@intentius/chant-lexicon-k8s 0.1.15 → 0.1.17

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "5ba1d1b3a933fa0a69af686d9b421bfeabc9393796b9a0edda924dc33ac4f505",
+    "manifest.json": "81c85a3d21213a3ec333100bb65bd5df47009fbb2e55f2d0a519b511b3dbdfef",
     "meta.json": "b16aba17feef7b62df4057b714b51e34f88330a843d77e3904ea207d6bb073c5",
     "types/index.d.ts": "be4a0a86c911d4407a22f1c252850d35d87c1234fac46eec8a0aebee248d60f5",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -32,7 +32,7 @@
     "rules/wk8207.ts": "e82dbf47e20fc186a105069b5923a8532553f236c58178332f9264f39ac31390",
     "rules/wk8208.ts": "0e9d654fa70f9ee91de4711df43689fcee4fde831ce0eb0081fdc4753632e9dd",
     "rules/wk8209.ts": "617324b7988a7c842502c9e76388412c5855dcd321e40a2df6039c9faf87ac47",
-    "rules/wk8301.ts": "12321c2b217db4a1f8842844e0d9875def589e54056dd66d6c0f4a65e50e1213",
+    "rules/wk8301.ts": "b7293376340ae511d6bec1691356558c38e2d42f5823e599125fdce1ddeefea6",
     "rules/wk8302.ts": "3e8e336e72618b543c3208f9b2b7a582b4535d3d284481cc6c77812c35812e71",
     "rules/wk8303.ts": "fdf8b072063359d2e654b1e810491738316eae01e85f9d18df1c341578caf2a6",
     "rules/wk8304.ts": "fd98b1bd1e62713b29af5fbb8e45d8ddf2b8b751eab1819caa9ea813efb9e54d",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "bcfebf986465fc20d2904a353b4ca041477fd94e63814d417c1eeba29488c2a0"
+  "composite": "44045fb12b92ec20c40832608226bdf313032c40080a56f777fb01861c4bb969"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/rules/wk8301.ts

@@ -1,9 +1,14 @@
 /**
  * WK8301: Probes Required
  *
- * Containers should have both livenessProbe and readinessProbe configured.
- * Without probes, Kubernetes cannot detect unhealthy containers or know
- * when a container is ready to receive traffic.
+ * Containers that expose a port should have both livenessProbe and
+ * readinessProbe configured. Without probes, Kubernetes cannot detect
+ * unhealthy containers or know when a container is ready to receive traffic.
+ *
+ * Containers that declare no port (queue/Temporal workers, batch consumers)
+ * are exempt: they take no inbound traffic, so there is no endpoint to
+ * HTTP-probe and no readiness signal for a Service to gate on. Flagging them
+ * would force a placeholder exec probe on a correct, port-less pattern.
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
@@ -29,6 +34,9 @@ export const wk8301: PostSynthCheck = {
         const resourceName = manifest.metadata?.name ?? manifest.kind;
 
         for (const container of containers) {
+          // No declared port → no inbound traffic → nothing to HTTP-probe.
+          if (!container.ports || container.ports.length === 0) continue;
+
           const missing: string[] = [];
           if (!container.livenessProbe) missing.push("livenessProbe");
           if (!container.readinessProbe) missing.push("readinessProbe");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/codegen/docs.ts

@@ -393,7 +393,7 @@ Post-synth checks run against the serialized YAML after build.
 | Rule | Description |
 |------|-------------|
 | WK8201 | Container missing resource limits |
-| WK8301 | Container missing health probes (skips Jobs/CronJobs) |
+| WK8301 | Port-serving container missing health probes (skips Jobs/CronJobs and port-less workers) |
 | WK8302 | Single replica Deployment |
 | WK8303 | HA Deployment without PodDisruptionBudget |
 

package/src/lint/post-synth/post-synth.test.ts

@@ -854,7 +854,7 @@ spec:
 // ── WK8301: Probes required ────────────────────────────────────────
 
 describe("WK8301: Probes required", () => {
-  test("flags container without probes", () => {
+  test("flags port-serving container without probes", () => {
     const ctx = makeCtx(JSON.stringify({
       apiVersion: "apps/v1",
       kind: "Deployment",
@@ -862,7 +862,9 @@ describe("WK8301: Probes required", () => {
       spec: {
         template: {
           spec: {
-            containers: [{ name: "app", image: "app:1.0" }],
+            containers: [
+              { name: "app", image: "app:1.0", ports: [{ containerPort: 8080 }] },
+            ],
           },
         },
       },
@@ -872,6 +874,24 @@ describe("WK8301: Probes required", () => {
     expect(diags[0].checkId).toBe("WK8301");
   });
 
+  test("skips port-less worker Deployment (no inbound traffic to probe)", () => {
+    const ctx = makeCtx(JSON.stringify({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: "worker" },
+      spec: {
+        template: {
+          spec: {
+            // A queue/Temporal worker — long-running, no port, no probes by design.
+            containers: [{ name: "worker", image: "worker:1.0" }],
+          },
+        },
+      },
+    }));
+    const diags = wk8301.check(ctx);
+    expect(diags.length).toBe(0);
+  });
+
   test("passes with both probes", () => {
     const ctx = makeCtx(JSON.stringify({
       apiVersion: "apps/v1",
@@ -884,6 +904,7 @@ describe("WK8301: Probes required", () => {
               {
                 name: "app",
                 image: "app:1.0",
+                ports: [{ containerPort: 8080 }],
                 livenessProbe: { httpGet: { path: "/healthz", port: 8080 } },
                 readinessProbe: { httpGet: { path: "/readyz", port: 8080 } },
               },

package/src/lint/post-synth/wk8301.ts

@@ -1,9 +1,14 @@
 /**
  * WK8301: Probes Required
  *
- * Containers should have both livenessProbe and readinessProbe configured.
- * Without probes, Kubernetes cannot detect unhealthy containers or know
- * when a container is ready to receive traffic.
+ * Containers that expose a port should have both livenessProbe and
+ * readinessProbe configured. Without probes, Kubernetes cannot detect
+ * unhealthy containers or know when a container is ready to receive traffic.
+ *
+ * Containers that declare no port (queue/Temporal workers, batch consumers)
+ * are exempt: they take no inbound traffic, so there is no endpoint to
+ * HTTP-probe and no readiness signal for a Service to gate on. Flagging them
+ * would force a placeholder exec probe on a correct, port-less pattern.
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
@@ -29,6 +34,9 @@ export const wk8301: PostSynthCheck = {
         const resourceName = manifest.metadata?.name ?? manifest.kind;
 
         for (const container of containers) {
+          // No declared port → no inbound traffic → nothing to HTTP-probe.
+          if (!container.ports || container.ports.length === 0) continue;
+
           const missing: string[] = [];
           if (!container.livenessProbe) missing.push("livenessProbe");
           if (!container.readinessProbe) missing.push("readinessProbe");