@mcpg-dev/pulumi 0.1.0-beta.11

package/bin/trustBootstrap.js

@@ -0,0 +1,56 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustBootstrap = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const pulumi_crds_1 = require("@mcpg-dev/pulumi-crds");
+/** Seeds the cluster-default MCPGRevocationList and carries the signing-key ref. */
+class TrustBootstrap extends pulumi.ComponentResource {
+    constructor(name, args = {}, opts) {
+        super("mcpg:index:TrustBootstrap", name, {}, opts);
+        const rlName = args.revocationListName ?? "cluster-default";
+        const spec = { version: 1, revocations: args.revocations ?? [] };
+        if (args.issuedAt)
+            spec.issuedAt = args.issuedAt;
+        this.revocationList = new pulumi_crds_1.mcpg.v1alpha1.MCPGRevocationList(rlName, {
+            metadata: { name: rlName },
+            spec: spec,
+        }, { parent: this });
+        this.revocationListName = pulumi.output(rlName);
+        this.signingKeySecretRef = args.signingKeySecretRef;
+        this.registerOutputs({ revocationListName: this.revocationListName });
+    }
+}
+exports.TrustBootstrap = TrustBootstrap;

package/copy.bara.sky

@@ -0,0 +1,98 @@
+# GENERATED by tools/open-source/gen-copybara.mjs — DO NOT EDIT.
+# One-way mirror of the @mcpg-dev/pulumi npm package from the mcpg monorepo to
+# its own public repository. Contains NO version literals — regenerate
+# (`--write-npm`) only when the package's identity or layout changes.
+#
+# Licence: Apache-2.0. Repo: github.com/mcpg-dev/pulumi-mcpg.
+# History is SQUASHED and re-authored to the bot, so no internal commit
+# history, subjects, or contributor identities are exposed.
+
+# Reads "version" from the package's own package.json at MIRROR time: sets
+# the public release message and the PKG_VERSION label the destination
+# resolves in tag_name — so no version is baked into this file. Matched at
+# two-space indentation so a nested "version" (the CRD SDK's generated
+# provider block carries one) can never be mistaken for the package's.
+def _release_meta(ctx):
+    content = ctx.read_path(ctx.new_path("package.json"))
+    version = ""
+    for line in content.split("\n"):
+        if not line.startswith('  "version"'):
+            continue
+        rest = line.split(":", 1)
+        if len(rest) < 2:
+            continue
+        version = rest[1].strip().strip(",").strip('"')
+        break
+    if version == "":
+        fail("mirror: could not read top-level \"version\" from package.json")
+    ctx.set_message("Release v" + version + "\n")
+    ctx.add_label("PKG_VERSION", version, hidden = True)
+
+core.workflow(
+    name = "default",
+    mode = "SQUASH",
+
+    origin = git.origin(
+        url = "https://github.com/mcpg-dev/source-code.git",
+        ref = "main",
+    ),
+    # push the code to main AND create the v{version} tag the public repo's
+    # release.yml fires on to self-publish to npm.
+    destination = git.github_destination(
+        url  = "https://github.com/mcpg-dev/pulumi-mcpg.git",
+        push = "main",
+        tag_name = "v${PKG_VERSION}",
+        tag_msg  = "Release v${PKG_VERSION}",
+    ),
+
+    # The package subtree, minus internal artifacts: nx project.json,
+    # CHANGELOG.md (internal commits/PRs), AI-agent working rules, build
+    # output, and installed dependencies. Sources and tests DO travel — the
+    # tests use only node:test and node:assert, so they build and run in the
+    # public repo with nothing extra.
+    origin_files = glob(["iac/pulumi/components/**"], exclude = [
+        "iac/pulumi/components/copy.bara.sky", "iac/pulumi/components/project.json",
+        "iac/pulumi/components/BUILD.bazel", "iac/pulumi/components/**/BUILD.bazel",
+        "iac/pulumi/components/CHANGELOG.md", "iac/pulumi/components/**/AGENTS.md",
+        "iac/pulumi/components/bin/**", "iac/pulumi/components/node_modules/**",
+        "iac/pulumi/components/**/*.tsbuildinfo",
+        # Destination-managed names never travel from the origin (the
+        # destination excludes them, and Copybara refuses uncovered writes).
+        "iac/pulumi/components/.gitignore", "iac/pulumi/components/CONTRIBUTING.md",
+        "iac/pulumi/components/package-lock.json", "iac/pulumi/components/.github/**",
+        "iac/pulumi/components/**/DEFERRED.md", "iac/pulumi/components/**/TODO.md",
+        "iac/pulumi/components/**/NOTES.md", "iac/pulumi/components/**/ROADMAP.md",
+        "iac/pulumi/components/**/INTERNAL*.md",
+    ]),
+
+    # Repo-only scaffold (CI, release shim, CONTRIBUTING, .gitignore) is
+    # seeded at bootstrap and excluded here so the mirror never deletes or
+    # clobbers it. LICENSE is NOT excluded — the mirror manages it.
+    destination_files = glob(["**"], exclude = [
+        ".github/**", ".gitignore", "CONTRIBUTING.md", "package-lock.json",
+    ]),
+
+    # Re-author every commit to the bot — no real contributor identity leaks.
+    authoring = authoring.overwrite("mcpg-bot <oss-bot@mcpg.dev>"),
+
+    transformations = [
+        # 1) subdir -> repo root.
+        core.move("iac/pulumi/components", ""),
+
+        # 2) point "repository" at this package's own public repo. Left
+        #    naming the monorepo, a published package sends every reader
+        #    to a repository they cannot open.
+        core.transform([
+            core.replace(
+                before = "\"repository\": \"https://github.com/mcpg-dev/source-code\"",
+                after  = "\"repository\": \"https://github.com/mcpg-dev/pulumi-mcpg\"",
+                paths  = glob(["package.json"]),
+            ),
+        ], reversal = []),
+
+        # 3) release message + PKG_VERSION label from the mirrored
+        #    manifest — replaces the squashed history's message entirely: NO
+        #    commit list, NO authors, NO subjects.
+        _release_meta,
+    ],
+)

package/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@mcpg-dev/pulumi",
+  "version": "0.1.0-beta.11",
+  "repository": "https://github.com/mcpg-dev/source-code",
+  "description": "Opinionated Pulumi components for MCPG (operator, gateway, tenant, trust).",
+  "license": "Apache-2.0",
+  "main": "bin/index.js",
+  "types": "bin/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@mcpg-dev/pulumi-crds": "0.1.0-beta.11",
+    "@pulumi/kubernetes": "4.31.1",
+    "@pulumi/pulumi": "^3.142.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "typescript": "^5.4.0"
+  }
+}

package/src/cluster.ts

@@ -0,0 +1,75 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+
+export interface ClusterCredential {
+    /** cred://cluster/<name>. */
+    name: string;
+    secretName: string;
+    key?: string;
+    /** When set, the component CREATES the Secret in operatorNamespace; else it is assumed to pre-exist. */
+    data?: { [key: string]: string };
+}
+
+export interface ClusterArgs {
+    /** single_node (default) | redis | nats | consul | etcd. */
+    backend?: string;
+    /** Per-backend connection config. MUST be empty for single_node, non-empty otherwise. */
+    config?: { [key: string]: any };
+    /** Optional { name } of the cluster-scoped MCPGPlugin supplying the cdylib. */
+    pluginRef?: { name: string };
+    /** Optional [{ name, secretName, key? }] referencing PRE-EXISTING Secrets, surfaced as cred://cluster/<name>. */
+    credentialRefs?: any[];
+    /** Backend credentials this component manages — creates the Secret (when `data` is set) in operatorNamespace + wires the ref. */
+    credentials?: ClusterCredential[];
+    /** Namespace the operator runs in — where credential Secrets must live. */
+    operatorNamespace?: pulumi.Input<string>;
+    labels?: { [key: string]: string };
+    resourceName?: string;
+}
+
+/**
+ * An MCPGCluster (cluster-scoped): the coordination backend a gateway's
+ * `clusterRef` points at. `single_node` takes no config; external backends
+ * require a non-empty connection block.
+ */
+export class Cluster extends pulumi.ComponentResource {
+    public readonly cluster: mcpg.v1alpha1.MCPGCluster;
+    public readonly name: pulumi.Output<string>;
+
+    constructor(name: string, args: ClusterArgs = {}, opts?: pulumi.ComponentResourceOptions) {
+        super("mcpg:index:Cluster", name, {}, opts);
+
+        const cName = args.resourceName ?? name;
+        const ns = args.operatorNamespace ?? "mcpg-system";
+
+        // Managed credential Secrets (operator namespace) + their refs.
+        const managedRefs: any[] = [];
+        const secretDeps: pulumi.Resource[] = [];
+        for (const c of args.credentials ?? []) {
+            if (c.data) {
+                const sec = new k8s.core.v1.Secret(`${cName}-cred-${c.name}`, {
+                    metadata: { name: c.secretName, namespace: ns },
+                    stringData: c.data,
+                    type: "Opaque",
+                }, { parent: this });
+                secretDeps.push(sec);
+            }
+            managedRefs.push(c.key ? { name: c.name, secretName: c.secretName, key: c.key } : { name: c.name, secretName: c.secretName });
+        }
+        const credentialRefs = [...(args.credentialRefs ?? []), ...managedRefs];
+
+        const spec: { [key: string]: any } = { backend: args.backend ?? "single_node" };
+        if (args.config && Object.keys(args.config).length > 0) spec.config = args.config;
+        if (args.pluginRef) spec.pluginRef = args.pluginRef;
+        if (credentialRefs.length > 0) spec.credentialRefs = credentialRefs;
+
+        this.cluster = new mcpg.v1alpha1.MCPGCluster(cName, {
+            metadata: { name: cName, labels: args.labels },
+            spec: spec as any,
+        }, { parent: this, dependsOn: secretDeps });
+
+        this.name = pulumi.output(cName);
+        this.registerOutputs({ name: this.name });
+    }
+}

package/src/config.test.ts

@@ -0,0 +1,36 @@
+// Unit tests for the config builder. Uses node's built-in test runner +
+// assert (no extra deps). Run: `tsc && node --test bin/config.test.js`.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { buildConfig } from "./config";
+
+test("typed sections are included; absent ones omitted", () => {
+    const c = buildConfig({ governance: { audit: { sinks: [{ kind: "dev.mcpg.builtin.audit.local-file" }] } } });
+    assert.equal(c.governance.audit.sinks[0].kind, "dev.mcpg.builtin.audit.local-file");
+    assert.equal("gateway" in c, false);
+    assert.equal("observability" in c, false);
+});
+
+test("server nests under config.gateway.server (not a top-level server key)", () => {
+    const c = buildConfig({ server: { listen_addr: "0.0.0.0:8080" } });
+    assert.equal("server" in c, false);
+    assert.deepEqual(c.gateway.server, { listen_addr: "0.0.0.0:8080" });
+});
+
+test("plugins included only when non-empty", () => {
+    assert.equal("plugins" in buildConfig({ plugins: [] }), false);
+    assert.deepEqual(buildConfig({ plugins: [{ id: "db.read" }] }).plugins, [{ id: "db.read" }]);
+});
+
+test("extraConfig is merged LAST and wins", () => {
+    const c = buildConfig({
+        governance: { a: 1 },
+        extraConfig: { governance: { b: 2 }, extra: true },
+    });
+    assert.deepEqual(c.governance, { b: 2 }); // extraConfig wins
+    assert.equal(c.extra, true);
+});
+
+test("empty input yields empty config", () => {
+    assert.deepEqual(buildConfig({}), {});
+});

