@intentius/chant-lexicon-k8s 0.46.0 → 0.50.0

package/dist/rules/wk8305.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 import type { K8sManifest } from "./k8s-helpers";
 
 export const wk8305: PostSynthCheck = {
@@ -16,60 +16,57 @@ export const wk8305: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    const manifests = docsToManifests(ctx);
 
-      // Build a map of Service name+namespace → set of port numbers
-      const servicePorts = collectServicePorts(manifests);
+    // Build a map of Service name+namespace → set of port numbers
+    const servicePorts = collectServicePorts(manifests);
 
-      for (const manifest of manifests) {
-        if (manifest.kind !== "Ingress") continue;
+    for (const manifest of manifests) {
+      if (manifest.kind !== "Ingress") continue;
 
-        const ingressName = manifest.metadata?.name ?? "Ingress";
-        const ingressNamespace = manifest.metadata?.namespace ?? "default";
-        const spec = manifest.spec;
-        if (!spec) continue;
+      const ingressName = manifest.metadata?.name ?? "Ingress";
+      const ingressNamespace = manifest.metadata?.namespace ?? "default";
+      const spec = manifest.spec;
+      if (!spec) continue;
 
-        const rules = spec.rules as Array<Record<string, unknown>> | undefined;
-        if (!rules) continue;
+      const rules = spec.rules as Array<Record<string, unknown>> | undefined;
+      if (!rules) continue;
 
-        for (const rule of rules) {
-          const http = rule.http as Record<string, unknown> | undefined;
-          if (!http) continue;
+      for (const rule of rules) {
+        const http = rule.http as Record<string, unknown> | undefined;
+        if (!http) continue;
 
-          const paths = http.paths as Array<Record<string, unknown>> | undefined;
-          if (!paths) continue;
+        const paths = http.paths as Array<Record<string, unknown>> | undefined;
+        if (!paths) continue;
 
-          for (const pathEntry of paths) {
-            const backend = pathEntry.backend as Record<string, unknown> | undefined;
-            if (!backend) continue;
+        for (const pathEntry of paths) {
+          const backend = pathEntry.backend as Record<string, unknown> | undefined;
+          if (!backend) continue;
 
-            const service = backend.service as Record<string, unknown> | undefined;
-            if (!service) continue;
+          const service = backend.service as Record<string, unknown> | undefined;
+          if (!service) continue;
 
-            const svcName = service.name as string | undefined;
-            const port = service.port as Record<string, unknown> | undefined;
-            const portNumber = port?.number as number | undefined;
+          const svcName = service.name as string | undefined;
+          const port = service.port as Record<string, unknown> | undefined;
+          const portNumber = port?.number as number | undefined;
 
-            if (!svcName || portNumber === undefined) continue;
+          if (!svcName || portNumber === undefined) continue;
 
-            // Look up the Service in the manifest set
-            const key = `${ingressNamespace}/${svcName}`;
-            const knownPorts = servicePorts.get(key);
+          // Look up the Service in the manifest set
+          const key = `${ingressNamespace}/${svcName}`;
+          const knownPorts = servicePorts.get(key);
 
-            // Skip if the Service is not in the manifest set (external service)
-            if (!knownPorts) continue;
+          // Skip if the Service is not in the manifest set (external service)
+          if (!knownPorts) continue;
 
-            if (!knownPorts.has(portNumber)) {
-              diagnostics.push({
-                checkId: "WK8305",
-                severity: "warning",
-                message: `Ingress "${ingressName}" references Service "${svcName}" port ${portNumber}, but the Service only declares ports [${[...knownPorts].join(", ")}]`,
-                entity: ingressName,
-                lexicon: "k8s",
-              });
-            }
+          if (!knownPorts.has(portNumber)) {
+            diagnostics.push({
+              checkId: "WK8305",
+              severity: "warning",
+              message: `Ingress "${ingressName}" references Service "${svcName}" port ${portNumber}, but the Service only declares ports [${[...knownPorts].join(", ")}]`,
+              entity: ingressName,
+              lexicon: "k8s",
+            });
           }
         }
       }

package/dist/rules/wk8306.ts

@@ -8,7 +8,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8306: PostSynthCheck = {
   id: "WK8306",
@@ -17,30 +17,25 @@ export const wk8306: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-        const containers = extractContainers(manifest);
-
-        for (const container of containers) {
-          const command = (container as Record<string, unknown>).command as unknown[] | undefined;
-          if (!Array.isArray(command) || command.length === 0) continue;
-
-          const firstArg = String(command[0]);
-          if (firstArg.startsWith("-")) {
-            diagnostics.push({
-              checkId: "WK8306",
-              severity: "error",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has command[0]="${firstArg}" which starts with a flag — the first element should be the binary, flags belong in args`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+      const containers = extractContainers(manifest);
+
+      for (const container of containers) {
+        const command = (container as Record<string, unknown>).command as unknown[] | undefined;
+        if (!Array.isArray(command) || command.length === 0) continue;
+
+        const firstArg = String(command[0]);
+        if (firstArg.startsWith("-")) {
+          diagnostics.push({
+            checkId: "WK8306",
+            severity: "error",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has command[0]="${firstArg}" which starts with a flag — the first element should be the binary, flags belong in args`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/dist/rules/wk8401.ts

@@ -8,7 +8,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, parseMemoryBytes } from "./k8s-helpers";
+import { docsToManifests, parseMemoryBytes } from "./k8s-helpers";
 
 export const wk8401: PostSynthCheck = {
   id: "WK8401",
@@ -17,77 +17,72 @@ export const wk8401: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (manifest.kind !== "RayCluster") continue;
 
-      for (const manifest of manifests) {
-        if (manifest.kind !== "RayCluster") continue;
+      const clusterName = manifest.metadata?.name ?? "RayCluster";
+      const spec = manifest.spec as Record<string, unknown> | undefined;
+      if (!spec) continue;
 
-        const clusterName = manifest.metadata?.name ?? "RayCluster";
-        const spec = manifest.spec as Record<string, unknown> | undefined;
-        if (!spec) continue;
+      const groups: Array<{ label: string; templateSpec: Record<string, unknown> }> = [];
 
-        const groups: Array<{ label: string; templateSpec: Record<string, unknown> }> = [];
+      // Head group
+      const headGroupSpec = spec.headGroupSpec as Record<string, unknown> | undefined;
+      if (headGroupSpec) {
+        const tmpl = headGroupSpec.template as Record<string, unknown> | undefined;
+        const podSpec = tmpl?.spec as Record<string, unknown> | undefined;
+        if (podSpec) groups.push({ label: "head", templateSpec: podSpec });
+      }
 
-        // Head group
-        const headGroupSpec = spec.headGroupSpec as Record<string, unknown> | undefined;
-        if (headGroupSpec) {
-          const tmpl = headGroupSpec.template as Record<string, unknown> | undefined;
+      // Worker groups
+      const workerGroupSpecs = spec.workerGroupSpecs as Array<Record<string, unknown>> | undefined;
+      if (Array.isArray(workerGroupSpecs)) {
+        for (const wg of workerGroupSpecs) {
+          const name = (wg.groupName as string | undefined) ?? "worker";
+          const tmpl = wg.template as Record<string, unknown> | undefined;
           const podSpec = tmpl?.spec as Record<string, unknown> | undefined;
-          if (podSpec) groups.push({ label: "head", templateSpec: podSpec });
-        }
-
-        // Worker groups
-        const workerGroupSpecs = spec.workerGroupSpecs as Array<Record<string, unknown>> | undefined;
-        if (Array.isArray(workerGroupSpecs)) {
-          for (const wg of workerGroupSpecs) {
-            const name = (wg.groupName as string | undefined) ?? "worker";
-            const tmpl = wg.template as Record<string, unknown> | undefined;
-            const podSpec = tmpl?.spec as Record<string, unknown> | undefined;
-            if (podSpec) groups.push({ label: `worker "${name}"`, templateSpec: podSpec });
-          }
+          if (podSpec) groups.push({ label: `worker "${name}"`, templateSpec: podSpec });
         }
+      }
 
-        for (const { label, templateSpec } of groups) {
-          // Find the emptyDir Memory volume (dshm)
-          const volumes = templateSpec.volumes as Array<Record<string, unknown>> | undefined;
-          if (!Array.isArray(volumes)) continue;
-
-          for (const vol of volumes) {
-            const emptyDir = vol.emptyDir as Record<string, unknown> | undefined;
-            if (!emptyDir || emptyDir.medium !== "Memory") continue;
-
-            const sizeLimit = emptyDir.sizeLimit as string | undefined;
-            if (!sizeLimit) continue;
-
-            const shmBytes = parseMemoryBytes(sizeLimit);
-            if (isNaN(shmBytes)) continue;
-
-            // Find memory limit from the first container that mounts this volume
-            const containers = templateSpec.containers as Array<Record<string, unknown>> | undefined;
-            if (!Array.isArray(containers)) continue;
-
-            for (const container of containers) {
-              const resources = container.resources as Record<string, unknown> | undefined;
-              const limits = resources?.limits as Record<string, unknown> | undefined;
-              const memLimit = limits?.memory as string | undefined;
-              if (!memLimit) continue;
-
-              const memBytes = parseMemoryBytes(memLimit);
-              if (isNaN(memBytes)) continue;
-
-              if (shmBytes > memBytes) {
-                diagnostics.push({
-                  checkId: "WK8401",
-                  severity: "error",
-                  message: `RayCluster "${clusterName}" ${label}: shmSize "${sizeLimit}" exceeds memory limit "${memLimit}" — pod will not schedule`,
-                  entity: clusterName,
-                  lexicon: "k8s",
-                });
-              }
-              break; // Only check the first container per group
+      for (const { label, templateSpec } of groups) {
+        // Find the emptyDir Memory volume (dshm)
+        const volumes = templateSpec.volumes as Array<Record<string, unknown>> | undefined;
+        if (!Array.isArray(volumes)) continue;
+
+        for (const vol of volumes) {
+          const emptyDir = vol.emptyDir as Record<string, unknown> | undefined;
+          if (!emptyDir || emptyDir.medium !== "Memory") continue;
+
+          const sizeLimit = emptyDir.sizeLimit as string | undefined;
+          if (!sizeLimit) continue;
+
+          const shmBytes = parseMemoryBytes(sizeLimit);
+          if (isNaN(shmBytes)) continue;
+
+          // Find memory limit from the first container that mounts this volume
+          const containers = templateSpec.containers as Array<Record<string, unknown>> | undefined;
+          if (!Array.isArray(containers)) continue;
+
+          for (const container of containers) {
+            const resources = container.resources as Record<string, unknown> | undefined;
+            const limits = resources?.limits as Record<string, unknown> | undefined;
+            const memLimit = limits?.memory as string | undefined;
+            if (!memLimit) continue;
+
+            const memBytes = parseMemoryBytes(memLimit);
+            if (isNaN(memBytes)) continue;
+
+            if (shmBytes > memBytes) {
+              diagnostics.push({
+                checkId: "WK8401",
+                severity: "error",
+                message: `RayCluster "${clusterName}" ${label}: shmSize "${sizeLimit}" exceeds memory limit "${memLimit}" — pod will not schedule`,
+                entity: clusterName,
+                lexicon: "k8s",
+              });
             }
+            break; // Only check the first container per group
           }
         }
       }

package/dist/rules/wk8402.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 
 export const wk8402: PostSynthCheck = {
   id: "WK8402",
@@ -16,25 +16,20 @@ export const wk8402: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (manifest.kind !== "RayCluster") continue;
 
-      for (const manifest of manifests) {
-        if (manifest.kind !== "RayCluster") continue;
+      const name = manifest.metadata?.name ?? "RayCluster";
+      const rayVersion = (manifest.spec as Record<string, unknown> | undefined)?.rayVersion;
 
-        const name = manifest.metadata?.name ?? "RayCluster";
-        const rayVersion = (manifest.spec as Record<string, unknown> | undefined)?.rayVersion;
-
-        if (!rayVersion) {
-          diagnostics.push({
-            checkId: "WK8402",
-            severity: "warning",
-            message: `RayCluster "${name}" is missing spec.rayVersion — KubeRay autoscaler will pull the "latest" image tag`,
-            entity: name,
-            lexicon: "k8s",
-          });
-        }
+      if (!rayVersion) {
+        diagnostics.push({
+          checkId: "WK8402",
+          severity: "warning",
+          message: `RayCluster "${name}" is missing spec.rayVersion — KubeRay autoscaler will pull the "latest" image tag`,
+          entity: name,
+          lexicon: "k8s",
+        });
       }
     }
 

package/dist/rules/wk8403.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractRayVersion } from "./k8s-helpers";
+import { docsToManifests, extractRayVersion } from "./k8s-helpers";
 
