@intentius/chant-lexicon-k8s 0.42.1 → 0.44.2

package/src/describe-resources.ts

@@ -42,17 +42,19 @@
  * exactly the shape `lifecycle diff --live` has always classified `orphan`.
  * On Kubernetes that is wrong: it is expected runtime, not drift, and will be
  * recreated the moment it is deleted. After the declared-entity reads above
- * resolve, this scans Pods in the namespaces they actually live in and walks
- * each one's `ownerReferences` chain (`./api/owner-chain.ts`) against the
- * entities this very call resolved. A chain reaching one of them is reported
- * with `ownerChain: { root: "declared", ... }`; core's diff/change-set engine
- * reads that as `runtime` instead of `orphan`. Deliberately scoped to Pods —
- * the concrete case the issue and its acceptance criteria name — and to the
- * namespaces this observation already touched, not a cluster-wide sweep;
- * widening to other controller-spawned kinds is the same walk repeated.
+ * resolve, this sweeps candidate kinds in the namespaces they actually live in
+ * and walks each object's `ownerReferences` chain (`./api/owner-chain.ts`)
+ * against the entities this very call resolved. A chain reaching one of them
+ * is reported with `ownerChain: { root: "declared", ... }`; core's
+ * diff/change-set engine reads that as `runtime` instead of `orphan`.
+ *
+ * Which kinds are candidates is the cluster's own API discovery's answer
+ * (#1517): every listable kind it serves, one version per group. The sweep's
+ * bound is the namespaces the declared estate touches, never a kind table —
+ * see `addRuntimeChildren`.
  */
 
-import type { ObservationResult, ResourceMetadata, UnobservedEntity } from "@intentius/chant/lexicon";
+import type { ObservationResult, ResourceMetadata, UnobservedEntity, UnobservedReason } from "@intentius/chant/lexicon";
 import { observation, unobservedAll } from "@intentius/chant/observation";
 import { hasOwnershipMarker, classifyOwnership, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import type { K8sClient, K8sObject } from "@intentius/chant-k8s-client";
@@ -253,6 +255,14 @@ export async function describeResources(
 ): Promise<ObservationResult> {
   const resources: Record<string, ResourceMetadata> = {};
   const unobserved: Record<string, UnobservedEntity> = {};
+  // The resolved query address per declared entity (#1620) — the exact request
+  // path each read was issued against, with the namespace the client actually
+  // defaulted to when the declaration carries none. This is what lets an
+  // absence explain itself: a Flux-deployed object declaring no
+  // metadata.namespace reads from `default`, correctly comes back 404, and
+  // without the address the report says "not there" when the truth is "not
+  // looked for where it lives".
+  const queried: Record<string, string> = {};
 
   const declared: Declared[] = [...options.entities].map(([entityName, entity]) => ({
     entityName,
@@ -321,13 +331,27 @@ export async function describeResources(
       return;
     }
 
+    const ref = {
+      apiVersion: operation.apiVersion,
+      kind: operation.kind,
+      name,
+      ...(metadata?.namespace ? { namespace: metadata.namespace } : {}),
+    };
+
+    // Resolve the address BEFORE the read, so every verdict below — present,
+    // absent, filtered, read-failed — carries the same record of what was
+    // asked. Resolution rides the client's cached discovery; a kind discovery
+    // does not serve has no path, and a resolution failure classifies through
+    // the read below, never here.
+    try {
+      const address = typeof client.pathFor === "function" ? await client.pathFor(ref) : undefined;
+      if (address) queried[entityName] = address;
+    } catch {
+      // The read below hits the same resolution and classifies its failure.
+    }
+
     try {
-      const obj = await client.read({
-        apiVersion: operation.apiVersion,
-        kind: operation.kind,
-        name,
-        ...(metadata?.namespace ? { namespace: metadata.namespace } : {}),
-      });
+      const obj = await client.read(ref);
 
