@intentius/chant-lexicon-k8s 0.124.31 → 0.124.32

package/dist/composites/argo-app.js

@@ -0,0 +1,199 @@
+/**
+ * Argo CD composites — turn Chant build targets into Argo `Application`s.
+ *
+ * The k8s lexicon stays runtime-agnostic: it only emits manifests. These
+ * composites are the opt-in bridge to Argo CD's reconciliation layer. Authoring
+ * an `Application` by hand is ~30 lines of nested YAML; `ArgoAppFor` collapses
+ * it to one call with production-friendly defaults.
+ *
+ * - ArgoAppFor(target, opts)         → a single K8s::Argo::Application
+ * - ArgoAppSetForRegions(regions, …) → one ApplicationSet, fanned out per region
+ * - registerArgoCluster(opts)        → the cluster-registration Secret
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Application as ApplicationResource, ApplicationSet as ApplicationSetResource, Secret as SecretResource, } from "../generated/index.js";
+const IN_CLUSTER_SERVER = "https://kubernetes.default.svc";
+/** The default, safe sync policy: automated, non-pruning, self-healing. */
+function defaultSyncPolicy() {
+    return {
+        automated: { prune: false, selfHeal: true },
+        syncOptions: ["CreateNamespace=true"],
+    };
+}
+function renderSyncPolicy(policy) {
+    const out = {};
+    if (policy.automated) {
+        out.automated = {
+            ...(policy.automated.prune !== undefined && { prune: policy.automated.prune }),
+            ...(policy.automated.selfHeal !== undefined && { selfHeal: policy.automated.selfHeal }),
+        };
+    }
+    if (policy.syncOptions && policy.syncOptions.length > 0) {
+        out.syncOptions = policy.syncOptions;
+    }
+    return out;
+}
+function renderDestination(dest) {
+    return {
+        ...(dest.server !== undefined && { server: dest.server }),
+        ...(dest.name !== undefined && { name: dest.name }),
+        namespace: dest.namespace,
+    };
+}
+const ArgoApplication = Composite((props) => {
+    const { target, repo, path, destination = { server: IN_CLUSTER_SERVER, namespace: target }, targetRevision = "HEAD", project = "default", argoNamespace = "argocd", syncPolicy, labels = {}, defaults, } = props;
+    const resolvedSyncPolicy = syncPolicy ?? defaultSyncPolicy();
+    const renderedSync = renderSyncPolicy(resolvedSyncPolicy);
+    const application = new ApplicationResource(mergeDefaults({
+        metadata: {
+            name: target,
+            namespace: argoNamespace,
+            labels: {
+                "app.kubernetes.io/name": target,
+                "app.kubernetes.io/managed-by": "chant",
+                ...labels,
+            },
+        },
+        spec: {
+            project,
+            source: { repoURL: repo, path, targetRevision },
+            destination: renderDestination(destination),
+            ...(Object.keys(renderedSync).length > 0 && { syncPolicy: renderedSync }),
+        },
+    }, defaults?.application));
+    return { application };
+}, "ArgoApplication");
+/**
+ * Turn a Chant build target into an Argo CD `Application` in one call.
+ *
+ * @example
+ * ```ts
+ * import { ArgoAppFor } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const api = ArgoAppFor("api", {
+ *   repo: "https://github.com/acme/infra",
+ *   path: "dist/api",
+ *   destination: { server: "https://kubernetes.default.svc", namespace: "api" },
+ * });
+ * ```
+ */
+export function ArgoAppFor(target, options) {
+    return ArgoApplication({ target, ...options });
+}
+/**
+ * Emit one `ApplicationSet` that fans out across regions via a list generator —
+ * one synced Application per region, all scoped to a single AppProject.
+ *
+ * @example
+ * ```ts
+ * import { ArgoAppSetForRegions } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const crdb = ArgoAppSetForRegions(
+ *   ["east", "central", "west"],
+ *   (region) => ({
+ *     server: clusterServers[region],
+ *     namespace: `crdb-${region}`,
+ *     path: `dist/${region}`,
+ *   }),
+ *   { name: "crdb", repo: "https://github.com/acme/infra", project: "crdb" },
+ * );
+ * ```
+ */
+export function ArgoAppSetForRegions(regions, fn, options) {
+    return ArgoApplicationSet({ regions, fn, options });
+}
+const ArgoApplicationSet = Composite((props) => {
+    const { regions, fn, options } = props;
+    const { name, repo, path: setPath, project = "default", argoNamespace = "argocd", targetRevision: setRevision = "HEAD", syncPolicy, labels = {}, defaults, } = options;
+    // One list-generator element per region, carrying the resolved per-region
+    // values the template interpolates.
+    const elements = regions.map((region) => {
+        const t = fn(region);
+        const path = t.path ?? setPath;
+        if (path === undefined) {
+            throw new Error(`ArgoAppSetForRegions("${name}"): region "${region}" has no path — set options.path or return a path from the mapper.`);
+        }
+        return {
+            region,
+            ...(t.server !== undefined && { server: t.server }),
+            ...(t.name !== undefined && { clusterName: t.name }),
+            namespace: t.namespace,
+            path,
+            targetRevision: t.targetRevision ?? setRevision,
+        };
+    });
+    // Destination interpolates server or name depending on what the mapper gave.
+    const usesServer = elements.every((e) => "server" in e);
+    const destination = usesServer
+        ? { server: "{{server}}", namespace: "{{namespace}}" }
+        : { name: "{{clusterName}}", namespace: "{{namespace}}" };
+    const resolvedSyncPolicy = syncPolicy ?? defaultSyncPolicy();
+    const renderedSync = renderSyncPolicy(resolvedSyncPolicy);
+    const applicationSet = new ApplicationSetResource(mergeDefaults({
+        metadata: {
+            name,
+            namespace: argoNamespace,
+            labels: {
+                "app.kubernetes.io/name": name,
+                "app.kubernetes.io/managed-by": "chant",
+                ...labels,
+            },
+        },
+        spec: {
+            generators: [{ list: { elements } }],
+            template: {
+                metadata: { name: `{{region}}-${name}` },
+                spec: {
+                    // Single static AppProject for the whole set (ARGO004).
+                    project,
+                    source: { repoURL: repo, path: "{{path}}", targetRevision: "{{targetRevision}}" },
+                    destination,
+                    ...(Object.keys(renderedSync).length > 0 && { syncPolicy: renderedSync }),
+                },
+            },
+        },
+    }, defaults?.applicationSet));
+    return { applicationSet };
+}, "ArgoApplicationSet");
+/**
+ * Register an external cluster with Argo CD — emits the cluster Secret labelled
+ * `argocd.argoproj.io/secret-type: cluster` that ARGO003 looks for.
+ *
+ * @example
+ * ```ts
+ * import { registerArgoCluster } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const east = registerArgoCluster({
+ *   name: "east",
+ *   server: "https://east.example.com",
+ *   config: { tlsClientConfig: { insecure: false } },
+ * });
+ * ```
+ */
+export function registerArgoCluster(options) {
+    return ArgoClusterSecret(options);
+}
+const ArgoClusterSecret = Composite((options) => {
+    const { name, server, config, argoNamespace = "argocd", labels = {}, defaults } = options;
+    const configString = config === undefined ? undefined : typeof config === "string" ? config : JSON.stringify(config);
+    const secret = new SecretResource(mergeDefaults({
+        metadata: {
+            // Secret names can't contain characters from the server URL; use the
+            // cluster name as the object name.
+            name: `cluster-${name}`,
+            namespace: argoNamespace,
+            labels: {
+                "argocd.argoproj.io/secret-type": "cluster",
+                "app.kubernetes.io/managed-by": "chant",
+                ...labels,
+            },
+        },
+        type: "Opaque",
+        stringData: {
+            name,
+            server,
+            ...(configString !== undefined && { config: configString }),
+        },
+    }, defaults?.secret));
+    return { secret };
+}, "ArgoClusterSecret");

package/dist/composites/autoscaled-service.js

@@ -0,0 +1,174 @@
+/**
+ * AutoscaledService composite — Deployment + Service + HPA + PDB.
+ *
+ * A higher-level construct for production HTTP services with autoscaling
+ * and disruption budget. Enforces that HPA targets match the Deployment,
+ * PDB selectors match pod labels, and resource requests are set.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Deployment, Service, HorizontalPodAutoscaler, PodDisruptionBudget } from "../generated/index.js";
+/**
+ * Create an AutoscaledService composite — returns prop objects for
+ * a Deployment, Service, HorizontalPodAutoscaler, and PodDisruptionBudget.
+ *
+ * @example
+ * ```ts
+ * import { AutoscaledService } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { deployment, service, hpa, pdb } = AutoscaledService({
+ *   name: "api",
+ *   image: "api:1.0",
+ *   maxReplicas: 10,
+ *   cpuRequest: "100m",
+ *   memoryRequest: "128Mi",
+ * });
+ * ```
+ */
+export const AutoscaledService = Composite((props) => {
+    const { name, image, port = 80, minReplicas = 2, maxReplicas, targetCPUPercent = 70, targetMemoryPercent, minAvailable = 1, cpuRequest, memoryRequest, cpuLimit, memoryLimit, topologySpread = false, livenessPath = "/healthz", readinessPath = "/readyz", initContainers, securityContext, terminationGracePeriodSeconds, priorityClassName, labels: extraLabels = {}, namespace, env, serviceAccountName, volumes: explicitVolumes = [], volumeMounts: explicitMounts = [], tmpDirs = [], defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    // Build topologySpreadConstraints if enabled
+    const topologyConstraints = (() => {
+        if (!topologySpread)
+            return undefined;
+        const maxSkew = typeof topologySpread === "object" ? (topologySpread.maxSkew ?? 1) : 1;
+        const topologyKey = typeof topologySpread === "object"
+            ? (topologySpread.topologyKey ?? "topology.kubernetes.io/zone")
+            : "topology.kubernetes.io/zone";
+        return [{
+                maxSkew,
+                topologyKey,
+                whenUnsatisfiable: "DoNotSchedule",
+                labelSelector: { matchLabels: { "app.kubernetes.io/name": name } },
+            }];
+    })();
+    // Generate emptyDir volumes/mounts from tmpDirs, then merge with explicit
+    const tmpVolumes = tmpDirs.map((_, i) => ({ name: `tmp-${i}`, emptyDir: {} }));
+    const tmpMounts = tmpDirs.map((dir, i) => ({ name: `tmp-${i}`, mountPath: dir }));
+    const allVolumes = [...explicitVolumes, ...tmpVolumes];
+    const allMounts = [...explicitMounts, ...tmpMounts];
+    const resources = {
+        requests: { cpu: cpuRequest, memory: memoryRequest },
+        ...(cpuLimit || memoryLimit
+            ? {
+                limits: {
+                    ...(cpuLimit && { cpu: cpuLimit }),
+                    ...(memoryLimit && { memory: memoryLimit }),
+                },
+            }
+            : {}),
+    };
+    const deployment = new Deployment(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "server" },
+        },
+        spec: {
+            replicas: minReplicas,
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+            template: {
+                metadata: { labels: { "app.kubernetes.io/name": name, ...extraLabels } },
+                spec: {
+                    containers: [
+                        {
+                            name,
+                            image,
+                            ports: [{ containerPort: port, name: "http" }],
+                            resources,
+                            livenessProbe: {
+                                httpGet: { path: livenessPath, port },
+                                initialDelaySeconds: 10,
+                                periodSeconds: 10,
+                            },
+                            readinessProbe: {
+                                httpGet: { path: readinessPath, port },
+                                initialDelaySeconds: 5,
+                                periodSeconds: 5,
+                            },
+                            ...(env && { env }),
+                            ...(securityContext && { securityContext }),
+                            ...(allMounts.length > 0 && { volumeMounts: allMounts }),
+                        },
+                    ],
+                    ...(initContainers && {
+                        initContainers: initContainers.map((ic) => ({
+                            name: ic.name,
+                            image: ic.image,
+                            ...(ic.command && { command: ic.command }),
+                            ...(ic.args && { args: ic.args }),
+                        })),
+                    }),
+                    ...(topologyConstraints && { topologySpreadConstraints: topologyConstraints }),
+                    ...(terminationGracePeriodSeconds !== undefined && { terminationGracePeriodSeconds }),
+                    ...(priorityClassName && { priorityClassName }),
+                    ...(serviceAccountName && { serviceAccountName }),
+                    ...(allVolumes.length > 0 && { volumes: allVolumes }),
+                },
+            },
+        },
+    }, defs?.deployment));
+    const service = new Service(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "server" },
+        },
+        spec: {
+            selector: { "app.kubernetes.io/name": name },
+            ports: [{ port: 80, targetPort: port, protocol: "TCP", name: "http" }],
+            type: "ClusterIP",
+        },
+    }, defs?.service));
+    const metrics = [
+        {
+            type: "Resource",
+            resource: {
+                name: "cpu",
+                target: { type: "Utilization", averageUtilization: targetCPUPercent },
+            },
+        },
+    ];
+    if (targetMemoryPercent !== undefined) {
+        metrics.push({
+            type: "Resource",
+            resource: {
+                name: "memory",
+                target: { type: "Utilization", averageUtilization: targetMemoryPercent },
+            },
+        });
+    }
+    const hpa = new HorizontalPodAutoscaler(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "autoscaler" },
+        },
+        spec: {
+            scaleTargetRef: {
+                apiVersion: "apps/v1",
+                kind: "Deployment",
+                name,
+            },
+            minReplicas,
+            maxReplicas,
+            metrics,
+        },
+    }, defs?.hpa));
+    const pdb = new PodDisruptionBudget(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "disruption-budget" },
+        },
+        spec: {
+            minAvailable,
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+        },
+    }, defs?.pdb));
+    return { deployment, service, hpa, pdb };
+}, "AutoscaledService");

package/dist/composites/azure-disk-storage-class.js

@@ -0,0 +1,47 @@
+/**
+ * AzureDiskStorageClass composite — StorageClass for Azure Disk CSI driver.
+ *
+ * @aks Creates a StorageClass with the `disk.csi.azure.com` provisioner.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { StorageClass } from "../generated/index.js";
+/**
+ * Create an AzureDiskStorageClass composite — returns prop objects for
+ * a StorageClass with the Azure Disk CSI provisioner.
+ *
+ * @aks
+ * @example
+ * ```ts
+ * import { AzureDiskStorageClass } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { storageClass } = AzureDiskStorageClass({
+ *   name: "premium-disk",
+ *   skuName: "Premium_LRS",
+ * });
+ * ```
+ */
+export const AzureDiskStorageClass = Composite((props) => {
+    const { name, skuName = "Premium_LRS", cachingMode = "ReadOnly", networkAccessPolicy = "AllowAll", reclaimPolicy = "Delete", volumeBindingMode = "WaitForFirstConsumer", allowVolumeExpansion = true, labels: extraLabels = {}, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const parameters = {
+        skuName,
+        cachingMode,
+        networkAccessPolicy,
+    };
+    const storageClass = new StorageClass(mergeDefaults({
+        metadata: {
+            name,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "storage" },
+        },
+        provisioner: "disk.csi.azure.com",
+        parameters,
+        reclaimPolicy,
+        volumeBindingMode,
+        allowVolumeExpansion,
+    }, defs?.storageClass));
+    return { storageClass };
+}, "AzureDiskStorageClass");

package/dist/composites/azure-file-storage-class.js

@@ -0,0 +1,48 @@
+/**
+ * AzureFileStorageClass composite — StorageClass for Azure Files CSI driver.
+ *
+ * @aks Creates a StorageClass with the `file.csi.azure.com` provisioner.
+ * Azure Files provides ReadWriteMany access mode (shared across pods/nodes).
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { StorageClass } from "../generated/index.js";
+/**
+ * Create an AzureFileStorageClass composite — returns prop objects for
+ * a StorageClass with the Azure Files CSI provisioner.
+ *
+ * @aks
+ * @example
+ * ```ts
+ * import { AzureFileStorageClass } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { storageClass } = AzureFileStorageClass({
+ *   name: "azure-files-shared",
+ *   skuName: "Premium_LRS",
+ *   protocol: "nfs",
+ * });
+ * ```
+ */
+export const AzureFileStorageClass = Composite((props) => {
+    const { name, skuName = "Premium_LRS", protocol = "smb", shareName, reclaimPolicy = "Delete", labels: extraLabels = {}, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const parameters = {
+        skuName,
+        protocol,
+    };
+    if (shareName)
+        parameters.shareName = shareName;
+    const storageClass = new StorageClass(mergeDefaults({
+        metadata: {
+            name,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "storage" },
+        },
+        provisioner: "file.csi.azure.com",
+        parameters,
+        reclaimPolicy,
+    }, defs?.storageClass));
+    return { storageClass };
+}, "AzureFileStorageClass");

package/dist/composites/azure-monitor-collector.js

@@ -0,0 +1,176 @@
+/**
+ * AzureMonitorCollector composite — DaemonSet + RBAC + ConfigMap for Azure Monitor / OTel collector.
+ *
+ * @aks Azure Monitor agent with OpenTelemetry collector config for
+ * Log Analytics workspace integration on AKS clusters.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, ConfigMap } from "../generated/index.js";
+/**
+ * Create an AzureMonitorCollector composite — returns prop objects for
+ * a DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, and ConfigMap.
+ *
+ * @aks
+ * @example
+ * ```ts
+ * import { AzureMonitorCollector } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { daemonSet, serviceAccount, clusterRole, clusterRoleBinding, configMap } = AzureMonitorCollector({
+ *   workspaceId: "00000000-0000-0000-0000-000000000000",
+ *   clusterName: "my-aks-cluster",
+ * });
+ * ```
+ */
+export const AzureMonitorCollector = Composite((props) => {
+    const { workspaceId, clusterName, name = "azure-monitor-collector", image = "mcr.microsoft.com/azuremonitor/containerinsights/ciprod:3.1.35", namespace = "azure-monitor", labels: extraLabels = {}, cpuRequest = "100m", memoryRequest = "256Mi", cpuLimit = "500m", memoryLimit = "512Mi", clientId, defaults: defs, } = props;
+    const saName = `${name}-sa`;
+    const clusterRoleName = `${name}-role`;
+    const bindingName = `${name}-binding`;
+    const configMapName = `${name}-config`;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    // Build OTel collector config YAML for Azure Monitor
+    const collectorConfig = `receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: 0.0.0.0:4317
+      http:
+        endpoint: 0.0.0.0:4318
+
+processors:
+  batch:
+    timeout: 30s
+    send_batch_size: 8192
+
+exporters:
+  azuremonitor:
+    connection_string: InstrumentationKey=\${APPINSIGHTS_INSTRUMENTATIONKEY}
+    endpoint: https://dc.services.visualstudio.com/v2/track
+  azuremonitor/logs:
+    workspace_id: ${workspaceId}
+    cluster_name: ${clusterName}
+
+service:
+  pipelines:
+    metrics:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [azuremonitor]
+    traces:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [azuremonitor]
+    logs:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [azuremonitor/logs]
+`;
+    const container = {
+        name,
+        image,
+        ports: [
+            { containerPort: 4317, name: "otlp-grpc" },
+            { containerPort: 4318, name: "otlp-http" },
+        ],
+        env: [
+            { name: "AKS_CLUSTER_NAME", value: clusterName },
+            { name: "WORKSPACE_ID", value: workspaceId },
+        ],
+        resources: {
+            requests: { cpu: cpuRequest, memory: memoryRequest },
+            limits: { cpu: cpuLimit, memory: memoryLimit },
+        },
+        volumeMounts: [
+            { name: "config", mountPath: "/etc/otel", readOnly: true },
+        ],
+    };
+    const daemonSet = new DaemonSet(mergeDefaults({
+        metadata: {
+            name,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "agent" },
+        },
+        spec: {
+            selector: { matchLabels: { "app.kubernetes.io/name": name } },
+            template: {
+                metadata: { labels: { "app.kubernetes.io/name": name, ...extraLabels } },
+                spec: {
+                    serviceAccountName: saName,
+                    containers: [container],
+                    volumes: [
+                        { name: "config", configMap: { name: configMapName } },
+                    ],
+                    tolerations: [{ operator: "Exists" }],
+                },
+            },
+        },
+    }, defs?.daemonSet));
+    const saLabels = {
+        ...commonLabels,
+        "app.kubernetes.io/component": "agent",
+    };
+    if (clientId) {
+        saLabels["azure.workload.identity/use"] = "true";
+    }
+    const serviceAccount = new ServiceAccount(mergeDefaults({
+        metadata: {
+            name: saName,
+            namespace,
+            labels: saLabels,
+            ...(clientId ? { annotations: { "azure.workload.identity/client-id": clientId } } : {}),
+        },
+    }, defs?.serviceAccount));
+    const clusterRole = new ClusterRole(mergeDefaults({
+        metadata: {
+            name: clusterRoleName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        rules: [
+            { apiGroups: [""], resources: ["pods", "nodes", "endpoints"], verbs: ["get", "list", "watch"] },
+            { apiGroups: ["apps"], resources: ["replicasets"], verbs: ["get", "list", "watch"] },
+            { apiGroups: ["batch"], resources: ["jobs"], verbs: ["get", "list", "watch"] },
+            { apiGroups: [""], resources: ["nodes/proxy"], verbs: ["get"] },
+            { apiGroups: [""], resources: ["nodes/stats", "configmaps", "events"], verbs: ["create", "get"] },
+            { apiGroups: [""], resources: ["configmaps"], verbs: ["get", "update", "create"], resourceNames: ["otel-container-insight-clusterleader"] },
+        ],
+    }, defs?.clusterRole));
+    const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({
+        metadata: {
+            name: bindingName,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+        },
+        roleRef: {
+            apiGroup: "rbac.authorization.k8s.io",
+            kind: "ClusterRole",
+            name: clusterRoleName,
+        },
+        subjects: [
+            {
+                kind: "ServiceAccount",
+                name: saName,
+                namespace,
+            },
+        ],
+    }, defs?.clusterRoleBinding));
+    const configMap = new ConfigMap(mergeDefaults({
+        metadata: {
+            name: configMapName,
+            namespace,
+            labels: { ...commonLabels, "app.kubernetes.io/component": "config" },
+        },
+        data: {
+            "config.yaml": collectorConfig,
+        },
+    }, defs?.configMap));
+    return {
+        daemonSet,
+        serviceAccount,
+        clusterRole,
+        clusterRoleBinding,
+        configMap,
+    };
+}, "AzureMonitorCollector");