package/src/config.ts

@@ -0,0 +1,44 @@
+// The gateway config builder: assemble spec.config (the preserve-unknown
+// AppConfig) from typed convenience sections plus an `extraConfig` escape hatch
+// deep-merged LAST so it wins. Mirrors the Terraform module's config builder.
+
+export interface GatewayConfigInput {
+    /**
+     * Gateway server/listener config. Emitted at config.gateway.server (the
+     * `gateway:` AppConfig umbrella holds server/admin/control_plane), NOT a
+     * top-level `server` key — that trips AppConfig's deny_unknown_fields.
+     */
+    server?: any;
+    /**
+     * config.governance section (access / policy / approvals / audit). Audit
+     * sinks are a LIST, not a scalar:
+     * { audit: { sinks: [{ kind: "dev.mcpg.builtin.audit.local-file" }] } }.
+     * `dev.mcpg.builtin.audit.local-file` is the canonical built-in audit sink.
+     */
+    governance?: any;
+    /** config.observability section. */
+    observability?: any;
+    /** config.mcp section (capabilities, etc.). */
+    mcp?: any;
+    /**
+     * Ordered config.plugins list (AppConfig PluginEntryConfig). Each entry:
+     * { id, source: { path | oci }, class?, kind?, config?, enforce?, disabled? }.
+     * The toggle is `disabled` (bool, default false) — there is no `enabled`.
+     * A `source` declaring exactly one of path/oci is required.
+     */
+    plugins?: any[];
+    /** Arbitrary AppConfig fragment merged LAST into spec.config (wins). */
+    extraConfig?: Record<string, any>;
+}
+
+/** Assemble spec.config from typed sections + extraConfig (extraConfig wins). */
+export function buildConfig(input: GatewayConfigInput): Record<string, any> {
+    const cfg: Record<string, any> = {};
+    // `server` lives under the `gateway:` umbrella, not at the top level.
+    if (input.server) cfg.gateway = { server: input.server };
+    if (input.governance) cfg.governance = input.governance;
+    if (input.observability) cfg.observability = input.observability;
+    if (input.mcp) cfg.mcp = input.mcp;
+    if (input.plugins && input.plugins.length > 0) cfg.plugins = input.plugins;
+    return { ...cfg, ...(input.extraConfig ?? {}) };
+}

package/src/gateway.ts

@@ -0,0 +1,91 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+import { buildConfig, GatewayConfigInput } from "./config";
+
+export interface GatewayArgs extends GatewayConfigInput {
+    namespace: pulumi.Input<string>;
+    /** Gateway image (CRD spec.image — e.g. { repository, tag }). Required. */
+    image: any;
+    replicas?: number;
+    pluginSetRef?: pulumi.Input<string>;
+    revocationListRef?: pulumi.Input<string>;
+    /** MCPGCluster coordination backend (spec.clusterRef.name) for HA gateways. */
+    clusterRef?: pulumi.Input<string>;
+    /** Soft-tenancy: namespaces whose MCPGRoutes this gateway accepts. */
+    acceptedRouteNamespaces?: string[];
+    podAnnotations?: { [key: string]: string };
+    podLabels?: { [key: string]: string };
+    // Passthrough spec blocks (CRD spec.* — same surface as the TF module).
+    resources?: any;
+    service?: any;
+    ingress?: any;
+    autoscaling?: any;
+    monitoring?: any;
+    networkPolicy?: any;
+    podDisruptionBudget?: any;
+    workloadIdentity?: any;