 export const wk8403: PostSynthCheck = {
   id: "WK8403",
@@ -16,42 +16,37 @@ export const wk8403: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (manifest.kind !== "RayCluster") continue;
-
-        const clusterName = manifest.metadata?.name ?? "RayCluster";
-        const spec = manifest.spec as Record<string, unknown> | undefined;
-        if (!spec) continue;
-
-        const rayVersion = spec.rayVersion as string | undefined;
-        if (!rayVersion) continue; // WK8402 covers the missing case
-
-        // Extract version from head container image
-        const headGroupSpec = spec.headGroupSpec as Record<string, unknown> | undefined;
-        const tmpl = headGroupSpec?.template as Record<string, unknown> | undefined;
-        const podSpec = tmpl?.spec as Record<string, unknown> | undefined;
-        const containers = podSpec?.containers as Array<Record<string, unknown>> | undefined;
-        if (!Array.isArray(containers) || containers.length === 0) continue;
-
-        const image = containers[0].image as string | undefined;
-        if (!image) continue;
-
-        const imageVersion = extractRayVersion(image);
-        if (!imageVersion) continue; // Can't determine version from tag
-
-        if (imageVersion !== rayVersion) {
-          diagnostics.push({
-            checkId: "WK8403",
-            severity: "warning",
-            message: `RayCluster "${clusterName}": spec.rayVersion "${rayVersion}" does not match head image tag "${imageVersion}" — autoscaler may run a mismatched Ray version`,
-            entity: clusterName,
-            lexicon: "k8s",
-          });
-        }
+    for (const manifest of docsToManifests(ctx)) {
+      if (manifest.kind !== "RayCluster") continue;
+
+      const clusterName = manifest.metadata?.name ?? "RayCluster";
+      const spec = manifest.spec as Record<string, unknown> | undefined;
+      if (!spec) continue;
+
+      const rayVersion = spec.rayVersion as string | undefined;
+      if (!rayVersion) continue; // WK8402 covers the missing case
+
+      // Extract version from head container image
+      const headGroupSpec = spec.headGroupSpec as Record<string, unknown> | undefined;
+      const tmpl = headGroupSpec?.template as Record<string, unknown> | undefined;
+      const podSpec = tmpl?.spec as Record<string, unknown> | undefined;
+      const containers = podSpec?.containers as Array<Record<string, unknown>> | undefined;
+      if (!Array.isArray(containers) || containers.length === 0) continue;
+
+      const image = containers[0].image as string | undefined;
+      if (!image) continue;
+
+      const imageVersion = extractRayVersion(image);
+      if (!imageVersion) continue; // Can't determine version from tag
+
+      if (imageVersion !== rayVersion) {
+        diagnostics.push({
+          checkId: "WK8403",
+          severity: "warning",
+          message: `RayCluster "${clusterName}": spec.rayVersion "${rayVersion}" does not match head image tag "${imageVersion}" — autoscaler may run a mismatched Ray version`,
+          entity: clusterName,
+          lexicon: "k8s",
+        });
       }
     }
 

package/dist/rules/wk8404.ts

@@ -0,0 +1,49 @@
+/**
+ * WK8404: GPU request without a matching toleration
+ *
+ * A pod that requests `nvidia.com/gpu` but carries no toleration for the
+ * `nvidia.com/gpu` taint won't schedule onto a tainted GPU node pool (see
+ * `GpuNodePool`, #987, which taints its nodes `nvidia.com/gpu=present` by
+ * default). The pod sits `Pending` with `0/N nodes are available` until a
+ * toleration is added.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import {
+  docsToManifests,
+  extractContainers,
+  extractPodSpec,
+  requestsGpu,
+  toleratesGpu,
+  GPU_POD_KINDS,
+} from "./k8s-helpers";
+
+export const wk8404: PostSynthCheck = {
+  id: "WK8404",
+  description: "GPU request without a matching nvidia.com/gpu toleration",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !GPU_POD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      if (!requestsGpu(containers)) continue;
+
+      const podSpec = extractPodSpec(manifest);
+      if (toleratesGpu(podSpec?.tolerations)) continue;
+
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+      diagnostics.push({
+        checkId: "WK8404",
+        severity: "error",
+        message: `${manifest.kind} "${resourceName}" requests nvidia.com/gpu but has no toleration for the nvidia.com/gpu taint — it will not schedule onto a tainted GPU node pool`,
+        entity: resourceName,
+        lexicon: "k8s",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wk8405.ts

