@microagi/alchemy-gcp 0.11.3 → 0.11.5

package/src/ArtifactRegistry/RepositoryIamMember.ts

@@ -0,0 +1,205 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as ar from "@distilled.cloud/gcp/artifactregistry-v1";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type * as GCP from "../Providers.ts";
+
+/**
+ * A single unconditional `(role, member)` IAM grant on an Artifact Registry
+ * repository. The repository is referenced by its fully-qualified resource
+ * name and is not created or deleted by this resource.
+ *
+ * Reconciliation is an additive read-modify-write: foreign bindings,
+ * conditional bindings, members, policy version, and etag are preserved.
+ * Deletion revokes only this exact member and removes an emptied binding.
+ * The whole cycle retries boundedly on stale-etag conflicts so concurrent
+ * policy writers compose safely.
+ *
+ * @example Read access to one Docker repository
+ * ```typescript
+ * yield* GCP.ArtifactRegistryRepositoryIamMember("EvalsAppsReader", {
+ *   repository: apps.fullyQualifiedName,
+ *   role: "roles/artifactregistry.reader",
+ *   member: "serviceAccount:evals@example-project.iam.gserviceaccount.com",
+ * });
+ * ```
+ */
+export type ArtifactRegistryRepositoryIamMemberProps = {
+  /**
+   * Fully-qualified repository resource name:
+   * `projects/{project}/locations/{location}/repositories/{repository}`.
+   * Immutable — changing it replaces the grant.
+   */
+  repository: string;
+  /** IAM role, e.g. `roles/artifactregistry.reader`. Immutable. */
+  role: string;
+  /** IAM member string, e.g. `serviceAccount:name@project.iam.gserviceaccount.com`. Immutable. */
+  member: string;
+};
+
+export type ArtifactRegistryRepositoryIamMemberAttributes =
+  ArtifactRegistryRepositoryIamMemberProps;
+
+export type ArtifactRegistryRepositoryIamMember = Resource<
+  "GCP.ArtifactRegistryRepositoryIamMember",
+  ArtifactRegistryRepositoryIamMemberProps,
+  ArtifactRegistryRepositoryIamMemberAttributes,
+  never,
+  GCP.Providers
+>;
+
+export const ArtifactRegistryRepositoryIamMember =
+  Resource<ArtifactRegistryRepositoryIamMember>(
+    "GCP.ArtifactRegistryRepositoryIamMember",
+  );
+
+export const ArtifactRegistryRepositoryIamMemberProvider = () =>
+  Provider.effect(
+    ArtifactRegistryRepositoryIamMember,
+    Effect.gen(function* () {
+      const getIamPolicy = yield* ar.getIamPolicyProjectsLocationsRepositories;
+      const setIamPolicy = yield* ar.setIamPolicyProjectsLocationsRepositories;
+
+      const hasMember = (policy: ar.Policy, role: string, member: string) =>
+        (policy.bindings ?? []).some(
+          (binding) =>
+            binding.role === role &&
+            !binding.condition &&
+            (binding.members ?? []).includes(member),
+        );
+
+      const conflictRetry = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+        effect.pipe(
+          Effect.retry({
+            while: (error) => (error as { _tag?: string })?._tag === "Conflict",
+            schedule: Schedule.exponential(Duration.millis(250)).pipe(
+              Schedule.both(Schedule.recurs(8)),
+            ),
+          }),
+        );
+
+      const readPolicy = (repository: string) =>
+        getIamPolicy({
+          resource: repository,
+          "options.requestedPolicyVersion": 3,
+        });
+
+      return {
+        stables: ["repository", "role", "member"],
+        diff: Effect.fn(function* ({ news, olds = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          const priorRepository = output?.repository || olds.repository;
+          const priorRole = output?.role || olds.role;
+          const priorMember = output?.member || olds.member;
+          if (
+            (priorRepository && priorRepository !== news.repository) ||
+            (priorRole && priorRole !== news.role) ||
+            (priorMember && priorMember !== news.member)