+    scheduling?: any;
+    probes?: any;
+    imagePullSecrets?: any;
+    /** Arbitrary spec-level fields merged LAST (for spec keys not yet typed). */
+    extraSpec?: { [key: string]: any };
+    labels?: { [key: string]: string };
+    /** Default true → annotate `pulumi.com/waitFor: condition=Ready`. */
+    waitForReady?: boolean;
+    /** MCPGGateway metadata.name (defaults to the component name). */
+    resourceName?: string;
+}
+
+/**
+ * An MCPGGateway built from typed inputs + the config builder. Readiness is the
+ * provider's built-in await via the `pulumi.com/waitFor` annotation.
+ */
+export class Gateway extends pulumi.ComponentResource {
+    public readonly gateway: mcpg.v1alpha1.MCPGGateway;
+    public readonly name: pulumi.Output<string>;
+
+    constructor(name: string, args: GatewayArgs, opts?: pulumi.ComponentResourceOptions) {
+        super("mcpg:index:Gateway", name, {}, opts);
+
+        const gwName = args.resourceName ?? name;
+        const spec: { [key: string]: any } = {
+            image: args.image,
+            config: buildConfig(args),
+        };
+        if (args.replicas !== undefined) spec.replicas = args.replicas;
+        if (args.pluginSetRef) spec.pluginSetRef = { name: args.pluginSetRef };
+        if (args.revocationListRef) spec.revocationListRef = { name: args.revocationListRef };
+        if (args.clusterRef) spec.clusterRef = { name: args.clusterRef };
+
+        // Typed passthrough blocks (same spec surface as the TF gateway module).
+        const optional: { [key: string]: any } = {
+            acceptedRouteNamespaces: args.acceptedRouteNamespaces,
+            podAnnotations: args.podAnnotations,
+            podLabels: args.podLabels,
+            resources: args.resources,
+            service: args.service,
+            ingress: args.ingress,
+            autoscaling: args.autoscaling,
+            monitoring: args.monitoring,
+            networkPolicy: args.networkPolicy,
+            podDisruptionBudget: args.podDisruptionBudget,
+            workloadIdentity: args.workloadIdentity,
+            scheduling: args.scheduling,
+            probes: args.probes,
+            imagePullSecrets: args.imagePullSecrets,
+        };
+        for (const [k, v] of Object.entries(optional)) if (v !== undefined) spec[k] = v;
+        Object.assign(spec, args.extraSpec ?? {}); // escape hatch wins (matches TF extra_spec)
+
+        const annotations: { [key: string]: string } =
+            args.waitForReady === false ? {} : { "pulumi.com/waitFor": "condition=Ready" };
+
+        this.gateway = new mcpg.v1alpha1.MCPGGateway(gwName, {
+            metadata: { name: gwName, namespace: args.namespace, labels: args.labels, annotations },
+            spec: spec as any,
+        }, { parent: this });
+
+        this.name = pulumi.output(gwName);
+        this.registerOutputs({ name: this.name });
+    }
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+export * from "./config";
+export * from "./oci";
+export * from "./operator";
+export * from "./gateway";
+export * from "./pluginSet";
+export * from "./trustBootstrap";
+export * from "./tenant";
+export * from "./cluster";
+export * from "./route";
+export * from "./tenantCr";
+export * from "./mcpgStack";

package/src/mcpgStack.ts

@@ -0,0 +1,37 @@
+import * as pulumi from "@pulumi/pulumi";
+import { Operator, OperatorArgs } from "./operator";
+import { Gateway, GatewayArgs } from "./gateway";
+import { TrustBootstrap } from "./trustBootstrap";
+
+export interface McpgStackArgs {
+    operator: OperatorArgs;
+    /** Optional single gateway for the common case. */
+    gateway?: Omit<GatewayArgs, "namespace"> & { namespace?: pulumi.Input<string> };
+    /** Seed the cluster-default revocation list (default true). */
+    trust?: boolean;
+}
+
+/** Convenience composition: operator + cluster trust + one gateway. */
+export class McpgStack extends pulumi.ComponentResource {
+    public readonly operator: Operator;
+    public readonly gateway?: Gateway;
+
+    constructor(name: string, args: McpgStackArgs, opts?: pulumi.ComponentResourceOptions) {
+        super("mcpg:index:McpgStack", name, {}, opts);
+
+        this.operator = new Operator(`${name}-operator`, args.operator, { parent: this });
+
+        if (args.trust !== false) {
+            new TrustBootstrap(`${name}-trust`, {}, { parent: this, dependsOn: this.operator });
+        }
+
+        if (args.gateway) {
+            this.gateway = new Gateway(`${name}-gateway`, {
+                ...args.gateway,
+                namespace: args.gateway.namespace ?? this.operator.namespace,
+            }, { parent: this, dependsOn: this.operator });
+        }
+
+        this.registerOutputs({});
+    }
+}

