@codiac.io/codiac-cli 1.3.229 → 1.3.230

package/dist/commands/import/cluster.js

@@ -0,0 +1,620 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const core_1 = require("@oclif/core");
+const k8s = require("@kubernetes/client-node");
+const contracts_1 = require("../../apis/codiac-api/contracts");
+const EXCLUDED_NAMESPACES = new Set([
+    "kube-system",
+    "kube-public",
+    "kube-node-lease",
+    // Azure-managed
+    "gatekeeper-system",
+    "calico-system",
+    "cert-manager",
+    "ingress-nginx",
+    "keda",
+    "azure-arc",
+    "tigera-operator",
+    // AWS-managed
+    "amazon-cloudwatch",
+    "aws-observability",
+]);
+class ImportCluster extends core_1.Command {
+    constructor() {
+        super(...arguments);
+        /** Accumulates unique secret store names discovered during the scan. */
+        this.discoveredStores = new Set();
+        /** Accumulates enterprise-scoped `codiac pvc create` lines keyed by their prefixed FileStoreDef name (`<namespace>-<pvc>`).
+         *  Map preserves insertion order; the prefix guarantees cross-namespace uniqueness so no dedupe logic is needed beyond key collision. */
+        this.discoveredPvcs = new Map();
+        /** Count of `# TODO:` comment lines emitted across all generated commands; surfaced as a summary banner at top of output. */
+        this.todoCount = 0;
+        /** Codiac registry codes that must already exist in the tenant for the generated `cod asset create` lines to succeed.
+         *  Keyed by code, value is the cloud provider hint used to render the `cod imageRegistry capture` suggestion in the banner.
+         *  `DockerHub|official` is intentionally excluded to keep the banner focused on registries the user must capture themselves. */
+        this.discoveredRegistries = new Map();
+    }
+    run() {
+        var _a, _b, _c, _d;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const { flags } = yield this.parse(ImportCluster);
+            if (!flags["run-in-cluster"]) {
+                this.log("The --run-in-cluster flag is required. Interactive mode is not yet supported.");
+                this.log("Usage: codiac import cluster --run-in-cluster [--enterprise <name>] [--environment <name>] [--cluster <name>] [--generate-cabinet] [--generate-secret-store] [--generate-pvcs] [--generate-volume-mounts] [--keyvault-name <name>] [--include-default]");
+                return;
+            }
+            // The generated commands all rely on --enterprise. Catch the omission up front rather than emitting broken script lines.
+            const generatesAnything = Boolean(flags["generate-cabinet"] || flags["generate-secret-store"] || flags["generate-pvcs"] || flags["generate-volume-mounts"]);
+            if (generatesAnything && !flags.enterprise) {
+                throw new Error("--enterprise is required when using --generate-cabinet / --generate-secret-store / --generate-pvcs / --generate-volume-mounts.");
+            }
+            // `cabinet create --silent` requires environment AND cluster (see src/commands/cabinet/create.ts validatePartial).
+            if (flags["generate-cabinet"] && (!flags.environment || !flags.cluster)) {
+                throw new Error("--generate-cabinet requires both --environment and --cluster.");
+            }
+            const kubeConfig = new k8s.KubeConfig();
+            kubeConfig.loadFromCluster();
+            const coreApi = kubeConfig.makeApiClient(k8s.CoreV1Api);
+            const appsApi = kubeConfig.makeApiClient(k8s.AppsV1Api);
+            const networkingApi = kubeConfig.makeApiClient(k8s.NetworkingV1Api);
+            const storageApi = kubeConfig.makeApiClient(k8s.StorageV1Api);
+            const namespaces = yield this.listUserNamespaces(coreApi, (_a = flags["include-default"]) !== null && _a !== void 0 ? _a : false);
+            if (namespaces.length === 0) {
+                this.log("# No user namespaces found in cluster.");
+                return;
+            }
+            this.log(`# Found ${namespaces.length} namespace(s) to import.`);
+            // Fetch StorageClass list once so each PVC can resolve its FileStoreType via the className -> CSI driver map.
+            // Tolerate failure (e.g. RBAC denial) by falling back to an empty map; PVCs that can't resolve emit a TODO.
+            let storageClassByName = new Map();
+            if (flags["generate-pvcs"]) {
+                try {
+                    const scList = yield storageApi.listStorageClass();
+                    for (const sc of (_b = scList.items) !== null && _b !== void 0 ? _b : []) {
+                        const name = (_c = sc.metadata) === null || _c === void 0 ? void 0 : _c.name;
+                        if (name && sc.provisioner)
+                            storageClassByName.set(name, sc.provisioner);
+                    }
+                }
+                catch (err) {
+                    this.log(`# WARNING: Failed to list StorageClasses (${(_d = err.message) !== null && _d !== void 0 ? _d : err}). PVC --type inference will fall back to PV CSI driver / TODO comments.`);
+                }
+            }
+            const allGroups = [];
+            for (const namespace of namespaces) {
+                const groups = yield this.scanNamespace(namespace, coreApi, appsApi, networkingApi, storageClassByName, flags);
+                allGroups.push(...groups);
+            }
+            this.outputCommands(allGroups, flags);
+        });
+    }
+    // --------------------------------------------------------------------
+    // Namespace Discovery
+    // --------------------------------------------------------------------
+    listUserNamespaces(coreApi, includeDefault) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield coreApi.listNamespace();
+            return result.items
+                .map(ns => { var _a; return (_a = ns.metadata) === null || _a === void 0 ? void 0 : _a.name; })
+                .filter((name) => {
+                if (!name)
+                    return false;
+                if (EXCLUDED_NAMESPACES.has(name))
+                    return false;
+                if (name === "default" && !includeDefault)
+                    return false;
+                return true;
+            })
+                .sort();
+        });
+    }
+    // --------------------------------------------------------------------
+    // Per-Namespace Scanning
+    // --------------------------------------------------------------------
+    scanNamespace(namespace, coreApi, appsApi, networkingApi, storageClassByName, flags) {
+        var _a, _b;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const deploymentResult = yield appsApi.listNamespacedDeployment({ namespace });
+            const deployments = deploymentResult.items.filter(d => { var _a; return !!((_a = d.metadata) === null || _a === void 0 ? void 0 : _a.name); });
+            if (deployments.length === 0)
+                return [];
+            const services = (yield coreApi.listNamespacedService({ namespace })).items;
+            const ingresses = (yield networkingApi.listNamespacedIngress({ namespace })).items;
+            // Only list PVCs when at least one PVC-related emission flag is set; the API call is per-namespace.
+            const needsPvcs = flags["generate-pvcs"] || flags["generate-volume-mounts"];
+            const pvcsInNs = needsPvcs ? yield this.scanNamespacePvcs(namespace, coreApi) : new Map();
+            const groups = [];
+            for (let i = 0; i < deployments.length; i++) {
+                const deployment = deployments[i];
+                const matchingServices = this.findServicesForDeployment(deployment, services);
+                const matchingIngresses = this.findIngressesForServices(matchingServices, ingresses);
+                const group = {
+                    namespace,
+                    assetCommand: this.buildAssetCreateCommand(deployment, matchingIngresses, flags),
+                    configCommands: this.buildConfigCommands(deployment, namespace, flags),
+                    volumeMountCommands: [],
+                    filestoreBindCommands: [],
+                };
+                if (i === 0 && flags["generate-cabinet"]) {
+                    group.cabinetCommand = this.buildCabinetCreateCommand(namespace, flags);
+                }
+                if (needsPvcs && pvcsInNs.size > 0) {
+                    const assetName = (_b = (_a = deployment.metadata) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : "unnamed";
+                    const mounts = this.findPvcMountsForDeployment(deployment, pvcsInNs);
+                    for (const mount of mounts) {
+                        if (flags["generate-volume-mounts"]) {
+                            group.volumeMountCommands.push(this.buildAssetVolumeCreateCommand(assetName, mount.volName, mount.mountPath, flags));
+                        }
+                        if (flags["generate-pvcs"]) {
+                            const prefixedPvcName = `${namespace}-${mount.k8sPvcName}`;
+                            const pvc = pvcsInNs.get(mount.k8sPvcName);
+                            // Resolve the FileStoreType, with PV fallback for statically-bound PVCs.
+                            const type = yield this.resolveFileStoreType(pvc, storageClassByName, coreApi);
+                            if (!this.discoveredPvcs.has(prefixedPvcName)) {
+                                this.discoveredPvcs.set(prefixedPvcName, this.buildPvcCreateCommand(prefixedPvcName, pvc, type, flags));
+                            }
+                            group.filestoreBindCommands.push(this.buildFilestoreBindCommand(assetName, namespace, mount.volName, prefixedPvcName, flags));
+                        }
+                    }
+                }
+                groups.push(group);
+            }
+            return groups;
+        });
+    }
+    scanNamespacePvcs(namespace, coreApi) {
+        var _a, _b, _c;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const out = new Map();
+            try {
+                const list = yield coreApi.listNamespacedPersistentVolumeClaim({ namespace });
+                for (const pvc of (_a = list.items) !== null && _a !== void 0 ? _a : []) {
+                    const name = (_b = pvc.metadata) === null || _b === void 0 ? void 0 : _b.name;
+                    if (name)
+                        out.set(name, pvc);
+                }
+            }
+            catch (err) {
+                this.log(`# WARNING: Failed to list PVCs in namespace [${namespace}] (${(_c = err.message) !== null && _c !== void 0 ? _c : err}).`);
+            }
+            return out;
+        });
+    }
+    /** Resolves a PVC's FileStoreType using the cluster-wide StorageClass map, falling back to the PV's CSI driver
+     *  for statically-bound PVCs (storageClassName empty / spec.volumeName set). Returns undefined when no path resolves. */
+    resolveFileStoreType(pvc, storageClassByName, coreApi) {
+        var _a, _b, _c, _d;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const sc = (_a = pvc.spec) === null || _a === void 0 ? void 0 : _a.storageClassName;
+            if (sc && storageClassByName.has(sc)) {
+                const t = this.csiDriverToFileStoreType(storageClassByName.get(sc));
+                if (t)
+                    return t;
+            }
+            const pvName = (_b = pvc.spec) === null || _b === void 0 ? void 0 : _b.volumeName;
+            if (pvName) {
+                try {
+                    const pv = yield coreApi.readPersistentVolume({ name: pvName });
+                    return this.csiDriverToFileStoreType((_d = (_c = pv.spec) === null || _c === void 0 ? void 0 : _c.csi) === null || _d === void 0 ? void 0 : _d.driver);
+                }
+                catch (_e) {
+                    // PV may not exist yet, or RBAC may deny; fall through to undefined.
+                }
+            }
+            return undefined;
+        });
+    }
+    // --------------------------------------------------------------------
+    // Command Generation
+    // --------------------------------------------------------------------
+    buildCabinetCreateCommand(namespace, flags) {
+        const parts = [`codiac cabinet create ${namespace}`];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        if (flags.environment)
+            parts.push(`--environment ${flags.environment}`);
+        if (flags.cluster)
+            parts.push(`--cluster ${flags.cluster}`);
+        parts.push("--silent");
+        return parts.join(" ");
+    }
+    buildAssetCreateCommand(deployment, ingresses, flags) {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        const deploymentName = (_b = (_a = deployment.metadata) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : "unnamed";
+        const containers = (_f = (_e = (_d = (_c = deployment.spec) === null || _c === void 0 ? void 0 : _c.template) === null || _d === void 0 ? void 0 : _d.spec) === null || _e === void 0 ? void 0 : _e.containers) !== null && _f !== void 0 ? _f : [];
+        const firstContainer = containers[0];
+        const hasIngress = ingresses.length > 0;
+        const { registry: registryHost, imageName } = this.parseContainerImage(firstContainer === null || firstContainer === void 0 ? void 0 : firstContainer.image);
+        const firstPort = (_h = (_g = firstContainer === null || firstContainer === void 0 ? void 0 : firstContainer.ports) === null || _g === void 0 ? void 0 : _g[0]) === null || _h === void 0 ? void 0 : _h.containerPort;
+        // `--registry` on `cod asset create` expects the Codiac ImageRegistry CODE (e.g. `devcodiaccontainers`),
+        // not the URL the container puller uses. Map known hostname patterns to codes; unknown patterns become a TODO.
+        const registryInfo = this.toRegistryCode(registryHost);
+        const todoLines = [];
+        if (imageName === "<unknown>") {
+            todoLines.push(`# TODO: container image could not be inferred from the K8s deployment spec for [${deploymentName}]; set --image manually before running.`);
+            this.todoCount++;
+        }
+        if (registryInfo === undefined) {
+            todoLines.push(`# TODO: could not derive a Codiac registry code from container image registry [${registryHost}] for [${deploymentName}]; capture it via \`cod imageRegistry capture\` and add --registry <code> below.`);
+            this.todoCount++;
+        }
+        else if (registryInfo.code !== "DockerHub|official") {
+            // Track non-DockerHub registries so the discovered-registries banner can remind the user to capture them.
+            this.discoveredRegistries.set(registryInfo.code, registryInfo.provider);
+        }
+        const parts = [
+            "codiac asset create",
+            `--name ${deploymentName}`,
+            `--image ${imageName}`,
+        ];
+        if (registryInfo !== undefined) {
+            parts.push(`--registry ${registryInfo.code}`);
+        }
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        if (hasIngress) {
+            parts.push(`--code ${deploymentName}`);
+        }
+        if (firstPort !== undefined) {
+            parts.push(`--port ${firstPort}`);
+        }
+        if (hasIngress) {
+            parts.push("--hasIngress");
+        }
+        parts.push("--silent");
+        const commandLine = parts.join(" ");
+        return todoLines.length > 0 ? `${todoLines.join("\n")}\n${commandLine}` : commandLine;
+    }
+    /** Maps a container-image hostname to the Codiac `ImageRegistry.code` recognised by `cod asset create --registry`.
+     *  Returns `undefined` when the hostname can't be resolved so the caller can emit a TODO comment instead of
+     *  producing a broken command line. Provider hint is paired with the code so the discovered-registries banner
+     *  can render an accurate `cod imageRegistry capture --provider <p> --name <code>` suggestion. */
+    toRegistryCode(host) {
+        if (!host || host === "<unknown>")
+            return undefined;
+        if (host === "docker.io")
+            return { code: "DockerHub|official", provider: "dockerHub" };
+        if (host.endsWith(".azurecr.io")) {
+            const code = host.slice(0, -".azurecr.io".length);
+            return code ? { code, provider: "azure" } : undefined;
+        }
+        return undefined;
+    }
+    buildConfigCommands(deployment, namespace, flags) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const deploymentName = (_b = (_a = deployment.metadata) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : "unnamed";
+        const containers = (_f = (_e = (_d = (_c = deployment.spec) === null || _c === void 0 ? void 0 : _c.template) === null || _d === void 0 ? void 0 : _d.spec) === null || _e === void 0 ? void 0 : _e.containers) !== null && _f !== void 0 ? _f : [];
+        const commands = [];
+        for (const container of containers) {
+            for (const envVar of (_g = container.env) !== null && _g !== void 0 ? _g : []) {
+                const cmd = this.buildConfigCommand(deploymentName, namespace, envVar, flags);
+                commands.push(cmd);
+            }
+        }
+        return commands;
+    }
+    buildConfigCommand(assetName, namespace, envVar, flags) {
+        const settingName = envVar.name;
+        // Direct value
+        if (envVar.value !== undefined) {
+            return this.buildConfigAddEnvCommand(assetName, namespace, settingName, `"${envVar.value.replace(/"/g, '\\"')}"`, flags);
+        }
+        if (envVar.valueFrom) {
+            // Secret reference -> #REF syntax
+            if (envVar.valueFrom.secretKeyRef) {
+                return this.buildSecretRefCommand(assetName, namespace, settingName, envVar.valueFrom.secretKeyRef, flags);
+            }
+            // Field reference -> k8spatch
+            if (envVar.valueFrom.fieldRef) {
+                return this.buildFieldRefPatchCommand(assetName, namespace, settingName, envVar.valueFrom.fieldRef, flags);
+            }
+            // configMapKeyRef / resourceFieldRef -> TODO comments (out of scope)
+            const ref = this.describeEnvVarReference(envVar.valueFrom);
+            const base = this.buildConfigAddEnvBase(assetName, namespace, settingName, flags);
+            this.todoCount++;
+            return `# TODO: ${settingName} - ${ref}\n# ${base} --value "<MANUAL_ENTRY_REQUIRED>"`;
+        }
+        // Empty value
+        return this.buildConfigAddEnvCommand(assetName, namespace, settingName, '""', flags);
+    }
+    /** Builds a standard codiac config add for a direct env value. */
+    buildConfigAddEnvCommand(assetName, namespace, settingName, value, flags) {
+        return `${this.buildConfigAddEnvBase(assetName, namespace, settingName, flags)} --value ${value}`;
+    }
+    /** Builds the base portion of a codiac config add command (without --value). */
+    buildConfigAddEnvBase(assetName, namespace, settingName, flags) {
+        const parts = ["codiac config add --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`-a ${assetName}`, "-t env", `--cabinet=${namespace}`, `--setting ${settingName}`);
+        return parts.join(" ");
+    }
+    /** Builds a codiac config add with #REF|azKeyVault|... for a secretKeyRef env var. */
+    buildSecretRefCommand(assetName, namespace, settingName, secretKeyRef, flags) {
+        var _a, _b, _c;
+        const secretName = (_a = secretKeyRef.name) !== null && _a !== void 0 ? _a : "<unknown>";
+        const secretKey = (_b = secretKeyRef.key) !== null && _b !== void 0 ? _b : "<unknown>";
+        const storeName = (_c = flags["keyvault-name"]) !== null && _c !== void 0 ? _c : secretName;
+        this.discoveredStores.add(storeName);
+        const refValue = `'#REF|azKeyVault|${storeName}|${secretKey}'`;
+        return this.buildConfigAddEnvCommand(assetName, namespace, settingName, refValue, flags);
+    }
+    /** Builds a codiac config set with -t k8spatch for a fieldRef (Downward API) env var. */
+    buildFieldRefPatchCommand(assetName, namespace, settingName, fieldRef, flags) {
+        const parts = ["codiac config set --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`-a ${assetName}`, `-c ${namespace}`, "-t k8spatch", "--setting 'deployment'");
+        const fieldRefObj = {};
+        if (fieldRef.apiVersion)
+            fieldRefObj.apiVersion = fieldRef.apiVersion;
+        fieldRefObj.fieldPath = fieldRef.fieldPath;
+        const patchOp = {
+            op: "add",
+            path: "/spec/template/spec/containers/0/env/-",
+            value: {
+                name: settingName,
+                valueFrom: { fieldRef: fieldRefObj },
+            },
+        };
+        const patchJson = JSON.stringify([patchOp]);
+        const shellEscaped = patchJson.replace(/'/g, "'\\''");
+        parts.push(`--value '${shellEscaped}'`);
+        return parts.join(" ");
+    }
+    /** Builds a codiac secretStore:capture command. */
+    buildSecretStoreCaptureCommand(storeName) {
+        return `codiac secretStore:capture --silent --name=${storeName} --provider=azure`;
+    }
+    // --------------------------------------------------------------------
+    // Output
+    // --------------------------------------------------------------------
+    outputCommands(groups, flags) {
+        if (groups.length === 0) {
+            this.log("# No deployments found to import.");
+            return;
+        }
+        this.log("");
+        this.log("# " + "=".repeat(58));
+        this.log("# Generated Import Commands");
+        this.log("# " + "=".repeat(58));
+        if (this.todoCount > 0) {
+            this.log("");
+            this.log("# " + "=".repeat(58));
+            this.log(`# WARNING: ${this.todoCount} TODO item(s) below require manual review before running this script.`);
+            this.log(`# Search for "# TODO:" to find them.`);
+            this.log("# " + "=".repeat(58));
+        }
+        if (this.discoveredRegistries.size > 0) {
+            this.log("");
+            this.log("# --- Image Registries (must already exist in Codiac) ---");
+            this.log("# The asset create commands below reference these registries by code.");
+            this.log("# If any have not yet been captured, run: cod imageRegistry capture --provider <provider> --name <code>");
+            this.log("# Discovered:");
+            const sortedCodes = [...this.discoveredRegistries.keys()].sort();
+            for (const code of sortedCodes) {
+                this.log(`#   - ${code} (provider: ${this.discoveredRegistries.get(code)})`);
+            }
+        }
+        if (flags["generate-secret-store"] && this.discoveredStores.size > 0) {
+            this.log("");
+            this.log("# --- Secret Store Capture ---");
+            for (const store of [...this.discoveredStores].sort()) {
+                this.log(this.buildSecretStoreCaptureCommand(store));
+            }
+        }
+        if (flags["generate-pvcs"] && this.discoveredPvcs.size > 0) {
+            this.log("");
+            this.log("# --- PVC Filestores ---");
+            const sortedNames = [...this.discoveredPvcs.keys()].sort();
+            for (const name of sortedNames) {
+                this.log(this.discoveredPvcs.get(name));
+            }
+        }
+        let lastNamespace = "";
+        for (const group of groups) {
+            if (group.namespace !== lastNamespace) {
+                this.log("");
+                this.log(`# --- Namespace: ${group.namespace} ---`);
+                lastNamespace = group.namespace;
+            }
+            if (group.cabinetCommand) {
+                this.log("");
+                this.log(group.cabinetCommand);
+            }
+            this.log("");
+            this.log(group.assetCommand);
+            if (group.configCommands.length > 0) {
+                for (const cmd of group.configCommands) {
+                    this.log(cmd);
+                }
+            }
+            if (group.volumeMountCommands.length > 0) {
+                for (const cmd of group.volumeMountCommands) {
+                    this.log(cmd);
+                }
+            }
+            if (group.filestoreBindCommands.length > 0) {
+                for (const cmd of group.filestoreBindCommands) {
+                    this.log(cmd);
+                }
+            }
+        }
+        this.log("");
+    }
+    // --------------------------------------------------------------------
+    // K8s Matching Logic
+    // --------------------------------------------------------------------
+    findServicesForDeployment(deployment, services) {
+        var _a, _b, _c, _d;
+        const podLabels = (_d = (_c = (_b = (_a = deployment.spec) === null || _a === void 0 ? void 0 : _a.template) === null || _b === void 0 ? void 0 : _b.metadata) === null || _c === void 0 ? void 0 : _c.labels) !== null && _d !== void 0 ? _d : {};
+        return services.filter(service => {
+            var _a, _b;
+            const selector = (_b = (_a = service.spec) === null || _a === void 0 ? void 0 : _a.selector) !== null && _b !== void 0 ? _b : {};
+            if (Object.keys(selector).length === 0)
+                return false;
+            return Object.entries(selector).every(([key, value]) => podLabels[key] === value);
+        });
+    }
+    findIngressesForServices(services, ingresses) {
+        const serviceNames = new Set(services.map(s => { var _a; return (_a = s.metadata) === null || _a === void 0 ? void 0 : _a.name; }).filter(Boolean));
+        return ingresses.filter(ingress => {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const defaultBackend = (_c = (_b = (_a = ingress.spec) === null || _a === void 0 ? void 0 : _a.defaultBackend) === null || _b === void 0 ? void 0 : _b.service) === null || _c === void 0 ? void 0 : _c.name;
+            if (defaultBackend && serviceNames.has(defaultBackend))
+                return true;
+            for (const rule of (_e = (_d = ingress.spec) === null || _d === void 0 ? void 0 : _d.rules) !== null && _e !== void 0 ? _e : []) {
+                for (const path of (_g = (_f = rule.http) === null || _f === void 0 ? void 0 : _f.paths) !== null && _g !== void 0 ? _g : []) {
+                    if (((_j = (_h = path.backend) === null || _h === void 0 ? void 0 : _h.service) === null || _j === void 0 ? void 0 : _j.name) && serviceNames.has(path.backend.service.name))
+                        return true;
+                }
+            }
+            return false;
+        });
+    }
+    // --------------------------------------------------------------------
+    // Image Parsing
+    // --------------------------------------------------------------------
+    parseContainerImage(image) {
+        if (!image) {
+            return { registry: "<unknown>", imageName: "<unknown>" };
+        }
+        const imageWithoutTag = image.split(":")[0];
+        const parts = imageWithoutTag.split("/");
+        if (parts.length === 1) {
+            return { registry: "docker.io", imageName: parts[0] };
+        }
+        else if (parts.length === 2) {
+            if (parts[0].includes(".") || parts[0].includes(":")) {
+                return { registry: parts[0], imageName: parts[1] };
+            }
+            return { registry: "docker.io", imageName: parts[1] };
+        }
+        return { registry: parts[0], imageName: parts[parts.length - 1] };
+    }
+    // --------------------------------------------------------------------
+    // Env Var Reference Description (for unsupported types)
+    // --------------------------------------------------------------------
+    describeEnvVarReference(valueFrom) {
+        var _a, _b, _c, _d;
+        if (valueFrom.configMapKeyRef) {
+            return `Value from ConfigMap "${(_a = valueFrom.configMapKeyRef.name) !== null && _a !== void 0 ? _a : "<unknown>"}", key "${(_b = valueFrom.configMapKeyRef.key) !== null && _b !== void 0 ? _b : "<unknown>"}"`;
+        }
+        if (valueFrom.resourceFieldRef) {
+            return `Value from container "${(_c = valueFrom.resourceFieldRef.containerName) !== null && _c !== void 0 ? _c : "<current>"}" resource "${(_d = valueFrom.resourceFieldRef.resource) !== null && _d !== void 0 ? _d : "<unknown>"}"`;
+        }
+        return "Value from unknown reference type";
+    }
+    // --------------------------------------------------------------------
+    // PVC Discovery & Emission
+    // --------------------------------------------------------------------
+    /** Maps a CSI driver name (or legacy in-tree provisioner) to the Codiac FileStoreType
+     *  recognised by `cod pvc create`. Returns undefined when the driver is unknown so the
+     *  caller can emit a TODO comment instead of guessing. */
+    csiDriverToFileStoreType(driver) {
+        switch (driver) {
+            case "file.csi.azure.com": return contracts_1.FileStoreTypeEnum.azureFileStorage;
+            case "disk.csi.azure.com":
+            case "kubernetes.io/azure-disk": return contracts_1.FileStoreTypeEnum.azureDisk;
+            case "blob.csi.azure.com": return contracts_1.FileStoreTypeEnum.azureBlobStorage;
+            case "netapp.csi.azure.com": return contracts_1.FileStoreTypeEnum.azureNetAppFiles;
+            default: return undefined;
+        }
+    }
+    /** Walks a deployment's pod template to find every container volumeMount backed by a PVC
+     *  in `pvcsInNs`. Returns one entry per matched (volume, container) pair. */
+    findPvcMountsForDeployment(deployment, pvcsInNs) {
+        var _a, _b, _c, _d, _e, _f;
+        const podSpec = (_b = (_a = deployment.spec) === null || _a === void 0 ? void 0 : _a.template) === null || _b === void 0 ? void 0 : _b.spec;
+        const volumes = (_c = podSpec === null || podSpec === void 0 ? void 0 : podSpec.volumes) !== null && _c !== void 0 ? _c : [];
+        const containers = (_d = podSpec === null || podSpec === void 0 ? void 0 : podSpec.containers) !== null && _d !== void 0 ? _d : [];
+        const out = [];
+        for (const vol of volumes) {
+            const claimName = (_e = vol.persistentVolumeClaim) === null || _e === void 0 ? void 0 : _e.claimName;
+            if (!claimName || !pvcsInNs.has(claimName))
+                continue;
+            for (const container of containers) {
+                for (const vm of (_f = container.volumeMounts) !== null && _f !== void 0 ? _f : []) {
+                    if (vm.name === vol.name && vm.mountPath) {
+                        out.push({ volName: vol.name, mountPath: vm.mountPath, k8sPvcName: claimName });
+                    }
+                }
+            }
+        }
+        return out;
+    }
+    /** Builds the enterprise-scoped `codiac pvc create` line. When the FileStoreType could not
+     *  be inferred, prepends a TODO comment line so the user is forced to set `--type` manually. */
+    buildPvcCreateCommand(prefixedPvcName, pvc, type, flags) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const parts = ["codiac pvc create --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`--name ${prefixedPvcName}`);
+        parts.push(`--provider azure`);
+        if (type)
+            parts.push(`--type ${type}`);
+        const storageClassName = (_a = pvc.spec) === null || _a === void 0 ? void 0 : _a.storageClassName;
+        if (storageClassName)
+            parts.push(`--storage-class ${storageClassName}`);
+        const modes = (_c = (_b = pvc.spec) === null || _b === void 0 ? void 0 : _b.accessModes) !== null && _c !== void 0 ? _c : [];
+        if (modes.length > 0)
+            parts.push(`--access-modes ${modes.join(",")}`);
+        const size = (_f = (_e = (_d = pvc.spec) === null || _d === void 0 ? void 0 : _d.resources) === null || _e === void 0 ? void 0 : _e.requests) === null || _f === void 0 ? void 0 : _f.storage;
+        if (size)
+            parts.push(`--size ${size}`);
+        if ((_g = pvc.spec) === null || _g === void 0 ? void 0 : _g.volumeName)
+            parts.push(`--volume-name ${pvc.spec.volumeName}`);
+        const line = parts.join(" ");
+        if (!type) {
+            const sc = storageClassName !== null && storageClassName !== void 0 ? storageClassName : "<none>";
+            this.todoCount++;
+            return `# TODO: --type could not be inferred (storageClass=${sc}); set it manually before running.\n${line}`;
+        }
+        return line;
+    }
+    /** Builds the asset-scoped `codiac asset volume create` line. The mountPath is a positional arg. */
+    buildAssetVolumeCreateCommand(assetName, volName, mountPath, flags) {
+        const parts = ["codiac asset volume create --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`--asset ${assetName}`);
+        parts.push(`--name ${volName}`);
+        parts.push(mountPath);
+        // Auto-description so reviewers can later audit where each volume mount originated.
+        // Defensive escape of any embedded double-quotes (K8s names are DNS-safe so this is belt-and-suspenders).
+        const description = `Imported from K8s deployment ${assetName}, volume ${volName}, mount ${mountPath}`.replace(/"/g, '\\"');
+        parts.push(`--description "${description}"`);
+        return parts.join(" ");
+    }
+    /** Builds the cabinet-scoped `codiac config add -t filestore` line that binds an asset's reserved
+     *  folder (declared by `asset volume create`) to the FileStoreDef (created by `pvc create`). */
+    buildFilestoreBindCommand(assetName, namespace, volName, prefixedPvcName, flags) {
+        const parts = ["codiac config add --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`-a ${assetName}`, `-c ${namespace}`, "-t filestore", `--setting ${volName}`, `--value ${prefixedPvcName}`);
+        return parts.join(" ");
+    }
+}
+exports.default = ImportCluster;
+ImportCluster.description = 'Scans all deployments in the current Kubernetes cluster and generates the Codiac CLI commands to import them.';
+ImportCluster.examples = [
+    '<%= config.bin %> <%= command.id %> --run-in-cluster',
+    '<%= config.bin %> <%= command.id %> --run-in-cluster --enterprise myco --environment dev --cluster mycluster --generate-cabinet --generate-secret-store',
+    '<%= config.bin %> <%= command.id %> --run-in-cluster --enterprise myco --environment dev --cluster mycluster --generate-pvcs --generate-volume-mounts',
+];
+ImportCluster.flags = {
+    "run-in-cluster": core_1.Flags.boolean({ description: 'Run using in-cluster Kubernetes config (service account). Required for headless/pod execution.' }),
+    enterprise: core_1.Flags.string({ description: 'Enterprise code to include in generated commands.' }),
+    environment: core_1.Flags.string({ description: 'Environment name to include in generated commands (required by --generate-cabinet).' }),
+    cluster: core_1.Flags.string({ description: 'Cluster name to include in generated cabinet create commands (required by --generate-cabinet).' }),
+    "generate-cabinet": core_1.Flags.boolean({ description: 'Include codiac cabinet create commands in the output (one per namespace). Requires --enterprise, --environment, and --cluster.' }),
+    "generate-secret-store": core_1.Flags.boolean({ description: 'Include codiac secretStore:capture commands in the output for discovered Azure Key Vaults.' }),
+    "generate-pvcs": core_1.Flags.boolean({ description: 'Include codiac pvc create commands (enterprise-scope) plus codiac config add -t filestore bindings for every PersistentVolumeClaim mounted by a discovered deployment.' }),
+    "generate-volume-mounts": core_1.Flags.boolean({ description: 'Include codiac asset volume create commands for every container volumeMount backed by a PVC on a discovered deployment.' }),
+    "include-default": core_1.Flags.boolean({ description: 'Include the "default" namespace (excluded by default).' }),
+    "keyvault-name": core_1.Flags.string({ description: 'Azure Key Vault name to use in generated secret references. When omitted, the K8s Secret name is used as a placeholder.' }),
+};
+//# sourceMappingURL=cluster.js.map