@intentius/chant-lexicon-k8s 0.37.3 → 0.39.0

package/src/generated/list-map-keys.json

@@ -0,0 +1,166 @@
+{
+  "addresses": [
+    [
+      "type"
+    ]
+  ],
+  "allocatedResourcesStatus": [
+    [
+      "name"
+    ]
+  ],
+  "claims": [
+    [
+      "name"
+    ]
+  ],
+  "conditions": [
+    [
+      "type"
+    ]
+  ],
+  "containers": [
+    [
+      "name"
+    ]
+  ],
+  "devices": [
+    [
+      "device",
+      "driver",
+      "pool",
+      "shareID"
+    ]
+  ],
+  "drivers": [
+    [
+      "name"
+    ]
+  ],
+  "env": [
+    [
+      "name"
+    ]
+  ],
+  "ephemeralContainers": [
+    [
+      "name"
+    ]
+  ],
+  "hostAliases": [
+    [
+      "ip"
+    ]
+  ],
+  "imagePullSecrets": [
+    [
+      "name"
+    ]
+  ],
+  "initContainers": [
+    [
+      "name"
+    ]
+  ],
+  "matchConditions": [
+    [
+      "name"
+    ]
+  ],
+  "ownerReferences": [
+    [
+      "uid"
+    ]
+  ],
+  "podGroupTemplates": [
+    [
+      "name"
+    ]
+  ],
+  "podIPs": [
+    [
+      "ip"
+    ]
+  ],
+  "ports": [
+    [
+      "containerPort",
+      "protocol"
+    ],
+    [
+      "port",
+      "protocol"
+    ]
+  ],
+  "reservedFor": [
+    [
+      "uid"
+    ]
+  ],
+  "resourceClaimStatuses": [
+    [
+      "name"
+    ]
+  ],
+  "resourceClaims": [
+    [
+      "name"
+    ]
+  ],
+  "resources": [
+    [
+      "resourceID"
+    ]
+  ],
+  "schedulingGates": [
+    [
+      "name"
+    ]
+  ],
+  "secrets": [
+    [
+      "name"
+    ]
+  ],
+  "storageVersions": [
+    [
+      "apiServerID"
+    ]
+  ],
+  "topologySpreadConstraints": [
+    [
+      "topologyKey",
+      "whenUnsatisfiable"
+    ]
+  ],
+  "variables": [
+    [
+      "name"
+    ]
+  ],
+  "volumeDevices": [
+    [
+      "devicePath"
+    ]
+  ],
+  "volumeMounts": [
+    [
+      "mountPath"
+    ]
+  ],
+  "volumes": [
+    [
+      "name"
+    ]
+  ],
+  "webhooks": [
+    [
+      "name"
+    ]
+  ],
+  "x-kubernetes-validations": [
+    [
+      "rule"
+    ]
+  ]
+}

package/src/generated/operations.json

@@ -625,6 +625,86 @@
     "scope": "Namespaced",
     "verbs": []
   },
+  "K8s::Cnpg::Backup": {
+    "entityType": "K8s::Cnpg::Backup",
+    "apiVersion": "postgresql.cnpg.io/v1",
+    "kind": "Backup",
+    "plural": "backups",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Cnpg::Cluster": {
+    "entityType": "K8s::Cnpg::Cluster",
+    "apiVersion": "postgresql.cnpg.io/v1",
+    "kind": "Cluster",
+    "plural": "clusters",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Cnpg::ObjectStore": {
+    "entityType": "K8s::Cnpg::ObjectStore",
+    "apiVersion": "barmancloud.cnpg.io/v1",
+    "kind": "ObjectStore",
+    "plural": "objectstores",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Cnpg::Pooler": {
+    "entityType": "K8s::Cnpg::Pooler",
+    "apiVersion": "postgresql.cnpg.io/v1",
+    "kind": "Pooler",
+    "plural": "poolers",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Cnpg::ScheduledBackup": {
+    "entityType": "K8s::Cnpg::ScheduledBackup",
+    "apiVersion": "postgresql.cnpg.io/v1",
+    "kind": "ScheduledBackup",
+    "plural": "scheduledbackups",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Coordination::Lease": {
     "entityType": "K8s::Coordination::Lease",
     "apiVersion": "coordination.k8s.io/v1",
@@ -1537,6 +1617,54 @@
       "watch"
     ]
   },
+  "K8s::Infisical::InfisicalDynamicSecret": {
+    "entityType": "K8s::Infisical::InfisicalDynamicSecret",
+    "apiVersion": "secrets.infisical.com/v1alpha1",
+    "kind": "InfisicalDynamicSecret",
+    "plural": "infisicaldynamicsecrets",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Infisical::InfisicalPushSecret": {
+    "entityType": "K8s::Infisical::InfisicalPushSecret",
+    "apiVersion": "secrets.infisical.com/v1alpha1",
+    "kind": "InfisicalPushSecret",
+    "plural": "infisicalpushsecrets",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Infisical::InfisicalSecret": {
+    "entityType": "K8s::Infisical::InfisicalSecret",
+    "apiVersion": "secrets.infisical.com/v1alpha1",
+    "kind": "InfisicalSecret",
+    "plural": "infisicalsecrets",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::KubeMicroVM::MicroVM": {
     "entityType": "K8s::KubeMicroVM::MicroVM",
     "apiVersion": "lambda.aws.amazon.com/v1alpha1",
@@ -2232,5 +2360,165 @@
     "plural": "storageversionmigrationlists",
     "scope": "Namespaced",
     "verbs": []
+  },
+  "K8s::Traefik::IngressRoute": {
+    "entityType": "K8s::Traefik::IngressRoute",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "IngressRoute",
+    "plural": "ingressroutes",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Traefik::IngressRouteTCP": {
+    "entityType": "K8s::Traefik::IngressRouteTCP",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "IngressRouteTCP",
+    "plural": "ingressroutetcps",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Traefik::IngressRouteUDP": {
+    "entityType": "K8s::Traefik::IngressRouteUDP",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "IngressRouteUDP",
+    "plural": "ingressrouteudps",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Traefik::Middleware": {
+    "entityType": "K8s::Traefik::Middleware",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "Middleware",
+    "plural": "middlewares",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Traefik::MiddlewareTCP": {
+    "entityType": "K8s::Traefik::MiddlewareTCP",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "MiddlewareTCP",
+    "plural": "middlewaretcps",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Traefik::ServersTransport": {
+    "entityType": "K8s::Traefik::ServersTransport",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "ServersTransport",
+    "plural": "serverstransports",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Traefik::ServersTransportTCP": {
+    "entityType": "K8s::Traefik::ServersTransportTCP",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "ServersTransportTCP",
+    "plural": "serverstransporttcps",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Traefik::TLSOption": {
+    "entityType": "K8s::Traefik::TLSOption",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "TLSOption",
+    "plural": "tlsoptions",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Traefik::TLSStore": {
+    "entityType": "K8s::Traefik::TLSStore",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "TLSStore",
+    "plural": "tlsstores",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Traefik::TraefikService": {
+    "entityType": "K8s::Traefik::TraefikService",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "TraefikService",
+    "plural": "traefikservices",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
   }
 }

package/src/lifecycle-integration.test.ts

@@ -211,6 +211,7 @@ describe("k8s lifecycle integration (#163)", () => {
 // The shared conformance suite (#1089) — every observing lexicon runs it.
 describeObservationConformance({
   lexicon: "k8s",
+  ownershipChannel: k8sPlugin.ownershipChannel,
   scenarios: [
     {
       name: "an RBAC-denied read alongside a confirmed absence",

package/src/list-map-order-key.test.ts

@@ -0,0 +1,119 @@
+import { describe, test, expect } from "vitest";
+import { schemaListMapOrderKey } from "./deep-observe-hooks";
+import { k8sListMapOrderKey } from "@intentius/chant/managed-fields";
+import type { DeepArrayElement } from "@intentius/chant/lexicon";
+
+/**
+ * chant #1441 — list elements are identified by the key the SPEC declares,
+ * with the hand-written conventions kept as fallback.
+ *
+ * The behavioural claim under test: two observations of the same object whose
+ * associative lists arrive in different orders must canonicalize to the same
+ * sequence, so ordering alone is never reported as drift.
+ */
+
+function el(pattern: string, element: unknown, index = 0): DeepArrayElement {
+  return { entityType: "K8s::Apps::Deployment", pattern, path: pattern, element, index, side: "live" };
+}
+
+/** Sort a list the way core's normalization does, using the hook's key. */
+function canonicalOrder(pattern: string, elements: unknown[]): unknown[] {
+  return elements
+    .map((element, index) => ({ element, key: schemaListMapOrderKey(el(pattern, element, index)) }))
+    .sort((a, b) => (a.key ?? "").localeCompare(b.key ?? ""))
+    .map((e) => e.element);
+}
+
+describe("conditions — the case the hardcoded table missed", () => {
+  const ready = { type: "Ready", status: "True" };
+  const progressing = { type: "Progressing", status: "True" };
+
+  test("is identified by type", () => {
+    expect(schemaListMapOrderKey(el("status.conditions", ready))).toBe("Ready");
+  });
+
+  test("was NOT identified before this change", () => {
+    // Guards the premise: without the spec-derived table, `conditions` fell
+    // through to `undefined`, which leaves the array order alone — so two
+    // orderings compared positionally and read as drift.
+    expect(k8sListMapOrderKey(el("status.conditions", ready))).toBeUndefined();
+  });
+
+  test("two orderings of the same conditions canonicalize identically", () => {
+    expect(canonicalOrder("status.conditions", [ready, progressing])).toEqual(
+      canonicalOrder("status.conditions", [progressing, ready]),
+    );
+  });
+});
+
+describe("ports — one name, two key shapes", () => {
+  test("a container port is keyed by containerPort and protocol", () => {
+    // Byte-identical to what the hardcoded implementation produced, because
+    // this string is also the element's address in drift output.
+    const element = { containerPort: 8080, protocol: "TCP" };
+    expect(schemaListMapOrderKey(el("spec.template.spec.containers.ports", element))).toBe("08080/TCP");
+    expect(schemaListMapOrderKey(el("spec.template.spec.containers.ports", element))).toBe(
+      k8sListMapOrderKey(el("spec.template.spec.containers.ports", element)),
+    );
+  });
+
+  test("a Service port is keyed by port and protocol", () => {
+    expect(schemaListMapOrderKey(el("spec.ports", { port: 443, protocol: "TCP" }))).toBe("00443/TCP");
+  });
+
+  test("numeric key fields order numerically, not lexicographically", () => {
+    const ordered = canonicalOrder("spec.ports", [
+      { port: 443, protocol: "TCP" },
+      { port: 80, protocol: "TCP" },
+    ]);
+    expect(ordered).toEqual([
+      { port: 80, protocol: "TCP" },
+      { port: 443, protocol: "TCP" },
+    ]);
+  });
+});
+
+describe("fallback", () => {
+  test("a list the spec does not annotate still gets the hand-written key", () => {
+    // `containers` is in both the generated table and the hardcoded one; the
+    // point is that removing an element's spec-declared fields does not strand
+    // it — it lands on the by-name convention.
+    const key = schemaListMapOrderKey(el("spec.template.spec.containers", { name: "app", image: "nginx" }));
+    expect(key).toBeDefined();
+  });
+
+  test("an unknown list is left unordered, exactly as before", () => {
+    expect(schemaListMapOrderKey(el("spec.somethingUnknown", { a: 1 }))).toBeUndefined();
+  });
+
+  test("a non-object element is left to the fallback rather than crashing", () => {
+    expect(() => schemaListMapOrderKey(el("spec.template.spec.containers", "not-an-object"))).not.toThrow();
+  });
+
+  test("an element missing its declared key fields falls through", () => {
+    // A conditions entry with no `type` cannot be identified by the spec key.
+    // It must not produce `type=undefined`, which would collide across
+    // elements and silently merge distinct entries.
+    const key = schemaListMapOrderKey(el("status.conditions", { status: "True" }));
+    expect(key ?? "").not.toContain("undefined");
+  });
+});
+
+describe("compatibility with the hardcoded table", () => {
+  // The order key is the element's address in drift output, so every property
+  // the hand-written table already covered must keep producing the identical
+  // string. A change here silently rewrites existing drift paths.
+  const cases: Array<[string, unknown]> = [
+    ["spec.template.spec.containers", { name: "app", image: "nginx" }],
+    ["spec.template.spec.initContainers", { name: "init" }],
+    ["spec.template.spec.ephemeralContainers", { name: "debug" }],
+    ["spec.template.spec.containers.env", { name: "PORT", value: "8080" }],
+    ["spec.template.spec.volumes", { name: "data" }],
+    ["spec.template.spec.containers.ports", { containerPort: 80, protocol: "TCP" }],
+    ["spec.ports", { port: 443, protocol: "TCP" }],
+  ];
+
+  test.each(cases)("%s produces the same key as before", (pattern, element) => {
+    expect(schemaListMapOrderKey(el(pattern, element))).toBe(k8sListMapOrderKey(el(pattern, element)));
+  });
+});

package/src/plugin.ts

@@ -26,9 +26,13 @@ import { k8sHover } from "./lsp/hover";
 import { K8sParser } from "./import/parser";
 import { K8sGenerator } from "./import/generator";
 import { k8sDeepNormalizationHooks } from "./deep-observe-hooks";
+import { LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import { k8sConfigSchema } from "./config-schema";
 
 export const k8sPlugin: LexiconPlugin = {
   name: "k8s",
+  ownershipChannel: { keys: LABEL_OWNERSHIP_KEYS, reads: ["describeResources", "observeResourcesDeep", "exportResources"] },
+  configSchema: k8sConfigSchema,
   auditCatalog: () => k8sAuditCatalog,
   serializer: k8sSerializer,
   // Self-upgrade: where the pinned Kubernetes schema version lives + its upstream (#685).

package/src/serializer.ts

@@ -153,6 +153,10 @@ function toYAMLValue(value: unknown, entityNames: Map<Declarable, string>): unkn
 export const k8sSerializer: Serializer = {
   name: "k8s",
   rulePrefix: "WK8",
+  // The Argo CD checks are a distinct product surface this lexicon covers, and
+  // their ids are published — renaming them would break every `chant-disable
+  // ARGO001` already written (#1349).
+  extraRulePrefixes: ["ARGO"],
 
   serialize(entities: Map<string, Declarable>, _outputs?: LexiconOutput[], context?: SerializeContext): string {
     // Build reverse map: entity → name

package/src/spec/parse.test.ts

@@ -4,6 +4,7 @@ import {
   gvkToApiVersion,
   k8sShortName,
   k8sServiceName,
+  specListMapKeyPairs,
 } from "./parse";
 
 describe("gvkToTypeName", () => {
@@ -100,3 +101,44 @@ describe("k8sServiceName", () => {
     expect(typeof name).toBe("string");
   });
 });
+
+/**
+ * chant #1441 — the merge semantics the API server publishes, read off every
+ * definition rather than only the ones chant emits a type for.
+ */
+describe("specListMapKeyPairs", () => {
+  const spec = JSON.stringify({
+    definitions: {
+      "io.k8s.api.core.v1.PodSpec": {
+        properties: {
+          containers: { type: "array", "x-kubernetes-list-type": "map", "x-kubernetes-list-map-keys": ["name"] },
+          // atomic and set lists carry no identity key
+          tolerations: { type: "array", "x-kubernetes-list-type": "atomic" },
+          finalizers: { type: "array", "x-kubernetes-list-type": "set" },
+          nodeName: { type: "string" },
+        },
+      },
+      "io.k8s.api.core.v1.ServiceSpec": {
+        properties: {
+          ports: { type: "array", "x-kubernetes-list-type": "map", "x-kubernetes-list-map-keys": ["port", "protocol"] },
+        },
+      },
+      "io.k8s.api.core.v1.NoProperties": {},
+    },
+  });
+
+  test("collects only map-typed lists that name their keys", () => {
+    expect(specListMapKeyPairs(spec)).toEqual([
+      ["containers", ["name"]],
+      ["ports", ["port", "protocol"]],
+    ]);
+  });
+
+  test("accepts a Buffer, as the fetch path supplies", () => {
+    expect(specListMapKeyPairs(Buffer.from(spec, "utf-8"))).toHaveLength(2);
+  });
+
+  test("a spec with no definitions yields nothing rather than throwing", () => {
+    expect(specListMapKeyPairs(JSON.stringify({}))).toEqual([]);
+  });
+});