package/src/oci.ts

@@ -0,0 +1,40 @@
+// Registry coordinates every MCPG artefact hangs off. The defaults mirror the
+// `internal` channel of tools/release/oci-registry.json — the manifest the
+// publish steps read — and tools/ci/selftest-oci-registry.sh asserts the two
+// still agree.
+//
+// A Pulumi program overrides per component (`chartRepo`, an explicit image
+// repository) or, for a whole stack, through the same environment contract the
+// shell and Node publish helpers honour:
+//
+//   MCPG_OCI_HOST       registry host       (default: ghcr.io)
+//   MCPG_OCI_NAMESPACE  org / user segment  (default: mcpg-dev)
+//   MCPG_OCI_PATH       repository path segment (default: source-code)
+//
+// MCPG_OCI_PATH set-but-empty means "no path segment" — the shape the public
+// channel takes — so it is read by presence, not by truthiness.
+
+const trim = (s: string): string => s.replace(/^\/+|\/+$/g, "");
+
+/** The resolved `<host>/<namespace>[/<path>]` base. */
+export function ociBase(env: NodeJS.ProcessEnv = process.env): string {
+    const host = trim(env.MCPG_OCI_HOST ?? "ghcr.io");
+    const namespace = trim(env.MCPG_OCI_NAMESPACE ?? "mcpg-dev");
+    const path = trim("MCPG_OCI_PATH" in env ? (env.MCPG_OCI_PATH ?? "") : "source-code");
+    return [host, namespace, path].filter(Boolean).join("/");
+}
+
+/** Helm OCI repository the charts publish to (`repositoryOpts.repo`). */
+export function ociChartRepo(env: NodeJS.ProcessEnv = process.env): string {
+    return `oci://${ociBase(env)}/charts`;
+}
+
+/** Container image repository for a project's `release.docker.imageName`. */
+export function ociImageRepo(imageName: string, env: NodeJS.ProcessEnv = process.env): string {
+    return `${ociBase(env)}/${trim(imageName)}`;
+}
+
+/** Registry a bare `oci:` plugin reference resolves against. */
+export function ociPluginRegistry(env: NodeJS.ProcessEnv = process.env): string {
+    return `${ociBase(env)}/plugins`;
+}

package/src/operator.ts

@@ -0,0 +1,65 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+import { ociChartRepo } from "./oci";
+
+export interface OperatorArgs {
+    namespace?: pulumi.Input<string>;
+    chartVersion: pulumi.Input<string>;
+    chartName?: pulumi.Input<string>;
+    /** Helm repository. Unset composes `oci://<ociBase()>/charts`. */
+    chartRepo?: pulumi.Input<string>;
+    /** Path to the split-by-kind CRD YAMLs (the generated schema snapshot). */
+    crdsDir?: string;
+    /** Restrict the operator to a single namespace (operator.watchNamespace → --watch-namespace). */
+    watchNamespace?: pulumi.Input<string>;
+    /** Extra chart values deep-merged last. */
+    values?: { [key: string]: any };
+}
+
+/**
+ * Installs the MCPG operator via Helm with the CRDs managed as first-class
+ * resources (chart `crd.install=false`) so they upgrade independently — closing
+ * the Helm-doesn't-upgrade-CRDs hazard. Pulumi's K8s provider does SSA by
+ * default and awaits readiness.
+ */
+export class Operator extends pulumi.ComponentResource {
+    public readonly namespace: pulumi.Output<string>;
+    public readonly chart: k8s.helm.v4.Chart;
+
+    constructor(name: string, args: OperatorArgs, opts?: pulumi.ComponentResourceOptions) {
+        super("mcpg:index:Operator", name, {}, opts);
+
+        const ns = pulumi.output(args.namespace ?? "mcpg-system");
+        const crdsDir = args.crdsDir ?? "../../codegen/schemas/v1alpha1/crds";
+
+        const crds = new k8s.yaml.v2.ConfigGroup(`${name}-crds`, {
+            files: [`${crdsDir}/*.yaml`],
+        }, { parent: this });
+
+        this.chart = new k8s.helm.v4.Chart(name, {
+            chart: args.chartName ?? "mcpg-operator",
+            version: args.chartVersion,
+            namespace: ns,
+            repositoryOpts: {
+                repo: args.chartRepo ?? ociChartRepo(),
+            },
+            // The chart ships CRDs under crds/ (Helm install-only, value-ungated);
+            // the ConfigGroup above owns them as first-class resources, so skip the
+            // chart's copy to avoid two Pulumi resources managing the same CRDs.
+            skipCrds: true,
+            // Secure default: the admission webhook fails closed, so it needs real
+            // TLS. cert-manager templates a self-signed Issuer + Certificate and
+            // injects the caBundle. Requires cert-manager in the cluster; override
+            // via values.certManager (e.g. { enabled: false } for BYO TLS Secret).
+            values: {
+                crd: { install: false },
+                certManager: { enabled: true },
+                ...(args.watchNamespace ? { operator: { watchNamespace: args.watchNamespace } } : {}),
+                ...(args.values ?? {}),
+            },
+        }, { parent: this, dependsOn: crds });
+
+        this.namespace = ns;
+        this.registerOutputs({ namespace: this.namespace });
+    }
+}

