@reyemtech/nimbus 1.2.0 → 2.0.1

package/dist/cjs/operator/minio.d.ts

@@ -0,0 +1,37 @@
+/**
+ * MinIO backend — deploys MinIO via the MinIO Operator (operator.min.io)
+ * using the Tenant CRD pattern. The operator is installed via Helm by
+ * index.ts; this module creates Tenant CRDs and provisions buckets with
+ * per-bucket IAM users via Kubernetes Jobs using the MinIO Client (mc).
+ *
+ * @module operator/minio
+ */
+import * as k8s from "@pulumi/kubernetes";
+import type { IOperatorConfig, IMinIOOperator, IMinIOIngressConfig } from "./interfaces";
+/**
+ * Create a MinIO Tenant via the MinIO Operator and return an IMinIOOperator
+ * with a createBucket() method for provisioning object storage buckets.
+ *
+ * The operator Helm release is installed by index.ts. This function creates:
+ * 1. A root credentials Secret (config.env format)
+ * 2. A Tenant CRD in the data namespace
+ * 3. Returns an operator with createBucket() for per-bucket provisioning
+ *
+ * @example
+ * ```typescript
+ * const minio = createOperator("minio", { cluster });
+ * const bucket = minio.createBucket("uploads", {
+ *   sizeGb: 20,
+ *   namespaces: ["app", "workers"],
+ * });
+ * ```
+ */
+export declare function createMinioOperator(config: IOperatorConfig, helmRelease: k8s.helm.v3.Release): IMinIOOperator;
+/**
+ * Create a Traefik Ingress for MinIO S3 API external access.
+ *
+ * With the operator/tenant pattern, the service is always named "minio"
+ * in the data namespace on port 80 (HTTP) or 443 (HTTPS).
+ */
+export declare function createMinioIngress(minio: IMinIOOperator, ingressConfig: IMinIOIngressConfig, provider: k8s.Provider): k8s.networking.v1.Ingress;
+//# sourceMappingURL=minio.d.ts.map

package/dist/cjs/operator/minio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minio.d.ts","sourceRoot":"","sources":["../../../src/operator/minio.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAG1C,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EAGd,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAStB;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,GAC/B,cAAc,CAgThB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,mBAAmB,EAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ,GACrB,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CA2C3B"}

package/dist/cjs/operator/minio.js

@@ -0,0 +1,364 @@
+"use strict";
+/**
+ * MinIO backend — deploys MinIO via the MinIO Operator (operator.min.io)
+ * using the Tenant CRD pattern. The operator is installed via Helm by
+ * index.ts; this module creates Tenant CRDs and provisions buckets with
+ * per-bucket IAM users via Kubernetes Jobs using the MinIO Client (mc).
+ *
+ * @module operator/minio
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMinioOperator = createMinioOperator;
+exports.createMinioIngress = createMinioIngress;
+const crypto = __importStar(require("node:crypto"));
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const ensure_namespace_1 = require("../utils/ensure-namespace");
+const storage_tiers_1 = require("../types/storage-tiers");
+const alerts_1 = require("../observability/alerts");
+const DATA_NAMESPACE = "data";
+const DEFAULT_STORAGE_GB = 20;
+const MINIO_SERVICE_PORT = 80;
+const TENANT_NAME = "minio";
+/**
+ * Create a MinIO Tenant via the MinIO Operator and return an IMinIOOperator
+ * with a createBucket() method for provisioning object storage buckets.
+ *
+ * The operator Helm release is installed by index.ts. This function creates:
+ * 1. A root credentials Secret (config.env format)
+ * 2. A Tenant CRD in the data namespace
+ * 3. Returns an operator with createBucket() for per-bucket provisioning
+ *
+ * @example
+ * ```typescript
+ * const minio = createOperator("minio", { cluster });
+ * const bucket = minio.createBucket("uploads", {
+ *   sizeGb: 20,
+ *   namespaces: ["app", "workers"],
+ * });
+ * ```
+ */
+function createMinioOperator(config, helmRelease) {
+    const provider = config.cluster.provider;
+    const namespace = (0, ensure_namespace_1.ensureNamespace)(DATA_NAMESPACE, provider);
+    const storageGb = DEFAULT_STORAGE_GB;
+    const storageClass = (0, storage_tiers_1.resolveStorageTier)("standard", config.cluster.storageTiers);
+    // Generate root credentials
+    const rootUser = "minio-admin";
+    const rootPassword = pulumi.secret(crypto.randomBytes(24).toString("base64url"));
+    // Root credentials Secret in config.env format (required by MinIO Operator Tenant CRD)
+    const configSecretName = `${TENANT_NAME}-env-config`;
+    const configSecret = new k8s.core.v1.Secret(`${TENANT_NAME}-config`, {
+        metadata: {
+            name: configSecretName,
+            namespace: DATA_NAMESPACE,
+            labels: { "app.kubernetes.io/managed-by": "nimbus" },
+        },
+        stringData: {
+            "config.env": pulumi.interpolate `export MINIO_ROOT_USER="${rootUser}"\nexport MINIO_ROOT_PASSWORD="${rootPassword}"\nexport MINIO_PROMETHEUS_AUTH_TYPE="public"`,
+        },
+    }, { provider, dependsOn: [namespace, helmRelease], ignoreChanges: ["data", "stringData"] });
+    // Separate root credentials secret with individual keys (for Jobs to reference)
+    const rootSecretName = `${TENANT_NAME}-root-credentials`;
+    const rootSecret = new k8s.core.v1.Secret(`${TENANT_NAME}-root-creds`, {
+        metadata: {
+            name: rootSecretName,
+            namespace: DATA_NAMESPACE,
+            labels: { "app.kubernetes.io/managed-by": "nimbus" },
+        },
+        stringData: {
+            rootUser,
+            rootPassword,
+        },
+    }, { provider, dependsOn: [namespace, helmRelease], ignoreChanges: ["data", "stringData"] });
+    // Tenant CRD — creates a single-pool MinIO deployment
+    const tenant = new k8s.apiextensions.CustomResource(`${TENANT_NAME}-tenant`, {
+        apiVersion: "minio.min.io/v2",
+        kind: "Tenant",
+        metadata: {
+            name: TENANT_NAME,
+            namespace: DATA_NAMESPACE,
+            labels: { "app.kubernetes.io/managed-by": "nimbus" },
+        },
+        spec: {
+            image: "quay.io/minio/minio:latest",
+            imagePullPolicy: "IfNotPresent",
+            configuration: { name: configSecretName },
+            requestAutoCert: false,
+            pools: [
+                {
+                    name: "pool-0",
+                    servers: 1,
+                    volumesPerServer: 1,
+                    volumeClaimTemplate: {
+                        metadata: { name: "data" },
+                        spec: {
+                            accessModes: ["ReadWriteOnce"],
+                            ...(storageClass ? { storageClassName: storageClass } : {}),
+                            resources: { requests: { storage: `${storageGb}Gi` } },
+                        },
+                    },
+                    resources: {
+                        requests: { cpu: "100m", memory: "256Mi" },
+                    },
+                    containerSecurityContext: {
+                        runAsUser: 1000,
+                        runAsGroup: 1000,
+                        runAsNonRoot: true,
+                    },
+                },
+            ],
+            mountPath: "/export",
+            // Allow Prometheus to scrape metrics without auth
+            env: [{ name: "MINIO_PROMETHEUS_AUTH_TYPE", value: "public" }],
+        },
+    }, { provider, dependsOn: [helmRelease, configSecret] });
+    // MinIO alert rules
+    (0, alerts_1.createPrometheusRule)(`${TENANT_NAME}-minio-alerts`, "observability", [
+        {
+            name: "nimbus.minio",
+            rules: [
+                {
+                    alert: "MinioClusterUnhealthy",
