@intentius/chant-lexicon-k8s 0.46.0 → 0.49.0

package/dist/okf/index.md

@@ -15,24 +15,30 @@ okf_version: '0.2'
 * [Application](/types/Application.md) - K8s::Argo::Application
 * [ApplicationSet](/types/ApplicationSet.md) - K8s::Argo::ApplicationSet
 * [AppProject](/types/AppProject.md) - K8s::Argo::AppProject
+* [AWSClusterControllerIdentity](/types/AWSClusterControllerIdentity.md) - K8s::Infrastructure::AWSClusterControllerIdentity
+* [AWSManagedCluster](/types/AWSManagedCluster.md) - K8s::Infrastructure::AWSManagedCluster
+* [AWSManagedControlPlane](/types/AWSManagedControlPlane.md) - K8s::Controlplane::AWSManagedControlPlane
+* [AWSManagedMachinePool](/types/AWSManagedMachinePool.md) - K8s::Infrastructure::AWSManagedMachinePool
 * [Backup](/types/Backup.md) - K8s::Cnpg::Backup
 * [BatchJob](/types/BatchJob.md) - K8s::Batch::Job
 * [Binding](/types/Binding.md) - K8s::Core::Binding
-* [Bucket](/types/Bucket.md) - K8s::Flux::Bucket
+* [CAPICluster](/types/CAPICluster.md) - K8s::CAPI::Cluster
 * [Certificate](/types/Certificate.md) - K8s::CertManager::Certificate
 * [CertificateRequest](/types/CertificateRequest.md) - K8s::CertManager::CertificateRequest
 * [CertificateSigningRequest](/types/CertificateSigningRequest.md) - K8s::Certificates::CertificateSigningRequest
 * [CertificateSigningRequestList](/types/CertificateSigningRequestList.md) - K8s::Certificates::CertificateSigningRequestList
 * [Challenge](/types/Challenge.md) - K8s::Acme::Challenge
-* [Cluster](/types/Cluster.md) - K8s::Cnpg::Cluster
 * [ClusterIssuer](/types/ClusterIssuer.md) - K8s::CertManager::ClusterIssuer
+* [ClusterResourceSet](/types/ClusterResourceSet.md) - K8s::Addons::ClusterResourceSet
 * [ClusterRole](/types/ClusterRole.md) - K8s::Rbac::ClusterRole
 * [ClusterRoleBinding](/types/ClusterRoleBinding.md) - K8s::Rbac::ClusterRoleBinding
 * [ClusterRoleBindingList](/types/ClusterRoleBindingList.md) - K8s::Rbac::ClusterRoleBindingList
 * [ClusterRoleList](/types/ClusterRoleList.md) - K8s::Rbac::ClusterRoleList
+* [ClusterServingRuntime](/types/ClusterServingRuntime.md) - K8s::KServe::ClusterServingRuntime
 * [ClusterTrustBundle](/types/ClusterTrustBundle.md) - K8s::Certificates::ClusterTrustBundle
 * [ClusterTrustBundleList](/types/ClusterTrustBundleList.md) - K8s::Certificates::ClusterTrustBundleList
 * [CM](/types/CM.md) - K8s::Core::ConfigMap
+* [CnpgCluster](/types/CnpgCluster.md) - K8s::Cnpg::Cluster
 * [ComponentStatus](/types/ComponentStatus.md) - K8s::Core::ComponentStatus
 * [ComponentStatusList](/types/ComponentStatusList.md) - K8s::Core::ComponentStatusList
 * [ConfigMapList](/types/ConfigMapList.md) - K8s::Core::ConfigMapList
@@ -52,6 +58,7 @@ okf_version: '0.2'
 * [CustomResourceDefinitionList](/types/CustomResourceDefinitionList.md) - K8s::Apiextensions::CustomResourceDefinitionList
 * [DaemonSet](/types/DaemonSet.md) - K8s::Apps::DaemonSet
 * [DaemonSetList](/types/DaemonSetList.md) - K8s::Apps::DaemonSetList
+* [DBInstance](/types/DBInstance.md) - K8s::Rds::DBInstance
 * [DeleteOptions](/types/DeleteOptions.md) - K8s::Core::DeleteOptions
 * [Deploy](/types/Deploy.md) - K8s::Apps::Deployment
 * [DeploymentList](/types/DeploymentList.md) - K8s::Apps::DeploymentList
@@ -69,6 +76,7 @@ okf_version: '0.2'
