@intentius/chant-lexicon-k8s 0.41.19 → 0.42.1

package/dist/okf/rules/WK8042.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8042
+description: Private keys in ConfigMap — private keys should be stored in Secrets, not ConfigMaps
+id: WK8042
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Private keys in ConfigMap — private keys should be stored in Secrets, not ConfigMaps

package/dist/okf/rules/WK8101.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8101
+description: Deployment selector must match template labels — mismatched selectors cause runtime failures
+id: WK8101
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Deployment selector must match template labels — mismatched selectors cause runtime failures

package/dist/okf/rules/WK8102.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8102
+description: Resources should have metadata labels — labels enable filtering and operational tooling
+id: WK8102
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Resources should have metadata labels — labels enable filtering and operational tooling

package/dist/okf/rules/WK8103.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8103
+description: Containers must have name — the name field is required by the Kubernetes API
+id: WK8103
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Containers must have name — the name field is required by the Kubernetes API

package/dist/okf/rules/WK8104.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8104
+description: Ports should be named — named ports improve Service and NetworkPolicy configuration
+id: WK8104
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Ports should be named — named ports improve Service and NetworkPolicy configuration
+
+## Applies to
+
+- [Service](/types/Service.md)

package/dist/okf/rules/WK8105.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8105
+description: ImagePullPolicy should be explicit — avoids surprising default behavior
+id: WK8105
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+ImagePullPolicy should be explicit — avoids surprising default behavior

package/dist/okf/rules/WK8201.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8201
+description: Resource limits required — containers should have CPU and memory limits
+id: WK8201
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Resource limits required — containers should have CPU and memory limits

package/dist/okf/rules/WK8202.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8202
+description: No privileged containers — privileged mode grants full host access
+id: WK8202
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+No privileged containers — privileged mode grants full host access

package/dist/okf/rules/WK8203.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8203
+description: ReadOnlyRootFilesystem recommended — prevents runtime modification of the container image
+id: WK8203
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+ReadOnlyRootFilesystem recommended — prevents runtime modification of the container image

package/dist/okf/rules/WK8204.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8204
+description: RunAsNonRoot recommended — running as root increases container breakout risk
+id: WK8204
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+RunAsNonRoot recommended — running as root increases container breakout risk

package/dist/okf/rules/WK8205.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8205
+description: Drop ALL capabilities — containers should drop all capabilities and add only what is needed
+id: WK8205
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Drop ALL capabilities — containers should drop all capabilities and add only what is needed

package/dist/okf/rules/WK8207.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8207
+description: No hostNetwork — using host network bypasses network isolation
+id: WK8207
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+No hostNetwork — using host network bypasses network isolation

package/dist/okf/rules/WK8208.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8208
+description: No hostPID — sharing host PID namespace allows visibility into all host processes
+id: WK8208
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+No hostPID — sharing host PID namespace allows visibility into all host processes

package/dist/okf/rules/WK8209.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8209
+description: No hostIPC — sharing host IPC namespace can expose shared memory segments
+id: WK8209
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+No hostIPC — sharing host IPC namespace can expose shared memory segments

package/dist/okf/rules/WK8301.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: WK8301
+description: Probes required — containers should have livenessProbe and readinessProbe
+id: WK8301
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Probes required — containers should have livenessProbe and readinessProbe
+
+## Applies to
+
+- [CronJob](/types/CronJob.md)
+- [Service](/types/Service.md)

package/dist/okf/rules/WK8302.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8302
+description: Replicas >= 2 recommended — single-replica Deployments have no high availability
+id: WK8302
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Replicas >= 2 recommended — single-replica Deployments have no high availability

package/dist/okf/rules/WK8303.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8303
+description: PDB recommended for HA Deployments — ensures availability during voluntary disruptions
+id: WK8303
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+PDB recommended for HA Deployments — ensures availability during voluntary disruptions
+
+## Applies to
+
+- [PDB](/types/PDB.md)

package/dist/okf/rules/WK8304.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8304
+description: SSL redirect without certificate — ssl-redirect annotation requires a valid certificate-arn and HTTPS listen-ports
+id: WK8304
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+SSL redirect without certificate — ssl-redirect annotation requires a valid certificate-arn and HTTPS listen-ports
+
+## Applies to
+
+- [Certificate](/types/Certificate.md)

package/dist/okf/rules/WK8305.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8305
+description: Ingress port not matching Service — backend port must match a declared Service port
+id: WK8305
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Ingress port not matching Service — backend port must match a declared Service port
+
+## Applies to
+
+- [Service](/types/Service.md)

package/dist/okf/rules/WK8306.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8306
+description: Container command starts with flag — first element should be a binary, not a flag
+id: WK8306
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Container command starts with flag — first element should be a binary, not a flag

package/dist/okf/rules/WK8401.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8401
+description: shmSize must not exceed the container memory limit — pod will not schedule if it does
+id: WK8401
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+shmSize must not exceed the container memory limit — pod will not schedule if it does
+
+## Applies to
+
+- [RayCluster](/types/RayCluster.md)