+                    expr: `minio_cluster_health_status != 1`,
+                    for: "5m",
+                    labels: { severity: "critical" },
+                    annotations: { summary: "MinIO cluster is unhealthy" },
+                },
+            ],
+        },
+    ], provider, [tenant]);
+    // MinIO Operator creates a service named "minio" in the tenant namespace
+    // S3 API at minio.data.svc.cluster.local:80 (HTTP when requestAutoCert: false)
+    const endpoint = pulumi.output(`http://${TENANT_NAME}.${DATA_NAMESPACE}.svc.cluster.local:${MINIO_SERVICE_PORT}`);
+    return {
+        name: "minio",
+        type: "minio",
+        helmRelease,
+        endpoint,
+        createBucket(bucketName, bucketConfig) {
+            const targetNamespaces = bucketConfig?.namespaces ?? [];
+            // Generate per-bucket credentials
+            const bucketAccessKey = pulumi.secret(`nimbus-${bucketName}-${crypto.randomBytes(6).toString("hex")}`);
+            const bucketSecretKey = pulumi.secret(crypto.randomBytes(30).toString("base64url"));
+            // Store per-bucket credentials (the Job reads these to create the MinIO user)
+            const credentialSecretName = `minio-${bucketName}-credentials`;
+            const credentialSecret = new k8s.core.v1.Secret(`minio-${bucketName}-creds`, {
+                metadata: {
+                    name: credentialSecretName,
+                    namespace: DATA_NAMESPACE,
+                    labels: {
+                        "app.kubernetes.io/managed-by": "nimbus",
+                        "nimbus/bucket": bucketName,
+                    },
+                },
+                stringData: {
+                    accessKey: bucketAccessKey,
+                    secretKey: bucketSecretKey,
+                },
+            }, {
+                provider,
+                dependsOn: [tenant],
+                ignoreChanges: ["data", "stringData"],
+            });
+            // IAM policy JSON granting full access to this bucket only
+            const policyJson = JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: ["s3:*"],
+                        Resource: [`arn:aws:s3:::${bucketName}`, `arn:aws:s3:::${bucketName}/*`],
+                    },
+                ],
+            });
+            // Job: create bucket, IAM user, policy, and attach policy to user
+            const jobName = `minio-init-bucket-${bucketName}`;
+            const bucketJob = new k8s.batch.v1.Job(jobName, {
+                metadata: {
+                    name: jobName,
+                    namespace: DATA_NAMESPACE,
+                    labels: {
+                        "app.kubernetes.io/managed-by": "nimbus",
+                        "nimbus/bucket": bucketName,
+                    },
+                },
+                spec: {
+                    ttlSecondsAfterFinished: 300,
+                    backoffLimit: 5,
+                    template: {
+                        metadata: {
+                            labels: { "nimbus/bucket": bucketName },
+                        },
+                        spec: {
+                            restartPolicy: "Never",
+                            containers: [
+                                {
+                                    name: "mc",
+                                    image: "minio/mc:latest",
+                                    command: [
+                                        "sh",
+                                        "-c",
+                                        [
+                                            "mc alias set nimbus $MINIO_ENDPOINT $MINIO_ROOT_USER $MINIO_ROOT_PASSWORD",
+                                            `mc mb --ignore-existing nimbus/${bucketName}`,
+                                            bucketConfig?.public
+                                                ? `mc anonymous set download nimbus/${bucketName}`
+                                                : "",
+                                            `echo '${policyJson}' | mc admin policy create nimbus ${bucketName}-policy /dev/stdin`,
+                                            `mc admin user add nimbus "$BUCKET_ACCESS_KEY" "$BUCKET_SECRET_KEY"`,
