@intentius/chant-lexicon-k8s 0.37.2 → 0.38.0

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAsBjG,eAAO,MAAM,SAAS,EAAE,aA2mBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAuBjG,eAAO,MAAM,SAAS,EAAE,aA4mBvB,CAAC"}

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA2IlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA2I3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA2IlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA+I3B,CAAC"}

package/dist/types/index.d.ts

@@ -128,6 +128,20 @@ export declare class AppProject {
   readonly uid: string;
 }
 
+export declare class Backup {
+  constructor(props: {
+    /** Specification of the desired behavior of the backup.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class BatchJob {
   constructor(props: {
     /** Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata */
@@ -228,6 +242,20 @@ export declare class Challenge {
   readonly uid: string;
 }
 
+export declare class Cluster {
+  constructor(props: {
+    /** Specification of the desired behavior of the cluster.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class ClusterIssuer {
   constructor(props: {
     /** Desired state of the ClusterIssuer resource. */
@@ -1101,6 +1129,45 @@ export declare class ImageUpdateAutomation {
   readonly uid: string;
 }
 
+export declare class InfisicalDynamicSecret {
+  constructor(props: {
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+    /** InfisicalDynamicSecretSpec defines the desired state of InfisicalDynamicSecret. */
+    spec?: Record<string, unknown>;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
+export declare class InfisicalPushSecret {
+  constructor(props: {
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+    /** InfisicalPushSecretSpec defines the desired state of InfisicalPushSecret */
+    spec?: Record<string, unknown>;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
+export declare class InfisicalSecret {
+  constructor(props: {
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+    /** InfisicalSecretSpec defines the desired state of InfisicalSecret */
+    spec?: Record<string, unknown>;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class Ing {
   constructor(props: {
     /** Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata */
@@ -1161,6 +1228,42 @@ export declare class IngressList {
   readonly uid: string;
 }
 
+export declare class IngressRoute {
+  constructor(props: {
+    /** IngressRouteSpec defines the desired state of IngressRoute. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class IngressRouteTCP {
+  constructor(props: {
+    /** IngressRouteTCPSpec defines the desired state of IngressRouteTCP. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class IngressRouteUDP {
+  constructor(props: {
+    /** IngressRouteUDPSpec defines the desired state of a IngressRouteUDP. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class IPAddress {
   constructor(props: {
     /** spec is the desired state of the IPAddress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
@@ -1379,6 +1482,30 @@ export declare class MicroVMReplicaSet {
   readonly uid: string;
 }
 
+export declare class Middleware {
+  constructor(props: {
+    /** MiddlewareSpec defines the desired state of a Middleware. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class MiddlewareTCP {
+  constructor(props: {
+    /** MiddlewareTCPSpec defines the desired state of a MiddlewareTCP. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class MutatingAdmissionPolicy {
   constructor(props: {
     /** metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata. */
@@ -1547,6 +1674,20 @@ export declare class NS {
   readonly uid: string;
 }
 
+export declare class ObjectStore {
+  constructor(props: {
+    /** Specification of the desired behavior of the ObjectStore.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class OCIRepository {
   constructor(props: {
     /** Standard object's metadata. */
@@ -1728,6 +1869,20 @@ export declare class PodTemplateList {
   readonly uid: string;
 }
 
+export declare class Pooler {
+  constructor(props: {
+    /** Specification of the desired behavior of the Pooler.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class PriorityClass {
   constructor(props: {
     /** description is an arbitrary string that usually provides guidelines on when this priority class should be used. */
@@ -2172,6 +2327,20 @@ export declare class Scale {
   readonly uid: string;
 }
 
+export declare class ScheduledBackup {
+  constructor(props: {
+    /** Specification of the desired behavior of the ScheduledBackup.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class Sec {
   constructor(props: {
     /** Data contains the secret data. Each key must consist of alphanumeric characters, '-', '_' or '.'. The serialized form of the secret data is a base64 encoded string, representing the arbitrary (possibly non-string) data value here. Described in https://tools.ietf.org/html/rfc4648#section-4 */
@@ -2254,6 +2423,30 @@ export declare class SelfSubjectRulesReview {
   readonly uid: string;
 }
 
+export declare class ServersTransport {
+  constructor(props: {
+    /** ServersTransportSpec defines the desired state of a ServersTransport. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class ServersTransportTCP {
+  constructor(props: {
+    /** ServersTransportTCPSpec defines the desired state of a ServersTransportTCP. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class Service {
   constructor(props: {
     /** Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata */
@@ -2469,6 +2662,30 @@ export declare class SubjectAccessReview {
   readonly uid: string;
 }
 
+export declare class TLSOption {
+  constructor(props: {
+    /** TLSOptionSpec defines the desired state of a TLSOption. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class TLSStore {
+  constructor(props: {
+    /** TLSStoreSpec defines the desired state of a TLSStore. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class TokenRequest {
   constructor(props: {
     /** metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata */
@@ -2493,6 +2710,18 @@ export declare class TokenReview {
   readonly uid: string;
 }
 
+export declare class TraefikService {
+  constructor(props: {
+    /** TraefikServiceSpec defines the desired state of a TraefikService. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class ValidatingAdmissionPolicy {
   constructor(props: {
     /** metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.37.2",
+  "version": "0.38.0",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -78,7 +78,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.37.2",
+    "@intentius/chant": "^0.38.0",
     "typescript": "^5.9.3"
   }
 }

package/src/crd/cnpg.test.ts

@@ -0,0 +1,186 @@
+/**
+ * CNPG acceptance test.
+ *
+ * The bar set by #1319 is that fountain's real `k8s/` overlay — postgres.yaml,
+ * scheduledbackup.yaml, objectstore.yaml — is reproducible from typed chant
+ * source. So these assertions are transcribed from that overlay rather than
+ * from a fixture invented to pass, and every value here is one a running
+ * cluster has.
+ */
+
+import { describe, test, expect } from "vitest";
+import { Cluster, ScheduledBackup, ObjectStore } from "../generated";
+import { k8sSerializer } from "../serializer";
+import { parseYAML } from "@intentius/chant/yaml";
+
+/** Serialize one declaration the way `chant build` would, and read it back. */
+function synth(logicalName: string, resource: unknown): any {
+  const yaml = k8sSerializer.serialize(new Map([[logicalName, resource as never]]));
+  return parseYAML(yaml);
+}
+
+describe("CNPG Cluster", () => {
+  const cluster = new Cluster({
+    metadata: { name: "fountain-pg", namespace: "fountain", labels: { app: "fountain" } },
+    spec: {
+      instances: 1,
+      imageName: "ghcr.io/cloudnative-pg/postgresql:18.4-standard-trixie",
+      plugins: [
+        {
+          name: "barman-cloud.cloudnative-pg.io",
+          isWALArchiver: true,
+          parameters: { barmanObjectName: "fountain-backups" },
+        },
+      ],
+      bootstrap: {
+        initdb: {
+          database: "fountain",
+          owner: "fountain",
+          postInitTemplateSQL: ["CREATE EXTENSION IF NOT EXISTS vector;"],
+        },
+      },
+      storage: { storageClass: "longhorn", size: "10Gi" },
+      resources: {
+        requests: { cpu: "100m", memory: "512Mi" },
+        limits: { memory: "1Gi" },
+      },
+    },
+  });
+
+  test("carries the CNPG apiVersion and kind", () => {
+    const doc = synth("fountainPg", cluster);
+    expect(doc.apiVersion).toBe("postgresql.cnpg.io/v1");
+    expect(doc.kind).toBe("Cluster");
+    expect(doc.metadata.name).toBe("fountain-pg");
+    expect(doc.metadata.namespace).toBe("fountain");
+  });
+
+  test("reproduces fountain's postgres.yaml spec", () => {
+    const { spec } = synth("fountainPg", cluster);
+    expect(spec.instances).toBe(1);
+    expect(spec.imageName).toBe("ghcr.io/cloudnative-pg/postgresql:18.4-standard-trixie");
+    expect(spec.storage).toEqual({ storageClass: "longhorn", size: "10Gi" });
+    expect(spec.bootstrap.initdb.database).toBe("fountain");
+    expect(spec.bootstrap.initdb.owner).toBe("fountain");
+    expect(spec.bootstrap.initdb.postInitTemplateSQL).toEqual([
+      "CREATE EXTENSION IF NOT EXISTS vector;",
+    ]);
+    // A memory limit with no CPU limit is deliberate upstream: a CPU limit
+    // throttles a database. It has to survive serialization as written.
+    expect(spec.resources).toEqual({
+      requests: { cpu: "100m", memory: "512Mi" },
+      limits: { memory: "1Gi" },
+    });
+  });
+
+  test("wires WAL archiving to the ObjectStore by name", () => {
+    const { spec } = synth("fountainPg", cluster);
+    // This block is the whole link between the two CRDs. `isWALArchiver` must
+    // stay a boolean -- quoted, the plugin ignores it and archiving is silently
+    // off, which looks exactly like a healthy cluster until a restore.
+    expect(spec.plugins).toEqual([
+      {
+        name: "barman-cloud.cloudnative-pg.io",
+        isWALArchiver: true,
+        parameters: { barmanObjectName: "fountain-backups" },
+      },
+    ]);
+    expect(typeof spec.plugins[0].isWALArchiver).toBe("boolean");
+  });
+});
+
+describe("CNPG ScheduledBackup", () => {
+  const backup = new ScheduledBackup({
+    metadata: { name: "fountain-pg-base", namespace: "fountain", labels: { app: "fountain" } },
+    spec: {
+      schedule: "0 47 2 * * *",
+      backupOwnerReference: "self",
+      cluster: { name: "fountain-pg" },
+      method: "plugin",
+      pluginConfiguration: { name: "barman-cloud.cloudnative-pg.io" },
+    },
+  });
+
+  test("reproduces fountain's scheduledbackup.yaml", () => {
+    const doc = synth("fountainPgBase", backup);
+    expect(doc.apiVersion).toBe("postgresql.cnpg.io/v1");
+    expect(doc.kind).toBe("ScheduledBackup");
+    expect(doc.spec.backupOwnerReference).toBe("self");
+    expect(doc.spec.cluster).toEqual({ name: "fountain-pg" });
+    expect(doc.spec.method).toBe("plugin");
+    expect(doc.spec.pluginConfiguration).toEqual({ name: "barman-cloud.cloudnative-pg.io" });
+  });
+
+  test("round-trips a six-field schedule", () => {
+    const { spec } = synth("fountainPgBase", backup);
+    // CNPG schedules lead with seconds, so this is six fields where a
+    // Kubernetes CronJob takes five. The schema types it as a plain string, so
+    // nothing here or upstream rejects the five-field form -- it just means a
+    // different time. The count is the only thing that catches it.
+    expect(spec.schedule).toBe("0 47 2 * * *");
+    expect(spec.schedule.trim().split(/\s+/)).toHaveLength(6);
+  });
+});
+
+describe("barman-cloud ObjectStore", () => {
+  const store = new ObjectStore({
+    metadata: { name: "fountain-backups", namespace: "fountain", labels: { app: "fountain" } },
+    spec: {
+      retentionPolicy: "14d",
+      configuration: {
+        destinationPath: "s3://fountain-backups/barman",
+        endpointURL: "http://s3.garage.svc.cluster.local:3900",
+        s3Credentials: {
+          accessKeyId: { name: "fountain-backup-s3-credentials", key: "AWS_ACCESS_KEY_ID" },
+          secretAccessKey: { name: "fountain-backup-s3-credentials", key: "AWS_SECRET_ACCESS_KEY" },
+        },
+        wal: { compression: "gzip" },
+        data: { compression: "gzip" },
+      },
+    },
+  });
+
+  test("reproduces fountain's objectstore.yaml", () => {
+    const doc = synth("fountainBackups", store);
+    // Its own group, mapped onto the same `Cnpg` namespace as the Cluster.
+    expect(doc.apiVersion).toBe("barmancloud.cnpg.io/v1");
+    expect(doc.kind).toBe("ObjectStore");
+    expect(doc.spec.retentionPolicy).toBe("14d");
+    expect(doc.spec.configuration.destinationPath).toBe("s3://fountain-backups/barman");
+    expect(doc.spec.configuration.endpointURL).toBe("http://s3.garage.svc.cluster.local:3900");
+    expect(doc.spec.configuration.wal).toEqual({ compression: "gzip" });
+    expect(doc.spec.configuration.data).toEqual({ compression: "gzip" });
+  });
+
+  test("keeps credentials as secret references, never values", () => {
+    const { spec } = synth("fountainBackups", store);
+    expect(spec.configuration.s3Credentials).toEqual({
+      accessKeyId: { name: "fountain-backup-s3-credentials", key: "AWS_ACCESS_KEY_ID" },
+      secretAccessKey: { name: "fountain-backup-s3-credentials", key: "AWS_SECRET_ACCESS_KEY" },
+    });
+  });
+
+  test("the Cluster's barmanObjectName matches this store's name", () => {
+    // The two CRDs are joined by a string. Nothing upstream checks it: a typo
+    // leaves the cluster running with archiving pointed at a store that does
+    // not exist.
+    const clusterDoc = synth(
+      "fountainPg",
+      new Cluster({
+        metadata: { name: "fountain-pg", namespace: "fountain" },
+        spec: {
+          instances: 1,
+          plugins: [
+            {
+              name: "barman-cloud.cloudnative-pg.io",
+              isWALArchiver: true,
+              parameters: { barmanObjectName: "fountain-backups" },
+            },
+          ],
+        },
+      }),
+    );
+    const storeDoc = synth("fountainBackups", store);
+    expect(clusterDoc.spec.plugins[0].parameters.barmanObjectName).toBe(storeDoc.metadata.name);
+  });
+});

package/src/crd/crd-sources.ts

@@ -93,6 +93,111 @@ const COCKROACH_OPERATOR_CRD_BASE = `https://raw.githubusercontent.com/cockroach
 const CERT_MANAGER_VERSION = "v1.16.2";
 const CERT_MANAGER_CRD_BUNDLE = `https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.crds.yaml`;
 
+/**
+ * CloudNativePG CRDs — postgresql.cnpg.io/v1
+ *
+ * The Postgres operator. Produces, under the `Cnpg` namespace (both groups are
+ * mapped there explicitly in parser.ts; the first-segment rule would otherwise
+ * split them into `Postgresql` and `Barmancloud`):
+ *   K8s::Cnpg::Cluster          → postgresql.cnpg.io/v1
+ *   K8s::Cnpg::ScheduledBackup  → postgresql.cnpg.io/v1
+ *   K8s::Cnpg::Backup           → postgresql.cnpg.io/v1
+ *   K8s::Cnpg::Pooler           → postgresql.cnpg.io/v1
+ *
+ * Pinned to 1.29.1 rather than latest (1.30.0) because that is the operator a
+ * real consumer runs — BinaryBourbon/fountain's k8s overlay.
+ *
+ * Note on ScheduledBackup.schedule: it is a **six**-field cron with leading
+ * seconds, not the five-field form Kubernetes CronJob takes. The schema types
+ * it as a plain string, so a five-field value passes every check here and
+ * silently means something else on the cluster.
+ *
+ * Database, Publication and Subscription are deliberately left out — no known
+ * consumer needs them, and pulling a whole provider is what the note at the top
+ * of this file warns against.
+ *
+ * Operator install: kubectl apply --server-side -f
+ *   https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.29/releases/cnpg-1.29.1.yaml
+ */
+const CNPG_VERSION = "v1.29.1";
+const CNPG_CRD_BASE = `https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/${CNPG_VERSION}/config/crd/bases`;
+
+/**
+ * barman-cloud plugin CRD — barmancloud.cnpg.io/v1
+ *
+ * CNPG's WAL archiving / object-storage backend, shipped as a separate plugin
+ * with its own release train. Produces:
+ *   K8s::Cnpg::ObjectStore  → barmancloud.cnpg.io/v1
+ *
+ * A CNPG Cluster reaches it through `spec.plugins[]` — `name:
+ * barman-cloud.cloudnative-pg.io`, `isWALArchiver: true`,
+ * `parameters.barmanObjectName` naming the ObjectStore — so the two are only
+ * ever useful together.
+ *
+ * Pinned to 0.14.0 (latest). Its ObjectStore schema is a superset of 0.7.0's:
+ * same four spec properties, more detail inside them.
+ *
+ * Plugin install: kubectl apply -f
+ *   https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.14.0/manifest.yaml
+ */
+const BARMAN_PLUGIN_VERSION = "v0.14.0";
+const BARMAN_PLUGIN_CRD_BASE = `https://raw.githubusercontent.com/cloudnative-pg/plugin-barman-cloud/${BARMAN_PLUGIN_VERSION}/config/crd/bases`;
+/**
+ * Traefik proxy CRDs — traefik.io/v1alpha1
+ *
+ * Traefik's own routing surface. An `IngressRoute` is not a
+ * `networking.k8s.io` Ingress with annotations — it is a distinct CRD with its
+ * own matcher grammar, so an estate fronted by Traefik has no expressible edge
+ * without these. Produces, under the `Traefik` namespace (first-segment rule,
+ * no override needed):
+ *   K8s::Traefik::IngressRoute          K8s::Traefik::Middleware
+ *   K8s::Traefik::IngressRouteTCP       K8s::Traefik::MiddlewareTCP
+ *   K8s::Traefik::IngressRouteUDP       K8s::Traefik::ServersTransport
+ *   K8s::Traefik::TLSOption             K8s::Traefik::ServersTransportTCP
+ *   K8s::Traefik::TLSStore              K8s::Traefik::TraefikService
+ *
+ * Only the `traefik.io` group. The chart's crds/ directory also ships
+ * `hub.traefik.io_*` (Traefik Hub, a different commercial product, ~12 kinds,
+ * no known consumer) and a vendored copy of the Gateway API, which is already
+ * generated here from its upstream repo and would collide.
+ *
+ * Version footgun: the pin below is the **chart** version, and the chart
+ * version is not the Traefik version. Chart v41.1.0 ships Traefik v3.7.9.
+ * When bumping, record both.
+ *
+ * Controller install: helm repo add traefik https://traefik.github.io/charts
+ *   && helm install traefik traefik/traefik --version 41.1.0
+ */
+const TRAEFIK_CHART_VERSION = "v41.1.0";
+const TRAEFIK_CRD_BASE = `https://raw.githubusercontent.com/traefik/traefik-helm-chart/${TRAEFIK_CHART_VERSION}/traefik/crds`;
+/**
+ * Infisical operator CRDs — secrets.infisical.com/v1alpha1
+ *
+ * The declarative form of chant's own secrets boundary. An `InfisicalSecret`
+ * says where a secret comes from and who may fetch it; it never carries a
+ * value. Without it an estate can declare the Deployment that consumes a
+ * Secret but not the thing that makes the Secret exist. Produces, under the
+ * `Infisical` namespace:
+ *   K8s::Infisical::InfisicalSecret
+ *   K8s::Infisical::InfisicalPushSecret
+ *   K8s::Infisical::InfisicalDynamicSecret
+ *
+ * The group is overridden to `Infisical` in parser.ts. The first-segment rule
+ * would give `K8s::Secrets::InfisicalSecret`, which reads like a core Secret
+ * next to the `K8s::Core::Secret` that already exists.
+ *
+ * Two things about the URL, both easy to lose an hour to:
+ *   - The operator lives in its own repo, `Infisical/kubernetes-operator`.
+ *     The path under the `Infisical/infisical` monorepo 404s.
+ *   - The tag is path-shaped — `infisical-k8-operator/v0.11.7`. Not a typo,
+ *     and not a directory.
+ *
+ * Operator install: helm repo add infisical https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
+ *   && helm install infisical-secrets-operator infisical/secrets-operator
+ */
+const INFISICAL_OPERATOR_VERSION = "infisical-k8-operator/v0.11.7";
+const INFISICAL_CRD_BASE = `https://raw.githubusercontent.com/Infisical/kubernetes-operator/${INFISICAL_OPERATOR_VERSION}/config/crd/bases`;
+
 /**
  * Prometheus Operator CRDs — monitoring.coreos.com/v1
  *
@@ -188,6 +293,24 @@ export const CRD_SOURCES: CRDSource[] = [
   { type: "url", url: CERT_MANAGER_CRD_BUNDLE },
   { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_servicemonitors.yaml` },
   { type: "url", url: `${PROM_OPERATOR_CRD_BASE}/monitoring.coreos.com_prometheusrules.yaml` },
+  { type: "url", url: `${CNPG_CRD_BASE}/postgresql.cnpg.io_clusters.yaml` },
+  { type: "url", url: `${CNPG_CRD_BASE}/postgresql.cnpg.io_scheduledbackups.yaml` },
+  { type: "url", url: `${CNPG_CRD_BASE}/postgresql.cnpg.io_backups.yaml` },
+  { type: "url", url: `${CNPG_CRD_BASE}/postgresql.cnpg.io_poolers.yaml` },
+  { type: "url", url: `${BARMAN_PLUGIN_CRD_BASE}/barmancloud.cnpg.io_objectstores.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_ingressroutes.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_ingressroutetcps.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_ingressrouteudps.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_middlewares.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_middlewaretcps.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_serverstransports.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_serverstransporttcps.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_tlsoptions.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_tlsstores.yaml` },
+  { type: "url", url: `${TRAEFIK_CRD_BASE}/traefik.io_traefikservices.yaml` },
+  { type: "url", url: `${INFISICAL_CRD_BASE}/secrets.infisical.com_infisicalsecrets.yaml` },
+  { type: "url", url: `${INFISICAL_CRD_BASE}/secrets.infisical.com_infisicalpushsecrets.yaml` },
+  { type: "url", url: `${INFISICAL_CRD_BASE}/secrets.infisical.com_infisicaldynamicsecrets.yaml` },
   {
     type: "url",
     url: FLUX_TOOLKIT_INSTALL,