package/dist/okf/rules/WK8402.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8402
+description: RayCluster should set spec.rayVersion so KubeRay selects the correct autoscaler image
+id: WK8402
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+RayCluster should set spec.rayVersion so KubeRay selects the correct autoscaler image
+
+## Applies to
+
+- [RayCluster](/types/RayCluster.md)

package/dist/okf/rules/WK8403.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8403
+description: spec.rayVersion should match the Ray version in the head container image tag
+id: WK8403
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+spec.rayVersion should match the Ray version in the head container image tag
+
+## Applies to
+
+- [RayCluster](/types/RayCluster.md)

package/dist/okf/types/APIGroup.md

@@ -0,0 +1,16 @@
+---
+type: resource-type
+title: APIGroup
+description: k8s resource type K8s::Core::APIGroup
+name: APIGroup
+lexicon: k8s
+resource_type: K8s::Core::APIGroup
+---
+`K8s::Core::APIGroup`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `name` (`string`, required): name is the name of the group.
+- `versions` (`Record<string, unknown>[]`, required): versions are the versions supported in this group.
+- `preferredVersion` (`Record<string, unknown>`, optional): preferredVersion is the version preferred by the API server, which probably is the storage version.
+- `serverAddressByClientCIDRs` (`Record<string, unknown>[]`, optional): a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.

package/dist/okf/types/APIGroupList.md

@@ -0,0 +1,13 @@
+---
+type: resource-type
+title: APIGroupList
+description: k8s resource type K8s::Core::APIGroupList
+name: APIGroupList
+lexicon: k8s
+resource_type: K8s::Core::APIGroupList
+---
+`K8s::Core::APIGroupList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `groups` (`Record<string, unknown>[]`, required): groups is a list of APIGroup.

package/dist/okf/types/APIResourceList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: APIResourceList
+description: k8s resource type K8s::Core::APIResourceList
+name: APIResourceList
+lexicon: k8s
+resource_type: K8s::Core::APIResourceList
+---
+`K8s::Core::APIResourceList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `groupVersion` (`string`, required): groupVersion is the group and version this APIResourceList is for.
+- `resources` (`Record<string, unknown>[]`, required): resources contains the name of the resources and if they are namespaced.

package/dist/okf/types/APIService.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: APIService
+description: k8s resource type K8s::Apiregistration::APIService
+name: APIService
+lexicon: k8s
+resource_type: K8s::Apiregistration::APIService
+---
+`K8s::Apiregistration::APIService`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+- `spec` (`Record<string, unknown>`, optional): Spec contains information for locating and communicating with a server

package/dist/okf/types/APIServiceList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: APIServiceList
+description: k8s resource type K8s::Apiregistration::APIServiceList
+name: APIServiceList
+lexicon: k8s
+resource_type: K8s::Apiregistration::APIServiceList
+---
+`K8s::Apiregistration::APIServiceList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): Items is the list of APIService
+- `metadata` (`Record<string, unknown>`, optional): Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/APIVersions.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: APIVersions
+description: k8s resource type K8s::Core::APIVersions
+name: APIVersions
+lexicon: k8s
+resource_type: K8s::Core::APIVersions
+---
+`K8s::Core::APIVersions`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `serverAddressByClientCIDRs` (`Record<string, unknown>[]`, required): a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
+- `versions` (`string[]`, required): versions are the api versions that are available.

package/dist/okf/types/Alert.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: Alert
+description: k8s resource type K8s::Flux::Alert
+name: Alert
+lexicon: k8s
+resource_type: K8s::Flux::Alert
+---
+`K8s::Flux::Alert`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): AlertSpec defines an alerting rule for events involving a list of objects.

package/dist/okf/types/AppProject.md

@@ -0,0 +1,19 @@
+---
+type: resource-type
+title: AppProject
+description: k8s resource type K8s::Argo::AppProject
+name: AppProject
+lexicon: k8s
+resource_type: K8s::Argo::AppProject
+---
+`K8s::Argo::AppProject`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): AppProjectSpec is the specification of an AppProject
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+
+## Governed by
+
+- [ARGO002](/rules/ARGO002.md): Application.spec.project must reference a declared AppProject (or the built-in default)
+- [ARGO004](/rules/ARGO004.md): ApplicationSet template must scope to a single AppProject

