"] = certificateArn;
+        annotations["alb.ingress.kubernetes.io/listen-ports"] = '[{"HTTPS":443}]';
+    }
+    if (sslRedirect ?? !!certificateArn) {
+        annotations["alb.ingress.kubernetes.io/ssl-redirect"] = "443";
+    }
+    if (wafAclArn) {
+        annotations["alb.ingress.kubernetes.io/wafv2-acl-arn"] = wafAclArn;
+    }
+    if (healthCheckPath) {
+        annotations["alb.ingress.kubernetes.io/healthcheck-path"] = healthCheckPath;
+    }
+    if (groupName) {
+        annotations["alb.ingress.kubernetes.io/group.name"] = groupName;
+    }
+    const ingressRules = hosts.map((host) => ({
+        host: host.hostname,
+        http: {
+            paths: host.paths.map((p) => ({
+                path: p.path,
+                pathType: p.pathType ?? "Prefix",
+                backend: {
+                    service: { name: p.serviceName, port: { number: p.servicePort } },
+                },
+            })),
+        },
+    }));
+    const ingress = new Ingress(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "ingress" },
+            annotations,
+        },
+        spec: {
+            ingressClassName: "alb",
+            rules: ingressRules,
+        },
+    }, defs?.ingress));
+    return { ingress };
+}, "AlbIngress");