@intentius/chant-lexicon-k8s 0.124.31 → 0.124.33

package/dist/lint/post-synth/wk8501.js

@@ -0,0 +1,36 @@
+/**
+ * WK8501: Custom resource spec has a field its CRD schema does not declare
+ *
+ * A generated CRD class takes `spec: Record<string, unknown>`, so a misspelled
+ * field (`classname` for `className`) type-checks and serializes. The API
+ * server accepts the object and prunes the unknown field, the controller
+ * never sees it, and the resource runs with a default nobody chose. The
+ * lexicon ships each CRD's `spec` schema (chant #1372); this check flags any
+ * field that schema does not list, unless the enclosing object declares
+ * `x-kubernetes-preserve-unknown-fields` or `additionalProperties`.
+ */
+import { customResources, resourceLabel, validateSpec } from "./crd-schema-helpers.js";
+export const wk8501 = {
+    id: "WK8501",
+    description: "Custom resource spec contains a field its CRD schema does not declare",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { manifest, schema } of customResources(ctx)) {
+            if (manifest.spec === undefined)
+                continue;
+            const name = resourceLabel(manifest);
+            for (const finding of validateSpec(manifest.spec, schema)) {
+                if (finding.kind !== "unknown-field")
+                    continue;
+                diagnostics.push({
+                    checkId: "WK8501",
+                    severity: "error",
+                    message: `${manifest.kind} "${name}": ${finding.message}. The API server prunes it and the controller never sees it.`,
+                    entity: name,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8502.js

@@ -0,0 +1,35 @@
+/**
+ * WK8502: Custom resource spec field has the wrong type or an invalid enum value
+ *
+ * With `spec: Record<string, unknown>` on every generated CRD class, nothing
+ * at compile time stops `replicas: "2"` or `desiredState: "Runing"`. The API
+ * server rejects the first at apply and the controller ignores the second.
+ * The lexicon ships each CRD's `spec` schema (chant #1372); this check
+ * compares every scalar against its declared type and enum before apply.
+ * `x-kubernetes-int-or-string` and untyped nodes accept anything.
+ */
+import { customResources, resourceLabel, validateSpec } from "./crd-schema-helpers.js";
+export const wk8502 = {
+    id: "WK8502",
+    description: "Custom resource spec field has the wrong type or a value outside its enum",
+    check(ctx) {
+        const diagnostics = [];
+        for (const { manifest, schema } of customResources(ctx)) {
+            if (manifest.spec === undefined)
+                continue;
+            const name = resourceLabel(manifest);
+            for (const finding of validateSpec(manifest.spec, schema)) {
+                if (finding.kind !== "type-mismatch")
+                    continue;
+                diagnostics.push({
+                    checkId: "WK8502",
+                    severity: "error",
+                    message: `${manifest.kind} "${name}": ${finding.message}`,
+                    entity: name,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8503.js

