@intentius/chant-lexicon-k8s 0.6.0 → 0.8.0

package/dist/composites/node-agent.d.ts

@@ -0,0 +1,87 @@
+/**
+ * NodeAgent composite — DaemonSet + ServiceAccount + ClusterRole + ClusterRoleBinding + optional ConfigMap.
+ *
+ * A higher-level construct for per-node agents (Fluentd, Prometheus Node Exporter,
+ * security scanners) that need cluster-wide RBAC and tolerations.
+ */
+import { DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, ConfigMap } from "../generated/index.js";
+import type { ContainerSecurityContext } from "./security-context.js";
+export interface NodeAgentProps {
+    /** Agent name — used in metadata and labels. */
+    name: string;
+    /** Container image. */
+    image: string;
+    /** Metrics port (optional). */
+    port?: number;
+    /** Host path mounts. */
+    hostPaths?: Array<{
+        name: string;
+        hostPath: string;
+        mountPath: string;
+        readOnly?: boolean;
+    }>;
+    /** Config data — creates a ConfigMap mounted at /etc/{name}/. */
+    config?: Record<string, string>;
+    /** ClusterRole RBAC rules (required). */
+    rbacRules: Array<{
+        apiGroups: string[];
+        resources: string[];
+        verbs: string[];
+    }>;
+    /** Tolerate all taints so agent runs on every node (default: true). */
+    tolerateAllTaints?: boolean;
+    /** Namespace for namespaced resources (DaemonSet, ServiceAccount, ConfigMap). */
+    namespace?: string;
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** CPU request (default: "50m"). */
+    cpuRequest?: string;
+    /** Memory request (default: "64Mi"). */
+    memoryRequest?: string;
+    /** CPU limit (default: "200m"). */
+    cpuLimit?: string;
+    /** Memory limit (default: "128Mi"). */
+    memoryLimit?: string;
+    /** Environment variables for the container. */
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** Container security context (supports PSS restricted fields). */
+    securityContext?: ContainerSecurityContext;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        daemonSet?: Partial<Record<string, unknown>>;
+        serviceAccount?: Partial<Record<string, unknown>>;
+        clusterRole?: Partial<Record<string, unknown>>;
+        clusterRoleBinding?: Partial<Record<string, unknown>>;
+        configMap?: Partial<Record<string, unknown>>;
+    };
+}
+export interface NodeAgentResult {
+    daemonSet: InstanceType<typeof DaemonSet>;
+    serviceAccount: InstanceType<typeof ServiceAccount>;
+    clusterRole: InstanceType<typeof ClusterRole>;
+    clusterRoleBinding: InstanceType<typeof ClusterRoleBinding>;
+    configMap?: InstanceType<typeof ConfigMap>;
+}
+/**
+ * Create a NodeAgent composite — returns prop objects for
+ * a DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, and optional ConfigMap.
+ *
+ * @example
+ * ```ts
+ * import { NodeAgent } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { daemonSet, serviceAccount, clusterRole, clusterRoleBinding } = NodeAgent({
+ *   name: "log-collector",
+ *   image: "fluentd:v1.16",
+ *   hostPaths: [{ name: "varlog", hostPath: "/var/log", mountPath: "/var/log" }],
+ *   rbacRules: [
+ *     { apiGroups: [""], resources: ["pods", "namespaces"], verbs: ["get", "list", "watch"] },
+ *   ],
+ * });
+ * ```
+ */
+export declare const NodeAgent: import("@intentius/chant").CompositeDefinition<NodeAgentProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=node-agent.d.ts.map

package/dist/composites/node-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-agent.d.ts","sourceRoot":"","sources":["../../src/composites/node-agent.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IACH,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,yCAAyC;IACzC,SAAS,EAAE,KAAK,CAAC;QACf,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,mEAAmE;IACnE,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC9C,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;IAC1C,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,kBAAkB,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC5D,SAAS,CAAC,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,SAAS,6GAyJP,CAAC"}

package/dist/composites/ray-cluster.d.ts

@@ -0,0 +1,179 @@
+/**
+ * RayCluster composite — KubeRay RayCluster CR + surrounding K8s infra.
+ *
+ * Encodes production defaults for running Ray on Kubernetes:
+ * - NetworkPolicy with podSelector rules (avoids GKE pod CIDR mismatch)
+ * - PodDisruptionBudget on the head (minAvailable: 1)
+ * - preStop: ray stop hooks + terminationGracePeriodSeconds: 120 on all pods
+ * - ServiceAccount for the head + optional autoscaler ClusterRole/CRB
+ * - Optional shared ReadWriteMany PVC for training data (Filestore/EFS)
+ * - Optional GCS spillover env var for object store spill-to-GCS
+ */
+import { ServiceAccount, ClusterRole, ClusterRoleBinding, NetworkPolicy, PodDisruptionBudget, PersistentVolumeClaim, Service, RayCluster as RayClusterResource } from "../generated/index.js";
+/** Container resource spec for Ray pods. */
+export interface ResourceSpec {
+    /** CPU request/limit (e.g. "2", "500m"). */
+    cpu: string;
+    /** Memory request/limit (e.g. "4Gi", "512Mi"). */
+    memory: string;
+    /** GPU count — adds nvidia.com/gpu to resource requests and limits. */
+    gpu?: number;
+}
+/** Head node configuration. */
+export interface HeadGroupSpec {
+    resources: ResourceSpec;
+    /**
+     * Shared memory size mounted at /dev/shm (default: "2Gi").
+     * Prevents OOM when PyTorch workers share tensors via /dev/shm.
+     */
+    shmSize?: string;
+    /**
+     * When true, sets num-cpus=0 so the Ray scheduler never places user tasks on
+     * the head node. Recommended for production — keeps the head free for GCS,
+     * dashboard, and autoscaler. Default: false.
+     */
+    reserveHead?: boolean;
+    /** Additional Ray start params merged into defaults. */
+    rayStartParams?: Record<string, string>;
+    /** Additional environment variables for the head container. */
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+}
+/** Worker group configuration. */
+export interface WorkerGroupSpec {
+    /** Worker group name — used as a selector label (e.g. "cpu", "gpu"). */
+    groupName: string;
+    /** Initial replica count. */
+    replicas: number;
+    /** Minimum replicas for autoscaling (default: replicas). */
+    minReplicas?: number;
+    /** Maximum replicas for autoscaling (default: replicas). */
+    maxReplicas?: number;
+    resources: ResourceSpec;
+    /**
+     * Idle timeout before the Ray autoscaler terminates idle workers (default: 60s).
+     * Use 300s for GPU groups to amortize initialization overhead.
+     */
+    idleTimeoutSeconds?: number;
+    /** Add nvidia.com/gpu NoSchedule toleration — required for GPU tainted node pools. */
+    gpuTolerations?: boolean;
+    /** Additional Ray start params. num-cpus is derived from resources.cpu automatically. */
+    rayStartParams?: Record<string, string>;
+    /** Additional environment variables for worker containers. */
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+}
+/** Cluster spec shared by RayCluster, RayJob, and RayService. */
+export interface RayClusterSpec {
+    /**
+     * Container image for head and all worker groups.
+     * Use a pre-built image stored in Artifact Registry / ECR for production —
+     * pip installs via runtimeEnv add minutes to cold start at scale.
+     */
+    image: string;
+    head: HeadGroupSpec;
+    workerGroups: WorkerGroupSpec[];
+}
+export interface RayClusterProps {
+    name: string;
+    namespace: string;
+    cluster: RayClusterSpec;
+    /**
+     * Shared ReadWriteMany storage for training data.
+     * Mounts the same PVC into head and all worker pods.
+     * Use Filestore ENTERPRISE (GKE) or EFS (AWS) for production SLA.
+     */
+    sharedStorage?: {
+        storageClass: string;
+        size: string;
+        /** Mount path in all containers (default: "/mnt/ray-data"). */
+        mountPath?: string;
+    };
+    /**
+     * Enable Ray in-tree autoscaler.
+     * Creates a ClusterRole/CRB granting pod CRUD to the head ServiceAccount.
+     */
+    enableAutoscaler?: boolean;
+    /**
+     * GCS bucket name for object store spill-to-GCS.
+     * Injects RAY_object_spilling_config into the head container.
+     * Without this, large object graphs (model weights) cause OOM on the head.
+     */
+    spilloverBucket?: string;
+    /**
+     * Emit a LoadBalancer Service exposing the Ray dashboard on port 8265.
+     * Default false — use `kubectl port-forward svc/<name>-head-svc 8265:8265`.
+     */
+    exposeDashboard?: boolean;
+    /** Additional labels applied to all resources. */
+    labels?: Record<string, string>;
+    /** Per-member defaults for fine-grained overrides via mergeDefaults. */
+    defaults?: {
+        serviceAccount?: Partial<Record<string, unknown>>;
+        clusterRole?: Partial<Record<string, unknown>>;
+        clusterRoleBinding?: Partial<Record<string, unknown>>;
+        networkPolicy?: Partial<Record<string, unknown>>;
+        pdb?: Partial<Record<string, unknown>>;
+        pvc?: Partial<Record<string, unknown>>;
+        dashboardService?: Partial<Record<string, unknown>>;
+        rayCluster?: Partial<Record<string, unknown>>;
+    };
+}
+export interface RayClusterResult {
+    serviceAccount: InstanceType<typeof ServiceAccount>;
+    clusterRole?: InstanceType<typeof ClusterRole>;
+    clusterRoleBinding?: InstanceType<typeof ClusterRoleBinding>;
+    networkPolicy: InstanceType<typeof NetworkPolicy>;
+    pdb: InstanceType<typeof PodDisruptionBudget>;
+    pvc?: InstanceType<typeof PersistentVolumeClaim>;
+    /** Only present when exposeDashboard is true. */
+    dashboardService?: InstanceType<typeof Service>;
+    rayCluster: InstanceType<typeof RayClusterResource>;
+}
+/**
+ * Build headGroupSpec and workerGroupSpecs for a KubeRay CR.
+ * Exported for use in RayJob and RayService composites.
+ */
+export declare function buildRayClusterParts(cluster: RayClusterSpec, saName: string, spilloverBucket: string | undefined, pvcName: string | undefined, mountPath: string | undefined): {
+    headGroupSpec: Record<string, unknown>;
+    workerGroupSpecs: Array<Record<string, unknown>>;
+    rayVersion: string | undefined;
+};
+/**
+ * Build a NetworkPolicy for a Ray cluster.
+ * Uses podSelector-only rules for intra-cluster traffic to avoid GKE pod CIDR
+ * mismatch (GKE secondary pod CIDRs differ from declared subnet CIDRs).
+ * GCS egress uses ipBlock excluding RFC1918 to allow Google APIs while
+ * blocking internal lateral movement.
+ */
+export declare function buildRayNetworkPolicy(name: string, namespace: string, commonLabels: Record<string, string>, exposeDashboard: boolean, defOverride: Partial<Record<string, unknown>> | undefined): InstanceType<typeof NetworkPolicy>;
+/**
+ * Create a RayCluster composite — returns a KubeRay RayCluster CR and the
+ * surrounding K8s resources needed for a production Ray cluster.
+ *
+ * @example
+ * ```ts
+ * import { RayCluster } from "@intentius/chant-lexicon-k8s";
+ *
+ * const ray = RayCluster({
+ *   name: "ray",
+ *   namespace: "ray-system",
+ *   cluster: {
+ *     image: "us-docker.pkg.dev/my-project/ray-images/ray:2.40.0",
+ *     head: { resources: { cpu: "2", memory: "8Gi" } },
+ *     workerGroups: [
+ *       { groupName: "cpu", replicas: 2, minReplicas: 1, maxReplicas: 8,
+ *         resources: { cpu: "2", memory: "4Gi" } },
+ *     ],
+ *   },
+ *   enableAutoscaler: true,
+ *   spilloverBucket: "my-ray-spill",
+ * });
+ * ```
+ */
+export declare const RayCluster: import("@intentius/chant").CompositeDefinition<RayClusterProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=ray-cluster.d.ts.map

package/dist/composites/ray-cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ray-cluster.d.ts","sourceRoot":"","sources":["../../src/composites/ray-cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,OAAO,EACP,UAAU,IAAI,kBAAkB,EACjC,MAAM,cAAc,CAAC;AAItB,4CAA4C;AAC5C,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,+BAA+B;AAC/B,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,YAAY,CAAC;IACxB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9C;AAED,kCAAkC;AAClC,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,YAAY,CAAC;IACxB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9C;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAID,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,+DAA+D;QAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,gBAAgB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,WAAW,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC/C,kBAAkB,CAAC,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC7D,aAAa,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;IAClD,GAAG,EAAE,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;IAC9C,GAAG,CAAC,EAAE,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;IACjD,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IAChD,UAAU,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;CACrD;AA6DD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAiG9H;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,eAAe,EAAE,OAAO,EACxB,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACxD,YAAY,CAAC,OAAO,aAAa,CAAC,CAiEpC;AAID;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,UAAU,8GAiKP,CAAC"}

package/dist/composites/ray-job.d.ts

@@ -0,0 +1,88 @@
+/**
+ * RayJob composite — KubeRay RayJob CR + surrounding K8s infra.
+ *
+ * RayJob spins up an ephemeral Ray cluster, runs a single entrypoint command,
+ * then tears the cluster down. Ideal for batch training pipelines.
+ *
+ * Encodes the same production defaults as RayCluster (NetworkPolicy,
+ * preStop hooks, optional shared PVC, optional autoscaler RBAC).
+ */
+import { ServiceAccount, ClusterRole, ClusterRoleBinding, NetworkPolicy, PersistentVolumeClaim, RayJob as RayJobResource } from "../generated/index.js";
+import { type RayClusterSpec } from "./ray-cluster.js";
+export type { RayClusterSpec };
+export type { ResourceSpec, HeadGroupSpec, WorkerGroupSpec } from "./ray-cluster.js";
+export interface RayJobProps {
+    name: string;
+    namespace: string;
+    /**
+     * Entrypoint command to run on the Ray cluster.
+     * E.g. "python train.py --epochs 10"
+     */
+    entrypoint: string;
+    cluster: RayClusterSpec;
+    /**
+     * Ray runtime environment YAML string.
+     * Prefer pre-built images over pip installs here — each pip install adds
+     * startup latency per worker on cold start.
+     */
+    runtimeEnvYAML?: string;
+    /**
+     * Tear down the cluster after the job finishes (default: true).
+     * Set false to keep the cluster alive for debugging.
+     */
+    shutdownAfterJobFinishes?: boolean;
+    /**
+     * TTL in seconds before a finished RayJob is garbage-collected (default: 300).
+     */
+    ttlSecondsAfterFinished?: number;
+    sharedStorage?: {
+        storageClass: string;
+        size: string;
+        mountPath?: string;
+    };
+    enableAutoscaler?: boolean;
+    spilloverBucket?: string;
+    labels?: Record<string, string>;
+    defaults?: {
+        serviceAccount?: Partial<Record<string, unknown>>;
+        clusterRole?: Partial<Record<string, unknown>>;
+        clusterRoleBinding?: Partial<Record<string, unknown>>;
+        networkPolicy?: Partial<Record<string, unknown>>;
+        pvc?: Partial<Record<string, unknown>>;
+        rayJob?: Partial<Record<string, unknown>>;
+    };
+}
+export interface RayJobResult {
+    serviceAccount: InstanceType<typeof ServiceAccount>;
+    clusterRole?: InstanceType<typeof ClusterRole>;
+    clusterRoleBinding?: InstanceType<typeof ClusterRoleBinding>;
+    networkPolicy: InstanceType<typeof NetworkPolicy>;
+    pvc?: InstanceType<typeof PersistentVolumeClaim>;
+    rayJob: InstanceType<typeof RayJobResource>;
+}
+/**
+ * Create a RayJob composite — ephemeral Ray cluster for a single batch job.
+ *
+ * @example
+ * ```ts
+ * import { RayJob } from "@intentius/chant-lexicon-k8s";
+ *
+ * const job = RayJob({
+ *   name: "train-resnet",
+ *   namespace: "ray-system",
+ *   entrypoint: "python train.py --epochs 50",
+ *   cluster: {
+ *     image: "us-docker.pkg.dev/my-project/ray-images/ray:2.40.0",
+ *     head: { resources: { cpu: "2", memory: "8Gi" } },
+ *     workerGroups: [
+ *       { groupName: "gpu", replicas: 4,
+ *         resources: { cpu: "8", memory: "32Gi", gpu: 1 },
+ *         gpuTolerations: true },
+ *     ],
+ *   },
+ *   spilloverBucket: "my-ray-spill",
+ * });
+ * ```
+ */
+export declare const RayJob: import("@intentius/chant").CompositeDefinition<RayJobProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=ray-job.d.ts.map

package/dist/composites/ray-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ray-job.d.ts","sourceRoot":"","sources":["../../src/composites/ray-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,MAAM,IAAI,cAAc,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,cAAc,EAAE,CAAC;AAC/B,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAElF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;OAEG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC3C,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,WAAW,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC/C,kBAAkB,CAAC,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC7D,aAAa,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;IAClD,GAAG,CAAC,EAAE,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;IACjD,MAAM,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,MAAM,0GAmIP,CAAC"}

package/dist/composites/ray-service.d.ts

@@ -0,0 +1,87 @@
+/**
+ * RayService composite — KubeRay RayService CR + surrounding K8s infra.
+ *
+ * RayService manages a persistent Ray Serve HTTP endpoint with zero-downtime
+ * blue-green upgrades. Ideal for online inference and serving workloads.
+ *
+ * Encodes the same production defaults as RayCluster (NetworkPolicy, preStop
+ * hooks, PDB, optional shared PVC, optional autoscaler RBAC) plus a
+ * LoadBalancer Service exposing the Serve HTTP endpoint on port 8000.
+ */
+import { ServiceAccount, ClusterRole, ClusterRoleBinding, NetworkPolicy, PodDisruptionBudget, PersistentVolumeClaim, Service, RayService as RayServiceResource } from "../generated/index.js";
+import { type RayClusterSpec } from "./ray-cluster.js";
+export type { RayClusterSpec };
+export type { ResourceSpec, HeadGroupSpec, WorkerGroupSpec } from "./ray-cluster.js";
+export interface RayServiceProps {
+    name: string;
+    namespace: string;
+    /**
+     * Ray Serve application config in YAML format.
+     * Passed verbatim to spec.serveConfigV2.
+     * See https://docs.ray.io/en/latest/serve/production-guide/config.html
+     */
+    serveConfigV2: string;
+    cluster: RayClusterSpec;
+    sharedStorage?: {
+        storageClass: string;
+        size: string;
+        mountPath?: string;
+    };
+    enableAutoscaler?: boolean;
+    spilloverBucket?: string;
+    labels?: Record<string, string>;
+    defaults?: {
+        serviceAccount?: Partial<Record<string, unknown>>;
+        clusterRole?: Partial<Record<string, unknown>>;
+        clusterRoleBinding?: Partial<Record<string, unknown>>;
+        networkPolicy?: Partial<Record<string, unknown>>;
+        pdb?: Partial<Record<string, unknown>>;
+        pvc?: Partial<Record<string, unknown>>;
+        serveService?: Partial<Record<string, unknown>>;
+        rayService?: Partial<Record<string, unknown>>;
+    };
+}
+export interface RayServiceResult {
+    serviceAccount: InstanceType<typeof ServiceAccount>;
+    clusterRole?: InstanceType<typeof ClusterRole>;
+    clusterRoleBinding?: InstanceType<typeof ClusterRoleBinding>;
+    networkPolicy: InstanceType<typeof NetworkPolicy>;
+    pdb: InstanceType<typeof PodDisruptionBudget>;
+    pvc?: InstanceType<typeof PersistentVolumeClaim>;
+    /** LoadBalancer Service exposing Ray Serve on port 8000. */
+    serveService: InstanceType<typeof Service>;
+    rayService: InstanceType<typeof RayServiceResource>;
+}
+/**
+ * Create a RayService composite — persistent Ray Serve endpoint with
+ * zero-downtime blue-green upgrades.
+ *
+ * @example
+ * ```ts
+ * import { RayService } from "@intentius/chant-lexicon-k8s";
+ *
+ * const svc = RayService({
+ *   name: "inference",
+ *   namespace: "ray-system",
+ *   serveConfigV2: `
+ *     applications:
+ *       - name: classifier
+ *         import_path: app:deployment
+ *         deployments:
+ *           - name: Classifier
+ *             num_replicas: 2
+ *   `,
+ *   cluster: {
+ *     image: "us-docker.pkg.dev/my-project/ray-images/ray:2.40.0",
+ *     head: { resources: { cpu: "2", memory: "8Gi" } },
+ *     workerGroups: [
+ *       { groupName: "gpu", replicas: 2,
+ *         resources: { cpu: "4", memory: "16Gi", gpu: 1 },
+ *         gpuTolerations: true },
+ *     ],
+ *   },
+ * });
+ * ```
+ */
+export declare const RayService: import("@intentius/chant").CompositeDefinition<RayServiceProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=ray-service.d.ts.map

package/dist/composites/ray-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ray-service.d.ts","sourceRoot":"","sources":["../../src/composites/ray-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,OAAO,EACP,UAAU,IAAI,kBAAkB,EACjC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,cAAc,EAAE,CAAC;AAC/B,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAElF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,WAAW,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC/C,kBAAkB,CAAC,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC7D,aAAa,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;IAClD,GAAG,EAAE,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;IAC9C,GAAG,CAAC,EAAE,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;IACjD,4DAA4D;IAC5D,YAAY,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IAC3C,UAAU,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,UAAU,8GAsKP,CAAC"}

package/dist/composites/secure-ingress.d.ts

@@ -0,0 +1,66 @@
+/**
+ * SecureIngress composite — Ingress + optional cert-manager Certificate.
+ *
+ * A standalone Ingress with TLS via cert-manager, supporting
+ * multiple hosts and paths (unlike the single-path Ingress in WebApp).
+ */
+import { Ingress, Certificate } from "../generated/index.js";
+export interface SecureIngressHost {
+    /** Hostname (e.g., "api.example.com"). */
+    hostname: string;
+    /** Path rules for this host. */
+    paths: Array<{
+        path: string;
+        pathType?: string;
+        serviceName: string;
+        servicePort: number;
+    }>;
+}
+export interface SecureIngressProps {
+    /** Ingress name — used in metadata and labels. */
+    name: string;
+    /** Host definitions with paths. */
+    hosts: SecureIngressHost[];
+    /** cert-manager ClusterIssuer name — if set, creates a Certificate resource. */
+    clusterIssuer?: string;
+    /** Ingress class name (e.g., "nginx"). */
+    ingressClassName?: string;
+    /** Additional annotations on the Ingress. */
+    annotations?: Record<string, string>;
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        ingress?: Partial<Record<string, unknown>>;
+        certificate?: Partial<Record<string, unknown>>;
+    };
+}
+export interface SecureIngressResult {
+    ingress: InstanceType<typeof Ingress>;
+    certificate?: InstanceType<typeof Certificate>;
+}
+/**
+ * Create a SecureIngress composite — returns prop objects for
+ * an Ingress and optional cert-manager Certificate.
+ *
+ * @example
+ * ```ts
+ * import { SecureIngress } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { ingress, certificate } = SecureIngress({
+ *   name: "api-ingress",
+ *   hosts: [
+ *     {
+ *       hostname: "api.example.com",
+ *       paths: [{ path: "/", serviceName: "api", servicePort: 80 }],
+ *     },
+ *   ],
+ *   clusterIssuer: "letsencrypt-prod",
+ *   ingressClassName: "nginx",
+ * });
+ * ```
+ */
+export declare const SecureIngress: import("@intentius/chant").CompositeDefinition<SecureIngressProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=secure-ingress.d.ts.map

package/dist/composites/secure-ingress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-ingress.d.ts","sourceRoot":"","sources":["../../src/composites/secure-ingress.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,iHAwFP,CAAC"}

package/dist/composites/security-context.d.ts

@@ -0,0 +1,17 @@
+/** Container-level security context — covers PSS restricted requirements. */
+export interface ContainerSecurityContext {
+    runAsNonRoot?: boolean;
+    readOnlyRootFilesystem?: boolean;
+    runAsUser?: number;
+    runAsGroup?: number;
+    allowPrivilegeEscalation?: boolean;
+    capabilities?: {
+        add?: string[];
+        drop?: string[];
+    };
+    seccompProfile?: {
+        type: string;
+        localhostProfile?: string;
+    };
+}
+//# sourceMappingURL=security-context.d.ts.map

package/dist/composites/security-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-context.d.ts","sourceRoot":"","sources":["../../src/composites/security-context.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,YAAY,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnD,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D"}