@intentius/chant-lexicon-k8s 0.124.31 → 0.124.33

package/dist/kustomize/root.js

@@ -0,0 +1,68 @@
+/**
+ * Kustomize build roots (#1548 piece 3).
+ *
+ * An estate that keeps its overlay tree has no typed chant source for those
+ * manifests — and piece 4 (a declarable Kustomization) is parked precisely
+ * because forcing a modelling migration onto every kustomize estate is the
+ * mistake behold#138 documented. What such an estate CAN declare is the
+ * directory: `k8s.kustomize.roots` in `chant.config.ts` names kustomization
+ * dirs that render at build time into the manifest set. The rendered
+ * documents become entities (see `./rendered-entity.ts`), so they are
+ * serialized into the build output, ownership-stamped, seen by post-synth
+ * checks, and observed by `lifecycle diff --live` — the declared side an
+ * overlay estate never had.
+ *
+ * Renders through the same injectable runner the `kustomize-apply`
+ * capability uses (`./render.ts`): `kustomize build`, `kubectl kustomize`
+ * fallback, and a both-binaries-missing failure that names them. Two
+ * build-time guarantees on top:
+ *
+ * - **Deterministic**: entity names derive from the root dir plus each
+ *   document's kind/name/namespace, disambiguated in render order — the same
+ *   overlay renders the same entity set every build.
+ * - **Fail loudly, not weirdly**: a root that doesn't exist, or a dir with no
+ *   kustomization file, refuses with the path in the message before any
+ *   subprocess runs — offline, the failure mode is a sentence, never a
+ *   render attempt's stack trace.
+ */
+import { existsSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { defaultKustomizeRunner, renderKustomizeDocuments } from "./render.js";
+import { addRenderedEntity, renderedManifestEntity } from "./rendered-entity.js";
+import { applyRenderedPatches } from "../patch/rendered-patch.js";
+const KUSTOMIZATION_FILES = ["kustomization.yaml", "kustomization.yml", "Kustomization"];
+/**
+ * Render each configured kustomization root into entities, keyed
+ * `<root>/<kindName>` (namespace-qualified, then numbered, on collision).
+ */
+export async function renderKustomizeRoots(opts) {
+    const run = opts.run ?? defaultKustomizeRunner;
+    const entities = new Map();
+    const warnings = [];
+    for (const entry of opts.roots) {
+        const root = typeof entry === "string" ? entry : entry.path;
+        const patches = typeof entry === "string" ? undefined : entry.patches;
+        const rootDir = isAbsolute(root) ? root : resolve(opts.projectRoot, root);
+        // The label rendered docs carry as provenance: the declared (relative)
+        // form when possible, so it names the overlay the way the config does.
+        const rootLabel = isAbsolute(root) ? (relative(opts.projectRoot, root) || ".") : root;
+        if (!existsSync(rootDir)) {
+            throw new Error(`k8s.kustomize.roots entry "${root}": directory not found at ${rootDir}`);
+        }
+        if (!KUSTOMIZATION_FILES.some((f) => existsSync(join(rootDir, f)))) {
+            throw new Error(`k8s.kustomize.roots entry "${root}": ${rootDir} contains no kustomization file ` +
+                `(expected one of ${KUSTOMIZATION_FILES.join(", ")})`);
+        }
+        const rendered = await renderKustomizeDocuments(rootDir, run);
+        const documents = applyRenderedPatches(rendered, patches, `kustomize root "${rootLabel}"`);
+        for (const doc of documents) {
+            const entity = renderedManifestEntity(doc, rootLabel);
+            if (!entity) {
+                warnings.push(`kustomize root "${rootLabel}" rendered a document without apiVersion/kind — skipped`);
+                continue;
+            }
+            addRenderedEntity(entities, rootLabel, entity);
+        }
+    }
+    return { entities, warnings };
+}

package/dist/lint/audit-catalog.js

@@ -0,0 +1,61 @@
+/**
+ * The k8s lexicon's chant audit catalog — metadata for its post-synth rules
+ * (WK8 and ARGO Kubernetes-manifest rules). Contributed via k8sPlugin.auditCatalog() (#687).
+ */
+import { auditRule, K8S_PSS, K8S_SECRETS, SCORECARD_PINNED, applyLineage } from "@intentius/chant/audit/catalog";
+import { k8sAuditLineage } from "./audit-lineage.js";
+export const k8sAuditCatalog = {
+    ARGO002: auditRule("ARGO002", "merge-worthy", "guidance", "Argo Application references an undeclared AppProject", "Declare the named AppProject or reference an existing project.", { category: "correctness" }),
+    ARGO003: auditRule("ARGO003", "merge-worthy", "guidance", "Argo Application targets an unregistered cluster", "Point spec.destination at a registered cluster or the in-cluster target.", { category: "correctness" }),
+    ARGO005: auditRule("ARGO005", "report-only", "guidance", "Argo source.path may not resolve", "Ensure the source path exists under the build root.", { category: "best-practice" }),
+    FLUX002: auditRule("FLUX002", "merge-worthy", "guidance", "Flux Kustomization references an undeclared source", "Declare the GitRepository/OCIRepository/Bucket, or point sourceRef at the bootstrap flux-system repo.", { category: "correctness" }),
+    FLUX003: auditRule("FLUX003", "report-only", "guidance", "Flux Kustomization dependsOn names an undeclared Kustomization", "Fix the dependsOn name, or ignore if the dependency is declared in another repo.", { category: "correctness" }),
+    WK8005: auditRule("WK8005", "merge-worthy", "guidance", "Hardcoded secret in env var", "Use a secretKeyRef instead of a literal value, and rotate the secret.", { authority: [K8S_SECRETS] }),
+    WK8006: auditRule("WK8006", "merge-worthy", "guidance", "Image uses :latest or no tag", "Pin the image to an explicit version tag (ideally a digest).", { authority: [SCORECARD_PINNED] }),
+    WK8041: auditRule("WK8041", "merge-worthy", "guidance", "Hardcoded API key in env var", "Move the key to a Secret and rotate it.", { authority: [K8S_SECRETS] }),
+    WK8042: auditRule("WK8042", "merge-worthy", "guidance", "Private key stored in a ConfigMap", "Store private keys in a Secret, not a ConfigMap.", { authority: [K8S_SECRETS] }),
+    WK8101: auditRule("WK8101", "merge-worthy", "guidance", "Deployment selector does not match template labels", "Align spec.selector with the pod template labels.", { category: "best-practice" }),
+    WK8102: auditRule("WK8102", "report-only", "guidance", "Resource missing metadata labels", "Add metadata labels for filtering and tooling.", { category: "best-practice" }),
+    WK8103: auditRule("WK8103", "merge-worthy", "guidance", "Container missing name", "Add the required container `name`.", { category: "best-practice" }),
+    WK8104: auditRule("WK8104", "report-only", "guidance", "Container ports not named", "Name ports for clearer Service/NetworkPolicy config.", { category: "best-practice" }),
+    WK8105: auditRule("WK8105", "report-only", "guidance", "imagePullPolicy not explicit", "Set imagePullPolicy explicitly to avoid surprising defaults.", { category: "best-practice" }),
+    WK8201: auditRule("WK8201", "report-only", "guidance", "Container missing resource limits", "Set CPU and memory limits.", { category: "best-practice" }),
+    WK8202: auditRule("WK8202", "merge-worthy", "guidance", "Privileged container", "Remove privileged: true; grant only the specific capabilities needed.", { authority: [K8S_PSS] }),
+    WK8203: auditRule("WK8203", "merge-worthy", "guidance", "Root filesystem is writable", "Set readOnlyRootFilesystem: true.", { authority: [K8S_PSS] }),
+    WK8204: auditRule("WK8204", "merge-worthy", "guidance", "Container may run as root", "Set runAsNonRoot: true (and a non-zero runAsUser).", { authority: [K8S_PSS] }),
+    WK8205: auditRule("WK8205", "merge-worthy", "guidance", "Capabilities not dropped", "drop: [ALL] and add back only what is required.", { authority: [K8S_PSS] }),
+    WK8207: auditRule("WK8207", "merge-worthy", "guidance", "Pod uses host network", "Remove hostNetwork; it bypasses network isolation.", { authority: [K8S_PSS] }),
+    WK8208: auditRule("WK8208", "merge-worthy", "guidance", "Pod shares host PID namespace", "Remove hostPID.", { authority: [K8S_PSS] }),
+    WK8209: auditRule("WK8209", "merge-worthy", "guidance", "Pod shares host IPC namespace", "Remove hostIPC.", { authority: [K8S_PSS] }),
+    WK8301: auditRule("WK8301", "report-only", "guidance", "Container missing probes", "Add liveness and readiness probes.", { category: "best-practice" }),
+    WK8302: auditRule("WK8302", "report-only", "guidance", "Deployment has a single replica", "Use replicas >= 2 for availability.", { category: "best-practice" }),
+    WK8303: auditRule("WK8303", "report-only", "guidance", "No PodDisruptionBudget for an HA Deployment", "Add a PDB to protect availability during disruptions.", { category: "best-practice" }),
+    WK8304: auditRule("WK8304", "report-only", "guidance", "SSL redirect without a certificate", "Provide a certificate and HTTPS listen-ports for the ssl-redirect annotation.", { category: "best-practice" }),
+    WK8305: auditRule("WK8305", "merge-worthy", "guidance", "Ingress backend port does not match the Service", "Point the Ingress backend at a declared Service port.", { category: "best-practice" }),
+    WK8306: auditRule("WK8306", "merge-worthy", "guidance", "Container command starts with a flag", "The first command element should be a binary, not a flag.", { category: "best-practice" }),
+    WK8401: auditRule("WK8401", "merge-worthy", "guidance", "shmSize exceeds the container memory limit", "Lower shmSize or raise the memory limit so the pod can schedule.", { category: "best-practice" }),
+    WK8402: auditRule("WK8402", "report-only", "guidance", "RayCluster missing spec.rayVersion", "Set spec.rayVersion so KubeRay picks the right autoscaler image.", { category: "best-practice" }),
+    WK8403: auditRule("WK8403", "report-only", "guidance", "rayVersion does not match the head image tag", "Align spec.rayVersion with the Ray version in the head container image.", { category: "best-practice" }),
+    WK8404: auditRule("WK8404", "merge-worthy", "guidance", "GPU request without a matching toleration", "Add a toleration for the nvidia.com/gpu taint (or a wildcard Exists toleration) so the pod can schedule onto a GPU node pool.", { category: "correctness" }),
+    WK8405: auditRule("WK8405", "report-only", "guidance", "Serving workload has no PodDisruptionBudget", "Add a PDB selecting the InferenceService/serving Deployment so a node drain can't take down every replica at once.", { category: "best-practice" }),
+    WK8406: auditRule("WK8406", "merge-worthy", "guidance", "GPU container missing resource limits", "Set CPU and memory limits on GPU-requesting containers to avoid starving the (scarce, expensive) GPU node.", { category: "best-practice" }),
+    WK8407: auditRule("WK8407", "merge-worthy", "guidance", "Unpinned model version", "Pin the InferenceService model storageUri to an explicit version segment (e.g. via the Model composite's required version) instead of a floating tag.", { category: "correctness" }),
+    WK8501: auditRule("WK8501", "merge-worthy", "guidance", "Custom resource spec has a field its CRD does not declare", "Fix the field name; the API server prunes unknown fields and the controller never sees them.", { category: "correctness" }),
+    WK8502: auditRule("WK8502", "merge-worthy", "guidance", "Custom resource spec field has the wrong type or enum value", "Match the CRD schema: use the declared scalar type and one of the enum values.", { category: "correctness" }),
+    WK8503: auditRule("WK8503", "merge-worthy", "guidance", "Workload consumes a Secret nothing in the output produces", "Produce the Secret in the same build (Secret, ExternalSecret, InfisicalSecret, cert-manager Certificate), or declare its provenance with declareSecret() if it exists out of band.", { category: "correctness" }),
+    WK8504: auditRule("WK8504", "merge-worthy", "guidance", "committed-encrypted secret declaration does not resolve", "Point `file` at the committed ciphertext, make its metadata.name match the declaration, and re-run `sops -e -i` so every data/stringData value is ENC[...].", { authority: [K8S_SECRETS] }),
+    WK8505: auditRule("WK8505", "report-only", "guidance", "committed-encrypted secret with no Flux decryption wiring", "Add decryption: \"sops\" to the FluxAppFor reconciling the path that carries the ciphertext sidecar, or ignore if that Kustomization is declared in a different build. This check sees one build root at a time, so it goes silent once the secret and the Kustomization live in different build roots (chant #1939).", { category: "correctness" }),
+    WK8601: auditRule("WK8601", "merge-worthy", "guidance", "OpenTelemetry Collector runs tail_sampling on every node", "Move tail_sampling from the DaemonSet agent to a gateway Deployment, and send traces to it through a loadbalancing exporter routed by traceID.", { category: "correctness" }),
+    WK8602: auditRule("WK8602", "merge-worthy", "guidance", "Multi-replica tail sampling gateway reached without trace-aware load balancing", "Send traces to the gateway through a loadbalancing exporter with routing_key traceID (k8s resolver, or dns on a headless Service), or run the gateway with one replica. It goes silent when the senders are in another build root (chant #1939).", { category: "correctness" }),
+    WK8603: auditRule("WK8603", "merge-worthy", "guidance", "k8s_cluster receiver runs in every collector copy", "Run the k8s_cluster receiver in a single-replica Deployment, or set its k8s_leader_elector to a k8s_leader_elector extension enabled in service.extensions.", { category: "correctness" }),
+    WK8604: auditRule("WK8604", "merge-worthy", "guidance", "Collector config in a ConfigMap fails the otel config checks", "Fix the collector config the ConfigMap carries: each finding keeps its OTEL1xx id and names the ConfigMap and key. Change the declared components and pipelines, not the rendered YAML.", { category: "correctness" }),
+    WK8605: auditRule("WK8605", "merge-worthy", "guidance", "Collector config reads the node but its workload lacks the node name or host mounts", "Set the node name variable from spec.nodeName with the downward API and mount the host paths hostmetrics and filelog read, read-only; OtelCollector adds them from the config.", { category: "correctness" }),
+    WK8606: auditRule("WK8606", "merge-worthy", "guidance", "PrometheusRule groups fail the prometheus rule-file checks", "Fix the rule group the PrometheusRule carries: each finding keeps its PROM1xx or PROM2xx id and names the PrometheusRule. Change the declared RuleGroup, not the rendered YAML.", { category: "correctness" }),
+    WK8701: auditRule("WK8701", "merge-worthy", "guidance", "PrometheusRule selected by no Prometheus or ThanosRuler", "Match the rule's labels and namespace with ruleSelector and ruleNamespaceSelector; null selects nothing, {} selects all.", { category: "correctness" }),
+    WK8702: auditRule("WK8702", "merge-worthy", "guidance", "Monitor selected by no Prometheus or PrometheusAgent", "Match the ServiceMonitor, PodMonitor, Probe or ScrapeConfig with the selector and namespace selector for its kind; null selects nothing, {} selects all.", { category: "correctness" }),
+    WK8703: auditRule("WK8703", "merge-worthy", "guidance", "AlertmanagerConfig selected by no Alertmanager", "Match the config's labels and namespace with alertmanagerConfigSelector and alertmanagerConfigNamespaceSelector; null selects nothing, {} selects all.", { category: "correctness" }),
+    WK8704: auditRule("WK8704", "merge-worthy", "guidance", "Monitor selects no Service or pod, or names a port that is not there", "Make the monitor's selector match the labels on the Service or pod template, and name a port the Service or container declares.", { category: "correctness" }),
+    WK8705: auditRule("WK8705", "merge-worthy", "guidance", "Prometheus selects no monitor at all", "Set serviceMonitorSelector, podMonitorSelector, probeSelector and scrapeConfigSelector for the monitor kinds it should scrape; {} selects all in the selected namespaces.", { category: "correctness" }),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(k8sAuditCatalog, k8sAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,118 @@
+export const k8sAuditLineage = {
+    FLUX002: [
+        { tool: "flux-docs", rule: ".spec.sourceRef", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/#source-reference", relation: "overlaps" },
+    ],
+    FLUX003: [
+        { tool: "flux-docs", rule: ".spec.dependsOn", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/#dependencies", relation: "overlaps" },
+    ],
+    WK8005: [
+        { tool: "polaris", rule: "sensitiveContainerEnvVar", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+        { tool: "kube-linter", rule: "env-var-secret", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#env-var-secret", relation: "overlaps" },
+    ],
+    WK8006: [
+        { tool: "kube-linter", rule: "latest-tag", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#latest-tag", relation: "equivalent" },
+        { tool: "polaris", rule: "tagNotSpecified", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_K8S_14", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+    ],
+    WK8041: [
+        { tool: "polaris", rule: "sensitiveContainerEnvVar", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+        { tool: "kube-linter", rule: "env-var-secret", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#env-var-secret", relation: "overlaps" },
+        { tool: "datree", rule: "prevent-exposed-secrets-aws", url: "https://hub.datree.io/built-in-rules/prevent-exposed-secrets-aws", relation: "overlaps" },
+    ],
+    WK8042: [
+        { tool: "polaris", rule: "sensitiveConfigmapContent", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+        { tool: "datree", rule: "prevent-exposed-secrets-privatekey", url: "https://hub.datree.io/built-in-rules/prevent-exposed-secrets-privatekey", relation: "overlaps" },
+    ],
+    WK8101: [
+        { tool: "kube-linter", rule: "mismatching-selector", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#mismatching-selector", relation: "equivalent" },
+        { tool: "kube-score", rule: "deployment-pod-selector-labels-match-template-metadata-labels", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+    ],
+    WK8105: [
+        { tool: "polaris", rule: "pullPolicyNotAlways", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+        { tool: "kube-score", rule: "container-image-pull-policy", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_K8S_15", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+    ],
+    WK8201: [
+        { tool: "polaris", rule: "cpuLimitsMissing", url: "https://polaris.docs.fairwinds.com/checks/efficiency/", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_K8S_13", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+        { tool: "kube-score", rule: "container-resources", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    ],
+    WK8202: [
+        { tool: "kube-linter", rule: "privileged-container", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#privileged-container", relation: "equivalent" },
+        { tool: "polaris", rule: "runAsPrivileged", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_K8S_16", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+    ],
+    WK8203: [
+        { tool: "kube-linter", rule: "no-read-only-root-fs", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#no-read-only-root-fs", relation: "equivalent" },
+        { tool: "polaris", rule: "notReadOnlyRootFilesystem", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_K8S_22", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+    ],
+    WK8204: [
+        { tool: "polaris", rule: "runAsRootAllowed", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_K8S_23", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+        { tool: "kube-linter", rule: "run-as-non-root", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#run-as-non-root", relation: "overlaps" },
+    ],
+    WK8205: [
+        { tool: "kubesec", rule: "containers[] .securityContext .capabilities .drop | index(\"ALL\")", url: "https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/", relation: "equivalent" },
+        { tool: "kics", rule: "No Drop Capabilities for Containers", url: "https://docs.kics.io/latest/queries/kubernetes-queries/268ca686-7fb7-4ae9-b129-955a2a89064e/", relation: "overlaps" },
+        { tool: "kube-linter", rule: "drop-net-raw-capability", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#drop-net-raw-capability", relation: "overlaps" },
+    ],
+    WK8207: [
+        { tool: "kube-linter", rule: "host-network", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#host-network", relation: "equivalent" },
+        { tool: "polaris", rule: "hostNetworkSet", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_K8S_19", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+    ],
+    WK8208: [
+        { tool: "kube-linter", rule: "host-pid", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#host-pid", relation: "equivalent" },
+        { tool: "polaris", rule: "hostPIDSet", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_K8S_17", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+    ],
+    WK8209: [
+        { tool: "kube-linter", rule: "host-ipc", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#host-ipc", relation: "equivalent" },
+        { tool: "polaris", rule: "hostIPCSet", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_K8S_18", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+    ],
+    WK8301: [
+        { tool: "kube-score", rule: "pod-probes", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+        { tool: "polaris", rule: "readinessProbeMissing", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_K8S_8", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+    ],
+    WK8302: [
+        { tool: "polaris", rule: "deploymentMissingReplicas", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "equivalent" },
+        { tool: "kube-score", rule: "deployment-replicas", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+        { tool: "datree", rule: "ensure-minimum-two-replicas", url: "https://hub.datree.io/built-in-rules/ensure-minimum-two-replicas", relation: "equivalent" },
+    ],
+    WK8303: [