@@ -0,0 +1,164 @@
+import { collectSecretDeclarations } from "@intentius/chant/secret-provenance";
+import { extractPodSpec } from "./k8s-helpers.js";
+import { allManifests } from "./argo-helpers.js";
+import { resolveEncryptedSecretClaims } from "./sops-helpers.js";
+function asRecord(value) {
+    return typeof value === "object" && value !== null ? value : undefined;
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+/** Collect every Secret the output produces, from literal Secrets and the
+ * secret-materializing CR kinds the lexicon ships. */
+function collectProducedSecrets(manifests) {
+    const produced = [];
+    for (const m of manifests) {
+        const metaName = m.metadata?.name;
+        const metaNs = m.metadata?.namespace;
+        switch (m.kind) {
+            case "Secret": {
+                if (typeof metaName === "string")
+                    produced.push({ name: metaName, namespace: metaNs });
+                break;
+            }
+            case "ExternalSecret": {
+                // external-secrets.io — writes spec.target.name, defaulting to the CR's own name.
+                const target = asRecord(m.spec?.target);
+                const targetName = typeof target?.name === "string" ? target.name : metaName;
+                if (typeof targetName === "string")
+                    produced.push({ name: targetName, namespace: metaNs });
+                break;
+            }
+            case "InfisicalSecret":
+            case "InfisicalDynamicSecret": {
+                // secrets.infisical.com — writes spec.managedSecretReference.secretName;
+                // secretNamespace is carried separately from the CR's own namespace.
+                const ref = asRecord(m.spec?.managedSecretReference);
+                if (typeof ref?.secretName === "string") {
+                    const ns = typeof ref.secretNamespace === "string" ? ref.secretNamespace : metaNs;
+                    produced.push({ name: ref.secretName, namespace: ns });
+                }
+                break;
+            }
+            case "Certificate": {
+                // cert-manager — materializes the keypair into spec.secretName.
+                const secretName = m.spec?.secretName;
+                if (typeof secretName === "string")
+                    produced.push({ name: secretName, namespace: metaNs });
+                break;
+            }
+        }
+    }
+    return produced;
+}
+/** Collect every non-optional secret reference in a pod spec. */
+function collectSecretRefs(podSpec) {
+    const refs = [];
+    const containers = [
+        ...asArray(podSpec.containers),
+        ...asArray(podSpec.initContainers),
+        ...asArray(podSpec.ephemeralContainers),
+    ];
+    for (const c of containers) {
+        const container = asRecord(c);
+        if (!container)
+            continue;
+        for (const e of asArray(container.envFrom)) {
+            const secretRef = asRecord(asRecord(e)?.secretRef);
+            if (typeof secretRef?.name === "string" && secretRef.optional !== true) {
+                refs.push({ name: secretRef.name, via: "envFrom.secretRef" });
+            }
+        }
+        for (const e of asArray(container.env)) {
+            const keyRef = asRecord(asRecord(asRecord(e)?.valueFrom)?.secretKeyRef);
+            if (typeof keyRef?.name === "string" && keyRef.optional !== true) {
+                refs.push({ name: keyRef.name, via: "env[].valueFrom.secretKeyRef" });
+            }
+        }
+    }
+    for (const v of asArray(podSpec.volumes)) {
+        const volume = asRecord(v);
+        if (!volume)
+            continue;
+        const secret = asRecord(volume.secret);
+        if (typeof secret?.secretName === "string" && secret.optional !== true) {
+            refs.push({ name: secret.secretName, via: "volumes[].secret.secretName" });
+        }
+        const projected = asRecord(volume.projected);
+        for (const s of asArray(projected?.sources)) {
+            const source = asRecord(asRecord(s)?.secret);
+            if (typeof source?.name === "string" && source.optional !== true) {
+                refs.push({ name: source.name, via: "volumes[].projected.sources[].secret" });
+            }
+        }
+    }
+    for (const p of asArray(podSpec.imagePullSecrets)) {
+        const pull = asRecord(p);
+        if (typeof pull?.name === "string") {
+            refs.push({ name: pull.name, via: "imagePullSecrets" });
+        }
+    }
+    return refs;
+}
+/** True when a produced Secret satisfies a reference. A side with no
+ * namespace matches any — only two explicit, different namespaces miss. */
+function producerCovers(producer, name, namespace) {
+    if (producer.name !== name)
+        return false;
+    return producer.namespace === undefined || namespace === undefined || producer.namespace === namespace;
+}
+export const wk8503 = {
+    id: "WK8503",
+    description: "Workload consumes a Secret nothing in the output produces — produce it (Secret, ExternalSecret, InfisicalSecret, Certificate) or declare its provenance with declareSecret()",
+    check(ctx) {
+        const diagnostics = [];
+        const manifests = allManifests(ctx);
+        const produced = collectProducedSecrets(manifests);
+        // Committed ciphertext produces a Secret as surely as a Secret manifest
+        // does — Flux decrypts the emitted sidecar straight into the cluster — so
+        // it joins the producer set, namespace and all. A claim whose file did
+        // not resolve produces nothing: WK8504 reports why, and this check still
+        // fires, which is the point of not treating it as a waiver.
+        for (const claim of resolveEncryptedSecretClaims(ctx)) {
+            if (claim.problems.length > 0)
+                continue;
+            produced.push({ name: claim.declaration.name, namespace: claim.document?.namespace });
+        }
+        // The typed waiver: a SecretProvenance declaration covering the name, for
+        // the three kinds whose value genuinely comes from outside this build.
+        const declaredNames = new Set();
+        for (const decl of collectSecretDeclarations(ctx.entities).values()) {
+            if (decl.provenance === "committed-encrypted")
+                continue;
+            declaredNames.add(decl.name);
+        }
+        for (const manifest of manifests) {
+            const podSpec = extractPodSpec(manifest);
+            if (!podSpec)
+                continue;
+            const workload = manifest.metadata?.name ?? manifest.kind ?? "workload";
+            const namespace = manifest.metadata?.namespace;
+            const reported = new Set();
+            for (const ref of collectSecretRefs(podSpec)) {
+                if (reported.has(ref.name))
+                    continue;
+                if (declaredNames.has(ref.name))
+                    continue;
+                if (produced.some((p) => producerCovers(p, ref.name, namespace)))
+                    continue;
+                reported.add(ref.name);
+                diagnostics.push({
+                    checkId: "WK8503",
+                    severity: "error",
+                    message: `${manifest.kind} "${workload}" consumes Secret "${ref.name}" (via ${ref.via}), ` +
+                        `but nothing in the build output produces it — the pod will fail at start. ` +
+                        `Produce it in this build, or declare its provenance: ` +
+                        `declareSecret({ name: "${ref.name}", provenance: "referenced" }).`,
+                    entity: workload,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8504.js

@@ -0,0 +1,20 @@
+import { resolveEncryptedSecretClaims } from "./sops-helpers.js";
+export const wk8504 = {
+    id: "WK8504",
+    description: "committed-encrypted secret declaration does not resolve — the declared file is missing, is not the named Secret, or is not encrypted",
+    check(ctx) {
+        const diagnostics = [];
+        for (const claim of resolveEncryptedSecretClaims(ctx)) {
+            for (const problem of claim.problems) {
+                diagnostics.push({
+                    checkId: "WK8504",
+                    severity: "error",
+                    message: `declareSecret("${claim.declaration.name}"): ${problem}`,
+                    entity: claim.declaration.name,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8505.js

@@ -0,0 +1,31 @@
+import { allManifests, manifestsOfKind } from "./argo-helpers.js";
+import { resolveEncryptedSecretClaims } from "./sops-helpers.js";
+/** Flux Kustomizations only — the kustomize.config.k8s.io kind shares the name. */
+function fluxKustomizations(manifests) {
+    return manifestsOfKind(manifests, "Kustomization").filter((m) => {
+        const apiVersion = m.apiVersion;
+        return typeof apiVersion !== "string" || apiVersion.startsWith("kustomize.toolkit.fluxcd.io/");
+    });
+}
+export const wk8505 = {
+    id: "WK8505",
+    description: "committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it. Sees one build root at a time, so it goes silent when that Kustomization lives in a different build root (chant #1939).",
+    check(ctx) {
+        const kustomizations = fluxKustomizations(allManifests(ctx));
+        if (kustomizations.length === 0)
+            return [];
+        if (kustomizations.some((k) => k.spec?.decryption !== undefined))
+            return [];
+        const resolved = resolveEncryptedSecretClaims(ctx).filter((claim) => claim.problems.length === 0);
+        return resolved.map((claim) => ({
+            checkId: "WK8505",
+            severity: "warning",
+            message: `declareSecret("${claim.declaration.name}") is committed-encrypted, but no Flux Kustomization ` +
+                `in this build sets spec.decryption — Flux will apply "${claim.filename}" without decrypting it. ` +
+                `Add decryption: "sops" to the FluxAppFor reconciling the path that carries it, or ignore if that ` +
+                `Kustomization is declared in a different build.`,
+            entity: claim.declaration.name,
+            lexicon: "k8s",
+        }));
+    },
+};

package/dist/lint/post-synth/wk8601.js

@@ -0,0 +1,40 @@
+/**
+ * WK8601: `tail_sampling` in a collector that runs once per node
+ *
+ * A DaemonSet collector sees the spans produced on its own node. A trace
+ * whose services run on several nodes arrives in pieces, one piece per
+ * agent, and `tail_sampling` decides on each piece alone: an error span on
+ * node A doesn't keep the rest of the trace on node B, and latency policies
+ * measure a fragment. Nothing fails; the sampled traces are just incomplete.
+ * Tail sampling belongs on a gateway that receives whole traces (see WK8602
+ * for the multi-replica gateway case).
+ *
+ * Reads the collector config from the ConfigMap the DaemonSet runs, joined
+ * through `otel-placement-helpers.ts`. One build root at a time (chant #1939).
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+import { collectorPlacements, describePlacement, tracePipelineProcessors } from "./otel-placement-helpers.js";
+export const wk8601 = {
+    id: "WK8601",
+    description: "OpenTelemetry Collector runs tail_sampling as a per-node DaemonSet; each agent sees only its node's spans, so decisions are made on partial traces. Sees one build root at a time (chant #1939).",
+    check(ctx) {
+        const diagnostics = [];
+        for (const p of collectorPlacements(docsToManifests(ctx))) {
+            if (p.kind !== "DaemonSet")
+                continue;
+            const ids = tracePipelineProcessors(p.config, "tail_sampling");
+            if (ids.length === 0)
+                continue;
+            diagnostics.push({
+                checkId: "WK8601",
+                severity: "warning",
+                message: `${describePlacement(p)} runs ${ids.join(", ")} (${p.where}) on every node. ` +
+                    `Each agent sees only its own node's spans, so sampling decisions are made on partial traces. ` +
+                    `Move tail sampling to a gateway (OtelCollectorGateway) and send traces to it through a loadbalancing exporter routed by traceID.`,
+                entity: p.name,
+                lexicon: "k8s",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8602.js

@@ -0,0 +1,120 @@
+/**
+ * WK8602: `tail_sampling` on a multi-replica gateway that collectors reach
+ * without trace-aware load balancing
+ *
+ * Tail sampling needs every span of a trace in the same process. Behind a
+ * ClusterIP Service, connections are spread across the gateway replicas with
+ * no regard for trace ids, so the spans of one trace land on different
+ * replicas and each samples a fragment. The fix is a `loadbalancing`
+ * exporter in front, routing by `traceID` to the replicas themselves (the
+ * `k8s` resolver on any Service that selects them, or the `dns` resolver on
+ * a headless one). A single-replica gateway passes.
+ *
+ * The check fires on evidence, not on absence: another collector in the
+ * build whose traces pipeline exports to one of the gateway's Services
+ * through `otlp`/`otlphttp`, through a `loadbalancing` exporter routed by
+ * something other than `traceID`, or through the `dns` resolver on a
+ * ClusterIP Service (one virtual IP, so one backend per connection). When
+ * the senders live in another build root, or are applications talking to
+ * the gateway directly, it stays silent (chant #1939).
+ */
+import { canonicalTypeOf } from "@intentius/chant-lexicon-otel/model";
+import { docsToManifests } from "./k8s-helpers.js";
+import { collectorPlacements, describePlacement, hostOfEndpoint, pipelinesOf, serviceOfHost, servicesSelecting, tracePipelineProcessors, } from "./otel-placement-helpers.js";
+const TRACE_ID_KEYS = new Set([undefined, null, "", "traceID"]);
+function record(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v) ? v : {};
+}
+/** Why each traces exporter of `sender` that reaches `services` does so without trace-aware routing. */
+function unroutedExporters(sender, services) {
+    const reasons = [];
+    const seen = new Set();
+    for (const [, pipeline] of pipelinesOf(sender.config, "traces")) {
+        for (const id of pipeline.exporters) {
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            const type = canonicalTypeOf("exporter", id);
+            const cfg = record(sender.config.exporters?.[id]);
+            if (type === "loadbalancing") {
+                const resolver = record(cfg.resolver);
+                const k8sService = record(resolver.k8s).service;
+                const dnsHost = record(resolver.dns).hostname;
+                let target;
+                if (typeof k8sService === "string") {
+                    const svc = serviceOfHost(k8sService, sender.namespace);
+                    if (svc && services.has(svc))
+                        target = svc;
+                }
+                else if (typeof dnsHost === "string") {
+                    const svc = serviceOfHost(dnsHost, sender.namespace);
+                    if (svc && services.has(svc)) {
+                        target = svc;
+                        if (!services.get(svc)) {
+                            reasons.push(`${id} resolves ClusterIP Service ${svc} through dns, which returns one virtual IP rather than the replicas`);
+                            continue;
+                        }
+                    }
+                }
+                if (target && !TRACE_ID_KEYS.has(cfg.routing_key)) {
+                    reasons.push(`${id} routes by ${String(cfg.routing_key)}, not traceID`);
+                }
+                continue;
+            }
+            if (type === "otlp" || type === "otlphttp") {
+                for (const field of ["endpoint", "traces_endpoint"]) {
+                    const host = hostOfEndpoint(cfg[field]);
+                    const svc = host ? serviceOfHost(host, sender.namespace) : undefined;
+                    if (svc && services.has(svc)) {
+                        reasons.push(`${id} sends to Service ${svc} directly`);
+                        break;
+                    }
+                }
+            }
+        }
+    }
+    return reasons;
+}
+export const wk8602 = {
+    id: "WK8602",
+    description: "OpenTelemetry Collector gateway runs tail_sampling on more than one replica, but collectors send it traces without a loadbalancing exporter routed by traceID. Sees one build root at a time (chant #1939).",
+    check(ctx) {
+        const manifests = docsToManifests(ctx);
+        const placements = collectorPlacements(manifests);
+        const diagnostics = [];
+        for (const gateway of placements) {
+            if (gateway.kind === "DaemonSet" || gateway.replicas === undefined || gateway.replicas <= 1)
+                continue;
+            const tail = tracePipelineProcessors(gateway.config, "tail_sampling");
+            if (tail.length === 0)
+                continue;
+            const services = new Map();
+            for (const s of servicesSelecting(manifests, gateway.workload))
+                services.set(`${s.name}.${s.namespace}`, s.headless);
+            if (services.size === 0)
+                continue;
+            const senders = new Set();
+            for (const sender of placements) {
+                if (sender.workload === gateway.workload)
+                    continue;
+                const key = `${sender.kind}/${sender.namespace}/${sender.name}/${sender.configMap}/${sender.key}`;
+                if (senders.has(key))
+                    continue;
+                senders.add(key);
+                const reasons = unroutedExporters(sender, services);
+                if (reasons.length === 0)
+                    continue;
+                diagnostics.push({
+                    checkId: "WK8602",
+                    severity: "warning",
+                    message: `${describePlacement(gateway)} runs ${tail.join(", ")} on up to ${gateway.replicas} replicas, and ${describePlacement(sender)} sends it traces without trace-aware routing: ${reasons.join("; ")}. ` +
+                        `Spans of one trace land on different replicas and each samples a fragment. ` +
+                        `Export traces through a loadbalancing exporter with routing_key traceID (gatewayExporter(gateway, { loadBalance: true })), or run one replica.`,
+                    entity: gateway.name,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8603.js

@@ -0,0 +1,63 @@
+/**
+ * WK8603: `k8s_cluster` receiver in a collector that runs more than one copy
+ * without a leader elector
+ *
+ * The `k8s_cluster` receiver reports cluster-level metrics and entity events
+ * (nodes, deployments, pods, resource quotas) by watching the API server.
+ * Every copy of the collector reports every object, so in a DaemonSet the
+ * cluster is reported once per node, and in a Deployment once per replica:
+ * duplicated series and N watches against the API server. Run it in a
+ * single-replica Deployment, or set the receiver's `k8s_leader_elector` to a
+ * `k8s_leader_elector` extension enabled in `service.extensions` (both ship in
+ * otelcol-contrib and otelcol-k8s at the pinned v0.130.0), so only the
+ * leader collects.
+ *
+ * One build root at a time (chant #1939).
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+import { allPipelines, collectorPlacements, componentType, describePlacement } from "./otel-placement-helpers.js";
+/** Why a `k8s_cluster` receiver is not behind a working leader elector, or undefined when it is. */
+function missingLeader(config, id) {
+    const cfg = config.receivers?.[id];
+    const ref = typeof cfg === "object" && cfg !== null ? cfg.k8s_leader_elector : undefined;
+    if (typeof ref !== "string" || ref.length === 0)
+        return `${id} has no k8s_leader_elector`;
+    if (componentType(ref) !== "k8s_leader_elector" || !(config.extensions && ref in config.extensions)) {
+        return `${id} names k8s_leader_elector "${ref}", which is not a declared k8s_leader_elector extension`;
+    }
+    const enabled = Array.isArray(config.service.extensions) && config.service.extensions.includes(ref);
+    if (!enabled)
+        return `${id} names k8s_leader_elector "${ref}", which is not enabled in service.extensions`;
+    return undefined;
+}
+export const wk8603 = {
+    id: "WK8603",
+    description: "OpenTelemetry Collector runs the k8s_cluster receiver in a DaemonSet or multi-replica workload without a k8s_leader_elector; every copy reports every cluster object. Sees one build root at a time (chant #1939).",
+    check(ctx) {
+        const diagnostics = [];
+        for (const p of collectorPlacements(docsToManifests(ctx))) {
+            const copies = p.kind === "DaemonSet" ? "every node" : p.replicas !== undefined && p.replicas > 1 ? `each of up to ${p.replicas} replicas` : undefined;
+            if (!copies)
+                continue;
+            const used = new Set();
+            for (const [, pipeline] of allPipelines(p.config)) {
+                for (const id of pipeline.receivers)
+                    if (componentType(id) === "k8s_cluster")
+                        used.add(id);
+            }
+            const reasons = [...used].map((id) => missingLeader(p.config, id)).filter((r) => r !== undefined);
+            if (reasons.length === 0)
+                continue;
+            diagnostics.push({
+                checkId: "WK8603",
+                severity: "warning",
+                message: `${describePlacement(p)} runs the k8s_cluster receiver on ${copies} (${p.where}): ${reasons.join("; ")}. ` +
+                    `Each copy reports every cluster object, duplicating series and API server watches. ` +
+                    `Run it in a single-replica Deployment, or reference a k8s_leader_elector extension from the receiver and enable it in service.extensions.`,
+                entity: p.name,
+                lexicon: "k8s",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8604.js

@@ -0,0 +1,31 @@
+/**
+ * WK8604: the otel config checks over collector configs in ConfigMaps
+ *
+ * `OtelCollector`, `OtelCollectorGateway`, `GkeOtelCollector` and hand-written
+ * manifests carry the collector config as a string under a ConfigMap data key.
+ * `chant build` gives each lexicon's checks only that lexicon's output, so the
+ * otel lexicon's config checks never see a config that lives in the k8s output
+ * (chant #2930). This check runs them there: every ConfigMap data value that
+ * parses as a collector config (a `service.pipelines` map) goes through the
+ * otel lexicon's `validateCollectorConfig`, and through `attributionIssues`
+ * (OTEL118) when the build stamps telemetry attribution.
+ *
+ * An OpenTelemetry Operator `OpenTelemetryCollector` carries its config in
+ * `spec.config` (an object in v1beta1, YAML text in v1alpha1), and goes
+ * through the same checks; its findings name `OpenTelemetryCollector
+ * <namespace>/<name>, spec.config` where a ConfigMap's name the ConfigMap and
+ * key (#3367).
+ *
+ * Findings keep the otel rule ids (OTEL101-OTEL106, OTEL112-OTEL127, and any config
+ * check the otel lexicon adds later), so `lint.rules` and suppressions name
+ * one id wherever the config lives. Each message names the ConfigMap's
+ * namespace, name and key. Needs only the k8s lexicon in the project.
+ */
+import { collectorConfigDiagnostics } from "@intentius/chant-lexicon-otel/lint/post-synth/otel-helpers";
+export const wk8604 = {
+    id: "WK8604",
+    description: "OpenTelemetry Collector config in a ConfigMap or an OpenTelemetryCollector's spec.config fails the otel lexicon's config checks; findings are reported under their OTEL1xx ids, naming the ConfigMap and key, or the OpenTelemetryCollector.",
+    check(ctx) {
+        return collectorConfigDiagnostics(ctx, { hostedOnly: true });
+    },
+};