@intentius/chant-lexicon-k8s 0.37.3 → 0.39.0

package/src/composites/azure-disk-storage-class.ts

@@ -49,7 +49,7 @@ export interface AzureDiskStorageClassResult {
  * });
  * ```
  */
-export const AzureDiskStorageClass = Composite<AzureDiskStorageClassProps>((props) => {
+export const AzureDiskStorageClass = Composite((props: AzureDiskStorageClassProps) => {
   const {
     name,
     skuName = "Premium_LRS",

package/src/composites/azure-file-storage-class.ts

@@ -47,7 +47,7 @@ export interface AzureFileStorageClassResult {
  * });
  * ```
  */
-export const AzureFileStorageClass = Composite<AzureFileStorageClassProps>((props) => {
+export const AzureFileStorageClass = Composite((props: AzureFileStorageClassProps) => {
   const {
     name,
     skuName = "Premium_LRS",

package/src/composites/azure-monitor-collector.ts

@@ -64,7 +64,7 @@ export interface AzureMonitorCollectorResult {
  * });
  * ```
  */
-export const AzureMonitorCollector = Composite<AzureMonitorCollectorProps>((props) => {
+export const AzureMonitorCollector = Composite((props: AzureMonitorCollectorProps) => {
   const {
     workspaceId,
     clusterName,

package/src/composites/batch-job.ts

@@ -103,7 +103,7 @@ export interface BatchJobResult {
  * });
  * ```
  */
-export const BatchJob = Composite<BatchJobProps>((props) => {
+export const BatchJob = Composite((props: BatchJobProps) => {
   const {
     name,
     image,

package/src/composites/cockroachdb-cluster.ts

@@ -133,7 +133,7 @@ export interface CockroachDbClusterResult {
  * });
  * ```
  */
-export const CockroachDbCluster = Composite<CockroachDbClusterProps>((props) => {
+export const CockroachDbCluster = Composite((props: CockroachDbClusterProps) => {
   const {
     name,
     namespace,

package/src/composites/config-connector-context.ts

@@ -42,7 +42,7 @@ export interface ConfigConnectorContextResult {
  * });
  * ```
  */
-export const ConfigConnectorContext = Composite<ConfigConnectorContextProps>((props) => {
+export const ConfigConnectorContext = Composite((props: ConfigConnectorContextProps) => {
   const {
     name = "configconnectorcontext.core.cnrm.cloud.google.com",
     googleServiceAccountEmail,

package/src/composites/configured-app.ts

@@ -89,7 +89,7 @@ export interface ConfiguredAppResult {
  * });
  * ```
  */
-export const ConfiguredApp = Composite<ConfiguredAppProps>((props) => {
+export const ConfiguredApp = Composite((props: ConfiguredAppProps) => {
   const {
     name,
     image,

package/src/composites/cron-workload.ts

@@ -74,7 +74,7 @@ export interface CronWorkloadResult {
  * });
  * ```
  */
-export const CronWorkload = Composite<CronWorkloadProps>((props) => {
+export const CronWorkload = Composite((props: CronWorkloadProps) => {
   const {
     name,
     image,

package/src/composites/ebs-storage-class.ts

@@ -56,7 +56,7 @@ export interface EbsStorageClassResult {
  * });
  * ```
  */
-export const EbsStorageClass = Composite<EbsStorageClassProps>((props) => {
+export const EbsStorageClass = Composite((props: EbsStorageClassProps) => {
   const {
     name,
     type = "gp3",

package/src/composites/efs-storage-class.ts

@@ -48,7 +48,7 @@ export interface EfsStorageClassResult {
  * });
  * ```
  */
-export const EfsStorageClass = Composite<EfsStorageClassProps>((props) => {
+export const EfsStorageClass = Composite((props: EfsStorageClassProps) => {
   const {
     name,
     fileSystemId,

package/src/composites/external-dns-agent.ts

@@ -59,7 +59,7 @@ export interface ExternalDnsAgentResult {
  * });
  * ```
  */
-export const ExternalDnsAgent = Composite<ExternalDnsAgentProps>((props) => {
+export const ExternalDnsAgent = Composite((props: ExternalDnsAgentProps) => {
   const {
     iamRoleArn,
     domainFilters,

package/src/composites/filestore-storage-class.ts

@@ -47,7 +47,7 @@ export interface FilestoreStorageClassResult {
  * });
  * ```
  */
-export const FilestoreStorageClass = Composite<FilestoreStorageClassProps>((props) => {
+export const FilestoreStorageClass = Composite((props: FilestoreStorageClassProps) => {
   const {
     name,
     tier = "standard",

package/src/composites/fluent-bit-agent.ts

@@ -67,7 +67,7 @@ export interface FluentBitAgentResult {
  * });
  * ```
  */
-export const FluentBitAgent = Composite<FluentBitAgentProps>((props) => {
+export const FluentBitAgent = Composite((props: FluentBitAgentProps) => {
   const {
     name = "fluent-bit",
     image = "public.ecr.aws/aws-observability/aws-for-fluent-bit:stable",

package/src/composites/gce-ingress.ts

@@ -74,7 +74,7 @@ export interface GceIngressResult {
  * });
  * ```
  */
-export const GceIngress = Composite<GceIngressProps>((props) => {
+export const GceIngress = Composite((props: GceIngressProps) => {
   const {
     name,
     hosts,

package/src/composites/gce-pd-storage-class.ts

@@ -49,7 +49,7 @@ export interface GcePdStorageClassResult {
  * });
  * ```
  */
-export const GcePdStorageClass = Composite<GcePdStorageClassProps>((props) => {
+export const GcePdStorageClass = Composite((props: GcePdStorageClassProps) => {
   const {
     name,
     type = "pd-balanced",

package/src/composites/gke-external-dns-agent.ts

@@ -60,7 +60,7 @@ export interface GkeExternalDnsAgentResult {
  * });
  * ```
  */
-export const GkeExternalDnsAgent = Composite<GkeExternalDnsAgentProps>((props) => {
+export const GkeExternalDnsAgent = Composite((props: GkeExternalDnsAgentProps) => {
   const {
     gcpServiceAccountEmail,
     gcpProjectId,

package/src/composites/gke-fluent-bit-agent.ts

@@ -65,7 +65,7 @@ export interface GkeFluentBitAgentResult {
  * });
  * ```
  */
-export const GkeFluentBitAgent = Composite<GkeFluentBitAgentProps>((props) => {
+export const GkeFluentBitAgent = Composite((props: GkeFluentBitAgentProps) => {
   const {
     clusterName,
     projectId,

package/src/composites/gke-gateway.ts

@@ -68,7 +68,7 @@ export interface GkeGatewayResult {
  * });
  * ```
  */
-export const GkeGateway = Composite<GkeGatewayProps>((props) => {
+export const GkeGateway = Composite((props: GkeGatewayProps) => {
   const {
     name,
     gatewayClassName = "gke-l7-global-external-managed",

package/src/composites/gke-otel-collector.ts

@@ -65,7 +65,7 @@ export interface GkeOtelCollectorResult {
  * });
  * ```
  */
-export const GkeOtelCollector = Composite<GkeOtelCollectorProps>((props) => {
+export const GkeOtelCollector = Composite((props: GkeOtelCollectorProps) => {
   const {
     clusterName,
     projectId,

package/src/composites/irsa-service-account.ts

@@ -55,7 +55,7 @@ export interface IrsaServiceAccountResult {
  * });
  * ```
  */
-export const IrsaServiceAccount = Composite<IrsaServiceAccountProps>((props) => {
+export const IrsaServiceAccount = Composite((props: IrsaServiceAccountProps) => {
   const {
     name,
     iamRoleArn,

package/src/composites/metrics-server.ts

@@ -57,7 +57,7 @@ export interface MetricsServerResult {
  * const ms = MetricsServer({});
  * ```
  */
-export const MetricsServer = Composite<MetricsServerProps>((props) => {
+export const MetricsServer = Composite((props: MetricsServerProps) => {
   const {
     name = "metrics-server",
     image = "registry.k8s.io/metrics-server/metrics-server:v0.7.2",

package/src/composites/monitored-service.ts

@@ -91,7 +91,7 @@ export interface MonitoredServiceResult {
  * });
  * ```
  */
-export const MonitoredService = Composite<MonitoredServiceProps>((props) => {
+export const MonitoredService = Composite((props: MonitoredServiceProps) => {
   const {
     name,
     image,

package/src/composites/namespace-env.ts

@@ -65,7 +65,7 @@ export interface NamespaceEnvResult {
  * });
  * ```
  */
-export const NamespaceEnv = Composite<NamespaceEnvProps>((props) => {
+export const NamespaceEnv = Composite((props: NamespaceEnvProps) => {
   const {
     name,
     cpuQuota,

package/src/composites/network-isolated-app.ts

@@ -85,7 +85,7 @@ export interface NetworkIsolatedAppResult {
  * });
  * ```
  */
-export const NetworkIsolatedApp = Composite<NetworkIsolatedAppProps>((props) => {
+export const NetworkIsolatedApp = Composite((props: NetworkIsolatedAppProps) => {
   const {
     name,
     image,

package/src/composites/node-agent.ts

@@ -85,7 +85,7 @@ export interface NodeAgentResult {
  * });
  * ```
  */
-export const NodeAgent = Composite<NodeAgentProps>((props) => {
+export const NodeAgent = Composite((props: NodeAgentProps) => {
   const {
     name,
     image,

package/src/composites/ray-cluster.ts

@@ -426,7 +426,7 @@ export function buildRayNetworkPolicy(
  * });
  * ```
  */
-export const RayCluster = Composite<RayClusterProps>((props) => {
+export const RayCluster = Composite((props: RayClusterProps) => {
   const {
     name,
     namespace,

package/src/composites/ray-job.ts

@@ -101,7 +101,7 @@ export interface RayJobResult {
  * });
  * ```
  */
-export const RayJob = Composite<RayJobProps>((props) => {
+export const RayJob = Composite((props: RayJobProps) => {
   const {
     name,
     namespace,

package/src/composites/ray-service.ts

@@ -102,7 +102,7 @@ export interface RayServiceResult {
  * });
  * ```
  */
-export const RayService = Composite<RayServiceProps>((props) => {
+export const RayService = Composite((props: RayServiceProps) => {
   const {
     name,
     namespace,

package/src/composites/secure-ingress.ts

@@ -68,7 +68,7 @@ export interface SecureIngressResult {
  * });
  * ```
  */
-export const SecureIngress = Composite<SecureIngressProps>((props) => {
+export const SecureIngress = Composite((props: SecureIngressProps) => {
   const {
     name,
     hosts,

package/src/composites/sidecar-app.ts

@@ -110,7 +110,7 @@ export interface SidecarAppResult {
  * });
  * ```
  */
-export const SidecarApp = Composite<SidecarAppProps>((props) => {
+export const SidecarApp = Composite((props: SidecarAppProps) => {
   const {
     name,
     image,

package/src/composites/stateful-app.ts

@@ -80,7 +80,7 @@ export interface StatefulAppResult {
  * });
  * ```
  */
-export const StatefulApp = Composite<StatefulAppProps>((props) => {
+export const StatefulApp = Composite((props: StatefulAppProps) => {
   const {
     name,
     image,

package/src/composites/web-app.ts

@@ -93,7 +93,7 @@ export interface WebAppResult {
  * export { deployment, service, ingress };
  * ```
  */
-export const WebApp = Composite<WebAppProps>((props) => {
+export const WebApp = Composite((props: WebAppProps) => {
   const {
     name,
     image,

package/src/composites/worker-pool.ts

@@ -97,7 +97,7 @@ export interface WorkerPoolResult {
  * });
  * ```
  */
-export const WorkerPool = Composite<WorkerPoolProps>((props) => {
+export const WorkerPool = Composite((props: WorkerPoolProps) => {
   const {
     name,
     image,

package/src/composites/workload-identity-sa.ts

@@ -55,7 +55,7 @@ export interface WorkloadIdentityServiceAccountResult {
  * });
  * ```
  */
-export const WorkloadIdentityServiceAccount = Composite<WorkloadIdentityServiceAccountProps>((props) => {
+export const WorkloadIdentityServiceAccount = Composite((props: WorkloadIdentityServiceAccountProps) => {
   const {
     name,
     clientId,

package/src/composites/workload-identity-service-account.ts

@@ -55,7 +55,7 @@ export interface WorkloadIdentityServiceAccountResult {
  * });
  * ```
  */
-export const WorkloadIdentityServiceAccount = Composite<WorkloadIdentityServiceAccountProps>((props) => {
+export const WorkloadIdentityServiceAccount = Composite((props: WorkloadIdentityServiceAccountProps) => {
   const {
     name,
     gcpServiceAccountEmail,

package/src/config-schema.ts

@@ -0,0 +1,46 @@
+/**
+ * Runtime shape of the `k8s` namespace in `chant.config.ts` (#1344).
+ *
+ * `./config.ts` describes the namespace for readers and for the `satisfies
+ * K8sChantConfig` form it documents. What it could not do is make an unknown
+ * key fail: the project config schema is `.passthrough()`, so a typo in
+ * `k8s.profiles.prod.contxt` was accepted and ignored — and a missing cluster
+ * binding is the failure this lexicon most cares about, since a wrong-cluster
+ * read reports every declared resource as missing (#1100).
+ *
+ * The schema is the runtime half. It is checked against `K8sChantConfig` below,
+ * so the two descriptions of the namespace cannot drift.
+ */
+
+import { z } from "zod";
+import type { ChantConfig } from "@intentius/chant/config";
+import type { K8sChantConfig } from "./config";
+
+export const k8sClusterProfileSchema = z.strictObject({
+  context: z.string(),
+});
+
+export const k8sConfigSchema = z.strictObject({
+  profiles: z.record(z.string(), k8sClusterProfileSchema).optional(),
+  execCredentialPlugins: z.array(z.string()).optional(),
+});
+
+declare module "@intentius/chant/config" {
+  interface ChantConfig {
+    k8s?: K8sChantConfig;
+  }
+}
+
+/** Compile-time proof the augmentation reaches `ChantConfig`. */
+export type K8sConfigNamespace = NonNullable<ChantConfig["k8s"]>;
+
+/**
+ * The schema and the documented interface describe the same namespace. If a
+ * field is added to one and not the other, this stops compiling.
+ */
+type SchemaMatchesInterface = z.infer<typeof k8sConfigSchema> extends K8sChantConfig
+  ? K8sChantConfig extends z.infer<typeof k8sConfigSchema>
+    ? true
+    : never
+  : never;
+export type _SchemaAgreesWithInterface = SchemaMatchesInterface;

package/src/config.ts

@@ -39,7 +39,11 @@
  *
  * `ChantConfig` uses `.passthrough()` in its Zod schema so the `k8s` key is
  * accepted at runtime without core changes, exactly like `temporal.profiles`
- * (see `lexicons/temporal/src/config.ts`).
+ * (see `lexicons/temporal/src/config.ts`). The type side is the declaration
+ * merge at the bottom of this file — without it the snippet above compiles
+ * only until someone adds `satisfies ChantConfig`, which every example
+ * project does and which is the only thing type-checking the rest of the
+ * file (#1370).
  *
  * Deliberately out of scope here (see the issue for the full proposal):
  * deriving the binding automatically from a declared `AWS::EKS::Cluster` /
@@ -51,6 +55,8 @@
  * typed API client to inherit, rather than re-deriving it.
  */
 
+import type { ChantConfig } from "@intentius/chant/config";
+
 /** A single environment's cluster binding. */
 export interface K8sClusterProfile {
   /** kubectl context name this environment is bound to. */
@@ -78,3 +84,21 @@ export interface K8sChantConfig {
    */
   execCredentialPlugins?: string[];
 }
+
+declare module "@intentius/chant/config" {
+  interface ChantConfig {
+    k8s?: K8sChantConfig;
+  }
+}
+
+/**
+ * Compile-time proof that the augmentation above reaches `ChantConfig`, the
+ * same guard the forgejo lexicon carries (#1344).
+ *
+ * Without it this line is `Property 'k8s' does not exist on type
+ * 'ChantConfig'` — which is exactly the error a project got for writing the
+ * documented snippet with `satisfies ChantConfig` (#1370). It lives here
+ * rather than in a test because the root tsconfig excludes test files from
+ * typechecking, so a compile-time claim asserted in one is checked by nothing.
+ */
+export type K8sConfigNamespace = NonNullable<ChantConfig["k8s"]>;

package/src/crd/cnpg.test.ts

@@ -0,0 +1,186 @@
+/**
+ * CNPG acceptance test.
+ *
+ * The bar set by #1319 is that fountain's real `k8s/` overlay — postgres.yaml,
+ * scheduledbackup.yaml, objectstore.yaml — is reproducible from typed chant
+ * source. So these assertions are transcribed from that overlay rather than
+ * from a fixture invented to pass, and every value here is one a running
+ * cluster has.
+ */
+
+import { describe, test, expect } from "vitest";
+import { Cluster, ScheduledBackup, ObjectStore } from "../generated";
+import { k8sSerializer } from "../serializer";
+import { parseYAML } from "@intentius/chant/yaml";
+
+/** Serialize one declaration the way `chant build` would, and read it back. */
+function synth(logicalName: string, resource: unknown): any {
+  const yaml = k8sSerializer.serialize(new Map([[logicalName, resource as never]]));
+  return parseYAML(yaml);
+}
+
+describe("CNPG Cluster", () => {
+  const cluster = new Cluster({
+    metadata: { name: "fountain-pg", namespace: "fountain", labels: { app: "fountain" } },
+    spec: {
+      instances: 1,
+      imageName: "ghcr.io/cloudnative-pg/postgresql:18.4-standard-trixie",
+      plugins: [
+        {
+          name: "barman-cloud.cloudnative-pg.io",
+          isWALArchiver: true,
+          parameters: { barmanObjectName: "fountain-backups" },
+        },
+      ],
+      bootstrap: {
+        initdb: {
+          database: "fountain",
+          owner: "fountain",
+          postInitTemplateSQL: ["CREATE EXTENSION IF NOT EXISTS vector;"],
+        },
+      },
+      storage: { storageClass: "longhorn", size: "10Gi" },
+      resources: {
+        requests: { cpu: "100m", memory: "512Mi" },
+        limits: { memory: "1Gi" },
+      },
+    },
+  });
+
+  test("carries the CNPG apiVersion and kind", () => {
+    const doc = synth("fountainPg", cluster);
+    expect(doc.apiVersion).toBe("postgresql.cnpg.io/v1");
+    expect(doc.kind).toBe("Cluster");
+    expect(doc.metadata.name).toBe("fountain-pg");
+    expect(doc.metadata.namespace).toBe("fountain");
+  });
+
+  test("reproduces fountain's postgres.yaml spec", () => {
+    const { spec } = synth("fountainPg", cluster);
+    expect(spec.instances).toBe(1);
+    expect(spec.imageName).toBe("ghcr.io/cloudnative-pg/postgresql:18.4-standard-trixie");
+    expect(spec.storage).toEqual({ storageClass: "longhorn", size: "10Gi" });
+    expect(spec.bootstrap.initdb.database).toBe("fountain");
+    expect(spec.bootstrap.initdb.owner).toBe("fountain");
+    expect(spec.bootstrap.initdb.postInitTemplateSQL).toEqual([
+      "CREATE EXTENSION IF NOT EXISTS vector;",
+    ]);
+    // A memory limit with no CPU limit is deliberate upstream: a CPU limit
+    // throttles a database. It has to survive serialization as written.
+    expect(spec.resources).toEqual({
+      requests: { cpu: "100m", memory: "512Mi" },
+      limits: { memory: "1Gi" },
+    });
+  });
+
+  test("wires WAL archiving to the ObjectStore by name", () => {
+    const { spec } = synth("fountainPg", cluster);
+    // This block is the whole link between the two CRDs. `isWALArchiver` must
+    // stay a boolean -- quoted, the plugin ignores it and archiving is silently
+    // off, which looks exactly like a healthy cluster until a restore.
+    expect(spec.plugins).toEqual([
+      {
+        name: "barman-cloud.cloudnative-pg.io",
+        isWALArchiver: true,
+        parameters: { barmanObjectName: "fountain-backups" },
+      },
+    ]);
+    expect(typeof spec.plugins[0].isWALArchiver).toBe("boolean");
+  });
+});
+
+describe("CNPG ScheduledBackup", () => {
+  const backup = new ScheduledBackup({
+    metadata: { name: "fountain-pg-base", namespace: "fountain", labels: { app: "fountain" } },
+    spec: {
+      schedule: "0 47 2 * * *",
+      backupOwnerReference: "self",
+      cluster: { name: "fountain-pg" },
+      method: "plugin",
+      pluginConfiguration: { name: "barman-cloud.cloudnative-pg.io" },
+    },
+  });
+
+  test("reproduces fountain's scheduledbackup.yaml", () => {
+    const doc = synth("fountainPgBase", backup);
+    expect(doc.apiVersion).toBe("postgresql.cnpg.io/v1");
+    expect(doc.kind).toBe("ScheduledBackup");
+    expect(doc.spec.backupOwnerReference).toBe("self");
+    expect(doc.spec.cluster).toEqual({ name: "fountain-pg" });
+    expect(doc.spec.method).toBe("plugin");
+    expect(doc.spec.pluginConfiguration).toEqual({ name: "barman-cloud.cloudnative-pg.io" });
+  });
+
+  test("round-trips a six-field schedule", () => {
+    const { spec } = synth("fountainPgBase", backup);
+    // CNPG schedules lead with seconds, so this is six fields where a
+    // Kubernetes CronJob takes five. The schema types it as a plain string, so
+    // nothing here or upstream rejects the five-field form -- it just means a
+    // different time. The count is the only thing that catches it.
+    expect(spec.schedule).toBe("0 47 2 * * *");
+    expect(spec.schedule.trim().split(/\s+/)).toHaveLength(6);
+  });
+});
+
+describe("barman-cloud ObjectStore", () => {
+  const store = new ObjectStore({
+    metadata: { name: "fountain-backups", namespace: "fountain", labels: { app: "fountain" } },
+    spec: {
+      retentionPolicy: "14d",
+      configuration: {
+        destinationPath: "s3://fountain-backups/barman",
+        endpointURL: "http://s3.garage.svc.cluster.local:3900",
+        s3Credentials: {
+          accessKeyId: { name: "fountain-backup-s3-credentials", key: "AWS_ACCESS_KEY_ID" },
+          secretAccessKey: { name: "fountain-backup-s3-credentials", key: "AWS_SECRET_ACCESS_KEY" },
+        },
+        wal: { compression: "gzip" },
+        data: { compression: "gzip" },
+      },
+    },
+  });
+
+  test("reproduces fountain's objectstore.yaml", () => {
+    const doc = synth("fountainBackups", store);
+    // Its own group, mapped onto the same `Cnpg` namespace as the Cluster.
+    expect(doc.apiVersion).toBe("barmancloud.cnpg.io/v1");
+    expect(doc.kind).toBe("ObjectStore");
+    expect(doc.spec.retentionPolicy).toBe("14d");
+    expect(doc.spec.configuration.destinationPath).toBe("s3://fountain-backups/barman");
+    expect(doc.spec.configuration.endpointURL).toBe("http://s3.garage.svc.cluster.local:3900");
+    expect(doc.spec.configuration.wal).toEqual({ compression: "gzip" });
+    expect(doc.spec.configuration.data).toEqual({ compression: "gzip" });
+  });
+
+  test("keeps credentials as secret references, never values", () => {
+    const { spec } = synth("fountainBackups", store);
+    expect(spec.configuration.s3Credentials).toEqual({
+      accessKeyId: { name: "fountain-backup-s3-credentials", key: "AWS_ACCESS_KEY_ID" },
+      secretAccessKey: { name: "fountain-backup-s3-credentials", key: "AWS_SECRET_ACCESS_KEY" },
+    });
+  });
+
+  test("the Cluster's barmanObjectName matches this store's name", () => {
+    // The two CRDs are joined by a string. Nothing upstream checks it: a typo
+    // leaves the cluster running with archiving pointed at a store that does
+    // not exist.
+    const clusterDoc = synth(
+      "fountainPg",
+      new Cluster({
+        metadata: { name: "fountain-pg", namespace: "fountain" },
+        spec: {
+          instances: 1,
+          plugins: [
+            {
+              name: "barman-cloud.cloudnative-pg.io",
+              isWALArchiver: true,
+              parameters: { barmanObjectName: "fountain-backups" },
+            },
+          ],
+        },
+      }),
+    );
+    const storeDoc = synth("fountainBackups", store);
+    expect(clusterDoc.spec.plugins[0].parameters.barmanObjectName).toBe(storeDoc.metadata.name);
+  });
+});