timonel 0.3.0 → 1.0.0

package/dist/lib/Rutter.js

@@ -1,23 +1,17 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Rutter = void 0;
-const cdk8s_1 = require("cdk8s");
-const yaml_1 = __importDefault(require("yaml"));
-const helm_1 = require("./helm");
-const HelmChartWriter_1 = require("./HelmChartWriter");
+import { App, Chart, Testing, ApiObject } from 'cdk8s';
+import YAML from 'yaml';
+import { include, helm } from './helm.js';
+import { HelmChartWriter } from './HelmChartWriter.js';
 /**
  * Rutter builds Kubernetes manifests using cdk8s and writes a Helm chart.
  */
-class Rutter {
+export class Rutter {
     constructor(props) {
         this.assets = [];
         this.valueOverrides = {};
         this.props = props;
-        this.app = new cdk8s_1.App();
-        this.chart = new cdk8s_1.Chart(this.app, props.meta.name);
+        this.app = new App();
+        this.chart = new Chart(this.app, props.manifestName ?? props.meta.name);
     }
     /**
      * Set dynamic value overrides (from --set flags)
@@ -68,8 +62,8 @@ class Rutter {
     }
     addDeployment(spec) {
         const match = spec.matchLabels ?? {
-            [Rutter.LABEL_NAME]: (0, helm_1.include)(Rutter.HELPER_NAME),
-            [Rutter.LABEL_INSTANCE]: helm_1.helm.releaseName,
+            [Rutter.LABEL_NAME]: include(Rutter.HELPER_NAME),
+            [Rutter.LABEL_INSTANCE]: helm.releaseName,
         };
         const envEntries = spec.env
             ? Object.entries(spec.env).map(([name, value]) => ({ name, value }))
@@ -99,7 +93,7 @@ class Rutter {
             }))
             : undefined;
         const templateLabels = { ...match, ...(spec.podLabels ?? {}) };
-        const dep = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const dep = new ApiObject(this.chart, spec.name, {
             apiVersion: 'apps/v1',
             kind: 'Deployment',
             metadata: {
@@ -140,7 +134,7 @@ class Rutter {
         return dep;
     }
     addService(spec) {
-        const svc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const svc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'Service',
             metadata: {
@@ -175,8 +169,8 @@ class Rutter {
     }
     addReplicaSet(spec) {
         const match = spec.matchLabels ?? {
-            [Rutter.LABEL_NAME]: (0, helm_1.include)(Rutter.HELPER_NAME),
-            [Rutter.LABEL_INSTANCE]: helm_1.helm.releaseName,
+            [Rutter.LABEL_NAME]: include(Rutter.HELPER_NAME),
+            [Rutter.LABEL_INSTANCE]: helm.releaseName,
         };
         const envEntries = spec.env
             ? Object.entries(spec.env).map(([name, value]) => ({ name, value }))
@@ -206,7 +200,7 @@ class Rutter {
             }))
             : undefined;
         const templateLabels = { ...match, ...(spec.podLabels ?? {}) };
-        const rs = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const rs = new ApiObject(this.chart, spec.name, {
             apiVersion: 'apps/v1',
             kind: 'ReplicaSet',
             metadata: {
@@ -247,8 +241,8 @@ class Rutter {
         return rs;
     }
     addIngress(spec) {
-        const ing = new cdk8s_1.ApiObject(this.chart, spec.name, {
-            apiVersion: 'networking.k8s.io/v1',
+        const ing = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
             kind: 'Ingress',
             metadata: {
                 name: spec.name,
@@ -321,7 +315,7 @@ class Rutter {
                 pvSpec[key] = value;
             }
         }
-        const pv = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pv = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolume',
             metadata: {
@@ -336,14 +330,15 @@ class Rutter {
     }
     optimizePVForCloud(spec) {
         const optimized = { ...spec };
+        const EBS_CSI_DRIVER = 'ebs.csi.aws.com';
         // Apply cloud-specific optimizations
         if (spec.cloudProvider === 'aws') {
             optimized.annotations = {
                 ...optimized.annotations,
-                'volume.beta.kubernetes.io/storage-provisioner': 'ebs.csi.aws.com',
+                'volume.beta.kubernetes.io/storage-provisioner': EBS_CSI_DRIVER,
             };
             // Default to gp3 for better performance/cost
-            if (spec.source.csi?.driver === 'ebs.csi.aws.com' && optimized.source.csi) {
+            if (spec.source.csi?.driver === EBS_CSI_DRIVER && optimized.source.csi) {
                 optimized.source.csi.volumeAttributes = {
                     type: 'gp3',
                     ...spec.source.csi.volumeAttributes,
@@ -377,7 +372,7 @@ class Rutter {
     addPersistentVolumeClaim(spec) {
         // Validate access modes compatibility
         this.validatePVCAccessModes(spec);
-        const pvc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pvc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolumeClaim',
             metadata: {
@@ -412,7 +407,7 @@ class Rutter {
         }
     }
     addConfigMap(spec) {
-        const cm = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const cm = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'ConfigMap',
             metadata: {
@@ -428,7 +423,7 @@ class Rutter {
         return cm;
     }
     addSecret(spec) {
-        const sec = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sec = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'Secret',
             metadata: {
@@ -445,27 +440,378 @@ class Rutter {
         return sec;
     }
     addServiceAccount(spec) {
-        const ann = {
+        const annotations = this.buildServiceAccountAnnotations(spec);
+        const sa = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'v1',
+            kind: 'ServiceAccount',
+            metadata: {
+                name: spec.name,
+                ...(Object.keys(annotations).length ? { annotations } : {}),
+                ...(spec.labels ? { labels: spec.labels } : {}),
+            },
+            automountServiceAccountToken: spec.automountServiceAccountToken,
+            imagePullSecrets: spec.imagePullSecrets?.map((n) => ({ name: n })),
+            secrets: spec.secrets?.map((n) => ({ name: n })),
+        });
+        this.capture(sa, `${spec.name}-serviceaccount`);
+        return sa;
+    }
+    buildServiceAccountAnnotations(spec) {
+        const annotations = {
             ...(spec.annotations ?? {}),
-            ...(spec.awsRoleArn ? { 'eks.amazonaws.com/role-arn': spec.awsRoleArn } : {}),
-            ...(spec.awsAudience ? { 'eks.amazonaws.com/audience': spec.awsAudience } : {}),
-            ...(spec.azureClientId ? { 'azure.workload.identity/client-id': spec.azureClientId } : {}),
-            ...(spec.azureTenantId ? { 'azure.workload.identity/tenant-id': spec.azureTenantId } : {}),
-            ...(spec.azureServiceAccountTokenExpiration !== undefined
-                ? {
-                    'azure.workload.identity/service-account-token-expiration': String(spec.azureServiceAccountTokenExpiration),
-                }
-                : {}),
-            ...(spec.gcpServiceAccountEmail
-                ? { 'iam.gke.io/gcp-service-account': spec.gcpServiceAccountEmail }
+        };
+        this.addAWSIRSAAnnotations(annotations, spec);
+        this.addAzureWorkloadIdentityAnnotations(annotations, spec);
+        this.addGCPWorkloadIdentityAnnotations(annotations, spec);
+        return annotations;
+    }
+    addAWSIRSAAnnotations(annotations, spec) {
+        if (spec.awsRoleArn) {
+            annotations['eks.amazonaws.com/role-arn'] = spec.awsRoleArn;
+        }
+        if (spec.awsAudience) {
+            annotations['eks.amazonaws.com/audience'] = spec.awsAudience;
+        }
+        if (spec.awsStsEndpointType) {
+            annotations['eks.amazonaws.com/sts-regional-endpoints'] = spec.awsStsEndpointType;
+        }
+        if (spec.awsTokenExpiration !== undefined) {
+            annotations['eks.amazonaws.com/token-expiration'] = String(spec.awsTokenExpiration);
+        }
+    }
+    addAzureWorkloadIdentityAnnotations(annotations, spec) {
+        if (spec.azureClientId) {
+            annotations['azure.workload.identity/client-id'] = spec.azureClientId;
+        }
+        if (spec.azureTenantId) {
+            annotations['azure.workload.identity/tenant-id'] = spec.azureTenantId;
+        }
+        if (spec.azureServiceAccountTokenExpiration !== undefined) {
+            annotations['azure.workload.identity/service-account-token-expiration'] = String(spec.azureServiceAccountTokenExpiration);
+        }
+    }
+    addGCPWorkloadIdentityAnnotations(annotations, spec) {
+        if (spec.gcpServiceAccountEmail) {
+            annotations['iam.gke.io/gcp-service-account'] = spec.gcpServiceAccountEmail;
+        }
+    }
+    addHorizontalPodAutoscaler(spec) {
+        // Default metrics if none provided (CPU utilization at 80%)
+        const defaultMetrics = [
+            {
+                type: 'Resource',
+                resource: {
+                    name: 'cpu',
+                    target: {
+                        type: 'Utilization',
+                        averageUtilization: 80,
+                    },
+                },
+            },
+        ];
+        const hpa = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'autoscaling/v2',
+            kind: 'HorizontalPodAutoscaler',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                scaleTargetRef: spec.scaleTargetRef,
+                minReplicas: spec.minReplicas ?? 1,
+                maxReplicas: spec.maxReplicas,
+                metrics: spec.metrics ?? defaultMetrics,
+                ...(spec.behavior ? { behavior: spec.behavior } : {}),
+            },
+        });
+        this.capture(hpa, `${spec.name}-hpa`);
+        return hpa;
+    }
+    addVerticalPodAutoscaler(spec) {
+        const vpa = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'autoscaling.k8s.io/v1',
+            kind: 'VerticalPodAutoscaler',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                targetRef: spec.targetRef,
+                updatePolicy: spec.updatePolicy ?? { updateMode: 'Auto' },
+                ...(spec.resourcePolicy ? { resourcePolicy: spec.resourcePolicy } : {}),
+                ...(spec.recommenders ? { recommenders: spec.recommenders } : {}),
+            },
+        });
+        this.capture(vpa, `${spec.name}-vpa`);
+        return vpa;
+    }
+    addPodDisruptionBudget(spec) {
+        const pdb = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'policy/v1',
+            kind: 'PodDisruptionBudget',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                ...(spec.minAvailable !== undefined ? { minAvailable: spec.minAvailable } : {}),
+                ...(spec.maxUnavailable !== undefined ? { maxUnavailable: spec.maxUnavailable } : {}),
+                selector: spec.selector,
+            },
+        });
+        this.capture(pdb, `${spec.name}-pdb`);
+        return pdb;
+    }
+    addAWSEBSStorageClass(spec) {
+        const DEFAULT_VOLUME_TYPE = 'gp3';
+        const parameters = {
+            type: spec.volumeType ?? DEFAULT_VOLUME_TYPE,
+            fsType: spec.fsType ?? 'ext4',
+            encrypted: String(spec.encrypted ?? true),
+        };
+        if (spec.kmsKeyId) {
+            parameters['kmsKeyId'] = spec.kmsKeyId;
+        }
+        const IOPS_SUPPORTED_TYPES = ['gp3', 'io1', 'io2'];
+        if (spec.iops && IOPS_SUPPORTED_TYPES.includes(spec.volumeType ?? DEFAULT_VOLUME_TYPE)) {
+            parameters['iops'] = String(spec.iops);
+        }
+        if (spec.throughput && spec.volumeType === DEFAULT_VOLUME_TYPE) {
+            parameters['throughput'] = String(spec.throughput);
+        }
+        const sc = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'storage.k8s.io/v1',
+            kind: 'StorageClass',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            provisioner: 'ebs.csi.aws.com',
+            parameters,
+            reclaimPolicy: spec.reclaimPolicy ?? 'Delete',
+            allowVolumeExpansion: spec.allowVolumeExpansion ?? true,
+            volumeBindingMode: spec.volumeBindingMode ?? 'WaitForFirstConsumer',
+        });
+        this.capture(sc, `${spec.name}-storageclass`);
+        return sc;
+    }
+    addAWSEBSPersistentVolumeClaim(spec) {
+        const pvc = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                accessModes: spec.accessModes ?? ['ReadWriteOnce'],
+                storageClassName: spec.storageClassName,
+                resources: {
+                    requests: {
+                        storage: spec.size,
+                    },
+                },
+            },
+        });
+        this.capture(pvc, `${spec.name}-pvc`);
+        return pvc;
+    }
+    addAWSEFSStorageClass(spec) {
+        const sc = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'storage.k8s.io/v1',
+            kind: 'StorageClass',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            provisioner: 'efs.csi.aws.com',
+            reclaimPolicy: spec.reclaimPolicy ?? 'Delete',
+            volumeBindingMode: spec.volumeBindingMode ?? 'Immediate',
+        });
+        this.capture(sc, `${spec.name}-storageclass`);
+        return sc;
+    }
+    addAWSEFSPersistentVolume(spec) {
+        const csiSpec = {
+            driver: 'efs.csi.aws.com',
+            volumeHandle: spec.fileSystemId,
+        };
+        if (spec.accessPoint) {
+            csiSpec['volumeHandle'] = `${spec.fileSystemId}::${spec.accessPoint}`;
+        }
+        const volumeAttributes = {};
+        if (spec.directoryPerms) {
+            volumeAttributes['directoryPerms'] = spec.directoryPerms;
+        }
+        if (spec.gidRangeStart !== undefined) {
+            volumeAttributes['gidRangeStart'] = String(spec.gidRangeStart);
+        }
+        if (spec.gidRangeEnd !== undefined) {
+            volumeAttributes['gidRangeEnd'] = String(spec.gidRangeEnd);
+        }
+        if (spec.basePath) {
+            volumeAttributes['basePath'] = spec.basePath;
+        }
+        if (spec.subPath) {
+            volumeAttributes['subPath'] = spec.subPath;
+        }
+        if (Object.keys(volumeAttributes).length > 0) {
+            csiSpec['volumeAttributes'] = volumeAttributes;
+        }
+        const pv = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'v1',
+            kind: 'PersistentVolume',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                capacity: {
+                    storage: spec.capacity ?? '5Gi',
+                },
+                accessModes: spec.accessModes ?? ['ReadWriteMany'],
+                persistentVolumeReclaimPolicy: 'Retain',
+                storageClassName: spec.storageClassName,
+                csi: csiSpec,
+            },
+        });
+        this.capture(pv, `${spec.name}-pv`);
+        return pv;
+    }
+    addAWSEFSPersistentVolumeClaim(spec) {
+        const pvc = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                accessModes: spec.accessModes ?? ['ReadWriteMany'],
+                storageClassName: spec.storageClassName,
+                resources: {
+                    requests: {
+                        storage: spec.size ?? '5Gi',
+                    },
+                },
+            },
+        });
+        this.capture(pvc, `${spec.name}-pvc`);
+        return pvc;
+    }
+    addAWSALBIngress(spec) {
+        const annotations = this.buildALBAnnotations(spec);
+        const ingress = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
+            kind: 'Ingress',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                annotations,
+            },
+            spec: {
+                tls: spec.tls,
+                rules: spec.rules.map((rule) => ({
+                    host: rule.host,
+                    http: {
+                        paths: rule.paths.map((path) => ({
+                            path: path.path,
+                            pathType: path.pathType,
+                            backend: path.backend,
+                        })),
+                    },
+                })),
+            },
+        });
+        this.capture(ingress, `${spec.name}-ingress`);
+        return ingress;
+    }
+    buildALBAnnotations(spec) {
+        const annotations = {
+            'kubernetes.io/ingress.class': 'alb',
+            'alb.ingress.kubernetes.io/scheme': spec.scheme ?? 'internet-facing',
+            'alb.ingress.kubernetes.io/target-type': spec.targetType ?? 'ip',
+            ...(spec.annotations ?? {}),
+        };
+        this.addOptionalALBAnnotations(annotations, spec);
+        this.addHealthCheckAnnotations(annotations, spec);
+        this.addTagsAnnotation(annotations, spec);
+        return annotations;
+    }
+    addOptionalALBAnnotations(annotations, spec) {
+        if (spec.ipAddressType) {
+            annotations['alb.ingress.kubernetes.io/ip-address-type'] = spec.ipAddressType;
+        }
+        if (spec.groupName) {
+            annotations['alb.ingress.kubernetes.io/group.name'] = spec.groupName;
+        }
+        if (spec.groupOrder !== undefined) {
+            annotations['alb.ingress.kubernetes.io/group.order'] = String(spec.groupOrder);
+        }
+        if (spec.subnets && spec.subnets.length > 0) {
+            annotations['alb.ingress.kubernetes.io/subnets'] = spec.subnets.join(',');
+        }
+        if (spec.securityGroups && spec.securityGroups.length > 0) {
+            annotations['alb.ingress.kubernetes.io/security-groups'] = spec.securityGroups.join(',');
+        }
+        if (spec.certificateArn) {
+            annotations['alb.ingress.kubernetes.io/certificate-arn'] = spec.certificateArn;
+        }
+        if (spec.sslRedirect) {
+            annotations['alb.ingress.kubernetes.io/ssl-redirect'] = '443';
+        }
+    }
+    addHealthCheckAnnotations(annotations, spec) {
+        if (spec.healthCheckPath) {
+            annotations['alb.ingress.kubernetes.io/healthcheck-path'] = spec.healthCheckPath;
+        }
+        if (spec.healthCheckIntervalSeconds !== undefined) {
+            annotations['alb.ingress.kubernetes.io/healthcheck-interval-seconds'] = String(spec.healthCheckIntervalSeconds);
+        }
+        if (spec.healthCheckTimeoutSeconds !== undefined) {
+            annotations['alb.ingress.kubernetes.io/healthcheck-timeout-seconds'] = String(spec.healthCheckTimeoutSeconds);
+        }
+        if (spec.healthyThresholdCount !== undefined) {
+            annotations['alb.ingress.kubernetes.io/healthy-threshold-count'] = String(spec.healthyThresholdCount);
+        }
+        if (spec.unhealthyThresholdCount !== undefined) {
+            annotations['alb.ingress.kubernetes.io/unhealthy-threshold-count'] = String(spec.unhealthyThresholdCount);
+        }
+    }
+    addTagsAnnotation(annotations, spec) {
+        if (spec.tags && Object.keys(spec.tags).length > 0) {
+            const tagString = Object.entries(spec.tags)
+                .map(([key, value]) => `${key}=${value}`)
+                .join(',');
+            annotations['alb.ingress.kubernetes.io/tags'] = tagString;
+        }
+    }
+    addAWSIRSAServiceAccount(spec) {
+        const annotations = {
+            'eks.amazonaws.com/role-arn': spec.roleArn,
+            ...(spec.audience ? { 'eks.amazonaws.com/audience': spec.audience } : {}),
+            ...(spec.stsEndpointType
+                ? { 'eks.amazonaws.com/sts-regional-endpoints': spec.stsEndpointType }
+                : { 'eks.amazonaws.com/sts-regional-endpoints': 'regional' }),
+            ...(spec.tokenExpiration !== undefined
+                ? { 'eks.amazonaws.com/token-expiration': String(spec.tokenExpiration) }
                 : {}),
+            ...(spec.annotations ?? {}),
         };
-        const sa = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sa = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'ServiceAccount',
             metadata: {
                 name: spec.name,
-                ...(Object.keys(ann).length ? { annotations: ann } : {}),
+                annotations,
                 ...(spec.labels ? { labels: spec.labels } : {}),
             },
             automountServiceAccountToken: spec.automountServiceAccountToken,
@@ -475,6 +821,227 @@ class Rutter {
         this.capture(sa, `${spec.name}-serviceaccount`);
         return sa;
     }
+    addAWSSecretProviderClass(spec) {
+        const objects = spec.objects.map((obj) => {
+            const baseObj = {
+                objectName: obj.objectName,
+                objectType: obj.objectType,
+            };
+            if ('objectAlias' in obj && obj.objectAlias) {
+                baseObj['objectAlias'] = obj.objectAlias;
+            }
+            if ('jmesPath' in obj && obj.jmesPath) {
+                baseObj['jmesPath'] = obj.jmesPath;
+            }
+            return baseObj;
+        });
+        const objectsYaml = YAML.stringify(objects, { indent: 2 }).trim();
+        const parameters = {
+            objects: `|\n  ${objectsYaml.split('\n').join('\n  ')}`,
+        };
+        if (spec.region) {
+            parameters['region'] = spec.region;
+        }
+        const spc = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'secrets-store.csi.x-k8s.io/v1',
+            kind: 'SecretProviderClass',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                provider: 'aws',
+                parameters,
+            },
+        });
+        this.capture(spc, `${spec.name}-secretproviderclass`);
+        return spc;
+    }
+    addNetworkPolicy(spec) {
+        // Validate policy types
+        this.validateNetworkPolicyTypes(spec);
+        // Validate CIDR blocks if present
+        this.validateNetworkPolicyCIDRs(spec);
+        const np = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
+            kind: 'NetworkPolicy',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                podSelector: spec.podSelector ?? {},
+                policyTypes: spec.policyTypes,
+                ...(spec.ingress ? { ingress: spec.ingress } : {}),
+                ...(spec.egress ? { egress: spec.egress } : {}),
+            },
+        });
+        this.capture(np, `${spec.name}-networkpolicy`);
+        return np;
+    }
+    /**
+     * Create a deny-all ingress NetworkPolicy for the current namespace
+     */
+    addDenyAllIngressNetworkPolicy(name = 'deny-all-ingress') {
+        return this.addNetworkPolicy({
+            name,
+            podSelector: Rutter.EMPTY_POD_SELECTOR,
+            policyTypes: ['Ingress'],
+        });
+    }
+    /**
+     * Create a deny-all egress NetworkPolicy for the current namespace
+     */
+    addDenyAllEgressNetworkPolicy(name = 'deny-all-egress') {
+        return this.addNetworkPolicy({
+            name,
+            podSelector: Rutter.EMPTY_POD_SELECTOR,
+            policyTypes: ['Egress'],
+        });
+    }
+    /**
+     * Create a deny-all NetworkPolicy for both ingress and egress
+     */
+    addDenyAllNetworkPolicy(name = 'deny-all') {
+        return this.addNetworkPolicy({
+            name,
+            podSelector: Rutter.EMPTY_POD_SELECTOR,
+            policyTypes: ['Ingress', 'Egress'],
+        });
+    }
+    /**
+     * Allow traffic from specific pods to target pods on specific ports
+     */
+    addAllowFromPodsNetworkPolicy(spec) {
+        return this.addNetworkPolicy({
+            name: spec.name,
+            podSelector: { matchLabels: spec.targetPodSelector },
+            policyTypes: ['Ingress'],
+            ingress: [
+                {
+                    from: [{ podSelector: { matchLabels: spec.sourcePodSelector } }],
+                    ...(spec.ports ? { ports: spec.ports } : {}),
+                },
+            ],
+            ...(spec.labels ? { labels: spec.labels } : {}),
+            ...(spec.annotations ? { annotations: spec.annotations } : {}),
+        });
+    }
+    /**
+     * Allow traffic from specific namespace to target pods
+     */
+    addAllowFromNamespaceNetworkPolicy(spec) {
+        return this.addNetworkPolicy({
+            name: spec.name,
+            podSelector: { matchLabels: spec.targetPodSelector },
+            policyTypes: ['Ingress'],
+            ingress: [
+                {
+                    from: [{ namespaceSelector: { matchLabels: spec.sourceNamespaceSelector } }],
+                    ...(spec.ports ? { ports: spec.ports } : {}),
+                },
+            ],
+            ...(spec.labels ? { labels: spec.labels } : {}),
+            ...(spec.annotations ? { annotations: spec.annotations } : {}),
+        });
+    }
+    validateNetworkPolicyTypes(spec) {
+        if (!spec.policyTypes || spec.policyTypes.length === 0) {
+            throw new Error(`NetworkPolicy ${spec.name}: policyTypes must be specified`);
+        }
+        this.validatePolicyTypeValues(spec);
+        this.validatePolicyTypeRules(spec);
+    }
+    validatePolicyTypeValues(spec) {
+        const validTypes = ['Ingress', 'Egress'];
+        for (const type of spec.policyTypes) {
+            if (!validTypes.includes(type)) {
+                throw new Error(`NetworkPolicy ${spec.name}: invalid policyType '${type}', must be 'Ingress' or 'Egress'`);
+            }
+        }
+    }
+    validatePolicyTypeRules(spec) {
+        if (spec.policyTypes.includes('Ingress') && spec.ingress === undefined) {
+            console.warn(`NetworkPolicy ${spec.name}: policyType 'Ingress' specified but no ingress rules defined (will deny all ingress)`);
+        }
+        if (spec.policyTypes.includes('Egress') && spec.egress === undefined) {
+            console.warn(`NetworkPolicy ${spec.name}: policyType 'Egress' specified but no egress rules defined (will deny all egress)`);
+        }
+    }
+    validateNetworkPolicyCIDRs(spec) {
+        const validateCIDR = (cidr, context) => {
+            if (!this.isValidCIDR(cidr)) {
+                throw new Error(`NetworkPolicy ${spec.name}: invalid CIDR '${cidr}' in ${context}`);
+            }
+        };
+        this.validateIngressCIDRs(spec, validateCIDR);
+        this.validateEgressCIDRs(spec, validateCIDR);
+    }
+    isValidCIDR(cidr) {
+        // IPv4 CIDR validation
+        const ipv4Parts = cidr.split('/');
+        if (ipv4Parts.length === 2) {
+            const [ip, prefix] = ipv4Parts;
+            if (ip && prefix && this.isValidIPv4(ip) && this.isValidPrefix(prefix, 32)) {
+                return true;
+            }
+        }
+        // IPv6 CIDR validation (basic)
+        if (cidr.includes(':') && ipv4Parts.length === 2) {
+            const [, prefix] = ipv4Parts;
+            if (prefix) {
+                return this.isValidPrefix(prefix, 128);
+            }
+        }
+        return false;
+    }
+    isValidIPv4(ip) {
+        const parts = ip.split('.');
+        if (parts.length !== 4)
+            return false;
+        return parts.every((part) => {
+            const num = parseInt(part, 10);
+            return !isNaN(num) && num >= 0 && num <= 255 && String(num) === part;
+        });
+    }
+    isValidPrefix(prefix, maxPrefix) {
+        const num = parseInt(prefix, 10);
+        return !isNaN(num) && num >= 0 && num <= maxPrefix && String(num) === prefix;
+    }
+    validateIngressCIDRs(spec, validateCIDR) {
+        if (!spec.ingress)
+            return;
+        for (const rule of spec.ingress) {
+            if (rule.from) {
+                for (const peer of rule.from) {
+                    this.validatePeerCIDRs(peer, validateCIDR, 'ingress rule');
+                }
+            }
+        }
+    }
+    validateEgressCIDRs(spec, validateCIDR) {
+        if (!spec.egress)
+            return;
+        for (const rule of spec.egress) {
+            if (rule.to) {
+                for (const peer of rule.to) {
+                    this.validatePeerCIDRs(peer, validateCIDR, 'egress rule');
+                }
+            }
+        }
+    }
+    validatePeerCIDRs(peer, validateCIDR, context) {
+        if (peer.ipBlock?.cidr) {
+            validateCIDR(peer.ipBlock.cidr, context);
+            if (peer.ipBlock.except) {
+                for (const except of peer.ipBlock.except) {
+                    validateCIDR(except, `${context} except block`);
+                }
+            }
+        }
+    }
     /**
      * Capture the YAML of an ApiObject or Construct into assets.
      */
@@ -483,6 +1050,21 @@ class Rutter {
         // We defer synth until write(), but we can capture logical ids now
         this.assets.push({ id, yaml: `# captured:${id}` });
     }
+    /**
+     * Extract a meaningful name from a Kubernetes resource object
+     */
+    getResourceName(obj) {
+        if (obj && typeof obj === 'object') {
+            const resource = obj;
+            if (resource.kind && resource.metadata?.name) {
+                return `${resource.kind.toLowerCase()}-${resource.metadata.name}`;
+            }
+            if (resource.kind) {
+                return resource.kind.toLowerCase();
+            }
+        }
+        return 'resource';
+    }
     /**
      * Add a raw CRD manifest to the chart (written under crds/).
      */
@@ -494,7 +1076,7 @@ class Rutter {
      */
     write(outDir) {
         // Use cdk8s Testing.synth to obtain manifest objects
-        const manifestObjs = cdk8s_1.Testing.synth(this.chart);
+        const manifestObjs = Testing.synth(this.chart);
         // Enforce common labels best-practice on all rendered objects
         const enriched = manifestObjs.map((obj) => {
             if (obj && typeof obj === 'object') {
@@ -504,11 +1086,11 @@ class Rutter {
                 const labels = o.metadata.labels;
                 const defaults = {
                     'helm.sh/chart': '{{ .Chart.Name }}-{{ .Chart.Version }}',
-                    'app.kubernetes.io/name': (0, helm_1.include)(Rutter.HELPER_NAME),
-                    'app.kubernetes.io/instance': helm_1.helm.releaseName,
-                    'app.kubernetes.io/version': helm_1.helm.chartVersion,
+                    'app.kubernetes.io/name': include(Rutter.HELPER_NAME),
+                    'app.kubernetes.io/instance': helm.releaseName,
+                    'app.kubernetes.io/version': helm.chartVersion,
                     'app.kubernetes.io/managed-by': '{{ .Release.Service }}',
-                    'app.kubernetes.io/part-of': helm_1.helm.chartName,
+                    'app.kubernetes.io/part-of': helm.chartName,
                 };
                 for (const [k, v] of Object.entries(defaults)) {
                     if (!(k in labels)) {
@@ -519,13 +1101,30 @@ class Rutter {
             }
             return obj;
         });
-        const combinedYaml = enriched
-            .map((obj) => yaml_1.default.stringify(obj).trim())
-            .filter(Boolean)
-            .map((y) => `---\n${y}`)
-            .join('\n');
-        this.assets.length = 0;
-        this.assets.push({ id: 'manifests', yaml: combinedYaml });
+        if (this.props.singleManifestFile) {
+            // Combine all resources into a single manifest file
+            const combinedYaml = enriched
+                .map((obj) => YAML.stringify(obj).trim())
+                .filter(Boolean)
+                .join('\n---\n');
+            this.assets.length = 0;
+            const manifestId = this.props.manifestName ?? 'manifests';
+            this.assets.push({ id: manifestId, yaml: combinedYaml, singleFile: true });
+        }
+        else {
+            // Create separate files for each resource (default behavior)
+            this.assets.length = 0;
+            enriched.forEach((obj, _index) => {
+                const yaml = YAML.stringify(obj).trim();
+                if (yaml) {
+                    const resourceName = this.getResourceName(obj);
+                    const manifestId = this.props.manifestName
+                        ? `${this.props.manifestName}-${resourceName}`
+                        : resourceName;
+                    this.assets.push({ id: manifestId, yaml });
+                }
+            });
+        }
         const options = {
             outDir,
             meta: this.props.meta,
@@ -573,11 +1172,12 @@ class Rutter {
             ...(this.props.notesTpl !== undefined ? { notesTpl: this.props.notesTpl } : {}),
             ...(this.props.valuesSchema !== undefined ? { valuesSchema: this.props.valuesSchema } : {}),
         };
-        HelmChartWriter_1.HelmChartWriter.write(options);
+        HelmChartWriter.write(options);
     }
 }
-exports.Rutter = Rutter;
 Rutter.LABEL_NAME = 'app.kubernetes.io/name';
 Rutter.LABEL_INSTANCE = 'app.kubernetes.io/instance';
 Rutter.HELPER_NAME = 'timonel.name';
+Rutter.NETWORKING_API_VERSION = 'networking.k8s.io/v1';
+Rutter.EMPTY_POD_SELECTOR = {};
 //# sourceMappingURL=Rutter.js.map