 * [Eviction](/types/Eviction.md) - K8s::Policy::Eviction
 * [FlowSchema](/types/FlowSchema.md) - K8s::Flowcontrol::FlowSchema
 * [FlowSchemaList](/types/FlowSchemaList.md) - K8s::Flowcontrol::FlowSchemaList
+* [FluxBucket](/types/FluxBucket.md) - K8s::Flux::Bucket
 * [FluxHelmChart](/types/FluxHelmChart.md) - K8s::Flux::HelmChart
 * [FluxInstance](/types/FluxInstance.md) - K8s::Flux::FluxInstance
 * [FluxReport](/types/FluxReport.md) - K8s::Flux::FluxReport
@@ -77,14 +85,17 @@ okf_version: '0.2'
 * [GitRepository](/types/GitRepository.md) - K8s::Flux::GitRepository
 * [GRPCRoute](/types/GRPCRoute.md) - K8s::Gateway::GRPCRoute
 * [HelmChartConfig](/types/HelmChartConfig.md) - K8s::K3s::HelmChartConfig
+* [HelmChartProxy](/types/HelmChartProxy.md) - K8s::Addons::HelmChartProxy
 * [HelmRelease](/types/HelmRelease.md) - K8s::Flux::HelmRelease
 * [HelmRepository](/types/HelmRepository.md) - K8s::Flux::HelmRepository
 * [HorizontalPodAutoscaler](/types/HorizontalPodAutoscaler.md) - K8s::Autoscaling::HorizontalPodAutoscaler
 * [HorizontalPodAutoscalerList](/types/HorizontalPodAutoscalerList.md) - K8s::Autoscaling::HorizontalPodAutoscalerList
 * [HTTPRoute](/types/HTTPRoute.md) - K8s::Gateway::HTTPRoute
+* [IamRole](/types/IamRole.md) - K8s::Iam::Role
 * [ImagePolicy](/types/ImagePolicy.md) - K8s::Flux::ImagePolicy
 * [ImageRepository](/types/ImageRepository.md) - K8s::Flux::ImageRepository
 * [ImageUpdateAutomation](/types/ImageUpdateAutomation.md) - K8s::Flux::ImageUpdateAutomation
+* [InferenceService](/types/InferenceService.md) - K8s::KServe::InferenceService
 * [InfisicalDynamicSecret](/types/InfisicalDynamicSecret.md) - K8s::Infisical::InfisicalDynamicSecret
 * [InfisicalPushSecret](/types/InfisicalPushSecret.md) - K8s::Infisical::InfisicalPushSecret
 * [InfisicalSecret](/types/InfisicalSecret.md) - K8s::Infisical::InfisicalSecret
@@ -108,6 +119,7 @@ okf_version: '0.2'
 * [LimitRange](/types/LimitRange.md) - K8s::Core::LimitRange
 * [LimitRangeList](/types/LimitRangeList.md) - K8s::Core::LimitRangeList
 * [LocalSubjectAccessReview](/types/LocalSubjectAccessReview.md) - K8s::Authorization::LocalSubjectAccessReview
+* [MachinePool](/types/MachinePool.md) - K8s::CAPI::MachinePool
 * [MicroVM](/types/MicroVM.md) - K8s::KubeMicroVM::MicroVM
 * [MicroVMClass](/types/MicroVMClass.md) - K8s::KubeMicroVM::MicroVMClass
 * [MicroVMImage](/types/MicroVMImage.md) - K8s::KubeMicroVM::MicroVMImage
@@ -139,9 +151,11 @@ okf_version: '0.2'
 * [PodCertificateRequest](/types/PodCertificateRequest.md) - K8s::Certificates::PodCertificateRequest
 * [PodCertificateRequestList](/types/PodCertificateRequestList.md) - K8s::Certificates::PodCertificateRequestList
 * [PodDisruptionBudgetList](/types/PodDisruptionBudgetList.md) - K8s::Policy::PodDisruptionBudgetList
+* [PodIdentityAssociation](/types/PodIdentityAssociation.md) - K8s::Eks::PodIdentityAssociation
 * [PodList](/types/PodList.md) - K8s::Core::PodList
 * [PodTemplate](/types/PodTemplate.md) - K8s::Core::PodTemplate
 * [PodTemplateList](/types/PodTemplateList.md) - K8s::Core::PodTemplateList
+* [Policy](/types/Policy.md) - K8s::Iam::Policy
 * [Pooler](/types/Pooler.md) - K8s::Cnpg::Pooler
 * [PriorityClass](/types/PriorityClass.md) - K8s::Scheduling::PriorityClass