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news }) {
+          yield* conflictRetry(
+            Effect.gen(function* () {
+              const current = yield* readPolicy(news.repository).pipe(
+                Effect.catchTag("NotFound", () =>
+                  Effect.fail(
+                    new ConfigError({
+                      message: `Artifact Registry repository ${news.repository} does not exist — RepositoryIamMember grants on existing repositories only.`,
+                    }),
+                  ),
+                ),
+              );
+              if (hasMember(current, news.role, news.member)) return;
+
+              const bindings = (current.bindings ?? []).map((binding) => ({
+                ...binding,
+                members: [...(binding.members ?? [])],
+              }));
+              const existing = bindings.find(
+                (binding) => binding.role === news.role && !binding.condition,
+              );
+              if (existing) {
+                existing.members = [...(existing.members ?? []), news.member];
+              } else {
+                bindings.push({ role: news.role, members: [news.member] });
+              }
+
+              yield* setIamPolicy({
+                resource: news.repository,
+                body: {
+                  policy: { ...current, bindings, version: 3 },
+                },
+              });
+            }),
+          );
+          return {
+            repository: news.repository,
+            role: news.role,
+            member: news.member,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (!output.repository || !output.role || !output.member) return;
+          yield* conflictRetry(
+            Effect.gen(function* () {
+              const current = yield* readPolicy(output.repository).pipe(
+                Effect.catchTag("NotFound", () =>
+                  Effect.succeed(undefined as ar.Policy | undefined),
+                ),
+              );
+              if (!current || !hasMember(current, output.role, output.member)) {
+                return;
+              }
+
+              const bindings = (current.bindings ?? [])
+                .map((binding) =>
+                  binding.role === output.role && !binding.condition
+                    ? {
+                        ...binding,
+                        members: (binding.members ?? []).filter(
+                          (member) => member !== output.member,
+                        ),
+                      }
+                    : {
+                        ...binding,
+                        members: [...(binding.members ?? [])],
+                      },
+                )
+                .filter((binding) => (binding.members?.length ?? 0) > 0);
+
+              yield* setIamPolicy({
+                resource: output.repository,
+                body: {
+                  policy: { ...current, bindings, version: 3 },
+                },
+              }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+            }),
+          );
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const repository = output?.repository ?? olds?.repository;
+          const role = output?.role ?? olds?.role;
+          const member = output?.member ?? olds?.member;
+          if (!repository || !role || !member) return undefined;
+
+          const current = yield* readPolicy(repository).pipe(
+            Effect.catchTag("NotFound", () =>
+              Effect.succeed(undefined as ar.Policy | undefined),
+            ),
+            Effect.catchTag("Forbidden", () =>
+              Effect.succeed(undefined as ar.Policy | undefined),
+            ),
+          );
+          if (!current || !hasMember(current, role, member)) return undefined;
+          return { repository, role, member };
+        }),
+      };
+    }),
+  );