+                                            `mc admin policy attach nimbus ${bucketName}-policy --user "$BUCKET_ACCESS_KEY"`,
+                                        ]
+                                            .filter(Boolean)
+                                            .join(" && "),
+                                    ],
+                                    env: [
+                                        { name: "MINIO_ENDPOINT", value: endpoint },
+                                        {
+                                            name: "MINIO_ROOT_USER",
+                                            valueFrom: {
+                                                secretKeyRef: { name: rootSecretName, key: "rootUser" },
+                                            },
+                                        },
+                                        {
+                                            name: "MINIO_ROOT_PASSWORD",
+                                            valueFrom: {
+                                                secretKeyRef: { name: rootSecretName, key: "rootPassword" },
+                                            },
+                                        },
+                                        {
+                                            name: "BUCKET_ACCESS_KEY",
+                                            valueFrom: {
+                                                secretKeyRef: { name: credentialSecretName, key: "accessKey" },
+                                            },
+                                        },
+                                        {
+                                            name: "BUCKET_SECRET_KEY",
+                                            valueFrom: {
+                                                secretKeyRef: { name: credentialSecretName, key: "secretKey" },
+                                            },
+                                        },
+                                    ],
+                                },
+                            ],
+                        },
+                    },
+                },
+            }, { provider, dependsOn: [tenant, rootSecret, credentialSecret] });
+            // Read credentials back from stored secret for stability
+            const storedCreds = k8s.core.v1.Secret.get(`minio-${bucketName}-creds-read`, pulumi.interpolate `${DATA_NAMESPACE}/${credentialSecretName}`, { provider, dependsOn: [credentialSecret] });
+            const stableAccessKey = storedCreds.data.apply((d) => Buffer.from(d?.["accessKey"] ?? "", "base64").toString());
+            const stableSecretKey = storedCreds.data.apply((d) => Buffer.from(d?.["secretKey"] ?? "", "base64").toString());
+            // Replicate per-bucket credentials to target namespaces
+            const secrets = {};
+            for (const targetNs of targetNamespaces) {
+                const targetNsResource = (0, ensure_namespace_1.ensureNamespace)(targetNs, provider);
+                const secretName = `minio-${bucketName}`;
+                new k8s.core.v1.Secret(`minio-bucket-secret-${bucketName}-${targetNs}`, {
+                    metadata: {
+                        name: secretName,
+                        namespace: targetNs,
+                        labels: {
+                            "app.kubernetes.io/managed-by": "nimbus",
+                            "nimbus/bucket": bucketName,
+                        },
+                    },
+                    stringData: {
+                        endpoint,
+                        bucket: bucketName,
+                        accessKeyId: stableAccessKey,
+                        secretAccessKey: stableSecretKey,
+                    },
+                }, { provider, dependsOn: [bucketJob, targetNsResource] });
+                secrets[targetNs] = pulumi.output(secretName);
+            }
+            return {
+                name: bucketName,
+                endpoint,
+                bucketName: pulumi.output(bucketName),
+                credentials: { accessKeyId: stableAccessKey, secretAccessKey: stableSecretKey },
+                secrets,
+                nativeResource: bucketJob,
+            };
+        },
+    };
+}
+/**
+ * Create a Traefik Ingress for MinIO S3 API external access.
+ *
