@intentius/chant-lexicon-k8s 0.14.0 → 0.15.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "26b8bb12ee085aaa99d561185783c554c4d0252043b2d74e6ab0260d763c9fcc",
+    "manifest.json": "f3f247293df83075abe8c0ff4cdb1c11bd004b806e92ca19cd5e817f253670a4",
     "meta.json": "560e496dee251a4fcc249373e50b7f16b5ee563ac8f9c832343a56f62bcfb656",
     "types/index.d.ts": "3cba22f6b907ebcbad3efded303cb21ba82fb5b8ac0ec41883fee6c84f0895ee",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "f0b98d130cf4eec327df59652a0c9bb693cec517cbe6adbc1cab62240419a155"
+  "composite": "f211e5ab09d5481f5268bc65a1960e2da9f81c74136f9b6681a24598305d37b6"
 }

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The k8s lexicon's chant audit catalog — metadata for its post-synth rules
+ * (WK8 and ARGO Kubernetes-manifest rules). Contributed via k8sPlugin.auditCatalog() (#687).
+ */
+import { type RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const k8sAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA8BpD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAkBjG,eAAO,MAAM,SAAS,EAAE,aAwkBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAmBjG,eAAO,MAAM,SAAS,EAAE,aAilBvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -70,6 +70,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.13.1"
+    "@intentius/chant": "^0.15.0"
   }
 }

package/src/describe-resources.ts

@@ -15,7 +15,7 @@
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 import type { ResourceMetadata } from "@intentius/chant/lexicon";
-import { hasOwnershipMarker, classifyOwnership } from "@intentius/chant/ownership";
+import { hasOwnershipMarker, classifyOwnership, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 
 const execAsync = promisify(exec);
 
@@ -109,7 +109,7 @@ export async function describeResources(options: {
       const { stdout } = await execAsync(cmd);
       const obj: KubectlResponse = JSON.parse(stdout);
       // owned filter: skip resources not carrying chant's marker label.
-      if (options.owned && !hasOwnershipMarker(obj.metadata?.labels, "label")) {
+      if (options.owned && !hasOwnershipMarker(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS)) {
         continue;
       }
       result[entityName] = {
@@ -117,7 +117,7 @@ export async function describeResources(options: {
         physicalId: obj.metadata?.uid,
         status: statusFromKubectl(obj),
         lastUpdated: obj.metadata?.creationTimestamp,
-        ownership: classifyOwnership(obj.metadata?.labels, "label"),
+        ownership: classifyOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
         attributes: pruneUndefined({
           namespace: obj.metadata?.namespace,
           labels: obj.metadata?.labels,

package/src/import/live-export.ts

@@ -1,5 +1,5 @@
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
-import { hasOwnershipMarker } from "@intentius/chant/ownership";
+import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import { K8sParser } from "./parser";
 
 /**
@@ -61,7 +61,7 @@ export function buildExportFromObjects(
     ? objects.filter((o) => {
         if (!isRecord(o)) return false;
         const labels = isRecord(o.metadata) ? (o.metadata.labels as Record<string, unknown>) : undefined;
-        return hasOwnershipMarker(labels, "label");
+        return hasOwnershipMarker(labels, LABEL_OWNERSHIP_KEYS);
       })
     : objects;
 

package/src/lint/audit-catalog.ts

@@ -0,0 +1,37 @@
+/**
+ * The k8s lexicon's chant audit catalog — metadata for its post-synth rules
+ * (WK8 and ARGO Kubernetes-manifest rules). Contributed via k8sPlugin.auditCatalog() (#687).
+ */
+import { auditRule, K8S_PSS, K8S_SECRETS, SCORECARD_PINNED, type RuleMeta } from "@intentius/chant/audit/catalog";
+
+export const k8sAuditCatalog: Record<string, RuleMeta> = {
+  ARGO002: auditRule("ARGO002", "merge-worthy", "guidance", "Argo Application references an undeclared AppProject", "Declare the named AppProject or reference an existing project.", { category: "correctness" }),
+  ARGO003: auditRule("ARGO003", "merge-worthy", "guidance", "Argo Application targets an unregistered cluster", "Point spec.destination at a registered cluster or the in-cluster target.", { category: "correctness" }),
+  ARGO005: auditRule("ARGO005", "report-only", "guidance", "Argo source.path may not resolve", "Ensure the source path exists under the build root.", { category: "best-practice" }),
+  WK8005: auditRule("WK8005", "merge-worthy", "guidance", "Hardcoded secret in env var", "Use a secretKeyRef instead of a literal value, and rotate the secret.", { authority: [K8S_SECRETS] }),
+  WK8006: auditRule("WK8006", "merge-worthy", "guidance", "Image uses :latest or no tag", "Pin the image to an explicit version tag (ideally a digest).", { authority: [SCORECARD_PINNED] }),
+  WK8041: auditRule("WK8041", "merge-worthy", "guidance", "Hardcoded API key in env var", "Move the key to a Secret and rotate it.", { authority: [K8S_SECRETS] }),
+  WK8042: auditRule("WK8042", "merge-worthy", "guidance", "Private key stored in a ConfigMap", "Store private keys in a Secret, not a ConfigMap.", { authority: [K8S_SECRETS] }),
+  WK8101: auditRule("WK8101", "merge-worthy", "guidance", "Deployment selector does not match template labels", "Align spec.selector with the pod template labels.", { category: "best-practice" }),
+  WK8102: auditRule("WK8102", "report-only", "guidance", "Resource missing metadata labels", "Add metadata labels for filtering and tooling.", { category: "best-practice" }),
+  WK8103: auditRule("WK8103", "merge-worthy", "guidance", "Container missing name", "Add the required container `name`.", { category: "best-practice" }),
+  WK8104: auditRule("WK8104", "report-only", "guidance", "Container ports not named", "Name ports for clearer Service/NetworkPolicy config.", { category: "best-practice" }),
+  WK8105: auditRule("WK8105", "report-only", "guidance", "imagePullPolicy not explicit", "Set imagePullPolicy explicitly to avoid surprising defaults.", { category: "best-practice" }),
+  WK8201: auditRule("WK8201", "report-only", "guidance", "Container missing resource limits", "Set CPU and memory limits.", { category: "best-practice" }),
+  WK8202: auditRule("WK8202", "merge-worthy", "guidance", "Privileged container", "Remove privileged: true; grant only the specific capabilities needed.", { authority: [K8S_PSS] }),
+  WK8203: auditRule("WK8203", "merge-worthy", "guidance", "Root filesystem is writable", "Set readOnlyRootFilesystem: true.", { authority: [K8S_PSS] }),
+  WK8204: auditRule("WK8204", "merge-worthy", "guidance", "Container may run as root", "Set runAsNonRoot: true (and a non-zero runAsUser).", { authority: [K8S_PSS] }),
+  WK8205: auditRule("WK8205", "merge-worthy", "guidance", "Capabilities not dropped", "drop: [ALL] and add back only what is required.", { authority: [K8S_PSS] }),
+  WK8207: auditRule("WK8207", "merge-worthy", "guidance", "Pod uses host network", "Remove hostNetwork; it bypasses network isolation.", { authority: [K8S_PSS] }),
+  WK8208: auditRule("WK8208", "merge-worthy", "guidance", "Pod shares host PID namespace", "Remove hostPID.", { authority: [K8S_PSS] }),
+  WK8209: auditRule("WK8209", "merge-worthy", "guidance", "Pod shares host IPC namespace", "Remove hostIPC.", { authority: [K8S_PSS] }),
+  WK8301: auditRule("WK8301", "report-only", "guidance", "Container missing probes", "Add liveness and readiness probes.", { category: "best-practice" }),
+  WK8302: auditRule("WK8302", "report-only", "guidance", "Deployment has a single replica", "Use replicas >= 2 for availability.", { category: "best-practice" }),
+  WK8303: auditRule("WK8303", "report-only", "guidance", "No PodDisruptionBudget for an HA Deployment", "Add a PDB to protect availability during disruptions.", { category: "best-practice" }),
+  WK8304: auditRule("WK8304", "report-only", "guidance", "SSL redirect without a certificate", "Provide a certificate and HTTPS listen-ports for the ssl-redirect annotation.", { category: "best-practice" }),
+  WK8305: auditRule("WK8305", "merge-worthy", "guidance", "Ingress backend port does not match the Service", "Point the Ingress backend at a declared Service port.", { category: "best-practice" }),
+  WK8306: auditRule("WK8306", "merge-worthy", "guidance", "Container command starts with a flag", "The first command element should be a binary, not a flag.", { category: "best-practice" }),
+  WK8401: auditRule("WK8401", "merge-worthy", "guidance", "shmSize exceeds the container memory limit", "Lower shmSize or raise the memory limit so the pod can schedule.", { category: "best-practice" }),
+  WK8402: auditRule("WK8402", "report-only", "guidance", "RayCluster missing spec.rayVersion", "Set spec.rayVersion so KubeRay picks the right autoscaler image.", { category: "best-practice" }),
+  WK8403: auditRule("WK8403", "report-only", "guidance", "rayVersion does not match the head image tag", "Align spec.rayVersion with the Ray version in the head container image.", { category: "best-practice" }),
+};

package/src/plugin.ts

@@ -9,6 +9,7 @@ import type { LexiconPlugin, InitTemplateSet, ResourceMetadata } from "@intentiu
 import { detectTemplate } from "./detect";
 import type { LintRule } from "@intentius/chant/lint/rule";
 import { postSynthChecks as postSynthCheckList } from "./lint/post-synth";
+import { k8sAuditCatalog } from "./lint/audit-catalog";
 import { createSkillsLoader, createDiffTool, createCatalogResource } from "@intentius/chant/lexicon-plugin-helpers";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -25,7 +26,16 @@ import { K8sGenerator } from "./import/generator";
 
 export const k8sPlugin: LexiconPlugin = {
   name: "k8s",
+  auditCatalog: () => k8sAuditCatalog,
   serializer: k8sSerializer,
+  // Self-upgrade: where the pinned Kubernetes schema version lives + its upstream (#685).
+  upstreamPin: {
+    file: "src/spec/fetch.ts",
+    pattern: /export const K8S_SCHEMA_VERSION\s*=\s*"([^"]+)"/,
+    replace: (v, line) =>
+      line.replace(/export const K8S_SCHEMA_VERSION\s*=\s*"[^"]+"/, `export const K8S_SCHEMA_VERSION = "${v}"`),
+    upstream: { owner: "kubernetes", repo: "kubernetes", kind: "releases" },
+  },
 
   lintRules(): LintRule[] {
     return [

package/src/serializer.ts

@@ -9,7 +9,7 @@ import { createRequire } from "module";
 import type { Declarable } from "@intentius/chant/declarable";
 import { isPropertyDeclarable } from "@intentius/chant/declarable";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
-import { ownershipEntries } from "@intentius/chant/ownership";
+import { ownershipEntries, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { emitYAML } from "@intentius/chant/yaml";
@@ -165,7 +165,7 @@ export const k8sSerializer: Serializer = {
     // labels, so they seed defaultLabelEntries and flow through the same merge
     // (explicit resource labels still win).
     let defaultLabelEntries: Record<string, unknown> = context?.ownership
-      ? { ...ownershipEntries("label", context.ownership) }
+      ? { ...ownershipEntries(LABEL_OWNERSHIP_KEYS, context.ownership) }
       : {};
     let defaultAnnotationEntries: Record<string, unknown> = {};