@intentius/chant-lexicon-k8s 0.41.11 → 0.41.13

package/dist/describe-stack-status.d.ts

@@ -14,11 +14,18 @@
  * a caller observes with, and a mismatch would read a deployed unit as absent
  * — the failure mode the tri-state exists to prevent.
  *
- * The sweep is bounded to the kinds chant's own k8s surface deploys as
- * stack-scoped objects (workloads + the service/config plumbing around them).
- * A CRD-only unit is out of this bound and reports absent rather than null —
- * a real limit, stated here rather than papered over; widening the sweep to
- * discovery-driven kinds is a follow-up, not a silent claim.
+ * The sweep starts from the kinds chant's own k8s surface deploys as
+ * stack-scoped objects (workloads + the service/config plumbing around them),
+ * then widens to what the cluster itself serves: the CRDs (a unit that
+ * deploys definitions is a real unit — kubemicrovm-ops pins them
+ * `delete: never`), and every CRD-backed kind those definitions declare. A
+ * kubemicrovm workload stack is *entirely* custom resources, and under the
+ * fixed bound it read as absent while its VMs ran (#1528) — and because a
+ * component is live only when every unit is, that one false absence painted
+ * whole components dead. The CRD list is read unfiltered, since the unit
+ * under observation rarely owns the definitions its objects instantiate;
+ * each derived kind is then read with the same stack selector, so the cost
+ * is one label-filtered list per served CRD kind.
  */
 import type { StackStatusObservation } from "@intentius/chant/lexicon";
 import { type K8sConnector } from "./api/connect.js";

package/dist/describe-stack-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-stack-status.d.ts","sourceRoot":"","sources":["../src/describe-stack-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGvE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAgCvE,wBAAsB,mBAAmB,CACvC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAC/C,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAuCxC"}
+{"version":3,"file":"describe-stack-status.d.ts","sourceRoot":"","sources":["../src/describe-stack-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGvE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmEvE,wBAAsB,mBAAmB,CACvC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAC/C,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAwCxC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "9399085f9a236e05e251e77ed9836ea682c29d2a5a685ec4609f48a426ce7c48",
+    "manifest.json": "9ba4951b328537999953cb55679d420add94305817fab50d31b487841236689f",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "eb5beb679ae3d4c4bddabe46475489b75f48613276910005eef1276d2ae4666e"
+  "composite": "3ad81fead558e4d2546ec00f031acaaa0fb4c1800794a5147b2cd0b20d9ef4ed"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.11",
+  "version": "0.41.13",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.11",
+  "version": "0.41.13",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.11",
+    "@intentius/chant": "^0.41.13",
     "typescript": "^5.9.3"
   }
 }

package/src/describe-stack-status.test.ts

@@ -2,13 +2,23 @@ import { describe, test, expect } from "vitest";
 import { describeStackStatus } from "./describe-stack-status";
 import type { K8sConnector } from "./api/connect";
 
-/** A connector whose client answers list() from a canned map keyed by kind. */
-function fakeConnector(byKind: Record<string, unknown[]>, opts: { failKinds?: string[]; recordSelectors?: string[] } = {}): K8sConnector {
+/**
+ * A connector whose client answers list() from a canned map keyed by kind.
+ * Selector-bearing lists model the server having filtered to the stack's
+ * objects (`byKind` holds what matched); the selector-less list is the CRD
+ * discovery read (#1528), answered from `discovery` so a test can serve
+ * definitions without them counting as the stack's own objects.
+ */
+function fakeConnector(
+  byKind: Record<string, unknown[]>,
+  opts: { failKinds?: string[]; recordSelectors?: string[]; discovery?: Record<string, unknown[]> } = {},
+): K8sConnector {
   return (async () => ({
     client: {
       async list(selector: { kind: string }, listOpts?: { labelSelector?: string }) {
-        if (listOpts?.labelSelector && opts.recordSelectors) opts.recordSelectors.push(listOpts.labelSelector);
         if (opts.failKinds?.includes(selector.kind)) throw new Error("rbac denied");
+        if (!listOpts?.labelSelector) return opts.discovery?.[selector.kind] ?? [];
+        if (opts.recordSelectors) opts.recordSelectors.push(listOpts.labelSelector);
         return byKind[selector.kind] ?? [];
       },
     },
@@ -23,6 +33,26 @@ const readyDeployment = {
 const laggingDeployment = { ...readyDeployment, status: { replicas: 2, readyReplicas: 1 } };
 const service = { kind: "Service", metadata: { name: "cc-api" } };
 
+/** A served CRD, as the discovery read returns it — not the stack's object. */
+const microvmCrd = {
+  kind: "CustomResourceDefinition",
+  metadata: { name: "microvms.lambda.aws.amazon.com" },
+  spec: {
+    group: "lambda.aws.amazon.com",
+    names: { kind: "MicroVM" },
+    versions: [{ name: "v1alpha1", served: true, storage: true }],
+  },
+};
+const runningMicroVm = {
+  kind: "MicroVM",
+  metadata: { name: "kmv-vm", labels: { "chant.intentius.io/stack": "kmv-workload" } },
+};
+const microvmReplicaSet = {
+  kind: "MicroVMReplicaSet",
+  metadata: { name: "kmv-rs", labels: { "chant.intentius.io/stack": "kmv-workload" } },
+  status: { replicas: 2, readyReplicas: 2 },
+};
+
 describe("k8s describeStackStatus (#1495 piece 3)", () => {
   test("selects on the labels chant's serializer stamps", async () => {
     const selectors: string[] = [];
@@ -68,8 +98,72 @@ describe("k8s describeStackStatus (#1495 piece 3)", () => {
   test("every read failing is indeterminate too", async () => {
     const out = await describeStackStatus(
       { environment: "local", stack: "cc" },
-      fakeConnector({}, { failKinds: ["Deployment", "StatefulSet", "DaemonSet", "Service", "ConfigMap", "Secret", "ServiceAccount", "Namespace", "Ingress", "PodDisruptionBudget", "HorizontalPodAutoscaler", "CronJob"] }),
+      fakeConnector({}, { failKinds: ["Deployment", "StatefulSet", "DaemonSet", "Service", "ConfigMap", "Secret", "ServiceAccount", "Namespace", "Ingress", "PodDisruptionBudget", "HorizontalPodAutoscaler", "CronJob", "CustomResourceDefinition"] }),
     );
     expect(out).toBeNull();
   });
 });
+
+describe("the sweep reaches what the cluster serves, not only built-ins (#1528)", () => {
+  // A kubemicrovm estate made both gaps real: its crds unit deploys nothing
+  // but definitions, its workload unit nothing but custom resources, and
+  // under the fixed bound both read absent while the estate ran — which
+  // painted every component touching them dead in `components status --live`.
+  test("a unit that deploys the definitions themselves is present", async () => {
+    const crdWithLabel = {
+      ...microvmCrd,
+      metadata: { ...microvmCrd.metadata, labels: { "chant.intentius.io/stack": "kmv-crds" } },
+    };
+    const out = await describeStackStatus(
+      { environment: "local", stack: "kmv-crds" },
+      fakeConnector({ CustomResourceDefinition: [crdWithLabel] }),
+    );
+    expect(out).toMatchObject({ present: true });
+  });
+
+  test("a unit of custom resources is present via the kinds the CRDs declare", async () => {
+    const out = await describeStackStatus(
+      { environment: "local", stack: "kmv-workload" },
+      fakeConnector({ MicroVM: [runningMicroVm] }, { discovery: { CustomResourceDefinition: [microvmCrd] } }),
+    );
+    expect(out).toMatchObject({ present: true });
+  });
+
+  test("a custom controller reporting replica readiness asserts health like a built-in", async () => {
+    const out = await describeStackStatus(
+      { environment: "local", stack: "kmv-workload" },
+      fakeConnector(
+        { MicroVMReplicaSet: [microvmReplicaSet] },
+        {
+          discovery: {
+            CustomResourceDefinition: [
+              {
+                ...microvmCrd,
+                spec: { ...microvmCrd.spec, names: { kind: "MicroVMReplicaSet" } },
+              },
+            ],
+          },
+        },
+      ),
+    );
+    expect(out).toMatchObject({ present: true, healthy: true, status: "1/1 workloads ready" });
+  });
+
+  test("an unserved or malformed CRD derives nothing and breaks nothing", async () => {
+    const out = await describeStackStatus(
+      { environment: "local", stack: "cc" },
+      fakeConnector(
+        { Deployment: [readyDeployment] },
+        {
+          discovery: {
+            CustomResourceDefinition: [
+              { kind: "CustomResourceDefinition", metadata: { name: "half" }, spec: { group: "x.io" } },
+              { ...microvmCrd, spec: { ...microvmCrd.spec, versions: [{ name: "v1", served: false }] } },
+            ],
+          },
+        },
+      ),
+    );
+    expect(out).toMatchObject({ present: true, healthy: true });
+  });
+});

package/src/describe-stack-status.ts

@@ -14,11 +14,18 @@
  * a caller observes with, and a mismatch would read a deployed unit as absent
  * — the failure mode the tri-state exists to prevent.
  *
- * The sweep is bounded to the kinds chant's own k8s surface deploys as
- * stack-scoped objects (workloads + the service/config plumbing around them).
- * A CRD-only unit is out of this bound and reports absent rather than null —
- * a real limit, stated here rather than papered over; widening the sweep to
- * discovery-driven kinds is a follow-up, not a silent claim.
+ * The sweep starts from the kinds chant's own k8s surface deploys as
+ * stack-scoped objects (workloads + the service/config plumbing around them),
+ * then widens to what the cluster itself serves: the CRDs (a unit that
+ * deploys definitions is a real unit — kubemicrovm-ops pins them
+ * `delete: never`), and every CRD-backed kind those definitions declare. A
+ * kubemicrovm workload stack is *entirely* custom resources, and under the
+ * fixed bound it read as absent while its VMs ran (#1528) — and because a
+ * component is live only when every unit is, that one false absence painted
+ * whole components dead. The CRD list is read unfiltered, since the unit
+ * under observation rarely owns the definitions its objects instantiate;
+ * each derived kind is then read with the same stack selector, so the cost
+ * is one label-filtered list per served CRD kind.
  */
 import type { StackStatusObservation } from "@intentius/chant/lexicon";
 import { LABEL_OWNERSHIP_KEYS, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
@@ -39,8 +46,43 @@ const SWEEP_KINDS: ReadonlyArray<{ apiVersion: string; kind: string }> = [
   { apiVersion: "policy/v1", kind: "PodDisruptionBudget" },
   { apiVersion: "autoscaling/v2", kind: "HorizontalPodAutoscaler" },
   { apiVersion: "batch/v1", kind: "CronJob" },
+  // The definitions themselves: a crds unit deploys these and nothing else.
+  { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition" },
 ];
 
+/**
+ * Every kind the cluster's CRDs declare, one served version each (storage
+ * preferred). Read unfiltered — see the module doc. Failure to read the CRD
+ * list narrows the sweep back to the fixed bound rather than failing it.
+ */
+async function crdBackedKinds(client: {
+  list(target: { apiVersion: string; kind: string }, opts?: object): Promise<K8sObject[]>;
+}): Promise<Array<{ apiVersion: string; kind: string }>> {
+  let crds: K8sObject[];
+  try {
+    crds = await client.list({ apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition" });
+  } catch {
+    return [];
+  }
+  const kinds: Array<{ apiVersion: string; kind: string }> = [];
+  for (const crd of crds) {
+    const spec = (crd as {
+      spec?: {
+        group?: string;
+        names?: { kind?: string };
+        versions?: Array<{ name: string; served?: boolean; storage?: boolean }>;
+      };
+    }).spec;
+    const group = spec?.group;
+    const kind = spec?.names?.kind;
+    const versions = spec?.versions ?? [];
+    const version = versions.find((v) => v.storage && v.served) ?? versions.find((v) => v.served);
+    if (!group || !kind || !version) continue;
+    kinds.push({ apiVersion: `${group}/${version.name}`, kind });
+  }
+  return kinds;
+}
+
 /** A workload is healthy when its controller reports every replica ready; a
  * kind with no readiness story (a ConfigMap, a Service) asserts nothing. */
 function objectHealthy(obj: K8sObject): boolean | undefined {
@@ -74,7 +116,8 @@ export async function describeStackStatus(
 
   const matched: K8sObject[] = [];
   let anyRead = false;
-  for (const target of SWEEP_KINDS) {
+  const targets = [...SWEEP_KINDS, ...(await crdBackedKinds(client))];
+  for (const target of targets) {
     try {
       const items = await client.list(target, { labelSelector: selector });
       anyRead = true;