 * [PriorityClassList](/types/PriorityClassList.md) - K8s::Scheduling::PriorityClassList
@@ -174,6 +188,7 @@ okf_version: '0.2'
 * [RoleList](/types/RoleList.md) - K8s::Rbac::RoleList
 * [RuntimeClass](/types/RuntimeClass.md) - K8s::Node::RuntimeClass
 * [RuntimeClassList](/types/RuntimeClassList.md) - K8s::Node::RuntimeClassList
+* [S3Bucket](/types/S3Bucket.md) - K8s::S3::Bucket
 * [SA](/types/SA.md) - K8s::Core::ServiceAccount
 * [Scale](/types/Scale.md) - K8s::Autoscaling::Scale
 * [ScheduledBackup](/types/ScheduledBackup.md) - K8s::Cnpg::ScheduledBackup
@@ -190,6 +205,7 @@ okf_version: '0.2'
 * [ServiceCIDRList](/types/ServiceCIDRList.md) - K8s::Networking::ServiceCIDRList
 * [ServiceList](/types/ServiceList.md) - K8s::Core::ServiceList
 * [ServiceMonitor](/types/ServiceMonitor.md) - K8s::Monitoring::ServiceMonitor
+* [ServingRuntime](/types/ServingRuntime.md) - K8s::KServe::ServingRuntime
 * [StatefulSet](/types/StatefulSet.md) - K8s::Apps::StatefulSet
 * [StatefulSetList](/types/StatefulSetList.md) - K8s::Apps::StatefulSetList
 * [Status](/types/Status.md) - K8s::Core::Status
@@ -203,6 +219,7 @@ okf_version: '0.2'
 * [TokenRequest](/types/TokenRequest.md) - K8s::Authentication::TokenRequest
 * [TokenReview](/types/TokenReview.md) - K8s::Authentication::TokenReview
 * [TraefikService](/types/TraefikService.md) - K8s::Traefik::TraefikService
+* [User](/types/User.md) - K8s::Iam::User
 * [ValidatingAdmissionPolicy](/types/ValidatingAdmissionPolicy.md) - K8s::Admissionregistration::ValidatingAdmissionPolicy
 * [ValidatingAdmissionPolicyBinding](/types/ValidatingAdmissionPolicyBinding.md) - K8s::Admissionregistration::ValidatingAdmissionPolicyBinding
 * [ValidatingAdmissionPolicyBindingList](/types/ValidatingAdmissionPolicyBindingList.md) - K8s::Admissionregistration::ValidatingAdmissionPolicyBindingList
@@ -254,5 +271,12 @@ okf_version: '0.2'
 * [WK8401](/rules/WK8401.md) - shmSize must not exceed the container memory limit — pod will not schedule if it does
 * [WK8402](/rules/WK8402.md) - RayCluster should set spec.rayVersion so KubeRay selects the correct autoscaler image
 * [WK8403](/rules/WK8403.md) - spec.rayVersion should match the Ray version in the head container image tag
+* [WK8404](/rules/WK8404.md) - GPU request without a matching nvidia.com/gpu toleration
+* [WK8405](/rules/WK8405.md) - Serving workload (InferenceService / serving Deployment) has no PodDisruptionBudget
+* [WK8406](/rules/WK8406.md) - GPU-requesting container has no cpu/memory resource limits
+* [WK8407](/rules/WK8407.md) - InferenceService model storageUri has no explicit version segment
 * [WK8501](/rules/WK8501.md) - Custom resource spec contains a field its CRD schema does not declare
 * [WK8502](/rules/WK8502.md) - Custom resource spec field has the wrong type or a value outside its enum
+* [WK8503](/rules/WK8503.md) - Workload consumes a Secret nothing in the output produces — produce it (Secret, ExternalSecret, InfisicalSecret, Certificate) or declare its provenance with...
+* [WK8504](/rules/WK8504.md) - committed-encrypted secret declaration does not resolve — the declared file is missing, is not the named Secret, or is not encrypted
+* [WK8505](/rules/WK8505.md) - committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it

package/dist/okf/rules/FLUX002.md

@@ -12,7 +12,6 @@ Kustomization.spec.sourceRef must reference a declared source (or the bootstrap
 
 ## Applies to
 
-- [Bucket](/types/Bucket.md)
 - [GitRepository](/types/GitRepository.md)
 - [Kustomization](/types/Kustomization.md)
 - [Namespace](/types/Namespace.md)

package/dist/okf/rules/WK8404.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8404
+description: GPU request without a matching nvidia.com/gpu toleration
+id: WK8404
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+GPU request without a matching nvidia.com/gpu toleration

package/dist/okf/rules/WK8405.md

@@ -0,0 +1,17 @@
+---
+type: post-synth-check
+title: WK8405
+description: Serving workload (InferenceService / serving Deployment) has no PodDisruptionBudget
+id: WK8405
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Serving workload (InferenceService / serving Deployment) has no PodDisruptionBudget
+
+## Applies to
+
+- [InferenceService](/types/InferenceService.md)
+- [PDB](/types/PDB.md)
+- [StatefulSet](/types/StatefulSet.md)

package/dist/okf/rules/WK8406.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8406
+description: GPU-requesting container has no cpu/memory resource limits
+id: WK8406
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+GPU-requesting container has no cpu/memory resource limits

package/dist/okf/rules/WK8407.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8407
+description: InferenceService model storageUri has no explicit version segment
+id: WK8407
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+InferenceService model storageUri has no explicit version segment
+
+## Applies to
+
+- [InferenceService](/types/InferenceService.md)

package/dist/okf/rules/WK8503.md

@@ -0,0 +1,17 @@
+---
+type: post-synth-check
+title: WK8503
+description: Workload consumes a Secret nothing in the output produces — produce it (Secret, ExternalSecret, InfisicalSecret, Certificate) or declare its provenance with declareSecret()
+id: WK8503
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+Workload consumes a Secret nothing in the output produces — produce it (Secret, ExternalSecret, InfisicalSecret, Certificate) or declare its provenance with declareSecret()
+
+## Applies to
+
+- [Certificate](/types/Certificate.md)
+- [InfisicalDynamicSecret](/types/InfisicalDynamicSecret.md)
+- [InfisicalSecret](/types/InfisicalSecret.md)

package/dist/okf/rules/WK8504.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WK8504
+description: committed-encrypted secret declaration does not resolve — the declared file is missing, is not the named Secret, or is not encrypted
+id: WK8504
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+committed-encrypted secret declaration does not resolve — the declared file is missing, is not the named Secret, or is not encrypted

package/dist/okf/rules/WK8505.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WK8505
+description: 'committed-encrypted secret with no Flux decryption wiring — add decryption: ''sops'' to the FluxAppFor reconciling the path that carries it'
+id: WK8505
+severity: error
+category: post-synth
+lexicon: k8s
+docs: https://intentius.io/chant/lexicons/k8s/rules/
+---
+committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it
+
+## Applies to
+
+- [Kustomization](/types/Kustomization.md)

package/dist/okf/types/AWSClusterControllerIdentity.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: AWSClusterControllerIdentity
+description: k8s resource type K8s::Infrastructure::AWSClusterControllerIdentity
+name: AWSClusterControllerIdentity
+lexicon: k8s
+resource_type: K8s::Infrastructure::AWSClusterControllerIdentity
+---
+`K8s::Infrastructure::AWSClusterControllerIdentity`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): Spec for this AWSClusterControllerIdentity.

package/dist/okf/types/AWSManagedCluster.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: AWSManagedCluster
+description: k8s resource type K8s::Infrastructure::AWSManagedCluster
+name: AWSManagedCluster
+lexicon: k8s
+resource_type: K8s::Infrastructure::AWSManagedCluster
+---
+`K8s::Infrastructure::AWSManagedCluster`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): AWSManagedClusterSpec defines the desired state of AWSManagedCluster

package/dist/okf/types/AWSManagedControlPlane.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: AWSManagedControlPlane
+description: k8s resource type K8s::Controlplane::AWSManagedControlPlane
+name: AWSManagedControlPlane
+lexicon: k8s
+resource_type: K8s::Controlplane::AWSManagedControlPlane
+---
+`K8s::Controlplane::AWSManagedControlPlane`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): AWSManagedControlPlaneSpec defines the desired state of an Amazon EKS Cluster.

package/dist/okf/types/AWSManagedMachinePool.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: AWSManagedMachinePool
+description: k8s resource type K8s::Infrastructure::AWSManagedMachinePool
+name: AWSManagedMachinePool
+lexicon: k8s
+resource_type: K8s::Infrastructure::AWSManagedMachinePool
+---
+`K8s::Infrastructure::AWSManagedMachinePool`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): AWSManagedMachinePoolSpec defines the desired state of AWSManagedMachinePool.

package/dist/okf/types/CAPICluster.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: CAPICluster
+description: k8s resource type K8s::CAPI::Cluster
+name: CAPICluster
+lexicon: k8s
+resource_type: K8s::CAPI::Cluster
+---
+`K8s::CAPI::Cluster`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): spec is the desired state of Cluster.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.

package/dist/okf/types/Certificate.md

@@ -16,3 +16,4 @@ resource_type: K8s::CertManager::Certificate
 ## Governed by
 
 - [WK8304](/rules/WK8304.md): SSL redirect without certificate — ssl-redirect annotation requires a valid certificate-arn and HTTPS listen-ports
+- [WK8503](/rules/WK8503.md): Workload consumes a Secret nothing in the output produces — produce it (Secret, ExternalSecret, InfisicalSecret, Certificate) or declare its provenance with declareSecret()

package/dist/okf/types/ClusterResourceSet.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ClusterResourceSet
+description: k8s resource type K8s::Addons::ClusterResourceSet
+name: ClusterResourceSet
+lexicon: k8s
+resource_type: K8s::Addons::ClusterResourceSet
+---
+`K8s::Addons::ClusterResourceSet`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): spec is the desired state of ClusterResourceSet.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.

package/dist/okf/types/ClusterServingRuntime.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ClusterServingRuntime
+description: k8s resource type K8s::KServe::ClusterServingRuntime
+name: ClusterServingRuntime
+lexicon: k8s
+resource_type: K8s::KServe::ClusterServingRuntime
+---
+`K8s::KServe::ClusterServingRuntime`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional)

package/dist/okf/types/{Cluster.md → CnpgCluster.md}

@@ -1,8 +1,8 @@
 ---
 type: resource-type
-title: Cluster
+title: CnpgCluster
 description: k8s resource type K8s::Cnpg::Cluster
-name: Cluster
+name: CnpgCluster
 lexicon: k8s
 resource_type: K8s::Cnpg::Cluster
 ---

package/dist/okf/types/DBInstance.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: DBInstance
+description: k8s resource type K8s::Rds::DBInstance
+name: DBInstance
+lexicon: k8s
+resource_type: K8s::Rds::DBInstance
+---
+`K8s::Rds::DBInstance`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): DBInstanceSpec defines the desired state of DBInstance. Contains the details of an Amazon RDS DB instance. This data type is used as a response element in the operations CreateDBInstance, CreateDBInstanceReadReplica, DeleteDBInstance, DescribeDBInstances, ModifyDBInstance, PromoteReadReplica, RebootDBInstance, RestoreDBInstanceFromDBSnapshot, RestoreDBInstanceFromS3, RestoreDBInstanceToPointInTime, StartDBInstance, and StopDBInstance.

package/dist/okf/types/{Bucket.md → FluxBucket.md}

@@ -1,8 +1,8 @@
 ---
 type: resource-type
-title: Bucket
+title: FluxBucket
 description: k8s resource type K8s::Flux::Bucket
-name: Bucket
+name: FluxBucket
 lexicon: k8s
 resource_type: K8s::Flux::Bucket
 ---
@@ -12,7 +12,3 @@ resource_type: K8s::Flux::Bucket
 
 - `metadata` (`ObjectMeta`, optional): Standard object's metadata.
 - `spec` (`Record<string, unknown>`, optional): BucketSpec specifies the required configuration to produce an Artifact for an object storage bucket.
-
-## Governed by
-
-- [FLUX002](/rules/FLUX002.md): Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)

package/dist/okf/types/HelmChartProxy.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: HelmChartProxy
+description: k8s resource type K8s::Addons::HelmChartProxy
+name: HelmChartProxy
+lexicon: k8s
+resource_type: K8s::Addons::HelmChartProxy
+---
+`K8s::Addons::HelmChartProxy`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): HelmChartProxySpec defines the desired state of HelmChartProxy.