       // owned filter: withhold resources not carrying chant's marker label.
       // Withheld is not absent (chant #1089) — this object exists, it just
@@ -338,6 +362,7 @@ export async function describeResources(
           type: entityType,
           reason: "filtered",
           detail: "live object carries no chant ownership marker and --owned was requested",
+          ...(queried[entityName] ? { queried: queried[entityName] } : {}),
         };
         return;
       }
@@ -359,51 +384,60 @@ export async function describeResources(
     } catch (err) {
       const outcome = classifyApiFailure(err);
       if (outcome.kind === "unobserved") {
-        unobserved[entityName] = { type: entityType, reason: outcome.reason, detail: outcome.detail };
+        unobserved[entityName] = {
+          type: entityType,
+          reason: outcome.reason,
+          detail: outcome.detail,
+          ...(queried[entityName] ? { queried: queried[entityName] } : {}),
+        };
       }
       // `absent` deliberately records nothing: in neither map is how the
-      // contract spells "asked, and it is not there".
+      // contract spells "asked, and it is not there". Its address stays in
+      // `queried` (#1620), which is the only record an absence gets.
     }
   });
 
-  // chant #1517 — the API groups this estate's own declarations use. A
-  // controller's children usually live in its controller's group (a
-  // MicroVMReplicaSet makes MicroVMs), so the runtime scan sweeps those
-  // groupVersions' kinds besides Pods. Core (`v1`) is excluded from the group
-  // sweep — Pods represent it; sweeping every core kind would walk endpoints
-  // and events for nothing.
-  const runtimeGroupVersions = new Set<string>();
-  for (const { entityType } of declared) {
-    const op = operationFor(entityType);
-    if (op && op.apiVersion.includes("/")) runtimeGroupVersions.add(op.apiVersion);
-  }
-
-  await addRuntimeChildren(client, resources, options.owned, runtimeGroupVersions, declared);
+  await addRuntimeChildren(client, resources, unobserved, options.owned, declared);
 
-  return observation(resources, unobserved);
+  return observation(resources, unobserved, queried);
 }
 
 /**
- * Scan runtime-child candidates in the namespaces of entities this call just
+ * Sweep runtime-child candidates in the namespaces of entities this call just
  * resolved, and classify each one's owner-reference chain (#1077). Mutates
  * `resources` in place, adding an entry per object whose chain was worth
- * reporting.
+ * reporting, and `unobserved` for the parts of the sweep that could not look.
  *
- * Two candidate pools:
- *  - **Pods** — the built-in workload leaf, always scanned.
- *  - **The estate's own API groups** (#1517) — every namespaced, listable
- *    kind in each `groupVersions` entry, from the cluster's own discovery.
- *    An operator estate's interesting children are custom resources its
- *    controllers made (a MicroVMReplicaSet's MicroVMs), which no kind table
- *    could anticipate — the same open-world inversion behold#74 made for
- *    declared CRDs, applied to the runtime axis. Bounded by what the estate
- *    declares, never a cluster-wide sweep.
+ * The candidate kinds are the cluster's own API discovery's answer (#1517):
+ * every listable kind it serves, one version per group (the group's
+ * preferredVersion, so nothing is listed twice at a second served version).
+ * The first cut scoped this to Pods, the second to the estate's own declared
+ * API groups — and both missed exactly where the runtime tier says the most:
+ * an operator's children are whatever kinds its controllers make (a
+ * MicroVMReplicaSet's MicroVMs, a CR's Deployments in a group the estate
+ * never declares), which no kind table can anticipate. The same open-world
+ * inversion behold#74 made for declared CRDs, applied to the runtime axis.
  *
- * Best-effort and additive: a namespace or kind this scan cannot list (RBAC
- * denial, a transient error) is simply skipped rather than failing the
- * observation — these are not declared entities, so there is no NOT-OBSERVED
- * axis for them to report against, the same way an out-of-band AWS child
- * resource has none either.
+ * What bounds the sweep is not a kind list but reach:
+ *  - **Namespaced kinds** are listed only in the namespaces the declared
+ *    estate touches (where its entities resolved, plus the namespaces its
+ *    GitOps CRs target) — owner references cannot cross a namespace, so a
+ *    child elsewhere could never chain to this estate anyway.
+ *  - **Cluster-scoped kinds** are listed only when the estate resolved a
+ *    cluster-scoped entity — a cluster-scoped object's owners are themselves
+ *    cluster-scoped (Kubernetes' own GC rule), so without one declared there
+ *    is nothing such a chain could reach.
+ *  - **It is not an inventory**: outside Pods (whose chain verdicts, foreign
+ *    included, are #1077's original contract), a swept object is only
+ *    reported when its chain resolves to a declared entity.
+ *
+ * Tri-state honesty (#1089, extended to the sweep): a kind discovery names
+ * but the sweep cannot list — RBAC denial, a flaking apiserver — becomes a
+ * `runtime-sweep:*` entry in `unobserved`, never a silent gap. Silence would
+ * read as "no runtime children there", which the failed list never proved.
+ * A list 404 (the kind vanished between discovery and the list) stays an
+ * absence, per `classifyApiFailure`'s standing rule. Declared-entity
+ * resolution is never failed by the sweep.
  */
 /** The declared GitOps CRs, indexed the way their controllers' labels can be
  * resolved (#1549). `byRef` keys are `type\0namespace\0name` (Flux — exact);
@@ -466,11 +500,29 @@ function gitopsOwner(labels: Record<string, string> | undefined, gitops: GitopsI
   return undefined;
 }
 