package/dist/okf/types/Application.md

@@ -0,0 +1,23 @@
+---
+type: resource-type
+title: Application
+description: k8s resource type K8s::Argo::Application
+name: Application
+lexicon: k8s
+resource_type: K8s::Argo::Application
+---
+`K8s::Argo::Application`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): ApplicationSpec represents desired application state. Contains link to repository with application definition and additional parameters link definition revision.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `operation` (`Record<string, unknown>`, optional): Operation contains information about a requested or running operation
+
+## Governed by
+
+- [ARGO001](/rules/ARGO001.md): Production Application must not enable automated prune
+- [ARGO002](/rules/ARGO002.md): Application.spec.project must reference a declared AppProject (or the built-in default)
+- [ARGO003](/rules/ARGO003.md): Application.spec.destination must reference a registered cluster or the in-cluster target
+- [ARGO004](/rules/ARGO004.md): ApplicationSet template must scope to a single AppProject
+- [ARGO005](/rules/ARGO005.md): Application source.path should resolve to an existing directory under the build root

package/dist/okf/types/ApplicationSet.md

@@ -0,0 +1,18 @@
+---
+type: resource-type
+title: ApplicationSet
+description: k8s resource type K8s::Argo::ApplicationSet
+name: ApplicationSet
+lexicon: k8s
+resource_type: K8s::Argo::ApplicationSet
+---
+`K8s::Argo::ApplicationSet`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required)
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+
+## Governed by
+
+- [ARGO004](/rules/ARGO004.md): ApplicationSet template must scope to a single AppProject

package/dist/okf/types/Backup.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: Backup
+description: k8s resource type K8s::Cnpg::Backup
+name: Backup
+lexicon: k8s
+resource_type: K8s::Cnpg::Backup
+---
+`K8s::Cnpg::Backup`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): Specification of the desired behavior of the backup. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.

package/dist/okf/types/BatchJob.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: BatchJob
+description: k8s resource type K8s::Batch::Job
+name: BatchJob
+lexicon: k8s
+resource_type: K8s::Batch::Job
+---
+`K8s::Batch::Job`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+- `spec` (`Record<string, unknown>`, optional): Specification of the desired behavior of a job. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

package/dist/okf/types/Binding.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: Binding
+description: k8s resource type K8s::Core::Binding
+name: Binding
+lexicon: k8s
+resource_type: K8s::Core::Binding
+---
+`K8s::Core::Binding`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `target` (`ObjectReference`, required): The target object that you want to bind to the standard object.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/Bucket.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: Bucket
+description: k8s resource type K8s::Flux::Bucket
+name: Bucket
+lexicon: k8s
+resource_type: K8s::Flux::Bucket
+---
+`K8s::Flux::Bucket`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): BucketSpec specifies the required configuration to produce an Artifact for an object storage bucket.

package/dist/okf/types/CM.md

@@ -0,0 +1,16 @@
+---
+type: resource-type
+title: CM
+description: k8s resource type K8s::Core::ConfigMap
+name: CM
+lexicon: k8s
+resource_type: K8s::Core::ConfigMap
+---
+`K8s::Core::ConfigMap`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `binaryData` (`Record<string, string>`, optional): BinaryData contains the binary data. Each key must consist of alphanumeric characters, '-', '_' or '.'. BinaryData can contain byte sequences that are not in the UTF-8 range. The keys stored in BinaryData must not overlap with the ones in the Data field, this is enforced during validation process. Using this field will require 1.10+ apiserver and kubelet.
+- `data` (`Record<string, string>`, optional): Data contains the configuration data. Each key must consist of alphanumeric characters, '-', '_' or '.'. Values with non-UTF-8 byte sequences must use the BinaryData field. The keys stored in Data must not overlap with the keys in the BinaryData field, this is enforced during validation process.
+- `immutable` (`boolean`, optional): Immutable, if set to true, ensures that data stored in the ConfigMap cannot be updated (only object metadata can be modified). If not set to true, the field can be modified at any time. Defaulted to nil.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/CSIDriver.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: CSIDriver
+description: k8s resource type K8s::Storage::CSIDriver
+name: CSIDriver
+lexicon: k8s
+resource_type: K8s::Storage::CSIDriver
+---
+`K8s::Storage::CSIDriver`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): spec represents the specification of the CSI Driver.
+- `metadata` (`ObjectMeta`, optional): Standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/CSIDriverList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: CSIDriverList
+description: k8s resource type K8s::Storage::CSIDriverList
+name: CSIDriverList
+lexicon: k8s
+resource_type: K8s::Storage::CSIDriverList
+---
+`K8s::Storage::CSIDriverList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): items is the list of CSIDriver
+- `metadata` (`Record<string, unknown>`, optional): Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/CSINode.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: CSINode
+description: k8s resource type K8s::Storage::CSINode
+name: CSINode
+lexicon: k8s
+resource_type: K8s::Storage::CSINode
+---
+`K8s::Storage::CSINode`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): spec is the specification of CSINode
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata. metadata.name must be the Kubernetes node name.

package/dist/okf/types/CSINodeList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: CSINodeList
+description: k8s resource type K8s::Storage::CSINodeList
+name: CSINodeList
+lexicon: k8s
+resource_type: K8s::Storage::CSINodeList
+---
+`K8s::Storage::CSINodeList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): items is the list of CSINode
+- `metadata` (`Record<string, unknown>`, optional): Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata