@intentius/chant-lexicon-k3s 0.44.3

package/src/generated/index.d.ts

@@ -0,0 +1,370 @@
+// Code generated by chant k3s generate. DO NOT EDIT.
+
+// --- k3s Entity classes ---
+
+export declare class Agent {
+  constructor(props: {
+    /** (cluster) Server to connect to */
+    server: string;
+    /** (logging) Log to standard error as well as file (if set) */
+    alsologtostderr?: boolean;
+    /** (listener)  bind address (default: 0.0.0.0) */
+    "bind-address"?: string;
+    /** (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path */
+    "container-runtime-endpoint"?: string;
+    /** (agent/data) Folder to hold state */
+    "data-dir"?: string;
+    /** (logging) Turn on debug logs */
+    debug?: boolean;
+    /** (agent/runtime) Set the default runtime in containerd */
+    "default-runtime"?: string;
+    /** (agent/networking) (experimental) Disable the agent's client-side load-balancer and connect directly to the configured server address */
+    "disable-apiserver-lb"?: boolean;
+    /** (agent/containerd) Disables containerd's fallback default registry endpoint when a mirror is configured for that registry */
+    "disable-default-registry-endpoint"?: boolean;
+    /** (agent/runtime) (experimental) Use cri-dockerd instead of containerd */
+    docker?: boolean;
+    /** (experimental) Enable pprof endpoint on supervisor port */
+    "enable-pprof"?: boolean;
+    /** (agent/networking) Override default flannel cni config file */
+    "flannel-cni-conf"?: string;
+    /** (agent/networking) Override default flannel config file */
+    "flannel-conf"?: string;
+    /** (agent/networking) Override default flannel interface */
+    "flannel-iface"?: string;
+    /** (agent/node) The path to the directory where credential provider plugin binaries are located (default: /var/lib/rancher/credentialprovider/bin) */
+    "image-credential-provider-bin-dir"?: string;
+    /** (agent/node) The path to the credential provider plugin config file (default: /var/lib/rancher/credentialprovider/config.yaml) */
+    "image-credential-provider-config"?: string;
+    /** (agent/runtime) Disable embedded containerd image service and use remote image service socket at the given path. If not specified, defaults to --container-runtime-endpoint. */
+    "image-service-endpoint"?: string;
+    /** (agent/flags) Customized flag for kube-proxy process */
+    "kube-proxy-arg"?: string | string[];
+    /** (agent/flags) Customized flag for kubelet process */
+    "kubelet-arg"?: string | string[];
+    /** (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444) */
+    "lb-server-port"?: number;
+    /** (logging) Log to file */
+    log?: string;
+    /** (agent/networking) external DNS addresses to advertise for node */
+    "node-external-dns"?: string | string[];
+    /** (agent/networking) IPv4/IPv6 external IP addresses to advertise for node */
+    "node-external-ip"?: string | string[];
+    /** (agent/networking) internal DNS addresses to advertise for node */
+    "node-internal-dns"?: string | string[];
+    /** (agent/networking) IPv4/IPv6 addresses to advertise for node */
+    "node-ip"?: string | string[];
+    /** (agent/node) Registering and starting kubelet with set of labels */
+    "node-label"?: string | string[];
+    /** (agent/node) Node name */
+    "node-name"?: string;
+    /** (agent/node) Registering kubelet with set of taints */
+    "node-taint"?: string | string[];
+    /** (agent/containerd) Allows non-root pods to access devices by setting device_ownership_from_security_context=true in the containerd CRI config */
+    "nonroot-devices"?: boolean;
+    /** (agent/runtime) Customized pause image for containerd or docker sandbox (default: rancher/mirrored-pause:3.10.2) */
+    "pause-image"?: string;
+    /** (experimental) Prefer bundled userspace binaries over host binaries */
+    "prefer-bundled-bin"?: boolean;
+    /** (agent/runtime) Private registry configuration file */
+    "private-registry"?: string;
+    /** (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults. */
+    "protect-kernel-defaults"?: boolean;
+    /** (agent/networking) Kubelet resolv.conf file */
+    "resolv-conf"?: string;
+    /** (experimental) Run rootless */
+    rootless?: boolean;
+    /** (agent/node) Enable SELinux in containerd */
+    selinux?: boolean;
+    /** (agent/runtime) Override default containerd snapshotter */
+    snapshotter?: string;
+    /** (cluster) Token file to use for authentication */
+    "token-file"?: string;
+    /** (logging) Number for the log level verbosity */
+    v?: number;
+    /** (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging */
+    vmodule?: string;
+    /** (agent/networking) (experimental) Credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] */
+    "vpn-auth"?: string;
+    /** (agent/networking) (experimental) File containing credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] */
+    "vpn-auth-file"?: string;
+    /** (agent/node) Append id to node name */
+    "with-node-id"?: boolean;
+  });
+}
+
+export declare class Mirror {
+  constructor(props: {
+    /** Mirror endpoint URLs, tried in order */
+    endpoint?: string | string[];
+    /** Image name rewrite rules (regex to replacement) */
+    rewrite?: Record<string, string>;
+  });
+}
+
+export declare class Registries {
+  constructor(props: {
+    /** Registry endpoint to auth/TLS configuration */
+    configs?: Record<string, RegistryConfig>;
+    /** Registry name (or wildcard) to mirror configuration */
+    mirrors?: Record<string, Mirror>;
+  });
+}
+
+export declare class RegistryAuth {
+  constructor(props: {
+    /** Basic auth password. A literal here fails K3SC002 */
+    password?: string;
+    /** Bearer token. A literal here fails K3SC002 */
+    token?: string;
+    /** Basic auth username */
+    username?: string;
+  });
+}
+
+export declare class RegistryConfig {
+  constructor(props: {
+    /** Credentials for the registry */
+    auth?: RegistryAuth;
+    /** TLS settings for the registry */
+    tls?: RegistryTLS;
+  });
+}
+
+export declare class RegistryTLS {
+  constructor(props: {
+    /** CA bundle path on the node */
+    ca_file?: string;
+    /** Client certificate path on the node */
+    cert_file?: string;
+    /** Skip TLS verification. K3SS002 flags this */
+    insecure_skip_verify?: boolean;
+    /** Client key path on the node */
+    key_file?: string;
+  });
+}
+
+export declare class Server {
+  constructor(props: {
+    /** (listener) IPv4/IPv6 address that apiserver uses to advertise to members of the cluster (default: node-external-ip/node-ip) */
+    "advertise-address"?: string;
+    /** (listener) Port that apiserver uses to advertise to members of the cluster (default: https-listen-port) */
+    "advertise-port"?: number;
+    /** (cluster) File containing the agent secret */
+    "agent-token-file"?: string;
+    /** (logging) Log to standard error as well as file (if set) */
+    alsologtostderr?: boolean;
+    /** (listener)  bind address (default: 0.0.0.0) */
+    "bind-address"?: string;
+    /** (networking) IPv4/IPv6 network CIDRs to use for pod IPs (default: 10.42.0.0/16) */
+    "cluster-cidr"?: string | string[];
+    /** (networking) IPv4/IPv6 Cluster IP for coredns service. Should be in your service-cidr range (default: 10.43.0.10) */
+    "cluster-dns"?: string | string[];
+    /** (networking) Cluster Domain (default: cluster.local) */
+    "cluster-domain"?: string;
+    /** (cluster) Initialize a new cluster using embedded Etcd */
+    "cluster-init"?: boolean;
+    /** (cluster) Forget all peers and become sole member of a new cluster */
+    "cluster-reset"?: boolean;
+    /** (db) Path to snapshot file to be restored */
+    "cluster-reset-restore-path"?: string;
+    /** (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path */
+    "container-runtime-endpoint"?: string;
+    /** (data) Folder to hold state default /var/lib/rancher/ or ${HOME}/.rancher/ if not root */
+    "data-dir"?: string;
+    /** (db) TLS Certificate Authority file used to secure datastore backend communication */
+    "datastore-cafile"?: string;
+    /** (db) TLS certification file used to secure datastore backend communication */
+    "datastore-certfile"?: string;
+    /** (db) Specify etcd, NATS, MySQL, Postgres, or SQLite (default) data source name */
+    "datastore-endpoint"?: string;
+    /** (db) TLS key file used to secure datastore backend communication */
+    "datastore-keyfile"?: string;
+    /** (logging) Turn on debug logs */
+    debug?: boolean;
+    /** (storage) Default local storage path for local provisioner storage class */
+    "default-local-storage-path"?: string;
+    /** (agent/runtime) Set the default runtime in containerd */
+    "default-runtime"?: string;
+    /** (components) Do not deploy packaged components and delete any deployed components (valid values: ) */
+    disable?: string | string[];
+    /** (components) Disable  default cloud controller manager */
+    "disable-cloud-controller"?: boolean;
+    /** (agent/containerd) Disables containerd's fallback default registry endpoint when a mirror is configured for that registry */
+    "disable-default-registry-endpoint"?: boolean;
+    /** (components) Disable Helm controller */
+    "disable-helm-controller"?: boolean;
+    /** (components) Disable running kube-proxy */
+    "disable-kube-proxy"?: boolean;
+    /** (components) Disable  default network policy controller */
+    "disable-network-policy"?: boolean;
+    /** (components) Disable Kubernetes default scheduler */
+    "disable-scheduler"?: boolean;
+    /** (agent/runtime) (experimental) Use cri-dockerd instead of containerd */
+    docker?: boolean;
+    /** (networking) One of 'agent', 'cluster', 'pod', 'disabled' (default: agent) */
+    "egress-selector-mode"?: string;
+    /** (components) Enable embedded distributed container registry; requires use of embedded containerd; when enabled agents will also listen on the supervisor port */
+    "embedded-registry"?: boolean;
+    /** (experimental) Enable pprof endpoint on supervisor port */
+    "enable-pprof"?: boolean;
+    /** (flags) Customized flag for etcd process */
+    "etcd-arg"?: string | string[];
+    /** (db) Disable automatic etcd snapshots */
+    "etcd-disable-snapshots"?: boolean;
+    /** (db) Expose etcd metrics to client interface */
+    "etcd-expose-metrics"?: boolean;
+    /** (db) Enable backup to S3 */
+    "etcd-s3"?: boolean;
+    /** (db) S3 access key */
+    "etcd-s3-access-key"?: string;
+    /** (db) S3 bucket name */
+    "etcd-s3-bucket"?: string;
+    /** (db) S3 bucket lookup type, one of 'auto', 'dns', 'path'; default is 'auto' if not set */
+    "etcd-s3-bucket-lookup-type"?: string;
+    /** (db) Name of secret in the kube-system namespace used to configure S3, if etcd-s3 is enabled and no other etcd-s3 options are set */
+    "etcd-s3-config-secret"?: string;
+    /** (db) S3 endpoint url (default: s3.amazonaws.com) */
+    "etcd-s3-endpoint"?: string;
+    /** (db) S3 custom CA cert to connect to S3 endpoint */
+    "etcd-s3-endpoint-ca"?: string;
+    /** (db) S3 folder */
+    "etcd-s3-folder"?: string;
+    /** (db) Disables S3 over HTTPS */
+    "etcd-s3-insecure"?: boolean;
+    /** (db) Proxy server to use when connecting to S3, overriding any proxy-releated environment variables */
+    "etcd-s3-proxy"?: string;
+    /** (db) S3 region / bucket location (optional) (default: us-east-1) */
+    "etcd-s3-region"?: string;
+    /** (db) S3 retention limit */
+    "etcd-s3-retention"?: number;
+    /** (db) S3 secret key */
+    "etcd-s3-secret-key"?: string;
+    /** (db) S3 session token */
+    "etcd-s3-session-token"?: string;
+    /** (db) Disables S3 SSL certificate validation */
+    "etcd-s3-skip-ssl-verify"?: boolean;
+    /** (db) S3 timeout */
+    "etcd-s3-timeout"?: string;
+    /** (db) Compress etcd snapshot */
+    "etcd-snapshot-compress"?: boolean;
+    /** (db) Directory to save db snapshots. (default: ${data-dir}/server/db/snapshots) */
+    "etcd-snapshot-dir"?: string;
+    /** (db) Set the base name of etcd snapshots, appended with UNIX timestamp (default: etcd-snapshot) */
+    "etcd-snapshot-name"?: string;
+    /** (db) Snapshot reconcile interval */
+    "etcd-snapshot-reconcile-interval"?: string;
+    /** (db) Number of snapshots to retain */
+    "etcd-snapshot-retention"?: number;
+    /** (db) Snapshot interval time in cron spec. eg. every 5 hours '0 *\/5 * * *' (default: 0 *\/12 * * *) */
+    "etcd-snapshot-schedule-cron"?: string;
+    /** (networking) Backend (valid values: 'none', 'vxlan', 'host-gw', 'wireguard-native' (default: vxlan) */
+    "flannel-backend"?: string;
+    /** (agent/networking) Override default flannel cni config file */
+    "flannel-cni-conf"?: string;
+    /** (agent/networking) Override default flannel config file */
+    "flannel-conf"?: string;
+    /** (networking) Use node external IP addresses for Flannel traffic */
+    "flannel-external-ip"?: boolean;
+    /** (agent/networking) Override default flannel interface */
+    "flannel-iface"?: string;
+    /** (networking) Enable IPv6 masquerading for pod */
+    "flannel-ipv6-masq"?: boolean;
+    /** (flags) Customized flag for helm-controller process */
+    "helm-controller-arg"?: string | string[];
+    /** (listener) HTTPS listen port (default: 6443) */
+    "https-listen-port"?: number;
+    /** (agent/node) The path to the directory where credential provider plugin binaries are located (default: /var/lib/rancher/credentialprovider/bin) */
+    "image-credential-provider-bin-dir"?: string;
+    /** (agent/node) The path to the credential provider plugin config file (default: /var/lib/rancher/credentialprovider/config.yaml) */
+    "image-credential-provider-config"?: string;
+    /** (agent/runtime) Disable embedded containerd image service and use remote image service socket at the given path. If not specified, defaults to --container-runtime-endpoint. */
+    "image-service-endpoint"?: string;
+    /** (flags) Customized flag for kube-apiserver process */
+    "kube-apiserver-arg"?: string | string[];
+    /** (flags) Customized flag for kube-cloud-controller-manager process */
+    "kube-cloud-controller-manager-arg"?: string | string[];
+    /** (flags) Customized flag for kube-controller-manager process */
+    "kube-controller-manager-arg"?: string | string[];
+    /** (agent/flags) Customized flag for kube-proxy process */
+    "kube-proxy-arg"?: string | string[];
+    /** (flags) Customized flag for kube-scheduler process */
+    "kube-scheduler-arg"?: string | string[];
+    /** (agent/flags) Customized flag for kubelet process */
+    "kubelet-arg"?: string | string[];
+    /** (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444) */
+    "lb-server-port"?: number;
+    /** (logging) Log to file */
+    log?: string;
+    /** (agent/networking) external DNS addresses to advertise for node */
+    "node-external-dns"?: string | string[];
+    /** (agent/networking) IPv4/IPv6 external IP addresses to advertise for node */
+    "node-external-ip"?: string | string[];
+    /** (agent/networking) internal DNS addresses to advertise for node */
+    "node-internal-dns"?: string | string[];
+    /** (agent/networking) IPv4/IPv6 addresses to advertise for node */
+    "node-ip"?: string | string[];
+    /** (agent/node) Registering and starting kubelet with set of labels */
+    "node-label"?: string | string[];
+    /** (agent/node) Node name */
+    "node-name"?: string;
+    /** (agent/node) Registering kubelet with set of taints */
+    "node-taint"?: string | string[];
+    /** (agent/containerd) Allows non-root pods to access devices by setting device_ownership_from_security_context=true in the containerd CRI config */
+    "nonroot-devices"?: boolean;
+    /** (agent/runtime) Customized pause image for containerd or docker sandbox (default: rancher/mirrored-pause:3.10.2) */
+    "pause-image"?: string;
+    /** (experimental) Prefer bundled userspace binaries over host binaries */
+    "prefer-bundled-bin"?: boolean;
+    /** (agent/runtime) Private registry configuration file */
+    "private-registry"?: string;
+    /** (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults. */
+    "protect-kernel-defaults"?: boolean;
+    /** (agent/networking) Kubelet resolv.conf file */
+    "resolv-conf"?: string;
+    /** (experimental) Run rootless */
+    rootless?: boolean;
+    /** Enable secret encryption at rest */
+    "secrets-encryption"?: boolean;
+    /** (experimental) Secret encryption provider (valid values: 'aescbc', 'secretbox') (default: aescbc) */
+    "secrets-encryption-provider"?: string;
+    /** (agent/node) Enable SELinux in containerd */
+    selinux?: boolean;
+    /** (cluster) Server to connect to, used to join a cluster */
+    server?: string;
+    /** (networking) IPv4/IPv6 network CIDRs to use for service IPs (default: 10.43.0.0/16) */
+    "service-cidr"?: string | string[];
+    /** (networking) Port range to reserve for services with NodePort visibility (default: 30000-32767) */
+    "service-node-port-range"?: string;
+    /** (networking) Namespace of the pods for the servicelb component (default: kube-system) */
+    "servicelb-namespace"?: string;
+    /** (agent/runtime) Override default containerd snapshotter */
+    snapshotter?: string;
+    /** (experimental/components) Enable serving  internal metrics on the supervisor port; when enabled agents will also listen on the supervisor port */
+    "supervisor-metrics"?: boolean;
+    /** (agent/runtime) Private registry to be used for all system images */
+    "system-default-registry"?: string;
+    /** (listener) Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert */
+    "tls-san"?: string | string[];
+    /** (listener) Protect the server TLS cert by refusing to add Subject Alternative Names not associated with the kubernetes apiserver service, server nodes, or values of the tls-san option (default: true) (default: true) */
+    "tls-san-security"?: boolean;
+    /** (cluster) File containing the token */
+    "token-file"?: string;
+    /** (logging) Number for the log level verbosity */
+    v?: number;
+    /** (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging */
+    vmodule?: string;
+    /** (agent/networking) (experimental) Credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] */
+    "vpn-auth"?: string;
+    /** (agent/networking) (experimental) File containing credentials for the VPN provider. It must include the provider name and join key in the format name=<vpn-provider>,joinKey=<key>[,controlServerURL=<url>][,extraArgs=<args>] */
+    "vpn-auth-file"?: string;
+    /** (agent/node) Append id to node name */
+    "with-node-id"?: boolean;
+    /** (client) Write kubeconfig for admin client to this file */
+    "write-kubeconfig"?: string;
+    /** (client) Write kubeconfig with this group */
+    "write-kubeconfig-group"?: string;
+    /** (client) Write kubeconfig with this mode */
+    "write-kubeconfig-mode"?: string;
+  });
+}

package/src/generated/index.ts

@@ -0,0 +1,13 @@
+// Code generated by chant generate. DO NOT EDIT.
+import { createResource, createProperty } from "./runtime";
+
+export const Agent = createResource("K3s::Agent", "k3s", {});
+export const Registries = createResource("K3s::Registries", "k3s", {});
+export const Server = createResource("K3s::Server", "k3s", {});
+
+export const Mirror = createProperty("K3s::Mirror", "k3s");
+export const RegistryAuth = createProperty("K3s::RegistryAuth", "k3s");
+export const RegistryConfig = createProperty("K3s::RegistryConfig", "k3s");
+export const RegistryTLS = createProperty("K3s::RegistryTLS", "k3s");
+
+// Re-exports for convenience

package/src/generated/lexicon-k3s.json

@@ -0,0 +1,37 @@
+{
+  "Agent": {
+    "resourceType": "K3s::Agent",
+    "kind": "resource",
+    "lexicon": "k3s"
+  },
+  "Mirror": {
+    "resourceType": "K3s::Mirror",
+    "kind": "property",
+    "lexicon": "k3s"
+  },
+  "Registries": {
+    "resourceType": "K3s::Registries",
+    "kind": "resource",
+    "lexicon": "k3s"
+  },
+  "RegistryAuth": {
+    "resourceType": "K3s::RegistryAuth",
+    "kind": "property",
+    "lexicon": "k3s"
+  },
+  "RegistryConfig": {
+    "resourceType": "K3s::RegistryConfig",
+    "kind": "property",
+    "lexicon": "k3s"
+  },
+  "RegistryTLS": {
+    "resourceType": "K3s::RegistryTLS",
+    "kind": "property",
+    "lexicon": "k3s"
+  },
+  "Server": {
+    "resourceType": "K3s::Server",
+    "kind": "resource",
+    "lexicon": "k3s"
+  }
+}

package/src/generated/runtime.ts

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/src/index.ts

@@ -0,0 +1,11 @@
+// Plugin
+export { k3sPlugin } from "./plugin";
+
+// Serializer
+export { k3sSerializer } from "./serializer";
+
+// Generated resources — export everything from generated index
+export * from "./generated/index";
+
+// The pinned upstream release and its Docker image tag form
+export { K3S_VERSION, K3S_IMAGE_TAG } from "./spec/fetch";

package/src/lint/audit-catalog.ts

@@ -0,0 +1,53 @@
+/**
+ * The k3s lexicon's chant audit catalog — metadata for its post-synth
+ * checks, contributed via k3sPlugin.auditCatalog() (#687, #1346). Every
+ * post-synth check has an entry, or the check contributes nothing to
+ * `chant audit`, silently.
+ *
+ * All five checks read the chant model (`ctx.entities`) rather than the
+ * emitted YAML — an emitted config.yaml carries no marker naming its own
+ * role — so every entry is constructed directly with `yamlBased: false`.
+ */
+import type { RuleMeta } from "@intentius/chant/audit/catalog";
+
+function entityRule(
+  id: string,
+  category: RuleMeta["category"],
+  title: string,
+  remediation: string,
+): RuleMeta {
+  return { id, tier: "merge-worthy", fixKind: "guidance", category, title, remediation, yamlBased: false };
+}
+
+export const k3sAuditCatalog: Record<string, RuleMeta> = {
+  K3S101: entityRule(
+    "K3S101",
+    "security",
+    "Literal join token in a k3s config",
+    "Remove the `token` value; point `token-file` at a path on the host instead.",
+  ),
+  K3S102: entityRule(
+    "K3S102",
+    "security",
+    "Literal registry credential in registries.yaml",
+    "Remove the credential from the declaration; configure registry auth on the host.",
+  ),
+  K3S103: entityRule(
+    "K3S103",
+    "correctness",
+    "Agent config with no server to join",
+    "Set `server: https://<server-host>:6443` on the agent declaration.",
+  ),
+  K3S104: entityRule(
+    "K3S104",
+    "security",
+    "Kubeconfig written wider than 0644",
+    "Drop `write-kubeconfig-mode`, or keep it at 0600/0644.",
+  ),
+  K3S105: entityRule(
+    "K3S105",
+    "security",
+    "Registry TLS verification disabled",
+    "Remove `insecure_skip_verify`; pin the registry CA via `ca_file`.",
+  ),
+};

package/src/lint/post-synth/index.ts

@@ -0,0 +1,15 @@
+// Code generated by chant generate. DO NOT EDIT.
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { k3s101 } from "./k3s101";
+import { k3s102 } from "./k3s102";
+import { k3s103 } from "./k3s103";
+import { k3s104 } from "./k3s104";
+import { k3s105 } from "./k3s105";
+
+export const postSynthChecks: PostSynthCheck[] = [
+  k3s101,
+  k3s102,
+  k3s103,
+  k3s104,
+  k3s105,
+];

package/src/lint/post-synth/k3s-helpers.ts

@@ -0,0 +1,34 @@
+/**
+ * Shared helpers for the k3s post-synth checks.
+ *
+ * These checks read the chant model (`ctx.entities`), not the emitted
+ * YAML: an emitted config.yaml carries no marker naming its own role, so
+ * the entity type is the only honest way to know a document is a server
+ * config, an agent config, or a registries file. The audit catalog marks
+ * every entity-based check `yamlBased: false` accordingly.
+ */
+
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+
+export interface K3sEntity {
+  name: string;
+  entityType: string;
+  props: Record<string, unknown>;
+}
+
+/** Every declared k3s entity of one type, with its props. */
+export function entitiesOfType(ctx: PostSynthContext, entityType: string): K3sEntity[] {
+  const out: K3sEntity[] = [];
+  for (const [name, entity] of ctx.entities) {
+    const e = entity as { entityType?: string; props?: unknown };
+    if (e.entityType !== entityType) continue;
+    const props =
+      typeof e.props === "object" && e.props !== null ? (e.props as Record<string, unknown>) : {};
+    out.push({ name, entityType, props });
+  }
+  return out;
+}
+
+export function configEntities(ctx: PostSynthContext): K3sEntity[] {
+  return [...entitiesOfType(ctx, "K3s::Server"), ...entitiesOfType(ctx, "K3s::Agent")];
+}

package/src/lint/post-synth/k3s101.ts

@@ -0,0 +1,58 @@
+/**
+ * K3S101: a literal join token reached the build.
+ *
+ * The typed surface omits `token` / `agent-token` (#1601) and K3S001
+ * catches the literal at source. This is the backstop for the path both
+ * miss: a raw prop object built at runtime, spread in, or emitted by a
+ * composite. If the key is present with a non-empty string value in the
+ * entity the build serialized, the emitted config.yaml carries the
+ * cluster's join secret, and the build fails.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { configEntities } from "./k3s-helpers";
+
+/**
+ * `token`/`agent-token`/`cluster-secret` are the join secret. The etcd S3
+ * pair are snapshot-store credentials the flag surface types as plain
+ * strings — k3s's own docs point at `etcd-s3-config-secret` (a Secret on
+ * the cluster) for exactly this reason.
+ */
+const SECRET_KEYS = [
+  "token",
+  "agent-token",
+  "cluster-secret",
+  "etcd-s3-secret-key",
+  "etcd-s3-session-token",
+];
+
+export const k3s101: PostSynthCheck = {
+  id: "K3S101",
+  description: "A k3s config entity carries a literal join token",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const entity of configEntities(ctx)) {
+      for (const key of SECRET_KEYS) {
+        const value = entity.props[key];
+        if (typeof value === "string" && value.length > 0) {
+          diagnostics.push({
+            checkId: "K3S101",
+            severity: "error",
+            message:
+              `"${entity.name}" carries a literal \`${key}\` — the emitted config.yaml would ` +
+              "contain the secret. Use the file/Secret reference form instead " +
+              "(`token-file`, `etcd-s3-config-secret`).",
+            entity: entity.name,
+            lexicon: "k3s",
+          });
+        }
+      }
+    }
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/k3s102.ts

@@ -0,0 +1,59 @@
+/**
+ * K3S102: registry credentials as literals.
+ *
+ * registries.yaml supports inline `auth.password` / `auth.token`, and a
+ * committed estate that uses them has published its registry credentials.
+ * The TLS file paths beside them are host paths — those are fine; it is
+ * the credential values that must come from somewhere else.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { entitiesOfType } from "./k3s-helpers";
+
+export const k3s102: PostSynthCheck = {
+  id: "K3S102",
+  description: "registries.yaml carries a literal registry credential",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const entity of entitiesOfType(ctx, "K3s::Registries")) {
+      const configs = entity.props.configs;
+      if (typeof configs !== "object" || configs === null) continue;
+      for (const [registry, config] of Object.entries(configs as Record<string, unknown>)) {
+        const auth = resolveProps(config)?.auth;
+        const authProps = resolveProps(auth);
+        if (!authProps) continue;
+        for (const key of ["password", "token"]) {
+          const value = authProps[key];
+          if (typeof value === "string" && value.length > 0) {
+            diagnostics.push({
+              checkId: "K3S102",
+              severity: "error",
+              message:
+                `"${entity.name}" carries a literal \`${key}\` for registry "${registry}" — ` +
+                "a committed registries.yaml is a leaked credential. Configure registry auth " +
+                "on the host outside the declaration.",
+              entity: entity.name,
+              lexicon: "k3s",
+            });
+          }
+        }
+      }
+    }
+    return diagnostics;
+  },
+};
+
+/** A nested value may be a plain object or a property declarable carrying props. */
+function resolveProps(value: unknown): Record<string, unknown> | undefined {
+  if (typeof value !== "object" || value === null) return undefined;
+  const obj = value as Record<string, unknown>;
+  if (typeof obj.props === "object" && obj.props !== null && "entityType" in obj) {
+    return obj.props as Record<string, unknown>;
+  }
+  return obj;
+}