alchemy-kubernetes-addons 0.1.0-alpha.0

package/dist/index.d.mts

@@ -0,0 +1,527 @@
+import { Input, Resource, Stack, Stage } from "alchemy";
+import * as Output from "alchemy/Output";
+import * as Provider from "alchemy/Provider";
+import * as Kubernetes from "alchemy/Kubernetes";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Telemetry from "alchemy/Telemetry";
+import { S3BucketAccess } from "alchemy-s3-access";
+//#region src/client.d.ts
+interface KubernetesObjectRef {
+  apiVersion: string;
+  kind: string;
+  name: string;
+  namespace?: string;
+}
+interface KubernetesObjectReadiness {
+  ready: boolean;
+  terminal: boolean;
+  detail: string;
+}
+declare const kubernetesObjectReadiness: (object: unknown) => KubernetesObjectReadiness;
+declare class KubernetesReadinessError extends Error {
+  readonly object: KubernetesObjectRef;
+  readonly timedOut: boolean;
+  readonly name = "KubernetesReadinessError";
+  constructor(message: string, object: KubernetesObjectRef, timedOut: boolean);
+}
+//#endregion
+//#region src/cloudflare-external-dns.d.ts
+declare const EXTERNAL_DNS_CHART_VERSION = "1.21.1";
+declare const EXTERNAL_DNS_IMAGE = "registry.k8s.io/external-dns/external-dns:v0.21.0@sha256:f53faaf71cb270d1ca9dce6ea0c94bfebf1a18696263487f0fbc74b9bf2bd7ff";
+interface CloudflareExternalDnsProps {
+  cluster: Input<Kubernetes.ClusterLike>;
+  zone: Cloudflare.Zone.Zone;
+  policy: "sync" | "upsert-only";
+  proxied?: boolean;
+  token?: Input<Redacted.Redacted<string>>;
+  /** Optional non-secret revision for externally managed tokens. */
+  tokenRevision?: Input<string>;
+  namespace?: string;
+  releaseName?: string;
+  timeoutSeconds?: number;
+}
+interface CloudflareExternalDnsResult {
+  zone: Cloudflare.Zone.Zone;
+  zoneId: Input<string>;
+  domain: Input<string>;
+  namespace: string;
+  releaseName: string;
+  txtOwnerId: string;
+  tokenManaged: boolean;
+}
+interface CloudflareExternalDnsPlanProps {
+  zoneId: Input<string>;
+  domain: Input<string>;
+  policy: "sync" | "upsert-only";
+  proxied: boolean;
+  releaseName: string;
+  txtOwnerId: string;
+  secretName: string;
+  namespaceRevision: Input<string>;
+  secretRevision: Input<string>;
+  tokenRevision?: Input<string> | undefined;
+}
+interface CloudflareExternalDnsPlan {
+  values: Record<string, unknown>;
+}
+declare const planCloudflareExternalDns: ({ zoneId, domain, policy, proxied, releaseName, txtOwnerId, secretName, namespaceRevision, secretRevision, tokenRevision }: CloudflareExternalDnsPlanProps) => CloudflareExternalDnsPlan;
+/** Install a zone-scoped Cloudflare ExternalDNS controller. */
+declare const CloudflareExternalDns: (id: string, props: CloudflareExternalDnsProps) => Effect.Effect<{
+  zone: Cloudflare.Zone.Zone;
+  zoneId: Output.Output<string, never>;
+  domain: Output.Output<string, never>;
+  namespace: string;
+  releaseName: string;
+  txtOwnerId: string;
+  tokenManaged: boolean;
+}, import("effect/Cause").UnknownError, Providers | Stack | Stage | Kubernetes.Providers | Cloudflare.Providers>;
+//#endregion
+//#region src/cert-manager.d.ts
+declare const CERT_MANAGER_CHART = "oci://quay.io/jetstack/charts/cert-manager";
+declare const CERT_MANAGER_CHART_VERSION = "v1.21.1";
+declare const CERT_MANAGER_IMAGE_VERSION = "v1.21.1";
+interface CertManagerProps {
+  cluster: Input<Kubernetes.ClusterLike>;
+  namespace?: string;
+  releaseName?: string;
+  timeoutSeconds?: number;
+}
+interface CertManagerResult {
+  namespace: Input<string>;
+  clusterResourceNamespace: Input<string>;
