@intentius/chant-lexicon-k8s 0.49.0 → 0.50.0

package/dist/rules/wk8102.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 
 export const wk8102: PostSynthCheck = {
   id: "WK8102",
@@ -15,25 +15,20 @@ export const wk8102: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !manifest.metadata) continue;
 
-      for (const manifest of manifests) {
-        if (!manifest.kind || !manifest.metadata) continue;
+      const resourceName = manifest.metadata.name ?? manifest.kind;
+      const labels = manifest.metadata.labels;
 
-        const resourceName = manifest.metadata.name ?? manifest.kind;
-        const labels = manifest.metadata.labels;
-
-        if (!labels || typeof labels !== "object" || Object.keys(labels).length === 0) {
-          diagnostics.push({
-            checkId: "WK8102",
-            severity: "warning",
-            message: `${manifest.kind} "${resourceName}" has no metadata.labels — add labels for organizational purposes`,
-            entity: resourceName,
-            lexicon: "k8s",
-          });
-        }
+      if (!labels || typeof labels !== "object" || Object.keys(labels).length === 0) {
+        diagnostics.push({
+          checkId: "WK8102",
+          severity: "warning",
+          message: `${manifest.kind} "${resourceName}" has no metadata.labels — add labels for organizational purposes`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
       }
     }
 

package/dist/rules/wk8103.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8103: PostSynthCheck = {
   id: "WK8103",
@@ -15,27 +15,22 @@ export const wk8103: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (let i = 0; i < containers.length; i++) {
-          const container = containers[i];
-          if (!container.name || typeof container.name !== "string" || container.name.trim() === "") {
-            diagnostics.push({
-              checkId: "WK8103",
-              severity: "error",
-              message: `${manifest.kind} "${resourceName}" has a container at index ${i} without a name — the name field is required`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (let i = 0; i < containers.length; i++) {
+        const container = containers[i];
+        if (!container.name || typeof container.name !== "string" || container.name.trim() === "") {
+          diagnostics.push({
+            checkId: "WK8103",
+            severity: "error",
+            message: `${manifest.kind} "${resourceName}" has a container at index ${i} without a name — the name field is required`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/dist/rules/wk8104.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8104: PostSynthCheck = {
   id: "WK8104",
@@ -16,45 +16,20 @@ export const wk8104: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      const resourceName = manifest.metadata?.name ?? manifest.kind ?? "(unknown)";
 
-      for (const manifest of manifests) {
-        const resourceName = manifest.metadata?.name ?? manifest.kind ?? "(unknown)";
-
-        // Check container ports in workloads
-        if (manifest.kind && WORKLOAD_KINDS.has(manifest.kind)) {
-          const containers = extractContainers(manifest);
-          for (const container of containers) {
-            if (!Array.isArray(container.ports)) continue;
-            for (const port of container.ports) {
-              if (typeof port === "object" && port !== null && !port.name) {
-                diagnostics.push({
-                  checkId: "WK8104",
-                  severity: "warning",
-                  message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has an unnamed port (containerPort: ${port.containerPort ?? "?"}) — add a name for clarity`,
-                  entity: resourceName,
-                  lexicon: "k8s",
-                });
-              }
-            }
-          }
-        }
-
-        // Check Service ports
-        if (manifest.kind === "Service") {
-          const spec = manifest.spec;
-          if (!spec) continue;
-          const ports = spec.ports as Array<Record<string, unknown>> | undefined;
-          if (!Array.isArray(ports)) continue;
-
-          for (const port of ports) {
+      // Check container ports in workloads
+      if (manifest.kind && WORKLOAD_KINDS.has(manifest.kind)) {
+        const containers = extractContainers(manifest);
+        for (const container of containers) {
+          if (!Array.isArray(container.ports)) continue;
+          for (const port of container.ports) {
             if (typeof port === "object" && port !== null && !port.name) {
               diagnostics.push({
                 checkId: "WK8104",
                 severity: "warning",
-                message: `Service "${resourceName}" has an unnamed port (port: ${port.port ?? "?"}) — add a name for clarity`,
+                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has an unnamed port (containerPort: ${port.containerPort ?? "?"}) — add a name for clarity`,
                 entity: resourceName,
                 lexicon: "k8s",
               });
@@ -62,6 +37,26 @@ export const wk8104: PostSynthCheck = {
           }
         }
       }
+
+      // Check Service ports
+      if (manifest.kind === "Service") {
+        const spec = manifest.spec;
+        if (!spec) continue;
+        const ports = spec.ports as Array<Record<string, unknown>> | undefined;
+        if (!Array.isArray(ports)) continue;
+
+        for (const port of ports) {
+          if (typeof port === "object" && port !== null && !port.name) {
+            diagnostics.push({
+              checkId: "WK8104",
+              severity: "warning",
+              message: `Service "${resourceName}" has an unnamed port (port: ${port.port ?? "?"}) — add a name for clarity`,
+              entity: resourceName,
+              lexicon: "k8s",
+            });
+          }
+        }
+      }
     }
 
     return diagnostics;

package/dist/rules/wk8105.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8105: PostSynthCheck = {
   id: "WK8105",
@@ -16,26 +16,21 @@ export const wk8105: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          if (!container.imagePullPolicy) {
-            diagnostics.push({
-              checkId: "WK8105",
-              severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has no explicit imagePullPolicy — set it to "Always", "IfNotPresent", or "Never"`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        if (!container.imagePullPolicy) {
+          diagnostics.push({
+            checkId: "WK8105",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has no explicit imagePullPolicy — set it to "Always", "IfNotPresent", or "Never"`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/dist/rules/wk8201.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8201: PostSynthCheck = {
   id: "WK8201",
@@ -16,36 +16,31 @@ export const wk8201: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          const limits = container.resources?.limits;
-          const missing: string[] = [];
-
-          if (!limits || typeof limits !== "object") {
-            missing.push("cpu", "memory");
-          } else {
-            if (!limits.cpu) missing.push("cpu");
-            if (!limits.memory) missing.push("memory");
-          }
-
-          if (missing.length > 0) {
-            diagnostics.push({
-              checkId: "WK8201",
-              severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" is missing resource limits for ${missing.join(", ")}`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        const limits = container.resources?.limits;
+        const missing: string[] = [];
+
+        if (!limits || typeof limits !== "object") {
+          missing.push("cpu", "memory");
+        } else {
+          if (!limits.cpu) missing.push("cpu");
+          if (!limits.memory) missing.push("memory");
+        }
+
+        if (missing.length > 0) {
+          diagnostics.push({
+            checkId: "WK8201",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" is missing resource limits for ${missing.join(", ")}`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/dist/rules/wk8202.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8202: PostSynthCheck = {
   id: "WK8202",
@@ -16,27 +16,22 @@ export const wk8202: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          const secCtx = container.securityContext;
-          if (secCtx && secCtx.privileged === true) {
-            diagnostics.push({
-              checkId: "WK8202",
-              severity: "error",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" runs in privileged mode — this grants full host access and should be avoided`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        const secCtx = container.securityContext;
+        if (secCtx && secCtx.privileged === true) {
+          diagnostics.push({
+            checkId: "WK8202",
+            severity: "error",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" runs in privileged mode — this grants full host access and should be avoided`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/dist/rules/wk8203.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8203: PostSynthCheck = {
   id: "WK8203",
@@ -16,27 +16,22 @@ export const wk8203: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          const secCtx = container.securityContext;
-          if (!secCtx || secCtx.readOnlyRootFilesystem !== true) {
-            diagnostics.push({
-              checkId: "WK8203",
-              severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" does not set readOnlyRootFilesystem: true — set it to reduce the attack surface`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        const secCtx = container.securityContext;
+        if (!secCtx || secCtx.readOnlyRootFilesystem !== true) {
+          diagnostics.push({
+            checkId: "WK8203",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" does not set readOnlyRootFilesystem: true — set it to reduce the attack surface`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/dist/rules/wk8204.ts

@@ -11,7 +11,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8204: PostSynthCheck = {
   id: "WK8204",
@@ -20,63 +20,58 @@ export const wk8204: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
 
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+      const podSpec = extractPodSpec(manifest);
+      if (!podSpec) continue;
 
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-        const podSpec = extractPodSpec(manifest);
-        if (!podSpec) continue;
+      // Check pod-level securityContext
+      const podSecCtx = podSpec.securityContext as Record<string, unknown> | undefined;
+      const podRunAsNonRoot = podSecCtx?.runAsNonRoot === true;
+      const podRunAsUser = podSecCtx?.runAsUser;
 
-        // Check pod-level securityContext
-        const podSecCtx = podSpec.securityContext as Record<string, unknown> | undefined;
-        const podRunAsNonRoot = podSecCtx?.runAsNonRoot === true;
-        const podRunAsUser = podSecCtx?.runAsUser;
+      const containers = extractContainers(manifest);
+      for (const container of containers) {
+        const secCtx = container.securityContext;
+        const containerRunAsNonRoot = secCtx?.runAsNonRoot === true;
+        const containerRunAsUser = secCtx?.runAsUser;
 
-        const containers = extractContainers(manifest);
-        for (const container of containers) {
-          const secCtx = container.securityContext;
-          const containerRunAsNonRoot = secCtx?.runAsNonRoot === true;
-          const containerRunAsUser = secCtx?.runAsUser;
+        const hasRunAsNonRoot = podRunAsNonRoot || containerRunAsNonRoot;
 
-          const hasRunAsNonRoot = podRunAsNonRoot || containerRunAsNonRoot;
-
-          if (!hasRunAsNonRoot) {
-            diagnostics.push({
-              checkId: "WK8204",
-              severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" does not set runAsNonRoot: true — set it at container or pod level`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-            continue;
-          }
+        if (!hasRunAsNonRoot) {
+          diagnostics.push({
+            checkId: "WK8204",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" does not set runAsNonRoot: true — set it at container or pod level`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
+          continue;
+        }
 
-          // runAsNonRoot is true — check for explicit runAsUser
-          const effectiveRunAsUser = containerRunAsUser ?? podRunAsUser;
+        // runAsNonRoot is true — check for explicit runAsUser
+        const effectiveRunAsUser = containerRunAsUser ?? podRunAsUser;
 
-          if (effectiveRunAsUser === 0) {
-            // Contradictory: runAsNonRoot: true + runAsUser: 0
-            diagnostics.push({
-              checkId: "WK8204",
-              severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has runAsNonRoot: true but runAsUser: 0 — these settings are contradictory and the container will fail to start`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          } else if (effectiveRunAsUser === undefined || effectiveRunAsUser === null) {
-            // runAsNonRoot: true but no explicit UID
-            diagnostics.push({
-              checkId: "WK8204",
-              severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has runAsNonRoot: true but no explicit runAsUser — set a numeric UID to ensure the container doesn't run as root`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+        if (effectiveRunAsUser === 0) {
+          // Contradictory: runAsNonRoot: true + runAsUser: 0
+          diagnostics.push({
+            checkId: "WK8204",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has runAsNonRoot: true but runAsUser: 0 — these settings are contradictory and the container will fail to start`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
+        } else if (effectiveRunAsUser === undefined || effectiveRunAsUser === null) {
+          // runAsNonRoot: true but no explicit UID
+          diagnostics.push({
+            checkId: "WK8204",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has runAsNonRoot: true but no explicit runAsUser — set a numeric UID to ensure the container doesn't run as root`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/dist/rules/wk8205.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8205: PostSynthCheck = {
   id: "WK8205",
@@ -16,37 +16,32 @@ export const wk8205: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          const secCtx = container.securityContext;
-          const capabilities = secCtx?.capabilities as Record<string, unknown> | undefined;
-          const drop = capabilities?.drop;
-
-          const dropsAll =
-            Array.isArray(drop) &&
-            drop.some(
-              (cap) =>
-                (typeof cap === "string" && cap.toUpperCase() === "ALL"),
-            );
-
-          if (!dropsAll) {
-            diagnostics.push({
-              checkId: "WK8205",
-              severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" does not drop ALL capabilities — add securityContext.capabilities.drop: ["ALL"]`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        const secCtx = container.securityContext;
+        const capabilities = secCtx?.capabilities as Record<string, unknown> | undefined;
+        const drop = capabilities?.drop;
+
+        const dropsAll =
+          Array.isArray(drop) &&
+          drop.some(
+            (cap) =>
+              (typeof cap === "string" && cap.toUpperCase() === "ALL"),
+          );
+
+        if (!dropsAll) {
+          diagnostics.push({
+            checkId: "WK8205",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" does not drop ALL capabilities — add securityContext.capabilities.drop: ["ALL"]`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }