typekro 0.33.10 → 0.35.0

package/dist/factories/clickhouse/utils/s3-storage.d.ts

@@ -0,0 +1,503 @@
+/**
+ * S3-backed ClickHouse storage compilation.
+ *
+ * Compiles the typed `storage` discriminated union into the three things the
+ * Altinity operator needs to make a ClickHouse cluster keep its data in object
+ * storage with only a local cache on the node:
+ *
+ * 1. a `storage_configuration` XML document dropped into the CHI's
+ *    `configuration.files` under `config.d/storage.xml` (disks + policies),
+ * 2. the `merge_tree/storage_policy` default in `configuration.settings`, so
+ *    tables created by OTHER tooling (HyperDX/OTel goose migrations, SigNoz)
+ *    land on object storage with NO per-table DDL, and
+ * 3. the pod-template patch that gives the server its credentials — an
+ *    IRSA-annotated ServiceAccount plus `use_environment_credentials`, or
+ *    Secret-backed env vars referenced from the XML with `from_env`.
+ *
+ * ## Two disk types, two DIFFERENT durability stories
+ *
+ * The distinction is the whole point of the discriminated `diskType` — a
+ * boolean `s3: true` would hide it:
+ *
+ * - `s3` (classic): part METADATA lives on the local disk; only the part data
+ *   goes to the bucket. The bucket is NOT self-describing — losing the node
+ *   loses the map to the objects. Durability comes from backups, which is why
+ *   `backup` exists.
+ * - `s3_plain_rewritable`: metadata lives in the bucket, so the bucket IS
+ *   self-describing and node loss is a restart + re-attach. The cost is hard
+ *   engine restrictions (see below).
+ *
+ * ## `s3_plain_rewritable` restrictions (verified against the ClickHouse docs)
+ *
+ * `s3_plain_rewritable` arrived in 24.4, and from **24.5** any object-storage
+ * disk can be configured with the `plain_rewritable` metadata type — the
+ * explicit `type: object_storage` + `object_storage_type: s3` +
+ * `metadata_type: plain_rewritable` form this module emits. It executes merges
+ * and supports `INSERT`, but the ClickHouse documentation is explicit that
+ * **mutations and table replication are NOT supported**. So:
+ * - single replica only (the factory rejects `replicas > 1`),
+ * - no `ALTER ... UPDATE/DELETE`, no lightweight deletes,
+ * - `ALTER TABLE ... MODIFY TTL` must be issued with
+ *   `materialize_ttl_after_modify = 0` (the materialization step is a
+ *   mutation); TTL-driven part expiry itself runs in merges and works.
+ *
+ * @see https://clickhouse.com/docs/operations/storing-data
+ */
+import type { ClickHouseInstallationStorage, ClickHouseS3StorageOptions, ClickHouseStorageTopology } from '../types.js';
+/**
+ * Deeply loosen optional properties so a `Composable<T>` value — where TypeKro's
+ * proxy mapping turns `x?: T` into `x: T | undefined` — assigns under
+ * `exactOptionalPropertyTypes`.
+ */
+type Loosen<T> = T extends (...args: never[]) => unknown ? T : T extends readonly unknown[] ? T : T extends object ? {
+    readonly [K in keyof T]?: Loosen<T[K]> | undefined;
+} : T;
+/**
+ * Storage input accepted by {@link resolveClickHouseStorage}: either the full
+ * installation storage (local volume sizing + mode) or the build-time topology
+ * alone (`makeClickHouseCluster` resolves it before the runtime `size` exists).
+ *
+ * Every field is loosened to optional because this function's whole job is to
+ * validate the shape at runtime — the type is a convenience, not the contract.
+ */
+export type ClickHouseStorageInput = Loosen<ClickHouseInstallationStorage> | Loosen<ClickHouseStorageTopology>;
+/** Default MergeTree storage policy name created for S3-backed clusters. */
+export declare const DEFAULT_S3_POLICY_NAME = "s3_main";
+/** Disk name of the raw object-storage disk inside `storage_configuration`. */
+export declare const S3_DISK_NAME = "s3";
+/** Disk name of the local read-through cache wrapping {@link S3_DISK_NAME}. */
+export declare const S3_CACHE_DISK_NAME = "s3_cache";
+/** Volume name inside the generated storage policy. */
+export declare const S3_POLICY_VOLUME_NAME = "main";
+/**
+ * Default filesystem path of the local cache. It sits UNDER the operator's
+ * data volume mount (`/var/lib/clickhouse`), so the thin local PVC declared by
+ * `storage.size` backs the cache without an extra volume.
+ */
+export declare const DEFAULT_S3_CACHE_PATH = "/var/lib/clickhouse/disks/s3_cache/";
+/** CHI `configuration.files` key for the rendered storage configuration. */
+export declare const CHI_STORAGE_CONFIG_FILE = "config.d/storage.xml";
+/** CHI `configuration.settings` key that makes the S3 policy the default. */
+export declare const MERGE_TREE_STORAGE_POLICY_SETTING = "merge_tree/storage_policy";
+/** Env var name the rendered XML reads the access key id from. */
+export declare const S3_ACCESS_KEY_ID_ENV = "CLICKHOUSE_S3_ACCESS_KEY_ID";
+/** Env var name the rendered XML reads the secret access key from. */
+export declare const S3_SECRET_ACCESS_KEY_ENV = "CLICKHOUSE_S3_SECRET_ACCESS_KEY";
+/** Default Secret key holding the access key id. */
+export declare const DEFAULT_ACCESS_KEY_ID_SECRET_KEY = "AWS_ACCESS_KEY_ID";
+/** Default Secret key holding the secret access key. */
+export declare const DEFAULT_SECRET_ACCESS_KEY_SECRET_KEY = "AWS_SECRET_ACCESS_KEY";
+/** IRSA annotation the EKS pod identity webhook keys off. */
+export declare const IRSA_ROLE_ARN_ANNOTATION = "eks.amazonaws.com/role-arn";
+/** Default object-key prefix for scheduled backups. */
+export declare const DEFAULT_BACKUP_PREFIX = "backups";
+/** Default database backed up by the generated backup CronJob. */
+export declare const DEFAULT_BACKUP_DATABASE = "default";
+/** `<s3>` credential section name used by `BACKUP ... TO S3(...)`. */
+export declare const S3_BACKUP_CONFIG_SECTION = "backup";
+/**
+ * Shape of an S3 bucket name, per AWS's general-purpose bucket naming rules.
+ *
+ * 3-63 characters of lowercase letters, digits, dots and hyphens, starting and
+ * ending alphanumeric. Two further AWS rules are not expressible in one
+ * readable pattern and are checked separately in {@link assertS3BucketName}:
+ * no `..`, and not IP-address-shaped.
+ *
+ * The length bound lives in the pattern (`{1,61}` between the two anchored
+ * alphanumerics) so the pattern alone is the whole character rule.
+ *
+ * @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html
+ */
+export declare const S3_BUCKET_NAME_PATTERN: RegExp;
+/**
+ * Region shape accepted for `storage.region`.
+ *
+ * Two lowercase letters (the geography — `us`, `eu`, `ap`, `cn`), one or more
+ * lowercase words, then a single digit: `us-east-2`, `eu-central-1`,
+ * `ap-southeast-3`, and the three-part partitions `us-gov-west-1` /
+ * `cn-north-1`. Deliberately a SHAPE rather than an enumeration of today's
+ * regions — a new region must not need a TypeKro release — but tight enough
+ * that the value cannot carry a quote, a dot or a slash into the composed URL,
+ * where it sits inside the host name.
+ */
+export declare const AWS_REGION_PATTERN: RegExp;
+/**
+ * Minimum ClickHouse version this factory accepts for
+ * `diskType: 's3_plain_rewritable'`.
+ *
+ * 24.4 introduced the `s3_plain_rewritable` disk; 24.5 generalized it to the
+ * `metadata_type: plain_rewritable` form emitted here, so 24.5 is the floor.
+ */
+export declare const MIN_S3_PLAIN_REWRITABLE_VERSION = "24.5";
+/**
+ * The {@link MIN_S3_PLAIN_REWRITABLE_VERSION} floor, expressed as a PATTERN so
+ * it can travel into a generated KRO schema.
