@intentius/chant-lexicon-k8s 0.0.12

package/src/lint/post-synth/post-synth.test.ts

@@ -0,0 +1,969 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+
+// Import all checks
+import { wk8005 } from "./wk8005";
+import { wk8006 } from "./wk8006";
+import { wk8041 } from "./wk8041";
+import { wk8042 } from "./wk8042";
+import { wk8101 } from "./wk8101";
+import { wk8102 } from "./wk8102";
+import { wk8103 } from "./wk8103";
+import { wk8104 } from "./wk8104";
+import { wk8105 } from "./wk8105";
+import { wk8201 } from "./wk8201";
+import { wk8202 } from "./wk8202";
+import { wk8203 } from "./wk8203";
+import { wk8204 } from "./wk8204";
+import { wk8205 } from "./wk8205";
+import { wk8207 } from "./wk8207";
+import { wk8208 } from "./wk8208";
+import { wk8209 } from "./wk8209";
+import { wk8301 } from "./wk8301";
+import { wk8302 } from "./wk8302";
+import { wk8303 } from "./wk8303";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["k8s", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["k8s", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+// ── WK8005: Secrets in env ──────────────────────────────────────────
+// Note: Tests with nested container properties (env, resources, securityContext,
+// ports, probes) use JSON format because the core parseYAML line-based parser
+// cannot handle deeply nested properties inside YAML array items.
+
+describe("WK8005: Hardcoded secrets in env", () => {
+  test("flags hardcoded password in env", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", env: [{ name: "DB_PASSWORD", value: "secret123" }] },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8005.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8005");
+  });
+
+  test("passes when env uses secretKeyRef", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", env: [{ name: "DB_PASSWORD", valueFrom: { secretKeyRef: { name: "db-secret", key: "password" } } }] },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8005.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+
+  test("passes when env var name is not sensitive", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", env: [{ name: "LOG_LEVEL", value: "info" }] },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8005.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8006: Latest tag ──────────────────────────────────────────────
+
+describe("WK8006: Latest/untagged images", () => {
+  test("flags image with :latest tag", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: nginx:latest
+`);
+    const diags = wk8006.check(ctx);
+    expect(diags.length).toBe(1);
+    expect(diags[0].checkId).toBe("WK8006");
+  });
+
+  test("flags untagged image", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: nginx
+`);
+    const diags = wk8006.check(ctx);
+    expect(diags.length).toBe(1);
+  });
+
+  test("passes for explicitly tagged image", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: nginx:1.25
+`);
+    const diags = wk8006.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8041: API keys ────────────────────────────────────────────────
+
+describe("WK8041: API keys in env", () => {
+  test("flags Stripe key pattern", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", env: [{ name: "STRIPE_KEY", value: "sk_live_abc123def456" }] },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8041.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8041");
+  });
+
+  test("passes for normal values", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", env: [{ name: "APP_MODE", value: "production" }] },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8041.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8042: Private keys ───────────────────────────────────────────
+
+describe("WK8042: Private keys in manifests", () => {
+  test("flags private key in ConfigMap", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "v1",
+      kind: "ConfigMap",
+      metadata: { name: "config" },
+      data: {
+        "cert.pem": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA...\n-----END RSA PRIVATE KEY-----",
+      },
+    }));
+    const diags = wk8042.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8042");
+  });
+
+  test("passes for normal ConfigMap data", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "v1",
+      kind: "ConfigMap",
+      metadata: { name: "config" },
+      data: { "config.json": '{"key": "value"}' },
+    }));
+    const diags = wk8042.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8101: Selector mismatch ──────────────────────────────────────
+
+describe("WK8101: Selector must match template labels", () => {
+  test("flags when matchLabels != template labels", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: different-app
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8101.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8101");
+  });
+
+  test("passes when selector matches template labels", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8101.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8102: Missing labels ─────────────────────────────────────────
+
+describe("WK8102: Missing metadata.labels", () => {
+  test("flags resource without labels", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8102.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8102");
+  });
+
+  test("passes with labels present", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  labels:
+    app: my-app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8102.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8103: Container name ─────────────────────────────────────────
+
+describe("WK8103: Container missing name", () => {
+  test("flags container without name", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - image: app:1.0
+`);
+    const diags = wk8103.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8103");
+  });
+
+  test("passes with container name", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8103.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8104: Named ports ────────────────────────────────────────────
+
+describe("WK8104: Unnamed container ports", () => {
+  test("flags unnamed ports", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", ports: [{ containerPort: 8080 }] },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8104.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8104");
+  });
+
+  test("passes with named ports", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", ports: [{ containerPort: 8080, name: "http" }] },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8104.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8105: imagePullPolicy ────────────────────────────────────────
+
+describe("WK8105: Missing imagePullPolicy", () => {
+  test("flags missing imagePullPolicy", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [{ name: "app", image: "app:1.0" }],
+          },
+        },
+      },
+    }));
+    const diags = wk8105.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8105");
+  });
+
+  test("passes with explicit imagePullPolicy", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [{ name: "app", image: "app:1.0", imagePullPolicy: "IfNotPresent" }],
+          },
+        },
+      },
+    }));
+    const diags = wk8105.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8201: Resource limits ────────────────────────────────────────
+
+describe("WK8201: Resource limits required", () => {
+  test("flags container without resource limits", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [{ name: "app", image: "app:1.0" }],
+          },
+        },
+      },
+    }));
+    const diags = wk8201.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8201");
+  });
+
+  test("passes with resource limits", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", resources: { limits: { cpu: "500m", memory: "256Mi" } } },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8201.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8202: Privileged ─────────────────────────────────────────────
+
+describe("WK8202: Privileged containers", () => {
+  test("flags privileged: true", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", securityContext: { privileged: true } },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8202.check(ctx);
+    expect(diags.length).toBe(1);
+    expect(diags[0].checkId).toBe("WK8202");
+  });
+
+  test("passes with privileged: false", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", securityContext: { privileged: false } },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8202.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8203: readOnlyRootFilesystem ─────────────────────────────────
+
+describe("WK8203: readOnlyRootFilesystem", () => {
+  test("flags missing readOnlyRootFilesystem", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", securityContext: {} },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8203.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8203");
+  });
+
+  test("passes with readOnlyRootFilesystem: true", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", securityContext: { readOnlyRootFilesystem: true } },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8203.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8204: runAsNonRoot ───────────────────────────────────────────
+
+describe("WK8204: runAsNonRoot", () => {
+  test("flags missing runAsNonRoot", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", securityContext: {} },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8204.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8204");
+  });
+
+  test("passes with runAsNonRoot: true", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", securityContext: { runAsNonRoot: true } },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8204.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8205: Drop capabilities ──────────────────────────────────────
+
+describe("WK8205: Drop all capabilities", () => {
+  test("flags missing capability drop", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", securityContext: {} },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8205.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8205");
+  });
+
+  test("passes with drop ALL", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "app", image: "app:1.0", securityContext: { capabilities: { drop: ["ALL"] } } },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8205.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8207: hostNetwork ────────────────────────────────────────────
+
+describe("WK8207: hostNetwork", () => {
+  test("flags hostNetwork: true", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      hostNetwork: true
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8207.check(ctx);
+    expect(diags.length).toBe(1);
+    expect(diags[0].checkId).toBe("WK8207");
+  });
+
+  test("passes without hostNetwork", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8207.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8208: hostPID ────────────────────────────────────────────────
+
+describe("WK8208: hostPID", () => {
+  test("flags hostPID: true", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      hostPID: true
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8208.check(ctx);
+    expect(diags.length).toBe(1);
+    expect(diags[0].checkId).toBe("WK8208");
+  });
+
+  test("passes without hostPID", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8208.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8209: hostIPC ────────────────────────────────────────────────
+
+describe("WK8209: hostIPC", () => {
+  test("flags hostIPC: true", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      hostIPC: true
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8209.check(ctx);
+    expect(diags.length).toBe(1);
+    expect(diags[0].checkId).toBe("WK8209");
+  });
+
+  test("passes without hostIPC", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8209.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8301: Probes required ────────────────────────────────────────
+
+describe("WK8301: Probes required", () => {
+  test("flags container without probes", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [{ name: "app", image: "app:1.0" }],
+          },
+        },
+      },
+    }));
+    const diags = wk8301.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8301");
+  });
+
+  test("passes with both probes", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "app" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              {
+                name: "app",
+                image: "app:1.0",
+                livenessProbe: { httpGet: { path: "/healthz", port: 8080 } },
+                readinessProbe: { httpGet: { path: "/readyz", port: 8080 } },
+              },
+            ],
+          },
+        },
+      },
+    }));
+    const diags = wk8301.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+
+  test("skips Job (probes not needed)", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "batch/v1",
+      kind: "Job",
+      metadata: { name: "job" },
+      spec: {
+        template: {
+          spec: {
+            containers: [{ name: "worker", image: "worker:1.0" }],
+          },
+        },
+      },
+    }));
+    const diags = wk8301.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+
+  test("skips CronJob", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "batch/v1",
+      kind: "CronJob",
+      metadata: { name: "cron" },
+      spec: {
+        schedule: "0 * * * *",
+        jobTemplate: {
+          spec: {
+            template: {
+              spec: {
+                containers: [{ name: "cron", image: "cron:1.0" }],
+              },
+            },
+          },
+        },
+      },
+    }));
+    const diags = wk8301.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8302: Single replica ─────────────────────────────────────────
+
+describe("WK8302: Single replica deployment", () => {
+  test("flags replicas: 1", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8302.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8302");
+  });
+
+  test("passes with replicas: 3", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  replicas: 3
+  template:
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8302.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});
+
+// ── WK8303: PDB missing ───────────────────────────────────────────
+
+describe("WK8303: HA Deployment without PDB", () => {
+  test("flags HA Deployment without PDB", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+`);
+    const diags = wk8303.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("WK8303");
+  });
+
+  test("passes with PDB present", () => {
+    const ctx = makeCtx(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+        - name: app
+          image: app:1.0
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: app-pdb
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: my-app
+`);
+    const diags = wk8303.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+});