@intentius/chant-lexicon-k8s 0.41.20 → 0.42.1

package/dist/deep-observe-hooks.d.ts

@@ -65,6 +65,14 @@ import type { DeepArrayElement, DeepNormalizationHooks } from "@intentius/chant/
  * under it is exactly at its default.
  */
 export declare const K8S_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
+/**
+ * Server-ASSIGNED fields — populated by the API server with a value that
+ * varies per object (an allocated ClusterIP, the resolved IP family list), so
+ * unlike {@link K8S_SERVICE_DEFAULTS} there is no fixed value to compare
+ * against. Counterpart-gated like the defaults table: a declared `clusterIP`
+ * is still compared, only the purely server-filled appearance is noise.
+ */
+export declare const K8S_SERVER_ASSIGNED_PATTERNS: Record<string, ReadonlySet<string>>;
 /**
  * Order an associative list's element by the identity the SPEC declares for it
  * (chant #1441), falling back to `@intentius/chant/managed-fields`'s hand-written

package/dist/deep-observe-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAY,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAYnG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcxE,CAAC;AA+EF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAYnF;AAMD,eAAO,MAAM,yBAAyB,EAAE,sBAWvC,CAAC"}
+{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAY,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAanG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoCxE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAE5E,CAAC;AAiGF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAYnF;AAMD,eAAO,MAAM,yBAAyB,EAAE,sBAmBvC,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "5dc7c047316cefafc266f579d7a266cfed2d3682a197bef9dbcb0f27c70af2df",
+    "manifest.json": "9a86742dc7d08b1d32dd3ae73ae9a62febf09f0a83f2cfaaeeee5c26efdaba05",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "624054fff650a57fd0f5c234a26aa362e45fed534780e98405f4ebae4c2470d0"
+  "composite": "cb6e9c99fe95c9c11ad9440c2ae9082e36c26ca90574b636904fcf25775b0250"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.20",
+  "version": "0.42.1",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/okf/index.md

