@intentius/chant-lexicon-k8s 0.49.0 → 0.50.0

package/dist/rules/wk8207.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8207: PostSynthCheck = {
   id: "WK8207",
@@ -16,27 +16,22 @@ export const wk8207: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
 
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+      const podSpec = extractPodSpec(manifest);
+      if (!podSpec) continue;
 
-        const podSpec = extractPodSpec(manifest);
-        if (!podSpec) continue;
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
 
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        if (podSpec.hostNetwork === true) {
-          diagnostics.push({
-            checkId: "WK8207",
-            severity: "warning",
-            message: `${manifest.kind} "${resourceName}" uses hostNetwork: true — this bypasses network isolation and should be avoided`,
-            entity: resourceName,
-            lexicon: "k8s",
-          });
-        }
+      if (podSpec.hostNetwork === true) {
+        diagnostics.push({
+          checkId: "WK8207",
+          severity: "warning",
+          message: `${manifest.kind} "${resourceName}" uses hostNetwork: true — this bypasses network isolation and should be avoided`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
       }
     }
 

package/dist/rules/wk8208.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8208: PostSynthCheck = {
   id: "WK8208",
@@ -16,27 +16,22 @@ export const wk8208: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
 
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+      const podSpec = extractPodSpec(manifest);
+      if (!podSpec) continue;
 
-        const podSpec = extractPodSpec(manifest);
-        if (!podSpec) continue;
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
 
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        if (podSpec.hostPID === true) {
-          diagnostics.push({
-            checkId: "WK8208",
-            severity: "warning",
-            message: `${manifest.kind} "${resourceName}" uses hostPID: true — this allows visibility into all host processes and should be avoided`,
-            entity: resourceName,
-            lexicon: "k8s",
-          });
-        }
+      if (podSpec.hostPID === true) {
+        diagnostics.push({
+          checkId: "WK8208",
+          severity: "warning",
+          message: `${manifest.kind} "${resourceName}" uses hostPID: true — this allows visibility into all host processes and should be avoided`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
       }
     }
 

package/dist/rules/wk8209.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractPodSpec, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8209: PostSynthCheck = {
   id: "WK8209",
@@ -16,27 +16,22 @@ export const wk8209: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
 
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+      const podSpec = extractPodSpec(manifest);
+      if (!podSpec) continue;
 
-        const podSpec = extractPodSpec(manifest);
-        if (!podSpec) continue;
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
 
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        if (podSpec.hostIPC === true) {
-          diagnostics.push({
-            checkId: "WK8209",
-            severity: "warning",
-            message: `${manifest.kind} "${resourceName}" uses hostIPC: true — this exposes host shared memory segments and should be avoided`,
-            entity: resourceName,
-            lexicon: "k8s",
-          });
-        }
+      if (podSpec.hostIPC === true) {
+        diagnostics.push({
+          checkId: "WK8209",
+          severity: "warning",
+          message: `${manifest.kind} "${resourceName}" uses hostIPC: true — this exposes host shared memory segments and should be avoided`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
       }
     }
 

package/dist/rules/wk8301.ts

@@ -12,7 +12,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8301: PostSynthCheck = {
   id: "WK8301",
@@ -21,35 +21,30 @@ export const wk8301: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-        // CronJobs and Jobs are short-lived — probes are less relevant
-        if (manifest.kind === "Job" || manifest.kind === "CronJob") continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          // No declared port → no inbound traffic → nothing to HTTP-probe.
-          if (!container.ports || container.ports.length === 0) continue;
-
-          const missing: string[] = [];
-          if (!container.livenessProbe) missing.push("livenessProbe");
-          if (!container.readinessProbe) missing.push("readinessProbe");
-
-          if (missing.length > 0) {
-            diagnostics.push({
-              checkId: "WK8301",
-              severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" is missing ${missing.join(" and ")}`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+      // CronJobs and Jobs are short-lived — probes are less relevant
+      if (manifest.kind === "Job" || manifest.kind === "CronJob") continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        // No declared port → no inbound traffic → nothing to HTTP-probe.
+        if (!container.ports || container.ports.length === 0) continue;
+
+        const missing: string[] = [];
+        if (!container.livenessProbe) missing.push("livenessProbe");
+        if (!container.readinessProbe) missing.push("readinessProbe");
+
+        if (missing.length > 0) {
+          diagnostics.push({
+            checkId: "WK8301",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" is missing ${missing.join(" and ")}`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/dist/rules/wk8302.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 
 export const wk8302: PostSynthCheck = {
   id: "WK8302",
@@ -15,29 +15,24 @@ export const wk8302: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (manifest.kind !== "Deployment") continue;
-
-        const resourceName = manifest.metadata?.name ?? "Deployment";
-        const spec = manifest.spec;
-        if (!spec) continue;
-
-        const replicas = spec.replicas;
-
-        // If replicas is omitted, Kubernetes defaults to 1
-        if (replicas === undefined || replicas === null || replicas === 1) {
-          diagnostics.push({
-            checkId: "WK8302",
-            severity: "info",
-            message: `Deployment "${resourceName}" has ${replicas ?? 1} replica(s) — consider at least 2 for high availability`,
-            entity: resourceName,
-            lexicon: "k8s",
-          });
-        }
+    for (const manifest of docsToManifests(ctx)) {
+      if (manifest.kind !== "Deployment") continue;
+
+      const resourceName = manifest.metadata?.name ?? "Deployment";
+      const spec = manifest.spec;
+      if (!spec) continue;
+
+      const replicas = spec.replicas;
+
+      // If replicas is omitted, Kubernetes defaults to 1
+      if (replicas === undefined || replicas === null || replicas === 1) {
+        diagnostics.push({
+          checkId: "WK8302",
+          severity: "info",
+          message: `Deployment "${resourceName}" has ${replicas ?? 1} replica(s) — consider at least 2 for high availability`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
       }
     }
 

package/dist/rules/wk8303.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 import type { K8sManifest } from "./k8s-helpers";
 
 export const wk8303: PostSynthCheck = {
@@ -17,38 +17,35 @@ export const wk8303: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    const manifests = docsToManifests(ctx);
 
-      // Collect all PDB selectors to match against Deployments
-      const pdbSelectors = collectPdbSelectors(manifests);
+    // Collect all PDB selectors to match against Deployments
+    const pdbSelectors = collectPdbSelectors(manifests);
 
-      for (const manifest of manifests) {
-        if (manifest.kind !== "Deployment") continue;
+    for (const manifest of manifests) {
+      if (manifest.kind !== "Deployment") continue;
 
-        const spec = manifest.spec;
-        if (!spec) continue;
+      const spec = manifest.spec;
+      if (!spec) continue;
 
-        const replicas = spec.replicas;
-        // Only check HA deployments (replicas >= 2)
-        if (typeof replicas !== "number" || replicas < 2) continue;
+      const replicas = spec.replicas;
+      // Only check HA deployments (replicas >= 2)
+      if (typeof replicas !== "number" || replicas < 2) continue;
 
-        const resourceName = manifest.metadata?.name ?? "Deployment";
+      const resourceName = manifest.metadata?.name ?? "Deployment";
 
-        // Check if any PDB targets this Deployment's labels
-        const selector = spec.selector as Record<string, unknown> | undefined;
-        const matchLabels = selector?.matchLabels as Record<string, string> | undefined;
+      // Check if any PDB targets this Deployment's labels
+      const selector = spec.selector as Record<string, unknown> | undefined;
+      const matchLabels = selector?.matchLabels as Record<string, string> | undefined;
 
-        if (!matchLabels || !hasCoveringPdb(matchLabels, pdbSelectors)) {
-          diagnostics.push({
-            checkId: "WK8303",
-            severity: "info",
-            message: `Deployment "${resourceName}" has ${replicas} replicas but no PodDisruptionBudget — add a PDB to ensure availability during voluntary disruptions`,
-            entity: resourceName,
-            lexicon: "k8s",
-          });
-        }
+      if (!matchLabels || !hasCoveringPdb(matchLabels, pdbSelectors)) {
+        diagnostics.push({
+          checkId: "WK8303",
+          severity: "info",
+          message: `Deployment "${resourceName}" has ${replicas} replicas but no PodDisruptionBudget — add a PDB to ensure availability during voluntary disruptions`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
       }
     }
 

package/dist/rules/wk8304.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 
 export const wk8304: PostSynthCheck = {
   id: "WK8304",
@@ -16,51 +16,46 @@ export const wk8304: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (manifest.kind !== "Ingress") continue;
 
-      for (const manifest of manifests) {
-        if (manifest.kind !== "Ingress") continue;
+      const annotations = manifest.metadata?.annotations as Record<string, string> | undefined;
+      if (!annotations) continue;
 
-        const annotations = manifest.metadata?.annotations as Record<string, string> | undefined;
-        if (!annotations) continue;
+      const sslRedirect = annotations["alb.ingress.kubernetes.io/ssl-redirect"];
+      if (!sslRedirect) continue;
 
-        const sslRedirect = annotations["alb.ingress.kubernetes.io/ssl-redirect"];
-        if (!sslRedirect) continue;
+      const resourceName = manifest.metadata?.name ?? "Ingress";
+      const certArn = annotations["alb.ingress.kubernetes.io/certificate-arn"];
 
-        const resourceName = manifest.metadata?.name ?? "Ingress";
-        const certArn = annotations["alb.ingress.kubernetes.io/certificate-arn"];
-
-        if (!certArn) {
-          diagnostics.push({
-            checkId: "WK8304",
-            severity: "warning",
-            message: `Ingress "${resourceName}" has ssl-redirect annotation but no certificate-arn — HTTPS redirect will fail without a TLS certificate`,
-            entity: resourceName,
-            lexicon: "k8s",
-          });
-          continue;
-        }
+      if (!certArn) {
+        diagnostics.push({
+          checkId: "WK8304",
+          severity: "warning",
+          message: `Ingress "${resourceName}" has ssl-redirect annotation but no certificate-arn — HTTPS redirect will fail without a TLS certificate`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
+        continue;
+      }
 
-        // Check listen-ports includes HTTPS
-        const listenPorts = annotations["alb.ingress.kubernetes.io/listen-ports"];
-        if (listenPorts) {
-          try {
-            const ports = JSON.parse(listenPorts) as Array<Record<string, number>>;
-            const hasHttps = ports.some((p) => "HTTPS" in p);
-            if (!hasHttps) {
-              diagnostics.push({
-                checkId: "WK8304",
-                severity: "warning",
-                message: `Ingress "${resourceName}" has ssl-redirect but listen-ports does not include HTTPS`,
-                entity: resourceName,
-                lexicon: "k8s",
-              });
-            }
-          } catch {
-            // Can't parse listen-ports — skip this check
+      // Check listen-ports includes HTTPS
+      const listenPorts = annotations["alb.ingress.kubernetes.io/listen-ports"];
+      if (listenPorts) {
+        try {
+          const ports = JSON.parse(listenPorts) as Array<Record<string, number>>;
+          const hasHttps = ports.some((p) => "HTTPS" in p);
+          if (!hasHttps) {
+            diagnostics.push({
+              checkId: "WK8304",
+              severity: "warning",
+              message: `Ingress "${resourceName}" has ssl-redirect but listen-ports does not include HTTPS`,
+              entity: resourceName,
+              lexicon: "k8s",
+            });
           }
+        } catch {
+          // Can't parse listen-ports — skip this check
         }
       }
     }

package/dist/rules/wk8305.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 import type { K8sManifest } from "./k8s-helpers";
 
 export const wk8305: PostSynthCheck = {
@@ -16,60 +16,57 @@ export const wk8305: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    const manifests = docsToManifests(ctx);
 
-      // Build a map of Service name+namespace → set of port numbers
-      const servicePorts = collectServicePorts(manifests);
+    // Build a map of Service name+namespace → set of port numbers
+    const servicePorts = collectServicePorts(manifests);
 
-      for (const manifest of manifests) {
-        if (manifest.kind !== "Ingress") continue;
+    for (const manifest of manifests) {
+      if (manifest.kind !== "Ingress") continue;
 
-        const ingressName = manifest.metadata?.name ?? "Ingress";
-        const ingressNamespace = manifest.metadata?.namespace ?? "default";
-        const spec = manifest.spec;
-        if (!spec) continue;
+      const ingressName = manifest.metadata?.name ?? "Ingress";
+      const ingressNamespace = manifest.metadata?.namespace ?? "default";
+      const spec = manifest.spec;
+      if (!spec) continue;
 
-        const rules = spec.rules as Array<Record<string, unknown>> | undefined;
-        if (!rules) continue;
+      const rules = spec.rules as Array<Record<string, unknown>> | undefined;
+      if (!rules) continue;
 
-        for (const rule of rules) {
-          const http = rule.http as Record<string, unknown> | undefined;
-          if (!http) continue;
+      for (const rule of rules) {
+        const http = rule.http as Record<string, unknown> | undefined;
+        if (!http) continue;
 
-          const paths = http.paths as Array<Record<string, unknown>> | undefined;
-          if (!paths) continue;
+        const paths = http.paths as Array<Record<string, unknown>> | undefined;
+        if (!paths) continue;
 
-          for (const pathEntry of paths) {
-            const backend = pathEntry.backend as Record<string, unknown> | undefined;
-            if (!backend) continue;
+        for (const pathEntry of paths) {
+          const backend = pathEntry.backend as Record<string, unknown> | undefined;
+          if (!backend) continue;
 
-            const service = backend.service as Record<string, unknown> | undefined;
-            if (!service) continue;
+          const service = backend.service as Record<string, unknown> | undefined;
+          if (!service) continue;
 
-            const svcName = service.name as string | undefined;
-            const port = service.port as Record<string, unknown> | undefined;
-            const portNumber = port?.number as number | undefined;
+          const svcName = service.name as string | undefined;
+          const port = service.port as Record<string, unknown> | undefined;
+          const portNumber = port?.number as number | undefined;
 
-            if (!svcName || portNumber === undefined) continue;
+          if (!svcName || portNumber === undefined) continue;
 
-            // Look up the Service in the manifest set
-            const key = `${ingressNamespace}/${svcName}`;
-            const knownPorts = servicePorts.get(key);
+          // Look up the Service in the manifest set
+          const key = `${ingressNamespace}/${svcName}`;
+          const knownPorts = servicePorts.get(key);
 
-            // Skip if the Service is not in the manifest set (external service)
-            if (!knownPorts) continue;
+          // Skip if the Service is not in the manifest set (external service)
+          if (!knownPorts) continue;
 
-            if (!knownPorts.has(portNumber)) {
-              diagnostics.push({
-                checkId: "WK8305",
-                severity: "warning",
-                message: `Ingress "${ingressName}" references Service "${svcName}" port ${portNumber}, but the Service only declares ports [${[...knownPorts].join(", ")}]`,
-                entity: ingressName,
-                lexicon: "k8s",
-              });
-            }
+          if (!knownPorts.has(portNumber)) {
+            diagnostics.push({
+              checkId: "WK8305",
+              severity: "warning",
+              message: `Ingress "${ingressName}" references Service "${svcName}" port ${portNumber}, but the Service only declares ports [${[...knownPorts].join(", ")}]`,
+              entity: ingressName,
+              lexicon: "k8s",
+            });
           }
         }
       }

package/dist/rules/wk8306.ts

@@ -8,7 +8,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8306: PostSynthCheck = {
   id: "WK8306",
@@ -17,30 +17,25 @@ export const wk8306: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-        const containers = extractContainers(manifest);
-
-        for (const container of containers) {
-          const command = (container as Record<string, unknown>).command as unknown[] | undefined;
-          if (!Array.isArray(command) || command.length === 0) continue;
-
-          const firstArg = String(command[0]);
-          if (firstArg.startsWith("-")) {
-            diagnostics.push({
-              checkId: "WK8306",
-              severity: "error",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has command[0]="${firstArg}" which starts with a flag — the first element should be the binary, flags belong in args`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+      const containers = extractContainers(manifest);
+
+      for (const container of containers) {
+        const command = (container as Record<string, unknown>).command as unknown[] | undefined;
+        if (!Array.isArray(command) || command.length === 0) continue;
+
+        const firstArg = String(command[0]);
+        if (firstArg.startsWith("-")) {
+          diagnostics.push({
+            checkId: "WK8306",
+            severity: "error",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has command[0]="${firstArg}" which starts with a flag — the first element should be the binary, flags belong in args`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }