@intentius/chant-lexicon-k8s 0.37.2 → 0.38.0

package/src/crd/infisical.test.ts

@@ -0,0 +1,100 @@
+/**
+ * Infisical acceptance test.
+ *
+ * Transcribed from fountain's `k8s/infisicalsecret.yaml`. Every field in that
+ * manifest is policy — where the secret comes from, who may fetch it, what
+ * happens to the materialized Secret when the CR goes away. None of it is a
+ * value, which is why this kind is expressible in chant at all.
+ */
+
+import { describe, test, expect } from "vitest";
+import { InfisicalSecret } from "../generated";
+import { k8sSerializer } from "../serializer";
+import { parseYAML } from "@intentius/chant/yaml";
+
+function synth(logicalName: string, resource: unknown): any {
+  const yaml = k8sSerializer.serialize(new Map([[logicalName, resource as never]]));
+  return parseYAML(yaml);
+}
+
+const fountainSecrets = new InfisicalSecret({
+  metadata: { name: "fountain-secrets", namespace: "fountain", labels: { app: "fountain" } },
+  spec: {
+    hostAPI: "http://infisical.infisical.svc.cluster.local:8080",
+    resyncInterval: 60,
+    authentication: {
+      kubernetesAuth: {
+        identityId: "6ccf748c-7fe1-4584-a206-b0a56d84530c",
+        autoCreateServiceAccountToken: true,
+        serviceAccountRef: { name: "fountain-infisical", namespace: "fountain" },
+        secretsScope: { projectSlug: "fountain-q-cwt", envSlug: "prod", secretsPath: "/" },
+      },
+    },
+    managedSecretReference: {
+      secretName: "fountain-secrets",
+      secretNamespace: "fountain",
+      creationPolicy: "Orphan",
+    },
+  },
+});
+
+describe("InfisicalSecret", () => {
+  test("carries the Infisical apiVersion and kind", () => {
+    const doc = synth("fountainSecrets", fountainSecrets);
+    expect(doc.apiVersion).toBe("secrets.infisical.com/v1alpha1");
+    expect(doc.kind).toBe("InfisicalSecret");
+    expect(doc.metadata.name).toBe("fountain-secrets");
+  });
+
+  test("reproduces fountain's infisicalsecret.yaml", () => {
+    const { spec } = synth("fountainSecrets", fountainSecrets);
+    expect(spec.hostAPI).toBe("http://infisical.infisical.svc.cluster.local:8080");
+    expect(spec.resyncInterval).toBe(60);
+    expect(spec.managedSecretReference).toEqual({
+      secretName: "fountain-secrets",
+      secretNamespace: "fountain",
+      creationPolicy: "Orphan",
+    });
+  });
+
+  test("serializes the whole kubernetesAuth block", () => {
+    const { spec } = synth("fountainSecrets", fountainSecrets);
+    // Kubernetes-native auth: the point is that no credential is stored
+    // anywhere. The operator presents a ServiceAccount token instead, so
+    // dropping any part of this block is what turns the deployment back into
+    // one that needs a secret to fetch its secrets.
+    expect(spec.authentication.kubernetesAuth).toEqual({
+      identityId: "6ccf748c-7fe1-4584-a206-b0a56d84530c",
+      autoCreateServiceAccountToken: true,
+      serviceAccountRef: { name: "fountain-infisical", namespace: "fountain" },
+      secretsScope: { projectSlug: "fountain-q-cwt", envSlug: "prod", secretsPath: "/" },
+    });
+  });
+
+  test("declares a source and never a value", () => {
+    // The reason this CRD fits chant at all: synthesis resolves nothing here.
+    // If a secret value could reach the manifest, the manifest would stop
+    // being safe to commit -- so assert on the serialized text, not the props.
+    const yaml = k8sSerializer.serialize(
+      new Map([["fountainSecrets", fountainSecrets as never]]),
+    );
+    expect(yaml).not.toMatch(/\bvalue\s*:/);
+    expect(yaml).not.toMatch(/\bdata\s*:/);
+    expect(yaml).not.toMatch(/\bstringData\s*:/);
+  });
+
+  test("keeps resyncInterval a number", () => {
+    const { spec } = synth("fountainSecrets", fountainSecrets);
+    // Quoted, the operator rejects the CR rather than defaulting -- worth
+    // pinning because seconds-as-a-string is a habit from other tools.
+    expect(typeof spec.resyncInterval).toBe("number");
+  });
+
+  test("creationPolicy Orphan survives, since the two policies differ on deletion", () => {
+    const { spec } = synth("fountainSecrets", fountainSecrets);
+    // Orphan leaves the materialized Secret behind when the CR is deleted;
+    // Owner takes it with it. Silently flipping to the default would make CR
+    // deletion destructive.
+    expect(spec.managedSecretReference.creationPolicy).toBe("Orphan");
+  });
+});

package/src/crd/parser.ts

@@ -44,6 +44,14 @@ const GROUP_NAMESPACE_OVERRIDES: Record<string, string> = {
   "image.toolkit.fluxcd.io": "Flux",
   "fluxcd.controlplane.io": "Flux",
   "lambda.aws.amazon.com": "KubeMicroVM",
+  // CNPG and its barman-cloud plugin ship under two groups but are one thing to
+  // an author: a Cluster's `plugins[]` names an ObjectStore. The first-segment
+  // rule would scatter them into `Postgresql` and `Barmancloud`.
+  "postgresql.cnpg.io": "Cnpg",
+  "barmancloud.cnpg.io": "Cnpg",
+  // Not `Secrets`: `K8s::Secrets::InfisicalSecret` reads like a core Secret,
+  // and `K8s::Core::Secret` is right there to be confused with.
+  "secrets.infisical.com": "Infisical",
 };
 
 /**

package/src/crd/traefik.test.ts

@@ -0,0 +1,108 @@
+/**
+ * Traefik acceptance test.
+ *
+ * Transcribed from fountain's `k8s/ingressroute.yaml` — the websecure route
+ * with `tls.secretName`, and the web route whose middleware lives in another
+ * namespace. The cross-namespace reference is the reason this file exists: it
+ * is one extra key, it is easy to leave off, and leaving it off produces a
+ * route that applies cleanly and drops traffic.
+ */
+
+import { describe, test, expect } from "vitest";
+import { IngressRoute, Middleware } from "../generated";
+import { k8sSerializer } from "../serializer";
+import { parseYAML } from "@intentius/chant/yaml";
+
+function synth(logicalName: string, resource: unknown): any {
+  const yaml = k8sSerializer.serialize(new Map([[logicalName, resource as never]]));
+  return parseYAML(yaml);
+}
+
+describe("Traefik IngressRoute", () => {
+  const secure = new IngressRoute({
+    metadata: { name: "fountain", namespace: "fountain", labels: { app: "fountain" } },
+    spec: {
+      entryPoints: ["websecure"],
+      routes: [
+        {
+          match: "Host(`fountain.inevitable.fyi`)",
+          kind: "Rule",
+          services: [{ name: "fountain", port: 80 }],
+        },
+      ],
+      tls: { secretName: "fountain-tls" },
+    },
+  });
+
+  const plain = new IngressRoute({
+    metadata: { name: "fountain-http", namespace: "fountain", labels: { app: "fountain" } },
+    spec: {
+      entryPoints: ["web"],
+      routes: [
+        {
+          match: "Host(`fountain.inevitable.fyi`)",
+          kind: "Rule",
+          middlewares: [{ name: "redirect-https", namespace: "default" }],
+          services: [{ name: "fountain", port: 80 }],
+        },
+      ],
+    },
+  });
+
+  test("carries the Traefik apiVersion and kind", () => {
+    const doc = synth("fountain", secure);
+    expect(doc.apiVersion).toBe("traefik.io/v1alpha1");
+    expect(doc.kind).toBe("IngressRoute");
+  });
+
+  test("reproduces the websecure route", () => {
+    const { spec } = synth("fountain", secure);
+    expect(spec.entryPoints).toEqual(["websecure"]);
+    expect(spec.tls).toEqual({ secretName: "fountain-tls" });
+    expect(spec.routes).toHaveLength(1);
+    expect(spec.routes[0].kind).toBe("Rule");
+    expect(spec.routes[0].services).toEqual([{ name: "fountain", port: 80 }]);
+  });
+
+  test("preserves the matcher grammar verbatim", () => {
+    const { spec } = synth("fountain", secure);
+    // Traefik's matcher is its own language, and the backticks around the host
+    // are part of it -- not YAML quoting. Anything that strips or re-quotes
+    // them produces a rule that parses and matches nothing.
+    expect(spec.routes[0].match).toBe("Host(`fountain.inevitable.fyi`)");
+    expect(spec.routes[0].match).toContain("`fountain.inevitable.fyi`");
+  });
+
+  test("keeps the namespace on a cross-namespace middleware ref", () => {
+    const { spec } = synth("fountainHttp", plain);
+    // `redirect-https` lives in `default`, the route in `fountain`. Without the
+    // qualifier Traefik looks in the route's own namespace, finds nothing, and
+    // serves the route with no redirect -- so plain HTTP quietly keeps working
+    // instead of upgrading.
+    expect(spec.routes[0].middlewares).toEqual([
+      { name: "redirect-https", namespace: "default" },
+    ]);
+  });
+
+  test("a route with no TLS omits the key rather than emptying it", () => {
+    const { spec } = synth("fountainHttp", plain);
+    expect(spec.tls).toBeUndefined();
+    expect(spec.entryPoints).toEqual(["web"]);
+  });
+});
+
+describe("Traefik Middleware", () => {
+  test("serializes the redirect the routes point at", () => {
+    const doc = synth(
+      "redirectHttps",
+      new Middleware({
+        metadata: { name: "redirect-https", namespace: "default" },
+        spec: { redirectScheme: { scheme: "https", permanent: true } },
+      }),
+    );
+    expect(doc.apiVersion).toBe("traefik.io/v1alpha1");
+    expect(doc.kind).toBe("Middleware");
+    expect(doc.metadata.namespace).toBe("default");
+    expect(doc.spec.redirectScheme).toEqual({ scheme: "https", permanent: true });
+  });
+});

package/src/generated/index.d.ts

@@ -128,6 +128,20 @@ export declare class AppProject {
   readonly uid: string;
 }
 
+export declare class Backup {
+  constructor(props: {
+    /** Specification of the desired behavior of the backup.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class BatchJob {
   constructor(props: {
     /** Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata */
@@ -228,6 +242,20 @@ export declare class Challenge {
   readonly uid: string;
 }
 
+export declare class Cluster {
+  constructor(props: {
+    /** Specification of the desired behavior of the cluster.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class ClusterIssuer {
   constructor(props: {
     /** Desired state of the ClusterIssuer resource. */
@@ -1101,6 +1129,45 @@ export declare class ImageUpdateAutomation {
   readonly uid: string;
 }
 
+export declare class InfisicalDynamicSecret {
+  constructor(props: {
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+    /** InfisicalDynamicSecretSpec defines the desired state of InfisicalDynamicSecret. */
+    spec?: Record<string, unknown>;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
+export declare class InfisicalPushSecret {
+  constructor(props: {
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+    /** InfisicalPushSecretSpec defines the desired state of InfisicalPushSecret */
+    spec?: Record<string, unknown>;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
+export declare class InfisicalSecret {
+  constructor(props: {
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+    /** InfisicalSecretSpec defines the desired state of InfisicalSecret */
+    spec?: Record<string, unknown>;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class Ing {
   constructor(props: {
     /** Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata */
@@ -1161,6 +1228,42 @@ export declare class IngressList {
   readonly uid: string;
 }
 
+export declare class IngressRoute {
+  constructor(props: {
+    /** IngressRouteSpec defines the desired state of IngressRoute. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class IngressRouteTCP {
+  constructor(props: {
+    /** IngressRouteTCPSpec defines the desired state of IngressRouteTCP. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class IngressRouteUDP {
+  constructor(props: {
+    /** IngressRouteUDPSpec defines the desired state of a IngressRouteUDP. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class IPAddress {
   constructor(props: {
     /** spec is the desired state of the IPAddress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
@@ -1379,6 +1482,30 @@ export declare class MicroVMReplicaSet {
   readonly uid: string;
 }
 
+export declare class Middleware {
+  constructor(props: {
+    /** MiddlewareSpec defines the desired state of a Middleware. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class MiddlewareTCP {
+  constructor(props: {
+    /** MiddlewareTCPSpec defines the desired state of a MiddlewareTCP. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class MutatingAdmissionPolicy {
   constructor(props: {
     /** metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata. */
@@ -1547,6 +1674,20 @@ export declare class NS {
   readonly uid: string;
 }
 
+export declare class ObjectStore {
+  constructor(props: {
+    /** Specification of the desired behavior of the ObjectStore.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class OCIRepository {
   constructor(props: {
     /** Standard object's metadata. */
@@ -1728,6 +1869,20 @@ export declare class PodTemplateList {
   readonly uid: string;
 }
 
+export declare class Pooler {
+  constructor(props: {
+    /** Specification of the desired behavior of the Pooler.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class PriorityClass {
   constructor(props: {
     /** description is an arbitrary string that usually provides guidelines on when this priority class should be used. */
@@ -2172,6 +2327,20 @@ export declare class Scale {
   readonly uid: string;
 }
 
+export declare class ScheduledBackup {
+  constructor(props: {
+    /** Specification of the desired behavior of the ScheduledBackup.
+More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class Sec {
   constructor(props: {
     /** Data contains the secret data. Each key must consist of alphanumeric characters, '-', '_' or '.'. The serialized form of the secret data is a base64 encoded string, representing the arbitrary (possibly non-string) data value here. Described in https://tools.ietf.org/html/rfc4648#section-4 */
@@ -2254,6 +2423,30 @@ export declare class SelfSubjectRulesReview {
   readonly uid: string;
 }
 
+export declare class ServersTransport {
+  constructor(props: {
+    /** ServersTransportSpec defines the desired state of a ServersTransport. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class ServersTransportTCP {
+  constructor(props: {
+    /** ServersTransportTCPSpec defines the desired state of a ServersTransportTCP. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class Service {
   constructor(props: {
     /** Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata */
@@ -2469,6 +2662,30 @@ export declare class SubjectAccessReview {
   readonly uid: string;
 }
 
+export declare class TLSOption {
+  constructor(props: {
+    /** TLSOptionSpec defines the desired state of a TLSOption. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
+export declare class TLSStore {
+  constructor(props: {
+    /** TLSStoreSpec defines the desired state of a TLSStore. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class TokenRequest {
   constructor(props: {
     /** metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata */
@@ -2493,6 +2710,18 @@ export declare class TokenReview {
   readonly uid: string;
 }
 
+export declare class TraefikService {
+  constructor(props: {
+    /** TraefikServiceSpec defines the desired state of a TraefikService. */
+    spec: Record<string, unknown>;
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class ValidatingAdmissionPolicy {
   constructor(props: {
     /** metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata. */