@intentius/chant-lexicon-k8s 0.45.0 → 0.49.0

package/src/generated/operations.json

@@ -31,6 +31,38 @@
       "watch"
     ]
   },
+  "K8s::Addons::ClusterResourceSet": {
+    "entityType": "K8s::Addons::ClusterResourceSet",
+    "apiVersion": "addons.cluster.x-k8s.io/v1beta2",
+    "kind": "ClusterResourceSet",
+    "plural": "clusterresourcesets",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Addons::HelmChartProxy": {
+    "entityType": "K8s::Addons::HelmChartProxy",
+    "apiVersion": "addons.cluster.x-k8s.io/v1alpha1",
+    "kind": "HelmChartProxy",
+    "plural": "helmchartproxies",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Admissionregistration::MutatingAdmissionPolicy": {
     "entityType": "K8s::Admissionregistration::MutatingAdmissionPolicy",
     "apiVersion": "admissionregistration.k8s.io/v1",
@@ -495,6 +527,38 @@
     "scope": "Namespaced",
     "verbs": []
   },
+  "K8s::CAPI::Cluster": {
+    "entityType": "K8s::CAPI::Cluster",
+    "apiVersion": "cluster.x-k8s.io/v1beta2",
+    "kind": "Cluster",
+    "plural": "clusters",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::CAPI::MachinePool": {
+    "entityType": "K8s::CAPI::MachinePool",
+    "apiVersion": "cluster.x-k8s.io/v1beta2",
+    "kind": "MachinePool",
+    "plural": "machinepools",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::CertManager::Certificate": {
     "entityType": "K8s::CertManager::Certificate",
     "apiVersion": "cert-manager.io/v1",
@@ -705,6 +769,22 @@
       "watch"
     ]
   },
+  "K8s::Controlplane::AWSManagedControlPlane": {
+    "entityType": "K8s::Controlplane::AWSManagedControlPlane",
+    "apiVersion": "controlplane.cluster.x-k8s.io/v1beta2",
+    "kind": "AWSManagedControlPlane",
+    "plural": "awsmanagedcontrolplanes",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Coordination::Lease": {
     "entityType": "K8s::Coordination::Lease",
     "apiVersion": "coordination.k8s.io/v1",
@@ -1199,6 +1279,22 @@
     "scope": "Namespaced",
     "verbs": []
   },
+  "K8s::Eks::PodIdentityAssociation": {
+    "entityType": "K8s::Eks::PodIdentityAssociation",
+    "apiVersion": "eks.services.k8s.aws/v1alpha1",
+    "kind": "PodIdentityAssociation",
+    "plural": "podidentityassociations",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Events::Event": {
     "entityType": "K8s::Events::Event",
     "apiVersion": "events.k8s.io/v1",
@@ -1617,6 +1713,54 @@
       "watch"
     ]
   },
+  "K8s::Iam::Policy": {
+    "entityType": "K8s::Iam::Policy",
+    "apiVersion": "iam.services.k8s.aws/v1alpha1",
+    "kind": "Policy",
+    "plural": "policies",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Iam::Role": {
+    "entityType": "K8s::Iam::Role",
+    "apiVersion": "iam.services.k8s.aws/v1alpha1",
+    "kind": "Role",
+    "plural": "roles",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Iam::User": {
+    "entityType": "K8s::Iam::User",
+    "apiVersion": "iam.services.k8s.aws/v1alpha1",
+    "kind": "User",
+    "plural": "users",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Infisical::InfisicalDynamicSecret": {
     "entityType": "K8s::Infisical::InfisicalDynamicSecret",
     "apiVersion": "secrets.infisical.com/v1alpha1",
@@ -1665,6 +1809,54 @@
       "watch"
     ]
   },
+  "K8s::Infrastructure::AWSClusterControllerIdentity": {
+    "entityType": "K8s::Infrastructure::AWSClusterControllerIdentity",
+    "apiVersion": "infrastructure.cluster.x-k8s.io/v1beta2",
+    "kind": "AWSClusterControllerIdentity",
+    "plural": "awsclustercontrolleridentities",
+    "scope": "Cluster",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Infrastructure::AWSManagedCluster": {
+    "entityType": "K8s::Infrastructure::AWSManagedCluster",
+    "apiVersion": "infrastructure.cluster.x-k8s.io/v1beta2",
+    "kind": "AWSManagedCluster",
+    "plural": "awsmanagedclusters",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::Infrastructure::AWSManagedMachinePool": {
+    "entityType": "K8s::Infrastructure::AWSManagedMachinePool",
+    "apiVersion": "infrastructure.cluster.x-k8s.io/v1beta2",
+    "kind": "AWSManagedMachinePool",
+    "plural": "awsmanagedmachinepools",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::K3s::Addon": {
     "entityType": "K8s::K3s::Addon",
     "apiVersion": "k3s.cattle.io/v1",
@@ -1713,6 +1905,54 @@
       "watch"
     ]
   },
+  "K8s::KServe::ClusterServingRuntime": {
+    "entityType": "K8s::KServe::ClusterServingRuntime",
+    "apiVersion": "serving.kserve.io/v1alpha1",
+    "kind": "ClusterServingRuntime",
+    "plural": "clusterservingruntimes",
+    "scope": "Cluster",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::KServe::InferenceService": {
+    "entityType": "K8s::KServe::InferenceService",
+    "apiVersion": "serving.kserve.io/v1beta1",
+    "kind": "InferenceService",
+    "plural": "inferenceservices",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
+  "K8s::KServe::ServingRuntime": {
+    "entityType": "K8s::KServe::ServingRuntime",
+    "apiVersion": "serving.kserve.io/v1alpha1",
+    "kind": "ServingRuntime",
+    "plural": "servingruntimes",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::KubeMicroVM::MicroVM": {
     "entityType": "K8s::KubeMicroVM::MicroVM",
     "apiVersion": "lambda.aws.amazon.com/v1alpha1",
@@ -2123,6 +2363,22 @@
     "scope": "Namespaced",
     "verbs": []
   },
+  "K8s::Rds::DBInstance": {
+    "entityType": "K8s::Rds::DBInstance",
+    "apiVersion": "rds.services.k8s.aws/v1alpha1",
+    "kind": "DBInstance",
+    "plural": "dbinstances",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Resource::DeviceClass": {
     "entityType": "K8s::Resource::DeviceClass",
     "apiVersion": "resource.k8s.io/v1",
@@ -2233,6 +2489,22 @@
     "scope": "Namespaced",
     "verbs": []
   },
+  "K8s::S3::Bucket": {
+    "entityType": "K8s::S3::Bucket",
+    "apiVersion": "s3.services.k8s.aws/v1alpha1",
+    "kind": "Bucket",
+    "plural": "buckets",
+    "scope": "Namespaced",
+    "verbs": [
+      "delete",
+      "get",
+      "list",
+      "patch",
+      "post",
+      "put",
+      "watch"
+    ]
+  },
   "K8s::Scheduling::PriorityClass": {
     "entityType": "K8s::Scheduling::PriorityClass",
     "apiVersion": "scheduling.k8s.io/v1",

package/src/group-namespace.test.ts

@@ -27,6 +27,18 @@ describe("namespaceSegmentForGroup", () => {
   test("the toolkit groups collapse to Flux", () => {
     expect(namespaceSegmentForGroup("kustomize.toolkit.fluxcd.io")).toBe("Flux");
   });
+
+  test("serving.kserve.io takes the KServe override", () => {
+    expect(namespaceSegmentForGroup("serving.kserve.io")).toBe("KServe");
+  });
+
+  test("cluster.x-k8s.io takes the CAPI override, avoiding the Cluster::Cluster stutter", () => {
+    expect(namespaceSegmentForGroup("cluster.x-k8s.io")).toBe("CAPI");
+  });
+
+  test("infrastructure.cluster.x-k8s.io is not overridden — first segment reads fine", () => {
+    expect(namespaceSegmentForGroup("infrastructure.cluster.x-k8s.io")).toBe("Infrastructure");
+  });
 });
 
 // #1628: rendered and imported entityTypes used to bypass the overrides, so a
@@ -61,4 +73,23 @@ spec:
     expect(ir.resources.length).toBe(1);
     expect(ir.resources[0].type).toBe("K8s::Argo::Application");
   });
+
+  test("an imported InferenceService is typed K8s::KServe::InferenceService", () => {
+    const ir = new K8sParser().parse(`
+apiVersion: serving.kserve.io/v1beta1
+kind: InferenceService
+metadata:
+  name: sklearn-iris
+  namespace: kserve-test
+spec:
+  predictor:
+    model:
+      modelFormat:
+        name: sklearn
+      storageUri: gs://kfserving-examples/models/sklearn/1.0/model
+`);
+
+    expect(ir.resources.length).toBe(1);
+    expect(ir.resources[0].type).toBe("K8s::KServe::InferenceService");
+  });
 });

package/src/group-namespace.ts

@@ -59,6 +59,19 @@ export const GROUP_NAMESPACE_OVERRIDES: Record<string, string> = {
   // and would split HelmChart from the Addon that tracks its deployment.
   "helm.cattle.io": "K3s",
   "k3s.cattle.io": "K3s",
+  // The first-segment rule would give `Serving`, which reads like a generic
+  // core concept rather than the KServe operator that owns it.
+  "serving.kserve.io": "KServe",
+  // The first-segment rule would give `Cluster`, which stutters against the
+  // CAPI `Cluster` kind itself (`K8s::Cluster::Cluster`) the same way the
+  // rejected `K8s::MicroVM::MicroVM` reads above. `infrastructure.cluster.x-k8s.io`
+  // (CAPA's AWSManagedCluster, AWSManagedMachinePool, AWSClusterControllerIdentity)
+  // and `controlplane.cluster.x-k8s.io` (CAPA's AWSManagedControlPlane) are left on
+  // the first-segment rule — their kinds already carry an `AWS` prefix, so
+  // `K8s::Infrastructure::AWSManagedCluster` / `K8s::Controlplane::AWSManagedControlPlane`
+  // don't need the same rescue. `addons.cluster.x-k8s.io` (CAAPH's HelmChartProxy,
+  // core CAPI's ClusterResourceSet) likewise stays `Addons`.
+  "cluster.x-k8s.io": "CAPI",
 };
 
 /**

package/src/index.ts

@@ -18,6 +18,10 @@ export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-lab
 // Variables / label constants
 export { K8sLabels, K8sAnnotations } from "./variables";
 
+// Generated-once secret marker (#1830) — constants only; the store adapter
+// itself lives at the `/secret-store` subpath, off the build path (#1074).
+export { GENERATED_ONCE_LABEL_KEY, GENERATED_ONCE_LABEL_VALUE, isGeneratedOnce } from "./secret-labels";
+
 // MicroTime helpers — see micro-time.ts for why this exists.
 export { microTime, isMicroTimeFormatted } from "./micro-time";
 
@@ -38,6 +42,7 @@ export {
   AgicIngress, AzureDiskStorageClass, AzureFileStorageClass, AzureMonitorCollector,
   AksWorkloadIdentityServiceAccount,
   GkeFluentBitAgent, GkeOtelCollector, GkeExternalDnsAgent, AksExternalDnsAgent,
+  Model, resolveModelStorageUri,
 } from "./composites/index";
 export type {
   WebAppProps, WebAppResult, StatefulAppProps, StatefulAppResult, CronWorkloadProps, CronWorkloadResult,
@@ -77,6 +82,7 @@ export type {
   GkeOtelCollectorProps, GkeOtelCollectorResult,
   GkeExternalDnsAgentProps, GkeExternalDnsAgentResult,
   AksExternalDnsAgentProps, AksExternalDnsAgentResult,
+  ModelSource, ModelProps, ModelResult,
 } from "./composites/index";
 
 // RBAC verb constants

package/src/kube/apply.ts

@@ -96,6 +96,11 @@ export async function runApply(rawArgs: string[], deps: ApplyDeps = {}): Promise
   } else {
     console.log(`applied ${result.applied.length} object(s) as field manager "${result.fieldManager}"`);
     if (result.pruned.length > 0) console.log(`pruned ${result.pruned.length} chant-owned object(s) no longer declared`);
+    if ((result.retained ?? []).length > 0) {
+      console.log(
+        `retained ${result.retained!.length} generated-once secret(s) no longer declared — never pruned; delete explicitly if you mean to`,
+      );
+    }
   }
   return 0;
 }

package/src/lifecycle-integration.test.ts

@@ -279,5 +279,47 @@ describeObservationConformance({
         });
       },
     },
+    {
+      name: "a marker-stamped object surfaces its stack/env identity; a foreign one surfaces none (#1222)",
+      declared: ["web", "legacy"],
+      expectPresent: ["web", "legacy"],
+      expectMarker: { web: { stack: "shop", env: "prod" } },
+      expectNoMarker: ["legacy"],
+      run: () => {
+        clusterState.fail = undefined;
+        clusterState.objects = {
+          [objectKey("apps/v1", "Deployment", "web", "default")]: {
+            apiVersion: "apps/v1",
+            kind: "Deployment",
+            metadata: {
+              name: "web",
+              namespace: "default",
+              uid: "uid-1",
+              labels: {
+                "app.kubernetes.io/managed-by": "chant",
+                "chant.intentius.io/stack": "shop",
+                "chant.intentius.io/env": "prod",
+              },
+            },
+            status: { readyReplicas: 1, replicas: 1 },
+          },
+          [objectKey("apps/v1", "Deployment", "legacy", "default")]: {
+            apiVersion: "apps/v1",
+            kind: "Deployment",
+            metadata: { name: "legacy", namespace: "default", uid: "uid-2" },
+            status: { readyReplicas: 1, replicas: 1 },
+          },
+        };
+        return k8sPlugin.describeResources!({
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["web", "legacy"],
+          entities: new Map([
+            ["web", { entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web" } } }],
+            ["legacy", { entityType: "K8s::Apps::Deployment", props: { metadata: { name: "legacy" } } }],
+          ]),
+        });
+      },
+    },
   ],
 });

package/src/lint/audit-catalog.ts

@@ -36,6 +36,13 @@ export const k8sAuditCatalog: Record<string, RuleMeta> = {
   WK8401: auditRule("WK8401", "merge-worthy", "guidance", "shmSize exceeds the container memory limit", "Lower shmSize or raise the memory limit so the pod can schedule.", { category: "best-practice" }),
   WK8402: auditRule("WK8402", "report-only", "guidance", "RayCluster missing spec.rayVersion", "Set spec.rayVersion so KubeRay picks the right autoscaler image.", { category: "best-practice" }),
   WK8403: auditRule("WK8403", "report-only", "guidance", "rayVersion does not match the head image tag", "Align spec.rayVersion with the Ray version in the head container image.", { category: "best-practice" }),
+  WK8404: auditRule("WK8404", "merge-worthy", "guidance", "GPU request without a matching toleration", "Add a toleration for the nvidia.com/gpu taint (or a wildcard Exists toleration) so the pod can schedule onto a GPU node pool.", { category: "correctness" }),
+  WK8405: auditRule("WK8405", "report-only", "guidance", "Serving workload has no PodDisruptionBudget", "Add a PDB selecting the InferenceService/serving Deployment so a node drain can't take down every replica at once.", { category: "best-practice" }),
+  WK8406: auditRule("WK8406", "merge-worthy", "guidance", "GPU container missing resource limits", "Set CPU and memory limits on GPU-requesting containers to avoid starving the (scarce, expensive) GPU node.", { category: "best-practice" }),
+  WK8407: auditRule("WK8407", "merge-worthy", "guidance", "Unpinned model version", "Pin the InferenceService model storageUri to an explicit version segment (e.g. via the Model composite's required version) instead of a floating tag.", { category: "correctness" }),
   WK8501: auditRule("WK8501", "merge-worthy", "guidance", "Custom resource spec has a field its CRD does not declare", "Fix the field name; the API server prunes unknown fields and the controller never sees them.", { category: "correctness" }),
   WK8502: auditRule("WK8502", "merge-worthy", "guidance", "Custom resource spec field has the wrong type or enum value", "Match the CRD schema: use the declared scalar type and one of the enum values.", { category: "correctness" }),
+  WK8503: auditRule("WK8503", "merge-worthy", "guidance", "Workload consumes a Secret nothing in the output produces", "Produce the Secret in the same build (Secret, ExternalSecret, InfisicalSecret, cert-manager Certificate), or declare its provenance with declareSecret() if it exists out of band.", { category: "correctness" }),
+  WK8504: auditRule("WK8504", "merge-worthy", "guidance", "committed-encrypted secret declaration does not resolve", "Point `file` at the committed ciphertext, make its metadata.name match the declaration, and re-run `sops -e -i` so every data/stringData value is ENC[...].", { authority: [K8S_SECRETS] }),
+  WK8505: auditRule("WK8505", "report-only", "guidance", "committed-encrypted secret with no Flux decryption wiring", "Add decryption: \"sops\" to the FluxAppFor reconciling the path that carries the ciphertext sidecar, or ignore if that Kustomization is declared in a different build.", { category: "correctness" }),
 };