+ *
+ * WHY A PATTERN AND NOT ONLY A BUILD-TIME COMPARISON. `storage.diskType` is a
+ * build-time choice, but `version` is per-INSTANCE runtime spec: in kro mode it
+ * arrives at construction as a schema reference, so no build-time comparison
+ * can see the value an instance will actually carry. Encoding the floor as a
+ * pattern lets `makeClickHouseCluster` put it on `spec.version` in the
+ * generated RGD (`string | pattern="…"`), so the API server / KRO REJECT an
+ * instance that selects an unsupported server — the case the build-time check
+ * structurally cannot reach.
+ *
+ * Reads as "major.minor >= 24.5": `24.5`-`24.9` and `24.10`+, any `25`-`99`
+ * major, and any three-or-more-digit major. A trailing `.patch.build`, or a
+ * `-`/`_` suffix, is accepted after the minor because ClickHouse tags look
+ * like `25.7`, `25.12.5`, and `24.8.14.39`.
+ *
+ * RE2-compatible on purpose (no lookaround, no backreferences): the same
+ * source becomes the `pattern=` marker of the generated KRO schema, and
+ * Kubernetes validates OpenAPI patterns with RE2.
+ */
+export declare const S3_PLAIN_REWRITABLE_VERSION_PATTERN: RegExp;
+/**
+ * ArkType schema for a `version` that may back
+ * `diskType: 's3_plain_rewritable'`.
+ *
+ * `makeClickHouseCluster` uses this as the spec-schema type of `version`
+ * whenever the build-time topology selects `s3_plain_rewritable`, so the floor
+ * travels into the generated RGD and KRO rejects a bad INSTANCE. Compositions
+ * that wire `clickHouseInstallation()` by hand should do the same — see
+ * {@link assertS3PlainRewritableVersion} for why a build-time check alone is
+ * not enough there.
+ */
+export declare const ClickHouseS3PlainRewritableVersionSchema: import("arktype/internal/variants/string.ts").StringType<string, {}>;
+/**
+ * What `storage` has to be, quoted into the ArkType error on a bad value.
+ *
+ * It is attached to the `mode` DISCRIMINANT of
+ * {@link ResolvedClickHouseS3StorageSchema} (via ArkType's `.describe()`), so a
+ * value that never came out of the S3 branch of the resolver — a PVC
+ * resolution, an unrelated object — is reported against `storage.mode` with
+ * this sentence, while every other field keeps its own precise, path-named
+ * error.
+ */
+export declare const RESOLVED_S3_STORAGE_REQUIREMENT = "a resolved S3 storage (mode: 's3'), as returned by resolveClickHouseStorage()";
+/**
+ * Credentials as resolved for rendering (never carries key material).
+ *
+ * A real ArkType union rather than a `kind` field plus optional siblings: the
+ * two transports have DISJOINT payloads, and the union is what makes
+ * `{ kind: 'irsa', secretName: … }` a validation error instead of a value the
+ * renderer silently reads the wrong half of.
+ */
+export declare const ResolvedClickHouseS3AuthSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    kind: "irsa";
+    roleArn: string;
+    serviceAccountName?: string;
+} | {
+    kind: "secretRef";
+    secretName: string;
+    accessKeyIdKey: string;
+    secretAccessKeyKey: string;
+}, {}>;
+/** Credentials as resolved for rendering (see {@link ResolvedClickHouseS3AuthSchema}). */
+export type ResolvedClickHouseS3Auth = typeof ResolvedClickHouseS3AuthSchema.infer;
+/** Backup schedule with every default applied. */
+export declare const ResolvedClickHouseS3BackupSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    schedule: string;
+    bucket: string;
+    prefix: string;
+    database: string;
+    endpointUrl: string;
+    retentionDays?: number;
+    auth?: {
+        secretName: string;
+        usernameKey: string;
+        passwordKey: string;
+    };
+}, {}>;
+/** Backup schedule with every default applied (see {@link ResolvedClickHouseS3BackupSchema}). */
+export type ResolvedClickHouseS3Backup = typeof ResolvedClickHouseS3BackupSchema.infer;
+/** Fully defaulted, validated S3 storage configuration. */
+export declare const ResolvedClickHouseS3StorageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    mode: "s3";
+    bucket: string;
+    prefix: string;
+    diskType: "s3" | "s3_plain_rewritable";
+    policyName: string;
+    cacheMaxSizeBytes: number;
+    cachePath: string;
+    auth: {
+        kind: "irsa";
+        roleArn: string;
+        serviceAccountName?: string;
+    } | {
+        kind: "secretRef";
+        secretName: string;
+        accessKeyIdKey: string;
+        secretAccessKeyKey: string;
+    };
+    endpointUrl: string;
+    region?: string;
+    endpoint?: string;
+    backup?: {
+        schedule: string;
+        bucket: string;
+        prefix: string;
+        database: string;
+        endpointUrl: string;
+        retentionDays?: number;
+        auth?: {
+            secretName: string;
+            usernameKey: string;
+            passwordKey: string;
+        };
+    };
+}, {}>;
+/** Fully defaulted, validated S3 storage (see {@link ResolvedClickHouseS3StorageSchema}). */
+export type ResolvedClickHouseS3Storage = typeof ResolvedClickHouseS3StorageSchema.infer;
+/** Fully defaulted, validated PVC storage configuration (today's behaviour). */
+export declare const ResolvedClickHousePvcStorageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    mode: "pvc";
+}, {}>;
+/** Fully defaulted PVC storage (see {@link ResolvedClickHousePvcStorageSchema}). */
+export type ResolvedClickHousePvcStorage = typeof ResolvedClickHousePvcStorageSchema.infer;
+/** Discriminated resolution of the `storage` input. */
+export declare const ResolvedClickHouseStorageSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    mode: "s3";
+    bucket: string;
+    prefix: string;
+    diskType: "s3" | "s3_plain_rewritable";
+    policyName: string;
+    cacheMaxSizeBytes: number;
+    cachePath: string;
+    auth: {
+        kind: "irsa";
+        roleArn: string;
+        serviceAccountName?: string;
+    } | {
+        kind: "secretRef";
+        secretName: string;
+        accessKeyIdKey: string;
+        secretAccessKeyKey: string;
+    };
+    endpointUrl: string;
+    region?: string;
+    endpoint?: string;
+    backup?: {
+        schedule: string;
+        bucket: string;
+        prefix: string;
+        database: string;
+        endpointUrl: string;
+        retentionDays?: number;
+        auth?: {
+            secretName: string;
+            usernameKey: string;
+            passwordKey: string;
+        };
+    };
+} | {
+    mode: "pvc";
+}, {}>;
+/** Discriminated resolution of the `storage` input. */
+export type ResolvedClickHouseStorage = typeof ResolvedClickHouseStorageSchema.infer;
+/**
+ * Parse a Kubernetes-style quantity into bytes.
+ *
+ * ClickHouse's cache `max_size` wants a byte count, while every other size in
+ * this factory family is a Kubernetes quantity — so the input stays a quantity
+ * and the conversion happens here (loudly) instead of the caller guessing.
+ *
+ * @param context - Entry point name for the error message
+ * @param field - Offending field path (e.g. `storage.cache.size`)
+ * @param value - Quantity string such as `'100Gi'`, `'50G'`, or `'1048576'`
+ * @returns The value in bytes
+ * @throws Error when the quantity cannot be parsed or is not positive
+ */
+export declare function parseByteQuantity(context: string, field: string, value: string): number;
+/**
+ * Extract `{ major, minor }` from a ClickHouse version tag.
+ *
+ * Returns `undefined` for tags this function cannot read (`'latest'`, a digest
+ * pin, a schema reference) so callers can skip version gating rather than
+ * reject a legitimate but unparseable pin.
+ */
+export declare function parseClickHouseVersion(version: unknown): {
+    major: number;
+    minor: number;
+} | undefined;
+/**
+ * Assert the server version can run `s3_plain_rewritable` MergeTree writes.
+ *
+ * TWO ENFORCEMENT SITES, ONE FLOOR. A CONCRETE version is checked here and
+ * rejected loudly — including a version this function cannot READ (`'latest'`,
+ * a digest pin), because "unreadable" is not evidence that the server supports
+ * the `plain_rewritable` metadata type, and silently accepting it was the gap
+ * this replaces. A version that is NOT a concrete string is a per-instance
+ * schema reference: its value does not exist at construction, so no check here
+ * can see it, and the floor must instead travel into the generated schema as
+ * {@link ClickHouseS3PlainRewritableVersionSchema} — which
+ * `makeClickHouseCluster` does automatically, so KRO rejects an instance that
+ * selects an older server. A composition that wires `clickHouseInstallation()`
+ * by hand with a schema-reference `version` MUST use that schema for its own
+ * `version` field; nothing else can enforce the floor for it.