@@ -0,0 +1,250 @@
+---
+okf_version: '0.2'
+---
+
+# Resource types
+
+* [Alert](/types/Alert.md) - K8s::Flux::Alert
+* [APIGroup](/types/APIGroup.md) - K8s::Core::APIGroup
+* [APIGroupList](/types/APIGroupList.md) - K8s::Core::APIGroupList
+* [APIResourceList](/types/APIResourceList.md) - K8s::Core::APIResourceList
+* [APIService](/types/APIService.md) - K8s::Apiregistration::APIService
+* [APIServiceList](/types/APIServiceList.md) - K8s::Apiregistration::APIServiceList
+* [APIVersions](/types/APIVersions.md) - K8s::Core::APIVersions
+* [Application](/types/Application.md) - K8s::Argo::Application
+* [ApplicationSet](/types/ApplicationSet.md) - K8s::Argo::ApplicationSet
+* [AppProject](/types/AppProject.md) - K8s::Argo::AppProject
+* [Backup](/types/Backup.md) - K8s::Cnpg::Backup
+* [BatchJob](/types/BatchJob.md) - K8s::Batch::Job
+* [Binding](/types/Binding.md) - K8s::Core::Binding
+* [Bucket](/types/Bucket.md) - K8s::Flux::Bucket
+* [Certificate](/types/Certificate.md) - K8s::CertManager::Certificate
+* [CertificateRequest](/types/CertificateRequest.md) - K8s::CertManager::CertificateRequest
+* [CertificateSigningRequest](/types/CertificateSigningRequest.md) - K8s::Certificates::CertificateSigningRequest
+* [CertificateSigningRequestList](/types/CertificateSigningRequestList.md) - K8s::Certificates::CertificateSigningRequestList
+* [Challenge](/types/Challenge.md) - K8s::Acme::Challenge
+* [Cluster](/types/Cluster.md) - K8s::Cnpg::Cluster
+* [ClusterIssuer](/types/ClusterIssuer.md) - K8s::CertManager::ClusterIssuer
+* [ClusterRole](/types/ClusterRole.md) - K8s::Rbac::ClusterRole
+* [ClusterRoleBinding](/types/ClusterRoleBinding.md) - K8s::Rbac::ClusterRoleBinding
+* [ClusterRoleBindingList](/types/ClusterRoleBindingList.md) - K8s::Rbac::ClusterRoleBindingList
+* [ClusterRoleList](/types/ClusterRoleList.md) - K8s::Rbac::ClusterRoleList
+* [ClusterTrustBundle](/types/ClusterTrustBundle.md) - K8s::Certificates::ClusterTrustBundle
+* [ClusterTrustBundleList](/types/ClusterTrustBundleList.md) - K8s::Certificates::ClusterTrustBundleList
+* [CM](/types/CM.md) - K8s::Core::ConfigMap
+* [ComponentStatus](/types/ComponentStatus.md) - K8s::Core::ComponentStatus
+* [ComponentStatusList](/types/ComponentStatusList.md) - K8s::Core::ComponentStatusList
+* [ConfigMapList](/types/ConfigMapList.md) - K8s::Core::ConfigMapList
+* [ControllerRevision](/types/ControllerRevision.md) - K8s::Apps::ControllerRevision
+* [ControllerRevisionList](/types/ControllerRevisionList.md) - K8s::Apps::ControllerRevisionList
+* [CoreEventList](/types/CoreEventList.md) - K8s::Core::EventList
+* [CrdbCluster](/types/CrdbCluster.md) - K8s::Crdb::CrdbCluster
+* [CronJob](/types/CronJob.md) - K8s::Batch::CronJob
+* [CronJobList](/types/CronJobList.md) - K8s::Batch::CronJobList
+* [CSIDriver](/types/CSIDriver.md) - K8s::Storage::CSIDriver
+* [CSIDriverList](/types/CSIDriverList.md) - K8s::Storage::CSIDriverList
+* [CSINode](/types/CSINode.md) - K8s::Storage::CSINode
+* [CSINodeList](/types/CSINodeList.md) - K8s::Storage::CSINodeList
+* [CSIStorageCapacity](/types/CSIStorageCapacity.md) - K8s::Storage::CSIStorageCapacity
+* [CSIStorageCapacityList](/types/CSIStorageCapacityList.md) - K8s::Storage::CSIStorageCapacityList
+* [CustomResourceDefinition](/types/CustomResourceDefinition.md) - K8s::Apiextensions::CustomResourceDefinition
+* [CustomResourceDefinitionList](/types/CustomResourceDefinitionList.md) - K8s::Apiextensions::CustomResourceDefinitionList
+* [DaemonSet](/types/DaemonSet.md) - K8s::Apps::DaemonSet
+* [DaemonSetList](/types/DaemonSetList.md) - K8s::Apps::DaemonSetList
+* [DeleteOptions](/types/DeleteOptions.md) - K8s::Core::DeleteOptions
+* [Deploy](/types/Deploy.md) - K8s::Apps::Deployment
+* [DeploymentList](/types/DeploymentList.md) - K8s::Apps::DeploymentList
+* [DeviceClass](/types/DeviceClass.md) - K8s::Resource::DeviceClass
+* [DeviceClassList](/types/DeviceClassList.md) - K8s::Resource::DeviceClassList
+* [DeviceTaintRule](/types/DeviceTaintRule.md) - K8s::Resource::DeviceTaintRule
+* [DeviceTaintRuleList](/types/DeviceTaintRuleList.md) - K8s::Resource::DeviceTaintRuleList
+* [Endpoints](/types/Endpoints.md) - K8s::Core::Endpoints
+* [EndpointSlice](/types/EndpointSlice.md) - K8s::Discovery::EndpointSlice
+* [EndpointSliceList](/types/EndpointSliceList.md) - K8s::Discovery::EndpointSliceList
+* [EndpointsList](/types/EndpointsList.md) - K8s::Core::EndpointsList
+* [Event](/types/Event.md) - K8s::Core::Event
+* [EventsEvent](/types/EventsEvent.md) - K8s::Events::Event
+* [EventsEventList](/types/EventsEventList.md) - K8s::Events::EventList
+* [Eviction](/types/Eviction.md) - K8s::Policy::Eviction
+* [FlowSchema](/types/FlowSchema.md) - K8s::Flowcontrol::FlowSchema
+* [FlowSchemaList](/types/FlowSchemaList.md) - K8s::Flowcontrol::FlowSchemaList
+* [FluxInstance](/types/FluxInstance.md) - K8s::Flux::FluxInstance
+* [FluxReport](/types/FluxReport.md) - K8s::Flux::FluxReport
+* [Gateway](/types/Gateway.md) - K8s::Gateway::Gateway
+* [GatewayClass](/types/GatewayClass.md) - K8s::Gateway::GatewayClass
+* [GitRepository](/types/GitRepository.md) - K8s::Flux::GitRepository
+* [GRPCRoute](/types/GRPCRoute.md) - K8s::Gateway::GRPCRoute
+* [HelmChart](/types/HelmChart.md) - K8s::Flux::HelmChart
+* [HelmRelease](/types/HelmRelease.md) - K8s::Flux::HelmRelease
+* [HelmRepository](/types/HelmRepository.md) - K8s::Flux::HelmRepository
+* [HorizontalPodAutoscaler](/types/HorizontalPodAutoscaler.md) - K8s::Autoscaling::HorizontalPodAutoscaler
+* [HorizontalPodAutoscalerList](/types/HorizontalPodAutoscalerList.md) - K8s::Autoscaling::HorizontalPodAutoscalerList
+* [HTTPRoute](/types/HTTPRoute.md) - K8s::Gateway::HTTPRoute
+* [ImagePolicy](/types/ImagePolicy.md) - K8s::Flux::ImagePolicy
+* [ImageRepository](/types/ImageRepository.md) - K8s::Flux::ImageRepository
+* [ImageUpdateAutomation](/types/ImageUpdateAutomation.md) - K8s::Flux::ImageUpdateAutomation
+* [InfisicalDynamicSecret](/types/InfisicalDynamicSecret.md) - K8s::Infisical::InfisicalDynamicSecret
+* [InfisicalPushSecret](/types/InfisicalPushSecret.md) - K8s::Infisical::InfisicalPushSecret
+* [InfisicalSecret](/types/InfisicalSecret.md) - K8s::Infisical::InfisicalSecret
+* [Ing](/types/Ing.md) - K8s::Networking::Ingress
+* [IngressClass](/types/IngressClass.md) - K8s::Networking::IngressClass
+* [IngressClassList](/types/IngressClassList.md) - K8s::Networking::IngressClassList
+* [IngressList](/types/IngressList.md) - K8s::Networking::IngressList
+* [IngressRoute](/types/IngressRoute.md) - K8s::Traefik::IngressRoute
+* [IngressRouteTCP](/types/IngressRouteTCP.md) - K8s::Traefik::IngressRouteTCP
+* [IngressRouteUDP](/types/IngressRouteUDP.md) - K8s::Traefik::IngressRouteUDP
+* [IPAddress](/types/IPAddress.md) - K8s::Networking::IPAddress
+* [IPAddressList](/types/IPAddressList.md) - K8s::Networking::IPAddressList
+* [Issuer](/types/Issuer.md) - K8s::CertManager::Issuer
+* [JobList](/types/JobList.md) - K8s::Batch::JobList
+* [Kustomization](/types/Kustomization.md) - K8s::Flux::Kustomization
+* [Lease](/types/Lease.md) - K8s::Coordination::Lease
+* [LeaseCandidate](/types/LeaseCandidate.md) - K8s::Coordination::LeaseCandidate
+* [LeaseCandidateList](/types/LeaseCandidateList.md) - K8s::Coordination::LeaseCandidateList
+* [LeaseList](/types/LeaseList.md) - K8s::Coordination::LeaseList
+* [LimitRange](/types/LimitRange.md) - K8s::Core::LimitRange
+* [LimitRangeList](/types/LimitRangeList.md) - K8s::Core::LimitRangeList
+* [LocalSubjectAccessReview](/types/LocalSubjectAccessReview.md) - K8s::Authorization::LocalSubjectAccessReview
+* [MicroVM](/types/MicroVM.md) - K8s::KubeMicroVM::MicroVM
+* [MicroVMClass](/types/MicroVMClass.md) - K8s::KubeMicroVM::MicroVMClass
+* [MicroVMImage](/types/MicroVMImage.md) - K8s::KubeMicroVM::MicroVMImage
+* [MicroVMNetwork](/types/MicroVMNetwork.md) - K8s::KubeMicroVM::MicroVMNetwork
+* [MicroVMReplicaSet](/types/MicroVMReplicaSet.md) - K8s::KubeMicroVM::MicroVMReplicaSet
+* [Middleware](/types/Middleware.md) - K8s::Traefik::Middleware
+* [MiddlewareTCP](/types/MiddlewareTCP.md) - K8s::Traefik::MiddlewareTCP
+* [MutatingAdmissionPolicy](/types/MutatingAdmissionPolicy.md) - K8s::Admissionregistration::MutatingAdmissionPolicy
+* [MutatingAdmissionPolicyBinding](/types/MutatingAdmissionPolicyBinding.md) - K8s::Admissionregistration::MutatingAdmissionPolicyBinding
+* [MutatingAdmissionPolicyBindingList](/types/MutatingAdmissionPolicyBindingList.md) - K8s::Admissionregistration::MutatingAdmissionPolicyBindingList
+* [MutatingAdmissionPolicyList](/types/MutatingAdmissionPolicyList.md) - K8s::Admissionregistration::MutatingAdmissionPolicyList
+* [MutatingWebhookConfiguration](/types/MutatingWebhookConfiguration.md) - K8s::Admissionregistration::MutatingWebhookConfiguration
+* [MutatingWebhookConfigurationList](/types/MutatingWebhookConfigurationList.md) - K8s::Admissionregistration::MutatingWebhookConfigurationList
+* [Namespace](/types/Namespace.md) - K8s::Core::Namespace
+* [NamespaceList](/types/NamespaceList.md) - K8s::Core::NamespaceList
+* [NetPol](/types/NetPol.md) - K8s::Networking::NetworkPolicy
+* [NetworkPolicyList](/types/NetworkPolicyList.md) - K8s::Networking::NetworkPolicyList
+* [Node](/types/Node.md) - K8s::Core::Node
+* [NodeList](/types/NodeList.md) - K8s::Core::NodeList
+* [ObjectStore](/types/ObjectStore.md) - K8s::Cnpg::ObjectStore
+* [OCIRepository](/types/OCIRepository.md) - K8s::Flux::OCIRepository
+* [Order](/types/Order.md) - K8s::Acme::Order
+* [PDB](/types/PDB.md) - K8s::Policy::PodDisruptionBudget
+* [PersistentVolume](/types/PersistentVolume.md) - K8s::Core::PersistentVolume
+* [PersistentVolumeClaim](/types/PersistentVolumeClaim.md) - K8s::Core::PersistentVolumeClaim
+* [PersistentVolumeClaimList](/types/PersistentVolumeClaimList.md) - K8s::Core::PersistentVolumeClaimList
+* [PersistentVolumeList](/types/PersistentVolumeList.md) - K8s::Core::PersistentVolumeList
+* [Pod](/types/Pod.md) - K8s::Core::Pod
+* [PodCertificateRequest](/types/PodCertificateRequest.md) - K8s::Certificates::PodCertificateRequest
+* [PodCertificateRequestList](/types/PodCertificateRequestList.md) - K8s::Certificates::PodCertificateRequestList
+* [PodDisruptionBudgetList](/types/PodDisruptionBudgetList.md) - K8s::Policy::PodDisruptionBudgetList
+* [PodList](/types/PodList.md) - K8s::Core::PodList
+* [PodTemplate](/types/PodTemplate.md) - K8s::Core::PodTemplate
+* [PodTemplateList](/types/PodTemplateList.md) - K8s::Core::PodTemplateList
+* [Pooler](/types/Pooler.md) - K8s::Cnpg::Pooler
+* [PriorityClass](/types/PriorityClass.md) - K8s::Scheduling::PriorityClass
+* [PriorityClassList](/types/PriorityClassList.md) - K8s::Scheduling::PriorityClassList
+* [PriorityLevelConfiguration](/types/PriorityLevelConfiguration.md) - K8s::Flowcontrol::PriorityLevelConfiguration
+* [PriorityLevelConfigurationList](/types/PriorityLevelConfigurationList.md) - K8s::Flowcontrol::PriorityLevelConfigurationList
+* [PrometheusRule](/types/PrometheusRule.md) - K8s::Monitoring::PrometheusRule
+* [Provider](/types/Provider.md) - K8s::Flux::Provider
+* [RayCluster](/types/RayCluster.md) - K8s::Ray::RayCluster
+* [RayJob](/types/RayJob.md) - K8s::Ray::RayJob
+* [RayService](/types/RayService.md) - K8s::Ray::RayService
+* [Receiver](/types/Receiver.md) - K8s::Flux::Receiver
+* [ReferenceGrant](/types/ReferenceGrant.md) - K8s::Gateway::ReferenceGrant
+* [ReplicaSet](/types/ReplicaSet.md) - K8s::Apps::ReplicaSet
+* [ReplicaSetList](/types/ReplicaSetList.md) - K8s::Apps::ReplicaSetList
+* [ReplicationController](/types/ReplicationController.md) - K8s::Core::ReplicationController
+* [ReplicationControllerList](/types/ReplicationControllerList.md) - K8s::Core::ReplicationControllerList
+* [ResourceClaim](/types/ResourceClaim.md) - K8s::Resource::ResourceClaim
+* [ResourceClaimList](/types/ResourceClaimList.md) - K8s::Resource::ResourceClaimList
+* [ResourceClaimTemplate](/types/ResourceClaimTemplate.md) - K8s::Resource::ResourceClaimTemplate
+* [ResourceClaimTemplateList](/types/ResourceClaimTemplateList.md) - K8s::Resource::ResourceClaimTemplateList
+* [ResourceQuota](/types/ResourceQuota.md) - K8s::Core::ResourceQuota
+* [ResourceQuotaList](/types/ResourceQuotaList.md) - K8s::Core::ResourceQuotaList
+* [ResourceSet](/types/ResourceSet.md) - K8s::Flux::ResourceSet
+* [ResourceSetInputProvider](/types/ResourceSetInputProvider.md) - K8s::Flux::ResourceSetInputProvider
+* [ResourceSlice](/types/ResourceSlice.md) - K8s::Resource::ResourceSlice
+* [ResourceSliceList](/types/ResourceSliceList.md) - K8s::Resource::ResourceSliceList
+* [Role](/types/Role.md) - K8s::Rbac::Role
+* [RoleBinding](/types/RoleBinding.md) - K8s::Rbac::RoleBinding
+* [RoleBindingList](/types/RoleBindingList.md) - K8s::Rbac::RoleBindingList
+* [RoleList](/types/RoleList.md) - K8s::Rbac::RoleList
+* [RuntimeClass](/types/RuntimeClass.md) - K8s::Node::RuntimeClass
+* [RuntimeClassList](/types/RuntimeClassList.md) - K8s::Node::RuntimeClassList
+* [SA](/types/SA.md) - K8s::Core::ServiceAccount
+* [Scale](/types/Scale.md) - K8s::Autoscaling::Scale
+* [ScheduledBackup](/types/ScheduledBackup.md) - K8s::Cnpg::ScheduledBackup
+* [Sec](/types/Sec.md) - K8s::Core::Secret
+* [SecretList](/types/SecretList.md) - K8s::Core::SecretList
+* [SelfSubjectAccessReview](/types/SelfSubjectAccessReview.md) - K8s::Authorization::SelfSubjectAccessReview
+* [SelfSubjectReview](/types/SelfSubjectReview.md) - K8s::Authentication::SelfSubjectReview
+* [SelfSubjectRulesReview](/types/SelfSubjectRulesReview.md) - K8s::Authorization::SelfSubjectRulesReview
+* [ServersTransport](/types/ServersTransport.md) - K8s::Traefik::ServersTransport
+* [ServersTransportTCP](/types/ServersTransportTCP.md) - K8s::Traefik::ServersTransportTCP
+* [Service](/types/Service.md) - K8s::Core::Service
+* [ServiceAccountList](/types/ServiceAccountList.md) - K8s::Core::ServiceAccountList
+* [ServiceCIDR](/types/ServiceCIDR.md) - K8s::Networking::ServiceCIDR
+* [ServiceCIDRList](/types/ServiceCIDRList.md) - K8s::Networking::ServiceCIDRList
+* [ServiceList](/types/ServiceList.md) - K8s::Core::ServiceList
+* [ServiceMonitor](/types/ServiceMonitor.md) - K8s::Monitoring::ServiceMonitor
+* [StatefulSet](/types/StatefulSet.md) - K8s::Apps::StatefulSet
+* [StatefulSetList](/types/StatefulSetList.md) - K8s::Apps::StatefulSetList
+* [Status](/types/Status.md) - K8s::Core::Status
+* [StorageClass](/types/StorageClass.md) - K8s::Storage::StorageClass
+* [StorageClassList](/types/StorageClassList.md) - K8s::Storage::StorageClassList
+* [StorageVersionMigration](/types/StorageVersionMigration.md) - K8s::Storagemigration::StorageVersionMigration
+* [StorageVersionMigrationList](/types/StorageVersionMigrationList.md) - K8s::Storagemigration::StorageVersionMigrationList
+* [SubjectAccessReview](/types/SubjectAccessReview.md) - K8s::Authorization::SubjectAccessReview
+* [TLSOption](/types/TLSOption.md) - K8s::Traefik::TLSOption
+* [TLSStore](/types/TLSStore.md) - K8s::Traefik::TLSStore
+* [TokenRequest](/types/TokenRequest.md) - K8s::Authentication::TokenRequest
+* [TokenReview](/types/TokenReview.md) - K8s::Authentication::TokenReview
+* [TraefikService](/types/TraefikService.md) - K8s::Traefik::TraefikService
+* [ValidatingAdmissionPolicy](/types/ValidatingAdmissionPolicy.md) - K8s::Admissionregistration::ValidatingAdmissionPolicy
+* [ValidatingAdmissionPolicyBinding](/types/ValidatingAdmissionPolicyBinding.md) - K8s::Admissionregistration::ValidatingAdmissionPolicyBinding
+* [ValidatingAdmissionPolicyBindingList](/types/ValidatingAdmissionPolicyBindingList.md) - K8s::Admissionregistration::ValidatingAdmissionPolicyBindingList
+* [ValidatingAdmissionPolicyList](/types/ValidatingAdmissionPolicyList.md) - K8s::Admissionregistration::ValidatingAdmissionPolicyList
+* [ValidatingWebhookConfiguration](/types/ValidatingWebhookConfiguration.md) - K8s::Admissionregistration::ValidatingWebhookConfiguration
+* [ValidatingWebhookConfigurationList](/types/ValidatingWebhookConfigurationList.md) - K8s::Admissionregistration::ValidatingWebhookConfigurationList
+* [VolumeAttachment](/types/VolumeAttachment.md) - K8s::Storage::VolumeAttachment