@@ -0,0 +1,85 @@
+/**
+ * WK8405: Serving workload without a PodDisruptionBudget
+ *
+ * An InferenceService (or a Deployment carrying a serving
+ * `app.kubernetes.io/component` label — e.g. `inference-service` or
+ * `vllm-serving-runtime`) with no PodDisruptionBudget selecting it can lose
+ * every replica at once during a voluntary disruption (node drain, cluster
+ * upgrade), taking the model endpoint down. Serving workloads should ship
+ * with a PDB.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { docsToManifests } from "./k8s-helpers";
+import type { K8sManifest } from "./k8s-helpers";
+
+/** `app.kubernetes.io/component` values this lexicon's composites use for serving workloads. */
+const SERVING_COMPONENTS = new Set(["inference-service", "vllm-serving-runtime", "model-serving"]);
+
+function isServingWorkload(manifest: K8sManifest): boolean {
+  if (manifest.kind === "InferenceService") return true;
+  if (manifest.kind !== "Deployment" && manifest.kind !== "StatefulSet") return false;
+  const component = manifest.metadata?.labels?.["app.kubernetes.io/component"];
+  return component !== undefined && SERVING_COMPONENTS.has(component);
+}
+
+export const wk8405: PostSynthCheck = {
+  id: "WK8405",
+  description: "Serving workload (InferenceService / serving Deployment) has no PodDisruptionBudget",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    const manifests = docsToManifests(ctx);
+
+    const pdbSelectors = collectPdbSelectors(manifests);
+
+    for (const manifest of manifests) {
+      if (!isServingWorkload(manifest)) continue;
+
+      const labels = manifest.metadata?.labels;
+      const resourceName = manifest.metadata?.name ?? manifest.kind ?? "workload";
+
+      if (!labels || !hasCoveringPdb(labels, pdbSelectors)) {
+        diagnostics.push({
+          checkId: "WK8405",
+          severity: "info",
+          message: `${manifest.kind} "${resourceName}" is a serving workload with no PodDisruptionBudget — add a PDB so a node drain or cluster upgrade cannot take down every replica at once`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};
+
+function collectPdbSelectors(manifests: K8sManifest[]): Array<Record<string, string>> {
+  const selectors: Array<Record<string, string>> = [];
+
+  for (const manifest of manifests) {
+    if (manifest.kind !== "PodDisruptionBudget") continue;
+
+    const spec = manifest.spec;
+    if (!spec) continue;
+
+    const selector = spec.selector as Record<string, unknown> | undefined;
+    const matchLabels = selector?.matchLabels as Record<string, string> | undefined;
+
+    if (matchLabels && typeof matchLabels === "object") {
+      selectors.push(matchLabels);
+    }
+  }
+
+  return selectors;
+}
+
+function hasCoveringPdb(
+  workloadLabels: Record<string, string>,
+  pdbSelectors: Array<Record<string, string>>,
+): boolean {
+  return pdbSelectors.some((pdbLabels) =>
+    Object.entries(pdbLabels).every(([key, value]) => workloadLabels[key] === value),
+  );
+}

package/dist/rules/wk8406.ts

@@ -0,0 +1,55 @@
+/**
+ * WK8406: No resource limits on a GPU pod
+ *
+ * A container that requests `nvidia.com/gpu` but sets no cpu/memory limits
+ * can starve other pods on the same (expensive, scarce) GPU node of CPU and
+ * memory headroom. Unlike WK8201's general resource-limits guidance, this
+ * check is scoped to GPU-requesting containers specifically, since GPU node
+ * capacity is costlier and more contended than a general-purpose pool.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { docsToManifests, extractContainers, GPU_POD_KINDS, NVIDIA_GPU_RESOURCE } from "./k8s-helpers";
+
+export const wk8406: PostSynthCheck = {
+  id: "WK8406",
+  description: "GPU-requesting container has no cpu/memory resource limits",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !GPU_POD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        const requests = container.resources?.requests as Record<string, unknown> | undefined;
+        const limits = container.resources?.limits as Record<string, unknown> | undefined;
+        const requestsGpu = Boolean(requests?.[NVIDIA_GPU_RESOURCE]) || Boolean(limits?.[NVIDIA_GPU_RESOURCE]);
+        if (!requestsGpu) continue;
+
+        const missing: string[] = [];
+        if (!limits || typeof limits !== "object") {
+          missing.push("cpu", "memory");
+        } else {
+          if (!limits.cpu) missing.push("cpu");
+          if (!limits.memory) missing.push("memory");
+        }
+
+        if (missing.length > 0) {
+          diagnostics.push({
+            checkId: "WK8406",
+            severity: "warning",
+            message: `GPU container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" is missing resource limits for ${missing.join(", ")} — a GPU pod without cpu/memory limits can starve its (scarce, expensive) node`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};