@intentius/chant-lexicon-k8s 0.13.1 → 0.15.0

package/src/generated/index.ts

@@ -22,6 +22,8 @@ export const ClusterRole = createResource("K8s::Rbac::ClusterRole", "k8s", {"nam
 export const ClusterRoleBinding = createResource("K8s::Rbac::ClusterRoleBinding", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const ClusterRoleBindingList = createResource("K8s::Rbac::ClusterRoleBindingList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const ClusterRoleList = createResource("K8s::Rbac::ClusterRoleList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const ClusterTrustBundle = createResource("K8s::Certificates::ClusterTrustBundle", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const ClusterTrustBundleList = createResource("K8s::Certificates::ClusterTrustBundleList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const CM = createResource("K8s::Core::ConfigMap", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const ComponentStatus = createResource("K8s::Core::ComponentStatus", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const ComponentStatusList = createResource("K8s::Core::ComponentStatusList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
@@ -49,6 +51,8 @@ export const Deployment = createResource("K8s::Apps::Deployment", "k8s", {"name"
 export const DeploymentList = createResource("K8s::Apps::DeploymentList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const DeviceClass = createResource("K8s::Resource::DeviceClass", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const DeviceClassList = createResource("K8s::Resource::DeviceClassList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const DeviceTaintRule = createResource("K8s::Resource::DeviceTaintRule", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const DeviceTaintRuleList = createResource("K8s::Resource::DeviceTaintRuleList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const DS = createResource("K8s::Apps::DaemonSet", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const Endpoints = createResource("K8s::Core::Endpoints", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const EndpointSlice = createResource("K8s::Discovery::EndpointSlice", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
@@ -78,10 +82,16 @@ export const Issuer = createResource("K8s::CertManager::Issuer", "k8s", {"name":
 export const Job = createResource("K8s::Batch::Job", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const JobList = createResource("K8s::Batch::JobList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const Lease = createResource("K8s::Coordination::Lease", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const LeaseCandidate = createResource("K8s::Coordination::LeaseCandidate", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const LeaseCandidateList = createResource("K8s::Coordination::LeaseCandidateList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const LeaseList = createResource("K8s::Coordination::LeaseList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const LimitRange = createResource("K8s::Core::LimitRange", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const LimitRangeList = createResource("K8s::Core::LimitRangeList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const LocalSubjectAccessReview = createResource("K8s::Authorization::LocalSubjectAccessReview", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const MutatingAdmissionPolicy = createResource("K8s::Admissionregistration::MutatingAdmissionPolicy", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const MutatingAdmissionPolicyBinding = createResource("K8s::Admissionregistration::MutatingAdmissionPolicyBinding", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const MutatingAdmissionPolicyBindingList = createResource("K8s::Admissionregistration::MutatingAdmissionPolicyBindingList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const MutatingAdmissionPolicyList = createResource("K8s::Admissionregistration::MutatingAdmissionPolicyList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const MutatingWebhookConfiguration = createResource("K8s::Admissionregistration::MutatingWebhookConfiguration", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const MutatingWebhookConfigurationList = createResource("K8s::Admissionregistration::MutatingWebhookConfigurationList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const Namespace = createResource("K8s::Core::Namespace", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
@@ -99,6 +109,8 @@ export const PersistentVolumeClaim = createResource("K8s::Core::PersistentVolume
 export const PersistentVolumeClaimList = createResource("K8s::Core::PersistentVolumeClaimList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const PersistentVolumeList = createResource("K8s::Core::PersistentVolumeList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const Pod = createResource("K8s::Core::Pod", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const PodCertificateRequest = createResource("K8s::Certificates::PodCertificateRequest", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const PodCertificateRequestList = createResource("K8s::Certificates::PodCertificateRequestList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const PodDisruptionBudget = createResource("K8s::Policy::PodDisruptionBudget", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const PodDisruptionBudgetList = createResource("K8s::Policy::PodDisruptionBudgetList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const PodList = createResource("K8s::Core::PodList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
@@ -153,6 +165,8 @@ export const StatefulSetList = createResource("K8s::Apps::StatefulSetList", "k8s
 export const Status = createResource("K8s::Core::Status", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const StorageClass = createResource("K8s::Storage::StorageClass", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const StorageClassList = createResource("K8s::Storage::StorageClassList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const StorageVersionMigration = createResource("K8s::Storagemigration::StorageVersionMigration", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const StorageVersionMigrationList = createResource("K8s::Storagemigration::StorageVersionMigrationList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const STS = createResource("K8s::Apps::StatefulSet", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const SubjectAccessReview = createResource("K8s::Authorization::SubjectAccessReview", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const TokenRequest = createResource("K8s::Authentication::TokenRequest", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});

package/src/generated/lexicon-k8s.json

@@ -425,6 +425,20 @@
     "apiVersion": "rbac.authorization.k8s.io/v1",
     "gvkKind": "ClusterRoleList"
   },
+  "ClusterTrustBundle": {
+    "resourceType": "K8s::Certificates::ClusterTrustBundle",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "certificates.k8s.io/v1beta1",
+    "gvkKind": "ClusterTrustBundle"
+  },
+  "ClusterTrustBundleList": {
+    "resourceType": "K8s::Certificates::ClusterTrustBundleList",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "certificates.k8s.io/v1beta1",
+    "gvkKind": "ClusterTrustBundleList"
+  },
   "ComponentStatus": {
     "resourceType": "K8s::Core::ComponentStatus",
     "kind": "resource",
@@ -650,16 +664,30 @@
     "resourceType": "K8s::Resource::DeviceClass",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "resource.k8s.io/v1beta1",
+    "apiVersion": "resource.k8s.io/v1",
     "gvkKind": "DeviceClass"
   },
   "DeviceClassList": {
     "resourceType": "K8s::Resource::DeviceClassList",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "resource.k8s.io/v1beta1",
+    "apiVersion": "resource.k8s.io/v1",
     "gvkKind": "DeviceClassList"
   },
+  "DeviceTaintRule": {
+    "resourceType": "K8s::Resource::DeviceTaintRule",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "resource.k8s.io/v1beta2",
+    "gvkKind": "DeviceTaintRule"
+  },
+  "DeviceTaintRuleList": {
+    "resourceType": "K8s::Resource::DeviceTaintRuleList",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "resource.k8s.io/v1beta2",
+    "gvkKind": "DeviceTaintRuleList"
+  },
   "Endpoint": {
     "resourceType": "K8s::Monitoring::ServiceMonitor.endpoints",
     "kind": "property",
@@ -908,14 +936,14 @@
     "resourceType": "K8s::Networking::IPAddress",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "networking.k8s.io/v1beta1",
+    "apiVersion": "networking.k8s.io/v1",
     "gvkKind": "IPAddress"
   },
   "IPAddressList": {
     "resourceType": "K8s::Networking::IPAddressList",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "networking.k8s.io/v1beta1",
+    "apiVersion": "networking.k8s.io/v1",
     "gvkKind": "IPAddressList"
   },
   "IgnoreApplicationDifference": {
@@ -1076,6 +1104,20 @@
     "apiVersion": "coordination.k8s.io/v1",
     "gvkKind": "Lease"
   },
+  "LeaseCandidate": {
+    "resourceType": "K8s::Coordination::LeaseCandidate",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "coordination.k8s.io/v1beta1",
+    "gvkKind": "LeaseCandidate"
+  },
+  "LeaseCandidateList": {
+    "resourceType": "K8s::Coordination::LeaseCandidateList",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "coordination.k8s.io/v1beta1",
+    "gvkKind": "LeaseCandidateList"
+  },
   "LeaseList": {
     "resourceType": "K8s::Coordination::LeaseList",
     "kind": "resource",
@@ -1119,6 +1161,34 @@
     "kind": "property",
     "lexicon": "k8s"
   },
+  "MutatingAdmissionPolicy": {
+    "resourceType": "K8s::Admissionregistration::MutatingAdmissionPolicy",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "admissionregistration.k8s.io/v1",
+    "gvkKind": "MutatingAdmissionPolicy"
+  },
+  "MutatingAdmissionPolicyBinding": {
+    "resourceType": "K8s::Admissionregistration::MutatingAdmissionPolicyBinding",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "admissionregistration.k8s.io/v1",
+    "gvkKind": "MutatingAdmissionPolicyBinding"
+  },
+  "MutatingAdmissionPolicyBindingList": {
+    "resourceType": "K8s::Admissionregistration::MutatingAdmissionPolicyBindingList",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "admissionregistration.k8s.io/v1",
+    "gvkKind": "MutatingAdmissionPolicyBindingList"
+  },
+  "MutatingAdmissionPolicyList": {
+    "resourceType": "K8s::Admissionregistration::MutatingAdmissionPolicyList",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "admissionregistration.k8s.io/v1",
+    "gvkKind": "MutatingAdmissionPolicyList"
+  },
   "MutatingWebhookConfiguration": {
     "resourceType": "K8s::Admissionregistration::MutatingWebhookConfiguration",
     "kind": "resource",
@@ -1340,6 +1410,20 @@
     "apiVersion": "v1",
     "gvkKind": "Pod"
   },
+  "PodCertificateRequest": {
+    "resourceType": "K8s::Certificates::PodCertificateRequest",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "certificates.k8s.io/v1beta1",
+    "gvkKind": "PodCertificateRequest"
+  },
+  "PodCertificateRequestList": {
+    "resourceType": "K8s::Certificates::PodCertificateRequestList",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "certificates.k8s.io/v1beta1",
+    "gvkKind": "PodCertificateRequestList"
+  },
   "PodDisruptionBudget": {
     "resourceType": "K8s::Policy::PodDisruptionBudget",
     "kind": "resource",
@@ -1637,28 +1721,28 @@
     "resourceType": "K8s::Resource::ResourceClaim",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "resource.k8s.io/v1beta1",
+    "apiVersion": "resource.k8s.io/v1",
     "gvkKind": "ResourceClaim"
   },
   "ResourceClaimList": {
     "resourceType": "K8s::Resource::ResourceClaimList",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "resource.k8s.io/v1beta1",
+    "apiVersion": "resource.k8s.io/v1",
     "gvkKind": "ResourceClaimList"
   },
   "ResourceClaimTemplate": {
     "resourceType": "K8s::Resource::ResourceClaimTemplate",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "resource.k8s.io/v1beta1",
+    "apiVersion": "resource.k8s.io/v1",
     "gvkKind": "ResourceClaimTemplate"
   },
   "ResourceClaimTemplateList": {
     "resourceType": "K8s::Resource::ResourceClaimTemplateList",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "resource.k8s.io/v1beta1",
+    "apiVersion": "resource.k8s.io/v1",
     "gvkKind": "ResourceClaimTemplateList"
   },
   "ResourceQuota": {
@@ -1684,14 +1768,14 @@
     "resourceType": "K8s::Resource::ResourceSlice",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "resource.k8s.io/v1beta1",
+    "apiVersion": "resource.k8s.io/v1",
     "gvkKind": "ResourceSlice"
   },
   "ResourceSliceList": {
     "resourceType": "K8s::Resource::ResourceSliceList",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "resource.k8s.io/v1beta1",
+    "apiVersion": "resource.k8s.io/v1",
     "gvkKind": "ResourceSliceList"
   },
   "Resources": {
@@ -1882,14 +1966,14 @@
     "resourceType": "K8s::Networking::ServiceCIDR",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "networking.k8s.io/v1beta1",
+    "apiVersion": "networking.k8s.io/v1",
     "gvkKind": "ServiceCIDR"
   },
   "ServiceCIDRList": {
     "resourceType": "K8s::Networking::ServiceCIDRList",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "networking.k8s.io/v1beta1",
+    "apiVersion": "networking.k8s.io/v1",
     "gvkKind": "ServiceCIDRList"
   },
   "ServiceList": {
@@ -1999,6 +2083,20 @@
     "apiVersion": "storage.k8s.io/v1",
     "gvkKind": "StorageClassList"
   },
+  "StorageVersionMigration": {
+    "resourceType": "K8s::Storagemigration::StorageVersionMigration",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "storagemigration.k8s.io/v1beta1",
+    "gvkKind": "StorageVersionMigration"
+  },
+  "StorageVersionMigrationList": {
+    "resourceType": "K8s::Storagemigration::StorageVersionMigrationList",
+    "kind": "resource",
+    "lexicon": "k8s",
+    "apiVersion": "storagemigration.k8s.io/v1beta1",
+    "gvkKind": "StorageVersionMigrationList"
+  },
   "Strategy": {
     "resourceType": "K8s::Argo::ApplicationSet.strategy",
     "kind": "property",
@@ -2153,14 +2251,14 @@
     "resourceType": "K8s::Storage::VolumeAttributesClass",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "storage.k8s.io/v1beta1",
+    "apiVersion": "storage.k8s.io/v1",
     "gvkKind": "VolumeAttributesClass"
   },
   "VolumeAttributesClassList": {
     "resourceType": "K8s::Storage::VolumeAttributesClassList",
     "kind": "resource",
     "lexicon": "k8s",
-    "apiVersion": "storage.k8s.io/v1beta1",
+    "apiVersion": "storage.k8s.io/v1",
     "gvkKind": "VolumeAttributesClassList"
   },
   "VolumeMount": {

package/src/import/live-export.ts

@@ -1,5 +1,5 @@
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
-import { hasOwnershipMarker } from "@intentius/chant/ownership";
+import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import { K8sParser } from "./parser";
 
 /**
@@ -61,7 +61,7 @@ export function buildExportFromObjects(
     ? objects.filter((o) => {
         if (!isRecord(o)) return false;
         const labels = isRecord(o.metadata) ? (o.metadata.labels as Record<string, unknown>) : undefined;
-        return hasOwnershipMarker(labels, "label");
+        return hasOwnershipMarker(labels, LABEL_OWNERSHIP_KEYS);
       })
     : objects;
 

package/src/lint/audit-catalog.ts

@@ -0,0 +1,37 @@
+/**
+ * The k8s lexicon's chant audit catalog — metadata for its post-synth rules
+ * (WK8 and ARGO Kubernetes-manifest rules). Contributed via k8sPlugin.auditCatalog() (#687).
+ */
+import { auditRule, K8S_PSS, K8S_SECRETS, SCORECARD_PINNED, type RuleMeta } from "@intentius/chant/audit/catalog";
+
+export const k8sAuditCatalog: Record<string, RuleMeta> = {
+  ARGO002: auditRule("ARGO002", "merge-worthy", "guidance", "Argo Application references an undeclared AppProject", "Declare the named AppProject or reference an existing project.", { category: "correctness" }),
+  ARGO003: auditRule("ARGO003", "merge-worthy", "guidance", "Argo Application targets an unregistered cluster", "Point spec.destination at a registered cluster or the in-cluster target.", { category: "correctness" }),
+  ARGO005: auditRule("ARGO005", "report-only", "guidance", "Argo source.path may not resolve", "Ensure the source path exists under the build root.", { category: "best-practice" }),
+  WK8005: auditRule("WK8005", "merge-worthy", "guidance", "Hardcoded secret in env var", "Use a secretKeyRef instead of a literal value, and rotate the secret.", { authority: [K8S_SECRETS] }),
+  WK8006: auditRule("WK8006", "merge-worthy", "guidance", "Image uses :latest or no tag", "Pin the image to an explicit version tag (ideally a digest).", { authority: [SCORECARD_PINNED] }),
+  WK8041: auditRule("WK8041", "merge-worthy", "guidance", "Hardcoded API key in env var", "Move the key to a Secret and rotate it.", { authority: [K8S_SECRETS] }),
+  WK8042: auditRule("WK8042", "merge-worthy", "guidance", "Private key stored in a ConfigMap", "Store private keys in a Secret, not a ConfigMap.", { authority: [K8S_SECRETS] }),
+  WK8101: auditRule("WK8101", "merge-worthy", "guidance", "Deployment selector does not match template labels", "Align spec.selector with the pod template labels.", { category: "best-practice" }),
+  WK8102: auditRule("WK8102", "report-only", "guidance", "Resource missing metadata labels", "Add metadata labels for filtering and tooling.", { category: "best-practice" }),
+  WK8103: auditRule("WK8103", "merge-worthy", "guidance", "Container missing name", "Add the required container `name`.", { category: "best-practice" }),
+  WK8104: auditRule("WK8104", "report-only", "guidance", "Container ports not named", "Name ports for clearer Service/NetworkPolicy config.", { category: "best-practice" }),
+  WK8105: auditRule("WK8105", "report-only", "guidance", "imagePullPolicy not explicit", "Set imagePullPolicy explicitly to avoid surprising defaults.", { category: "best-practice" }),
+  WK8201: auditRule("WK8201", "report-only", "guidance", "Container missing resource limits", "Set CPU and memory limits.", { category: "best-practice" }),
+  WK8202: auditRule("WK8202", "merge-worthy", "guidance", "Privileged container", "Remove privileged: true; grant only the specific capabilities needed.", { authority: [K8S_PSS] }),
+  WK8203: auditRule("WK8203", "merge-worthy", "guidance", "Root filesystem is writable", "Set readOnlyRootFilesystem: true.", { authority: [K8S_PSS] }),
+  WK8204: auditRule("WK8204", "merge-worthy", "guidance", "Container may run as root", "Set runAsNonRoot: true (and a non-zero runAsUser).", { authority: [K8S_PSS] }),
+  WK8205: auditRule("WK8205", "merge-worthy", "guidance", "Capabilities not dropped", "drop: [ALL] and add back only what is required.", { authority: [K8S_PSS] }),
+  WK8207: auditRule("WK8207", "merge-worthy", "guidance", "Pod uses host network", "Remove hostNetwork; it bypasses network isolation.", { authority: [K8S_PSS] }),
+  WK8208: auditRule("WK8208", "merge-worthy", "guidance", "Pod shares host PID namespace", "Remove hostPID.", { authority: [K8S_PSS] }),
+  WK8209: auditRule("WK8209", "merge-worthy", "guidance", "Pod shares host IPC namespace", "Remove hostIPC.", { authority: [K8S_PSS] }),
+  WK8301: auditRule("WK8301", "report-only", "guidance", "Container missing probes", "Add liveness and readiness probes.", { category: "best-practice" }),
+  WK8302: auditRule("WK8302", "report-only", "guidance", "Deployment has a single replica", "Use replicas >= 2 for availability.", { category: "best-practice" }),
+  WK8303: auditRule("WK8303", "report-only", "guidance", "No PodDisruptionBudget for an HA Deployment", "Add a PDB to protect availability during disruptions.", { category: "best-practice" }),
+  WK8304: auditRule("WK8304", "report-only", "guidance", "SSL redirect without a certificate", "Provide a certificate and HTTPS listen-ports for the ssl-redirect annotation.", { category: "best-practice" }),
+  WK8305: auditRule("WK8305", "merge-worthy", "guidance", "Ingress backend port does not match the Service", "Point the Ingress backend at a declared Service port.", { category: "best-practice" }),
+  WK8306: auditRule("WK8306", "merge-worthy", "guidance", "Container command starts with a flag", "The first command element should be a binary, not a flag.", { category: "best-practice" }),
+  WK8401: auditRule("WK8401", "merge-worthy", "guidance", "shmSize exceeds the container memory limit", "Lower shmSize or raise the memory limit so the pod can schedule.", { category: "best-practice" }),
+  WK8402: auditRule("WK8402", "report-only", "guidance", "RayCluster missing spec.rayVersion", "Set spec.rayVersion so KubeRay picks the right autoscaler image.", { category: "best-practice" }),
+  WK8403: auditRule("WK8403", "report-only", "guidance", "rayVersion does not match the head image tag", "Align spec.rayVersion with the Ray version in the head container image.", { category: "best-practice" }),
+};

package/src/plugin.ts

@@ -9,6 +9,7 @@ import type { LexiconPlugin, InitTemplateSet, ResourceMetadata } from "@intentiu
 import { detectTemplate } from "./detect";
 import type { LintRule } from "@intentius/chant/lint/rule";
 import { postSynthChecks as postSynthCheckList } from "./lint/post-synth";
+import { k8sAuditCatalog } from "./lint/audit-catalog";
 import { createSkillsLoader, createDiffTool, createCatalogResource } from "@intentius/chant/lexicon-plugin-helpers";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -25,7 +26,16 @@ import { K8sGenerator } from "./import/generator";
 
 export const k8sPlugin: LexiconPlugin = {
   name: "k8s",
+  auditCatalog: () => k8sAuditCatalog,
   serializer: k8sSerializer,
+  // Self-upgrade: where the pinned Kubernetes schema version lives + its upstream (#685).
+  upstreamPin: {
+    file: "src/spec/fetch.ts",
+    pattern: /export const K8S_SCHEMA_VERSION\s*=\s*"([^"]+)"/,
+    replace: (v, line) =>
+      line.replace(/export const K8S_SCHEMA_VERSION\s*=\s*"[^"]+"/, `export const K8S_SCHEMA_VERSION = "${v}"`),
+    upstream: { owner: "kubernetes", repo: "kubernetes", kind: "releases" },
+  },
 
   lintRules(): LintRule[] {
     return [

package/src/serializer.ts

@@ -9,7 +9,7 @@ import { createRequire } from "module";
 import type { Declarable } from "@intentius/chant/declarable";
 import { isPropertyDeclarable } from "@intentius/chant/declarable";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
-import { ownershipEntries } from "@intentius/chant/ownership";
+import { ownershipEntries, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { emitYAML } from "@intentius/chant/yaml";
@@ -165,7 +165,7 @@ export const k8sSerializer: Serializer = {
     // labels, so they seed defaultLabelEntries and flow through the same merge
     // (explicit resource labels still win).
     let defaultLabelEntries: Record<string, unknown> = context?.ownership
-      ? { ...ownershipEntries("label", context.ownership) }
+      ? { ...ownershipEntries(LABEL_OWNERSHIP_KEYS, context.ownership) }
       : {};
     let defaultAnnotationEntries: Record<string, unknown> = {};
 

package/src/spec/fetch.ts

@@ -10,7 +10,7 @@ import { fetchWithCache, clearCacheFile } from "@intentius/chant/codegen/fetch";
 /**
  * Pinned Kubernetes version for schema download.
  */
-export const K8S_SCHEMA_VERSION = "v1.32.0";
+export const K8S_SCHEMA_VERSION = "v1.36.2";
 
 /**
  * Build the schema URL for a given version.