+ *
+ * @param context - Entry point name for the error message
+ * @param version - The configured ClickHouse server version tag, or a schema
+ *   reference (skipped — see above)
+ * @throws Error when a concrete version is below
+ *   {@link MIN_S3_PLAIN_REWRITABLE_VERSION} or cannot be parsed as
+ *   `major.minor`
+ */
+export declare function assertS3PlainRewritableVersion(context: string, version: unknown): void;
+/**
+ * Assert a value is a legal S3 bucket name.
+ *
+ * ONE validator for both bucket-shaped options — `storage.bucket` and the
+ * `storage.backup.bucket` override — because both are appended into the same
+ * composed URL and therefore into the same `BACKUP … TO S3('<url>')` string
+ * literal. A second, hand-inlined copy for the override is exactly how the
+ * override came to be unchecked in the first place.
+ *
+ * @param context - Entry point name for the error message
+ * @param field - Offending option path (e.g. `storage.backup.bucket`)
+ * @param value - The bucket name received
+ * @throws Error naming the option and the value when the name breaks AWS's
+ *   naming rules
+ */
+export declare function assertS3BucketName(context: string, field: string, value: unknown): void;
+/**
+ * Assert a value is an AWS region identifier.
+ *
+ * The region is interpolated into the HOST of the composed endpoint
+ * (`<bucket>.s3.<region>.amazonaws.com`), so an unconstrained value reaches the
+ * XML and the backup SQL literal exactly like the bucket does.
+ *
+ * @param context - Entry point name for the error message
+ * @param field - Offending option path (e.g. `storage.region`)
+ * @param value - The region received
+ * @throws Error naming the option and the value when the region is not
+ *   {@link AWS_REGION_PATTERN}-shaped
+ */
+export declare function assertAwsRegion(context: string, field: string, value: unknown): void;
+/**
+ * True when the storage input selects the object-storage mode.
+ *
+ * The predicate claims exactly what the check ESTABLISHES and no more: `mode`
+ * is `'s3'`, so the S3-only options are the ones that MAY be present — hence
+ * `Loosen<…>`, which leaves every one of them optional. Claiming the full
+ * `ClickHouseS3StorageOptions` here would assert `bucket: string`,
+ * `cache: { size: string }` and a valid `auth` on the strength of one
+ * discriminant, and the compiler would then stop asking
+ * {@link resolveClickHouseStorage} to check them — which is precisely the job
+ * that function exists to do.
+ */
+export declare function isS3Storage(storage: ClickHouseStorageInput): storage is ClickHouseStorageInput & Loosen<ClickHouseS3StorageOptions>;
+/**
+ * Parse and VALIDATE a custom S3-compatible endpoint, returning it normalized
+ * with no trailing slash so the caller can append `/<bucket>/<prefix>/`.
+ *
+ * STRUCTURE, not just characters. The character allow-list on the composed URL
+ * ({@link ENDPOINT_URL_CHARACTERS}) stops injection into the storage XML and
+ * the `BACKUP … TO S3('<url>')` SQL literal, but it happily accepts strings
+ * that are not usable endpoints — a userinfo section that would write
+ * credentials into `config.d/storage.xml`, a query string or fragment that the
+ * appended bucket path turns into nonsense, or an out-of-range port. Each of
+ * those is a different mistake and gets its own message.
+ *
+ * @param context - Entry point name for the error message
+ * @param endpoint - The caller's `storage.endpoint` value
+ * @returns The endpoint as `<scheme>://<host>[:<port>][<path>]`, no trailing
+ *   slash
+ * @throws Error naming the specific part of the URL that is unusable
+ */
+export declare function parseS3EndpointUrl(context: string, endpoint: string): string;
+/**
+ * Compose the disk/backup endpoint URL, then validate what was composed.
