@codiac.io/codiac-cli 1.3.229 → 1.3.232

package/dist/commands/import/cluster.js

@@ -0,0 +1,799 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const core_1 = require("@oclif/core");
+const k8s = require("@kubernetes/client-node");
+const zlib = require("zlib");
+const YAML = require("yaml");
+const contracts_1 = require("../../apis/codiac-api/contracts");
+const EXCLUDED_NAMESPACES = new Set([
+    "kube-system",
+    "kube-public",
+    "kube-node-lease",
+    // Azure-managed
+    "gatekeeper-system",
+    "calico-system",
+    "cert-manager",
+    "ingress-nginx",
+    "keda",
+    "azure-arc",
+    "tigera-operator",
+    // AWS-managed
+    "amazon-cloudwatch",
+    "aws-observability",
+]);
+class ImportCluster extends core_1.Command {
+    constructor() {
+        super(...arguments);
+        /** Accumulates unique secret store names discovered during the scan. */
+        this.discoveredStores = new Set();
+        /** Accumulates enterprise-scoped `codiac pvc create` lines keyed by their prefixed FileStoreDef name (`<namespace>-<pvc>`).
+         *  Map preserves insertion order; the prefix guarantees cross-namespace uniqueness so no dedupe logic is needed beyond key collision. */
+        this.discoveredPvcs = new Map();
+        /** Count of `# TODO:` comment lines emitted across all generated commands; surfaced as a summary banner at top of output. */
+        this.todoCount = 0;
+        /** Codiac registry codes that must already exist in the tenant for the generated `cod asset create` lines to succeed.
+         *  Keyed by code, value is the cloud provider hint used to render the `cod imageRegistry capture` suggestion in the banner.
+         *  `DockerHub|official` is intentionally excluded to keep the banner focused on registries the user must capture themselves. */
+        this.discoveredRegistries = new Map();
+    }
+    run() {
+        var _a, _b, _c, _d;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const { flags } = yield this.parse(ImportCluster);
+            if (!flags["run-in-cluster"]) {
+                this.log("The --run-in-cluster flag is required. Interactive mode is not yet supported.");
+                this.log("Usage: codiac import cluster --run-in-cluster [--enterprise <name>] [--environment <name>] [--cluster <name>] [--subscription-id <id>] [--generate-cabinet] [--generate-secret-store] [--generate-pvcs] [--generate-volume-mounts] [--keyvault-name <name>] [--include-default]");
+                return;
+            }
+            // The generated commands all rely on --enterprise. Catch the omission up front rather than emitting broken script lines.
+            const generatesAnything = Boolean(flags["generate-cabinet"] || flags["generate-secret-store"] || flags["generate-pvcs"] || flags["generate-volume-mounts"]);
+            if (generatesAnything && !flags.enterprise) {
+                throw new Error("--enterprise is required when using --generate-cabinet / --generate-secret-store / --generate-pvcs / --generate-volume-mounts.");
+            }
+            // `cabinet create --silent` requires environment AND cluster (see src/commands/cabinet/create.ts validatePartial).
+            if (flags["generate-cabinet"] && (!flags.environment || !flags.cluster)) {
+                throw new Error("--generate-cabinet requires both --environment and --cluster.");
+            }
+            const kubeConfig = new k8s.KubeConfig();
+            kubeConfig.loadFromCluster();
+            const coreApi = kubeConfig.makeApiClient(k8s.CoreV1Api);
+            const appsApi = kubeConfig.makeApiClient(k8s.AppsV1Api);
+            const networkingApi = kubeConfig.makeApiClient(k8s.NetworkingV1Api);
+            const storageApi = kubeConfig.makeApiClient(k8s.StorageV1Api);
+            const namespaces = yield this.listUserNamespaces(coreApi, (_a = flags["include-default"]) !== null && _a !== void 0 ? _a : false);
+            if (namespaces.length === 0) {
+                this.log("# No user namespaces found in cluster.");
+                return;
+            }
+            this.log(`# Found ${namespaces.length} namespace(s) to import.`);
+            // Fetch StorageClass list once so each PVC can resolve its FileStoreType via the className -> CSI driver map.
+            // Tolerate failure (e.g. RBAC denial) by falling back to an empty map; PVCs that can't resolve emit a TODO.
+            let storageClassByName = new Map();
+            if (flags["generate-pvcs"]) {
+                try {
+                    const scList = yield storageApi.listStorageClass();
+                    for (const sc of (_b = scList.items) !== null && _b !== void 0 ? _b : []) {
+                        const name = (_c = sc.metadata) === null || _c === void 0 ? void 0 : _c.name;
+                        if (name && sc.provisioner)
+                            storageClassByName.set(name, sc.provisioner);
+                    }
+                }
+                catch (err) {
+                    this.log(`# WARNING: Failed to list StorageClasses (${(_d = err.message) !== null && _d !== void 0 ? _d : err}). PVC --type inference will fall back to PV CSI driver / TODO comments.`);
+                }
+            }
+            const allGroups = [];
+            const allHelmGroups = [];
+            for (const namespace of namespaces) {
+                const { groups, helmGroups } = yield this.scanNamespace(namespace, coreApi, appsApi, networkingApi, storageClassByName, flags);
+                allGroups.push(...groups);
+                allHelmGroups.push(...helmGroups);
+            }
+            this.outputCommands(allGroups, allHelmGroups, flags);
+        });
+    }
+    // --------------------------------------------------------------------
+    // Namespace Discovery
+    // --------------------------------------------------------------------
+    listUserNamespaces(coreApi, includeDefault) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield coreApi.listNamespace();
+            return result.items
+                .map(ns => { var _a; return (_a = ns.metadata) === null || _a === void 0 ? void 0 : _a.name; })
+                .filter((name) => {
+                if (!name)
+                    return false;
+                if (EXCLUDED_NAMESPACES.has(name))
+                    return false;
+                if (name === "default" && !includeDefault)
+                    return false;
+                return true;
+            })
+                .sort();
+        });
+    }
+    // --------------------------------------------------------------------
+    // Per-Namespace Scanning
+    // --------------------------------------------------------------------
+    scanNamespace(namespace, coreApi, appsApi, networkingApi, storageClassByName, flags) {
+        var _a, _b;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            // Discover Helm releases first so their owned Deployments can be deduped out of the raw asset path.
+            const helmReleases = yield this.scanNamespaceHelmReleases(namespace, coreApi);
+            const releaseNames = new Set(helmReleases.map(r => r.name));
+            const helmGroups = helmReleases.map(r => ({
+                namespace,
+                releaseName: r.name,
+                lines: this.buildHelmReleaseCommands(r, flags),
+            }));
+            const deploymentResult = yield appsApi.listNamespacedDeployment({ namespace });
+            // Skip Deployments owned by a Helm release we successfully imported; they are represented by the helm asset instead.
+            const deployments = deploymentResult.items.filter(d => { var _a; return !!((_a = d.metadata) === null || _a === void 0 ? void 0 : _a.name) && !this.isHelmOwned(d, releaseNames); });
+            if (deployments.length === 0)
+                return { groups: [], helmGroups };
+            const services = (yield coreApi.listNamespacedService({ namespace })).items;
+            const ingresses = (yield networkingApi.listNamespacedIngress({ namespace })).items;
+            // Only list PVCs when at least one PVC-related emission flag is set; the API call is per-namespace.
+            const needsPvcs = flags["generate-pvcs"] || flags["generate-volume-mounts"];
+            const pvcsInNs = needsPvcs ? yield this.scanNamespacePvcs(namespace, coreApi) : new Map();
+            const groups = [];
+            for (let i = 0; i < deployments.length; i++) {
+                const deployment = deployments[i];
+                const matchingServices = this.findServicesForDeployment(deployment, services);
+                const matchingIngresses = this.findIngressesForServices(matchingServices, ingresses);
+                const group = {
+                    namespace,
+                    assetCommand: this.buildAssetCreateCommand(deployment, matchingIngresses, flags),
+                    configCommands: this.buildConfigCommands(deployment, namespace, flags),
+                    volumeMountCommands: [],
+                    filestoreBindCommands: [],
+                };
+                if (needsPvcs && pvcsInNs.size > 0) {
+                    const assetName = (_b = (_a = deployment.metadata) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : "unnamed";
+                    const mounts = this.findPvcMountsForDeployment(deployment, pvcsInNs);
+                    for (const mount of mounts) {
+                        if (flags["generate-volume-mounts"]) {
+                            group.volumeMountCommands.push(this.buildAssetVolumeCreateCommand(assetName, mount.volName, mount.mountPath, flags));
+                        }
+                        if (flags["generate-pvcs"]) {
+                            const prefixedPvcName = `${namespace}-${mount.k8sPvcName}`;
+                            const pvc = pvcsInNs.get(mount.k8sPvcName);
+                            // Resolve the FileStoreType, with PV fallback for statically-bound PVCs.
+                            const type = yield this.resolveFileStoreType(pvc, storageClassByName, coreApi);
+                            if (!this.discoveredPvcs.has(prefixedPvcName)) {
+                                this.discoveredPvcs.set(prefixedPvcName, this.buildPvcCreateCommand(prefixedPvcName, pvc, type, flags));
+                            }
+                            group.filestoreBindCommands.push(this.buildFilestoreBindCommand(assetName, namespace, mount.volName, prefixedPvcName, flags));
+                        }
+                    }
+                }
+                groups.push(group);
+            }
+            return { groups, helmGroups };
+        });
+    }
+    /** True when the Deployment is owned by one of the named Helm releases (so it must not be imported as a raw asset). */
+    isHelmOwned(deployment, releaseNames) {
+        var _a, _b;
+        const releaseName = (_b = (_a = deployment.metadata) === null || _a === void 0 ? void 0 : _a.annotations) === null || _b === void 0 ? void 0 : _b["meta.helm.sh/release-name"];
+        return releaseName != undefined && releaseNames.has(releaseName);
+    }
+    // --------------------------------------------------------------------
+    // Helm Release Discovery
+    // --------------------------------------------------------------------
+    /** Lists the Helm v3 release storage Secrets in a namespace, keeps the latest revision per release, and decodes
+     *  each into a HelmRelease. Listing failures (typically missing `secrets` read RBAC) are non-fatal: a warning is
+     *  emitted and an empty list returned, so the affected Deployments fall back to the raw asset-import path. */
+    scanNamespaceHelmReleases(namespace, coreApi) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            let secrets;
+            try {
+                const list = yield coreApi.listNamespacedSecret({ namespace, fieldSelector: "type=helm.sh/release.v1" });
+                secrets = (_a = list.items) !== null && _a !== void 0 ? _a : [];
+            }
+            catch (err) {
+                this.log(`# WARNING: Failed to list Helm release secrets in namespace [${namespace}] (${(_b = err.message) !== null && _b !== void 0 ? _b : err}). Helm releases here will not be imported; their Deployments will be imported individually instead.`);
+                return [];
+            }
+            // Group by release name, keeping only the highest revision Secret per release.
+            const latestByName = new Map();
+            for (const secret of secrets) {
+                const releaseName = (_d = (_c = secret.metadata) === null || _c === void 0 ? void 0 : _c.labels) === null || _d === void 0 ? void 0 : _d["name"];
+                if (!releaseName)
+                    continue;
+                const revision = parseInt((_g = (_f = (_e = secret.metadata) === null || _e === void 0 ? void 0 : _e.labels) === null || _f === void 0 ? void 0 : _f["version"]) !== null && _g !== void 0 ? _g : "0", 10) || 0;
+                const existing = latestByName.get(releaseName);
+                if (!existing || revision > existing.revision)
+                    latestByName.set(releaseName, { revision, secret });
+            }
+            const releases = [];
+            for (const [releaseName, { secret }] of latestByName) {
+                const encoded = (_h = secret.data) === null || _h === void 0 ? void 0 : _h["release"];
+                if (!encoded)
+                    continue;
+                try {
+                    const release = this.decodeHelmRelease(encoded);
+                    const metadata = (_k = (_j = release === null || release === void 0 ? void 0 : release.chart) === null || _j === void 0 ? void 0 : _j.metadata) !== null && _k !== void 0 ? _k : {};
+                    releases.push({
+                        name: (_l = release === null || release === void 0 ? void 0 : release.name) !== null && _l !== void 0 ? _l : releaseName,
+                        namespace: (_m = release === null || release === void 0 ? void 0 : release.namespace) !== null && _m !== void 0 ? _m : namespace,
+                        chartName: (_o = metadata.name) !== null && _o !== void 0 ? _o : releaseName,
+                        chartVersion: metadata.version,
+                        defaults: (_q = (_p = release === null || release === void 0 ? void 0 : release.chart) === null || _p === void 0 ? void 0 : _p.values) !== null && _q !== void 0 ? _q : {},
+                        overrides: (_r = release === null || release === void 0 ? void 0 : release.config) !== null && _r !== void 0 ? _r : {},
+                        repoGuess: this.sniffChartRepo(metadata),
+                        repoHint: this.buildRepoHint(metadata),
+                    });
+                }
+                catch (err) {
+                    this.log(`# WARNING: Failed to decode Helm release [${namespace}/${releaseName}] (${(_s = err.message) !== null && _s !== void 0 ? _s : err}); skipping.`);
+                }
+            }
+            releases.sort((a, b) => a.name.localeCompare(b.name));
+            return releases;
+        });
+    }
+    /** Decodes a Helm v3 release storage payload. Helm stores the release as base64(gzip(json)); the Kubernetes API
+     *  then base64-encodes that string again as the Secret's `release` data value, so two base64 decodes precede the
+     *  gunzip. Older releases may be stored without gzip, so the gzip magic bytes are checked before inflating. */
+    decodeHelmRelease(b64FromK8s) {
+        const helmStored = Buffer.from(b64FromK8s, "base64");
+        const payload = Buffer.from(helmStored.toString("utf8"), "base64");
+        let json;
+        if (payload.length >= 2 && payload[0] === 0x1f && payload[1] === 0x8b) {
+            json = zlib.gunzipSync(payload);
+        }
+        else {
+            json = payload.length > 0 ? payload : helmStored;
+        }
+        return JSON.parse(json.toString("utf8"));
+    }
+    /** Best-effort recovery of a usable chart repository reference from chart metadata. The Helm release Secret does
+     *  not record where a chart came from, so only an explicit OCI source can be returned with confidence. */
+    sniffChartRepo(metadata) {
+        const sources = Array.isArray(metadata === null || metadata === void 0 ? void 0 : metadata.sources) ? metadata.sources : [];
+        const ociRef = sources.find(s => typeof s === "string" && s.startsWith("oci://"));
+        return ociRef;
+    }
+    /** Renders a human hint (chart home / sources) shown in a comment when the chart repository could not be resolved. */
+    buildRepoHint(metadata) {
+        const hints = [];
+        if (typeof (metadata === null || metadata === void 0 ? void 0 : metadata.home) === "string" && metadata.home)
+            hints.push(metadata.home);
+        if (Array.isArray(metadata === null || metadata === void 0 ? void 0 : metadata.sources))
+            hints.push(...metadata.sources.filter((s) => typeof s === "string"));
+        return hints.length > 0 ? hints.join(", ") : undefined;
+    }
+    // --------------------------------------------------------------------
+    // Helm Command Generation
+    // --------------------------------------------------------------------
+    /** Builds the full block of generated commands for one Helm release: the asset create line, plus enterprise-scoped
+     *  default values and (when present) cabinet-scoped override values, each delivered via a heredoc to keep the output
+     *  a single self-contained script stream. */
+    buildHelmReleaseCommands(release, flags) {
+        const lines = [];
+        const versionSuffix = release.chartVersion ? `:${release.chartVersion}` : "";
+        lines.push(`# --- Helm release: ${release.namespace}/${release.name} (chart ${release.chartName}${versionSuffix}) ---`);
+        // The Codiac asset model has no chart-version field; version is a deploy-time concern, so surface it for the operator.
+        if (release.chartVersion) {
+            lines.push(`# Chart version at import time: ${release.chartVersion} (set explicitly at deploy time; not stored on the asset).`);
+        }
+        let repo = release.repoGuess;
+        if (!repo) {
+            this.todoCount++;
+            lines.push(`# TODO: the Helm release secret does not record its chart repository; set --chart-repo to the Codiac registry code for the repo that publishes [${release.chartName}].`);
+            if (release.repoHint)
+                lines.push(`#   hint - chart home/sources: ${release.repoHint}`);
+            repo = "<CHART_REPO>";
+        }
+        const createParts = ["codiac asset create --helm", `--chart ${release.chartName}`, `--chart-repo ${repo}`];
+        if (flags.enterprise)
+            createParts.push(`--enterprise ${flags.enterprise}`);
+        createParts.push(`--name ${release.name}`, "--silent");
+        lines.push(createParts.join(" "));
+        // Chart defaults define the asset baseline -> enterprise-scoped helm config.
+        if (release.defaults && Object.keys(release.defaults).length > 0) {
+            lines.push(`# Chart default values for ${release.name}:`);
+            lines.push(this.buildHelmValuesConfigBlock(release.name, release.defaults, "enterprise", release.namespace, flags));
+        }
+        // Operator overrides define per-deployment behavior -> cabinet-scoped helm config.
+        if (release.overrides && Object.keys(release.overrides).length > 0) {
+            lines.push(`# Release override values for ${release.name} (captured verbatim from the live release; MAY CONTAIN SECRETS - review before running):`);
+            lines.push(this.buildHelmValuesConfigBlock(release.name, release.overrides, "cabinet", release.namespace, flags));
+        }
+        return lines;
+    }
+    /** Builds a single `codiac config set -t helm` command whose value is the entire values document, supplied via a
+     *  quoted heredoc so the YAML passes through the shell literally. `--escape-expressions` ensures any third-party
+     *  `@{...}` tokens in the values are stored as literals rather than evaluated by Codiac at deploy time. */
+    buildHelmValuesConfigBlock(assetName, values, scope, namespace, flags) {
+        const parts = ["codiac config set --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`-a ${assetName}`);
+        if (scope === "enterprise")
+            parts.push("--enterprise-scope");
+        else
+            parts.push(`-c ${namespace}`);
+        parts.push("-t helm", "--entire-file", "--value-stdin", "--escape-expressions");
+        const yamlText = YAML.stringify(values).replace(/\n+$/, "");
+        return `${parts.join(" ")} <<'EOF'\n${yamlText}\nEOF`;
+    }
+    scanNamespacePvcs(namespace, coreApi) {
+        var _a, _b, _c;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const out = new Map();
+            try {
+                const list = yield coreApi.listNamespacedPersistentVolumeClaim({ namespace });
+                for (const pvc of (_a = list.items) !== null && _a !== void 0 ? _a : []) {
+                    const name = (_b = pvc.metadata) === null || _b === void 0 ? void 0 : _b.name;
+                    if (name)
+                        out.set(name, pvc);
+                }
+            }
+            catch (err) {
+                this.log(`# WARNING: Failed to list PVCs in namespace [${namespace}] (${(_c = err.message) !== null && _c !== void 0 ? _c : err}).`);
+            }
+            return out;
+        });
+    }
+    /** Resolves a PVC's FileStoreType using the cluster-wide StorageClass map, falling back to the PV's CSI driver
+     *  for statically-bound PVCs (storageClassName empty / spec.volumeName set). Returns undefined when no path resolves. */
+    resolveFileStoreType(pvc, storageClassByName, coreApi) {
+        var _a, _b, _c, _d;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const sc = (_a = pvc.spec) === null || _a === void 0 ? void 0 : _a.storageClassName;
+            if (sc && storageClassByName.has(sc)) {
+                const t = this.csiDriverToFileStoreType(storageClassByName.get(sc));
+                if (t)
+                    return t;
+            }
+            const pvName = (_b = pvc.spec) === null || _b === void 0 ? void 0 : _b.volumeName;
+            if (pvName) {
+                try {
+                    const pv = yield coreApi.readPersistentVolume({ name: pvName });
+                    return this.csiDriverToFileStoreType((_d = (_c = pv.spec) === null || _c === void 0 ? void 0 : _c.csi) === null || _d === void 0 ? void 0 : _d.driver);
+                }
+                catch (_e) {
+                    // PV may not exist yet, or RBAC may deny; fall through to undefined.
+                }
+            }
+            return undefined;
+        });
+    }
+    // --------------------------------------------------------------------
+    // Command Generation
+    // --------------------------------------------------------------------
+    buildCabinetCreateCommand(namespace, flags) {
+        const parts = [`codiac cabinet create ${namespace}`];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        if (flags.environment)
+            parts.push(`--environment ${flags.environment}`);
+        if (flags.cluster)
+            parts.push(`--cluster ${flags.cluster}`);
+        parts.push("--silent");
+        return parts.join(" ");
+    }
+    buildAssetCreateCommand(deployment, ingresses, flags) {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        const deploymentName = (_b = (_a = deployment.metadata) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : "unnamed";
+        const containers = (_f = (_e = (_d = (_c = deployment.spec) === null || _c === void 0 ? void 0 : _c.template) === null || _d === void 0 ? void 0 : _d.spec) === null || _e === void 0 ? void 0 : _e.containers) !== null && _f !== void 0 ? _f : [];
+        const firstContainer = containers[0];
+        const hasIngress = ingresses.length > 0;
+        const { registry: registryHost, imageName } = this.parseContainerImage(firstContainer === null || firstContainer === void 0 ? void 0 : firstContainer.image);
+        const firstPort = (_h = (_g = firstContainer === null || firstContainer === void 0 ? void 0 : firstContainer.ports) === null || _g === void 0 ? void 0 : _g[0]) === null || _h === void 0 ? void 0 : _h.containerPort;
+        // `--registry` on `cod asset create` expects the Codiac ImageRegistry CODE (e.g. `devcodiaccontainers`),
+        // not the URL the container puller uses. Map known hostname patterns to codes; unknown patterns become a TODO.
+        const registryInfo = this.toRegistryCode(registryHost);
+        const todoLines = [];
+        if (imageName === "<unknown>") {
+            todoLines.push(`# TODO: container image could not be inferred from the K8s deployment spec for [${deploymentName}]; set --image manually before running.`);
+            this.todoCount++;
+        }
+        if (registryInfo === undefined) {
+            todoLines.push(`# TODO: could not derive a Codiac registry code from container image registry [${registryHost}] for [${deploymentName}]; capture it via \`cod imageRegistry capture\` and add --registry <code> below.`);
+            this.todoCount++;
+        }
+        else if (registryInfo.code !== "DockerHub|official") {
+            // Track non-DockerHub registries so the discovered-registries banner can remind the user to capture them.
+            this.discoveredRegistries.set(registryInfo.code, registryInfo.provider);
+        }
+        const parts = [
+            "codiac asset create",
+            `--name ${deploymentName}`,
+            `--image ${imageName}`,
+        ];
+        if (registryInfo !== undefined) {
+            parts.push(`--registry ${registryInfo.code}`);
+        }
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        if (hasIngress) {
+            parts.push(`--code ${deploymentName}`);
+        }
+        if (firstPort !== undefined) {
+            parts.push(`--port ${firstPort}`);
+        }
+        if (hasIngress) {
+            parts.push("--hasIngress");
+        }
+        parts.push("--silent");
+        const commandLine = parts.join(" ");
+        return todoLines.length > 0 ? `${todoLines.join("\n")}\n${commandLine}` : commandLine;
+    }
+    /** Maps a container-image hostname to the Codiac `ImageRegistry.code` recognised by `cod asset create --registry`.
+     *  Returns `undefined` when the hostname can't be resolved so the caller can emit a TODO comment instead of
+     *  producing a broken command line. Provider hint is paired with the code so the discovered-registries banner
+     *  can render an accurate `cod imageRegistry capture --provider <p> --name <code>` suggestion. */
+    toRegistryCode(host) {
+        if (!host || host === "<unknown>")
+            return undefined;
+        if (host === "docker.io")
+            return { code: "DockerHub|official", provider: "dockerHub" };
+        if (host.endsWith(".azurecr.io")) {
+            const code = host.slice(0, -".azurecr.io".length);
+            return code ? { code, provider: "azure" } : undefined;
+        }
+        return undefined;
+    }
+    buildConfigCommands(deployment, namespace, flags) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const deploymentName = (_b = (_a = deployment.metadata) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : "unnamed";
+        const containers = (_f = (_e = (_d = (_c = deployment.spec) === null || _c === void 0 ? void 0 : _c.template) === null || _d === void 0 ? void 0 : _d.spec) === null || _e === void 0 ? void 0 : _e.containers) !== null && _f !== void 0 ? _f : [];
+        const commands = [];
+        for (const container of containers) {
+            for (const envVar of (_g = container.env) !== null && _g !== void 0 ? _g : []) {
+                const cmd = this.buildConfigCommand(deploymentName, namespace, envVar, flags);
+                commands.push(cmd);
+            }
+        }
+        return commands;
+    }
+    buildConfigCommand(assetName, namespace, envVar, flags) {
+        const settingName = envVar.name;
+        // Direct value
+        if (envVar.value !== undefined) {
+            return this.buildConfigAddEnvCommand(assetName, namespace, settingName, `"${envVar.value.replace(/"/g, '\\"')}"`, flags);
+        }
+        if (envVar.valueFrom) {
+            // Secret reference -> #REF syntax
+            if (envVar.valueFrom.secretKeyRef) {
+                return this.buildSecretRefCommand(assetName, namespace, settingName, envVar.valueFrom.secretKeyRef, flags);
+            }
+            // Field reference -> k8spatch
+            if (envVar.valueFrom.fieldRef) {
+                return this.buildFieldRefPatchCommand(assetName, namespace, settingName, envVar.valueFrom.fieldRef, flags);
+            }
+            // configMapKeyRef / resourceFieldRef -> TODO comments (out of scope)
+            const ref = this.describeEnvVarReference(envVar.valueFrom);
+            const base = this.buildConfigAddEnvBase(assetName, namespace, settingName, flags);
+            this.todoCount++;
+            return `# TODO: ${settingName} - ${ref}\n# ${base} --value "<MANUAL_ENTRY_REQUIRED>"`;
+        }
+        // Empty value
+        return this.buildConfigAddEnvCommand(assetName, namespace, settingName, '""', flags);
+    }
+    /** Builds a standard codiac config add for a direct env value. */
+    buildConfigAddEnvCommand(assetName, namespace, settingName, value, flags) {
+        return `${this.buildConfigAddEnvBase(assetName, namespace, settingName, flags)} --value ${value}`;
+    }
+    /** Builds the base portion of a codiac config add command (without --value). */
+    buildConfigAddEnvBase(assetName, namespace, settingName, flags) {
+        const parts = ["codiac config add --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`-a ${assetName}`, "-t env", `--cabinet=${namespace}`, `--setting ${settingName}`);
+        return parts.join(" ");
+    }
+    /** Builds a codiac config add with #REF|azKeyVault|... for a secretKeyRef env var. */
+    buildSecretRefCommand(assetName, namespace, settingName, secretKeyRef, flags) {
+        var _a, _b, _c;
+        const secretName = (_a = secretKeyRef.name) !== null && _a !== void 0 ? _a : "<unknown>";
+        const secretKey = (_b = secretKeyRef.key) !== null && _b !== void 0 ? _b : "<unknown>";
+        const storeName = (_c = flags["keyvault-name"]) !== null && _c !== void 0 ? _c : secretName;
+        this.discoveredStores.add(storeName);
+        const refValue = `'#REF|azKeyVault|${storeName}|${secretKey}'`;
+        return this.buildConfigAddEnvCommand(assetName, namespace, settingName, refValue, flags);
+    }
+    /** Builds a codiac config set with -t k8spatch for a fieldRef (Downward API) env var. */
+    buildFieldRefPatchCommand(assetName, namespace, settingName, fieldRef, flags) {
+        const parts = ["codiac config set --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`-a ${assetName}`, `-c ${namespace}`, "-t k8spatch", "--setting 'deployment'");
+        const fieldRefObj = {};
+        if (fieldRef.apiVersion)
+            fieldRefObj.apiVersion = fieldRef.apiVersion;
+        fieldRefObj.fieldPath = fieldRef.fieldPath;
+        const patchOp = {
+            op: "add",
+            path: "/spec/template/spec/containers/0/env/-",
+            value: {
+                name: settingName,
+                valueFrom: { fieldRef: fieldRefObj },
+            },
+        };
+        const patchJson = JSON.stringify([patchOp]);
+        const shellEscaped = patchJson.replace(/'/g, "'\\''");
+        parts.push(`--value '${shellEscaped}'`);
+        return parts.join(" ");
+    }
+    /** Builds a codiac secretStore:capture command. When the import was run with --subscription-id, threads
+     *  it through so the generated line resolves the Azure tenant context unambiguously when the operator
+     *  has multiple cached azure subscriptions. */
+    buildSecretStoreCaptureCommand(storeName, flags) {
+        const parts = [`codiac secretStore:capture --silent --name=${storeName} --provider=azure`];
+        if (flags["subscription-id"])
+            parts.push(`--subscription-id=${flags["subscription-id"]}`);
+        return parts.join(" ");
+    }
+    // --------------------------------------------------------------------
+    // Output
+    // --------------------------------------------------------------------
+    outputCommands(groups, helmGroups, flags) {
+        var _a, _b, _c, _d;
+        if (groups.length === 0 && helmGroups.length === 0) {
+            this.log("# No deployments or Helm releases found to import.");
+            return;
+        }
+        this.log("");
+        this.log("# " + "=".repeat(58));
+        this.log("# Generated Import Commands");
+        this.log("# " + "=".repeat(58));
+        if (this.todoCount > 0) {
+            this.log("");
+            this.log("# " + "=".repeat(58));
+            this.log(`# WARNING: ${this.todoCount} TODO item(s) below require manual review before running this script.`);
+            this.log(`# Search for "# TODO:" to find them.`);
+            this.log("# " + "=".repeat(58));
+        }
+        if (this.discoveredRegistries.size > 0) {
+            this.log("");
+            this.log("# --- Image Registries (must already exist in Codiac) ---");
+            this.log("# The asset create commands below reference these registries by code.");
+            this.log("# If any have not yet been captured, run: cod imageRegistry capture --provider <provider> --name <code>");
+            this.log("# Discovered:");
+            const sortedCodes = [...this.discoveredRegistries.keys()].sort();
+            for (const code of sortedCodes) {
+                this.log(`#   - ${code} (provider: ${this.discoveredRegistries.get(code)})`);
+            }
+        }
+        if (flags["generate-secret-store"] && this.discoveredStores.size > 0) {
+            this.log("");
+            this.log("# --- Secret Store Capture ---");
+            for (const store of [...this.discoveredStores].sort()) {
+                this.log(this.buildSecretStoreCaptureCommand(store, flags));
+            }
+        }
+        if (flags["generate-pvcs"] && this.discoveredPvcs.size > 0) {
+            this.log("");
+            this.log("# --- PVC Filestores ---");
+            const sortedNames = [...this.discoveredPvcs.keys()].sort();
+            for (const name of sortedNames) {
+                this.log(this.discoveredPvcs.get(name));
+            }
+        }
+        // Group both raw and helm commands by namespace, then iterate the union so a namespace that contains only
+        // Helm releases (and no raw Deployments) still gets its own section and cabinet line.
+        const groupsByNs = new Map();
+        for (const group of groups) {
+            const list = (_a = groupsByNs.get(group.namespace)) !== null && _a !== void 0 ? _a : [];
+            list.push(group);
+            groupsByNs.set(group.namespace, list);
+        }
+        const helmByNs = new Map();
+        for (const helmGroup of helmGroups) {
+            const list = (_b = helmByNs.get(helmGroup.namespace)) !== null && _b !== void 0 ? _b : [];
+            list.push(helmGroup);
+            helmByNs.set(helmGroup.namespace, list);
+        }
+        const allNamespaces = [...new Set([...groupsByNs.keys(), ...helmByNs.keys()])].sort();
+        for (const namespace of allNamespaces) {
+            this.log("");
+            this.log(`# --- Namespace: ${namespace} ---`);
+            if (flags["generate-cabinet"]) {
+                this.log("");
+                this.log(this.buildCabinetCreateCommand(namespace, flags));
+            }
+            for (const helmGroup of (_c = helmByNs.get(namespace)) !== null && _c !== void 0 ? _c : []) {
+                this.log("");
+                for (const line of helmGroup.lines) {
+                    this.log(line);
+                }
+            }
+            for (const group of (_d = groupsByNs.get(namespace)) !== null && _d !== void 0 ? _d : []) {
+                this.log("");
+                this.log(group.assetCommand);
+                for (const cmd of group.configCommands) {
+                    this.log(cmd);
+                }
+                for (const cmd of group.volumeMountCommands) {
+                    this.log(cmd);
+                }
+                for (const cmd of group.filestoreBindCommands) {
+                    this.log(cmd);
+                }
+            }
+        }
+        this.log("");
+    }
+    // --------------------------------------------------------------------
+    // K8s Matching Logic
+    // --------------------------------------------------------------------
+    findServicesForDeployment(deployment, services) {
+        var _a, _b, _c, _d;
+        const podLabels = (_d = (_c = (_b = (_a = deployment.spec) === null || _a === void 0 ? void 0 : _a.template) === null || _b === void 0 ? void 0 : _b.metadata) === null || _c === void 0 ? void 0 : _c.labels) !== null && _d !== void 0 ? _d : {};
+        return services.filter(service => {
+            var _a, _b;
+            const selector = (_b = (_a = service.spec) === null || _a === void 0 ? void 0 : _a.selector) !== null && _b !== void 0 ? _b : {};
+            if (Object.keys(selector).length === 0)
+                return false;
+            return Object.entries(selector).every(([key, value]) => podLabels[key] === value);
+        });
+    }
+    findIngressesForServices(services, ingresses) {
+        const serviceNames = new Set(services.map(s => { var _a; return (_a = s.metadata) === null || _a === void 0 ? void 0 : _a.name; }).filter(Boolean));
+        return ingresses.filter(ingress => {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const defaultBackend = (_c = (_b = (_a = ingress.spec) === null || _a === void 0 ? void 0 : _a.defaultBackend) === null || _b === void 0 ? void 0 : _b.service) === null || _c === void 0 ? void 0 : _c.name;
+            if (defaultBackend && serviceNames.has(defaultBackend))
+                return true;
+            for (const rule of (_e = (_d = ingress.spec) === null || _d === void 0 ? void 0 : _d.rules) !== null && _e !== void 0 ? _e : []) {
+                for (const path of (_g = (_f = rule.http) === null || _f === void 0 ? void 0 : _f.paths) !== null && _g !== void 0 ? _g : []) {
+                    if (((_j = (_h = path.backend) === null || _h === void 0 ? void 0 : _h.service) === null || _j === void 0 ? void 0 : _j.name) && serviceNames.has(path.backend.service.name))
+                        return true;
+                }
+            }
+            return false;
+        });
+    }
+    // --------------------------------------------------------------------
+    // Image Parsing
+    // --------------------------------------------------------------------
+    parseContainerImage(image) {
+        if (!image) {
+            return { registry: "<unknown>", imageName: "<unknown>" };
+        }
+        const imageWithoutTag = image.split(":")[0];
+        const parts = imageWithoutTag.split("/");
+        if (parts.length === 1) {
+            return { registry: "docker.io", imageName: parts[0] };
+        }
+        else if (parts.length === 2) {
+            if (parts[0].includes(".") || parts[0].includes(":")) {
+                return { registry: parts[0], imageName: parts[1] };
+            }
+            return { registry: "docker.io", imageName: parts[1] };
+        }
+        return { registry: parts[0], imageName: parts[parts.length - 1] };
+    }
+    // --------------------------------------------------------------------
+    // Env Var Reference Description (for unsupported types)
+    // --------------------------------------------------------------------
+    describeEnvVarReference(valueFrom) {
+        var _a, _b, _c, _d;
+        if (valueFrom.configMapKeyRef) {
+            return `Value from ConfigMap "${(_a = valueFrom.configMapKeyRef.name) !== null && _a !== void 0 ? _a : "<unknown>"}", key "${(_b = valueFrom.configMapKeyRef.key) !== null && _b !== void 0 ? _b : "<unknown>"}"`;
+        }
+        if (valueFrom.resourceFieldRef) {
+            return `Value from container "${(_c = valueFrom.resourceFieldRef.containerName) !== null && _c !== void 0 ? _c : "<current>"}" resource "${(_d = valueFrom.resourceFieldRef.resource) !== null && _d !== void 0 ? _d : "<unknown>"}"`;
+        }
+        return "Value from unknown reference type";
+    }
+    // --------------------------------------------------------------------
+    // PVC Discovery & Emission
+    // --------------------------------------------------------------------
+    /** Maps a CSI driver name (or legacy in-tree provisioner) to the Codiac FileStoreType
+     *  recognised by `cod pvc create`. Returns undefined when the driver is unknown so the
+     *  caller can emit a TODO comment instead of guessing. */
+    csiDriverToFileStoreType(driver) {
+        switch (driver) {
+            case "file.csi.azure.com": return contracts_1.FileStoreTypeEnum.azureFileStorage;
+            case "disk.csi.azure.com":
+            case "kubernetes.io/azure-disk": return contracts_1.FileStoreTypeEnum.azureDisk;
+            case "blob.csi.azure.com": return contracts_1.FileStoreTypeEnum.azureBlobStorage;
+            case "netapp.csi.azure.com": return contracts_1.FileStoreTypeEnum.azureNetAppFiles;
+            default: return undefined;
+        }
+    }
+    /** Walks a deployment's pod template to find every container volumeMount backed by a PVC
+     *  in `pvcsInNs`. Returns one entry per matched (volume, container) pair. */
+    findPvcMountsForDeployment(deployment, pvcsInNs) {
+        var _a, _b, _c, _d, _e, _f;
+        const podSpec = (_b = (_a = deployment.spec) === null || _a === void 0 ? void 0 : _a.template) === null || _b === void 0 ? void 0 : _b.spec;
+        const volumes = (_c = podSpec === null || podSpec === void 0 ? void 0 : podSpec.volumes) !== null && _c !== void 0 ? _c : [];
+        const containers = (_d = podSpec === null || podSpec === void 0 ? void 0 : podSpec.containers) !== null && _d !== void 0 ? _d : [];
+        const out = [];
+        for (const vol of volumes) {
+            const claimName = (_e = vol.persistentVolumeClaim) === null || _e === void 0 ? void 0 : _e.claimName;
+            if (!claimName || !pvcsInNs.has(claimName))
+                continue;
+            for (const container of containers) {
+                for (const vm of (_f = container.volumeMounts) !== null && _f !== void 0 ? _f : []) {
+                    if (vm.name === vol.name && vm.mountPath) {
+                        out.push({ volName: vol.name, mountPath: vm.mountPath, k8sPvcName: claimName });
+                    }
+                }
+            }
+        }
+        return out;
+    }
+    /** Builds the enterprise-scoped `codiac pvc create` line. When the FileStoreType could not
+     *  be inferred, prepends a TODO comment line so the user is forced to set `--type` manually. */
+    buildPvcCreateCommand(prefixedPvcName, pvc, type, flags) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const parts = ["codiac pvc create --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`--name ${prefixedPvcName}`);
+        parts.push(`--provider azure`);
+        if (type)
+            parts.push(`--type ${type}`);
+        const storageClassName = (_a = pvc.spec) === null || _a === void 0 ? void 0 : _a.storageClassName;
+        if (storageClassName)
+            parts.push(`--storage-class ${storageClassName}`);
+        const modes = (_c = (_b = pvc.spec) === null || _b === void 0 ? void 0 : _b.accessModes) !== null && _c !== void 0 ? _c : [];
+        if (modes.length > 0)
+            parts.push(`--access-modes ${modes.join(",")}`);
+        const size = (_f = (_e = (_d = pvc.spec) === null || _d === void 0 ? void 0 : _d.resources) === null || _e === void 0 ? void 0 : _e.requests) === null || _f === void 0 ? void 0 : _f.storage;
+        if (size)
+            parts.push(`--size ${size}`);
+        if ((_g = pvc.spec) === null || _g === void 0 ? void 0 : _g.volumeName)
+            parts.push(`--volume-name ${pvc.spec.volumeName}`);
+        const line = parts.join(" ");
+        if (!type) {
+            const sc = storageClassName !== null && storageClassName !== void 0 ? storageClassName : "<none>";
+            this.todoCount++;
+            return `# TODO: --type could not be inferred (storageClass=${sc}); set it manually before running.\n${line}`;
+        }
+        return line;
+    }
+    /** Builds the asset-scoped `codiac asset volume create` line. The mountPath is a positional arg. */
+    buildAssetVolumeCreateCommand(assetName, volName, mountPath, flags) {
+        const parts = ["codiac asset volume create --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`--asset ${assetName}`);
+        parts.push(`--name ${volName}`);
+        parts.push(mountPath);
+        // Auto-description so reviewers can later audit where each volume mount originated.
+        // Defensive escape of any embedded double-quotes (K8s names are DNS-safe so this is belt-and-suspenders).
+        const description = `Imported from K8s deployment ${assetName}, volume ${volName}, mount ${mountPath}`.replace(/"/g, '\\"');
+        parts.push(`--description "${description}"`);
+        return parts.join(" ");
+    }
+    /** Builds the cabinet-scoped `codiac config add -t filestore` line that binds an asset's reserved
+     *  folder (declared by `asset volume create`) to the FileStoreDef (created by `pvc create`). */
+    buildFilestoreBindCommand(assetName, namespace, volName, prefixedPvcName, flags) {
+        const parts = ["codiac config add --silent"];
+        if (flags.enterprise)
+            parts.push(`--enterprise ${flags.enterprise}`);
+        parts.push(`-a ${assetName}`, `-c ${namespace}`, "-t filestore", `--setting ${volName}`, `--value ${prefixedPvcName}`);
+        return parts.join(" ");
+    }
+}
+exports.default = ImportCluster;
+ImportCluster.description = 'Scans all deployments in the current Kubernetes cluster and generates the Codiac CLI commands to import them.';
+ImportCluster.examples = [
+    '<%= config.bin %> <%= command.id %> --run-in-cluster',
+    '<%= config.bin %> <%= command.id %> --run-in-cluster --enterprise myco --environment dev --cluster mycluster --generate-cabinet --generate-secret-store',
+    '<%= config.bin %> <%= command.id %> --run-in-cluster --enterprise myco --environment dev --cluster mycluster --generate-pvcs --generate-volume-mounts',
+    '<%= config.bin %> <%= command.id %> --run-in-cluster --enterprise myco --environment dev --cluster mycluster --generate-cabinet --generate-secret-store --subscription-id 00000000-0000-0000-0000-000000000000',
+];
+ImportCluster.flags = {
+    "run-in-cluster": core_1.Flags.boolean({ description: 'Run using in-cluster Kubernetes config (service account). Required for headless/pod execution.' }),
+    enterprise: core_1.Flags.string({ description: 'Enterprise code to include in generated commands.' }),
+    environment: core_1.Flags.string({ description: 'Environment name to include in generated commands (required by --generate-cabinet).' }),
+    cluster: core_1.Flags.string({ description: 'Cluster name to include in generated cabinet create commands (required by --generate-cabinet).' }),
+    "subscription-id": core_1.Flags.string({ char: 's', description: 'Cloud subscription containing the source cluster; threaded into generated secretStore:capture commands so they run silently in multi-subscription tenants.' }),
+    "generate-cabinet": core_1.Flags.boolean({ description: 'Include codiac cabinet create commands in the output (one per namespace). Requires --enterprise, --environment, and --cluster.' }),
+    "generate-secret-store": core_1.Flags.boolean({ description: 'Include codiac secretStore:capture commands in the output for discovered Azure Key Vaults.' }),
+    "generate-pvcs": core_1.Flags.boolean({ description: 'Include codiac pvc create commands (enterprise-scope) plus codiac config add -t filestore bindings for every PersistentVolumeClaim mounted by a discovered deployment.' }),
+    "generate-volume-mounts": core_1.Flags.boolean({ description: 'Include codiac asset volume create commands for every container volumeMount backed by a PVC on a discovered deployment.' }),
+    "include-default": core_1.Flags.boolean({ description: 'Include the "default" namespace (excluded by default).' }),
+    "keyvault-name": core_1.Flags.string({ description: 'Azure Key Vault name to use in generated secret references. When omitted, the K8s Secret name is used as a placeholder.' }),
+};
+//# sourceMappingURL=cluster.js.map