@intentius/chant-lexicon-k8s 0.124.31 → 0.124.32

package/dist/lint/post-synth/monitoring-selection-helpers.js

@@ -0,0 +1,163 @@
+/**
+ * Shared plumbing for the Prometheus Operator selection checks (WK8701-WK8705).
+ *
+ * An operator accepts a PrometheusRule, monitor or AlertmanagerConfig that no
+ * Prometheus or Alertmanager selects and then ignores it without an error.
+ * These helpers decide, from the manifests in one build, whether a selector
+ * picks an object, following the operator's rules for a label selector:
+ *
+ *   - an object selector that is null (or absent) matches nothing, `{}` matches all;
+ *   - a namespace selector that is null (or absent) matches only the selecting
+ *     resource's own namespace, `{}` matches every namespace.
+ *
+ * Namespace labels come from the Namespace manifests in the build, plus the
+ * `kubernetes.io/metadata.name` label every namespace carries. A selector on a
+ * label the build cannot know (the namespace is not declared in it) answers
+ * "unknown", and the checks stay silent on "unknown".
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+export const MONITORING_GROUP = "monitoring.coreos.com/";
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** A manifest of a monitoring.coreos.com kind, whatever the version. */
+export function ofMonitoringKind(m, kind) {
+    return m.kind === kind && typeof m.apiVersion === "string" && m.apiVersion.startsWith(MONITORING_GROUP);
+}
+export function monitoringKind(manifests, kind) {
+    return manifests.filter((m) => ofMonitoringKind(m, kind));
+}
+export function namespaceOf(m) {
+    return typeof m.metadata?.namespace === "string" && m.metadata.namespace !== "" ? m.metadata.namespace : "default";
+}
+export function nameOf(m) {
+    return typeof m.metadata?.name === "string" ? m.metadata.name : "";
+}
+export function describe(m) {
+    return `${m.kind} ${namespaceOf(m)}/${nameOf(m)}`;
+}
+/**
+ * Whether a label selector matches a label set. Null, undefined and anything
+ * that is not an object match nothing; `{}` matches everything.
+ * `unknownKeys` are label keys the caller cannot read (a namespace the build
+ * does not declare); a requirement on one answers "unknown".
+ */
+export function matchLabelSelector(selector, labels, unknownKeys = new Set()) {
+    if (!isRecord(selector))
+        return "no";
+    let unknown = false;
+    const matchLabels = isRecord(selector.matchLabels) ? selector.matchLabels : {};
+    for (const [k, v] of Object.entries(matchLabels)) {
+        if (unknownKeys.has(k)) {
+            unknown = true;
+        }
+        else if (labels[k] !== String(v)) {
+            return "no";
+        }
+    }
+    const exprs = Array.isArray(selector.matchExpressions) ? selector.matchExpressions : [];
+    for (const e of exprs) {
+        if (!isRecord(e) || typeof e.key !== "string")
+            continue;
+        if (unknownKeys.has(e.key)) {
+            unknown = true;
+            continue;
+        }
+        const values = Array.isArray(e.values) ? e.values.map(String) : [];
+        const has = Object.prototype.hasOwnProperty.call(labels, e.key);
+        switch (e.operator) {
+            case "In":
+                if (!has || !values.includes(labels[e.key]))
+                    return "no";
+                break;
+            case "NotIn":
+                if (has && values.includes(labels[e.key]))
+                    return "no";
+                break;
+            case "Exists":
+                if (!has)
+                    return "no";
+                break;
+            case "DoesNotExist":
+                if (has)
+                    return "no";
+                break;
+        }
+    }
+    return unknown ? "unknown" : "yes";
+}
+export function labelsOf(m) {
+    const out = {};
+    const labels = m.metadata?.labels;
+    if (isRecord(labels))
+        for (const [k, v] of Object.entries(labels))
+            out[k] = String(v);
+    return out;
+}
+/** The namespaces a build declares, with their labels. */
+function declaredNamespaces(manifests) {
+    const out = new Map();
+    for (const m of manifests) {
+        if (m.kind === "Namespace" && (m.apiVersion === "v1" || m.apiVersion === undefined) && nameOf(m)) {
+            out.set(nameOf(m), { ...labelsOf(m), "kubernetes.io/metadata.name": nameOf(m) });
+        }
+    }
+    return out;
+}
+/**
+ * Whether a selecting resource's namespace selector picks `targetNamespace`.
+ * Null or absent: the selecting resource's own namespace only.
+ */
+export function matchNamespaceSelector(selector, ownNamespace, targetNamespace, namespaces) {
+    if (!isRecord(selector))
+        return ownNamespace === targetNamespace ? "yes" : "no";
+    const declared = namespaces.get(targetNamespace);
+    const labels = declared ?? { "kubernetes.io/metadata.name": targetNamespace };
+    // A namespace the build does not declare has labels the build cannot know, except the name label.
+    const unknownKeys = new Set();
+    if (!declared) {
+        const keys = [
+            ...Object.keys(isRecord(selector.matchLabels) ? selector.matchLabels : {}),
+            ...(Array.isArray(selector.matchExpressions) ? selector.matchExpressions : []).map((e) => (isRecord(e) ? String(e.key) : "")),
+        ];
+        for (const k of keys)
+            if (k !== "kubernetes.io/metadata.name")
+                unknownKeys.add(k);
+    }
+    return matchLabelSelector(selector, labels, unknownKeys);
+}
+/** A selecting resource's reach over one object: its object selector, then its namespace selector. */
+export function selects(selector, namespaceSelector, selecting, object, namespaces) {
+    const ns = matchNamespaceSelector(namespaceSelector, namespaceOf(selecting), namespaceOf(object), namespaces);
+    if (ns === "no")
+        return "no";
+    const obj = matchLabelSelector(selector, labelsOf(object));
+    if (obj === "no")
+        return "no";
+    return ns === "unknown" || obj === "unknown" ? "unknown" : "yes";
+}
+export function selectionContext(ctx) {
+    const manifests = docsToManifests(ctx);
+    return { manifests, namespaces: declaredNamespaces(manifests) };
+}
+/**
+ * Objects of `kinds` that no resource in `selectors` selects, by the named
+ * object selector and namespace selector fields of each selector's spec.
+ * Silent (empty) when `selectors` is empty, since the stack is often installed
+ * separately. A selector that answers "unknown" counts as selecting.
+ */
+export function unselected(sc, objects, selectors, fields) {
+    if (selectors.length === 0)
+        return [];
+    return objects.filter((object) => {
+        for (const sel of selectors) {
+            const f = fields(sel, object);
+            if (!f)
+                continue;
+            const spec = (sel.spec ?? {});
+            if (selects(spec[f[0]], spec[f[1]], sel, object, sc.namespaces) !== "no")
+                return false;
+        }
+        return true;
+    });
+}

package/dist/lint/post-synth/otel-placement-helpers.js

@@ -0,0 +1,293 @@
+/**
+ * Where each OpenTelemetry Collector config in a k8s build runs: the join
+ * WK8601, WK8602 and WK8603 read (chant #2899).
+ *
+ * The collector config is a YAML string inside a ConfigMap, and whether it
+ * runs once per node or as N replicas lives on another document, the workload
+ * that mounts it. A config is joined to its workload in this order:
+ *
+ * 1. The workload's `otel.chant.dev/config` annotation, written by
+ *    `OtelCollector` and `OtelCollectorGateway`, naming the ConfigMap whose
+ *    `config.yaml` it runs.
+ * 2. Otherwise the ConfigMaps the pod spec mounts as volumes (how
+ *    `GkeOtelCollector` and hand-written manifests link them), keeping only
+ *    data keys that parse as a collector config (a `service.pipelines` map).
+ *    When a container passes `--config=<path>`, only keys named by those
+ *    paths count.
+ *
+ * 3. An OpenTelemetry Operator `OpenTelemetryCollector` carries its config in
+ *    `spec.config` (an object in v1beta1, a YAML string in v1alpha1) and its
+ *    placement in `spec.mode` and `spec.replicas`; it is its own workload. A
+ *    `sidecar` runs inside other pods and is left out. The Services the
+ *    operator makes (`<name>-collector`, `<name>-collector-headless`) are not
+ *    in the build, so \`servicesSelecting\` names them from the CR.
+ *
+ * Anything this can't resolve (a ConfigMap or workload outside the build, a
+ * replica count that isn't a number) is left out, so the checks stay silent
+ * rather than guess. Like every bundle-join check they see one build root at
+ * a time (chant #1939).
+ *
+ * The annotation keys are repeated here rather than imported from the
+ * composites, whose module pulls in the otel lexicon; a test pins them to
+ * `OTEL_COLLECTOR_ANNOTATIONS`.
+ */
+import { parseCollectorConfig as parseOtelCollectorConfig } from "@intentius/chant-lexicon-otel/configmap";
+import { extractContainers, extractPodSpec } from "./k8s-helpers.js";
+export const PLACEMENT_ANNOTATIONS = {
+    role: "otel.chant.dev/role",
+    workload: "otel.chant.dev/workload",
+    config: "otel.chant.dev/config",
+    gateways: "otel.chant.dev/gateways",
+    header: "otel.chant.dev/header",
+};
+const PLACED_KINDS = new Set(["DaemonSet", "Deployment", "StatefulSet"]);
+const OTEL_OPERATOR_KINDS = { daemonset: "DaemonSet", deployment: "Deployment", statefulset: "StatefulSet" };
+/** An OpenTelemetry Operator `OpenTelemetryCollector` (any version of `opentelemetry.io`). */
+export function isOperatorCollector(m) {
+    return m.kind === "OpenTelemetryCollector" && typeof m.apiVersion === "string" && m.apiVersion.startsWith("opentelemetry.io/");
+}
+/** The placement of one `OpenTelemetryCollector`, or undefined for a sidecar, a missing name or a config that isn't one. */
+function operatorPlacement(cr) {
+    const name = cr.metadata?.name;
+    if (typeof name !== "string")
+        return undefined;
+    const mode = cr.spec?.mode === undefined || cr.spec.mode === null ? "deployment" : cr.spec.mode;
+    if (typeof mode !== "string" || !(mode in OTEL_OPERATOR_KINDS))
+        return undefined;
+    const kind = OTEL_OPERATOR_KINDS[mode];
+    // v1beta1 holds the config as an object, v1alpha1 as YAML text.
+    const raw = cr.spec?.config;
+    const config = isRecord(raw)
+        ? parseCollectorConfig(JSON.stringify(raw))
+        : parseCollectorConfig(raw);
+    if (!config)
+        return undefined;
+    let replicas;
+    if (kind !== "DaemonSet") {
+        const r = cr.spec?.replicas;
+        const base = r === undefined || r === null ? 1 : typeof r === "number" ? r : undefined;
+        const auto = isRecord(cr.spec?.autoscaler) ? cr.spec.autoscaler.maxReplicas : undefined;
+        replicas = base === undefined ? undefined : Math.max(base, typeof auto === "number" ? auto : 0);
+    }
+    return { workload: cr, kind, name, namespace: ns(cr), replicas, configMap: name, key: "spec.config", config, where: "spec.config", operatorCR: true };
+}
+function ns(m) {
+    const n = m.metadata?.namespace;
+    return typeof n === "string" && n.length > 0 ? n : "default";
+}
+function annotations(m) {
+    const a = m.metadata?.annotations;
+    return a && typeof a === "object" ? a : {};
+}
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Parse a ConfigMap value as a collector config, or undefined when it isn't
+ * one. The otel lexicon's parser, shared with its config checks (OTEL101 and
+ * the rest) and WK8604 so every check agrees on what counts as a config.
+ */
+export function parseCollectorConfig(text) {
+    return parseOtelCollectorConfig(text);
+}
+/** The `type` of a component id: `tail_sampling/errors` is `tail_sampling`. */
+export function componentType(id) {
+    const slash = id.indexOf("/");
+    return slash === -1 ? id : id.slice(0, slash);
+}
+function stringList(v) {
+    return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+}
+/** The pipelines of one signal (`traces`, `traces/sampled`, ...) as [id, pipeline] pairs. */
+export function pipelinesOf(config, signal) {
+    const out = [];
+    for (const [id, p] of Object.entries(config.service.pipelines)) {
+        if (componentType(id) !== signal || !isRecord(p))
+            continue;
+        out.push([id, { receivers: stringList(p.receivers), processors: stringList(p.processors), exporters: stringList(p.exporters) }]);
+    }
+    return out;
+}
+/** Every pipeline, whatever its signal. */
+export function allPipelines(config) {
+    return ["traces", "metrics", "logs"].flatMap((s) => pipelinesOf(config, s));
+}
+/** Processor ids of `type` that a traces pipeline runs. */
+export function tracePipelineProcessors(config, type) {
+    const out = new Set();
+    for (const [, p] of pipelinesOf(config, "traces")) {
+        for (const id of p.processors)
+            if (componentType(id) === type)
+                out.add(id);
+    }
+    return [...out];
+}
+/** The ConfigMap file names a workload's containers pass with `--config`. */
+function configArgNames(workload) {
+    const names = [];
+    for (const c of extractContainers(workload)) {
+        const argv = [...stringList(c.command), ...stringList(c.args)];
+        for (let i = 0; i < argv.length; i++) {
+            let path;
+            if (argv[i].startsWith("--config="))
+                path = argv[i].slice("--config=".length);
+            else if (argv[i] === "--config")
+                path = argv[i + 1];
+            if (!path)
+                continue;
+            // `--config=env:...`, `--config=yaml:...` and URLs are not files.
+            if (/^[a-z]+:/.test(path))
+                continue;
+            names.push(path.slice(path.lastIndexOf("/") + 1));
+        }
+    }
+    return names;
+}
+/** ConfigMap names mounted by a workload's pod spec, directly or through a projected volume. */
+function mountedConfigMaps(workload) {
+    const pod = extractPodSpec(workload);
+    const out = [];
+    for (const v of Array.isArray(pod?.volumes) ? pod.volumes : []) {
+        if (!isRecord(v))
+            continue;
+        const cm = isRecord(v.configMap) ? v.configMap.name : undefined;
+        if (typeof cm === "string")
+            out.push(cm);
+        const sources = isRecord(v.projected) && Array.isArray(v.projected.sources) ? v.projected.sources : [];
+        for (const s of sources) {
+            const name = isRecord(s) && isRecord(s.configMap) ? s.configMap.name : undefined;
+            if (typeof name === "string")
+                out.push(name);
+        }
+    }
+    return out;
+}
+/** The max replica count an HPA allows for kind/name in a namespace, if one targets it. */
+function hpaMax(manifests, kind, name, namespace) {
+    let max;
+    for (const m of manifests) {
+        if (m.kind !== "HorizontalPodAutoscaler" || ns(m) !== namespace)
+            continue;
+        const target = isRecord(m.spec?.scaleTargetRef) ? m.spec.scaleTargetRef : undefined;
+        if (!target || target.kind !== kind || target.name !== name)
+            continue;
+        const n = m.spec?.maxReplicas;
+        if (typeof n === "number")
+            max = Math.max(max ?? 0, n);
+    }
+    return max;
+}
+/** Join every collector config in the build to the workload that runs it. */
+export function collectorPlacements(manifests) {
+    const configMaps = new Map();
+    for (const m of manifests) {
+        if (m.kind === "ConfigMap" && typeof m.metadata?.name === "string")
+            configMaps.set(`${ns(m)}/${m.metadata.name}`, m);
+    }
+    const out = [];
+    for (const workload of manifests) {
+        if (!workload.kind || !PLACED_KINDS.has(workload.kind))
+            continue;
+        const name = workload.metadata?.name;
+        if (typeof name !== "string")
+            continue;
+        const namespace = ns(workload);
+        const kind = workload.kind;
+        let replicas;
+        if (kind !== "DaemonSet") {
+            const r = workload.spec?.replicas;
+            const base = r === undefined || r === null ? 1 : typeof r === "number" ? r : undefined;
+            const hpa = hpaMax(manifests, kind, name, namespace);
+            replicas = base === undefined ? undefined : Math.max(base, hpa ?? 0);
+        }
+        const annotated = annotations(workload)[PLACEMENT_ANNOTATIONS.config];
+        const candidates = typeof annotated === "string"
+            ? [{ configMap: annotated, keys: ["config.yaml"] }]
+            : mountedConfigMaps(workload).map((configMap) => ({ configMap }));
+        const argNames = configArgNames(workload);
+        for (const { configMap, keys } of candidates) {
+            const cm = configMaps.get(`${namespace}/${configMap}`);
+            if (!cm || !isRecord(cm.data))
+                continue;
+            const parsed = [];
+            for (const [key, text] of Object.entries(cm.data)) {
+                if (keys && !keys.includes(key))
+                    continue;
+                const config = parseCollectorConfig(text);
+                if (config)
+                    parsed.push([key, config]);
+            }
+            const named = parsed.filter(([key]) => argNames.includes(key));
+            for (const [key, config] of named.length > 0 ? named : parsed) {
+                out.push({ workload, kind, name, namespace, replicas, configMap, key, config, where: `ConfigMap ${configMap}, ${key}` });
+            }
+        }
+    }
+    for (const m of manifests) {
+        if (!isOperatorCollector(m))
+            continue;
+        const p = operatorPlacement(m);
+        if (p)
+            out.push(p);
+    }
+    return out;
+}
+/** How a placement is described in a message: `DaemonSet observability/otel-agent`. */
+export function describePlacement(p) {
+    if (p.operatorCR)
+        return `OpenTelemetryCollector ${p.namespace}/${p.name} (mode ${p.kind.toLowerCase()})`;
+    return `${p.kind} ${p.namespace}/${p.name}`;
+}
+/** The Services in a workload's namespace whose selector matches its pod template labels. */
+export function servicesSelecting(manifests, workload) {
+    // The operator's Services for a CR are not in the build; their names are fixed by the operator.
+    if (isOperatorCollector(workload) && typeof workload.metadata?.name === "string") {
+        const name = workload.metadata.name;
+        return [
+            { name: `${name}-collector`, namespace: ns(workload), headless: false },
+            { name: `${name}-collector-headless`, namespace: ns(workload), headless: true },
+        ];
+    }
+    const template = isRecord(workload.spec?.template) ? workload.spec.template : undefined;
+    const labels = isRecord(template?.metadata) && isRecord(template.metadata.labels) ? template.metadata.labels : {};
+    const out = [];
+    for (const m of manifests) {
+        if (m.kind !== "Service" || ns(m) !== ns(workload) || typeof m.metadata?.name !== "string")
+            continue;
+        const selector = isRecord(m.spec?.selector) ? m.spec.selector : undefined;
+        if (!selector || Object.keys(selector).length === 0)
+            continue;
+        if (!Object.entries(selector).every(([k, v]) => labels[k] === v))
+            continue;
+        out.push({ name: m.metadata.name, namespace: ns(m), headless: m.spec?.clusterIP === "None" });
+    }
+    return out;
+}
+/**
+ * The Service a hostname names, as `name.namespace`, when it has the shape of
+ * cluster DNS: `name`, `name.ns`, `name.ns.svc` or `name.ns.svc.<domain>`.
+ * A bare `name` resolves in the caller's namespace.
+ */
+export function serviceOfHost(host, callerNamespace) {
+    const parts = host.split(".");
+    if (parts.some((p) => p.length === 0))
+        return undefined;
+    if (parts.length === 1)
+        return `${parts[0]}.${callerNamespace}`;
+    if (parts.length === 2)
+        return `${parts[0]}.${parts[1]}`;
+    if (parts[2] === "svc")
+        return `${parts[0]}.${parts[1]}`;
+    return undefined;
+}
+/** The host of an exporter endpoint: `host:port`, `scheme://host:port/path` or `dns:///host:port`. */
+export function hostOfEndpoint(endpoint) {
+    if (typeof endpoint !== "string" || endpoint.length === 0)
+        return undefined;
+    let rest = endpoint.replace(/^[a-z][a-z0-9+.-]*:\/\/\/?/i, "");
+    rest = rest.split("/")[0];
+    if (rest.startsWith("["))
+        return undefined;
+    const colon = rest.lastIndexOf(":");
+    return colon === -1 ? rest : rest.slice(0, colon);
+}

package/dist/lint/post-synth/sops-helpers.js

@@ -0,0 +1,43 @@
+import { getAdditionalFiles } from "./k8s-helpers.js";
+import { committedEncryptedDeclarations, sidecarFilename, validateEncryptedSecretDocument } from "../../sops/encrypted-secret-file.js";
+/** Every sidecar file across every lexicon output, keyed by filename. */
+export function allAdditionalFiles(ctx) {
+    const files = new Map();
+    for (const [, output] of ctx.outputs) {
+        for (const [filename, content] of Object.entries(getAdditionalFiles(output))) {
+            files.set(filename, content);
+        }
+    }
+    return files;
+}
+/**
+ * Join every committed-encrypted declaration to its emitted sidecar,
+ * validating the document as it goes. A declaration with no sidecar comes
+ * back with `text` undefined and one problem naming the missing file.
+ */
+export function resolveEncryptedSecretClaims(ctx) {
+    const declarations = committedEncryptedDeclarations(ctx.entities);
+    if (declarations.size === 0)
+        return [];
+    const files = allAdditionalFiles(ctx);
+    const resolved = [];
+    for (const [entityName, declaration] of declarations) {
+        const filename = sidecarFilename(declaration.file);
+        const text = files.get(filename);
+        if (text === undefined) {
+            resolved.push({
+                entityName,
+                declaration,
+                filename,
+                problems: [
+                    `the build emitted no file for "${declaration.file}" — ` +
+                        `the declared ciphertext did not resolve`,
+                ],
+            });
+            continue;
+        }
+        const { problems, document } = validateEncryptedSecretDocument(text, declaration);
+        resolved.push({ entityName, declaration, filename, text, problems, document });
+    }
+    return resolved;
+}

package/dist/lint/post-synth/wk8005.js

@@ -0,0 +1,44 @@
+/**
+ * WK8005: Hardcoded Secrets in Environment Variables
+ *
+ * Detects container environment variables with names suggesting sensitive
+ * values (password, token, key, secret) that use hardcoded string values
+ * instead of secretKeyRef or configMapKeyRef.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+const SENSITIVE_NAME_PATTERN = /password|token|key|secret/i;
+export const wk8005 = {
+    id: "WK8005",
+    description: "Hardcoded secrets in env vars — sensitive environment variables should use secretKeyRef",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                if (!Array.isArray(container.env))
+                    continue;
+                for (const envVar of container.env) {
+                    if (typeof envVar.name === "string" &&
+                        SENSITIVE_NAME_PATTERN.test(envVar.name) &&
+                        envVar.value !== undefined &&
+                        envVar.value !== null &&
+                        typeof envVar.value === "string" &&
+                        envVar.value !== "" &&
+                        !envVar.valueFrom) {
+                        diagnostics.push({
+                            checkId: "WK8005",
+                            severity: "error",
+                            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has hardcoded value for sensitive env var "${envVar.name}" — use secretKeyRef instead`,
+                            entity: resourceName,
+                            lexicon: "k8s",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8006.js

@@ -0,0 +1,56 @@
+/**
+ * WK8006: No :latest or Untagged Images
+ *
+ * Container images should use explicit version tags for reproducibility.