+ * With the operator/tenant pattern, the service is always named "minio"
+ * in the data namespace on port 80 (HTTP) or 443 (HTTPS).
+ */
+function createMinioIngress(minio, ingressConfig, provider) {
+    const subdomain = ingressConfig.subdomain ?? "s3";
+    const host = `${subdomain}.${ingressConfig.domain}`;
+    const certName = ingressConfig.domain.replace(/\./g, "-");
+    const tlsSecretName = ingressConfig.tlsSecretName ?? `${certName}-wildcard-tls`;
+    return new k8s.networking.v1.Ingress("minio-s3-ingress", {
+        metadata: {
+            name: "minio-s3",
+            namespace: DATA_NAMESPACE,
+            labels: { "app.kubernetes.io/managed-by": "nimbus" },
+            annotations: {
+                "traefik.ingress.kubernetes.io/router.entrypoints": "websecure",
+            },
+        },
+        spec: {
+            ingressClassName: "traefik",
+            tls: [{ secretName: tlsSecretName, hosts: [host] }],
+            rules: [
+                {
+                    host,
+                    http: {
+                        paths: [
+                            {
+                                path: "/",
+                                pathType: "Prefix",
+                                backend: {
+                                    service: {
+                                        name: TENANT_NAME,
+                                        port: { number: MINIO_SERVICE_PORT },
+                                    },
+                                },
+                            },
+                        ],
+                    },
+                },
+            ],
+        },
+    }, { provider, dependsOn: [minio.helmRelease] });
+}
+//# sourceMappingURL=minio.js.map

package/dist/cjs/operator/minio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minio.js","sourceRoot":"","sources":["../../../src/operator/minio.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCH,kDAmTC;AAQD,gDA+CC;AA/YD,oDAAsC;AACtC,wDAA0C;AAC1C,uDAAyC;AACzC,gEAA4D;AAQ5D,0DAA4D;AAC5D,oDAA+D;AAE/D,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,mBAAmB,CACjC,MAAuB,EACvB,WAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzC,MAAM,SAAS,GAAG,IAAA,kCAAe,EAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC;IACrC,MAAM,YAAY,GAAG,IAAA,kCAAkB,EAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEjF,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,aAAa,CAAC;IAC/B,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjF,uFAAuF;IACvF,MAAM,gBAAgB,GAAG,GAAG,WAAW,aAAa,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CACzC,GAAG,WAAW,SAAS,EACvB;QACE,QAAQ,EAAE;YACR,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,EAAE,8BAA8B,EAAE,QAAQ,EAAE;SACrD;QACD,UAAU,EAAE;YACV,YAAY,EAAE,MAAM,CAAC,WAAW,CAAA,2BAA2B,QAAQ,kCAAkC,YAAY,+CAA+C;SACjK;KACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CACzF,CAAC;IAEF,gFAAgF;IAChF,MAAM,cAAc,GAAG,GAAG,WAAW,mBAAmB,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CACvC,GAAG,WAAW,aAAa,EAC3B;QACE,QAAQ,EAAE;YACR,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,EAAE,8BAA8B,EAAE,QAAQ,EAAE;SACrD;QACD,UAAU,EAAE;YACV,QAAQ;YACR,YAAY;SACb;KACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CACzF,CAAC;IAEF,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,cAAc,CACjD,GAAG,WAAW,SAAS,EACvB;QACE,UAAU,EAAE,iBAAiB;QAC7B,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE;YACR,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,EAAE,8BAA8B,EAAE,QAAQ,EAAE;SACrD;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,4BAA4B;YACnC,eAAe,EAAE,cAAc;YAC/B,aAAa,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;YACzC,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,CAAC;oBACV,gBAAgB,EAAE,CAAC;oBACnB,mBAAmB,EAAE;wBACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC1B,IAAI,EAAE;4BACJ,WAAW,EAAE,CAAC,eAAe,CAAC;4BAC9B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC3D,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,SAAS,IAAI,EAAE,EAAE;yBACvD;qBACF;oBACD,SAAS,EAAE;wBACT,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;qBAC3C;oBACD,wBAAwB,EAAE;wBACxB,SAAS,EAAE,IAAI;wBACf,UAAU,EAAE,IAAI;wBAChB,YAAY,EAAE,IAAI;qBACnB;iBACF;aACF;YACD,SAAS,EAAE,SAAS;YACpB,kDAAkD;YAClD,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC/D;KACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CACrD,CAAC;IAEF,oBAAoB;IACpB,IAAA,6BAAoB,EAClB,GAAG,WAAW,eAAe,EAC7B,eAAe,EACf;QACE;YACE,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE;gBACL;oBACE,KAAK,EAAE,uBAAuB;oBAC9B,IAAI,EAAE,kCAAkC;oBACxC,GAAG,EAAE,IAAI;oBACT,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE;oBAChC,WAAW,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE;iBACvD;aACF;SACF;KACF,EACD,QAAQ,EACR,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,yEAAyE;IACzE,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B,UAAU,WAAW,IAAI,cAAc,sBAAsB,kBAAkB,EAAE,CAClF,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,WAAW;QACX,QAAQ;QAER,YAAY,CAAC,UAAkB,EAAE,YAAiC;YAChE,MAAM,gBAAgB,GAAG,YAAY,EAAE,UAAU,IAAI,EAAE,CAAC;YAExD,kCAAkC;YAClC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CACnC,UAAU,UAAU,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAChE,CAAC;YACF,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YAEpF,8EAA8E;YAC9E,MAAM,oBAAoB,GAAG,SAAS,UAAU,cAAc,CAAC;YAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAC7C,SAAS,UAAU,QAAQ,EAC3B;gBACE,QAAQ,EAAE;oBACR,IAAI,EAAE,oBAAoB;oBAC1B,SAAS,EAAE,cAAc;oBACzB,MAAM,EAAE;wBACN,8BAA8B,EAAE,QAAQ;wBACxC,eAAe,EAAE,UAAU;qBAC5B;iBACF;gBACD,UAAU,EAAE;oBACV,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,eAAe;iBAC3B;aACF,EACD;gBACE,QAAQ;gBACR,SAAS,EAAE,CAAC,MAAM,CAAC;gBACnB,aAAa,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;aACtC,CACF,CAAC;YAEF,2DAA2D;YAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChC,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,OAAO;wBACf,MAAM,EAAE,CAAC,MAAM,CAAC;wBAChB,QAAQ,EAAE,CAAC,gBAAgB,UAAU,EAAE,EAAE,gBAAgB,UAAU,IAAI,CAAC;qBACzE;iBACF;aACF,CAAC,CAAC;YAEH,kEAAkE;YAClE,MAAM,OAAO,GAAG,qBAAqB,UAAU,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CACpC,OAAO,EACP;gBACE,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,cAAc;oBACzB,MAAM,EAAE;wBACN,8BAA8B,EAAE,QAAQ;wBACxC,eAAe,EAAE,UAAU;qBAC5B;iBACF;gBACD,IAAI,EAAE;oBACJ,uBAAuB,EAAE,GAAG;oBAC5B,YAAY,EAAE,CAAC;oBACf,QAAQ,EAAE;wBACR,QAAQ,EAAE;4BACR,MAAM,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;yBACxC;wBACD,IAAI,EAAE;4BACJ,aAAa,EAAE,OAAO;4BACtB,UAAU,EAAE;gCACV;oCACE,IAAI,EAAE,IAAI;oCACV,KAAK,EAAE,iBAAiB;oCACxB,OAAO,EAAE;wCACP,IAAI;wCACJ,IAAI;wCACJ;4CACE,2EAA2E;4CAC3E,kCAAkC,UAAU,EAAE;4CAC9C,YAAY,EAAE,MAAM;gDAClB,CAAC,CAAC,oCAAoC,UAAU,EAAE;gDAClD,CAAC,CAAC,EAAE;4CACN,SAAS,UAAU,qCAAqC,UAAU,oBAAoB;4CACtF,oEAAoE;4CACpE,iCAAiC,UAAU,qCAAqC;yCACjF;6CACE,MAAM,CAAC,OAAO,CAAC;6CACf,IAAI,CAAC,MAAM,CAAC;qCAChB;oCACD,GAAG,EAAE;wCACH,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE;wCAC3C;4CACE,IAAI,EAAE,iBAAiB;4CACvB,SAAS,EAAE;gDACT,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE;6CACxD;yCACF;wCACD;4CACE,IAAI,EAAE,qBAAqB;4CAC3B,SAAS,EAAE;gDACT,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE;6CAC5D;yCACF;wCACD;4CACE,IAAI,EAAE,mBAAmB;4CACzB,SAAS,EAAE;gDACT,YAAY,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,WAAW,EAAE;6CAC/D;yCACF;wCACD;4CACE,IAAI,EAAE,mBAAmB;4CACzB,SAAS,EAAE;gDACT,YAAY,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,WAAW,EAAE;6CAC/D;yCACF;qCACF;iCACF;6BACF;yBACF;qBACF;iBACF;aACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE,CAChE,CAAC;YAEF,yDAAyD;YACzD,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CACxC,SAAS,UAAU,aAAa,EAChC,MAAM,CAAC,WAAW,CAAA,GAAG,cAAc,IAAI,oBAAoB,EAAE,EAC7D,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAC5C,CAAC;YACF,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACnD,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACzD,CAAC;YACF,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACnD,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACzD,CAAC;YAEF,wDAAwD;YACxD,MAAM,OAAO,GAA0C,EAAE,CAAC;YAE1D,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACxC,MAAM,gBAAgB,GAAG,IAAA,kCAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC7D,MAAM,UAAU,GAAG,SAAS,UAAU,EAAE,CAAC;gBAEzC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CACpB,uBAAuB,UAAU,IAAI,QAAQ,EAAE,EAC/C;oBACE,QAAQ,EAAE;wBACR,IAAI,EAAE,UAAU;wBAChB,SAAS,EAAE,QAAQ;wBACnB,MAAM,EAAE;4BACN,8BAA8B,EAAE,QAAQ;4BACxC,eAAe,EAAE,UAAU;yBAC5B;qBACF;oBACD,UAAU,EAAE;wBACV,QAAQ;wBACR,MAAM,EAAE,UAAU;wBAClB,WAAW,EAAE,eAAe;wBAC5B,eAAe,EAAE,eAAe;qBACjC;iBACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,CACvD,CAAC;gBAEF,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAChD,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,QAAQ;gBACR,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;gBACrC,WAAW,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE;gBAC/E,OAAO;gBACP,cAAc,EAAE,SAAS;aAC1B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAChC,KAAqB,EACrB,aAAkC,EAClC,QAAsB;IAEtB,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,IAAI,GAAG,QAAQ,eAAe,CAAC;IAEhF,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAClC,kBAAkB,EAClB;QACE,QAAQ,EAAE;YACR,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,EAAE,8BAA8B,EAAE,QAAQ,EAAE;YACpD,WAAW,EAAE;gBACX,kDAAkD,EAAE,WAAW;aAChE;SACF;QACD,IAAI,EAAE;YACJ,gBAAgB,EAAE,SAAS;YAC3B,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,KAAK,EAAE;gBACL;oBACE,IAAI;oBACJ,IAAI,EAAE;wBACJ,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,GAAG;gCACT,QAAQ,EAAE,QAAQ;gCAClB,OAAO,EAAE;oCACP,OAAO,EAAE;wCACP,IAAI,EAAE,WAAW;wCACjB,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qCACrC;iCACF;6BACF;yBACF;qBACF;iBACF;aACF;SACF;KACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAC7C,CAAC;AACJ,CAAC"}

package/dist/cjs/operator/neo4j.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Neo4j backend — deploys Neo4j via the official Helm chart
+ * (helm.neo4j.com/neo4j) with full operator-level lifecycle management:
+ *
+ * - Scheduled S3 backups via CronJob (neo4j-admin database dump + aws s3 cp)
+ * - Prometheus metrics via ServiceMonitor
+ * - User provisioning via cypher-shell Jobs
+ * - Connection secret replication to target namespaces
+ *
+ * Neo4j Community supports a single user database. Enterprise
+ * supports multiple databases. User provisioning works on both.
+ *
+ * @module operator/neo4j
+ */
+import * as k8s from "@pulumi/kubernetes";
+import * as pulumi from "@pulumi/pulumi";
+import { type StorageTier, type StorageTierMap } from "../types/storage-tiers";
+import type { IBackupDefaults, IClusterInstance } from "./interfaces";
+/** Neo4j-specific cluster config. */
+export interface INeo4jClusterConfig {
+    /** Neo4j password for the built-in neo4j user. Auto-generated if omitted. */
+    readonly password?: pulumi.Input<string>;
+    /** Storage size in GB. Default: 10. */
+    readonly storageGb?: number;
+    /** Storage performance tier. Default: "performance". */
+    readonly storageTier?: StorageTier;
+    /** CPU and memory resource requests. */
+    readonly resources?: {
+        readonly cpu?: string;
+        readonly memory?: string;
+    };
+    /** Enable APOC plugin. Default: true. */
+    readonly apoc?: boolean;
+    /** Enable Prometheus metrics endpoint. Default: true. */
+    readonly metrics?: boolean;
+    /** Additional neo4j.conf settings. */
+    readonly config?: Record<string, string>;
+    /** Additional Helm values to merge. */
+    readonly values?: Record<string, unknown>;
+}
+/**
+ * Create a Neo4j graph database cluster via the official Helm chart.
+ *
+ * Provides full operator-level lifecycle: deployment, backup, monitoring,
+ * user provisioning, and connection secret replication.
+ */
+export declare function createNeo4jCluster(name: string, config: INeo4jClusterConfig | undefined, backupDefaults: IBackupDefaults | undefined, provider: k8s.Provider, operatorRelease: k8s.helm.v3.Release, storageTiers?: StorageTierMap): IClusterInstance;
+//# sourceMappingURL=neo4j.d.ts.map

package/dist/cjs/operator/neo4j.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"neo4j.d.ts","sourceRoot":"","sources":["../../../src/operator/neo4j.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,EAAsB,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACnG,OAAO,KAAK,EACV,eAAe,EAGf,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAStB,qCAAqC;AACrC,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,uCAAuC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,wCAAwC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,yCAAyC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,uCAAuC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AA0ED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,cAAc,EAAE,eAAe,GAAG,SAAS,EAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EACpC,YAAY,CAAC,EAAE,cAAc,GAC5B,gBAAgB,CA2WlB"}