Examples: Composites

A composite is one function call that returns several Config Connector resources wired together.

GkeCluster

GKE cluster with node pool and workload identity:

import { GkeCluster } from "@intentius/chant-lexicon-gcp";

const { cluster, nodePool } = GkeCluster({
  name: "my-cluster",
  projectId: "my-project",
  location: "us-central1",
  machineType: "e2-standard-4",
  minNodeCount: 1,
  maxNodeCount: 10,
  workloadIdentity: true,
});

export { cluster, nodePool };

CloudRunService

Cloud Run service with optional public access:

import { CloudRunService } from "@intentius/chant-lexicon-gcp";

const { service, publicIam } = CloudRunService({
  name: "my-api",
  image: "gcr.io/my-project/api:1.0",
  port: 8080,
  publicAccess: true,
  minInstanceCount: 1,
  maxInstanceCount: 10,
});

export { service, publicIam };

CloudSqlInstance

PostgreSQL with database and user:

import { CloudSqlInstance } from "@intentius/chant-lexicon-gcp";

const { instance, database, user } = CloudSqlInstance({
  name: "app-db",
  tier: "db-custom-2-8192",
  backupEnabled: true,
  highAvailability: true,
});

export { instance, database, user };

GcsBucket

Storage bucket with encryption and lifecycle:

import { GcsBucket } from "@intentius/chant-lexicon-gcp";

const { bucket } = GcsBucket({
  name: "data-lake",
  location: "US",
  versioning: true,
  kmsKeyName: "projects/p/locations/us/keyRings/kr/cryptoKeys/key",
  lifecycleDeleteAfterDays: 365,
  lifecycleNearlineAfterDays: 30,
});

export { bucket };

VpcNetwork

VPC with subnets, firewalls, and Cloud NAT:

import { VpcNetwork } from "@intentius/chant-lexicon-gcp";

const { network, subnets, firewalls, router, routerNat } = VpcNetwork({
  name: "production",
  subnets: [
    { name: "app", ipCidrRange: "10.0.0.0/24", region: "us-central1" },
    { name: "data", ipCidrRange: "10.0.1.0/24", region: "us-central1" },
  ],
  enableNat: true,
  natRegion: "us-central1",
  allowIapSsh: true,
});

export { network, subnets, firewalls, router, routerNat };

PubSubPipeline

Topic + Subscription + optional dead-letter queue:

import { PubSubPipeline } from "@intentius/chant-lexicon-gcp";

const { topic, subscription, deadLetterTopic, subscriberIam } = PubSubPipeline({
  name: "order-events",
  enableDeadLetterQueue: true,
  maxDeliveryAttempts: 5,
  subscriberServiceAccount: "worker@my-project.iam.gserviceaccount.com",
});

export { topic, subscription, deadLetterTopic, subscriberIam };

CloudFunctionWithTrigger

Cloud Function + source bucket + optional public invoker IAM:

import { CloudFunctionWithTrigger } from "@intentius/chant-lexicon-gcp";

const { function: fn, sourceBucket, invokerIam } = CloudFunctionWithTrigger({
  name: "process-upload",
  runtime: "nodejs20",
  entryPoint: "handler",
  triggerType: "pubsub",
  triggerTopic: "file-uploads",
  region: "us-central1",
});

export { fn, sourceBucket, invokerIam };

PrivateService

Private service networking (VPC peering):

import { PrivateService } from "@intentius/chant-lexicon-gcp";

const { globalAddress, serviceConnection, dnsZone } = PrivateService({
  name: "db-peering",
  networkName: "production",
  enableDns: true,
});

export { globalAddress, serviceConnection, dnsZone };

ManagedCertificate

Google-managed SSL certificate + optional HTTPS proxy:

import { ManagedCertificate } from "@intentius/chant-lexicon-gcp";

const { certificate, targetHttpsProxy, urlMap } = ManagedCertificate({
  name: "web-cert",
  domains: ["example.com", "www.example.com"],
  createProxy: true,
  backendServiceName: "web-backend",
});

export { certificate, targetHttpsProxy, urlMap };

SecureProject

Project with audit logging, API enablement, and IAM:

import { SecureProject } from "@intentius/chant-lexicon-gcp";

const { project, auditConfig, services, ownerIam, loggingSink } = SecureProject({
  name: "my-project",
  orgId: "123456789",
  billingAccountRef: "ABCDEF-123456-ABCDEF",
  owner: "user:admin@example.com",
  loggingSinkDestination: "bigquery.googleapis.com/projects/audit/datasets/logs",
});

export { project, auditConfig, services, ownerIam, loggingSink };

PublicCloudRun

Cloud Run behind a global external Application Load Balancer, with Direct VPC egress into a PrivateEgressNetwork’s subnet. The composite creates a service account <name>-run unless serviceAccount names an existing one. Setting domains adds a Google-managed certificate, an HTTPS proxy and a rule on 443, and the HTTP rule then redirects to HTTPS. securityPolicy attaches a Cloud Armor policy to the backend service.

import { PrivateEgressNetwork, PublicCloudRun } from "@intentius/chant-lexicon-gcp";

export const network = PrivateEgressNetwork({
  name: "web",
  region: "us-central1",
  subnetCidr: "10.10.0.0/24",
});

export const web = PublicCloudRun({
  name: "web",
  projectId: "my-project",
  region: "us-central1",
  vpc: network.vpc,
  subnet: network.subnet,
  image: "us-docker.pkg.dev/my-project/web/site:1",
  minInstanceCount: 1,
  maxInstanceCount: 3,
  domains: ["example.com"],
});

Deploying composites

# Build YAML manifests
chant build src/ --output manifests.yaml

# Lint for common issues
chant lint src/

# Dry run
kubectl apply -f manifests.yaml --dry-run=server

# Apply
kubectl apply -f manifests.yaml