+ *
+ * ORDER IS THE POINT. Every component reaching this function is already
+ * checked on its own — bucket ({@link assertS3BucketName}), region
+ * ({@link assertAwsRegion}), prefix ({@link normalizePrefix}), and the
+ * `endpoint` right below — and each of those checks exists so the error can
+ * name the OPTION the caller set. But per-component checks are a set of doors
+ * that has to be complete, and the string that actually matters is the one the
+ * runtime sees: the `<endpoint>` text of `config.d/storage.xml` and the
+ * `BACKUP … TO S3('<url>')` literal the CronJob builds, where a `'` is extra
+ * SQL rather than a bad URL. So the composed result is re-checked against the
+ * same RFC 3986 allow-list as a BACKSTOP — a component check that is ever
+ * loosened, or a component that is ever added, cannot open that door quietly.
+ *
+ * @param context - Entry point name for the error message
+ * @param field - Option path prefix for the error (`storage` or
+ *   `storage.backup`), so a bad backup override does not report `storage.*`
+ * @param bucket - Validated bucket name
+ * @param prefix - Normalized, validated key prefix ('' for the bucket root)
+ * @param region - Validated region; required when `endpoint` is absent
+ * @param endpoint - Custom S3-compatible base URL, if any
+ * @returns The composed URL, always with a trailing slash
+ * @throws Error when the endpoint is not an absolute http(s) URL, when the
+ *   region is missing for AWS, or when the COMPOSED URL carries a character
+ *   the allow-list forbids
+ */
+export declare function composeS3EndpointUrl(context: string, field: string, bucket: string, prefix: string, region: string | undefined, endpoint: string | undefined): string;
+/**
+ * Resolve and validate the `storage` input into a discriminated result.
+ *
+ * The S3 branch is BUILD-TIME data: it compiles into an XML document and
+ * selects which resources exist (ServiceAccount, backup CronJob), so a schema
+ * reference anywhere inside it can never serialize — this function rejects one
+ * loudly rather than emitting `__KUBERNETES_REF__` markers into server config.
+ *
+ * @param context - Entry point name used in every error message
+ * @param storage - The `storage` field as supplied by the caller
+ * @param version - The configured ClickHouse version (gates
+ *   `s3_plain_rewritable`); pass `undefined` to skip the gate
+ * @returns The resolved storage configuration
+ * @throws Error when PVC and S3 options are mixed, when a required S3 field is
+ *   missing, or when a value is not build-time concrete
+ */
+export declare function resolveClickHouseStorage(context: string, storage: ClickHouseStorageInput, version?: unknown): ResolvedClickHouseStorage;
+/**
+ * Render the `storage_configuration` (and, with a backup schedule, the `<s3>`
+ * credential section) XML for the CHI's `configuration.files`.
+ *
+ * The document is fully STATIC: credentials arrive through
+ * `use_environment_credentials` or `from_env`, so no secret material is ever
+ * rendered here.
+ *
+ * @param resolved - Resolved S3 storage configuration
+ * @returns The XML document text, newline-terminated
+ */
+export declare function renderStorageConfigurationXml(resolved: ResolvedClickHouseS3Storage): string;
+/** CHI `configuration.files` entry for the resolved S3 storage. */
+export declare function clickHouseS3ConfigurationFiles(resolved: ResolvedClickHouseS3Storage): Record<string, string>;
+/**
+ * CHI `configuration.settings` entry that makes the S3 policy the DEFAULT.
+ *
+ * This is what lets tooling outside TypeKro — the ClickStack/HyperDX gateway
+ * collector's goose migrations, SigNoz's migrator — create its tables with no
+ * `SETTINGS storage_policy` clause and still land on object storage.
+ */
+export declare function clickHouseS3ConfigurationSettings(resolved: ResolvedClickHouseS3Storage): Record<string, string>;
+/** A pod-template env var entry (the CRD's pod spec is an open structure). */
+interface PodEnvVar {
+    name: string;
+    valueFrom: {
+        secretKeyRef: {
+            name: string;
+            key: string;
+            optional: false;
+        };
+    };
+}
+/**
+ * Env vars the ClickHouse container needs for Secret-backed credentials.
+ *
+ * Empty for IRSA. `optional: false` so a missing Secret fails the pod loudly
+ * instead of starting a server whose S3 disk silently 403s.
+ */
+export declare function clickHouseS3ContainerEnv(resolved: ResolvedClickHouseS3Storage): PodEnvVar[];
+/**
+ * ServiceAccount name the CHI pod template must run as, when IRSA is used.
+ *
+ * @param resolved - Resolved S3 storage configuration
+ * @param installationName - CHI name, used for the derived default
+ * @returns The ServiceAccount name, or `undefined` for non-IRSA credentials
+ */
+export declare function clickHouseS3ServiceAccountName(resolved: ResolvedClickHouseS3Storage, installationName: string): string | undefined;
+export {};
+//# sourceMappingURL=s3-storage.d.ts.map

package/dist/factories/clickhouse/utils/s3-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-storage.d.ts","sourceRoot":"","sources":["../../../../src/factories/clickhouse/utils/s3-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH,OAAO,KAAK,EACV,6BAA6B,EAE7B,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAC;AAIrB;;;;GAIG;AACH,KAAK,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,GACpD,CAAC,GACD,CAAC,SAAS,SAAS,OAAO,EAAE,GAC1B,CAAC,GACD,CAAC,SAAS,MAAM,GACd;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS;CAAE,GACtD,CAAC,CAAC;AAEV;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAC9B,MAAM,CAAC,6BAA6B,CAAC,GACrC,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAMtC,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAEhD,+EAA+E;AAC/E,eAAO,MAAM,YAAY,OAAO,CAAC;AAEjC,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAE7C,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,wCAAwC,CAAC;AAE3E,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAE9D,6EAA6E;AAC7E,eAAO,MAAM,iCAAiC,8BAA8B,CAAC;AAE7E,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAElE,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,oCAAoC,CAAC;AAE1E,oDAAoD;AACpD,eAAO,MAAM,gCAAgC,sBAAsB,CAAC;AAEpE,wDAAwD;AACxD,eAAO,MAAM,oCAAoC,0BAA0B,CAAC;AAE5E,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAE/C,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,YAAY,CAAC;AAEjD,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAmBjD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,QAAuC,CAAC;AA+B3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,QAA4B,CAAC;AAY5D;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,SAAS,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mCAAmC,QACuE,CAAC;AAExH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wCAAwC,sEAEpD,CAAC;AAkCF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,kFACqC,CAAC;AAElF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;MAgBzC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,wBAAwB,GAAG,OAAO,8BAA8B,CAAC,KAAK,CAAC;AAEnF,kDAAkD;AAClD,eAAO,MAAM,gCAAgC;;;;;;;;;;;;MAsB3C,CAAC;AAEH,iGAAiG;AACjG,MAAM,MAAM,0BAA0B,GAAG,OAAO,gCAAgC,CAAC,KAAK,CAAC;AAEvF,2DAA2D;AAC3D,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAyB5C,CAAC;AAEH,6FAA6F;AAC7F,MAAM,MAAM,2BAA2B,GAAG,OAAO,iCAAiC,CAAC,KAAK,CAAC;AAEzF,gFAAgF;AAChF,eAAO,MAAM,kCAAkC;;MAG7C,CAAC;AAEH,oFAAoF;AACpF,MAAM,MAAM,4BAA4B,GAAG,OAAO,kCAAkC,CAAC,KAAK,CAAC;AAE3F,uDAAuD;AACvD,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAE3C,CAAC;AAEF,uDAAuD;AACvD,MAAM,MAAM,yBAAyB,GAAG,OAAO,+BAA+B,CAAC,KAAK,CAAC;AA6BrF;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBvF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,GACf;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO9C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CA+BtF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CA+BvF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAUpF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,IAAI,sBAAsB,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAExE;AAeD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAuE5E;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAoDR;AA0ID;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,OAAO,GAChB,yBAAyB,CAoI3B;AAmED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM,CAwD3F;AAMD,mEAAmE;AACnE,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,2BAA2B,GACpC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,2BAA2B,GACpC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED,8EAA8E;AAC9E,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE;QAAE,YAAY,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,KAAK,CAAA;SAAE,CAAA;KAAE,CAAC;CAC7E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,SAAS,EAAE,CAwB3F;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,2BAA2B,EACrC,gBAAgB,EAAE,MAAM,GACvB,MAAM,GAAG,SAAS,CAGpB"}