+/** One candidate kind of the discovery-driven sweep. */
+interface SweptKind {
+  apiVersion: string;
+  kind: string;
+  typeName: string;
+}
+
+/**
+ * Kinds the sweep skips even though discovery serves them. Not a kind table
+ * creeping back in: each entry is a kind that CANNOT attribute to a declared
+ * owner — an Event names its subject via `involvedObject`, never
+ * `ownerReferences` — and churns by the thousands in any active namespace,
+ * so listing it can only cost and never attach.
+ */
+function isSweepNoise(info: { kind: string; group: string }): boolean {
+  return info.kind === "Event" && (info.group === "" || info.group === "events.k8s.io");
+}
+
 async function addRuntimeChildren(
   client: K8sClient,
   resources: Record<string, ResourceMetadata>,
+  unobserved: Record<string, UnobservedEntity>,
   owned: boolean | undefined,
-  groupVersions: ReadonlySet<string> = new Set(),
   declared: readonly Declared[] = [],
 ): Promise<void> {
   const declaredByUid = new Map<string, string>();
@@ -488,9 +540,11 @@ async function addRuntimeChildren(
   const gitops = gitopsIndex(declared);
 
   const namespaces = new Set<string>();
+  let clusterScopedDeclared = false;
   for (const meta of Object.values(resources)) {
     const namespace = (meta.attributes as { namespace?: string } | undefined)?.namespace;
     if (namespace) namespaces.add(namespace);
+    else clusterScopedDeclared = true;
   }
   // The namespaces a declared GitOps CR TARGETS are declared literals too
   // (Argo `spec.destination.namespace`, Flux `spec.targetNamespace`) — the
@@ -498,93 +552,147 @@ async function addRuntimeChildren(
   // reading it off the declaration keeps this bounded by the estate, never a
   // cluster-wide sweep.
   for (const ns of gitops.targetNamespaces) namespaces.add(ns);
-  if (namespaces.size === 0) return;
-
-  // The kinds to scan: Pods, plus each declared groupVersion's namespaced,
-  // listable kinds from discovery (#1517). A groupVersion the cluster does
-  // not serve contributes nothing — an answer, not a failure.
-  const kinds: Array<{ apiVersion: string; kind: string; typeName: string }> = [
-    { apiVersion: "v1", kind: "Pod", typeName: "K8s::Core::Pod" },
-  ];
-  // A GitOps estate's managed WORKLOADS live in groups the estate itself never
-  // declares (a pure Argo/Flux estate declares only the CRs), so without this
-  // the label channel could only ever fire on Pods (#1549).
-  if (gitops.present) {
-    kinds.push(
-      { apiVersion: "apps/v1", kind: "Deployment", typeName: "K8s::Apps::Deployment" },
-      { apiVersion: "apps/v1", kind: "StatefulSet", typeName: "K8s::Apps::StatefulSet" },
-      { apiVersion: "apps/v1", kind: "DaemonSet", typeName: "K8s::Apps::DaemonSet" },
-      { apiVersion: "v1", kind: "Service", typeName: "K8s::Core::Service" },
-      { apiVersion: "v1", kind: "ConfigMap", typeName: "K8s::Core::ConfigMap" },
-    );
+  if (namespaces.size === 0 && !clusterScopedDeclared) return;
+
+  // Every kind the cluster serves, from its own discovery (#1517): one
+  // groupVersion per group, every listable kind, split by scope. Failing to
+  // enumerate is a hole the observation must admit — silently sweeping
+  // nothing would read as "no runtime children", which was never established.
+  let groupVersions: string[];
+  try {
+    groupVersions = await client.preferredGroupVersions();
+  } catch (err) {
+    const outcome = classifyApiFailure(err);
+    unobserved["runtime-sweep"] = {
+      reason: outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+      detail:
+        "cluster API discovery failed, so runtime children were not swept" +
+        (outcome.kind === "unobserved" ? `: ${outcome.detail}` : ""),
+    };
+    return;
   }
-  for (const gv of [...groupVersions].sort()) {
-    let infos;
+
+  const perGroup = await client.concurrently(groupVersions, async (gv) => {
     try {
-      infos = await client.resources(gv);
-    } catch {
-      continue; // best-effort — see the function doc
+      return await client.resources(gv);
+    } catch (err) {
+      const outcome = classifyApiFailure(err);
+      if (outcome.kind === "unobserved") {
+        unobserved[`runtime-sweep:${gv}`] = {
+          reason: outcome.reason,
+          detail: `discovery for ${gv} failed, so its kinds were not swept: ${outcome.detail}`,
+        };
+      }
+      return [];
     }
-    const [group, version] = [gv.slice(0, gv.indexOf("/")), gv.slice(gv.indexOf("/") + 1)];
+  });
+
+  const namespacedKinds: SweptKind[] = [];
+  const clusterKinds: SweptKind[] = [];
+  for (const infos of perGroup) {
     for (const info of infos) {
-      if (!info.namespaced || !info.verbs.includes("list")) continue;
-      kinds.push({ apiVersion: gv, kind: info.kind, typeName: gvkToTypeName({ group, version, kind: info.kind }) });
+      if (!info.verbs.includes("list") || isSweepNoise(info)) continue;
+      const swept: SweptKind = {
+        apiVersion: info.apiVersion,
+        kind: info.kind,
+        typeName: gvkToTypeName({ group: info.group, version: info.version, kind: info.kind }),
+      };
+      (info.namespaced ? namespacedKinds : clusterKinds).push(swept);
     }
   }
 
-  await client.concurrently([...namespaces], async (namespace) => {
-    for (const { apiVersion, kind, typeName } of kinds) {
-      let objects: K8sObject[];
-      try {
-        objects = await client.list({ apiVersion, kind }, { namespace });
-      } catch {
-        continue; // best-effort — see the function doc
-      }
+  // A failed list is recorded once per kind, naming every scope it failed in,
+  // rather than once per (kind, namespace) — one RBAC rule denying a kind
+  // across N namespaces is one hole, not N.
+  const listFailures = new Map<
+    string,
+    { typeName: string; reason: UnobservedReason; scopes: string[]; detail: string }
+  >();
 
-      await client.concurrently(objects, async (obj) => {
-        const uid = obj.metadata?.uid;
-        const name = obj.metadata?.name;
-        if (!uid || !name || declaredByUid.has(uid)) return; // declared directly, or unaddressable
-        if (resources[`${namespace}/${name}`]) return; // already reported by an earlier kind
-
-        let ownerChain = await resolveK8sOwnerChain(obj, { declaredByUid, reader: client, namespace });
-        // The label channel (#1549) — only when the chain itself said nothing:
-        // a verdict the walk DID reach is never overridden.
-        if (ownerChain.root !== "declared") {
-          const entity = gitopsOwner(obj.metadata?.labels, gitops);
-          if (entity) ownerChain = { root: "declared", entity };
-        }
-
-        // `--owned`: withhold an object that is neither a runtime child of a
-        // declared entity nor carrying chant's own marker — the same rule the
-        // declared-entity read above applies, extended to the undeclared axis
-        // this scan introduces.
-        const marker = hasOwnershipMarker(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS);
-        if (owned && ownerChain.root !== "declared" && !marker) return;
-
-        // An undeclared object with NO owner chain at all is not a runtime
-        // child — reporting every loose object a group serves would turn the
-        // scan into an inventory. Pods keep their pre-#1517 reporting (their
-        // chain verdicts, including foreign, were already part of #1077's
-        // contract); swept group kinds only report when the chain reaches a
-        // declared entity.
-        if (kind !== "Pod" && ownerChain.root !== "declared") return;
-
-        resources[`${namespace}/${name}`] = {
-          type: typeName,
-          physicalId: uid,
-          status: statusFromObject(obj),
-          lastUpdated: obj.metadata?.creationTimestamp,
-          ownership: classifyOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
-          ownerChain,
-          attributes: pruneUndefined({
-            namespace,
-            labels: obj.metadata?.labels,
-            resourceVersion: obj.metadata?.resourceVersion,
-            conditions: unhappyConditions(obj),
-          }),
-        };
-      });
+  const sweep = async (swept: SweptKind, namespace: string | undefined): Promise<void> => {
+    let objects: K8sObject[];
+    try {
+      objects = await client.list(
+        { apiVersion: swept.apiVersion, kind: swept.kind },
+        namespace ? { namespace } : {},
+      );
+    } catch (err) {
+      const outcome = classifyApiFailure(err);
+      // `absent` (a list 404: the kind vanished between discovery and now)
+      // proves no instance exists — nothing to record.
+      if (outcome.kind === "unobserved") {
+        const key = `runtime-sweep:${swept.apiVersion}/${swept.kind}`;
+        const scope = namespace ? `namespace ${namespace}` : "cluster scope";
+        const failure = listFailures.get(key);
+        if (failure) failure.scopes.push(scope);
