@vfarcic/dot-ai 0.72.0 → 0.74.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +36 -1
- package/dist/core/capabilities.d.ts.map +1 -1
- package/dist/core/capabilities.js +6 -51
- package/dist/core/claude.d.ts +2 -0
- package/dist/core/claude.d.ts.map +1 -1
- package/dist/core/claude.js +24 -15
- package/dist/core/doc-testing-session.d.ts.map +1 -1
- package/dist/core/doc-testing-session.js +42 -60
- package/dist/core/index.d.ts +2 -2
- package/dist/core/index.d.ts.map +1 -1
- package/dist/core/index.js +4 -3
- package/dist/core/organizational-types.d.ts +43 -0
- package/dist/core/organizational-types.d.ts.map +1 -0
- package/dist/core/organizational-types.js +8 -0
- package/dist/core/pattern-types.d.ts +1 -10
- package/dist/core/pattern-types.d.ts.map +1 -1
- package/dist/core/policy-vector-service.d.ts +28 -0
- package/dist/core/policy-vector-service.d.ts.map +1 -0
- package/dist/core/policy-vector-service.js +64 -0
- package/dist/core/schema.d.ts +3 -5
- package/dist/core/schema.d.ts.map +1 -1
- package/dist/core/schema.js +85 -24
- package/dist/core/shared-prompt-loader.d.ts +13 -0
- package/dist/core/shared-prompt-loader.d.ts.map +1 -0
- package/dist/core/shared-prompt-loader.js +64 -0
- package/dist/core/unified-creation-session.d.ts +83 -0
- package/dist/core/unified-creation-session.d.ts.map +1 -0
- package/dist/core/unified-creation-session.js +943 -0
- package/dist/core/unified-creation-types.d.ts +58 -0
- package/dist/core/unified-creation-types.d.ts.map +1 -0
- package/dist/core/unified-creation-types.js +61 -0
- package/dist/core/vector-db-service.d.ts.map +1 -1
- package/dist/core/vector-db-service.js +10 -1
- package/dist/tools/answer-question.d.ts.map +1 -1
- package/dist/tools/answer-question.js +3 -4
- package/dist/tools/generate-manifests.d.ts.map +1 -1
- package/dist/tools/generate-manifests.js +25 -70
- package/dist/tools/organizational-data.d.ts +2 -2
- package/dist/tools/organizational-data.d.ts.map +1 -1
- package/dist/tools/organizational-data.js +650 -62
- package/dist/tools/version.d.ts +30 -3
- package/dist/tools/version.d.ts.map +1 -1
- package/dist/tools/version.js +200 -27
- package/package.json +3 -3
- package/prompts/infrastructure-trigger-expansion.md +26 -0
- package/prompts/infrastructure-triggers.md +11 -0
- package/prompts/kyverno-generation.md +317 -0
- package/prompts/pattern-complete-error.md +1 -0
- package/prompts/pattern-complete-success.md +8 -0
- package/prompts/pattern-created-by.md +1 -0
- package/prompts/pattern-description.md +7 -0
- package/prompts/pattern-rationale.md +1 -0
- package/prompts/pattern-resources.md +1 -0
- package/prompts/pattern-review.md +9 -0
- package/prompts/policy-complete-apply.md +12 -0
- package/prompts/policy-complete-discard.md +5 -0
- package/prompts/policy-complete-error.md +1 -0
- package/prompts/policy-complete-save.md +12 -0
- package/prompts/policy-complete-success.md +7 -0
- package/prompts/policy-created-by.md +1 -0
- package/prompts/policy-description.md +9 -0
- package/prompts/policy-namespace-scope.md +43 -0
- package/prompts/policy-rationale.md +1 -0
- package/prompts/question-generation.md +27 -0
- package/prompts/resource-selection.md +6 -2
- package/shared-prompts/manage-org-data.md +20 -9
- package/dist/core/pattern-creation-session.d.ts +0 -43
- package/dist/core/pattern-creation-session.d.ts.map +0 -1
- package/dist/core/pattern-creation-session.js +0 -312
- package/dist/core/pattern-creation-types.d.ts +0 -30
- package/dist/core/pattern-creation-types.d.ts.map +0 -1
- package/dist/core/pattern-creation-types.js +0 -8
- package/shared-prompts/context-load.md +0 -19
- package/shared-prompts/context-save.md +0 -24
|
@@ -0,0 +1,317 @@
|
|
|
1
|
+
# Kyverno Policy Generation from Policy Intent
|
|
2
|
+
|
|
3
|
+
## Policy Intent Description
|
|
4
|
+
{policy_description}
|
|
5
|
+
|
|
6
|
+
## Policy Intent Details
|
|
7
|
+
- **Rationale**: {policy_rationale}
|
|
8
|
+
- **Triggers**: {policy_triggers}
|
|
9
|
+
- **Intent ID**: {policy_id}
|
|
10
|
+
|
|
11
|
+
## Available Resource Schemas
|
|
12
|
+
{resource_schemas}
|
|
13
|
+
|
|
14
|
+
## Namespace Scope Configuration
|
|
15
|
+
{namespace_scope}
|
|
16
|
+
|
|
17
|
+
## Previous Attempt Analysis
|
|
18
|
+
{previous_attempt}
|
|
19
|
+
|
|
20
|
+
## Error Details from Previous Attempt
|
|
21
|
+
{error_details}
|
|
22
|
+
|
|
23
|
+
## Instructions
|
|
24
|
+
|
|
25
|
+
You are a Kubernetes governance expert specializing in Kyverno policy generation. Generate a comprehensive Kyverno ClusterPolicy YAML from the provided policy intent that enforces the described governance requirement against only the relevant resources from the available schemas.
|
|
26
|
+
|
|
27
|
+
**RETRY CONTEXT**: If this is a retry attempt (indicated by previous attempt details above), analyze the validation errors carefully and fix the specific issues identified. Common validation failures include:
|
|
28
|
+
- Invalid YAML syntax
|
|
29
|
+
- Invalid CEL expressions using `request.object` instead of `object`
|
|
30
|
+
- References to non-existent fields in resource schemas
|
|
31
|
+
- Incorrect resource kind/apiVersion combinations
|
|
32
|
+
- Using invalid Kyverno match fields like `apiGroups`, `versions`, or `apiVersions` (use Group/Version/Kind format in kinds array)
|
|
33
|
+
- kubectl dry-run server-side validation failures
|
|
34
|
+
- CEL compilation errors at runtime due to undefined fields
|
|
35
|
+
|
|
36
|
+
## 🛡️ KYVERNO POLICY GENERATION PRINCIPLES
|
|
37
|
+
|
|
38
|
+
**Core Requirements:**
|
|
39
|
+
- **Single ClusterPolicy** - Generate one ClusterPolicy with multiple rules if needed to handle different resource schemas
|
|
40
|
+
- **CEL Expressions Only** - Use CEL (Common Expression Language) for all validation logic, never JMESPath patterns
|
|
41
|
+
- **Intelligent Resource Selection** - Only target resource types where the policy intent logically applies
|
|
42
|
+
- **Schema-Accurate Targeting** - Only reference fields that actually exist in the targeted resource schemas
|
|
43
|
+
- **Multiple Rules for Different Schemas** - Use separate rules when different resource types have different field structures
|
|
44
|
+
- **New Resource Targeting** - Set `background: false` to apply only to new/updated resources
|
|
45
|
+
- **Descriptive Naming** - Generate clear, descriptive policy names with policy ID for uniqueness
|
|
46
|
+
- **Enforcement Mode** - Use `validationFailureAction: Enforce` to actively prevent policy violations
|
|
47
|
+
|
|
48
|
+
**Policy Structure Guidelines:**
|
|
49
|
+
|
|
50
|
+
1. **Metadata Requirements**:
|
|
51
|
+
- **Name**: Generate descriptive slug from policy description (max 63 chars, e.g., `require-container-resource-limits`)
|
|
52
|
+
- **Labels**: Include `policy-intent/id: {policy_id}` for machine lookup
|
|
53
|
+
- **Annotations**:
|
|
54
|
+
- `policy-intent/description: "{policy_description}"`
|
|
55
|
+
- `policy-intent/rationale: "{policy_rationale}"`
|
|
56
|
+
|
|
57
|
+
2. **Name Generation Rules**:
|
|
58
|
+
- Convert policy description to lowercase slug format
|
|
59
|
+
- Use hyphens to separate words
|
|
60
|
+
- Keep it concise but descriptive (e.g., "All containers must have resource limits" → "require-container-resource-limits")
|
|
61
|
+
- Ensure DNS compliance (lowercase alphanumeric + hyphens only)
|
|
62
|
+
- Must be 63 characters or less (Kubernetes naming limit)
|
|
63
|
+
|
|
64
|
+
3. **Specification Requirements**:
|
|
65
|
+
- Set `background: false` to avoid processing existing resources
|
|
66
|
+
- Use `validationFailureAction: Enforce` to actively block non-compliant resources
|
|
67
|
+
- Include clear failure messages that reference the organizational policy
|
|
68
|
+
- Target only resources where the policy intent makes logical sense
|
|
69
|
+
|
|
70
|
+
4. **Rule Design for Different Schemas**:
|
|
71
|
+
- **Separate rules** for resources with different field structures
|
|
72
|
+
- **Schema-specific validation** tailored to each resource type's field paths
|
|
73
|
+
- **Consistent governance intent** across all rules in the policy
|
|
74
|
+
- **Clear rule names** that indicate which resource types they target
|
|
75
|
+
|
|
76
|
+
5. **Namespace Targeting Rules**:
|
|
77
|
+
- If namespace scope is 'Apply to all namespaces': No namespace restrictions needed
|
|
78
|
+
- If namespace scope starts with 'Apply ONLY to these namespaces': Add `match.any` with `resources.namespaces` list
|
|
79
|
+
- If namespace scope starts with 'Apply to all namespaces EXCEPT': Add `exclude.any` with `resources.namespaces` list
|
|
80
|
+
- Always use the exact namespace names provided in the scope configuration
|
|
81
|
+
- Never add namespace restrictions if scope indicates "all namespaces"
|
|
82
|
+
|
|
83
|
+
## 🎯 MANDATORY PRE-GENERATION SCHEMA ANALYSIS
|
|
84
|
+
|
|
85
|
+
**CRITICAL**: You MUST perform this systematic analysis BEFORE generating any Kyverno rules. This is NOT optional.
|
|
86
|
+
|
|
87
|
+
**STEP 1: Policy Requirements Analysis**
|
|
88
|
+
First, extract the exact validation requirements from the policy intent:
|
|
89
|
+
- What specific field types, values, or patterns must be validated?
|
|
90
|
+
- What conditions trigger a policy violation?
|
|
91
|
+
- What constitutes compliance vs non-compliance?
|
|
92
|
+
|
|
93
|
+
**STEP 2: MANDATORY SCHEMA-BY-SCHEMA ANALYSIS**
|
|
94
|
+
**REQUIREMENT**: You MUST analyze EVERY SINGLE provided schema individually. For each schema, you must:
|
|
95
|
+
|
|
96
|
+
1. **Resource Identification**: Note the resource name, kind, and API version
|
|
97
|
+
2. **Field Scanning**: Scan ALL fields in the schema for policy-relevant properties
|
|
98
|
+
3. **Relevance Determination**: Does this resource have fields that match the policy requirements?
|
|
99
|
+
4. **Field Path Mapping**: For relevant fields, identify the exact field paths
|
|
100
|
+
5. **Rule Requirement**: If relevant fields exist, this resource REQUIRES a validation rule
|
|
101
|
+
|
|
102
|
+
**STEP 3: COMPREHENSIVE COVERAGE VERIFICATION**
|
|
103
|
+
Create a mental checklist for EVERY schema provided:
|
|
104
|
+
- [ ] Schema analyzed: YES/NO
|
|
105
|
+
- [ ] Policy-relevant fields found: YES/NO
|
|
106
|
+
- [ ] If YES: Field paths identified: [list paths]
|
|
107
|
+
- [ ] If YES: Validation rule required: YES
|
|
108
|
+
- [ ] If NO: Resource can be skipped: YES
|
|
109
|
+
|
|
110
|
+
**STEP 4: FORCED RULE GENERATION**
|
|
111
|
+
**ABSOLUTE REQUIREMENT**: Generate validation rules for EVERY resource that has policy-relevant fields.
|
|
112
|
+
- NO EXCEPTIONS: If a resource has relevant fields, it gets a rule
|
|
113
|
+
- NO ASSUMPTIONS: Don't assume certain resources are "not important"
|
|
114
|
+
- NO SHORTCUTS: Don't skip resources because they're custom or unfamiliar
|
|
115
|
+
- FIELD-BASED DECISIONS ONLY: Base inclusion solely on presence of relevant fields
|
|
116
|
+
|
|
117
|
+
**VALIDATION CHECK**: Before finalizing the policy, verify that you have generated rules for ALL resources with policy-relevant fields. If any resource with relevant fields lacks a rule, the policy is INCOMPLETE and INVALID.
|
|
118
|
+
|
|
119
|
+
## 🔍 EXPLICIT RESOURCE ANALYSIS REQUIREMENT
|
|
120
|
+
|
|
121
|
+
**MANDATORY SCHEMA ACCOUNTING**: Before generating the policy, you MUST explicitly account for EVERY schema provided. Include this analysis as YAML comments at the top of the generated policy.
|
|
122
|
+
|
|
123
|
+
**For EVERY schema in the "Available Resource Schemas" section above:**
|
|
124
|
+
Include a concise comment line in format: `ResourceName: HAS field.path → MUST generate rule` or `ResourceName: NO relevant fields → Can skip`
|
|
125
|
+
|
|
126
|
+
**CRITICAL EXAMPLES** (adapt to your actual policy):
|
|
127
|
+
- If analyzing a resource with `spec.image` field → MUST generate rule
|
|
128
|
+
- If analyzing a resource with `spec.containers[].image` field → MUST generate rule
|
|
129
|
+
- If analyzing a resource with `spec.template.spec.containers[].image` field → MUST generate rule
|
|
130
|
+
- If analyzing a resource with only networking fields → Can skip (for non-networking policies)
|
|
131
|
+
|
|
132
|
+
**FAILURE TO ANALYZE = INVALID POLICY**: If you generate a policy without systematically considering every schema, the policy is incomplete and violates the requirements.
|
|
133
|
+
|
|
134
|
+
**OUTPUT FORMAT**: Include your systematic schema analysis as YAML comments at the beginning of the policy file, followed by the clean YAML manifest.
|
|
135
|
+
|
|
136
|
+
## 📋 SCHEMA-DRIVEN CEL EXPRESSIONS
|
|
137
|
+
|
|
138
|
+
**Resource Schema Analysis:**
|
|
139
|
+
- Examine each resource schema to understand field structure differences
|
|
140
|
+
- Use exact field paths as documented in each schema
|
|
141
|
+
- Handle nested objects and arrays correctly for each resource type
|
|
142
|
+
- Account for optional vs required fields per schema
|
|
143
|
+
|
|
144
|
+
**CEL Expression Patterns:**
|
|
145
|
+
- **Field Existence**: `has(object.spec.fieldName)`
|
|
146
|
+
- **Array Validation**: `object.spec.containers.all(c, condition)`
|
|
147
|
+
- **String Patterns**: `object.metadata.name.matches('^[a-z][a-z0-9-]*$')`
|
|
148
|
+
- **Resource Type Checking**: `request.kind.kind == 'Deployment'` (if needed in combined rules)
|
|
149
|
+
- **Complex Logic**: Combine conditions with `&&`, `||`, `!`
|
|
150
|
+
- **Previous Object (Updates)**: `oldObject.spec.fieldName` for comparing old vs new values
|
|
151
|
+
|
|
152
|
+
**CRITICAL CEL SYNTAX RULES:**
|
|
153
|
+
- ✅ **CORRECT**: `object.spec.containers` - Use `object` to reference the resource being validated
|
|
154
|
+
- ❌ **WRONG**: `request.object.spec.containers` - Do NOT use `request.object` prefix
|
|
155
|
+
- ✅ **CORRECT**: `has(object.metadata.labels['app'])`
|
|
156
|
+
- ❌ **WRONG**: `has(request.object.metadata.labels['app'])`
|
|
157
|
+
|
|
158
|
+
**KYVERNO MATCH SCHEMA RULES:**
|
|
159
|
+
```yaml
|
|
160
|
+
# ✅ CORRECT Kyverno match syntax:
|
|
161
|
+
match:
|
|
162
|
+
any:
|
|
163
|
+
- resources:
|
|
164
|
+
kinds:
|
|
165
|
+
- Pod # Standard Kubernetes resource
|
|
166
|
+
- apps/v1/Deployment # Group/Version/Kind format for apps group
|
|
167
|
+
operations:
|
|
168
|
+
- CREATE
|
|
169
|
+
- UPDATE
|
|
170
|
+
|
|
171
|
+
# ✅ For custom resources use Group/Version/Kind format:
|
|
172
|
+
match:
|
|
173
|
+
any:
|
|
174
|
+
- resources:
|
|
175
|
+
kinds:
|
|
176
|
+
- example.com/v1/CustomResource
|
|
177
|
+
- example.com/v1beta1/CustomResource
|
|
178
|
+
operations:
|
|
179
|
+
- CREATE
|
|
180
|
+
- UPDATE
|
|
181
|
+
|
|
182
|
+
# ❌ WRONG - Do NOT use 'apiGroups' or 'versions' fields:
|
|
183
|
+
# apiGroups: [example.com] # This field does not exist!
|
|
184
|
+
# versions: [v1, v1beta1] # This field does not exist!
|
|
185
|
+
# apiVersions: [example.com/v1] # This field does not exist!
|
|
186
|
+
```
|
|
187
|
+
|
|
188
|
+
## ✅ RESOURCE COVERAGE VALIDATION
|
|
189
|
+
|
|
190
|
+
**Before finalizing the policy, verify complete coverage:**
|
|
191
|
+
|
|
192
|
+
1. **Schema Analysis Completeness**: Every provided resource schema has been analyzed for policy-relevant fields
|
|
193
|
+
2. **Rule Generation Coverage**: Every resource with policy-relevant fields has corresponding validation rules
|
|
194
|
+
3. **Field Path Accuracy**: All CEL expressions reference fields that actually exist in the target resource schemas
|
|
195
|
+
4. **Validation Logic Correctness**: CEL expressions properly implement the governance rule for each resource's field structure
|
|
196
|
+
5. **Message Clarity**: Error messages clearly explain the policy violation and reference the organizational requirement
|
|
197
|
+
|
|
198
|
+
## 🧠 CUSTOM RESOURCE FIELD ANALYSIS
|
|
199
|
+
|
|
200
|
+
**CRITICAL**: Custom resources often have different field structures than standard Kubernetes resources. Pay special attention to:
|
|
201
|
+
|
|
202
|
+
**Image-Related Field Patterns:**
|
|
203
|
+
- **Standard Pattern**: `spec.containers[].image` (includes tag like `nginx:1.21`)
|
|
204
|
+
- **Separated Fields**: `spec.image` + `spec.tag` (image and tag in separate fields)
|
|
205
|
+
- **Template Pattern**: `spec.template.spec.containers[].image` (for controller resources)
|
|
206
|
+
|
|
207
|
+
**Field Analysis Rules:**
|
|
208
|
+
1. **Look for both `image` and `tag` fields separately** - Some custom resources separate these
|
|
209
|
+
2. **Check field descriptions** - Understand what each field represents
|
|
210
|
+
3. **Generate appropriate validation** - For separate tag fields, check the tag field directly
|
|
211
|
+
4. **Handle both patterns** - Some resources may have both patterns
|
|
212
|
+
|
|
213
|
+
**Example Custom Resource Pattern:**
|
|
214
|
+
```yaml
|
|
215
|
+
# If custom resource has:
|
|
216
|
+
spec:
|
|
217
|
+
image: nginx
|
|
218
|
+
tag: latest
|
|
219
|
+
|
|
220
|
+
# Then validate:
|
|
221
|
+
expression: >-
|
|
222
|
+
has(object.spec.tag) && object.spec.tag != '' ?
|
|
223
|
+
object.spec.tag != 'latest'
|
|
224
|
+
: true
|
|
225
|
+
```
|
|
226
|
+
|
|
227
|
+
## 🚀 OUTPUT REQUIREMENTS
|
|
228
|
+
|
|
229
|
+
Generate a complete, valid Kyverno ClusterPolicy YAML that:
|
|
230
|
+
|
|
231
|
+
1. **Uses Clean YAML Format** - Raw YAML with analysis as YAML comments, no markdown formatting
|
|
232
|
+
2. **Uses Descriptive Naming** - Generate clear policy name from description + policy_id
|
|
233
|
+
3. **Includes Machine-Readable Metadata** - Add policy-intent/id label for lookup
|
|
234
|
+
4. **Enforces the Policy Intent** - Addresses the specific governance requirement described
|
|
235
|
+
4. **Uses Multiple Rules Appropriately** - Creates separate rules for different resource schemas when needed
|
|
236
|
+
5. **Targets Relevant Resources Only** - Includes only resource types where the policy logically applies
|
|
237
|
+
6. **Uses Only CEL Expressions** - All validation logic must use CEL syntax exclusively
|
|
238
|
+
7. **References Existing Fields** - Only uses fields that exist in the targeted resource schemas
|
|
239
|
+
8. **Uses Enforcement Mode** - Set `validationFailureAction: Enforce` to actively block violations
|
|
240
|
+
9. **New Resources Only** - Set `background: false` to target only new/updated resources
|
|
241
|
+
10. **Provides Clear Feedback** - Descriptive error messages explaining the policy violation
|
|
242
|
+
|
|
243
|
+
**CRITICAL ANALYSIS REQUIRED**:
|
|
244
|
+
- **Generate appropriate policy name** - Create concise, descriptive slug from policy description
|
|
245
|
+
- **Read the policy intent carefully** - Understand what governance rule needs enforcement
|
|
246
|
+
- **Analyze available schemas** - Identify field structure differences across resource types
|
|
247
|
+
- **Design appropriate rules** - Create separate rules when schemas require different validation approaches
|
|
248
|
+
- **Validate field paths** - Ensure all referenced fields exist in the target resource schemas
|
|
249
|
+
|
|
250
|
+
## 📋 NAMESPACE TARGETING EXAMPLES
|
|
251
|
+
|
|
252
|
+
**For "Apply ONLY to these namespaces: production, staging":**
|
|
253
|
+
```yaml
|
|
254
|
+
spec:
|
|
255
|
+
rules:
|
|
256
|
+
- name: rule-name
|
|
257
|
+
match:
|
|
258
|
+
any:
|
|
259
|
+
- resources:
|
|
260
|
+
kinds: [Deployment]
|
|
261
|
+
namespaces:
|
|
262
|
+
- production
|
|
263
|
+
- staging
|
|
264
|
+
```
|
|
265
|
+
|
|
266
|
+
**For "Apply to all namespaces EXCEPT: kube-system, kube-public":**
|
|
267
|
+
```yaml
|
|
268
|
+
spec:
|
|
269
|
+
rules:
|
|
270
|
+
- name: rule-name
|
|
271
|
+
match:
|
|
272
|
+
any:
|
|
273
|
+
- resources:
|
|
274
|
+
kinds: [Deployment]
|
|
275
|
+
exclude:
|
|
276
|
+
any:
|
|
277
|
+
- resources:
|
|
278
|
+
namespaces:
|
|
279
|
+
- kube-system
|
|
280
|
+
- kube-public
|
|
281
|
+
```
|
|
282
|
+
|
|
283
|
+
**For "Apply to all namespaces (no restrictions)":**
|
|
284
|
+
```yaml
|
|
285
|
+
spec:
|
|
286
|
+
rules:
|
|
287
|
+
- name: rule-name
|
|
288
|
+
match:
|
|
289
|
+
any:
|
|
290
|
+
- resources:
|
|
291
|
+
kinds: [Deployment]
|
|
292
|
+
# No namespace restrictions - applies cluster-wide
|
|
293
|
+
```
|
|
294
|
+
|
|
295
|
+
**IMPORTANT**: Return only the YAML content with your mandatory schema analysis as concise YAML comments at the top, followed by the clean Kyverno policy manifest. The final policy YAML should be production-ready for `kubectl apply --dry-run=server` validation.
|
|
296
|
+
|
|
297
|
+
**CRITICAL OUTPUT FORMAT REQUIREMENTS**:
|
|
298
|
+
|
|
299
|
+
- **NO MARKDOWN FORMATTING**: Do not wrap the YAML in markdown code blocks (no ```yaml or ```)
|
|
300
|
+
- **NO PROSE EXPLANATION**: Do not include any explanatory text before or after the YAML
|
|
301
|
+
- **RAW YAML ONLY**: Return only the YAML content with analysis comments inside as YAML comments
|
|
302
|
+
- **KUBECTL READY**: The output must be directly usable with kubectl apply
|
|
303
|
+
|
|
304
|
+
**OUTPUT FORMAT EXAMPLE**:
|
|
305
|
+
# MANDATORY SCHEMA-BY-SCHEMA ANALYSIS
|
|
306
|
+
#
|
|
307
|
+
# StatefulSet: HAS spec.template.spec.containers[].image → MUST generate rule
|
|
308
|
+
# Pod: HAS spec.containers[].image → MUST generate rule
|
|
309
|
+
# ConfigMap: NO relevant fields → Can skip
|
|
310
|
+
#
|
|
311
|
+
# RESOURCES REQUIRING VALIDATION RULES: StatefulSet, Pod
|
|
312
|
+
#
|
|
313
|
+
apiVersion: kyverno.io/v1
|
|
314
|
+
kind: ClusterPolicy
|
|
315
|
+
metadata:
|
|
316
|
+
name: policy-name
|
|
317
|
+
# ... rest of policy
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
Error creating pattern: {error}
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
Pattern created successfully!
|
|
2
|
+
|
|
3
|
+
**Pattern ID**: {patternId}
|
|
4
|
+
**Description**: {description}
|
|
5
|
+
**Triggers**: {triggers}
|
|
6
|
+
**Resources**: {resources}
|
|
7
|
+
|
|
8
|
+
The pattern is now ready to enhance AI recommendations. When users ask for deployments matching your triggers, this pattern will suggest the specified Kubernetes resources.
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
Ask the user: "What is your name or team identifier? This helps track pattern ownership and allows others to contact you with questions."
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
Ask the user: "What deployment capability does this pattern provide? I need a capability name (2-4 words).
|
|
2
|
+
|
|
3
|
+
Examples:
|
|
4
|
+
- Specific: "Horizontal scaling", "Database persistence", "SSL termination"
|
|
5
|
+
- Broad/Organizational: "Application networking", "General security", "Basic monitoring"
|
|
6
|
+
|
|
7
|
+
Both specific and broad patterns are fine. What capability describes your pattern?"
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
Ask the user: "Why does this combination of resources work well together for {description}? This helps others understand when and why to use this pattern."
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
Ask the user: "Which Kubernetes resources should be suggested for {description}? Please list the resource types you want this pattern to suggest, separated by commas. For example: Deployment, Service, ConfigMap or StatefulSet, PersistentVolumeClaim, Secret."
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
Please review your pattern:
|
|
2
|
+
|
|
3
|
+
**Description**: {description}
|
|
4
|
+
**Triggers**: {triggers}
|
|
5
|
+
**Suggested Resources**: {resources}
|
|
6
|
+
**Rationale**: {rationale}
|
|
7
|
+
**Created By**: {createdBy}
|
|
8
|
+
|
|
9
|
+
Does this look correct? Type 'confirm' to create the pattern, or 'modify' to make changes.
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
🚀 **Policy Applied Successfully!**
|
|
2
|
+
|
|
3
|
+
**Description**: {description}
|
|
4
|
+
**Triggers**: {triggers}
|
|
5
|
+
**Rationale**: {rationale}
|
|
6
|
+
|
|
7
|
+
**Applied Kyverno Policy:**
|
|
8
|
+
```yaml
|
|
9
|
+
{kyvernoPolicy}
|
|
10
|
+
```
|
|
11
|
+
|
|
12
|
+
The policy intent has been saved and the Kyverno policy has been applied to your cluster. The policy is now active and will enforce the defined rules on new and updated resources.
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
Error creating policy intent: {error}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
💾 **Policy Saved Successfully!**
|
|
2
|
+
|
|
3
|
+
**Description**: {description}
|
|
4
|
+
**Triggers**: {triggers}
|
|
5
|
+
**Rationale**: {rationale}
|
|
6
|
+
|
|
7
|
+
**Generated Kyverno Policy:**
|
|
8
|
+
```yaml
|
|
9
|
+
{kyvernoPolicy}
|
|
10
|
+
```
|
|
11
|
+
|
|
12
|
+
The policy intent has been saved and the Kyverno YAML should be saved to your local file system. The policy is ready for manual deployment when needed.
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
Ask the user: "Who should be credited as the creator of this policy intent? (This can be your name, team name, or organization.)"
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
Ask the user: "Please describe the policy intent you want to create. What should this policy enforce or ensure in your Kubernetes deployments?
|
|
2
|
+
|
|
3
|
+
Examples:
|
|
4
|
+
- "All containers must have resource limits defined"
|
|
5
|
+
- "Images must be from trusted registries only"
|
|
6
|
+
- "Pods must not run as root user"
|
|
7
|
+
- "All services must have network policies"
|
|
8
|
+
|
|
9
|
+
What policy requirement do you want to enforce?"
|
|
@@ -0,0 +1,43 @@
|
|
|
1
|
+
# Policy Namespace Scope
|
|
2
|
+
|
|
3
|
+
Your policy can be applied cluster-wide or limited to specific namespaces.
