@intentius/chant-lexicon-k8s 0.124.31 → 0.124.32

package/dist/lint/post-synth/wk8042.js

@@ -0,0 +1,36 @@
+/**
+ * WK8042: Private Keys in ConfigMap
+ *
+ * Detects PEM-encoded private keys stored in ConfigMap data values.
+ * Private keys should be stored in Secrets, not ConfigMaps, since
+ * ConfigMaps are not encrypted at rest by default.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+const PRIVATE_KEY_PATTERN = /-----BEGIN\s+[\w\s]*PRIVATE KEY-----/;
+export const wk8042 = {
+    id: "WK8042",
+    description: "Private keys in ConfigMap — private keys should be stored in Secrets, not ConfigMaps",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (manifest.kind !== "ConfigMap")
+                continue;
+            const resourceName = manifest.metadata?.name ?? "ConfigMap";
+            const data = manifest.data;
+            if (typeof data !== "object" || data === null)
+                continue;
+            for (const [key, value] of Object.entries(data)) {
+                if (typeof value === "string" && PRIVATE_KEY_PATTERN.test(value)) {
+                    diagnostics.push({
+                        checkId: "WK8042",
+                        severity: "error",
+                        message: `ConfigMap "${resourceName}" contains a private key in data field "${key}" — use a Secret resource instead`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8101.js

@@ -0,0 +1,52 @@
+/**
+ * WK8101: Deployment Selector Must Match Template Labels
+ *
+ * A Deployment's spec.selector.matchLabels must be a subset of
+ * spec.template.metadata.labels. If they don't match, the Deployment
+ * controller cannot find the Pods it creates, causing a runtime failure.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+export const wk8101 = {
+    id: "WK8101",
+    description: "Deployment selector must match template labels — mismatched selectors cause runtime failures",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (manifest.kind !== "Deployment")
+                continue;
+            const resourceName = manifest.metadata?.name ?? "Deployment";
+            const spec = manifest.spec;
+            if (!spec)
+                continue;
+            const selector = spec.selector;
+            const matchLabels = selector?.matchLabels;
+            if (!matchLabels || typeof matchLabels !== "object")
+                continue;
+            const template = spec.template;
+            const templateMetadata = template?.metadata;
+            const templateLabels = templateMetadata?.labels;
+            if (!templateLabels || typeof templateLabels !== "object") {
+                diagnostics.push({
+                    checkId: "WK8101",
+                    severity: "error",
+                    message: `Deployment "${resourceName}" has spec.selector.matchLabels but no spec.template.metadata.labels`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+                continue;
+            }
+            for (const [key, value] of Object.entries(matchLabels)) {
+                if (templateLabels[key] !== value) {
+                    diagnostics.push({
+                        checkId: "WK8101",
+                        severity: "error",
+                        message: `Deployment "${resourceName}" selector label "${key}=${value}" does not match template label "${key}=${templateLabels[key] ?? '(missing)'}"`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8102.js

@@ -0,0 +1,30 @@
+/**
+ * WK8102: Resources Should Have Metadata Labels
+ *
+ * All Kubernetes resources should have metadata.labels for organizational
+ * purposes. Labels enable filtering, selection, and operational tooling.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+export const wk8102 = {
+    id: "WK8102",
+    description: "Resources should have metadata labels — labels enable filtering and operational tooling",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !manifest.metadata)
+                continue;
+            const resourceName = manifest.metadata.name ?? manifest.kind;
+            const labels = manifest.metadata.labels;
+            if (!labels || typeof labels !== "object" || Object.keys(labels).length === 0) {
+                diagnostics.push({
+                    checkId: "WK8102",
+                    severity: "warning",
+                    message: `${manifest.kind} "${resourceName}" has no metadata.labels — add labels for organizational purposes`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8103.js

@@ -0,0 +1,33 @@
+/**
+ * WK8103: Containers Must Have Name
+ *
+ * Every container in a pod spec must have a `name` field. This is required
+ * by the Kubernetes API and will be rejected at apply time if missing.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8103 = {
+    id: "WK8103",
+    description: "Containers must have name — the name field is required by the Kubernetes API",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (let i = 0; i < containers.length; i++) {
+                const container = containers[i];
+                if (!container.name || typeof container.name !== "string" || container.name.trim() === "") {
+                    diagnostics.push({
+                        checkId: "WK8103",
+                        severity: "error",
+                        message: `${manifest.kind} "${resourceName}" has a container at index ${i} without a name — the name field is required`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8104.js

@@ -0,0 +1,58 @@
+/**
+ * WK8104: Ports Should Be Named
+ *
+ * Container ports and Service ports should have names. Named ports enable
+ * referencing by name in Service targetPort and NetworkPolicy rules,
+ * improving maintainability.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8104 = {
+    id: "WK8104",
+    description: "Ports should be named — named ports improve Service and NetworkPolicy configuration",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            const resourceName = manifest.metadata?.name ?? manifest.kind ?? "(unknown)";
+            // Check container ports in workloads
+            if (manifest.kind && WORKLOAD_KINDS.has(manifest.kind)) {
+                const containers = extractContainers(manifest);
+                for (const container of containers) {
+                    if (!Array.isArray(container.ports))
+                        continue;
+                    for (const port of container.ports) {
+                        if (typeof port === "object" && port !== null && !port.name) {
+                            diagnostics.push({
+                                checkId: "WK8104",
+                                severity: "warning",
+                                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has an unnamed port (containerPort: ${port.containerPort ?? "?"}) — add a name for clarity`,
+                                entity: resourceName,
+                                lexicon: "k8s",
+                            });
+                        }
+                    }
+                }
+            }
+            // Check Service ports
+            if (manifest.kind === "Service") {
+                const spec = manifest.spec;
+                if (!spec)
+                    continue;
+                const ports = spec.ports;
+                if (!Array.isArray(ports))
+                    continue;
+                for (const port of ports) {
+                    if (typeof port === "object" && port !== null && !port.name) {
+                        diagnostics.push({
+                            checkId: "WK8104",
+                            severity: "warning",
+                            message: `Service "${resourceName}" has an unnamed port (port: ${port.port ?? "?"}) — add a name for clarity`,
+                            entity: resourceName,
+                            lexicon: "k8s",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8105.js

@@ -0,0 +1,33 @@
+/**
+ * WK8105: ImagePullPolicy Should Be Explicit
+ *
+ * Containers should have an explicit imagePullPolicy. When omitted,
+ * Kubernetes defaults to "Always" for :latest and "IfNotPresent" for
+ * other tags, which can lead to unexpected behavior.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8105 = {
+    id: "WK8105",
+    description: "ImagePullPolicy should be explicit — avoids surprising default behavior",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                if (!container.imagePullPolicy) {
+                    diagnostics.push({
+                        checkId: "WK8105",
+                        severity: "warning",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has no explicit imagePullPolicy — set it to "Always", "IfNotPresent", or "Never"`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8201.js

@@ -0,0 +1,44 @@
+/**
+ * WK8201: Resource Limits Required
+ *
+ * Containers should have CPU and memory limits defined in resources.limits.
+ * Without limits, a container can consume unbounded resources, potentially
+ * affecting other workloads on the node.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8201 = {
+    id: "WK8201",
+    description: "Resource limits required — containers should have CPU and memory limits",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                const limits = container.resources?.limits;
+                const missing = [];
+                if (!limits || typeof limits !== "object") {
+                    missing.push("cpu", "memory");
+                }
+                else {
+                    if (!limits.cpu)
+                        missing.push("cpu");
+                    if (!limits.memory)
+                        missing.push("memory");
+                }
+                if (missing.length > 0) {
+                    diagnostics.push({
+                        checkId: "WK8201",
+                        severity: "warning",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" is missing resource limits for ${missing.join(", ")}`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8202.js

@@ -0,0 +1,34 @@
+/**
+ * WK8202: No Privileged Containers
+ *
+ * Containers should not run in privileged mode. Privileged containers
+ * have full access to the host's devices and kernel capabilities,
+ * which is a significant security risk.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8202 = {
+    id: "WK8202",
+    description: "No privileged containers — privileged mode grants full host access",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                const secCtx = container.securityContext;
+                if (secCtx && secCtx.privileged === true) {
+                    diagnostics.push({
+                        checkId: "WK8202",
+                        severity: "error",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" runs in privileged mode — this grants full host access and should be avoided`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8203.js

@@ -0,0 +1,34 @@
+/**
+ * WK8203: ReadOnlyRootFilesystem Recommended
+ *
+ * Containers should set securityContext.readOnlyRootFilesystem to true.
+ * A read-only root filesystem prevents runtime modification of the container
+ * image, reducing the attack surface.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8203 = {
+    id: "WK8203",
+    description: "ReadOnlyRootFilesystem recommended — prevents runtime modification of the container image",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                const secCtx = container.securityContext;
+                if (!secCtx || secCtx.readOnlyRootFilesystem !== true) {
+                    diagnostics.push({
+                        checkId: "WK8203",
+                        severity: "warning",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" does not set readOnlyRootFilesystem: true — set it to reduce the attack surface`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8204.js

@@ -0,0 +1,71 @@
+/**
+ * WK8204: RunAsNonRoot Recommended
+ *
+ * Containers should set securityContext.runAsNonRoot to true at either
+ * the container level or pod level. Running as root inside a container
+ * increases the blast radius of a container breakout.
+ *
+ * Additionally warns when runAsNonRoot: true is set but no explicit
+ * runAsUser is provided — without a numeric UID, K8s relies on the
+ * image's USER directive, which may be root (UID 0).
+ */
+import { docsToManifests, extractContainers, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8204 = {
+    id: "WK8204",
+    description: "RunAsNonRoot recommended — running as root increases container breakout risk",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            const podSpec = extractPodSpec(manifest);
+            if (!podSpec)
+                continue;
+            // Check pod-level securityContext
+            const podSecCtx = podSpec.securityContext;
+            const podRunAsNonRoot = podSecCtx?.runAsNonRoot === true;
+            const podRunAsUser = podSecCtx?.runAsUser;
+            const containers = extractContainers(manifest);
+            for (const container of containers) {
+                const secCtx = container.securityContext;
+                const containerRunAsNonRoot = secCtx?.runAsNonRoot === true;
+                const containerRunAsUser = secCtx?.runAsUser;
+                const hasRunAsNonRoot = podRunAsNonRoot || containerRunAsNonRoot;
+                if (!hasRunAsNonRoot) {
+                    diagnostics.push({
+                        checkId: "WK8204",
+                        severity: "warning",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" does not set runAsNonRoot: true — set it at container or pod level`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                    continue;
+                }
+                // runAsNonRoot is true — check for explicit runAsUser
+                const effectiveRunAsUser = containerRunAsUser ?? podRunAsUser;
+                if (effectiveRunAsUser === 0) {
+                    // Contradictory: runAsNonRoot: true + runAsUser: 0
+                    diagnostics.push({
+                        checkId: "WK8204",
+                        severity: "warning",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has runAsNonRoot: true but runAsUser: 0 — these settings are contradictory and the container will fail to start`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+                else if (effectiveRunAsUser === undefined || effectiveRunAsUser === null) {
+                    // runAsNonRoot: true but no explicit UID
+                    diagnostics.push({
+                        checkId: "WK8204",
+                        severity: "warning",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has runAsNonRoot: true but no explicit runAsUser — set a numeric UID to ensure the container doesn't run as root`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8205.js

@@ -0,0 +1,38 @@
+/**
+ * WK8205: Drop ALL Capabilities
+ *
+ * Containers should drop all Linux capabilities and only add back those
+ * explicitly needed. This follows the principle of least privilege and
+ * reduces the attack surface.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8205 = {
+    id: "WK8205",
+    description: "Drop ALL capabilities — containers should drop all capabilities and add only what is needed",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                const secCtx = container.securityContext;
+                const capabilities = secCtx?.capabilities;
+                const drop = capabilities?.drop;
+                const dropsAll = Array.isArray(drop) &&
+                    drop.some((cap) => (typeof cap === "string" && cap.toUpperCase() === "ALL"));
+                if (!dropsAll) {
+                    diagnostics.push({
+                        checkId: "WK8205",
+                        severity: "warning",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" does not drop ALL capabilities — add securityContext.capabilities.drop: ["ALL"]`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8207.js

@@ -0,0 +1,33 @@
+/**
+ * WK8207: No hostNetwork
+ *
+ * Pods should not use hostNetwork: true. Using the host network namespace
+ * bypasses network isolation and allows the pod to access all network
+ * interfaces on the host.
+ */
+import { docsToManifests, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8207 = {
+    id: "WK8207",
+    description: "No hostNetwork — using host network bypasses network isolation",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const podSpec = extractPodSpec(manifest);
+            if (!podSpec)
+                continue;
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            if (podSpec.hostNetwork === true) {
+                diagnostics.push({
+                    checkId: "WK8207",
+                    severity: "warning",
+                    message: `${manifest.kind} "${resourceName}" uses hostNetwork: true — this bypasses network isolation and should be avoided`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8208.js

@@ -0,0 +1,33 @@
+/**
+ * WK8208: No hostPID
+ *
+ * Pods should not use hostPID: true. Sharing the host PID namespace
+ * allows the pod to see and interact with all processes on the host,
+ * which is a significant security risk.
+ */
+import { docsToManifests, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8208 = {
+    id: "WK8208",
+    description: "No hostPID — sharing host PID namespace allows visibility into all host processes",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const podSpec = extractPodSpec(manifest);
+            if (!podSpec)
+                continue;
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            if (podSpec.hostPID === true) {
+                diagnostics.push({
+                    checkId: "WK8208",
+                    severity: "warning",
+                    message: `${manifest.kind} "${resourceName}" uses hostPID: true — this allows visibility into all host processes and should be avoided`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8209.js

@@ -0,0 +1,33 @@
+/**
+ * WK8209: No hostIPC
+ *
+ * Pods should not use hostIPC: true. Sharing the host IPC namespace
+ * allows the pod to access shared memory segments on the host, which
+ * can be used to escalate privileges or exfiltrate data.
+ */
+import { docsToManifests, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8209 = {
+    id: "WK8209",
+    description: "No hostIPC — sharing host IPC namespace can expose shared memory segments",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const podSpec = extractPodSpec(manifest);
+            if (!podSpec)
+                continue;
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            if (podSpec.hostIPC === true) {
+                diagnostics.push({
+                    checkId: "WK8209",
+                    severity: "warning",
+                    message: `${manifest.kind} "${resourceName}" uses hostIPC: true — this exposes host shared memory segments and should be avoided`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8301.js

@@ -0,0 +1,49 @@
+/**
+ * WK8301: Probes Required
+ *
+ * Containers that expose a port should have both livenessProbe and
+ * readinessProbe configured. Without probes, Kubernetes cannot detect
+ * unhealthy containers or know when a container is ready to receive traffic.
+ *
+ * Containers that declare no port (queue/Temporal workers, batch consumers)
+ * are exempt: they take no inbound traffic, so there is no endpoint to
+ * HTTP-probe and no readiness signal for a Service to gate on. Flagging them
+ * would force a placeholder exec probe on a correct, port-less pattern.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8301 = {
+    id: "WK8301",
+    description: "Probes required — containers should have livenessProbe and readinessProbe",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            // CronJobs and Jobs are short-lived — probes are less relevant
+            if (manifest.kind === "Job" || manifest.kind === "CronJob")
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                // No declared port → no inbound traffic → nothing to HTTP-probe.
+                if (!container.ports || container.ports.length === 0)
+                    continue;
+                const missing = [];
+                if (!container.livenessProbe)
+                    missing.push("livenessProbe");
+                if (!container.readinessProbe)
+                    missing.push("readinessProbe");
+                if (missing.length > 0) {
+                    diagnostics.push({
+                        checkId: "WK8301",
+                        severity: "warning",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" is missing ${missing.join(" and ")}`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8302.js

@@ -0,0 +1,34 @@
+/**
+ * WK8302: Replicas >= 2 for High Availability
+ *
+ * Deployments should have at least 2 replicas for high availability.
+ * A single replica means any pod disruption causes downtime.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+export const wk8302 = {
+    id: "WK8302",
+    description: "Replicas >= 2 recommended — single-replica Deployments have no high availability",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (manifest.kind !== "Deployment")
+                continue;
+            const resourceName = manifest.metadata?.name ?? "Deployment";
+            const spec = manifest.spec;
+            if (!spec)
+                continue;
+            const replicas = spec.replicas;
+            // If replicas is omitted, Kubernetes defaults to 1
+            if (replicas === undefined || replicas === null || replicas === 1) {
+                diagnostics.push({
+                    checkId: "WK8302",
+                    severity: "info",
+                    message: `Deployment "${resourceName}" has ${replicas ?? 1} replica(s) — consider at least 2 for high availability`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};