@intentius/chant-lexicon-k8s 0.100.0 → 0.101.0

package/src/composites/otel-collector-rbac.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, test } from "vitest";
+import { DebugExporter, KubeletStatsReceiver, OtlpReceiver, Pipeline, type CollectorConfig } from "@intentius/chant-lexicon-otel";
+import { agentClusterRules, namespacedRoles } from "./otel-collector-rbac";
+import { OtelCollector } from "./otel-collector";
+import { GkeOtelCollector } from "./gke-otel-collector";
+
+const READ = ["get", "list", "watch"];
+const BASE = [
+  { apiGroups: [""], resources: ["pods", "namespaces", "nodes"], verbs: READ },
+  { apiGroups: ["apps"], resources: ["replicasets"], verbs: READ },
+];
+
+function cfg(c: Partial<CollectorConfig>): CollectorConfig {
+  return { service: { pipelines: {} }, ...c } as CollectorConfig;
+}
+
+describe("agentClusterRules", () => {
+  test("an OTLP-only config gets k8sattributes' rules and nothing else", () => {
+    expect(agentClusterRules(cfg({ receivers: { otlp: {} } }))).toEqual(BASE);
+  });
+
+  test("k8sattributes extracting from a deployment adds deployments", () => {
+    const rules = agentClusterRules(
+      cfg({ processors: { "k8sattributes/x": { extract: { labels: [{ key: "team", from: "deployment" }] } } } as any }),
+    );
+    expect(rules[1]).toEqual({ apiGroups: ["apps"], resources: ["replicasets", "deployments"], verbs: READ });
+  });
+
+  test("kubeletstats gets nodes/stats", () => {
+    expect(agentClusterRules(cfg({ receivers: { kubeletstats: { auth_type: "serviceAccount" } } as any }))).toEqual([
+      ...BASE,
+      { apiGroups: [""], resources: ["nodes/stats"], verbs: ["get"] },
+    ]);
+  });
+
+  test.each([
+    [{ extra_metadata_labels: ["container.id"] }],
+    [{ metrics: { "k8s.pod.cpu_limit_utilization": { enabled: true } } }],
+    [{ metrics: { "k8s.container.memory_request_utilization": { enabled: true } } }],
+  ])("kubeletstats needing the kubelet's /pods gets nodes/proxy (%o)", (extra) => {
+    const rules = agentClusterRules(cfg({ receivers: { "kubeletstats/node": { auth_type: "serviceAccount", ...extra } } as any }));
+    expect(rules[2]).toEqual({ apiGroups: [""], resources: ["nodes/stats", "nodes/proxy"], verbs: ["get"] });
+  });
+
+  test("a disabled utilization metric does not add nodes/proxy", () => {
+    const rules = agentClusterRules(
+      cfg({ receivers: { kubeletstats: { metrics: { "k8s.pod.cpu_limit_utilization": { enabled: false } } } } as any }),
+    );
+    expect(rules[2].resources).toEqual(["nodes/stats"]);
+  });
+
+  test("kubeletstats with k8s_api_config reads persistent volumes and claims", () => {
+    const rules = agentClusterRules(cfg({ receivers: { kubeletstats: { k8s_api_config: { auth_type: "serviceAccount" } } } as any }));
+    expect(rules.at(-1)).toEqual({ apiGroups: [""], resources: ["persistentvolumeclaims", "persistentvolumes"], verbs: ["get"] });
+  });
+});
+
+describe("the agent ClusterRole", () => {
+  const rulesOf = (r: { clusterRole: unknown }) => (r.clusterRole as { props: { rules: unknown } }).props.rules;
+
+  test("OtelCollector and GkeOtelCollector grant k8sattributes' rules by default", () => {
+    expect(rulesOf(OtelCollector({}))).toEqual(BASE);
+    expect(rulesOf(GkeOtelCollector({ clusterName: "c", projectId: "p" }))).toEqual(BASE);
+  });
+
+  test("an OtelCollector config with kubeletstats gets its rules", () => {
+    const kubelet = new KubeletStatsReceiver({ auth_type: "serviceAccount", extra_metadata_labels: ["container.id"] });
+    const otlp = new OtlpReceiver({ protocols: { grpc: { endpoint: "0.0.0.0:4317" } } });
+    const debug = new DebugExporter({});
+    const agent = OtelCollector({ config: [new Pipeline({ signal: "metrics", receivers: [otlp, kubelet], exporters: [debug] })] });
+    expect(rulesOf(agent)).toEqual([...BASE, { apiGroups: [""], resources: ["nodes/stats", "nodes/proxy"], verbs: ["get"] }]);
+  });
+
+  test("defaults.clusterRole.rules are appended", () => {
+    const extra = { apiGroups: [""], resources: ["services"], verbs: READ };
+    expect(rulesOf(OtelCollector({ defaults: { clusterRole: { rules: [extra] } } }))).toEqual([...BASE, extra]);
+  });
+});
+
+describe("namespacedRoles", () => {
+  const base = {
+    key: "endpoints",
+    name: "agent-endpoints",
+    rules: [{ apiGroups: [""], resources: ["endpoints"], verbs: READ }],
+    labels: { app: "x" },
+    serviceAccount: { name: "agent-sa", namespace: "agents" },
+  };
+
+  test("no namespaces, no members", () => {
+    expect(namespacedRoles({ ...base, namespaces: [] })).toEqual({});
+  });
+
+  test("the first namespace keeps the plain member names, the rest are suffixed", () => {
+    expect(Object.keys(namespacedRoles({ ...base, namespaces: ["obs", "team-a", "b2"] }))).toEqual([
+      "endpointsRole",
+      "endpointsRoleBinding",
+      "endpointsRoleInTeamA",
+      "endpointsRoleBindingInTeamA",
+      "endpointsRoleInB2",
+      "endpointsRoleBindingInB2",
+    ]);
+  });
+
+  test("namespaces that give the same member name are refused", () => {
+    expect(() => namespacedRoles({ ...base, namespaces: ["obs", "a-b", "a--b"] })).toThrow(/a-b and a--b/);
+  });
+
+  test("defaults apply to each Role", () => {
+    const out = namespacedRoles({ ...base, namespaces: ["one", "two"], roleDefaults: { metadata: { annotations: { x: "y" } } } });
+    for (const key of ["endpointsRole", "endpointsRoleInTwo"]) {
+      expect((out[key] as any).props.metadata.annotations).toEqual({ x: "y" });
+    }
+  });
+});

package/src/composites/otel-collector-rbac.ts

@@ -0,0 +1,144 @@
+/**
+ * The RBAC the collector composites grant, worked out from the collector
+ * config they deploy.
+ *
+ * `agentClusterRules` is the ClusterRole `OtelCollector` and
+ * `GkeOtelCollector` share: what the `k8sattributes` processor needs, plus
+ * what the config's Kubernetes receivers need. Each rule cites the
+ * component's RBAC requirements at collector-contrib v0.130.0, the version the
+ * otel lexicon pins.
+ *
+ * `namespacedRoles` builds one Role and RoleBinding per namespace, for access
+ * a collector needs in namespaces other than its own: Endpoints for a
+ * `loadbalancing` exporter's `k8s` resolver, Leases for a
+ * `k8s_leader_elector` extension.
+ */
+
+import { mergeDefaults } from "@intentius/chant";
+import type { CollectorConfig } from "@intentius/chant-lexicon-otel";
+import { Role, RoleBinding } from "../generated";
+
+/** One RBAC rule, as a Role or ClusterRole lists it. */
+export interface CollectorPolicyRule {
+  apiGroups: string[];
+  resources: string[];
+  verbs: string[];
+  resourceNames?: string[];
+}
+
+const READ = ["get", "list", "watch"];
+
+function componentsOfType(section: Record<string, unknown> | undefined, type: string): Array<Record<string, unknown>> {
+  return Object.entries(section ?? {})
+    .filter(([id]) => id === type || id.startsWith(`${type}/`))
+    .map(([, cfg]) => (cfg && typeof cfg === "object" ? (cfg as Record<string, unknown>) : {}));
+}
+
+/**
+ * The agent ClusterRole's rules for a collector config.
+ *
+ * Always, for `k8sattributes` (processor/k8sattributesprocessor README,
+ * "Cluster-scoped RBAC"): `get`, `list` and `watch` on pods, namespaces and
+ * nodes, and on `apps` replicasets for `k8s.deployment.name`, which is
+ * extracted by default. The processor lists ReplicaSets through `apps/v1`
+ * only, so the README's `extensions` group is left out. When a
+ * `k8sattributes` processor extracts labels or annotations `from: deployment`,
+ * `apps` deployments are added.
+ *
+ * For each `kubeletstats` receiver (receiver/kubeletstatsreceiver README,
+ * "Role-based access control"): `get` on `nodes/stats`; `get` on
+ * `nodes/proxy` when it sets `extra_metadata_labels` or enables a
+ * `*_request_utilization` or `*_limit_utilization` metric; and, when it sets
+ * `k8s_api_config`, `get` on persistentvolumeclaims and persistentvolumes,
+ * which it reads for volume metadata (scraper.go).
+ *
+ * Other components that read the Kubernetes API, such as `k8s_cluster`
+ * (which belongs on a gateway, see WK8603), add their rules through
+ * `defaults.clusterRole.rules`, which are appended.
+ */
+export function agentClusterRules(config: CollectorConfig): CollectorPolicyRule[] {
+  const apps = ["replicasets"];
+  const k8sattributes = componentsOfType(config.processors as Record<string, unknown> | undefined, "k8sattributes");
+  const fromDeployment = k8sattributes.some((p) => {
+    const extract = p.extract as { labels?: Array<{ from?: string }>; annotations?: Array<{ from?: string }> } | undefined;
+    return [...(extract?.labels ?? []), ...(extract?.annotations ?? [])].some((f) => f?.from === "deployment");
+  });
+  if (fromDeployment) apps.push("deployments");
+
+  const rules: CollectorPolicyRule[] = [
+    { apiGroups: [""], resources: ["pods", "namespaces", "nodes"], verbs: READ },
+    { apiGroups: ["apps"], resources: apps, verbs: READ },
+  ];
+
+  const kubeletstats = componentsOfType(config.receivers as Record<string, unknown> | undefined, "kubeletstats");
+  if (kubeletstats.length) {
+    const nodeSubresources = ["nodes/stats"];
+    const needsProxy = kubeletstats.some((r) => {
+      const labels = r.extra_metadata_labels;
+      if (Array.isArray(labels) && labels.length) return true;
+      const metrics = (r.metrics ?? {}) as Record<string, { enabled?: boolean } | undefined>;
+      return Object.entries(metrics).some(([metric, toggle]) => /_(request|limit)_utilization$/.test(metric) && toggle?.enabled === true);
+    });
+    if (needsProxy) nodeSubresources.push("nodes/proxy");
+    rules.push({ apiGroups: [""], resources: nodeSubresources, verbs: ["get"] });
+    if (kubeletstats.some((r) => r.k8s_api_config)) {
+      rules.push({ apiGroups: [""], resources: ["persistentvolumeclaims", "persistentvolumes"], verbs: ["get"] });
+    }
+  }
+
+  return rules;
+}
+
+function pascal(namespace: string): string {
+  return namespace
+    .split(/[^a-zA-Z0-9]+/)
+    .filter(Boolean)
+    .map((part) => part[0].toUpperCase() + part.slice(1))
+    .join("");
+}
+
+export interface NamespacedRolesOptions {
+  /** Prefix of the member names: `<key>Role` and `<key>RoleBinding`. */
+  key: string;
+  /** Name of each Role and RoleBinding. They live in different namespaces, so one name serves all. */
+  name: string;
+  /** Namespaces to grant in, in declaration order. */
+  namespaces: string[];
+  rules: CollectorPolicyRule[];
+  labels: Record<string, string>;
+  /** The ServiceAccount every RoleBinding binds. */
+  serviceAccount: { name: string; namespace: string };
+  /** Defaults laid over each Role and each RoleBinding. */
+  roleDefaults?: Partial<Record<string, unknown>>;
+  roleBindingDefaults?: Partial<Record<string, unknown>>;
+}
+
+/**
+ * One Role and RoleBinding per namespace, as composite members. The first
+ * namespace's are `<key>Role` and `<key>RoleBinding`, so a single-namespace
+ * config keeps the member names it had before; each further namespace's are
+ * `<key>RoleIn<Namespace>` and `<key>RoleBindingIn<Namespace>`, with the
+ * namespace in PascalCase (`team-a` gives `endpointsRoleInTeamA`).
+ */
+export function namespacedRoles(opts: NamespacedRolesOptions): Record<string, InstanceType<typeof Role> | InstanceType<typeof RoleBinding>> {
+  const out: Record<string, InstanceType<typeof Role> | InstanceType<typeof RoleBinding>> = {};
+  const seen = new Map<string, string>();
+  opts.namespaces.forEach((namespace, i) => {
+    const suffix = i === 0 ? "" : `In${pascal(namespace)}`;
+    const clash = seen.get(suffix);
+    if (clash !== undefined) {
+      throw new Error(`${opts.name}: namespaces ${clash} and ${namespace} give the same member name ${opts.key}Role${suffix}`);
+    }
+    seen.set(suffix, namespace);
+    out[`${opts.key}Role${suffix}`] = new Role(mergeDefaults({
+      metadata: { name: opts.name, namespace, labels: opts.labels },
+      rules: opts.rules,
+    }, opts.roleDefaults));
+    out[`${opts.key}RoleBinding${suffix}`] = new RoleBinding(mergeDefaults({
+      metadata: { name: opts.name, namespace, labels: opts.labels },
+      roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: opts.name },
+      subjects: [{ kind: "ServiceAccount", name: opts.serviceAccount.name, namespace: opts.serviceAccount.namespace }],
+    }, opts.roleBindingDefaults));
+  });
+  return out;
+}

package/src/composites/otel-collector-shape.ts

@@ -139,3 +139,22 @@ export function k8sResolverNamespaces(built: BuiltCollector, ownNamespace: strin
   }
   return out;
 }
+
+/**
+ * The namespaces of the Leases a config's `k8s_leader_elector` extensions
+ * take, for those `service.extensions` enables (the collector starts no
+ * other). An elector without `lease_namespace` fails the otel lexicon's
+ * OTEL107 and is skipped here.
+ */
+export function leaderElectorLeaseNamespaces(built: BuiltCollector): string[] {
+  const out: string[] = [];
+  const enabled = built.config.service?.extensions ?? [];
+  for (const [id, cfg] of Object.entries(built.config.extensions ?? {})) {
+    if (id !== "k8s_leader_elector" && !id.startsWith("k8s_leader_elector/")) continue;
+    if (!enabled.includes(id)) continue;
+    const ns = (cfg as { lease_namespace?: unknown } | null)?.lease_namespace;
+    if (typeof ns !== "string" || ns === "") continue;
+    if (!out.includes(ns)) out.push(ns);
+  }
+  return out;
+}

package/src/composites/otel-collector.ts

@@ -24,6 +24,7 @@ import {
 } from "@intentius/chant-lexicon-otel";
 import { Service, Role, RoleBinding } from "../generated";
 import { collectorAgentResources, type CollectorAgentResources } from "./otel-collector-agent";
+import { agentClusterRules, namespacedRoles } from "./otel-collector-rbac";
 import {
   collectorRuntime,
   gatewaysAnnotation,
@@ -74,9 +75,15 @@ export interface OtelCollectorProps {
 
 export type OtelCollectorResult = CollectorAgentResources & {
   service: InstanceType<typeof Service>;
-  /** Read access to Endpoints for a `loadbalancing` exporter's `k8s` resolver, in the resolved Service's namespace. */
+  /**
+   * Read access to Endpoints for a `loadbalancing` exporter's `k8s` resolver,
+   * in the first namespace the resolvers point at. Each further namespace
+   * gets `endpointsRoleIn<Namespace>` and `endpointsRoleBindingIn<Namespace>`.
+   */
   endpointsRole?: InstanceType<typeof Role>;
   endpointsRoleBinding?: InstanceType<typeof RoleBinding>;
+  [member: `endpointsRoleIn${string}`]: InstanceType<typeof Role>;
+  [member: `endpointsRoleBindingIn${string}`]: InstanceType<typeof RoleBinding>;
 };
 
 /**
@@ -131,6 +138,7 @@ export const OtelCollector = Composite((props: OtelCollectorProps) => {
     configYaml: runtime.configYaml,
     configDir: runtime.configDir,
     ports: runtime.containerPorts,
+    clusterRules: agentClusterRules(runtime.built.config),
     cpuRequest,
     memoryRequest,
     cpuLimit,
@@ -165,39 +173,22 @@ export const OtelCollector = Composite((props: OtelCollectorProps) => {
   // The loadbalancing exporter's k8s resolver runs in this agent and watches
   // the gateway's headless Service, so the agent's ServiceAccount gets read
   // access to Endpoints (what the resolver watches at the pinned collector
-  // version) and EndpointSlices (what later versions watch) in that namespace.
-  const resolverNamespaces = k8sResolverNamespaces(runtime.built, namespace);
-  if (resolverNamespaces.length > 1) {
-    throw new Error(
-      `OtelCollector ${name}: loadbalancing exporters resolve Services in ${resolverNamespaces.join(" and ")}; ` +
-        `one agent can watch Endpoints in one namespace. Use one gateway namespace, or grant the rest through defaults.clusterRole`,
-    );
-  }
+  // version) and EndpointSlices (what later versions watch), with one Role
+  // and RoleBinding in each namespace the resolvers point at.
   const saName = (resources.serviceAccount as unknown as { props: { metadata: { name: string } } }).props.metadata.name;
-  const endpointsRbac = resolverNamespaces.length
-    ? {
-        endpointsRole: new Role(mergeDefaults({
-          metadata: {
-            name: `${name}-endpoints`,
-            namespace: resolverNamespaces[0],
-            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
-          },
-          rules: [
-            { apiGroups: [""], resources: ["endpoints"], verbs: ["get", "list", "watch"] },
-            { apiGroups: ["discovery.k8s.io"], resources: ["endpointslices"], verbs: ["get", "list", "watch"] },
-          ],
-        }, defs?.endpointsRole)),
-        endpointsRoleBinding: new RoleBinding(mergeDefaults({
-          metadata: {
-            name: `${name}-endpoints`,
-            namespace: resolverNamespaces[0],
-            labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
-          },
-          roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: `${name}-endpoints` },
-          subjects: [{ kind: "ServiceAccount", name: saName, namespace }],
-        }, defs?.endpointsRoleBinding)),
-      }
-    : {};
+  const endpointsRbac = namespacedRoles({
+    key: "endpoints",
+    name: `${name}-endpoints`,
+    namespaces: k8sResolverNamespaces(runtime.built, namespace),
+    rules: [
+      { apiGroups: [""], resources: ["endpoints"], verbs: ["get", "list", "watch"] },
+      { apiGroups: ["discovery.k8s.io"], resources: ["endpointslices"], verbs: ["get", "list", "watch"] },
+    ],
+    labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+    serviceAccount: { name: saName, namespace },
+    roleDefaults: defs?.endpointsRole,
+    roleBindingDefaults: defs?.endpointsRoleBinding,
+  });
 
-  return { ...resources, service, ...endpointsRbac };
+  return { ...resources, service, ...endpointsRbac } as OtelCollectorResult;
 }, "OtelCollector");

package/src/import/embedded-live.test.ts

@@ -0,0 +1,138 @@
+/**
+ * Embedded content through `chant import --from <env>` (#2995): a ConfigMap
+ * holding a collector config, or a PrometheusRule's groups, read from a
+ * (fake) cluster imports as the owning lexicon's typed declarations, exactly
+ * as `chant import <manifest>` does (embedded-roundtrip.test.ts).
+ *
+ * The cluster is `fakeCluster`: a real k8s client with the socket replaced.
+ * The objects are the round trip's fixtures with the fields a server adds.
+ */
+
+import { describe, expect, test } from "vitest";
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import { join, relative } from "path";
+import { load, loadAll } from "js-yaml";
+import { liveImportFromPlugins } from "@intentius/chant/cli/commands/import";
+import type { LexiconPlugin, ResourceSelector } from "@intentius/chant/lexicon";
+import { build } from "@intentius/chant/build";
+import type { K8sObject } from "@intentius/chant-k8s-client";
+import { otelSerializer } from "@intentius/chant-lexicon-otel";
+import { prometheusSerializer } from "@intentius/chant-lexicon-prometheus";
+import { k8sPlugin } from "../plugin";
+import { k8sSerializer } from "../serializer";
+import { exportResources } from "../export-resources";
+import { fakeCluster, objectKey } from "../api/fake-cluster";
+import { pkgDir, read, removeDir } from "./testdata/embedded/fixtures";
+
+type Json = Record<string, unknown>;
+
+/** The fixture's documents as the API server returns them. */
+function liveObjects(fixture: string): Record<string, K8sObject> {
+  const objects: Record<string, K8sObject> = {};
+  for (const doc of loadAll(read(fixture)) as Json[]) {
+    if (!doc) continue;
+    const metadata = doc.metadata as Json;
+    const live = {
+      ...doc,
+      metadata: { ...metadata, uid: `uid-${metadata.name}`, resourceVersion: "7", managedFields: [{ manager: "helm" }] },
+    } as K8sObject;
+    const key = objectKey(doc.apiVersion as string, doc.kind as string, metadata.name as string, metadata.namespace as string | undefined);
+    objects[key] = live;
+  }
+  return objects;
+}
+
+function walk(dir: string, root: string, out: Record<string, string>): void {
+  for (const entry of readdirSync(dir)) {
+    const path = join(dir, entry);
+    if (statSync(path).isDirectory()) walk(path, root, out);
+    else out[relative(root, path)] = readFileSync(path, "utf-8");
+  }
+}
+
+/** `chant import --from test` against a cluster holding the fixture's objects, in a project inside this package. */
+async function importLive(fixture: string, selector?: ResourceSelector) {
+  const cluster = fakeCluster({ objects: liveObjects(fixture) });
+  const plugin: LexiconPlugin = {
+    ...k8sPlugin,
+    exportResources: (options) => exportResources(options, cluster.connector),
+  };
+  const dir = mkdtempSync(join(pkgDir, ".roundtrip-tmp-live-"));
+  writeFileSync(join(dir, "package.json"), '{ "name": "k8s-live-embedded", "private": true, "type": "module" }\n');
+  writeFileSync(join(dir, "chant.config.ts"), 'export default { lexicons: ["k8s"] };\n');
+  const srcDir = join(dir, "src");
+  mkdirSync(srcDir);
+  const result = await liveImportFromPlugins([plugin], { environment: "test", output: srcDir, selector, force: true });
+  const files: Record<string, string> = {};
+  walk(srcDir, srcDir, files);
+  return { result, dir, srcDir, files };
+}
+
+function primary(out: unknown): string {
+  return typeof out === "string" ? out : ((out as { primary?: string } | undefined)?.primary ?? "");
+}
+
+function find(docs: Json[], kind: string, name: string): Json {
+  const doc = docs.find((d) => d.kind === kind && (d.metadata as Json | undefined)?.name === name);
+  if (!doc) throw new Error(`no ${kind} ${name}`);
+  return doc;
+}
+
+/** A collector config as the collector reads it: an empty component is `{}` whether written `{}` or left null. */
+function collectorConfig(text: string): Json {
+  const doc = (load(text) ?? {}) as Json;
+  for (const section of ["receivers", "processors", "exporters", "connectors", "extensions"]) {
+    const s = doc[section] as Json | undefined;
+    if (!s) continue;
+    for (const id of Object.keys(s)) if (s[id] === null) s[id] = {};
+  }
+  return doc;
+}
+
+describe("chant import --from: embedded content imported by its owner (#2995)", () => {
+  test("a live collector ConfigMap becomes typed otel declarations and builds back to the same config", async () => {
+    const out = await importLive("otel-collector-daemonset.yaml");
+    try {
+      expect(out.result.error).toBeUndefined();
+      expect(out.result.success).toBe(true);
+      expect(out.result.warnings.filter((w) => w.includes("kept as written"))).toEqual([]);
+
+      const name = "example-opentelemetry-collector-agent";
+      const host = Object.entries(out.files).find(([p]) => !p.includes("/") && p !== "index.ts" && out.files[p].includes("collectorYaml("));
+      expect(host, Object.keys(out.files).join(", ")).toBeDefined();
+      expect(host![1]).toContain('import { collectorYaml } from "@intentius/chant-lexicon-otel";');
+      expect(out.files[`${name}/receivers.ts`]).toContain("new OtlpReceiver(");
+      expect(out.result.generatedFiles).toContain(`${name}/pipelines.ts`);
+
+      const result = await build(out.srcDir, [k8sSerializer, otelSerializer, prometheusSerializer]);
+      expect(result.errors).toEqual([]);
+      const rebuilt = (loadAll(primary(result.outputs.get("k8s"))) as Json[]).filter((d) => d);
+      const source = (loadAll(read("otel-collector-daemonset.yaml")) as Json[]).filter((d) => d);
+      const before = find(source, "ConfigMap", name).data as Json;
+      const after = find(rebuilt, "ConfigMap", name).data as Json;
+      expect(collectorConfig(after.relay as string)).toEqual(collectorConfig(before.relay as string));
+    } finally {
+      removeDir(out.dir);
+    }
+  });
+
+  test("a live PrometheusRule's spec.groups become prometheus RuleGroups", async () => {
+    const out = await importLive("node-exporter-prometheusrule.yaml", { type: "K8s::Monitoring::PrometheusRule" });
+    try {
+      expect(out.result.error).toBeUndefined();
+      expect(out.result.generatedFiles).toEqual(["main.ts", "node-exporter-rules/rules.ts"]);
+      expect(out.files["main.ts"]).toContain('from "./node-exporter-rules/rules";');
+      expect(out.files["node-exporter-rules/rules.ts"]).toContain("new RuleGroup(");
+    } finally {
+      removeDir(out.dir);
+    }
+  });
+
+  test("the export keeps embedded content as read when no context is given", async () => {
+    const cluster = fakeCluster({ objects: liveObjects("otel-collector-daemonset.yaml") });
+    const ir = await exportResources({ environment: "test", selector: { type: "K8s::Core::ConfigMap" } }, cluster.connector);
+    const [configMap] = ir.resources;
+    expect(typeof (configMap.properties.data as Json).relay).toBe("string");
+    expect(typeof ir.reparse).toBe("function");
+  });
+});

package/src/import/live-export.ts

@@ -1,5 +1,6 @@
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
 import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import type { ParseContext, TemplateIR } from "@intentius/chant/import/parser";
 import { K8sParser } from "./parser";
 
 /**
@@ -52,6 +53,11 @@ export function stripServerFields(obj: Record<string, unknown>): Record<string,
  * `items` of a `kubectl get -o json` List). Reuses the import K8sParser by
  * feeding it the cleaned objects as JSON documents — JSON is valid YAML, so no
  * separate serializer is needed. Pure: all I/O stays in the caller.
+ *
+ * The result's `reparse(context)` parses the same objects again with a
+ * `ParseContext`, so `chant import --from` hands embedded content (a
+ * collector config in a ConfigMap, a PrometheusRule's groups) to the lexicon
+ * that owns it, as file import does (#2995).
  */
 export function buildExportFromObjects(
   objects: unknown[],
@@ -70,9 +76,11 @@ export function buildExportFromObjects(
     .map((o) => (opts.verbatim ? o : stripServerFields(o)));
 
   const content = cleaned.map((o) => JSON.stringify(o, null, 2)).join("\n---\n");
-  const ir = new K8sParser().parse(content);
+  const parse = (context?: ParseContext): TemplateIR => select(new K8sParser().parse(content, context), opts.selector);
+  return { ...parse(), reparse: (context) => parse(context) };
+}
 
-  const selector = opts.selector;
+function select(ir: TemplateIR, selector: ResourceSelector | undefined): TemplateIR {
   if (!selector || (selector.type === undefined && selector.name === undefined)) {
     return ir;
   }

package/src/lint/audit-catalog.ts

@@ -49,6 +49,7 @@ export const k8sAuditCatalog: Record<string, RuleMeta> = {
   WK8601: auditRule("WK8601", "merge-worthy", "guidance", "OpenTelemetry Collector runs tail_sampling on every node", "Move tail_sampling from the DaemonSet agent to a gateway Deployment, and send traces to it through a loadbalancing exporter routed by traceID.", { category: "correctness" }),
   WK8602: auditRule("WK8602", "merge-worthy", "guidance", "Multi-replica tail sampling gateway reached without trace-aware load balancing", "Send traces to the gateway through a loadbalancing exporter with routing_key traceID (k8s resolver, or dns on a headless Service), or run the gateway with one replica. It goes silent when the senders are in another build root (chant #1939).", { category: "correctness" }),
   WK8603: auditRule("WK8603", "merge-worthy", "guidance", "k8s_cluster receiver runs in every collector copy", "Run the k8s_cluster receiver in a single-replica Deployment, or set its k8s_leader_elector to a k8s_leader_elector extension enabled in service.extensions.", { category: "correctness" }),
+  WK8604: auditRule("WK8604", "merge-worthy", "guidance", "Collector config in a ConfigMap fails the otel config checks", "Fix the collector config the ConfigMap carries: each finding keeps its OTEL1xx id and names the ConfigMap and key. Change the declared components and pipelines, not the rendered YAML.", { category: "correctness" }),
 };
 
 // Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).

package/src/lint/post-synth/index.ts

@@ -43,6 +43,7 @@ import { wk8505 } from "./wk8505";
 import { wk8601 } from "./wk8601";
 import { wk8602 } from "./wk8602";
 import { wk8603 } from "./wk8603";
+import { wk8604 } from "./wk8604";
 
 export const postSynthChecks: PostSynthCheck[] = [
   argo002,
@@ -88,4 +89,5 @@ export const postSynthChecks: PostSynthCheck[] = [
   wk8601,
   wk8602,
   wk8603,
+  wk8604,
 ];

package/src/lint/post-synth/otel-placement-helpers.ts

@@ -25,7 +25,7 @@
  * `OTEL_COLLECTOR_ANNOTATIONS`.
  */
 
-import { load } from "js-yaml";
+import { parseCollectorConfig as parseOtelCollectorConfig } from "@intentius/chant-lexicon-otel/configmap";
 import { extractContainers, extractPodSpec, type K8sManifest } from "./k8s-helpers";
 
 export const PLACEMENT_ANNOTATIONS = {
@@ -80,17 +80,13 @@ function isRecord(v: unknown): v is Record<string, unknown> {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 
-/** Parse a ConfigMap value as a collector config, or undefined when it isn't one. */
+/**
+ * Parse a ConfigMap value as a collector config, or undefined when it isn't
+ * one. The otel lexicon's parser, shared with its config checks (OTEL101 and
+ * the rest) and WK8604 so every check agrees on what counts as a config.
+ */
 export function parseCollectorConfig(text: unknown): CollectorConfigShape | undefined {
-  if (typeof text !== "string") return undefined;
-  let value: unknown;
-  try {
-    value = load(text);
-  } catch {
-    return undefined;
-  }
-  if (!isRecord(value) || !isRecord(value.service) || !isRecord(value.service.pipelines)) return undefined;
-  return value as unknown as CollectorConfigShape;
+  return parseOtelCollectorConfig(text) as CollectorConfigShape | undefined;
 }
 
 /** The `type` of a component id: `tail_sampling/errors` is `tail_sampling`. */

package/src/lint/post-synth/otel-placement.test.ts

@@ -30,6 +30,7 @@ import { docsToManifests } from "./k8s-helpers";
 import { wk8601 } from "./wk8601";
 import { wk8602 } from "./wk8602";
 import { wk8603 } from "./wk8603";
+import { wk8604 } from "./wk8604";
 
 // ── Fixture builders ────────────────────────────────────────────────
 
@@ -399,3 +400,37 @@ service: { pipelines: { metrics: { receivers: [otlp], exporters: [debug] } } }
     expect(wk8603.check(yaml(configMap("c", { "config.yaml": unused }), workload({ kind: "DaemonSet", name: "agent", configMap: "c" })))).toEqual([]);
   });
 });
+
+// ── WK8604 ──────────────────────────────────────────────────────────
+
+describe("WK8604: the otel config checks over ConfigMap configs", () => {
+  test("reports an undeclared exporter under OTEL101, naming the ConfigMap and key", () => {
+    const broken = PLAIN_CONFIG.replace("exporters: [debug]", "exporters: [debug, otlp/tempo]");
+    const diags = wk8604.check(yaml(configMap("agent-config", { "config.yaml": broken })));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]).toMatchObject({ checkId: "OTEL101", severity: "error", lexicon: "otel" });
+    expect(diags[0].message).toMatch(/^ConfigMap obs\/agent-config, key config\.yaml: /);
+    expect(diags[0].message).toContain("otlp/tempo");
+  });
+
+  test("checks every key that holds a config, defaulting the namespace", () => {
+    const unused = PLAIN_CONFIG.replace("exporters: { debug: {} }", "exporters: { debug: {} }\nprocessors: { batch: {} }");
+    const cm = { apiVersion: "v1", kind: "ConfigMap", metadata: { name: "c" }, data: { "a.yaml": PLAIN_CONFIG, "b.yaml": unused } };
+    const diags = wk8604.check(yaml(cm));
+    expect(diags.map((d) => [d.checkId, d.entity])).toEqual([["OTEL103", "batch"]]);
+    expect(diags[0].message).toContain("ConfigMap default/c, key b.yaml");
+  });
+
+  test("ignores ConfigMap values that are not collector configs", () => {
+    const ctx = yaml(configMap("prometheus-config", { "prometheus.yml": "scrape_configs: []\n", "rules.yml": "groups: [ {" }));
+    expect(wk8604.check(ctx)).toEqual([]);
+  });
+
+  test("passes what OtelCollector, OtelCollectorGateway and GkeOtelCollector render", () => {
+    const gke = GkeOtelCollector({ clusterName: "c", projectId: "p", gcpServiceAccountEmail: "o@p.iam.gserviceaccount.com" });
+    const gateway = samplingGateway(2);
+    const agent = agentSending(gatewayExporter(gateway, { loadBalance: true }));
+    expect(wk8604.check(built({ gke, gateway, agent }))).toEqual([]);
+  });
+});
+