Composites

Five composites, each encoding rules that are easy to break by leaving something out.

GvcEnvironment

A GVC with its locations and pull secrets.

export const { gvc } = GvcEnvironment({
  name: "prod",
  org: "acme",
  locations: ["aws-us-east-1", "gcp-us-central1"],
  pullSecrets: ["registry-creds"],
});

Pull secrets are set on the GVC, not on each workload, which is where people usually look for them. Location ids are validated against the <provider>-<region> form before they become links.

ServerlessService

A serverless workload with the port, firewall and autoscaling a public HTTP service needs. Serverless must expose exactly one HTTP port, and the external firewall starts closed in both directions, so a workload that looks entirely correct serves nothing until a CIDR is added.

CronJob

A scheduled workload. It has no fields for probes, autoscaling or timeoutSeconds, because cron accepts all three and ignores them.

StatefulService

A stateful workload and its volume set, mounted. Validates the performance class capacity floor at build time (high-throughput-ssd has a 200 GB minimum where the others have 10 GB), because === fileSystemType and performanceClass are both immutable and correcting either later means data loss.

SecretAccess

The identity and policy a workload needs to read a secret, with the GVC-qualified principal link. Pairs with secretRef(name, field) for the reference itself.

export const { identity, policy } = SecretAccess({
  name: "web-identity",
  gvc: "prod",
  secrets: ["db-password"],
});