+        { tool: "kube-score", rule: "deployment-has-poddisruptionbudget", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+        { tool: "polaris", rule: "missingPodDisruptionBudget", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+        { tool: "kics", rule: "Deployment Without PodDisruptionBudget", url: "https://docs.kics.io/latest/queries/kubernetes-queries/b23e9b98-0cb6-4fc9-b257-1f3270442678/", relation: "overlaps" },
+    ],
+    WK8304: [
+        { tool: "polaris", rule: "tlsSettingsMissing", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+    ],
+    WK8305: [
+        { tool: "kube-linter", rule: "dangling-ingress", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#dangling-ingress", relation: "overlaps" },
+        { tool: "kube-score", rule: "ingress-targets-service", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    ],
+    WK8405: [
+        { tool: "kube-score", rule: "deployment-has-poddisruptionbudget", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+        { tool: "polaris", rule: "missingPodDisruptionBudget", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+    ],
+    WK8406: [
+        { tool: "checkov", rule: "CKV_K8S_13", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+        { tool: "kube-score", rule: "container-resources", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+        { tool: "kube-linter", rule: "unset-memory-requirements", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#unset-memory-requirements", relation: "overlaps" },
+    ],
+    WK8501: [
+        { tool: "kube-linter", rule: "schema-validation", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#schema-validation", relation: "overlaps" },
+    ],
+    WK8502: [
+        { tool: "kube-linter", rule: "schema-validation", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#schema-validation", relation: "overlaps" },
+    ],
+    WK8503: [
+        { tool: "kube-linter", rule: "env-value-from", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#env-value-from", relation: "overlaps" },
+    ],
+    WK8505: [
+        { tool: "flux-docs", rule: ".spec.decryption", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/#decryption", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/argo-helpers.js

@@ -0,0 +1,36 @@
+import { docsToManifests } from "./k8s-helpers.js";
+/** The always-present, in-cluster Argo destination. */
+export const IN_CLUSTER_SERVER = "https://kubernetes.default.svc";
+export const IN_CLUSTER_NAME = "in-cluster";
+/** Label that marks a Secret as an Argo CD external cluster registration. */
+export const CLUSTER_SECRET_TYPE_LABEL = "argocd.argoproj.io/secret-type";
+/** All manifests across every lexicon output. */
+export function allManifests(ctx) {
+    return docsToManifests(ctx);
+}
+/** Manifests of a given Argo kind. */
+export function manifestsOfKind(manifests, kind) {
+    return manifests.filter((m) => m.kind === kind);
+}
+/**
+ * Read a string field from a Secret's stringData or data block.
+ * (Argo cluster Secrets conventionally use stringData.)
+ */
+export function secretField(manifest, key) {
+    const stringData = manifest.stringData;
+    const data = manifest.data;
+    const fromStringData = stringData?.[key];
+    if (typeof fromStringData === "string")
+        return fromStringData;
+    const fromData = data?.[key];
+    if (typeof fromData === "string")
+        return fromData;
+    return undefined;
+}
+/** True if the Secret is labelled as an Argo cluster registration. */
+export function isClusterSecret(manifest) {
+    if (manifest.kind !== "Secret")
+        return false;
+    const labels = manifest.metadata?.labels;
+    return labels?.[CLUSTER_SECRET_TYPE_LABEL] === "cluster";
+}

package/dist/lint/post-synth/argo002.js

@@ -0,0 +1,31 @@
+import { allManifests, manifestsOfKind } from "./argo-helpers.js";
+export const argo002 = {
+    id: "ARGO002",
+    description: "Application.spec.project must reference a declared AppProject (or the built-in default)",
+    check(ctx) {
+        const diagnostics = [];
+        const manifests = allManifests(ctx);
+        const declaredProjects = new Set(manifestsOfKind(manifests, "AppProject")
+            .map((p) => p.metadata?.name)
+            .filter((n) => typeof n === "string"));
+        // Argo ships a built-in default project.
+        declaredProjects.add("default");
+        for (const app of manifestsOfKind(manifests, "Application")) {
+            const project = app.spec?.project;
+            const name = app.metadata?.name ?? "Application";
+            // No project set → defaults to `default` at sync time; not this check's job.
+            if (typeof project !== "string" || project === "")
+                continue;
+            if (declaredProjects.has(project))
+                continue;
+            diagnostics.push({
+                checkId: "ARGO002",
+                severity: "error",
+                message: `Application "${name}" references AppProject "${project}", which is not declared. Add an AppProject named "${project}" or reference an existing project.`,
+                entity: name,
+                lexicon: "k8s",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/argo003.js

@@ -0,0 +1,53 @@
+import { allManifests, manifestsOfKind, isClusterSecret, secretField, IN_CLUSTER_SERVER, IN_CLUSTER_NAME, } from "./argo-helpers.js";
+export const argo003 = {
+    id: "ARGO003",
+    description: "Application.spec.destination must reference a registered cluster or the in-cluster target",
+    check(ctx) {
+        const diagnostics = [];
+        const manifests = allManifests(ctx);
+        const registeredServers = new Set([IN_CLUSTER_SERVER]);
+        const registeredNames = new Set([IN_CLUSTER_NAME]);
+        for (const secret of manifests.filter(isClusterSecret)) {
+            const server = secretField(secret, "server");
+            if (server)
+                registeredServers.add(server);
+            const name = secretField(secret, "name") ?? secret.metadata?.name;
+            if (typeof name === "string")
+                registeredNames.add(name);
+        }
+        for (const app of manifestsOfKind(manifests, "Application")) {
+            const name = app.metadata?.name ?? "Application";
+            const destination = app.spec?.destination;
+            if (!destination || (destination.server === undefined && destination.name === undefined)) {
+                diagnostics.push({
+                    checkId: "ARGO003",
+                    severity: "error",
+                    message: `Application "${name}" has no spec.destination.server or spec.destination.name — Argo cannot resolve a target cluster.`,
+                    entity: name,
+                    lexicon: "k8s",
+                });
+                continue;
+            }
+            if (typeof destination.server === "string" && !registeredServers.has(destination.server)) {
+                diagnostics.push({
+                    checkId: "ARGO003",
+                    severity: "error",
+                    message: `Application "${name}" targets cluster server "${destination.server}", which is not registered. Register it with a cluster Secret (label argocd.argoproj.io/secret-type=cluster) or use the in-cluster target.`,
+                    entity: name,
+                    lexicon: "k8s",
+                });
+                continue;
+            }
+            if (typeof destination.name === "string" && !registeredNames.has(destination.name)) {
+                diagnostics.push({
+                    checkId: "ARGO003",
+                    severity: "error",
+                    message: `Application "${name}" targets cluster name "${destination.name}", which is not registered. Register it with a cluster Secret or use the in-cluster target.`,
+                    entity: name,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/argo005.js

@@ -0,0 +1,54 @@
+/**
+ * ARGO005: Application source.path should point at an existing directory (warn)
+ *
+ * When an Argo `Application` syncs from a git source it names a `source.path`
+ * inside the repo. In the common monorepo layout — Argo watches the same repo
+ * Chant builds — that path is relative to the build root, so a typo'd or moved
+ * path surfaces as a sync error only after deploy. This check warns when the
+ * path doesn't resolve to a directory under the build root.
+ *
+ * It is a warning, not an error: Applications that sync from a *different*
+ * remote repo legitimately reference paths that don't exist locally. Helm chart
+ * sources (`source.chart`) and pathless sources are skipped.
+ */
+import { existsSync, statSync } from "fs";
+import { isAbsolute, resolve } from "path";
+import { allManifests, manifestsOfKind } from "./argo-helpers.js";
+function dirExists(path) {
+    try {
+        const full = isAbsolute(path) ? path : resolve(process.cwd(), path);
+        return existsSync(full) && statSync(full).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+export const argo005 = {
+    id: "ARGO005",
+    description: "Application source.path should resolve to an existing directory under the build root",
+    check(ctx) {
+        const diagnostics = [];
+        for (const app of manifestsOfKind(allManifests(ctx), "Application")) {
+            const name = app.metadata?.name ?? "Application";
+            const source = app.spec?.source;
+            if (!source)
+                continue;
+            // Helm chart sources have no filesystem path.
+            if (typeof source.chart === "string" && source.chart !== "")
+                continue;
+            const path = source.path;
+            if (typeof path !== "string" || path === "")
+                continue;
+            if (dirExists(path))
+                continue;
+            diagnostics.push({
+                checkId: "ARGO005",
+                severity: "warning",
+                message: `Application "${name}" source.path "${path}" does not resolve to a directory under the build root. Confirm the path (or ignore if it lives in a different repo).`,
+                entity: name,
+                lexicon: "k8s",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/crd-schema-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crd-schema-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/crd-schema-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,cAAc,EAAE,CAAC;AAgB/B;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAkBlE;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,GAAG,IAAI,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAM/E;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,KAAK,CAAC;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC,CAO/G;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,GAAG,eAAe,CAAC;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,SAAS,GAAG,WAAW,EAAE,CAIjG;AAgGD,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAcxD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAWjF;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAE3D"}
+{"version":3,"file":"crd-schema-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/crd-schema-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,cAAc,EAAE,CAAC;AAgB/B;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAkBlE;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,GAAG,IAAI,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAM/E;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,KAAK,CAAC;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC,CAO/G;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,GAAG,eAAe,CAAC;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,SAAS,GAAG,WAAW,EAAE,CAIjG;AAgGD,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAcxD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAWjF;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAE3D"}