+  releaseName: string;
+  chart: Kubernetes.HelmChart;
+  readiness: Readiness;
+}
+declare const validateCertManagerProps: (props: CertManagerProps) => void;
+declare const certManagerHelmValues: (namespace: string, namespaceRevision: Input<string>) => Record<string, unknown>;
+/** Install cert-manager and wait for its CRDs and control plane. */
+declare const CertManager: (id: string, props: CertManagerProps) => Effect.Effect<{
+  namespace: Output.Output<string, never>;
+  clusterResourceNamespace: Output.Output<string, never>;
+  releaseName: string;
+  chart: Kubernetes.HelmChart;
+  readiness: Readiness;
+}, import("effect/Cause").UnknownError, Providers | Kubernetes.Providers>;
+//#endregion
+//#region src/cloudflare-acme-issuer.d.ts
+declare const LETSENCRYPT_STAGING_URL = "https://acme-staging-v02.api.letsencrypt.org/directory";
+declare const LETSENCRYPT_PRODUCTION_URL = "https://acme-v02.api.letsencrypt.org/directory";
+interface CloudflareAcmeIssuerProps {
+  cluster: Input<Kubernetes.ClusterLike>;
+  certManager: CertManagerResult;
+  zone: Cloudflare.Zone.Zone;
+  email: string;
+  environment: "staging" | "production";
+  token?: Input<Redacted.Redacted<string>>;
+  name?: string;
+  timeoutSeconds?: number;
+}
+interface CloudflareAcmeIssuerResult {
+  name: Input<string>;
+  issuerRef: {
+    name: Input<string>;
+    kind: "ClusterIssuer";
+    group: "cert-manager.io";
+  };
+  environment: "staging" | "production";
+  tokenManaged: boolean;
+  tokenSecretName: string;
+  accountKeySecretName: string;
+  readiness: Readiness;
+}
+interface CloudflareAcmeIssuerManifestProps {
+  name: string;
+  email: string;
+  environment: "staging" | "production";
+  domain: Input<string>;
+  tokenSecretName: string;
+  accountKeySecretName: string;
+  certManagerRevision: Input<string>;
+  tokenSecretRevision: Input<string>;
+}
+declare const cloudflareAcmeIssuerName: (id: string, environment: "staging" | "production") => string;
+declare const cloudflareAcmeIssuerTokenPolicies: (zoneId: string) => Cloudflare.ApiToken.Policy[];
+declare const validateCloudflareAcmeIssuerProps: (props: CloudflareAcmeIssuerProps) => void;
+declare const cloudflareAcmeIssuerManifest: ({ name, email, environment, domain, tokenSecretName, accountKeySecretName, certManagerRevision, tokenSecretRevision }: CloudflareAcmeIssuerManifestProps) => {
+  apiVersion: string;
+  kind: string;
+  metadata: {
+    name: string;
+    annotations: {
+      "alchemy.run/cert-manager-revision": Input<string>;
+      "alchemy.run/token-secret-revision": Input<string>;
+    };
+  };
+  spec: {
+    acme: {
+      email: string;
+      server: string;
+      privateKeySecretRef: {
+        name: string;
+      };
+      solvers: {
+        selector: {
+          dnsZones: Input<string>[];
+        };
+        dns01: {
+          cloudflare: {
+            apiTokenSecretRef: {
+              name: string;
+              key: string;
+            };
+          };
+        };
+      }[];
+    };
+  };
+};
+/** Create a zone-scoped Cloudflare DNS-01 ClusterIssuer. */
+declare const CloudflareAcmeIssuer: (id: string, props: CloudflareAcmeIssuerProps) => Effect.Effect<{
+  name: Output.Output<string, never>;
+  issuerRef: {
+    name: Output.Output<string, never>;
+    kind: "ClusterIssuer";
+    group: "cert-manager.io";
+  };
+  environment: "staging" | "production";
+  tokenManaged: boolean;
+  tokenSecretName: string;
+  accountKeySecretName: string;
+  readiness: Readiness;
+}, import("effect/Cause").UnknownError, Providers | Kubernetes.Providers | Cloudflare.Providers>;