package/src/lint/post-synth/index.ts

@@ -31,8 +31,15 @@ import { wk8306 } from "./wk8306";
 import { wk8401 } from "./wk8401";
 import { wk8402 } from "./wk8402";
 import { wk8403 } from "./wk8403";
+import { wk8404 } from "./wk8404";
+import { wk8405 } from "./wk8405";
+import { wk8406 } from "./wk8406";
+import { wk8407 } from "./wk8407";
 import { wk8501 } from "./wk8501";
 import { wk8502 } from "./wk8502";
+import { wk8503 } from "./wk8503";
+import { wk8504 } from "./wk8504";
+import { wk8505 } from "./wk8505";
 
 export const postSynthChecks: PostSynthCheck[] = [
   argo002,
@@ -66,6 +73,13 @@ export const postSynthChecks: PostSynthCheck[] = [
   wk8401,
   wk8402,
   wk8403,
+  wk8404,
+  wk8405,
+  wk8406,
+  wk8407,
   wk8501,
   wk8502,
+  wk8503,
+  wk8504,
+  wk8505,
 ];

package/src/lint/post-synth/k8s-helpers.ts

@@ -6,7 +6,7 @@
  */
 
 import { parseYAML } from "@intentius/chant/yaml";
-export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+export { getPrimaryOutput, getAdditionalFiles } from "@intentius/chant/lint/post-synth";
 
 /**
  * A parsed Kubernetes manifest (loosely typed).
@@ -103,6 +103,13 @@ export function extractPodSpec(
       return (template?.spec as Record<string, unknown>) ?? null;
     }
 
+    // KServe ServingRuntime/ClusterServingRuntime carry `containers` and
+    // `tolerations` directly on spec — no template wrapper, unlike the
+    // built-in workload kinds above.
+    case "ServingRuntime":
+    case "ClusterServingRuntime":
+      return spec;
+
     default:
       return null;
   }
@@ -148,6 +155,53 @@ export const WORKLOAD_KINDS = new Set([
   "CronJob",
 ]);
 
+/**
+ * Workload kinds that can request `nvidia.com/gpu` — the built-in workload
+ * kinds plus KServe's ServingRuntime/ClusterServingRuntime, which declare
+ * `containers`/`tolerations` directly on spec (see `extractPodSpec`).
+ */
+export const GPU_POD_KINDS = new Set([
+  ...WORKLOAD_KINDS,
+  "ServingRuntime",
+  "ClusterServingRuntime",
+]);
+
+/** A Kubernetes toleration (loosely typed). */
+export interface K8sToleration {
+  key?: string;
+  operator?: "Exists" | "Equal";
+  value?: string;
+  effect?: string;
+  [key: string]: unknown;
+}
+
+/** Resource name used for GPU requests/limits across the lexicon. */
+export const NVIDIA_GPU_RESOURCE = "nvidia.com/gpu";
+
+/**
+ * True when any container in `containers` requests or limits
+ * `nvidia.com/gpu`.
+ */
+export function requestsGpu(containers: K8sContainer[]): boolean {
+  return containers.some((c) => {
+    const requests = c.resources?.requests as Record<string, unknown> | undefined;
+    const limits = c.resources?.limits as Record<string, unknown> | undefined;
+    return Boolean(requests?.[NVIDIA_GPU_RESOURCE]) || Boolean(limits?.[NVIDIA_GPU_RESOURCE]);
+  });
+}
+
+/**
+ * True when `tolerations` includes one that tolerates the `nvidia.com/gpu`
+ * taint — either an explicit `key: "nvidia.com/gpu"` toleration, or a
+ * wildcard `{ operator: "Exists" }` with no key (tolerates every taint).
+ */
+export function toleratesGpu(tolerations: unknown): boolean {
+  if (!Array.isArray(tolerations)) return false;
+  return (tolerations as K8sToleration[]).some(
+    (t) => t.key === NVIDIA_GPU_RESOURCE || (t.operator === "Exists" && !t.key),
+  );
+}
+
 /**
  * Parse a Kubernetes memory string to bytes.
  *