+ * Flags images using the `:latest` tag or no tag at all.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8006 = {
+    id: "WK8006",
+    description: "No :latest or untagged images — container images should use explicit version tags",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                const image = container.image;
+                if (typeof image !== "string" || image === "")
+                    continue;
+                // Split off digest (@sha256:...) — those are pinned and fine
+                if (image.includes("@"))
+                    continue;
+                // Extract the tag portion (after the last colon that isn't part of a port)
+                // Images can be: name, name:tag, registry:port/name, registry:port/name:tag
+                const slashIndex = image.lastIndexOf("/");
+                const afterSlash = slashIndex >= 0 ? image.slice(slashIndex + 1) : image;
+                const colonIndex = afterSlash.lastIndexOf(":");
+                if (colonIndex === -1) {
+                    // No tag at all
+                    diagnostics.push({
+                        checkId: "WK8006",
+                        severity: "warning",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses untagged image "${image}" — specify an explicit version tag`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+                else {
+                    const tag = afterSlash.slice(colonIndex + 1);
+                    if (tag === "latest") {
+                        diagnostics.push({
+                            checkId: "WK8006",
+                            severity: "warning",
+                            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses :latest tag on image "${image}" — use a specific version tag`,
+                            entity: resourceName,
+                            lexicon: "k8s",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8041.js

@@ -0,0 +1,60 @@
+/**
+ * WK8041: Hardcoded API Keys
+ *
+ * Detects well-known API key patterns in container environment variable values.
+ * Catches Stripe keys, GitHub PATs, AWS access keys, Google API keys, and
+ * other common credential formats.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+/**
+ * Known API key patterns and their descriptions.
+ */
+const API_KEY_PATTERNS = [
+    { pattern: /^sk_live_/, label: "Stripe secret key" },
+    { pattern: /^pk_live_/, label: "Stripe publishable key" },
+    { pattern: /^sk_test_/, label: "Stripe test secret key" },
+    { pattern: /^pk_test_/, label: "Stripe test publishable key" },
+    { pattern: /^ghp_[A-Za-z0-9_]{36,}/, label: "GitHub personal access token" },
+    { pattern: /^gho_[A-Za-z0-9_]{36,}/, label: "GitHub OAuth token" },
+    { pattern: /^ghs_[A-Za-z0-9_]{36,}/, label: "GitHub app installation token" },
+    { pattern: /^ghu_[A-Za-z0-9_]{36,}/, label: "GitHub user-to-server token" },
+    { pattern: /^ghr_[A-Za-z0-9_]{36,}/, label: "GitHub refresh token" },
+    { pattern: /^AKIA[A-Z0-9]{16}$/, label: "AWS access key ID" },
+    { pattern: /^AIza[A-Za-z0-9_-]{35}$/, label: "Google API key" },
+    { pattern: /^xox[bprs]-[A-Za-z0-9-]+/, label: "Slack token" },
+    { pattern: /^SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}$/, label: "SendGrid API key" },
+];
+export const wk8041 = {
+    id: "WK8041",
+    description: "Hardcoded API keys — detects well-known API key patterns in env var values",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                if (!Array.isArray(container.env))
+                    continue;
+                for (const envVar of container.env) {
+                    if (typeof envVar.value !== "string" || envVar.value === "")
+                        continue;
+                    for (const { pattern, label } of API_KEY_PATTERNS) {
+                        if (pattern.test(envVar.value)) {
+                            diagnostics.push({
+                                checkId: "WK8041",
+                                severity: "error",
+                                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has a ${label} hardcoded in env var "${envVar.name ?? "(unnamed)"}" — use a Secret reference instead`,
+                                entity: resourceName,
+                                lexicon: "k8s",
+                            });
+                            break; // One match per env var is sufficient
+                        }
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};