+//#endregion
+//#region src/otel-collector.d.ts
+declare const OTEL_COLLECTOR_CHART_VERSION = "0.171.0";
+declare const OTEL_COLLECTOR_IMAGE = "otel/opentelemetry-collector-contrib@sha256:c5918f78992ee73b0d6f0e599423ac5ec52dd5d9726733114d6eca53d5a32ed5";
+type OtelSignal = "traces" | "logs" | "metrics";
+interface OtelCollectorBasicAuthSecretRef {
+  namespace: string;
+  name: string;
+  usernameKey: string;
+  passwordKey: string;
+  /** Changes to this non-secret value force pods to reload Secret-backed env. */
+  resourceVersion: Input<string | undefined>;
+}
+interface OtelCollectorDestination {
+  endpoints: Telemetry.OtlpOptions;
+  encoding?: "json" | "proto";
+  authentication?: {
+    type: "basic";
+    secretRef: OtelCollectorBasicAuthSecretRef;
+  };
+}
+interface OtelCollectorProps {
+  cluster: Input<Kubernetes.ClusterLike>;
+  destination: OtelCollectorDestination;
+  namespace?: string;
+  releaseName?: string;
+  /** Own a new namespace. Defaults off when authentication references a Secret. */
+  createNamespace?: boolean;
+  timeoutSeconds?: number;
+}
+interface OtelCollectorResult {
+  namespace: string;
+  releaseName: string;
+  serviceName: string;
+  signals: OtelSignal[];
+  otelEndpoint: string;
+  otelTracesEndpoint: string;
+  otelLogsEndpoint: string;
+  otelMetricsEndpoint: string;
+  otlp: Telemetry.OtlpOptions;
+}
+interface OtelCollectorPlanProps {
+  releaseName: string;
+  destination: OtelCollectorDestination;
+  namespaceRevision: Input<string>;
+  headerSecretName: string;
+  headerSecretRevision?: Input<string> | undefined;
+  basicSecretRevision?: Input<string | undefined> | undefined;
+}
+interface OtelCollectorPlan {
+  signals: OtelSignal[];
+  headerSecretData: Record<string, string | Redacted.Redacted<string> | Input<string | Redacted.Redacted<string>>>;
+  values: Record<string, unknown>;
+}
+declare const planOtelCollector: ({ releaseName, destination, namespaceRevision, headerSecretName, headerSecretRevision, basicSecretRevision }: OtelCollectorPlanProps) => OtelCollectorPlan;
+/** Deploy a minimal OTLP/HTTP gateway for one downstream destination. */
+declare const OtelCollector: (id: string, props: OtelCollectorProps) => Effect.Effect<{
+  otelEndpoint: string;
+  otelTracesEndpoint: string;
+  otelLogsEndpoint: string;
+  otelMetricsEndpoint: string;
+  otlp: Telemetry.OtlpOptions;
+  namespace: string;
+  releaseName: string;
+  serviceName: string;
+  signals: OtelSignal[];
+}, import("effect/Cause").UnknownError, Providers | Kubernetes.Providers>;
+//#endregion
+//#region src/parseable.d.ts
+declare const PARSEABLE_CHART_VERSION = "3.2.1";
+declare const PARSEABLE_IMAGE = "quay.io/parseablehq/parseable:v3.1.0";
+interface ParseableStagingProps {
+  /** Persistent staging space for acknowledged data waiting to reach S3. */
+  size?: string;
+  storageClass?: string;
+}
+interface ParseableIngressProps {
+  host: string;
+  /** Existing ingress class. The add-on does not install an ingress controller. */
+  className?: string;
+  /** Existing TLS Secret, normally issued by cert-manager. */
+  tlsSecretName?: string;
+}
+interface ParseableProps {
+  cluster: Input<Kubernetes.ClusterLike>;
+  storage: S3BucketAccess;
+  namespace?: string;
+  releaseName?: string;
+  admin?: {
+    username?: string;
+    password?: Redacted.Redacted<string>;
+  };
+  staging?: ParseableStagingProps;
+  streams?: {
+    logs?: string;
+    traces?: string;
+    metrics?: string;
+  };
+  ingress?: ParseableIngressProps;
+  timeoutSeconds?: number;
+}
+/** Axiom-shaped endpoint names for standard OTEL environment variables. */
+interface ParseableOtlpEndpoints {
+  otelEndpoint: string;
+  otelTracesEndpoint: string;
+  otelLogsEndpoint: string;
+  otelMetricsEndpoint: string;
+}
+interface ParseableResult extends ParseableOtlpEndpoints {
+  namespace: string;
+  releaseName: string;
+  serviceName: string;
+  streams: {
+    logs: string;
+    traces: string;
+    metrics: string;
+  };
+  internalUrl: string;
+  uiUrl: string;
+  admin: {
+    username: string;
+    password: Input<Redacted.Redacted<string>>;
+  };
+  credentialsSecretRef: {
+    namespace: string;
+    name: string;
+    usernameKey: "username";
+    passwordKey: "password";
+    resourceVersion: Input<string | undefined>;
+  };
+  /** Endpoint-only OTLP shape. Authentication is mounted from the Secret by the collector. */
+  endpoints: Pick<Telemetry.OtlpOptions, "url" | "traces" | "logs" | "metrics">;
+  ingress?: {
+    host: string;
+    url: string;
+    tls: boolean;
+  };
+}
+interface ParseableHelmValuesProps {
+  releaseName: string;
+  secretName: Input<string>;
+  secretResourceVersion: Input<string>;
+  forcePathStyle?: boolean | undefined;
+  staging: ParseableStagingProps;
+}
+declare const parseableHelmValues: ({ releaseName, secretName, secretResourceVersion, forcePathStyle, staging }: ParseableHelmValuesProps) => Record<string, unknown>;
+/** Deploy Parseable OSS with S3 durability and its bundled web UI. */
+declare const Parseable: (id: string, props: ParseableProps) => Effect.Effect<{
+  ingress?: {
+    host: string;
+    url: string;
+    tls: boolean;
+  };
+  namespace: string;
+  releaseName: string;
+  serviceName: string;
+  streams: {
+    logs: string;
+    traces: string;
+    metrics: string;
+  };
+  internalUrl: string;
+  uiUrl: string;
+  otelEndpoint: string;
+  otelTracesEndpoint: string;
+  otelLogsEndpoint: string;
+  otelMetricsEndpoint: string;
+  admin: {
+    username: string;
+    password: Redacted.Redacted<string> | Output.ObjectExpr<Redacted.Redacted<string>, never>;
+  };
+  credentialsSecretRef: {
+    namespace: string;
+    name: string;
+    usernameKey: "username";
+    passwordKey: "password";
+    resourceVersion: Output.Output<string | undefined, never>;
+  };
+  endpoints: Pick<Telemetry.OtlpOptions, "logs" | "url" | "traces" | "metrics">;
+}, import("effect/Cause").UnknownError, Providers | Kubernetes.Providers | import("alchemy").Provider<import("alchemy").Random>>;
+//#endregion
+//#region src/container-registry.d.ts
+declare const CONTAINER_REGISTRY_CHART = "oci://ghcr.io/project-zot/helm-charts/zot";
+declare const CONTAINER_REGISTRY_CHART_VERSION = "0.1.122";
+declare const CONTAINER_REGISTRY_IMAGE = "ghcr.io/project-zot/zot-minimal:v2.1.20@sha256:73f26433b341f4a319963f7c5e169858663a10565e4037e71605737daee202ee";
+interface ContainerRegistryIngressProps {
+  host: string;
+  /** Existing IngressClass. The add-on does not install an ingress controller. */
+  className?: string;
+  /** TLS Secret in the registry namespace. The add-on does not issue it. */
+  tlsSecretName: string;
+  annotations?: Record<string, string>;
+}
+interface ContainerRegistryGarbageCollectionProps {
+  /** Zot/Go duration. @default "24h" */
+  interval?: string;
+  /** Minimum age before unreferenced content is collected. @default "24h" */
+  delay?: string;
+  /** Daily UTC start window in HH:MM-HH:MM form. @default "02:00-04:00" */
+  timeWindowUtc?: string;
+}
+interface ContainerRegistryPullSecretsProps {
+  /** Pre-existing application namespaces that receive Docker pull credentials. */
+  namespaces: string[];
+  /** @default `${releaseName}-pull` */
+  name?: string;
+}
+interface ContainerRegistryProps {
+  cluster: Input<Kubernetes.ClusterLike>;
+  storage: S3BucketAccess;
+  ingress: ContainerRegistryIngressProps;
+  namespace?: string;
+  releaseName?: string;
+  /** Own the registry namespace. Disable when another resource owns it. @default true */
+  createNamespace?: boolean;
+  /** Relative prefix reserved for registry objects in the supplied bucket. @default "registry" */
+  storagePrefix?: string;
+  credentials?: {
+    username?: string;
+    password?: Redacted.Redacted<string>;
+  };
+  pullSecrets?: ContainerRegistryPullSecretsProps;
+  garbageCollection?: ContainerRegistryGarbageCollectionProps;
+  timeoutSeconds?: number;
+}
+interface ContainerRegistryPullSecretRef {
+  namespace: string;
+  name: string;
+  resourceVersion: Input<string | undefined>;
+}
+interface ContainerRegistryResult {
+  namespace: string;
+  releaseName: string;
+  serviceName: string;
+  host: string;
+  url: string;
+  imagePrefix: string;
+  internalUrl: string;
+  credentials: {
+    username: string;
+    password: Input<Redacted.Redacted<string>>;
+  };
+  pullSecretRefs: ContainerRegistryPullSecretRef[];
+  ingress: {
+    host: string;
+    url: string;
+    tls: true;
+  };
+}
+interface ContainerRegistryHelmValuesProps {
+  releaseName: string;
+  storage: Pick<S3BucketAccess, "endpoint" | "region" | "bucket" | "forcePathStyle" | "sessionToken">;
+  storagePrefix: string;
+  storageSecretName: string;
+  storageSecretRevision: Input<string>;
+  authSecretName: string;
+  authSecretRevision: Input<string>;
+  namespaceRevision: Input<string>;
+  ingress: ContainerRegistryIngressProps;
+  username: string;
+  garbageCollection: Required<ContainerRegistryGarbageCollectionProps>;
+}
+declare const validateContainerRegistryProps: (props: ContainerRegistryProps) => void;
+declare const containerRegistryHtpasswd: (username: string, password: Redacted.Redacted<string>, saltSeed: Redacted.Redacted<string>) => Redacted.Redacted<string>;
+declare const containerRegistryDockerConfig: (host: string, username: string, password: Redacted.Redacted<string>) => Redacted.Redacted<string>;
+declare const containerRegistryHelmValues: ({ releaseName, storage, storagePrefix, storageSecretName, storageSecretRevision, authSecretName, authSecretRevision, namespaceRevision, ingress, username, garbageCollection }: ContainerRegistryHelmValuesProps) => Record<string, unknown>;
+/** Deploy a private, HTTPS-only, S3-backed OCI/Docker registry. */
+declare const ContainerRegistry: (id: string, props: ContainerRegistryProps) => Effect.Effect<{
+  namespace: string;
+  releaseName: string;
+  serviceName: string;
+  host: string;
+  url: string;
+  imagePrefix: string;
+  internalUrl: string;
+  credentials: {
+    username: string;
+    password: Redacted.Redacted<string> | Output.ObjectExpr<Redacted.Redacted<string>, never>;
+  };
+  pullSecretRefs: ContainerRegistryPullSecretRef[];
+  ingress: {
+    host: string;
+    url: string;
+    tls: true;
+  };
+}, import("effect/Cause").UnknownError, Providers | Kubernetes.Providers | import("alchemy").Provider<import("alchemy").Random>>;
+//#endregion
+//#region src/index.d.ts
+declare const Providers_base: Provider.ProviderCollection<Providers, "KubernetesAddons">;
+declare class Providers extends Providers_base {}
+interface SecretProps {
+  cluster: Kubernetes.ClusterLike;
+  name: string;
+  namespace?: string;
+  type?: string;
+  immutable?: boolean;
+  stringData: Record<string, string | Redacted.Redacted<string>>;
+}
+type Secret = Resource<"KubernetesAddons.Secret", SecretProps, {
+  connection: Kubernetes.Connection;
+  name: string;
+  namespace: string;
+  type: string;
+  uid: string | undefined;
+  resourceVersion: string | undefined;
+}, Record<never, never>, Providers>;
+declare const SecretResource: import("alchemy").ResourceClass<Secret>;
+/** Write-only Kubernetes Secret with Redacted request-boundary handling. */
+declare const Secret: typeof SecretResource;
+declare const SecretProvider: () => Layer.Layer<Provider.Provider<Secret>, never, never>;
+interface ReadinessProps {
+  cluster: Kubernetes.ClusterLike;
+  objects: KubernetesObjectRef[];
+  revision: string;
+  timeoutSeconds?: number;
+}
+type Readiness = Resource<"KubernetesAddons.Readiness", ReadinessProps, {
+  connection: Kubernetes.Connection;
+  objects: KubernetesObjectRef[];
+  revision: string;
+}, Record<never, never>, Providers>;
+declare const Readiness: import("alchemy").ResourceClass<Readiness>;
+declare const ReadinessProvider: () => Layer.Layer<Provider.Provider<Readiness>, never, never>;
+interface ReadyHelmChartProps extends Omit<Kubernetes.HelmChartProps, "cluster" | "wait" | "timeoutSeconds"> {
+  cluster: Input<Kubernetes.ClusterLike>;
+  timeoutSeconds?: number;
+}
+/** Apply an Alchemy Helm chart, then wait for its CRDs and workloads. */
+declare const ReadyHelmChart: (id: string, props: ReadyHelmChartProps) => Effect.Effect<Kubernetes.HelmChart, never, Providers | Kubernetes.Providers>;
+declare const providers: () => Layer.Layer<Providers | Provider.Provider<import("alchemy").Random>, never, never>;
+//#endregion
+export { CERT_MANAGER_CHART, CERT_MANAGER_CHART_VERSION, CERT_MANAGER_IMAGE_VERSION, CONTAINER_REGISTRY_CHART, CONTAINER_REGISTRY_CHART_VERSION, CONTAINER_REGISTRY_IMAGE, CertManager, type CertManagerProps, type CertManagerResult, CloudflareAcmeIssuer, type CloudflareAcmeIssuerProps, type CloudflareAcmeIssuerResult, CloudflareExternalDns, type CloudflareExternalDnsPlan, type CloudflareExternalDnsProps, type CloudflareExternalDnsResult, ContainerRegistry, type ContainerRegistryGarbageCollectionProps, type ContainerRegistryIngressProps, type ContainerRegistryProps, type ContainerRegistryPullSecretRef, type ContainerRegistryPullSecretsProps, type ContainerRegistryResult, EXTERNAL_DNS_CHART_VERSION, EXTERNAL_DNS_IMAGE, type KubernetesObjectReadiness, type KubernetesObjectRef, KubernetesReadinessError, LETSENCRYPT_PRODUCTION_URL, LETSENCRYPT_STAGING_URL, OTEL_COLLECTOR_CHART_VERSION, OTEL_COLLECTOR_IMAGE, OtelCollector, type OtelCollectorBasicAuthSecretRef, type OtelCollectorDestination, type OtelCollectorPlan, type OtelCollectorProps, type OtelCollectorResult, type OtelSignal, PARSEABLE_CHART_VERSION, PARSEABLE_IMAGE, Parseable, type ParseableIngressProps, type ParseableOtlpEndpoints, type ParseableProps, type ParseableResult, type ParseableStagingProps, Providers, Readiness, ReadinessProps, ReadinessProvider, ReadyHelmChart, ReadyHelmChartProps, Secret, SecretProps, SecretProvider, certManagerHelmValues, cloudflareAcmeIssuerManifest, cloudflareAcmeIssuerName, cloudflareAcmeIssuerTokenPolicies, containerRegistryDockerConfig, containerRegistryHelmValues, containerRegistryHtpasswd, kubernetesObjectReadiness, parseableHelmValues, planCloudflareExternalDns, planOtelCollector, providers, validateCertManagerProps, validateCloudflareAcmeIssuerProps, validateContainerRegistryProps };