package/src/ArtifactRegistry/index.ts

@@ -7,4 +7,12 @@ export type {
   ArtifactRegistryRepositoryAttributes,
   ArtifactRegistryRepositoryProps,
 } from "./Repository.ts";
+export {
+  ArtifactRegistryRepositoryIamMember,
+  ArtifactRegistryRepositoryIamMemberProvider,
+} from "./RepositoryIamMember.ts";
+export type {
+  ArtifactRegistryRepositoryIamMemberAttributes,
+  ArtifactRegistryRepositoryIamMemberProps,
+} from "./RepositoryIamMember.ts";
 export type { ArtifactRegistryFormat, ArtifactRegistryMode } from "./Types.ts";

package/src/Container/NodePool.ts

@@ -34,11 +34,19 @@ export type NodePoolProps = {
    * without a positive node count, so when omitted we default to
    * `autoscaling.minNodeCount ?? 1` on the create path.
    *
-   * Subsequent size changes go via `setSize` when `autoscaling` is
-   * disabled, or are GKE-managed when `autoscaling.enabled` is true
-   * (the size sync is skipped to avoid fighting the autoscaler).
+   * Subsequent size changes go via `setSize` unless autoscaling or
+   * `externallyManagedSize` delegates steady-state size ownership.
    */
   initialNodeCount?: number;
+  /**
+   * Treat the pool's live size as externally owned after creation.
+   *
+   * `initialNodeCount` is still used to bootstrap a missing pool, but
+   * subsequent reconciles do not call GKE `setSize`. This is intended for
+   * imperative controllers that resize a pool while Alchemy continues to own
+   * its machine shape, labels, taints, management, and upgrade settings.
+   */
+  externallyManagedSize?: boolean;
   /**
    * Per-pool zones. Override the cluster default. Mutable via
    * `update` — sent in a standalone update body to avoid the SDK's
@@ -235,6 +243,19 @@ export type NodePool = Resource<
 >;
 export const NodePool = Resource<NodePool>("GCP.NodePool");
 
+/** Whether a reconcile should bring a node pool back to its declared size. */
+export const nodePoolSizeNeedsSync = (
+  observedCount: number | undefined,
+  news: Pick<
+    NodePoolProps,
+    "initialNodeCount" | "autoscaling" | "externallyManagedSize"
+  >,
+): boolean =>
+  news.externallyManagedSize !== true &&
+  news.autoscaling?.enabled !== true &&
+  news.initialNodeCount !== undefined &&
+  observedCount !== news.initialNodeCount;
+
 /**
  * Translate a public `accelerators` spec into the SDK's
  * `AcceleratorConfig`. Same shape on both create and update paths.
@@ -449,14 +470,14 @@ export const NodePoolProvider = () =>
         news: NodePoolProps;
         session: ScopedPlanStatusSession;
       }) {
-        // Skip when the autoscaler is enabled; fighting it creates churn.
-        if (args.news.autoscaling?.enabled) return;
-        if (args.news.initialNodeCount === undefined) return;
         const observedCount = args.observed.initialNodeCount;
-        if (observedCount === args.news.initialNodeCount) return;
+        // Skip when either GKE autoscaling or an external controller owns
+        // size; fighting either creates churn. Externally-managed pools still
+        // use initialNodeCount on the create path above.
+        if (!nodePoolSizeNeedsSync(observedCount, args.news)) return;
         const op = yield* setSize({
           name: args.fqName,
-          body: { nodeCount: args.news.initialNodeCount },
+          body: { nodeCount: args.news.initialNodeCount! },
         });
         if (op.name) yield* awaitOperation(qualifyOp(args.fqName, op.name), args.session);
       });

package/src/Providers.ts

@@ -4,6 +4,10 @@ import {
   ArtifactRegistryRepository,
   ArtifactRegistryRepositoryProvider,
 } from "./ArtifactRegistry/Repository.ts";
+import {
+  ArtifactRegistryRepositoryIamMember,
+  ArtifactRegistryRepositoryIamMemberProvider,
+} from "./ArtifactRegistry/RepositoryIamMember.ts";
 import { GCPAuth } from "./Auth/AuthProvider.ts";
 import { fromAuthProvider } from "./Auth/Credentials.ts";
 import { Project, ProjectProvider } from "./CloudResourceManager/Project.ts";
@@ -116,6 +120,7 @@ export const providers = () =>
       SqlDatabase,
       SqlUser,
       ArtifactRegistryRepository,
+      ArtifactRegistryRepositoryIamMember,
       ServiceAccount,
       ServiceAccountKey,
       KubernetesSecret,
@@ -148,6 +153,7 @@ export const providers = () =>
         SqlDatabaseProvider(),
         SqlUserProvider(),
         ArtifactRegistryRepositoryProvider(),
+        ArtifactRegistryRepositoryIamMemberProvider(),
         ServiceAccountProvider(),
         ServiceAccountKeyProvider(),
         KubernetesSecretProvider(),