package/dist/okf/types/IamRole.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: IamRole
+description: k8s resource type K8s::Iam::Role
+name: IamRole
+lexicon: k8s
+resource_type: K8s::Iam::Role
+---
+`K8s::Iam::Role`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): RoleSpec defines the desired state of Role. Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.

package/dist/okf/types/InferenceService.md

@@ -0,0 +1,19 @@
+---
+type: resource-type
+title: InferenceService
+description: k8s resource type K8s::KServe::InferenceService
+name: InferenceService
+lexicon: k8s
+resource_type: K8s::KServe::InferenceService
+---
+`K8s::KServe::InferenceService`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional)
+
+## Governed by
+
+- [WK8405](/rules/WK8405.md): Serving workload (InferenceService / serving Deployment) has no PodDisruptionBudget
+- [WK8407](/rules/WK8407.md): InferenceService model storageUri has no explicit version segment

package/dist/okf/types/InfisicalDynamicSecret.md

@@ -12,3 +12,7 @@ resource_type: K8s::Infisical::InfisicalDynamicSecret
 
 - `metadata` (`ObjectMeta`, optional): Standard object's metadata.
 - `spec` (`Record<string, unknown>`, optional): InfisicalDynamicSecretSpec defines the desired state of InfisicalDynamicSecret.
+
+## Governed by
+
+- [WK8503](/rules/WK8503.md): Workload consumes a Secret nothing in the output produces — produce it (Secret, ExternalSecret, InfisicalSecret, Certificate) or declare its provenance with declareSecret()

package/dist/okf/types/InfisicalSecret.md

@@ -12,3 +12,7 @@ resource_type: K8s::Infisical::InfisicalSecret
 
 - `metadata` (`ObjectMeta`, optional): Standard object's metadata.
 - `spec` (`Record<string, unknown>`, optional): InfisicalSecretSpec defines the desired state of InfisicalSecret
+
+## Governed by
+
+- [WK8503](/rules/WK8503.md): Workload consumes a Secret nothing in the output produces — produce it (Secret, ExternalSecret, InfisicalSecret, Certificate) or declare its provenance with declareSecret()

package/dist/okf/types/Kustomization.md

@@ -18,3 +18,4 @@ resource_type: K8s::Flux::Kustomization
 - [FLUX001](/rules/FLUX001.md): GitRepository must pin spec.ref
 - [FLUX002](/rules/FLUX002.md): Kustomization.spec.sourceRef must reference a declared source (or the bootstrap flux-system repo)
 - [FLUX003](/rules/FLUX003.md): Kustomization.spec.dependsOn entries should name Kustomizations declared in the build
+- [WK8505](/rules/WK8505.md): committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it

package/dist/okf/types/MachinePool.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: MachinePool
+description: k8s resource type K8s::CAPI::MachinePool
+name: MachinePool
+lexicon: k8s
+resource_type: K8s::CAPI::MachinePool
+---
+`K8s::CAPI::MachinePool`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): spec is the desired state of MachinePool.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.

package/dist/okf/types/PDB.md

@@ -16,3 +16,4 @@ resource_type: K8s::Policy::PodDisruptionBudget
 ## Governed by
 
 - [WK8303](/rules/WK8303.md): PDB recommended for HA Deployments — ensures availability during voluntary disruptions
+- [WK8405](/rules/WK8405.md): Serving workload (InferenceService / serving Deployment) has no PodDisruptionBudget

package/dist/okf/types/PodIdentityAssociation.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: PodIdentityAssociation
+description: k8s resource type K8s::Eks::PodIdentityAssociation
+name: PodIdentityAssociation
+lexicon: k8s
+resource_type: K8s::Eks::PodIdentityAssociation
+---
+`K8s::Eks::PodIdentityAssociation`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): PodIdentityAssociationSpec defines the desired state of PodIdentityAssociation. Amazon EKS Pod Identity associations provide the ability to manage credentials for your applications, similar to the way that Amazon EC2 instance profiles provide credentials to Amazon EC2 instances.

package/dist/okf/types/Policy.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: Policy
+description: k8s resource type K8s::Iam::Policy
+name: Policy
+lexicon: k8s
+resource_type: K8s::Iam::Policy
+---
+`K8s::Iam::Policy`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): PolicySpec defines the desired state of Policy. Contains information about a managed policy. This data type is used as a response element in the CreatePolicy, GetPolicy, and ListPolicies operations. For more information about managed policies, refer to Managed policies and inline policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the IAM User Guide.

package/dist/okf/types/S3Bucket.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: S3Bucket
+description: k8s resource type K8s::S3::Bucket
+name: S3Bucket
+lexicon: k8s
+resource_type: K8s::S3::Bucket
+---
+`K8s::S3::Bucket`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): BucketSpec defines the desired state of Bucket. In terms of implementation, a Bucket is a resource.

package/dist/okf/types/ServingRuntime.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ServingRuntime
+description: k8s resource type K8s::KServe::ServingRuntime
+name: ServingRuntime
+lexicon: k8s
+resource_type: K8s::KServe::ServingRuntime
+---
+`K8s::KServe::ServingRuntime`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional)

package/dist/okf/types/StatefulSet.md

@@ -17,3 +17,4 @@ resource_type: K8s::Apps::StatefulSet
 
 - [WK8002](/rules/WK8002.md): Latest Image Tag
 - [WK8003](/rules/WK8003.md): Missing Resource Limits
+- [WK8405](/rules/WK8405.md): Serving workload (InferenceService / serving Deployment) has no PodDisruptionBudget

package/dist/okf/types/User.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: User
+description: k8s resource type K8s::Iam::User
+name: User
+lexicon: k8s
+resource_type: K8s::Iam::User
+---
+`K8s::Iam::User`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.
+- `spec` (`Record<string, unknown>`, optional): UserSpec defines the desired state of User. Contains information about an IAM user entity. This data type is used as a response element in the following operations: CreateUser GetUser ListUsers

package/dist/op/activities/ensure-secret.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `ensureSecret` — the activity behind core's `ensureSecret(...)` op step
+ * builder (#1829), provided by the store's lexicon as that builder promises
+ * (#1830). Registered by name through the activity registry when a project's
+ * `chant.config.ts` lists the `k8s` lexicon, exactly like `kubectlApply`.
+ *
+ * All it does is connect (the same environment→cluster binding every k8s
+ * path uses), build the namespace-scoped store adapter, and run core's one
+ * materialization engine over it. The contract — present means done, never
+ * mint over an existing value, mismatches fail naming key names only, no
+ * output carries material — lives in core (`secret-materialization.ts`) and
+ * in the adapter (../../secret-store.ts), not here.
+ */
+import { type EnsureSecretOutcome } from "@intentius/chant/secret-materialization";
+import { type K8sConnector } from "../../api/connect.js";
+export interface EnsureSecretActivityArgs {
+    /** The Secret's `metadata.name`. */
+    name: string;
+    /** The declared key-set. Creation mints one value per key; verification compares names only. */
+    keys: string[];
+    /** Declared metadata (labels/annotations) an existing Secret must carry. Mismatches name the KEY. */
+    metadata?: Record<string, string>;
+    /** Target namespace. Omitted uses the connected context's default namespace. */
+    namespace?: string;
+    /** chant environment, resolved through `k8s.profiles.<env>.context`. */
+    environment?: string;
+    /** Explicit kubectl context — same precedence as `kubectlApply`. */
+    context?: string;
+    /** Project directory whose `chant.config.ts` carries the k8s profiles. */
+    cwd?: string;
+    /** Ownership stack to stamp on a minted Secret (with `env`, the full marker). */
+    stack?: string;
+    /** Ownership env to stamp alongside `stack`. */
+    env?: string;
+}
+/**
+ * Ensure a `generated-once` Secret exists in the target cluster. Returns
+ * names only — see core's `EnsureSecretOutcome`.
+ */
+export declare function ensureSecret(args: EnsureSecretActivityArgs, _signal?: AbortSignal, connect?: K8sConnector): Promise<EnsureSecretOutcome>;
+//# sourceMappingURL=ensure-secret.d.ts.map

package/dist/op/activities/ensure-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-secret.d.ts","sourceRoot":"","sources":["../../../src/op/activities/ensure-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAG3E,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,wBAAwB,EAC9B,OAAO,CAAC,EAAE,WAAW,EACrB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAmB9B"}