+* [VolumeAttachmentList](/types/VolumeAttachmentList.md) - K8s::Storage::VolumeAttachmentList
+* [VolumeAttributesClass](/types/VolumeAttributesClass.md) - K8s::Storage::VolumeAttributesClass
+* [VolumeAttributesClassList](/types/VolumeAttributesClassList.md) - K8s::Storage::VolumeAttributesClassList
+* [WatchEvent](/types/WatchEvent.md) - K8s::Core::WatchEvent
+
+# Rules
+
+* [ARGO001](/rules/ARGO001.md) - Production Application must not enable automated prune
+* [ARGO002](/rules/ARGO002.md) - Application.spec.project must reference a declared AppProject (or the built-in default)
+* [ARGO003](/rules/ARGO003.md) - Application.spec.destination must reference a registered cluster or the in-cluster target
+* [ARGO004](/rules/ARGO004.md) - ApplicationSet template must scope to a single AppProject
+* [ARGO005](/rules/ARGO005.md) - Application source.path should resolve to an existing directory under the build root
+* [WK8001](/rules/WK8001.md) - Hardcoded Namespace
+* [WK8002](/rules/WK8002.md) - Latest Image Tag
+* [WK8003](/rules/WK8003.md) - Missing Resource Limits
+* [WK8005](/rules/WK8005.md) - Hardcoded secrets in env vars — sensitive environment variables should use secretKeyRef
+* [WK8006](/rules/WK8006.md) - No :latest or untagged images — container images should use explicit version tags
+* [WK8041](/rules/WK8041.md) - Hardcoded API keys — detects well-known API key patterns in env var values
+* [WK8042](/rules/WK8042.md) - Private keys in ConfigMap — private keys should be stored in Secrets, not ConfigMaps
+* [WK8101](/rules/WK8101.md) - Deployment selector must match template labels — mismatched selectors cause runtime failures
+* [WK8102](/rules/WK8102.md) - Resources should have metadata labels — labels enable filtering and operational tooling
+* [WK8103](/rules/WK8103.md) - Containers must have name — the name field is required by the Kubernetes API
+* [WK8104](/rules/WK8104.md) - Ports should be named — named ports improve Service and NetworkPolicy configuration
+* [WK8105](/rules/WK8105.md) - ImagePullPolicy should be explicit — avoids surprising default behavior
+* [WK8201](/rules/WK8201.md) - Resource limits required — containers should have CPU and memory limits
+* [WK8202](/rules/WK8202.md) - No privileged containers — privileged mode grants full host access
+* [WK8203](/rules/WK8203.md) - ReadOnlyRootFilesystem recommended — prevents runtime modification of the container image
+* [WK8204](/rules/WK8204.md) - RunAsNonRoot recommended — running as root increases container breakout risk
+* [WK8205](/rules/WK8205.md) - Drop ALL capabilities — containers should drop all capabilities and add only what is needed
+* [WK8207](/rules/WK8207.md) - No hostNetwork — using host network bypasses network isolation
+* [WK8208](/rules/WK8208.md) - No hostPID — sharing host PID namespace allows visibility into all host processes
+* [WK8209](/rules/WK8209.md) - No hostIPC — sharing host IPC namespace can expose shared memory segments
+* [WK8301](/rules/WK8301.md) - Probes required — containers should have livenessProbe and readinessProbe
+* [WK8302](/rules/WK8302.md) - Replicas >= 2 recommended — single-replica Deployments have no high availability
+* [WK8303](/rules/WK8303.md) - PDB recommended for HA Deployments — ensures availability during voluntary disruptions
+* [WK8304](/rules/WK8304.md) - SSL redirect without certificate — ssl-redirect annotation requires a valid certificate-arn and HTTPS listen-ports
+* [WK8305](/rules/WK8305.md) - Ingress port not matching Service — backend port must match a declared Service port
+* [WK8306](/rules/WK8306.md) - Container command starts with flag — first element should be a binary, not a flag
+* [WK8401](/rules/WK8401.md) - shmSize must not exceed the container memory limit — pod will not schedule if it does
+* [WK8402](/rules/WK8402.md) - RayCluster should set spec.rayVersion so KubeRay selects the correct autoscaler image
+* [WK8403](/rules/WK8403.md) - spec.rayVersion should match the Ray version in the head container image tag

package/dist/okf/rules/ARGO001.md

@@ -0,0 +1,16 @@
+---
+type: lint-rule
+title: ARGO001
+description: Production Application must not enable automated prune
+id: ARGO001
+severity: warning
+category: correctness
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Production Application must not enable automated prune
+
+## Applies to
+
+- [Application](/types/Application.md)
+- [Node](/types/Node.md)

package/dist/okf/rules/ARGO002.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: ARGO002
+description: Application.spec.project must reference a declared AppProject (or the built-in default)
+id: ARGO002
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Application.spec.project must reference a declared AppProject (or the built-in default)
+
+## Applies to
+
+- [Application](/types/Application.md)
+- [AppProject](/types/AppProject.md)

package/dist/okf/rules/ARGO003.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: ARGO003
+description: Application.spec.destination must reference a registered cluster or the in-cluster target
+id: ARGO003
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Application.spec.destination must reference a registered cluster or the in-cluster target
+
+## Applies to
+
+- [Application](/types/Application.md)

package/dist/okf/rules/ARGO004.md

@@ -0,0 +1,17 @@
+---
+type: lint-rule
+title: ARGO004
+description: ApplicationSet template must scope to a single AppProject
+id: ARGO004
+severity: warning
+category: correctness
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+ApplicationSet template must scope to a single AppProject
+
+## Applies to
+
+- [Application](/types/Application.md)
+- [ApplicationSet](/types/ApplicationSet.md)
+- [AppProject](/types/AppProject.md)

package/dist/okf/rules/ARGO005.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: ARGO005
+description: Application source.path should resolve to an existing directory under the build root
+id: ARGO005
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Application source.path should resolve to an existing directory under the build root
+
+## Applies to
+
+- [Application](/types/Application.md)

package/dist/okf/rules/WK8001.md

@@ -0,0 +1,16 @@
+---
+type: lint-rule
+title: WK8001
+description: Hardcoded Namespace
+id: WK8001
+severity: warning
+category: correctness
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Hardcoded Namespace
+
+## Applies to
+
+- [Namespace](/types/Namespace.md)
+- [Node](/types/Node.md)

package/dist/okf/rules/WK8002.md

@@ -0,0 +1,20 @@
+---
+type: lint-rule
+title: WK8002
+description: Latest Image Tag
+id: WK8002
+severity: warning
+category: security
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Latest Image Tag
+
+## Applies to
+
+- [CronJob](/types/CronJob.md)
+- [DaemonSet](/types/DaemonSet.md)
+- [Node](/types/Node.md)
+- [Pod](/types/Pod.md)
+- [ReplicaSet](/types/ReplicaSet.md)
+- [StatefulSet](/types/StatefulSet.md)

package/dist/okf/rules/WK8003.md

@@ -0,0 +1,19 @@
+---
+type: lint-rule
+title: WK8003
+description: Missing Resource Limits
+id: WK8003
+severity: warning
+category: correctness
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Missing Resource Limits
+
+## Applies to
+
+- [CronJob](/types/CronJob.md)
+- [DaemonSet](/types/DaemonSet.md)
+- [Node](/types/Node.md)
+- [ReplicaSet](/types/ReplicaSet.md)
+- [StatefulSet](/types/StatefulSet.md)

package/dist/okf/rules/WK8005.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8005
+description: Hardcoded secrets in env vars — sensitive environment variables should use secretKeyRef
+id: WK8005
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Hardcoded secrets in env vars — sensitive environment variables should use secretKeyRef

package/dist/okf/rules/WK8006.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8006
+description: No :latest or untagged images — container images should use explicit version tags
+id: WK8006
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+No :latest or untagged images — container images should use explicit version tags

package/dist/okf/rules/WK8041.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8041
+description: Hardcoded API keys — detects well-known API key patterns in env var values
+id: WK8041
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Hardcoded API keys — detects well-known API key patterns in env var values

package/dist/okf/rules/WK8042.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8042
+description: Private keys in ConfigMap — private keys should be stored in Secrets, not ConfigMaps
+id: WK8042
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Private keys in ConfigMap — private keys should be stored in Secrets, not ConfigMaps

package/dist/okf/rules/WK8101.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8101
+description: Deployment selector must match template labels — mismatched selectors cause runtime failures
+id: WK8101
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Deployment selector must match template labels — mismatched selectors cause runtime failures

package/dist/okf/rules/WK8102.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8102
+description: Resources should have metadata labels — labels enable filtering and operational tooling
+id: WK8102
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Resources should have metadata labels — labels enable filtering and operational tooling

package/dist/okf/rules/WK8103.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8103
+description: Containers must have name — the name field is required by the Kubernetes API
+id: WK8103
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Containers must have name — the name field is required by the Kubernetes API

package/dist/okf/rules/WK8104.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8104
+description: Ports should be named — named ports improve Service and NetworkPolicy configuration
+id: WK8104
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Ports should be named — named ports improve Service and NetworkPolicy configuration
+
+## Applies to
+
+- [Service](/types/Service.md)

package/dist/okf/rules/WK8105.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8105
+description: ImagePullPolicy should be explicit — avoids surprising default behavior
+id: WK8105
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+ImagePullPolicy should be explicit — avoids surprising default behavior

package/dist/okf/rules/WK8201.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8201
+description: Resource limits required — containers should have CPU and memory limits
+id: WK8201
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Resource limits required — containers should have CPU and memory limits

package/dist/okf/rules/WK8202.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8202
+description: No privileged containers — privileged mode grants full host access
+id: WK8202
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+No privileged containers — privileged mode grants full host access

package/dist/okf/rules/WK8203.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8203
+description: ReadOnlyRootFilesystem recommended — prevents runtime modification of the container image
+id: WK8203
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+ReadOnlyRootFilesystem recommended — prevents runtime modification of the container image

package/dist/okf/rules/WK8204.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8204
+description: RunAsNonRoot recommended — running as root increases container breakout risk
+id: WK8204
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+RunAsNonRoot recommended — running as root increases container breakout risk

package/dist/okf/rules/WK8205.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8205
+description: Drop ALL capabilities — containers should drop all capabilities and add only what is needed
+id: WK8205
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Drop ALL capabilities — containers should drop all capabilities and add only what is needed

package/dist/okf/rules/WK8207.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8207
+description: No hostNetwork — using host network bypasses network isolation
+id: WK8207
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+No hostNetwork — using host network bypasses network isolation