@intentius/chant-lexicon-k8s 0.124.31 → 0.124.33

package/dist/crd/crd-sources.js

@@ -0,0 +1,615 @@
+/**
+ * Third-party CRD sources included in k8s lexicon generation.
+ *
+ * Add entries here to have CRDs fetched and code-generated alongside
+ * the core Kubernetes OpenAPI types. The CRD YAML is fetched at
+ * generation time (npm run generate) and baked into the output.
+ */
+/**
+ * KubeRay operator CRDs — ray.io/v1
+ *
+ * Produces:
+ *   K8s::Ray::RayCluster  → apiVersion: ray.io/v1, kind: RayCluster
+ *   K8s::Ray::RayJob      → apiVersion: ray.io/v1, kind: RayJob
+ *   K8s::Ray::RayService  → apiVersion: ray.io/v1, kind: RayService
+ *
+ * Operator install: kubectl apply -f
+ *   https://github.com/ray-project/kuberay/releases/download/v1.3.0/kuberay-operator.yaml
+ */
+const KUBERAY_VERSION = "v1.3.0";
+const KUBERAY_CRD_BASE = `https://raw.githubusercontent.com/ray-project/kuberay/${KUBERAY_VERSION}/helm-chart/kuberay-operator/crds`;
+/**
+ * Argo CD CRDs — argoproj.io/v1alpha1
+ *
+ * Produces (the `argoproj.io` group is mapped to the `Argo` namespace —
+ * see GROUP_NAMESPACE_OVERRIDES in group-namespace.ts):
+ *   K8s::Argo::Application     → apiVersion: argoproj.io/v1alpha1, kind: Application
+ *   K8s::Argo::ApplicationSet  → apiVersion: argoproj.io/v1alpha1, kind: ApplicationSet
+ *   K8s::Argo::AppProject      → apiVersion: argoproj.io/v1alpha1, kind: AppProject
+ *
+ * Operator install: kubectl apply -n argocd -f
+ *   https://raw.githubusercontent.com/argoproj/argo-cd/v2.13.3/manifests/install.yaml
+ */
+const ARGOCD_VERSION = "v2.13.3";
+const ARGOCD_CRD_BASE = `https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/crds`;
+/**
+ * Gateway API CRDs — gateway.networking.k8s.io (standard channel)
+ *
+ * The modern, portable replacement for Ingress. GRPCRoute in particular is the
+ * native way to express a gRPC route (vs. ingress-controller annotations).
+ *
+ * Produces (the `gateway.networking.k8s.io` group maps to the `Gateway`
+ * namespace via the first-segment rule in crd/parser.ts):
+ *   K8s::Gateway::GatewayClass    → apiVersion: gateway.networking.k8s.io/v1,      kind: GatewayClass
+ *   K8s::Gateway::Gateway         → apiVersion: gateway.networking.k8s.io/v1,      kind: Gateway
+ *   K8s::Gateway::HTTPRoute       → apiVersion: gateway.networking.k8s.io/v1,      kind: HTTPRoute
+ *   K8s::Gateway::GRPCRoute       → apiVersion: gateway.networking.k8s.io/v1,      kind: GRPCRoute
+ *   K8s::Gateway::ReferenceGrant  → apiVersion: gateway.networking.k8s.io/v1beta1, kind: ReferenceGrant
+ *
+ * CRD install: kubectl apply -f
+ *   https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml
+ */
+const GATEWAY_API_VERSION = "v1.2.1";
+const GATEWAY_API_CRD_BASE = `https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/${GATEWAY_API_VERSION}/config/crd/standard`;
+/**
+ * CockroachDB Kubernetes Operator CRD — crdb.cockroachlabs.com/v1alpha1
+ *
+ * The operator-managed path for a CockroachDB cluster (the operator handles
+ * version upgrades, scale-down decommissioning, and cert rotation). Complements
+ * the self-managed `CockroachDbCluster` StatefulSet composite.
+ *
+ * Produces (the `crdb.cockroachlabs.com` group maps to the `Crdb` namespace via
+ * the first-segment rule in crd/parser.ts):
+ *   K8s::Crdb::CrdbCluster  → apiVersion: crdb.cockroachlabs.com/v1alpha1, kind: CrdbCluster
+ *
+ * Operator install: kubectl apply -f
+ *   https://github.com/cockroachdb/cockroach-operator/releases/download/v2.17.0/install/operator.yaml
+ */
+const COCKROACH_OPERATOR_VERSION = "v2.17.0";
+const COCKROACH_OPERATOR_CRD_BASE = `https://raw.githubusercontent.com/cockroachdb/cockroach-operator/${COCKROACH_OPERATOR_VERSION}/config/crd/bases`;
+/**
+ * cert-manager CRDs — cert-manager.io + acme.cert-manager.io
+ *
+ * The de-facto TLS cert issuance/rotation controller. A single multi-doc bundle
+ * (the parser uses loadAll) produces, under the `CertManager` and `Acme`
+ * namespaces (first-segment rule; "cert-manager.io" → "CertManager"):
+ *   K8s::CertManager::Certificate         → cert-manager.io/v1
+ *   K8s::CertManager::CertificateRequest  → cert-manager.io/v1
+ *   K8s::CertManager::Issuer              → cert-manager.io/v1
+ *   K8s::CertManager::ClusterIssuer       → cert-manager.io/v1
+ *   K8s::Acme::Challenge                  → acme.cert-manager.io/v1
+ *   K8s::Acme::Order                      → acme.cert-manager.io/v1
+ *
+ * Controller install: kubectl apply -f
+ *   https://github.com/cert-manager/cert-manager/releases/download/v1.16.2/cert-manager.yaml
+ */
+const CERT_MANAGER_VERSION = "v1.16.2";
+const CERT_MANAGER_CRD_BUNDLE = `https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.crds.yaml`;
+/**
+ * CloudNativePG CRDs — postgresql.cnpg.io/v1
+ *
+ * The Postgres operator. Produces, under the `Cnpg` namespace (both groups are
+ * mapped there explicitly in parser.ts; the first-segment rule would otherwise
+ * split them into `Postgresql` and `Barmancloud`):
+ *   K8s::Cnpg::Cluster          → postgresql.cnpg.io/v1
+ *   K8s::Cnpg::ScheduledBackup  → postgresql.cnpg.io/v1
+ *   K8s::Cnpg::Backup           → postgresql.cnpg.io/v1
+ *   K8s::Cnpg::Pooler           → postgresql.cnpg.io/v1
+ *
+ * Pinned to 1.29.1 rather than latest (1.30.0) because that is the operator a
+ * real consumer runs — BinaryBourbon/fountain's k8s overlay.
+ *
+ * Note on ScheduledBackup.schedule: it is a **six**-field cron with leading
+ * seconds, not the five-field form Kubernetes CronJob takes. The schema types
+ * it as a plain string, so a five-field value passes every check here and
+ * silently means something else on the cluster.
+ *
+ * Database, Publication and Subscription are deliberately left out — no known
+ * consumer needs them, and pulling a whole provider is what the note at the top
+ * of this file warns against.
+ *
+ * Operator install: kubectl apply --server-side -f
+ *   https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.29/releases/cnpg-1.29.1.yaml
+ */
+const CNPG_VERSION = "v1.29.1";
+const CNPG_CRD_BASE = `https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/${CNPG_VERSION}/config/crd/bases`;
+/**
+ * barman-cloud plugin CRD — barmancloud.cnpg.io/v1
+ *
+ * CNPG's WAL archiving / object-storage backend, shipped as a separate plugin
+ * with its own release train. Produces:
+ *   K8s::Cnpg::ObjectStore  → barmancloud.cnpg.io/v1
+ *
+ * A CNPG Cluster reaches it through `spec.plugins[]` — `name:
+ * barman-cloud.cloudnative-pg.io`, `isWALArchiver: true`,
+ * `parameters.barmanObjectName` naming the ObjectStore — so the two are only
+ * ever useful together.
+ *
+ * Pinned to 0.14.0 (latest). Its ObjectStore schema is a superset of 0.7.0's:
+ * same four spec properties, more detail inside them.
+ *
+ * Plugin install: kubectl apply -f
+ *   https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.14.0/manifest.yaml
+ */
+const BARMAN_PLUGIN_VERSION = "v0.14.0";
+const BARMAN_PLUGIN_CRD_BASE = `https://raw.githubusercontent.com/cloudnative-pg/plugin-barman-cloud/${BARMAN_PLUGIN_VERSION}/config/crd/bases`;
+/**
+ * Traefik proxy CRDs — traefik.io/v1alpha1
+ *
+ * Traefik's own routing surface. An `IngressRoute` is not a
+ * `networking.k8s.io` Ingress with annotations — it is a distinct CRD with its
+ * own matcher grammar, so an estate fronted by Traefik has no expressible edge
+ * without these. Produces, under the `Traefik` namespace (first-segment rule,
+ * no override needed):
+ *   K8s::Traefik::IngressRoute          K8s::Traefik::Middleware
+ *   K8s::Traefik::IngressRouteTCP       K8s::Traefik::MiddlewareTCP
+ *   K8s::Traefik::IngressRouteUDP       K8s::Traefik::ServersTransport
+ *   K8s::Traefik::TLSOption             K8s::Traefik::ServersTransportTCP
+ *   K8s::Traefik::TLSStore              K8s::Traefik::TraefikService
+ *
+ * Only the `traefik.io` group. The chart's crds/ directory also ships
+ * `hub.traefik.io_*` (Traefik Hub, a different commercial product, ~12 kinds,
+ * no known consumer) and a vendored copy of the Gateway API, which is already
+ * generated here from its upstream repo and would collide.
+ *
+ * Version footgun: the pin below is the **chart** version, and the chart
+ * version is not the Traefik version. Chart v41.1.0 ships Traefik v3.7.9.
+ * When bumping, record both.
+ *
+ * Controller install: helm repo add traefik https://traefik.github.io/charts
+ *   && helm install traefik traefik/traefik --version 41.1.0
+ */
+const TRAEFIK_CHART_VERSION = "v41.1.0";
+const TRAEFIK_CRD_BASE = `https://raw.githubusercontent.com/traefik/traefik-helm-chart/${TRAEFIK_CHART_VERSION}/traefik/crds`;
+/**
+ * Infisical operator CRDs — secrets.infisical.com/v1alpha1
+ *
+ * The declarative form of chant's own secrets boundary. An `InfisicalSecret`
+ * says where a secret comes from and who may fetch it; it never carries a
+ * value. Without it an estate can declare the Deployment that consumes a
+ * Secret but not the thing that makes the Secret exist. Produces, under the
+ * `Infisical` namespace:
+ *   K8s::Infisical::InfisicalSecret
+ *   K8s::Infisical::InfisicalPushSecret
+ *   K8s::Infisical::InfisicalDynamicSecret
+ *
+ * The group is overridden to `Infisical` in parser.ts. The first-segment rule
+ * would give `K8s::Secrets::InfisicalSecret`, which reads like a core Secret
+ * next to the `K8s::Core::Secret` that already exists.
+ *
+ * Two things about the URL, both easy to lose an hour to:
+ *   - The operator lives in its own repo, `Infisical/kubernetes-operator`.
+ *     The path under the `Infisical/infisical` monorepo 404s.
+ *   - The tag is path-shaped — `infisical-k8-operator/v0.11.7`. Not a typo,
+ *     and not a directory.
+ *
+ * Operator install: helm repo add infisical https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
+ *   && helm install infisical-secrets-operator infisical/secrets-operator
+ */
+const INFISICAL_OPERATOR_VERSION = "infisical-k8-operator/v0.11.7";
+const INFISICAL_CRD_BASE = `https://raw.githubusercontent.com/Infisical/kubernetes-operator/${INFISICAL_OPERATOR_VERSION}/config/crd/bases`;
+/**
+ * Prometheus Operator CRDs — monitoring.coreos.com/v1 and v1alpha1
+ *
+ * Produces (the `monitoring.coreos.com` group maps to the `Monitoring`
+ * namespace):
+ *   K8s::Monitoring::ServiceMonitor  → apiVersion: monitoring.coreos.com/v1, kind: ServiceMonitor
+ *   K8s::Monitoring::PrometheusRule  → apiVersion: monitoring.coreos.com/v1, kind: PrometheusRule
+ *   K8s::Monitoring::Prometheus / Alertmanager / PodMonitor / Probe / ThanosRuler
+ *                                    → apiVersion: monitoring.coreos.com/v1
+ *   K8s::Monitoring::PrometheusAgent / AlertmanagerConfig / ScrapeConfig
+ *                                    → apiVersion: monitoring.coreos.com/v1alpha1
+ *
+ * `Probe` is also the core container probe property type, so the CRD class is
+ * `MonitoringProbe` (priorityNames in codegen/naming.ts).
+ *
+ * Operator install: kube-prometheus-stack chart, or
+ *   https://github.com/prometheus-operator/prometheus-operator
+ */
+const PROM_OPERATOR_VERSION = "v0.94.1";
+const PROM_OPERATOR_CRD_BASE = `https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/${PROM_OPERATOR_VERSION}/example/prometheus-operator-crd`;
+/**
+ * Flux GitOps Toolkit CRDs — the five `*.toolkit.fluxcd.io` groups.
+ *
+ * The flux2 release `install.yaml` is a single multi-doc bundle (controllers,
+ * RBAC, and CRDs); the parser keeps only the CustomResourceDefinition docs, and
+ * the `kinds` allowlist below narrows those to the supported set — the bundle
+ * also carries `ExternalArtifact` and `ArtifactGenerator` (experimental, and a
+ * separate `source.extensions.fluxcd.io` group), which are intentionally left
+ * out. All groups map to the `Flux` namespace (see GROUP_NAMESPACE_OVERRIDES in
+ * group-namespace.ts):
+ *   K8s::Flux::GitRepository / OCIRepository / HelmRepository / HelmChart / Bucket
+ *                                          → source.toolkit.fluxcd.io/v1
+ *   K8s::Flux::Kustomization               → kustomize.toolkit.fluxcd.io/v1
+ *   K8s::Flux::HelmRelease                 → helm.toolkit.fluxcd.io/v2
+ *   K8s::Flux::Provider / Alert            → notification.toolkit.fluxcd.io/v1beta3
+ *   K8s::Flux::Receiver                    → notification.toolkit.fluxcd.io/v1
+ *   K8s::Flux::ImagePolicy / ImageRepository / ImageUpdateAutomation
+ *                                          → image.toolkit.fluxcd.io/v1
+ *
+ * Controller install: kubectl apply -f
+ *   https://github.com/fluxcd/flux2/releases/download/v2.9.1/install.yaml
+ */
+const FLUX_TOOLKIT_VERSION = "v2.9.1";
+const FLUX_TOOLKIT_INSTALL = `https://github.com/fluxcd/flux2/releases/download/${FLUX_TOOLKIT_VERSION}/install.yaml`;
+/**
+ * Flux Operator CRDs — fluxcd.controlplane.io/v1
+ *
+ * The operator that installs and manages a Flux instance declaratively. Its
+ * release `install.yaml` bundles the four CRDs alongside the operator
+ * Deployment/RBAC; the parser keeps only the CRDs. They map to the `Flux`
+ * namespace (GROUP_NAMESPACE_OVERRIDES):
+ *   K8s::Flux::FluxInstance              → fluxcd.controlplane.io/v1
+ *   K8s::Flux::FluxReport                → fluxcd.controlplane.io/v1
+ *   K8s::Flux::ResourceSet               → fluxcd.controlplane.io/v1
+ *   K8s::Flux::ResourceSetInputProvider  → fluxcd.controlplane.io/v1
+ *
+ * Operator install: kubectl apply -f
+ *   https://github.com/controlplaneio-fluxcd/flux-operator/releases/download/v0.54.1/install.yaml
+ */
+const FLUX_OPERATOR_VERSION = "v0.54.1";
+const FLUX_OPERATOR_INSTALL = `https://github.com/controlplaneio-fluxcd/flux-operator/releases/download/${FLUX_OPERATOR_VERSION}/install.yaml`;
+/**
+ * KubeMicroVM CRDs — lambda.aws.amazon.com/v1alpha1
+ *
+ * Produces (the group is mapped to the `KubeMicroVM` namespace — see
+ * GROUP_NAMESPACE_OVERRIDES in group-namespace.ts):
+ *   K8s::KubeMicroVM::MicroVM            → kind: MicroVM
+ *   K8s::KubeMicroVM::MicroVMImage       → kind: MicroVMImage
+ *   K8s::KubeMicroVM::MicroVMNetwork     → kind: MicroVMNetwork
+ *   K8s::KubeMicroVM::MicroVMClass       → kind: MicroVMClass
+ *   K8s::KubeMicroVM::MicroVMReplicaSet  → kind: MicroVMReplicaSet
+ *
+ * Sourced from the chart rather than a raw URL: the operator is built with
+ * the Java operator SDK, which generates CRDs at build time, and only
+ * `microvmclasses` is committed to their repo. All five are in the published
+ * chart.
+ *
+ * Operator install: helm install kube-microvm-operator
+ *   oci://ghcr.io/codriverlabs/helm/kube-microvm-operator --version 1.0.11
+ */
+const KUBEMICROVM_CHART = "oci://ghcr.io/codriverlabs/helm/kube-microvm-operator";
+const KUBEMICROVM_VERSION = "1.0.11";
+// The chart layer of 1.0.11 on ghcr.io, so a re-pushed tag cannot change generated output.
+const KUBEMICROVM_CHART_DIGEST = "sha256:b15570736277f69bc69bc6bd1d6b89470404b8bbd45970b7dcb29ca9ab69170c";
+/**
+ * k3s bundled-controller CRDs — helm.cattle.io/v1 + k3s.cattle.io/v1
+ *
+ * k3s's manifest auto-deploy machinery speaks these CRDs: drop a HelmChart
+ * into /var/lib/rancher/k3s/server/manifests and the embedded helm-controller
+ * installs the chart; every auto-deployed manifest is tracked by an Addon.
+ * Typed here for the same reason the Flux toolkit kinds are — they are what a
+ * k3s estate's GitOps surface is written in.
+ *
+ * Produces (both groups map to the `K3s` namespace — see
+ * GROUP_NAMESPACE_OVERRIDES in group-namespace.ts):
+ *   K8s::K3s::HelmChart        → apiVersion: helm.cattle.io/v1, kind: HelmChart
+ *   K8s::K3s::HelmChartConfig  → apiVersion: helm.cattle.io/v1, kind: HelmChartConfig
+ *   K8s::K3s::Addon            → apiVersion: k3s.cattle.io/v1,  kind: Addon
+ *
+ * The pin is k3s v1.36.3+k3s1 (the release the k3s lexicon pins), but the k3s
+ * repo itself publishes no CRD YAMLs — its manifests/ directory carries only
+ * the bundled charts, and the API types live in dependency repos. The URLs
+ * below point at the exact versions that release vendors in its go.mod:
+ *   github.com/k3s-io/helm-controller v0.17.7  (helm.cattle.io CRDs)
+ *   github.com/k3s-io/api             v0.1.4   (k3s.cattle.io CRDs)
+ * When bumping, re-read go.mod at the new k3s tag and move both pins together.
+ *
+ * k3s-io/api also ships an ETCDSnapshotFile CRD — deliberately left out. It is
+ * status-only controller bookkeeping (the server writes them to describe
+ * snapshots it took); nothing an author would declare.
+ *
+ * Controller install: none — both controllers are embedded in the k3s binary.
+ */
+const K3S_HELM_CONTROLLER_VERSION = "v0.17.7"; // vendored by k3s v1.36.3+k3s1
+const K3S_API_VERSION = "v0.1.4"; // vendored by k3s v1.36.3+k3s1
+const K3S_HELM_CONTROLLER_CRD_BASE = `https://raw.githubusercontent.com/k3s-io/helm-controller/${K3S_HELM_CONTROLLER_VERSION}/pkg/crds/yaml/generated`;
+const K3S_API_CRD_BASE = `https://raw.githubusercontent.com/k3s-io/api/${K3S_API_VERSION}/pkg/crds/yaml/generated`;
+/**
+ * KServe CRDs — serving.kserve.io
+ *
+ * The model-serving control plane chant #982 builds vLLM composites on top
+ * of. Produces (the `serving.kserve.io` group maps to the `KServe` namespace
+ * — see GROUP_NAMESPACE_OVERRIDES in group-namespace.ts; the first-segment
+ * rule would otherwise give `K8s::Serving::*`):
+ *   K8s::KServe::InferenceService       → serving.kserve.io/v1beta1, kind: InferenceService
+ *   K8s::KServe::ServingRuntime         → serving.kserve.io/v1alpha1, kind: ServingRuntime
+ *   K8s::KServe::ClusterServingRuntime  → serving.kserve.io/v1alpha1, kind: ClusterServingRuntime
+ *
+ * Sourced from `config/crd/full`, not `config/crd/minimal` — `full` is what
+ * the release's own kustomization.yaml (and `kubectl apply -k config/crd`)
+ * actually installs; `minimal` is a stripped, non-validating variant with no
+ * OpenAPI schema to speak of. `full`'s InferenceService schema is the entire
+ * spec-true predictor/transformer/explainer union (~1MB of YAML) — see
+ * schemaPatches in codegen/patches.ts if generation trips on its recursion
+ * depth.
+ *
+ * Pinned to the last patch of the 0.15 line rather than latest (0.20.0,
+ * weeks old at pin time) — a release that's had over a year to settle,
+ * matching the CNPG precedent above of tracking what a real operator runs
+ * rather than the newest tag.
+ *
+ * Operator install: kubectl apply --server-side -k
+ *   "github.com/kserve/kserve/config/default?ref=v0.15.2"
+ */
+const KSERVE_VERSION = "v0.15.2";
+const KSERVE_CRD_BASE = `https://raw.githubusercontent.com/kserve/kserve/${KSERVE_VERSION}/config/crd/full`;
+/**
+ * Cluster API (CAPI) core CRDs — cluster.x-k8s.io/v1beta2
+ *
+ * The provider-agnostic cluster-lifecycle surface CAPA, CAAPH, and every
+ * other CAPI provider build on. Only the two kinds a project actually
+ * declares are taken; `ClusterClass`, `MachineDeployment`, `MachineSet`,
+ * `MachineHealthCheck`, `MachineDrainRule`, the `ipam.cluster.x-k8s.io` pair,
+ * and `ExtensionConfig` are deliberately left out (the scale note at the top
+ * of this file: add the kinds a project uses). `ClusterResourceSet`, CAPI
+ * core's other addons.cluster.x-k8s.io kind, is a separate source below —
+ * see the CAAPH block for why it's grouped there. Produces (the group takes
+ * the `CAPI` override — see GROUP_NAMESPACE_OVERRIDES in group-namespace.ts,
+ * which avoids the `K8s::Cluster::Cluster` stutter):
+ *   K8s::CAPI::Cluster      → cluster.x-k8s.io/v1beta2, kind: Cluster
+ *   K8s::CAPI::MachinePool  → cluster.x-k8s.io/v1beta2, kind: MachinePool
+ *
+ * Controller install: kubectl apply -f
+ *   https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.14.0/cluster-api-components.yaml
+ */
+const CAPI_VERSION = "v1.14.0";
+const CAPI_CRD_BASE = `https://raw.githubusercontent.com/kubernetes-sigs/cluster-api/${CAPI_VERSION}/core/config/crd/bases`;
+/**
+ * Cluster API Provider AWS (CAPA) CRDs — infrastructure.cluster.x-k8s.io + controlplane.cluster.x-k8s.io
+ *
+ * The AWS infrastructure and EKS control-plane providers for CAPI. Produces
+ * (first-segment rule, no override — the `AWS` kind prefix already keeps
+ * these from reading like anything else in the file):
+ *   K8s::Infrastructure::AWSManagedCluster            → infrastructure.cluster.x-k8s.io/v1beta2
+ *   K8s::Infrastructure::AWSManagedMachinePool         → infrastructure.cluster.x-k8s.io/v1beta2
+ *   K8s::Infrastructure::AWSClusterControllerIdentity  → infrastructure.cluster.x-k8s.io/v1beta2
+ *   K8s::Controlplane::AWSManagedControlPlane          → controlplane.cluster.x-k8s.io/v1beta2
+ *
+ * Contradicts chant #10's own text: the issue describes AWSManagedControlPlane
+ * as an `infrastructure.cluster.x-k8s.io` kind alongside the other three. The
+ * shipped CRD (`config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml`
+ * in the v2.13.0 tag) puts it under `controlplane.cluster.x-k8s.io` instead —
+ * CAPA's EKS control-plane provider is a `controlplane.*` provider like
+ * kubeadm's, not an infra one. The parser reads `spec.group` from the fetched
+ * CRD document itself (`parseCRDSpec` in `crd/parser.ts`), so the source list
+ * below only needs the right URL; the resulting type name follows upstream's
+ * actual group, not the issue text's.
+ *
+ * Operator install: with clusterctl,
+ *   clusterctl init --infrastructure aws:v2.13.0
+ */
+const CAPA_VERSION = "v2.13.0";
+const CAPA_CRD_BASE = `https://raw.githubusercontent.com/kubernetes-sigs/cluster-api-provider-aws/${CAPA_VERSION}/config/crd/bases`;
+/**
+ * Cluster API Addon Provider for Helm (CAAPH) CRD, plus CAPI core's own
+ * addon-binding kind — both addons.cluster.x-k8s.io/v1alpha1|v1beta2
+ *
+ * `HelmChartProxy` is CAAPH's kind — installs a Helm chart across every
+ * cluster a label selector matches. `ClusterResourceSet` ships in CAPI
+ * core's own `core/` component (same CAPI_VERSION/CAPI_CRD_BASE pin as the
+ * `Cluster`/`MachinePool` source above), not a separate provider — it binds
+ * a set of raw manifests (ConfigMaps/Secrets) to matching clusters. They're
+ * grouped in one source block because both are what the RegionCluster
+ * composite's flux-addon wiring needs (chant#11) and both share the
+ * `addons.cluster.x-k8s.io` group, so both land under `K8s::Addons::*`:
+ *   K8s::Addons::HelmChartProxy      → addons.cluster.x-k8s.io/v1alpha1, kind: HelmChartProxy
+ *   K8s::Addons::ClusterResourceSet  → addons.cluster.x-k8s.io/v1beta2,  kind: ClusterResourceSet
+ *
+ * `HelmReleaseProxy` (CAAPH's per-cluster status-tracking CR, never authored
+ * directly) is deliberately left out.
+ *
+ * Operator install: with clusterctl,
+ *   clusterctl init --addon helm:v0.6.4
+ */
+const CAAPH_VERSION = "v0.6.4";
+const CAAPH_CRD_BASE = `https://raw.githubusercontent.com/kubernetes-sigs/cluster-api-addon-provider-helm/${CAAPH_VERSION}/config/crd/bases`;
+/**
+ * AWS Controllers for Kubernetes (ACK) — S3 controller CRD — s3.services.k8s.aws/v1alpha1
+ *
+ * Each ACK service controller is its own release train with its own CRDs, so
+ * (per the docs' "add the specific kinds a project uses" guidance, and
+ * matching how the ACK IAM group below stays split from EKS/RDS/S3) it is
+ * its own scoped source rather than one entry per AWS "provider". Produces:
+ *   K8s::S3::Bucket  → s3.services.k8s.aws/v1alpha1, kind: Bucket
+ *
+ * Controller install: helm install ack-s3-controller
+ *   oci://public.ecr.aws/aws-controllers-k8s/s3-chart --version 1.10.0
+ */
+const ACK_S3_VERSION = "v1.10.0";
+const ACK_S3_CRD_BASE = `https://raw.githubusercontent.com/aws-controllers-k8s/s3-controller/${ACK_S3_VERSION}/config/crd/bases`;
+/**
+ * ACK RDS controller CRD — rds.services.k8s.aws/v1alpha1
+ *
+ * Only `DBInstance` — the standalone-instance kind a project provisions
+ * directly. `DBCluster` and its endpoint/parameter-group/snapshot satellites
+ * are left out (no known consumer; add them when one shows up). Produces:
+ *   K8s::Rds::DBInstance  → rds.services.k8s.aws/v1alpha1, kind: DBInstance
+ *
+ * Controller install: helm install ack-rds-controller
+ *   oci://public.ecr.aws/aws-controllers-k8s/rds-chart --version 1.11.1
+ */
+const ACK_RDS_VERSION = "v1.11.1";
+const ACK_RDS_CRD_BASE = `https://raw.githubusercontent.com/aws-controllers-k8s/rds-controller/${ACK_RDS_VERSION}/config/crd/bases`;
+/**
+ * ACK IAM controller CRDs — iam.services.k8s.aws/v1alpha1
+ *
+ * `Role`, `User`, `Policy` — the three IAM primitives a cluster workload
+ * needing AWS access declares (a Role's trust policy, a User's access keys,
+ * a Policy document attached to either). `Group`, `InstanceProfile`,
+ * `OpenIDConnectProvider`, and `ServiceLinkedRole` are left out. Produces:
+ *   K8s::Iam::Role    → iam.services.k8s.aws/v1alpha1, kind: Role
+ *   K8s::Iam::User    → iam.services.k8s.aws/v1alpha1, kind: User
+ *   K8s::Iam::Policy  → iam.services.k8s.aws/v1alpha1, kind: Policy
+ *
+ * Controller install: helm install ack-iam-controller
+ *   oci://public.ecr.aws/aws-controllers-k8s/iam-chart --version 1.8.1
+ */
+const ACK_IAM_VERSION = "v1.8.1";
+const ACK_IAM_CRD_BASE = `https://raw.githubusercontent.com/aws-controllers-k8s/iam-controller/${ACK_IAM_VERSION}/config/crd/bases`;
+/**
+ * ACK EKS controller CRD — eks.services.k8s.aws/v1alpha1
+ *
+ * Only `PodIdentityAssociation` — EKS Pod Identity is the modern replacement
+ * for IRSA, and the ACK-managed way to bind a Kubernetes ServiceAccount to
+ * an IAM role without a webhook. `Cluster`, `Addon`, `Nodegroup`,
+ * `FargateProfile`, `AccessEntry`, `IdentityProviderConfig`, and
+ * `Capability` are left out (this k8s lexicon doesn't provision the EKS
+ * cluster itself). Produces:
+ *   K8s::Eks::PodIdentityAssociation  → eks.services.k8s.aws/v1alpha1, kind: PodIdentityAssociation
+ *
+ * Controller install: helm install ack-eks-controller
+ *   oci://public.ecr.aws/aws-controllers-k8s/eks-chart --version 1.20.0
+ */
+const ACK_EKS_VERSION = "v1.20.0";
+const ACK_EKS_CRD_BASE = `https://raw.githubusercontent.com/aws-controllers-k8s/eks-controller/${ACK_EKS_VERSION}/config/crd/bases`;
+/**
+ * Grafana Operator CRDs — grafana.integreatly.org/v1beta1
+ *
+ * The delivery path for a Grafana the Grafana Operator runs, used by
+ * `GrafanaOperatorResources` in `@intentius/chant-lexicon-grafana/k8s`
+ * (#3015). Produces (the `grafana.integreatly.org` group maps to the
+ * `Grafana` namespace via the first-segment rule):
+ *   K8s::Grafana::GrafanaDashboard   → grafana.integreatly.org/v1beta1, kind: GrafanaDashboard
+ *   K8s::Grafana::GrafanaDatasource  → grafana.integreatly.org/v1beta1, kind: GrafanaDatasource
+ *   K8s::Grafana::GrafanaFolder      → grafana.integreatly.org/v1beta1, kind: GrafanaFolder
+ *   K8s::Grafana::GrafanaLibraryPanel → grafana.integreatly.org/v1beta1, kind: GrafanaLibraryPanel
+ *   K8s::Grafana::GrafanaAlertRuleGroup, GrafanaContactPoint, GrafanaNotificationPolicy,
+ *   GrafanaNotificationPolicyRoute, GrafanaMuteTiming, GrafanaNotificationTemplate
+ *     → grafana.integreatly.org/v1beta1, the alerting kinds (#3156)
+ *
+ * The operator's other kinds (Grafana itself, service accounts, manifests)
+ * are left out until something uses them.
+ *
+ * Operator install: kubectl apply --server-side -f
+ *   https://github.com/grafana/grafana-operator/releases/download/v5.25.0/kustomize-cluster_scoped.yaml
+ */
+const GRAFANA_OPERATOR_VERSION = "v5.25.0";
+const GRAFANA_OPERATOR_CRD_BASE = `https://raw.githubusercontent.com/grafana/grafana-operator/${GRAFANA_OPERATOR_VERSION}/config/crd/bases`;
+/**
+ * OpenTelemetry Operator CRDs — opentelemetry.io (#3367)
+ *
+ * The `opentelemetry.io` group is mapped to the `OpenTelemetry` namespace (see
+ * GROUP_NAMESPACE_OVERRIDES in group-namespace.ts). Each CRD is generated at
+ * its storage version:
+ *   K8s::OpenTelemetry::OpenTelemetryCollector → opentelemetry.io/v1beta1 (spec.config is a structured object)
+ *   K8s::OpenTelemetry::Instrumentation        → opentelemetry.io/v1alpha1
+ *   K8s::OpenTelemetry::TargetAllocator        → opentelemetry.io/v1alpha1
+ *   K8s::OpenTelemetry::OpAMPBridge            → opentelemetry.io/v1alpha1
+ *   K8s::OpenTelemetry::ClusterObservability   → opentelemetry.io/v1alpha1 (new in v0.160.0: one CR that
+ *     sets up the operator's collectors and instrumentation cluster-wide)
+ *
+ * Operator install: kubectl apply -f
+ *   https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.160.0/opentelemetry-operator.yaml
+ */
+const OTEL_OPERATOR_VERSION = "v0.160.0";
+const OTEL_OPERATOR_CRD_BASE = `https://raw.githubusercontent.com/open-telemetry/opentelemetry-operator/${OTEL_OPERATOR_VERSION}/config/crd/bases`;
+export const CRD_SOURCES = [
+    { type: "url", url: `${KUBERAY_CRD_BASE}/ray.io_rayclusters.yaml` },
+    { type: "url", url: `${KUBERAY_CRD_BASE}/ray.io_rayjobs.yaml` },
+    { type: "url", url: `${KUBERAY_CRD_BASE}/ray.io_rayservices.yaml` },
+    { type: "url", url: `${ARGOCD_CRD_BASE}/application-crd.yaml` },
+    { type: "url", url: `${ARGOCD_CRD_BASE}/applicationset-crd.yaml` },
+    { type: "url", url: `${ARGOCD_CRD_BASE}/appproject-crd.yaml` },
+    { type: "url", url: `${GATEWAY_API_CRD_BASE}/gateway.networking.k8s.io_gatewayclasses.yaml` },
+    { type: "url", url: `${GATEWAY_API_CRD_BASE}/gateway.networking.k8s.io_gateways.yaml` },
+    { type: "url", url: `${GATEWAY_API_CRD_BASE}/gateway.networking.k8s.io_httproutes.yaml` },
+    { type: "url", url: `${GATEWAY_API_CRD_BASE}/gateway.networking.k8s.io_grpcroutes.yaml` },
+    { type: "url", url: `${GATEWAY_API_CRD_BASE}/gateway.networking.k8s.io_referencegrants.yaml` },
+    { type: "url", url: `${COCKROACH_OPERATOR_CRD_BASE}/crdb.cockroachlabs.com_crdbclusters.yaml` },
+    { type: "url", url: CERT_MANAGER_CRD_BUNDLE },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_servicemonitors.yaml` },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_prometheusrules.yaml` },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_prometheuses.yaml` },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_alertmanagers.yaml` },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_podmonitors.yaml` },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_probes.yaml` },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_thanosrulers.yaml` },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_prometheusagents.yaml` },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_alertmanagerconfigs.yaml` },
+    { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_scrapeconfigs.yaml` },
+    { type: "url", url: `${CNPG_CRD_BASE}/postgresql.cnpg.io_clusters.yaml` },
+    { type: "url", url: `${CNPG_CRD_BASE}/postgresql.cnpg.io_scheduledbackups.yaml` },
+    { type: "url", url: `${CNPG_CRD_BASE}/postgresql.cnpg.io_backups.yaml` },
+    { type: "url", url: `${CNPG_CRD_BASE}/postgresql.cnpg.io_poolers.yaml` },
+    { type: "url", url: `${BARMAN_PLUGIN_CRD_BASE}/barmancloud.cnpg.io_objectstores.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_ingressroutes.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_ingressroutetcps.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_ingressrouteudps.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_middlewares.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_middlewaretcps.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_serverstransports.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_serverstransporttcps.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_tlsoptions.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_tlsstores.yaml` },
+    { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_traefikservices.yaml` },
+    { type: "url", url: `${INFISICAL_CRD_BASE}/secrets.infisical.com_infisicalsecrets.yaml` },
+    { type: "url", url: `${INFISICAL_CRD_BASE}/secrets.infisical.com_infisicalpushsecrets.yaml` },
+    { type: "url", url: `${INFISICAL_CRD_BASE}/secrets.infisical.com_infisicaldynamicsecrets.yaml` },
+    {
+        type: "url",
+        url: FLUX_TOOLKIT_INSTALL,
+        kinds: [
+            "GitRepository",
+            "OCIRepository",
+            "HelmRepository",
+            "HelmChart",
+            "Bucket",
+            "Kustomization",
+            "HelmRelease",
+            "Provider",
+            "Alert",
+            "Receiver",
+            "ImagePolicy",
+            "ImageRepository",
+            "ImageUpdateAutomation",
+        ],
+    },
+    {
+        type: "url",
+        url: FLUX_OPERATOR_INSTALL,
+        kinds: ["FluxInstance", "FluxReport", "ResourceSet", "ResourceSetInputProvider"],
+    },
+    { type: "url", url: `${K3S_HELM_CONTROLLER_CRD_BASE}/helm.cattle.io_helmcharts.yaml` },
+    { type: "url", url: `${K3S_HELM_CONTROLLER_CRD_BASE}/helm.cattle.io_helmchartconfigs.yaml` },
+    { type: "url", url: `${K3S_API_CRD_BASE}/k3s.cattle.io_addons.yaml` },
+    {
+        type: "helm",
+        chart: KUBEMICROVM_CHART,
+        version: KUBEMICROVM_VERSION,
+        digest: KUBEMICROVM_CHART_DIGEST,
+        kinds: ["MicroVM", "MicroVMImage", "MicroVMNetwork", "MicroVMClass", "MicroVMReplicaSet"],
+    },
+    { type: "url", url: `${KSERVE_CRD_BASE}/serving.kserve.io_inferenceservices.yaml` },
+    { type: "url", url: `${KSERVE_CRD_BASE}/serving.kserve.io_servingruntimes.yaml` },
+    { type: "url", url: `${KSERVE_CRD_BASE}/serving.kserve.io_clusterservingruntimes.yaml` },
+    { type: "url", url: `${CAPI_CRD_BASE}/cluster.x-k8s.io_clusters.yaml` },
+    { type: "url", url: `${CAPI_CRD_BASE}/cluster.x-k8s.io_machinepools.yaml` },
+    { type: "url", url: `${CAPA_CRD_BASE}/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml` },
+    { type: "url", url: `${CAPA_CRD_BASE}/infrastructure.cluster.x-k8s.io_awsmanagedclusters.yaml` },
+    { type: "url", url: `${CAPA_CRD_BASE}/infrastructure.cluster.x-k8s.io_awsmanagedmachinepools.yaml` },
+    { type: "url", url: `${CAPA_CRD_BASE}/infrastructure.cluster.x-k8s.io_awsclustercontrolleridentities.yaml` },
+    { type: "url", url: `${CAAPH_CRD_BASE}/addons.cluster.x-k8s.io_helmchartproxies.yaml` },
+    { type: "url", url: `${CAPI_CRD_BASE}/addons.cluster.x-k8s.io_clusterresourcesets.yaml` },
+    { type: "url", url: `${ACK_S3_CRD_BASE}/s3.services.k8s.aws_buckets.yaml` },
+    { type: "url", url: `${ACK_RDS_CRD_BASE}/rds.services.k8s.aws_dbinstances.yaml` },
+    { type: "url", url: `${ACK_IAM_CRD_BASE}/iam.services.k8s.aws_roles.yaml` },
+    { type: "url", url: `${ACK_IAM_CRD_BASE}/iam.services.k8s.aws_users.yaml` },
+    { type: "url", url: `${ACK_IAM_CRD_BASE}/iam.services.k8s.aws_policies.yaml` },
+    { type: "url", url: `${ACK_EKS_CRD_BASE}/eks.services.k8s.aws_podidentityassociations.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafanadashboards.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafanadatasources.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafanafolders.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafanalibrarypanels.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafanaalertrulegroups.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafanacontactpoints.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafananotificationpolicies.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafananotificationpolicyroutes.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafanamutetimings.yaml` },
+    { type: "url", url: `${GRAFANA_OPERATOR_CRD_BASE}/grafana.integreatly.org_grafananotificationtemplates.yaml` },
+    { type: "url", url: `${OTEL_OPERATOR_CRD_BASE}/opentelemetry.io_opentelemetrycollectors.yaml` },
+    { type: "url", url: `${OTEL_OPERATOR_CRD_BASE}/opentelemetry.io_instrumentations.yaml` },
+    { type: "url", url: `${OTEL_OPERATOR_CRD_BASE}/opentelemetry.io_targetallocators.yaml` },
+    { type: "url", url: `${OTEL_OPERATOR_CRD_BASE}/opentelemetry.io_opampbridges.yaml` },
+    { type: "url", url: `${OTEL_OPERATOR_CRD_BASE}/opentelemetry.io_clusterobservabilities.yaml` },
+];