@intentius/chant-lexicon-k8s 0.41.4 → 0.41.5

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAGtG,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAkBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA0BvD;AAgED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAetE;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAuH5B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAGtG,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA0BvD;AAgED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAetE;AAQD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CAmI5B"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "5f1a15a53cfc8e71e5472c94d89b7880a5f703b96979191a5c5f2c1774d156dd",
+    "manifest.json": "9cd5bebf0d9b42505b9b15cbde474c7ed1934e615d7d92b20459e0e6bfc850c7",
     "meta.json": "c0b141b882c51483c1d1aead748a0eb171aceca7432edd2a0404b062bf6d7831",
     "types/index.d.ts": "3be2af7494aca94adfa16269cb9c4e7a155529872207a3d70b0c4d39914f9eec",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -50,5 +50,5 @@
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
     "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5"
   },
-  "composite": "1662e74e96d14ad3c614e8b38df06cc8266bbfbfdfa1aa769d88ee2a4abd0a4b"
+  "composite": "4b8491693100b59644a7d1794d71ee06dfa702c9ab9f85ea5552c356e6c3bff6"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.41.4",
+  "version": "0.41.5",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.4",
+  "version": "0.41.5",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.4",
+    "@intentius/chant": "^0.41.5",
     "typescript": "^5.9.3"
   }
 }

package/src/describe-resources.test.ts

@@ -508,6 +508,96 @@ describe("k8s describeResources", () => {
 
   // ── Runtime children: owner-reference chain classification (chant #1077) ──
 
+  describe("runtime children of the estate's own API groups (#1517)", () => {
+    function declaredCronJob() {
+      return makeEntities([
+        { name: "backup", entityType: "K8s::Batch::CronJob", props: { metadata: { name: "backup", namespace: "prod" } } },
+      ]);
+    }
+    const cronJob = {
+      apiVersion: "batch/v1",
+      kind: "CronJob",
+      metadata: { name: "backup", namespace: "prod", uid: "cj-uid" },
+    };
+
+    test("a controller-made child in a declared non-core group surfaces with its own kind and a declared chain", async () => {
+      const job = {
+        apiVersion: "batch/v1",
+        kind: "Job",
+        metadata: {
+          name: "backup-29157",
+          namespace: "prod",
+          uid: "job-uid",
+          ownerReferences: [{ apiVersion: "batch/v1", kind: "CronJob", name: "backup", uid: "cj-uid", controller: true }],
+        },
+        status: { conditions: [{ type: "Complete", status: "True" }] },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("batch/v1", "CronJob", "backup", "prod")]: cronJob,
+          [objectKey("batch/v1", "Job", "backup-29157", "prod")]: job,
+        },
+      });
+
+      const result = await describeResources(
+        { environment: "prod", buildOutput: "", entityNames: ["backup"], entities: declaredCronJob() },
+        cluster.connector,
+      );
+
+      const child = result.resources["prod/backup-29157"];
+      expect(child).toMatchObject({
+        type: "K8s::Batch::Job",
+        physicalId: "job-uid",
+        ownerChain: { root: "declared", entity: "backup" },
+      });
+    });
+
+    test("a loose object in a swept group with no owner chain is NOT reported — the scan is not an inventory", async () => {
+      const looseJob = {
+        apiVersion: "batch/v1",
+        kind: "Job",
+        metadata: { name: "hand-made", namespace: "prod", uid: "loose-uid" },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("batch/v1", "CronJob", "backup", "prod")]: cronJob,
+          [objectKey("batch/v1", "Job", "hand-made", "prod")]: looseJob,
+        },
+      });
+
+      const result = await describeResources(
+        { environment: "prod", buildOutput: "", entityNames: ["backup"], entities: declaredCronJob() },
+        cluster.connector,
+      );
+
+      expect(result.resources["prod/hand-made"]).toBeUndefined();
+    });
+
+    test("a core-only estate sweeps no extra groups — Pods stay the core representative", async () => {
+      const svc = { apiVersion: "v1", kind: "Service", metadata: { name: "web", namespace: "prod", uid: "svc-uid" } };
+      const cluster = fakeCluster({
+        objects: { [objectKey("v1", "Service", "web", "prod")]: svc },
+      });
+
+      await describeResources(
+        {
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["web"],
+          entities: makeEntities([
+            { name: "web", entityType: "K8s::Core::Service", props: { metadata: { name: "web", namespace: "prod" } } },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      // Discovery was consulted for no non-core groupVersion: the only list
+      // sweeps are the namespace's pods.
+      const groupDiscovery = cluster.layer.paths().filter((p) => /^\/apis\/[^/]+\/[^/]+$/.test(p) && !p.includes("namespaces"));
+      expect(groupDiscovery.filter((p) => !p.startsWith("/apis/apps"))).toEqual([]);
+    });
+  });
+
   describe("runtime children (#1077)", () => {
     function declaredDeployment() {
       return makeEntities([

package/src/describe-resources.ts

@@ -65,6 +65,7 @@ import {
 } from "./api/classify";
 import { operationFor } from "./api/operation-surface";
 import { resolveK8sOwnerChain } from "./api/owner-chain";
+import { gvkToTypeName } from "./spec/parse";
 
 function pruneUndefined<T extends Record<string, unknown>>(obj: T): Record<string, unknown> {
   const out: Record<string, unknown> = {};
@@ -320,26 +321,50 @@ export async function describeResources(
     }
   });
 
-  await addRuntimeChildren(client, resources, options.owned);
+  // chant #1517 — the API groups this estate's own declarations use. A
+  // controller's children usually live in its controller's group (a
+  // MicroVMReplicaSet makes MicroVMs), so the runtime scan sweeps those
+  // groupVersions' kinds besides Pods. Core (`v1`) is excluded from the group
+  // sweep — Pods represent it; sweeping every core kind would walk endpoints
+  // and events for nothing.
+  const runtimeGroupVersions = new Set<string>();
+  for (const { entityType } of declared) {
+    const op = operationFor(entityType);
+    if (op && op.apiVersion.includes("/")) runtimeGroupVersions.add(op.apiVersion);
+  }
+
+  await addRuntimeChildren(client, resources, options.owned, runtimeGroupVersions);
 
   return observation(resources, unobserved);
 }
 
 /**
- * Scan Pods in the namespaces of entities this call just resolved, and
- * classify each one's owner-reference chain (#1077). Mutates `resources` in
- * place, adding an entry per Pod whose chain was worth reporting.
+ * Scan runtime-child candidates in the namespaces of entities this call just
+ * resolved, and classify each one's owner-reference chain (#1077). Mutates
+ * `resources` in place, adding an entry per object whose chain was worth
+ * reporting.
+ *
+ * Two candidate pools:
+ *  - **Pods** — the built-in workload leaf, always scanned.
+ *  - **The estate's own API groups** (#1517) — every namespaced, listable
+ *    kind in each `groupVersions` entry, from the cluster's own discovery.
+ *    An operator estate's interesting children are custom resources its
+ *    controllers made (a MicroVMReplicaSet's MicroVMs), which no kind table
+ *    could anticipate — the same open-world inversion behold#74 made for
+ *    declared CRDs, applied to the runtime axis. Bounded by what the estate
+ *    declares, never a cluster-wide sweep.
  *
- * Best-effort and additive: a namespace this scan cannot list (RBAC denial,
- * a transient error) is simply skipped rather than failing the observation —
- * Pods are not declared entities, so there is no NOT-OBSERVED axis for them
- * to report against, the same way an out-of-band AWS child resource has none
- * either.
+ * Best-effort and additive: a namespace or kind this scan cannot list (RBAC
+ * denial, a transient error) is simply skipped rather than failing the
+ * observation — these are not declared entities, so there is no NOT-OBSERVED
+ * axis for them to report against, the same way an out-of-band AWS child
+ * resource has none either.
  */
 async function addRuntimeChildren(
   client: K8sClient,
   resources: Record<string, ResourceMetadata>,
   owned: boolean | undefined,
+  groupVersions: ReadonlySet<string> = new Set(),
 ): Promise<void> {
   const declaredByUid = new Map<string, string>();
   for (const [entityName, meta] of Object.entries(resources)) {
@@ -353,42 +378,73 @@ async function addRuntimeChildren(
   }
   if (namespaces.size === 0) return;
 
-  await client.concurrently([...namespaces], async (namespace) => {
-    let pods: K8sObject[];
+  // The kinds to scan: Pods, plus each declared groupVersion's namespaced,
+  // listable kinds from discovery (#1517). A groupVersion the cluster does
+  // not serve contributes nothing — an answer, not a failure.
+  const kinds: Array<{ apiVersion: string; kind: string; typeName: string }> = [
+    { apiVersion: "v1", kind: "Pod", typeName: "K8s::Core::Pod" },
+  ];
+  for (const gv of [...groupVersions].sort()) {
+    let infos;
     try {
-      pods = await client.list({ apiVersion: "v1", kind: "Pod" }, { namespace });
+      infos = await client.resources(gv);
     } catch {
-      return; // best-effort — see the function doc
+      continue; // best-effort — see the function doc
+    }
+    const [group, version] = [gv.slice(0, gv.indexOf("/")), gv.slice(gv.indexOf("/") + 1)];
+    for (const info of infos) {
+      if (!info.namespaced || !info.verbs.includes("list")) continue;
+      kinds.push({ apiVersion: gv, kind: info.kind, typeName: gvkToTypeName({ group, version, kind: info.kind }) });
     }
+  }
 
-    await client.concurrently(pods, async (pod) => {
-      const uid = pod.metadata?.uid;
-      const name = pod.metadata?.name;
-      if (!uid || !name || declaredByUid.has(uid)) return; // declared directly, or unaddressable
-
-      const ownerChain = await resolveK8sOwnerChain(pod, { declaredByUid, reader: client, namespace });
-
-      // `--owned`: withhold a Pod that is neither a runtime child of a
-      // declared entity nor carrying chant's own marker — the same rule the
-      // declared-entity read above applies, extended to the undeclared axis
-      // this scan introduces.
-      const marker = hasOwnershipMarker(pod.metadata?.labels, LABEL_OWNERSHIP_KEYS);
-      if (owned && ownerChain.root !== "declared" && !marker) return;
-
-      resources[`${namespace}/${name}`] = {
-        type: "K8s::Core::Pod",
-        physicalId: uid,
-        status: statusFromObject(pod),
-        lastUpdated: pod.metadata?.creationTimestamp,
-        ownership: classifyOwnership(pod.metadata?.labels, LABEL_OWNERSHIP_KEYS),
-        ownerChain,
-        attributes: pruneUndefined({
-          namespace,
-          labels: pod.metadata?.labels,
-          resourceVersion: pod.metadata?.resourceVersion,
-          conditions: unhappyConditions(pod),
-        }),
-      };
-    });
+  await client.concurrently([...namespaces], async (namespace) => {
+    for (const { apiVersion, kind, typeName } of kinds) {
+      let objects: K8sObject[];
+      try {
+        objects = await client.list({ apiVersion, kind }, { namespace });
+      } catch {
+        continue; // best-effort — see the function doc
+      }
+
+      await client.concurrently(objects, async (obj) => {
+        const uid = obj.metadata?.uid;
+        const name = obj.metadata?.name;
+        if (!uid || !name || declaredByUid.has(uid)) return; // declared directly, or unaddressable
+        if (resources[`${namespace}/${name}`]) return; // already reported by an earlier kind
+
+        const ownerChain = await resolveK8sOwnerChain(obj, { declaredByUid, reader: client, namespace });
+
+        // `--owned`: withhold an object that is neither a runtime child of a
+        // declared entity nor carrying chant's own marker — the same rule the
+        // declared-entity read above applies, extended to the undeclared axis
+        // this scan introduces.
+        const marker = hasOwnershipMarker(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS);
+        if (owned && ownerChain.root !== "declared" && !marker) return;
+
+        // An undeclared object with NO owner chain at all is not a runtime
+        // child — reporting every loose object a group serves would turn the
+        // scan into an inventory. Pods keep their pre-#1517 reporting (their
+        // chain verdicts, including foreign, were already part of #1077's
+        // contract); swept group kinds only report when the chain reaches a
+        // declared entity.
+        if (kind !== "Pod" && ownerChain.root !== "declared") return;
+
+        resources[`${namespace}/${name}`] = {
+          type: typeName,
+          physicalId: uid,
+          status: statusFromObject(obj),
+          lastUpdated: obj.metadata?.creationTimestamp,
+          ownership: classifyOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
+          ownerChain,
+          attributes: pruneUndefined({
+            namespace,
+            labels: obj.metadata?.labels,
+            resourceVersion: obj.metadata?.resourceVersion,
+            conditions: unhappyConditions(obj),
+          }),
+        };
+      });
+    }
   });
 }