package/src/pluginSet.ts

@@ -0,0 +1,33 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+
+export interface PluginSetArgs {
+    namespace: pulumi.Input<string>;
+    entries: any[];
+    capabilityGrants?: any[];
+    labels?: { [key: string]: string };
+    resourceName?: string;
+}
+
+export class PluginSet extends pulumi.ComponentResource {
+    public readonly pluginSet: mcpg.v1alpha1.MCPGPluginSet;
+    public readonly name: pulumi.Output<string>;
+
+    constructor(name: string, args: PluginSetArgs, opts?: pulumi.ComponentResourceOptions) {
+        super("mcpg:index:PluginSet", name, {}, opts);
+
+        const psName = args.resourceName ?? name;
+        const spec: { [key: string]: any } = { entries: args.entries };
+        if (args.capabilityGrants && args.capabilityGrants.length > 0) {
+            spec.capabilityGrants = args.capabilityGrants;
+        }
+
+        this.pluginSet = new mcpg.v1alpha1.MCPGPluginSet(psName, {
+            metadata: { name: psName, namespace: args.namespace, labels: args.labels },
+            spec: spec as any,
+        }, { parent: this });
+
+        this.name = pulumi.output(psName);
+        this.registerOutputs({ name: this.name });
+    }
+}

package/src/route.ts

@@ -0,0 +1,45 @@
+import * as pulumi from "@pulumi/pulumi";
+import { mcpg } from "@mcpg-dev/pulumi-crds";
+
+export interface RouteArgs {
+    namespace: pulumi.Input<string>;
+    /** Shared gateway this route binds into: { name } (non-empty). */
+    gatewayRef: { name: string };
+    /** Tool matcher: { tools: [{ id }] } — at least one unique, non-empty id. */
+    match: { tools: { id: string }[] };
+    identityChain?: string[];
+    policyChain?: string[];
+    auditChain?: string[];
+    /** e.g. { tenant: "team-a" }. Omit only for a single-tenant gateway (else reachable by any caller). */
+    attributes?: { [key: string]: any };
+    labels?: { [key: string]: string };
+    resourceName?: string;
+}
+
+/**
+ * An MCPGRoute (namespaced): binds a tenant's tool subset into a SHARED gateway
+ * with identity/policy/audit chains — the soft-multi-tenancy primitive.
+ */
+export class Route extends pulumi.ComponentResource {
+    public readonly route: mcpg.v1alpha1.MCPGRoute;
+    public readonly name: pulumi.Output<string>;
+
+    constructor(name: string, args: RouteArgs, opts?: pulumi.ComponentResourceOptions) {
+        super("mcpg:index:Route", name, {}, opts);
+
+        const rName = args.resourceName ?? name;
+        const spec: { [key: string]: any } = { gatewayRef: args.gatewayRef, match: args.match };
+        if (args.identityChain && args.identityChain.length > 0) spec.identityChain = args.identityChain;
+        if (args.policyChain && args.policyChain.length > 0) spec.policyChain = args.policyChain;
+        if (args.auditChain && args.auditChain.length > 0) spec.auditChain = args.auditChain;
+        if (args.attributes) spec.attributes = args.attributes;
+
+        this.route = new mcpg.v1alpha1.MCPGRoute(rName, {
+            metadata: { name: rName, namespace: args.namespace, labels: args.labels },
+            spec: spec as any,
+        }, { parent: this });
+
+        this.name = pulumi.output(rName);
+        this.registerOutputs({ name: this.name });
+    }
+}