|
|
4
|
+
|
|
5
|
+
## Available Namespaces in Your Cluster:
|
|
6
|
+
{namespaces}
|
|
7
|
+
|
|
8
|
+
## Choose the scope for your policy:
|
|
9
|
+
|
|
10
|
+
1. **Apply to all namespaces** (cluster-wide enforcement)
|
|
11
|
+
- Type: `all` or `1`
|
|
12
|
+
|
|
13
|
+
2. **Apply only to specific namespaces** (inclusive list)
|
|
14
|
+
- Type: `include: namespace1, namespace2, namespace3`
|
|
15
|
+
- Example: `include: production, staging`
|
|
16
|
+
|
|
17
|
+
3. **Apply to all namespaces EXCEPT specific ones** (exclusion list)
|
|
18
|
+
- Type: `exclude: namespace1, namespace2`
|
|
19
|
+
- Example: `exclude: kube-system, kube-public`
|
|
20
|
+
|
|
21
|
+
**Your choice**: [Type your selection]
|
|
22
|
+
|
|
23
|
+
---
|
|
24
|
+
|
|
25
|
+
## Examples:
|
|
26
|
+
|
|
27
|
+
**For cluster-wide policy:**
|
|
28
|
+
```
|
|
29
|
+
all
|
|
30
|
+
```
|
|
31
|
+
|
|
32
|
+
**To apply only to production and staging:**
|
|
33
|
+
```
|
|
34
|
+
include: production, staging
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
**To exclude system namespaces:**
|
|
38
|
+
```
|
|
39
|
+
exclude: kube-system, kube-public, kube-node-lease
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
## Note
|
|
43
|
+
System namespaces (kube-system, kube-public, kube-node-lease) are often excluded from policies to prevent conflicts with Kubernetes core functionality. Consider whether your policy should apply to these system namespaces.
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
Ask the user: "Why is this policy important for your organization? Please explain the rationale behind this policy requirement - what risks does it mitigate or what benefits does it provide?"
|
|
@@ -12,8 +12,35 @@
|
|
|
12
12
|
## Available Cluster Options
|
|
13
13
|
{cluster_options}
|
|
14
14
|
|
|
15
|
+
## Organizational Policies
|
|
16
|
+
{policy_context}
|
|
17
|
+
|
|
15
18
|
## Instructions
|
|
16
19
|
|
|
20
|
+
## 🛡️ POLICY-AWARE QUESTION GENERATION (HIGHEST PRIORITY)
|
|
21
|
+
|
|
22
|
+
**Policy Requirements Integration:**
|
|
23
|
+
- **Policy-driven questions** represent organizational governance requirements and must be enforced through configuration
|
|
24
|
+
- **Conditional applicability** - Only apply policies when their rationale matches the selected resources
|
|
25
|
+
- **REQUIRED question promotion** - Applicable policy requirements should become REQUIRED questions with helpful defaults
|
|
26
|
+
- **Compliance indicators** - Mark policy-driven questions with "⚠️ required by [policy description]" in question text
|
|
27
|
+
- **Policy rationale** - Include policy rationale as question hints to help users understand WHY they're required
|
|
28
|
+
|
|
29
|
+
**POLICY APPLICATION APPROACH:**
|
|
30
|
+
|
|
31
|
+
1. **Analyze Resource Match**: Review each policy's rationale to determine if it applies to the selected resources
|
|
32
|
+
2. **Extract Requirements**: Identify what configuration properties the policy requires
|
|
33
|
+
3. **Create REQUIRED Questions**: Convert applicable policy requirements into REQUIRED questions
|
|
34
|
+
4. **Add Compliance Context**: Include policy context in question text and hints
|
|
35
|
+
5. **Set Sensible Defaults**: Provide policy-compliant defaults when possible
|
|
36
|
+
|
|
37
|
+
**CRITICAL: Policy Conditional Logic**
|
|
38
|
+
- **Read each policy's "Rationale" field carefully** - it specifies WHEN and TO WHAT the policy applies
|
|
39
|
+
- **Apply policies selectively** - only convert policy requirements to questions when the policy technically applies to the selected resource types
|
|
40
|
+
- **Resource type matching** - If a policy rationale mentions specific resource types (e.g., "All Deployments must..."), only apply when Deployment resources are selected
|
|
41
|
+
- **Field-specific requirements** - Match policy requirements to actual resource schema fields available in the "Resources in Solution" section
|
|
42
|
+
- **Policy compliance increases user success** - policy-driven questions help users create compliant configurations from the start
|
|
43
|
+
|
|
17
44
|
Based on the user's intent and the Kubernetes resources in this solution, generate appropriate questions to gather the information needed to create working manifests.
|
|
18
45
|
|
|
19
46
|
**IMPORTANT**: Only ask questions about properties that are explicitly listed in the "Resources in Solution" section below. Do not ask about common Kubernetes properties unless they appear in the actual resource schema.
|
|
@@ -58,6 +58,8 @@ Create multiple alternative solutions. Consider:
|
|
|
58
58
|
|
|
59
59
|
Respond with ONLY a JSON object containing an array of complete solutions. Each solution should include resources, description, scoring, and pattern compliance:
|
|
60
60
|
|
|
61
|
+
**CRITICAL**: For each resource in your solutions, you MUST include the `resourceName` field. This field contains the correct plural, lowercase resource name used for kubectl explain calls. Extract this from the Available Resources list - each resource shows its `resourceName` field that you should copy exactly.
|
|
62
|
+
|
|
61
63
|
```json
|
|
62
64
|
{
|
|
63
65
|
"solutions": [
|
|
@@ -67,12 +69,14 @@ Respond with ONLY a JSON object containing an array of complete solutions. Each
|
|
|
67
69
|
{
|
|
68
70
|
"kind": "Deployment",
|
|
69
71
|
"apiVersion": "apps/v1",
|
|
70
|
-
"group": "apps"
|
|
72
|
+
"group": "apps",
|
|
73
|
+
"resourceName": "deployments.apps"
|
|
71
74
|
},
|
|
72
75
|
{
|
|
73
76
|
"kind": "Service",
|
|
74
77
|
"apiVersion": "v1",
|
|
75
|
-
"group": ""
|
|
78
|
+
"group": "",
|
|
79
|
+
"resourceName": "services"
|
|
76
80
|
}
|
|
77
81
|
],
|
|
78
82
|
"score": 95,
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: manage-org-data
|
|
3
|
-
description: Manage organizational patterns and cluster resource capabilities
|
|
3
|
+
description: Manage organizational patterns, policy intents, and cluster resource capabilities
|
|
4
4
|
category: administration
|
|
5
5
|
---
|
|
6
6
|
|
|
@@ -13,19 +13,30 @@ category: administration
|
|
|
13
13
|
2. List existing patterns
|
|
14
14
|
3. Get pattern details
|
|
15
15
|
4. Search patterns
|
|
16
|
+
5. Delete a specific pattern
|
|
17
|
+
6. Delete all patterns
|
|
18
|
+
|
|
19
|
+
### Policy Intents:
|
|
20
|
+
7. Create a new policy intent
|
|
21
|
+
8. List existing policy intents
|
|
22
|
+
9. Get policy intent details
|
|
23
|
+
10. Search policy intents
|
|
24
|
+
11. Delete a specific policy intent
|
|
25
|
+
12. Delete all policy intents
|
|
16
26
|
|
|
17
27
|
### Resource Capabilities:
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
28
|
+
13. Scan cluster for resource capabilities
|
|
29
|
+
14. List discovered capabilities
|
|
30
|
+
15. Get capability details
|
|
31
|
+
16. Delete specific capability data
|
|
32
|
+
17. Delete all capabilities
|
|
33
|
+
18. Check scan progress
|
|
34
|
+
19. Analyze capabilities
|
|
24
35
|
|
|
25
|
-
**Your choice**: [Type the number (1-
|
|
36
|
+
**Your choice**: [Type the number (1-19) or describe what you want to do]
|
|
26
37
|
|
|
27
38
|
---
|
|
28
39
|
|
|
29
|
-
Examples: Type "1" or "Create a new organizational pattern" or "
|
|
40
|
+
Examples: Type "1" or "Create a new organizational pattern" or "7" or "Create a new policy intent" or "13" or "Scan cluster"
|
|
30
41
|
|
|
31
42
|
Once you make your choice, I'll call the `manageOrgData` tool with the appropriate parameters.
|
|
@@ -1,43 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Pattern Creation Session Manager
|
|
3
|
-
*
|
|
4
|
-
* Handles step-by-step pattern creation workflow with context-aware questions
|
|
5
|
-
* and AI-powered trigger expansion.
|
|
6
|
-
*/
|
|
7
|
-
import { PatternCreationSession, PatternWorkflowStep } from './pattern-creation-types';
|
|
8
|
-
export declare class PatternCreationSessionManager {
|
|
9
|
-
/**
|
|
10
|
-
* Create a new pattern creation session
|
|
11
|
-
*/
|
|
12
|
-
createSession(args: any): PatternCreationSession;
|
|
13
|
-
/**
|
|
14
|
-
* Load existing session
|
|
15
|
-
*/
|
|
16
|
-
loadSession(sessionId: string, args: any): PatternCreationSession | null;
|
|
17
|
-
/**
|
|
18
|
-
* Save session to disk
|
|
19
|
-
*/
|
|
20
|
-
private saveSession;
|
|
21
|
-
/**
|
|
22
|
-
* Process user response and move to next step
|
|
23
|
-
*/
|
|
24
|
-
processResponse(sessionId: string, response: string, args: any): PatternWorkflowStep | null;
|
|
25
|
-
/**
|
|
26
|
-
* Get the next workflow step for the session
|
|
27
|
-
*/
|
|
28
|
-
getNextStep(sessionId: string, args: any): PatternWorkflowStep | null;
|
|
29
|
-
/**
|
|
30
|
-
* Generate trigger expansion step with AI suggestions
|
|
31
|
-
*/
|
|
32
|
-
private generateTriggerExpansionStep;
|
|
33
|
-
/**
|
|
34
|
-
* Generate review prompt showing complete pattern
|
|
35
|
-
*/
|
|
36
|
-
private generateReviewPrompt;
|
|
37
|
-
/**
|
|
38
|
-
* Complete pattern creation and return success result
|
|
39
|
-
*/
|
|
40
|
-
private completePattern;
|
|
41
|
-
private generateSessionId;
|
|
42
|
-
}
|
|
43
|
-
//# sourceMappingURL=pattern-creation-session.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"pattern-creation-session.d.ts","sourceRoot":"","sources":["../../src/core/pattern-creation-session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAIlC,qBAAa,6BAA6B;IAExC;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,GAAG,GAAG,sBAAsB;IAiBhD;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,sBAAsB,GAAG,IAAI;IAgBxE;;OAEG;IACH,OAAO,CAAC,WAAW;IAcnB;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,mBAAmB,GAAG,IAAI;IA+D3F;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,mBAAmB,GAAG,IAAI;IAwErE;;OAEG;IACH,OAAO,CAAC,4BAA4B;IAiCpC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAa5B;;OAEG;IACH,OAAO,CAAC,eAAe;IAyCvB,OAAO,CAAC,iBAAiB;CAG1B"}
|