+        else listFailures.set(key, { typeName: swept.typeName, reason: outcome.reason, scopes: [scope], detail: outcome.detail });
+      }
+      return;
     }
+
+    await client.concurrently(objects, async (obj) => {
+      const uid = obj.metadata?.uid;
+      const name = obj.metadata?.name;
+      if (!uid || !name || declaredByUid.has(uid)) return; // declared directly, or unaddressable
+      const key = namespace ? `${namespace}/${name}` : `cluster:${name}`;
+      if (resources[key]) return; // already reported by an earlier kind
+
+      let ownerChain = await resolveK8sOwnerChain(obj, { declaredByUid, reader: client, namespace });
+      // The label channel (#1549) — only when the chain itself said nothing:
+      // a verdict the walk DID reach is never overridden.
+      if (ownerChain.root !== "declared") {
+        const entity = gitopsOwner(obj.metadata?.labels, gitops);
+        if (entity) ownerChain = { root: "declared", entity };
+      }
+
+      // `--owned`: withhold an object that is neither a runtime child of a
+      // declared entity nor carrying chant's own marker — the same rule the
+      // declared-entity read above applies, extended to the undeclared axis
+      // this scan introduces.
+      const marker = hasOwnershipMarker(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS);
+      if (owned && ownerChain.root !== "declared" && !marker) return;
+
+      // An undeclared object with NO owner chain at all is not a runtime
+      // child — reporting every loose object the cluster serves would turn
+      // the sweep into an inventory. Pods keep their pre-#1517 reporting
+      // (their chain verdicts, including foreign, were already part of
+      // #1077's contract); every other swept kind only reports when the
+      // chain reaches a declared entity.
+      if (swept.kind !== "Pod" && ownerChain.root !== "declared") return;
+
+      resources[key] = {
+        type: swept.typeName,
+        physicalId: uid,
+        status: statusFromObject(obj),
+        lastUpdated: obj.metadata?.creationTimestamp,
+        ownership: classifyOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
+        ownerChain,
+        attributes: pruneUndefined({
+          namespace,
+          labels: obj.metadata?.labels,
+          resourceVersion: obj.metadata?.resourceVersion,
+          conditions: unhappyConditions(obj),
+        }),
+      };
+    });
+  };
+
+  await client.concurrently([...namespaces], async (namespace) => {
+    for (const swept of namespacedKinds) await sweep(swept, namespace);
   });
+
+  // Cluster-scoped kinds are swept once (their lists are cluster-wide by
+  // nature), and only when a declared cluster-scoped entity exists for a
+  // chain to reach — a cluster-scoped object's owners are cluster-scoped.
+  if (clusterScopedDeclared) {
+    await client.concurrently(clusterKinds, async (swept) => sweep(swept, undefined));
+  }
+
+  for (const [key, failure] of listFailures) {
+    unobserved[key] = {
+      type: failure.typeName,
+      reason: failure.reason,
+      detail: `the runtime-children sweep could not list this kind in ${failure.scopes.join(", ")}: ${failure.detail}`,
+    };
+  }
 }

package/src/generated/index.d.ts

@@ -2,6 +2,18 @@
 
 // --- Kubernetes Resource classes ---
 
+export declare class Addon {
+  constructor(props: {
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+    /** Spec provides information about the on-disk manifest backing this resource. */
+    spec?: Record<string, unknown>;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly uid: string;
+}
+
 export declare class Alert {
   constructor(props: {
     /** Standard object's metadata. */
@@ -920,6 +932,19 @@ export declare class FlowSchemaList {
   readonly uid: string;
 }
 
+export declare class FluxHelmChart {
+  constructor(props: {
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+    /** HelmChartSpec specifies the desired state of a Helm chart. */
+    spec?: Record<string, unknown>;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class FluxInstance {
   constructor(props: {
     /** Standard object's metadata. */
@@ -999,16 +1024,16 @@ export declare class GRPCRoute {
   readonly uid: string;
 }
 
-export declare class HelmChart {
+export declare class HelmChartConfig {
   constructor(props: {
     /** Standard object's metadata. */
     metadata?: ObjectMeta;
-    /** HelmChartSpec specifies the desired state of a Helm chart. */
+    /** HelmChartConfigSpec represents additional user-configurable details of an installed and configured Helm chart release.
+These fields are merged with or override the corresponding fields on the related HelmChart resource. */
     spec?: Record<string, unknown>;
   });
   readonly name: string;
   readonly namespace: string;
-  readonly status: Record<string, unknown>;
   readonly uid: string;
 }
 
@@ -1325,6 +1350,19 @@ export declare class JobList {
   readonly uid: string;
 }
 
+export declare class K3sHelmChart {
+  constructor(props: {
+    /** Standard object's metadata. */
+    metadata?: ObjectMeta;
+    /** HelmChartSpec represents the user-configurable details for installation and upgrade of a Helm chart release. */
+    spec?: Record<string, unknown>;
+  });
+  readonly name: string;
+  readonly namespace: string;
+  readonly status: Record<string, unknown>;
+  readonly uid: string;
+}
+
 export declare class Kustomization {
   constructor(props: {
     /** Standard object's metadata. */

package/src/generated/index.ts

@@ -1,6 +1,7 @@
 // Code generated by chant generate. DO NOT EDIT.
 import { createResource, createProperty } from "./runtime";
 
+export const Addon = createResource("K8s::K3s::Addon", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const Alert = createResource("K8s::Flux::Alert", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const APIGroup = createResource("K8s::Core::APIGroup", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const APIGroupList = createResource("K8s::Core::APIGroupList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
@@ -68,13 +69,14 @@ export const EventsEventList = createResource("K8s::Events::EventList", "k8s", {
 export const Eviction = createResource("K8s::Policy::Eviction", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const FlowSchema = createResource("K8s::Flowcontrol::FlowSchema", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const FlowSchemaList = createResource("K8s::Flowcontrol::FlowSchemaList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const FluxHelmChart = createResource("K8s::Flux::HelmChart", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const FluxInstance = createResource("K8s::Flux::FluxInstance", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const FluxReport = createResource("K8s::Flux::FluxReport", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const Gateway = createResource("K8s::Gateway::Gateway", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const GatewayClass = createResource("K8s::Gateway::GatewayClass", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const GitRepository = createResource("K8s::Flux::GitRepository", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const GRPCRoute = createResource("K8s::Gateway::GRPCRoute", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
-export const HelmChart = createResource("K8s::Flux::HelmChart", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
+export const HelmChartConfig = createResource("K8s::K3s::HelmChartConfig", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const HelmRelease = createResource("K8s::Flux::HelmRelease", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const HelmRepository = createResource("K8s::Flux::HelmRepository", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const HorizontalPodAutoscaler = createResource("K8s::Autoscaling::HorizontalPodAutoscaler", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
@@ -100,6 +102,7 @@ export const IPAddressList = createResource("K8s::Networking::IPAddressList", "k
 export const Issuer = createResource("K8s::CertManager::Issuer", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const Job = createResource("K8s::Batch::Job", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const JobList = createResource("K8s::Batch::JobList", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
+export const K3sHelmChart = createResource("K8s::K3s::HelmChart", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const Kustomization = createResource("K8s::Flux::Kustomization", "k8s", {"name":"name","namespace":"namespace","uid":"uid","status":"status"});
 export const Lease = createResource("K8s::Coordination::Lease", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
 export const LeaseCandidate = createResource("K8s::Coordination::LeaseCandidate", "k8s", {"name":"name","namespace":"namespace","uid":"uid"});
@@ -332,6 +335,9 @@ export const EnvVar = createProperty("K8s::Core::EnvVar", "k8s");
 export const EnvVarSource = createProperty("K8s::Core::EnvVarSource", "k8s");
 export const EphemeralContainer = createProperty("K8s::Core::EphemeralContainer", "k8s");
 export const ExecAction = createProperty("K8s::Core::ExecAction", "k8s");
+export const FluxHelmChart_SourceRef = createProperty("K8s::Flux::HelmChart.sourceRef", "k8s");
+export const FluxHelmChart_Status = createProperty("K8s::Flux::HelmChart.status", "k8s");
+export const FluxHelmChart_Verify = createProperty("K8s::Flux::HelmChart.verify", "k8s");
 export const FluxInstance_Cluster = createProperty("K8s::Flux::FluxInstance.cluster", "k8s");
 export const FluxInstance_CommonMetadata = createProperty("K8s::Flux::FluxInstance.commonMetadata", "k8s");
 export const FluxInstance_Distribution = createProperty("K8s::Flux::FluxInstance.distribution", "k8s");
@@ -362,9 +368,7 @@ export const GitRepository_Verify = createProperty("K8s::Flux::GitRepository.ver
 export const GRPCRoute_ParentRef = createProperty("K8s::Gateway::GRPCRoute.parentRefs", "k8s");
 export const GRPCRoute_Rule = createProperty("K8s::Gateway::GRPCRoute.rules", "k8s");
 export const GRPCRoute_Status = createProperty("K8s::Gateway::GRPCRoute.status", "k8s");
-export const HelmChart_SourceRef = createProperty("K8s::Flux::HelmChart.sourceRef", "k8s");
-export const HelmChart_Status = createProperty("K8s::Flux::HelmChart.status", "k8s");
-export const HelmChart_Verify = createProperty("K8s::Flux::HelmChart.verify", "k8s");
+export const HelmChartConfig_ValuesSecret = createProperty("K8s::K3s::HelmChartConfig.valuesSecrets", "k8s");
 export const HelmRelease_Chart = createProperty("K8s::Flux::HelmRelease.chart", "k8s");
 export const HelmRelease_ChartRef = createProperty("K8s::Flux::HelmRelease.chartRef", "k8s");
 export const HelmRelease_CommonMetadata = createProperty("K8s::Flux::HelmRelease.commonMetadata", "k8s");
@@ -440,6 +444,13 @@ export const Issuer_SelfSigned = createProperty("K8s::CertManager::Issuer.selfSi
 export const Issuer_Status = createProperty("K8s::CertManager::Issuer.status", "k8s");
 export const Issuer_Vault = createProperty("K8s::CertManager::Issuer.vault", "k8s");
 export const Issuer_Venafi = createProperty("K8s::CertManager::Issuer.venafi", "k8s");
+export const K3sHelmChart_AuthSecret = createProperty("K8s::K3s::HelmChart.authSecret", "k8s");
+export const K3sHelmChart_DockerRegistrySecret = createProperty("K8s::K3s::HelmChart.dockerRegistrySecret", "k8s");
+export const K3sHelmChart_PodSecurityContext = createProperty("K8s::K3s::HelmChart.podSecurityContext", "k8s");
+export const K3sHelmChart_RepoCAConfigMap = createProperty("K8s::K3s::HelmChart.repoCAConfigMap", "k8s");
+export const K3sHelmChart_SecurityContext = createProperty("K8s::K3s::HelmChart.securityContext", "k8s");
+export const K3sHelmChart_Status = createProperty("K8s::K3s::HelmChart.status", "k8s");
+export const K3sHelmChart_ValuesSecret = createProperty("K8s::K3s::HelmChart.valuesSecrets", "k8s");
 export const KeyToPath = createProperty("K8s::Core::KeyToPath", "k8s");
 export const Kustomization_CommonMetadata = createProperty("K8s::Flux::Kustomization.commonMetadata", "k8s");
 export const Kustomization_Decryption = createProperty("K8s::Flux::Kustomization.decryption", "k8s");