@intentius/chant-lexicon-k8s 0.42.1 → 0.44.2

package/src/kustomize/root.test.ts

@@ -0,0 +1,268 @@
+/**
+ * Kustomize build roots (#1548 piece 3). What must hold: a configured root
+ * renders through the shared runner (kustomize first, kubectl fallback) and
+ * its documents become verbatim manifest entities that reach the BUILD
+ * output — serialized by the k8s serializer with ownership stamped, carrying
+ * the overlay-dir provenance annotation, visible to post-synth checks — and
+ * the offline failure modes are sentences naming the problem (the dir, the
+ * kustomization file, the binaries), never a stack trace out of a subprocess.
+ */
+import { describe, test, expect } from "vitest";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { mkdir, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { build } from "@intentius/chant";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { renderKustomizeRoots } from "./root";
+import { renderCommand } from "./render";
+import { KUSTOMIZE_ROOT_ANNOTATION, isRenderedManifestEntity } from "./rendered-entity";
+import { k8sSerializer } from "../serializer";
+import { k8sPlugin } from "../plugin";
+import { wk8005 } from "../lint/post-synth/wk8005";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const fixtureRoot = join(here, "..", "testdata", "kustomize-root");
+
+/** What `kustomize build overlays/prod` over the fixture would emit. */
+const RENDERED = `apiVersion: v1
+kind: Service
+metadata:
+  name: prod-web
+spec:
+  ports:
+    - port: 80
+  selector:
+    app: web
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prod-web
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: web
+  template:
+    metadata:
+      labels:
+        app: web
+    spec:
+      containers:
+        - name: web
+          image: nginx:1.27
+          env:
+            - name: DB_PASSWORD
+              value: hunter2
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: prod-web-tls
+spec:
+  secretName: prod-web-tls
+  dnsNames:
+    - web.example.com
+`;
+
+const cannedRunner = (commands: string[]) => async (command: string) => {
+  commands.push(command);
+  return { stdout: RENDERED };
+};
+
+describe("renderKustomizeRoots", () => {
+  test("renders a configured root into verbatim entities with deterministic keys and provenance", async () => {
+    const commands: string[] = [];
+    const { entities, warnings } = await renderKustomizeRoots({
+      projectRoot: fixtureRoot,
+      roots: ["overlays/prod"],
+      run: cannedRunner(commands),
+    });
+
+    expect(commands).toEqual([renderCommand(join(fixtureRoot, "overlays/prod"), "kustomize")]);
+    expect(warnings).toEqual([]);
+    expect([...entities.keys()]).toEqual([
+      "overlays/prod/serviceProdWeb",
+      "overlays/prod/deploymentProdWeb",
+      "overlays/prod/certificateProdWebTls",
+    ]);
+
+    const deployment = entities.get("overlays/prod/deploymentProdWeb")!;
+    expect(isRenderedManifestEntity(deployment)).toBe(true);
+    expect(deployment.lexicon).toBe("k8s");
+    // The generated operation surface's naming, so `lifecycle diff --live`
+    // observes a rendered Deployment through the same reader a declared one uses.
+    expect(deployment.entityType).toBe("K8s::Apps::Deployment");
+    expect(entities.get("overlays/prod/certificateProdWebTls")!.entityType).toBe("K8s::Cert-manager::Certificate");
+
+    const props = (deployment as unknown as { props: Record<string, unknown> }).props;
+    const metadata = props.metadata as { annotations: Record<string, string> };
+    expect(metadata.annotations[KUSTOMIZE_ROOT_ANNOTATION]).toBe("overlays/prod");
+    expect((props.spec as { replicas: number }).replicas).toBe(3);
+  });
+
+  test("falls back to kubectl's vendored kustomize when the standalone binary is missing", async () => {
+    const commands: string[] = [];
+    const { entities } = await renderKustomizeRoots({
+      projectRoot: fixtureRoot,
+      roots: ["overlays/prod"],
+      run: async (command) => {
+        commands.push(command);
+        if (command.startsWith("kustomize ")) throw new Error("spawn kustomize ENOENT");
+        return { stdout: RENDERED };
+      },
+    });
+    const dir = join(fixtureRoot, "overlays/prod");
+    expect(commands).toEqual([renderCommand(dir, "kustomize"), renderCommand(dir, "kubectl")]);
+    expect(entities.size).toBe(3);
+  });
+
+  test("both binaries missing fails with a message naming them, not a stack trace", async () => {
+    await expect(
+      renderKustomizeRoots({
+        projectRoot: fixtureRoot,
+        roots: ["overlays/prod"],
+        run: async (command) => {
+          throw new Error(command.startsWith("kustomize ") ? "spawn kustomize ENOENT" : "spawn kubectl ENOENT");
+        },
+      }),
+    ).rejects.toThrow(/neither the `kustomize` binary nor `kubectl`.*found on PATH/);
+  });
+
+  test("a root that does not exist refuses before any subprocess runs", async () => {
+    let ran = false;
+    await expect(
+      renderKustomizeRoots({
+        projectRoot: fixtureRoot,
+        roots: ["overlays/staging"],
+        run: async () => {
+          ran = true;
+          return { stdout: "" };
+        },
+      }),
+    ).rejects.toThrow(/overlays\/staging.*directory not found/);
+    expect(ran).toBe(false);
+  });
+
+  test("a dir without a kustomization file refuses, naming the expected files", async () => {
+    await expect(
+      renderKustomizeRoots({
+        projectRoot: fixtureRoot,
+        roots: ["base/../.."], // the testdata parent — exists, holds no kustomization
+        run: async () => ({ stdout: "" }),
+      }),
+    ).rejects.toThrow(/no kustomization file.*kustomization\.yaml/);
+  });
+
+  test("a rendered document without apiVersion/kind is skipped with a warning", async () => {
+    const { entities, warnings } = await renderKustomizeRoots({
+      projectRoot: fixtureRoot,
+      roots: ["overlays/prod"],
+      run: async () => ({ stdout: "just: data\n---\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: web\n" }),
+    });
+    expect(warnings).toHaveLength(1);
+    expect(warnings[0]).toContain("without apiVersion/kind");
+    expect([...entities.keys()]).toEqual(["overlays/prod/namespaceWeb"]);
+  });
+});
+
+describe("kustomize roots through the build pipeline", () => {
+  test("rendered docs reach the build output, ownership-stamped, and post-synth checks fire on them", async () => {
+    // An empty source dir: the estate keeps its overlay tree and declares no
+    // typed manifest — the whole point of a build root.
+    const srcDir = join(tmpdir(), `kustomize-root-int-${Date.now()}-${Math.random()}`);
+    await mkdir(srcDir, { recursive: true });
+    try {
+      const result = await build(srcDir, [k8sSerializer], undefined, {
+        ownership: { stack: "web", env: "prod" },
+        buildRoots: [
+          () =>
+            renderKustomizeRoots({
+              projectRoot: fixtureRoot,
+              roots: ["overlays/prod"],
+              run: cannedRunner([]),
+            }),
+        ],
+      });
+
+      expect(result.errors).toEqual([]);
+      expect(result.entities.size).toBe(3);
+
+      const output = result.outputs.get("k8s");
+      expect(output).toBeDefined();
+      const yaml = typeof output === "string" ? output : output!.primary;
+
+      // Verbatim manifests, ownership stamped by the serializer's normal merge.
+      expect(yaml).toContain("kind: Deployment");
+      expect(yaml).toContain("name: prod-web");
+      expect(yaml).toContain("app.kubernetes.io/managed-by: chant");
+      expect(yaml).toContain("chant.intentius.io/stack: web");
+      // Provenance names the overlay the doc came from.
+      expect(yaml).toContain(`${KUSTOMIZE_ROOT_ANNOTATION}: overlays/prod`);
+      // Render-final shape survives: the CRD instance keeps its own spec.
+      expect(yaml).toContain("kind: Certificate");
+      expect(yaml).toContain("secretName: prod-web-tls");
+
+      // Post-synth checks see the rendered docs like any other manifests —
+      // the fixture Deployment hardcodes a sensitive env var, so WK8005 fires.
+      const ctx: PostSynthContext = {
+        outputs: result.outputs,
+        entities: result.entities,
+        buildResult: {
+          outputs: result.outputs,
+          entities: result.entities,
+          warnings: result.warnings,
+          errors: [],
+          sourceFileCount: result.sourceFileCount,
+        },
+      };
+      const diagnostics = wk8005.check(ctx);
+      expect(diagnostics.some((d) => d.message.includes("DB_PASSWORD"))).toBe(true);
+    } finally {
+      await rm(srcDir, { recursive: true, force: true });
+    }
+  });
+
+  test("a missing renderer surfaces as a build error naming the binaries", async () => {
+    const srcDir = join(tmpdir(), `kustomize-root-miss-${Date.now()}-${Math.random()}`);
+    await mkdir(srcDir, { recursive: true });
+    try {
+      const result = await build(srcDir, [k8sSerializer], undefined, {
+        buildRoots: [
+          () =>
+            renderKustomizeRoots({
+              projectRoot: fixtureRoot,
+              roots: ["overlays/prod"],
+              run: async () => {
+                throw new Error("spawn kustomize ENOENT");
+              },
+            }),
+        ],
+      });
+      expect(result.errors).toHaveLength(1);
+      expect(result.errors[0].message).toContain("neither the `kustomize` binary nor `kubectl`");
+    } finally {
+      await rm(srcDir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("k8sPlugin.buildRoots", () => {
+  test("no configured roots contributes nothing", async () => {
+    const contribution = await k8sPlugin.buildRoots!({ projectRoot: fixtureRoot, config: {} });
+    expect(contribution.entities.size).toBe(0);
+  });
+
+  test("reads k8s.kustomize.roots from the project config namespace", async () => {
+    // The real hook uses the subprocess runner, so only the config plumbing is
+    // asserted here: a configured root that fails its offline existence check
+    // proves the hook read the namespace (no subprocess involved).
+    await expect(
+      k8sPlugin.buildRoots!({
+        projectRoot: fixtureRoot,
+        config: { k8s: { kustomize: { roots: ["overlays/missing"] } } },
+      }),
+    ).rejects.toThrow(/overlays\/missing.*directory not found/);
+  });
+});

package/src/kustomize/root.ts

@@ -0,0 +1,109 @@
+/**
+ * Kustomize build roots (#1548 piece 3).
+ *
+ * An estate that keeps its overlay tree has no typed chant source for those
+ * manifests — and piece 4 (a declarable Kustomization) is parked precisely
+ * because forcing a modelling migration onto every kustomize estate is the
+ * mistake behold#138 documented. What such an estate CAN declare is the
+ * directory: `k8s.kustomize.roots` in `chant.config.ts` names kustomization
+ * dirs that render at build time into the manifest set. The rendered
+ * documents become entities (see `./rendered-entity.ts`), so they are
+ * serialized into the build output, ownership-stamped, seen by post-synth
+ * checks, and observed by `lifecycle diff --live` — the declared side an
+ * overlay estate never had.
+ *
+ * Renders through the same injectable runner the `kustomize-apply`
+ * capability uses (`./render.ts`): `kustomize build`, `kubectl kustomize`
+ * fallback, and a both-binaries-missing failure that names them. Two
+ * build-time guarantees on top:
+ *
+ * - **Deterministic**: entity names derive from the root dir plus each
+ *   document's kind/name/namespace, disambiguated in render order — the same
+ *   overlay renders the same entity set every build.
+ * - **Fail loudly, not weirdly**: a root that doesn't exist, or a dir with no
+ *   kustomization file, refuses with the path in the message before any
+ *   subprocess runs — offline, the failure mode is a sentence, never a
+ *   render attempt's stack trace.
+ */
+import { existsSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import type { Declarable } from "@intentius/chant/declarable";
+import { defaultKustomizeRunner, renderKustomizeDocuments, type KustomizeRunner } from "./render";
+import { renderedManifestEntity } from "./rendered-entity";
+
+const KUSTOMIZATION_FILES = ["kustomization.yaml", "kustomization.yml", "Kustomization"];
+
+export interface KustomizeRootsResult {
+  entities: Map<string, Declarable>;
+  warnings: string[];
+}
+
+/** `Deployment` + `my-app` → `deploymentMyApp`, the import path's naming. */
+function logicalId(kind: string, name: string | undefined): string {
+  const prefix = kind.charAt(0).toLowerCase() + kind.slice(1);
+  if (!name) return prefix;
+  const pascal = name
+    .split(/[^a-zA-Z0-9]+/)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join("");
+  return `${prefix}${pascal}`;
+}
+
+/**
+ * Render each configured kustomization root into entities, keyed
+ * `<root>/<kindName>` (namespace-qualified, then numbered, on collision).
+ */
+export async function renderKustomizeRoots(opts: {
+  /** Directory the project config was loaded from; relative roots resolve against it. */
+  projectRoot: string;
+  /** `k8s.kustomize.roots` — kustomization dirs, usually relative. */
+  roots: readonly string[];
+  /** Injectable renderer (tests); defaults to the real subprocess runner. */
+  run?: KustomizeRunner;
+}): Promise<KustomizeRootsResult> {
+  const run = opts.run ?? defaultKustomizeRunner;
+  const entities = new Map<string, Declarable>();
+  const warnings: string[] = [];
+
+  for (const root of opts.roots) {
+    const rootDir = isAbsolute(root) ? root : resolve(opts.projectRoot, root);
+    // The label rendered docs carry as provenance: the declared (relative)
+    // form when possible, so it names the overlay the way the config does.
+    const rootLabel = isAbsolute(root) ? (relative(opts.projectRoot, root) || ".") : root;
+
+    if (!existsSync(rootDir)) {
+      throw new Error(`k8s.kustomize.roots entry "${root}": directory not found at ${rootDir}`);
+    }
+    if (!KUSTOMIZATION_FILES.some((f) => existsSync(join(rootDir, f)))) {
+      throw new Error(
+        `k8s.kustomize.roots entry "${root}": ${rootDir} contains no kustomization file ` +
+          `(expected one of ${KUSTOMIZATION_FILES.join(", ")})`,
+      );
+    }
+
+    const documents = await renderKustomizeDocuments(rootDir, run);
+    for (const doc of documents) {
+      const entity = renderedManifestEntity(doc, rootLabel);
+      if (!entity) {
+        warnings.push(`kustomize root "${rootLabel}" rendered a document without apiVersion/kind — skipped`);
+        continue;
+      }
+      const metadata = entity.props.metadata as Record<string, unknown>;
+      const kind = entity.props.kind as string;
+      const name = typeof metadata.name === "string" ? metadata.name : undefined;
+      const namespace = typeof metadata.namespace === "string" ? metadata.namespace : undefined;
+
+      // Deterministic, human-readable keys. Two documents can share
+      // kind+name (different namespaces, or different API groups with the
+      // same kind word) — qualify by namespace first, then number.
+      const base = `${rootLabel}/${logicalId(kind, name)}`;
+      let key = base;
+      if (entities.has(key) && namespace) key = `${base}.${namespace}`;
+      for (let n = 2; entities.has(key); n++) key = `${base}~${n}`;
+      entities.set(key, entity);
+    }
+  }
+
+  return { entities, warnings };
+}

package/src/lint/audit-catalog.ts

@@ -8,6 +8,8 @@ export const k8sAuditCatalog: Record<string, RuleMeta> = {
   ARGO002: auditRule("ARGO002", "merge-worthy", "guidance", "Argo Application references an undeclared AppProject", "Declare the named AppProject or reference an existing project.", { category: "correctness" }),
   ARGO003: auditRule("ARGO003", "merge-worthy", "guidance", "Argo Application targets an unregistered cluster", "Point spec.destination at a registered cluster or the in-cluster target.", { category: "correctness" }),
   ARGO005: auditRule("ARGO005", "report-only", "guidance", "Argo source.path may not resolve", "Ensure the source path exists under the build root.", { category: "best-practice" }),
+  FLUX002: auditRule("FLUX002", "merge-worthy", "guidance", "Flux Kustomization references an undeclared source", "Declare the GitRepository/OCIRepository/Bucket, or point sourceRef at the bootstrap flux-system repo.", { category: "correctness" }),
+  FLUX003: auditRule("FLUX003", "report-only", "guidance", "Flux Kustomization dependsOn names an undeclared Kustomization", "Fix the dependsOn name, or ignore if the dependency is declared in another repo.", { category: "correctness" }),
   WK8005: auditRule("WK8005", "merge-worthy", "guidance", "Hardcoded secret in env var", "Use a secretKeyRef instead of a literal value, and rotate the secret.", { authority: [K8S_SECRETS] }),
   WK8006: auditRule("WK8006", "merge-worthy", "guidance", "Image uses :latest or no tag", "Pin the image to an explicit version tag (ideally a digest).", { authority: [SCORECARD_PINNED] }),
   WK8041: auditRule("WK8041", "merge-worthy", "guidance", "Hardcoded API key in env var", "Move the key to a Secret and rotate it.", { authority: [K8S_SECRETS] }),

package/src/lint/post-synth/argo-helpers.ts

@@ -1,5 +1,7 @@
 /**
  * Shared helpers for the Argo post-synth checks (ARGO002, ARGO003, ARGO005).
+ * The generic manifest collectors (`allManifests`, `manifestsOfKind`) are
+ * shared by the Flux checks (FLUX002, FLUX003) too.
  *
  * Excluded from check auto-discovery by the "helper" filename filter.
  */

package/src/lint/post-synth/flux002.ts

@@ -0,0 +1,77 @@
+/**
+ * FLUX002: Kustomization.spec.sourceRef must reference a declared source
+ *
+ * A Flux `Kustomization` names its source in `spec.sourceRef` — a
+ * `GitRepository`, `OCIRepository`, or `Bucket` the source-controller fetches.
+ * If the referenced source isn't declared in the build, the
+ * kustomize-controller waits on an artifact that never arrives and the
+ * Kustomization stalls. The bootstrap-created `flux-system` GitRepository
+ * always exists on a bootstrapped cluster, so a reference to it is never
+ * flagged — the Flux analogue of ARGO002's built-in `default` project.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { allManifests, manifestsOfKind } from "./argo-helpers";
+
+/** Source kinds the kustomize-controller can reconcile from. */
+const SOURCE_KINDS = ["GitRepository", "OCIRepository", "Bucket"] as const;
+
+/** The GitRepository `flux bootstrap` creates alongside the controllers. */
+const BOOTSTRAP_SOURCE_NAME = "flux-system";
+
+export const flux002: PostSynthCheck = {
+  id: "FLUX002",
+  description: "Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const manifests = allManifests(ctx);
+
+    // Declared sources, keyed "Kind/name". Namespace is deliberately ignored:
+    // an unset sourceRef.namespace resolves in the Kustomization's own, and
+    // the common estate keeps everything in flux-system anyway.
+    const declaredSources = new Set<string>();
+    for (const kind of SOURCE_KINDS) {
+      for (const source of manifestsOfKind(manifests, kind)) {
+        const name = source.metadata?.name;
+        if (typeof name === "string") declaredSources.add(`${kind}/${name}`);
+      }
+    }
+
+    for (const kustomization of manifestsOfKind(manifests, "Kustomization")) {
+      // Flux and kustomize.config.k8s.io share the kind name; only the Flux CR
+      // carries a sourceRef-bearing spec.
+      const apiVersion = kustomization.apiVersion;
+      if (typeof apiVersion === "string" && !apiVersion.startsWith("kustomize.toolkit.fluxcd.io/")) continue;
+
+      const name = kustomization.metadata?.name ?? "Kustomization";
+      const sourceRef = kustomization.spec?.sourceRef as
+        | { kind?: unknown; name?: unknown }
+        | undefined;
+
+      if (!sourceRef || typeof sourceRef.name !== "string" || sourceRef.name === "") {
+        diagnostics.push({
+          checkId: "FLUX002",
+          severity: "error",
+          message: `Kustomization "${name}" has no spec.sourceRef.name — the kustomize-controller cannot resolve a source.`,
+          entity: name,
+          lexicon: "k8s",
+        });
+        continue;
+      }
+
+      const kind = typeof sourceRef.kind === "string" && sourceRef.kind !== "" ? sourceRef.kind : "GitRepository";
+      if (kind === "GitRepository" && sourceRef.name === BOOTSTRAP_SOURCE_NAME) continue;
+      if (declaredSources.has(`${kind}/${sourceRef.name}`)) continue;
+
+      diagnostics.push({
+        checkId: "FLUX002",
+        severity: "error",
+        message: `Kustomization "${name}" references ${kind} "${sourceRef.name}", which is not declared. Declare the source (e.g. FluxGitSource) or point sourceRef at the bootstrap flux-system repo.`,
+        entity: name,
+        lexicon: "k8s",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/flux003.ts

@@ -0,0 +1,75 @@
+/**
+ * FLUX003: Kustomization.spec.dependsOn entries should name declared Kustomizations
+ *
+ * `dependsOn` is Flux's reconcile-ordering edge: the Kustomization stays
+ * pending until every named Kustomization is ready. The names are plain
+ * strings with no referential integrity — a typo, or an entry left behind
+ * after a rename, stalls the app silently. This check joins each entry
+ * against the Kustomizations the build actually declares.
+ *
+ * It is a warning, not an error: estates legitimately split infra and apps
+ * across repos, so a dependency (say `cert-manager`) may be declared by a
+ * build this one never sees. A self-referencing entry is flagged too — Flux
+ * can never satisfy it.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { allManifests, manifestsOfKind } from "./argo-helpers";
+import type { K8sManifest } from "./k8s-helpers";
+
+/** Flux Kustomizations only — the kustomize.config.k8s.io kind shares the name. */
+function fluxKustomizations(manifests: K8sManifest[]): K8sManifest[] {
+  return manifestsOfKind(manifests, "Kustomization").filter((m) => {
+    const apiVersion = m.apiVersion;
+    return typeof apiVersion !== "string" || apiVersion.startsWith("kustomize.toolkit.fluxcd.io/");
+  });
+}
+
+export const flux003: PostSynthCheck = {
+  id: "FLUX003",
+  description: "Kustomization.spec.dependsOn entries should name Kustomizations declared in the build",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const kustomizations = fluxKustomizations(allManifests(ctx));
+
+    const declared = new Set(
+      kustomizations
+        .map((k) => k.metadata?.name)
+        .filter((n): n is string => typeof n === "string"),
+    );
+
+    for (const kustomization of kustomizations) {
+      const name = kustomization.metadata?.name ?? "Kustomization";
+      const dependsOn = kustomization.spec?.dependsOn;
+      if (!Array.isArray(dependsOn)) continue;
+
+      for (const entry of dependsOn) {
+        const depName = (entry as { name?: unknown } | null)?.name;
+        if (typeof depName !== "string" || depName === "") continue;
+
+        if (depName === name) {
+          diagnostics.push({
+            checkId: "FLUX003",
+            severity: "warning",
+            message: `Kustomization "${name}" depends on itself — Flux can never satisfy the edge and the app will not reconcile.`,
+            entity: name,
+            lexicon: "k8s",
+          });
+          continue;
+        }
+
+        if (declared.has(depName)) continue;
+
+        diagnostics.push({
+          checkId: "FLUX003",
+          severity: "warning",
+          message: `Kustomization "${name}" depends on Kustomization "${depName}", which nothing in the build declares — reconciliation stalls until it exists. Fix the name, or ignore if it is declared in another repo.`,
+          entity: name,
+          lexicon: "k8s",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/index.ts

@@ -3,6 +3,8 @@ import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
 import { argo002 } from "./argo002";
 import { argo003 } from "./argo003";
 import { argo005 } from "./argo005";
+import { flux002 } from "./flux002";
+import { flux003 } from "./flux003";
 import { wk8005 } from "./wk8005";
 import { wk8006 } from "./wk8006";
 import { wk8041 } from "./wk8041";
@@ -34,6 +36,8 @@ export const postSynthChecks: PostSynthCheck[] = [
   argo002,
   argo003,
   argo005,
+  flux002,
+  flux003,
   wk8005,
   wk8006,
   wk8041,