timonel 0.4.0 → 2.0.0

package/dist/lib/Rutter.js

@@ -1,23 +1,17 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Rutter = void 0;
-const cdk8s_1 = require("cdk8s");
-const yaml_1 = __importDefault(require("yaml"));
-const helm_1 = require("./helm");
-const HelmChartWriter_1 = require("./HelmChartWriter");
+import { App, Chart, Testing, ApiObject } from 'cdk8s';
+import YAML from 'yaml';
+import { include, helm } from './helm.js';
+import { HelmChartWriter } from './HelmChartWriter.js';
 /**
  * Rutter builds Kubernetes manifests using cdk8s and writes a Helm chart.
  */
-class Rutter {
+export class Rutter {
     constructor(props) {
         this.assets = [];
         this.valueOverrides = {};
         this.props = props;
-        this.app = new cdk8s_1.App();
-        this.chart = new cdk8s_1.Chart(this.app, props.manifestName ?? props.meta.name);
+        this.app = new App();
+        this.chart = new Chart(this.app, props.manifestName ?? props.meta.name);
     }
     /**
      * Set dynamic value overrides (from --set flags)
@@ -68,8 +62,8 @@ class Rutter {
     }
     addDeployment(spec) {
         const match = spec.matchLabels ?? {
-            [Rutter.LABEL_NAME]: (0, helm_1.include)(Rutter.HELPER_NAME),
-            [Rutter.LABEL_INSTANCE]: helm_1.helm.releaseName,
+            [Rutter.LABEL_NAME]: include(Rutter.HELPER_NAME),
+            [Rutter.LABEL_INSTANCE]: helm.releaseName,
         };
         const envEntries = spec.env
             ? Object.entries(spec.env).map(([name, value]) => ({ name, value }))
@@ -99,7 +93,7 @@ class Rutter {
             }))
             : undefined;
         const templateLabels = { ...match, ...(spec.podLabels ?? {}) };
-        const dep = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const dep = new ApiObject(this.chart, spec.name, {
             apiVersion: 'apps/v1',
             kind: 'Deployment',
             metadata: {
@@ -140,7 +134,7 @@ class Rutter {
         return dep;
     }
     addService(spec) {
-        const svc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const svc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'Service',
             metadata: {
@@ -175,8 +169,8 @@ class Rutter {
     }
     addReplicaSet(spec) {
         const match = spec.matchLabels ?? {
-            [Rutter.LABEL_NAME]: (0, helm_1.include)(Rutter.HELPER_NAME),
-            [Rutter.LABEL_INSTANCE]: helm_1.helm.releaseName,
+            [Rutter.LABEL_NAME]: include(Rutter.HELPER_NAME),
+            [Rutter.LABEL_INSTANCE]: helm.releaseName,
         };
         const envEntries = spec.env
             ? Object.entries(spec.env).map(([name, value]) => ({ name, value }))
@@ -206,7 +200,7 @@ class Rutter {
             }))
             : undefined;
         const templateLabels = { ...match, ...(spec.podLabels ?? {}) };
-        const rs = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const rs = new ApiObject(this.chart, spec.name, {
             apiVersion: 'apps/v1',
             kind: 'ReplicaSet',
             metadata: {
@@ -247,8 +241,8 @@ class Rutter {
         return rs;
     }
     addIngress(spec) {
-        const ing = new cdk8s_1.ApiObject(this.chart, spec.name, {
-            apiVersion: 'networking.k8s.io/v1',
+        const ing = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
             kind: 'Ingress',
             metadata: {
                 name: spec.name,
@@ -321,7 +315,7 @@ class Rutter {
                 pvSpec[key] = value;
             }
         }
-        const pv = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pv = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolume',
             metadata: {
@@ -354,10 +348,10 @@ class Rutter {
         else if (spec.cloudProvider === 'azure') {
             optimized.annotations = {
                 ...optimized.annotations,
-                'volume.beta.kubernetes.io/storage-provisioner': 'disk.csi.azure.com',
+                [Rutter.AZURE_DISK_PROVISIONER_ANNOTATION]: Rutter.AZURE_DISK_CSI_DRIVER,
             };
             // Default to Premium_ZRS for multi-zone clusters
-            if (spec.source.csi?.driver === 'disk.csi.azure.com' && optimized.source.csi) {
+            if (spec.source.csi?.driver === Rutter.AZURE_DISK_CSI_DRIVER && optimized.source.csi) {
                 optimized.source.csi.volumeAttributes = {
                     skuName: 'Premium_ZRS',
                     ...spec.source.csi.volumeAttributes,
@@ -378,7 +372,7 @@ class Rutter {
     addPersistentVolumeClaim(spec) {
         // Validate access modes compatibility
         this.validatePVCAccessModes(spec);
-        const pvc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pvc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolumeClaim',
             metadata: {
@@ -413,7 +407,7 @@ class Rutter {
         }
     }
     addConfigMap(spec) {
-        const cm = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const cm = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'ConfigMap',
             metadata: {
@@ -429,7 +423,7 @@ class Rutter {
         return cm;
     }
     addSecret(spec) {
-        const sec = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sec = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'Secret',
             metadata: {
@@ -447,7 +441,7 @@ class Rutter {
     }
     addServiceAccount(spec) {
         const annotations = this.buildServiceAccountAnnotations(spec);
-        const sa = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sa = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'ServiceAccount',
             metadata: {
@@ -515,7 +509,7 @@ class Rutter {
                 },
             },
         ];
-        const hpa = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const hpa = new ApiObject(this.chart, spec.name, {
             apiVersion: 'autoscaling/v2',
             kind: 'HorizontalPodAutoscaler',
             metadata: {
@@ -535,7 +529,7 @@ class Rutter {
         return hpa;
     }
     addVerticalPodAutoscaler(spec) {
-        const vpa = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const vpa = new ApiObject(this.chart, spec.name, {
             apiVersion: 'autoscaling.k8s.io/v1',
             kind: 'VerticalPodAutoscaler',
             metadata: {
@@ -554,7 +548,7 @@ class Rutter {
         return vpa;
     }
     addPodDisruptionBudget(spec) {
-        const pdb = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pdb = new ApiObject(this.chart, spec.name, {
             apiVersion: 'policy/v1',
             kind: 'PodDisruptionBudget',
             metadata: {
@@ -588,8 +582,8 @@ class Rutter {
         if (spec.throughput && spec.volumeType === DEFAULT_VOLUME_TYPE) {
             parameters['throughput'] = String(spec.throughput);
         }
-        const sc = new cdk8s_1.ApiObject(this.chart, spec.name, {
-            apiVersion: 'storage.k8s.io/v1',
+        const sc = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.STORAGE_API_VERSION,
             kind: 'StorageClass',
             metadata: {
                 name: spec.name,
@@ -606,7 +600,7 @@ class Rutter {
         return sc;
     }
     addAWSEBSPersistentVolumeClaim(spec) {
-        const pvc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pvc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolumeClaim',
             metadata: {
@@ -628,8 +622,8 @@ class Rutter {
         return pvc;
     }
     addAWSEFSStorageClass(spec) {
-        const sc = new cdk8s_1.ApiObject(this.chart, spec.name, {
-            apiVersion: 'storage.k8s.io/v1',
+        const sc = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.STORAGE_API_VERSION,
             kind: 'StorageClass',
             metadata: {
                 name: spec.name,
@@ -670,7 +664,7 @@ class Rutter {
         if (Object.keys(volumeAttributes).length > 0) {
             csiSpec['volumeAttributes'] = volumeAttributes;
         }
-        const pv = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pv = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolume',
             metadata: {
@@ -692,7 +686,7 @@ class Rutter {
         return pv;
     }
     addAWSEFSPersistentVolumeClaim(spec) {
-        const pvc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const pvc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'PersistentVolumeClaim',
             metadata: {
@@ -715,8 +709,8 @@ class Rutter {
     }
     addAWSALBIngress(spec) {
         const annotations = this.buildALBAnnotations(spec);
-        const ingress = new cdk8s_1.ApiObject(this.chart, spec.name, {
-            apiVersion: 'networking.k8s.io/v1',
+        const ingress = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
             kind: 'Ingress',
             metadata: {
                 name: spec.name,
@@ -794,12 +788,165 @@ class Rutter {
     }
     addTagsAnnotation(annotations, spec) {
         if (spec.tags && Object.keys(spec.tags).length > 0) {
-            const tagString = Object.entries(spec.tags)
-                .map(([key, value]) => `${key}=${value}`)
-                .join(',');
+            const tagString = this.formatCloudResourceTags(spec.tags);
             annotations['alb.ingress.kubernetes.io/tags'] = tagString;
         }
     }
+    /**
+     * Add Azure Application Gateway Ingress Controller (AGIC) Ingress.
+     * Creates an Ingress resource with AGIC-specific annotations for AKS deployments.
+     *
+     * @param spec - AGIC Ingress specification
+     * @returns The created Ingress ApiObject
+     *
+     * @example
+     * ```typescript
+     * rutter.addAzureAGICIngress({
+     *   name: 'app-ingress',
+     *   rules: [{
+     *     host: 'app.example.com',
+     *     paths: [{
+     *       path: '/',
+     *       pathType: 'Prefix',
+     *       backend: { service: { name: 'app-service', port: { number: 80 } } }
+     *     }]
+     *   }],
+     *   sslRedirect: true,
+     *   backendProtocol: 'https',
+     *   healthProbePath: '/health'
+     * });
+     * ```
+     */
+    addAzureAGICIngress(spec) {
+        this.validateAGICHealthProbeParams(spec);
+        this.validateAGICSecurityParams(spec);
+        this.validateAGICAnnotationConsistency(spec);
+        const annotations = this.buildAGICAnnotations(spec);
+        const ingress = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
+            kind: 'Ingress',
+            metadata: {
+                name: spec.name,
+                annotations,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+            },
+            spec: {
+                tls: spec.tls,
+                rules: spec.rules.map((rule) => ({
+                    host: rule.host,
+                    http: {
+                        paths: rule.paths.map((path) => ({
+                            path: path.path,
+                            pathType: path.pathType,
+                            backend: path.backend,
+                        })),
+                    },
+                })),
+            },
+        });
+        this.capture(ingress, `${spec.name}-ingress`);
+        return ingress;
+    }
+    buildAGICAnnotations(spec) {
+        const annotations = {
+            'kubernetes.io/ingress.class': 'azure/application-gateway',
+            ...(spec.annotations ?? {}),
+        };
+        this.addAGICPathAnnotations(annotations, spec);
+        this.addAGICProtocolAnnotations(annotations, spec);
+        this.addAGICHealthProbeAnnotations(annotations, spec);
+        this.addAGICConnectionAnnotations(annotations, spec);
+        this.addAGICSecurityAnnotations(annotations, spec);
+        this.addAGICAdvancedAnnotations(annotations, spec);
+        return annotations;
+    }
+    addAGICPathAnnotations(annotations, spec) {
+        if (spec.backendPathPrefix) {
+            annotations['appgw.ingress.kubernetes.io/backend-path-prefix'] = spec.backendPathPrefix;
+        }
+        if (spec.backendHostname) {
+            annotations['appgw.ingress.kubernetes.io/backend-hostname'] = spec.backendHostname;
+        }
+    }
+    addAGICProtocolAnnotations(annotations, spec) {
+        if (spec.backendProtocol) {
+            annotations['appgw.ingress.kubernetes.io/backend-protocol'] = spec.backendProtocol;
+        }
+        if (spec.sslRedirect) {
+            annotations['appgw.ingress.kubernetes.io/ssl-redirect'] = 'true';
+        }
+        if (spec.usePrivateIp) {
+            annotations['appgw.ingress.kubernetes.io/use-private-ip'] = 'true';
+        }
+        if (spec.overrideFrontendPort !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/override-frontend-port'] = String(spec.overrideFrontendPort);
+        }
+    }
+    addAGICHealthProbeAnnotations(annotations, spec) {
+        if (spec.healthProbeHostname) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-hostname'] = spec.healthProbeHostname;
+        }
+        if (spec.healthProbePort !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-port'] = String(spec.healthProbePort);
+        }
+        if (spec.healthProbePath) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-path'] = spec.healthProbePath;
+        }
+        if (spec.healthProbeStatusCodes) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-status-codes'] =
+                spec.healthProbeStatusCodes;
+        }
+        if (spec.healthProbeInterval !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-interval'] = String(spec.healthProbeInterval);
+        }
+        if (spec.healthProbeTimeout !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-timeout'] = String(spec.healthProbeTimeout);
+        }
+        if (spec.healthProbeUnhealthyThreshold !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-unhealthy-threshold'] = String(spec.healthProbeUnhealthyThreshold);
+        }
+    }
+    addAGICConnectionAnnotations(annotations, spec) {
+        if (spec.cookieBasedAffinity) {
+            annotations['appgw.ingress.kubernetes.io/cookie-based-affinity'] = 'true';
+        }
+        if (spec.requestTimeout !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/request-timeout'] = String(spec.requestTimeout);
+        }
+        if (spec.connectionDraining) {
+            annotations['appgw.ingress.kubernetes.io/connection-draining'] = 'true';
+        }
+        if (spec.connectionDrainingTimeout !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/connection-draining-timeout'] = String(spec.connectionDrainingTimeout);
+        }
+    }
+    addAGICSecurityAnnotations(annotations, spec) {
+        if (spec.appgwSslCertificate) {
+            annotations['appgw.ingress.kubernetes.io/appgw-ssl-certificate'] = spec.appgwSslCertificate;
+        }
+        if (spec.appgwSslProfile) {
+            annotations['appgw.ingress.kubernetes.io/appgw-ssl-profile'] = spec.appgwSslProfile;
+        }
+        if (spec.appgwTrustedRootCertificate && spec.appgwTrustedRootCertificate.length > 0) {
+            annotations['appgw.ingress.kubernetes.io/appgw-trusted-root-certificate'] =
+                spec.appgwTrustedRootCertificate.join(',');
+        }
+        if (spec.wafPolicyForPath) {
+            annotations['appgw.ingress.kubernetes.io/waf-policy-for-path'] = spec.wafPolicyForPath;
+        }
+    }
+    addAGICAdvancedAnnotations(annotations, spec) {
+        if (spec.hostnameExtension && spec.hostnameExtension.length > 0) {
+            annotations['appgw.ingress.kubernetes.io/hostname-extension'] =
+                spec.hostnameExtension.join(', ');
+        }
+        if (spec.rewriteRuleSet) {
+            annotations['appgw.ingress.kubernetes.io/rewrite-rule-set'] = spec.rewriteRuleSet;
+        }
+        if (spec.rulePriority !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/rule-priority'] = String(spec.rulePriority);
+        }
+    }
     addAWSIRSAServiceAccount(spec) {
         const annotations = {
             'eks.amazonaws.com/role-arn': spec.roleArn,
@@ -812,7 +959,7 @@ class Rutter {
                 : {}),
             ...(spec.annotations ?? {}),
         };
-        const sa = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const sa = new ApiObject(this.chart, spec.name, {
             apiVersion: 'v1',
             kind: 'ServiceAccount',
             metadata: {
@@ -841,14 +988,14 @@ class Rutter {
             }
             return baseObj;
         });
-        const objectsYaml = yaml_1.default.stringify(objects, { indent: 2 }).trim();
+        const objectsYaml = YAML.stringify(objects, { indent: 2 }).trim();
         const parameters = {
             objects: `|\n  ${objectsYaml.split('\n').join('\n  ')}`,
         };
         if (spec.region) {
             parameters['region'] = spec.region;
         }
-        const spc = new cdk8s_1.ApiObject(this.chart, spec.name, {
+        const spc = new ApiObject(this.chart, spec.name, {
             apiVersion: 'secrets-store.csi.x-k8s.io/v1',
             kind: 'SecretProviderClass',
             metadata: {
@@ -864,6 +1011,386 @@ class Rutter {
         this.capture(spc, `${spec.name}-secretproviderclass`);
         return spc;
     }
+    addAzureDiskStorageClass(spec) {
+        // Validate numeric parameters to prevent runtime errors
+        this.validateAzureDiskNumericParameters(spec);
+        const parameters = this.buildAzureDiskParameters(spec);
+        const sc = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.STORAGE_API_VERSION,
+            kind: 'StorageClass',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            provisioner: Rutter.AZURE_DISK_CSI_DRIVER,
+            parameters,
+            reclaimPolicy: spec.reclaimPolicy ?? 'Delete',
+            allowVolumeExpansion: spec.allowVolumeExpansion ?? true,
+            volumeBindingMode: spec.volumeBindingMode ?? 'WaitForFirstConsumer',
+        });
+        this.capture(sc, `${spec.name}-storageclass`);
+        return sc;
+    }
+    buildAzureDiskParameters(spec) {
+        const parameters = {
+            skuName: spec.skuName ?? 'StandardSSD_LRS',
+            fsType: spec.fsType ?? 'ext4',
+            // Security best practices: default to private network access and encryption
+            networkAccessPolicy: spec.networkAccessPolicy ?? 'AllowPrivate',
+        };
+        this.addOptionalAzureDiskParameters(parameters, spec);
+        this.addAzureDiskEncryptionParameters(parameters, spec);
+        this.addAzureDiskPerformanceParameters(parameters, spec);
+        return parameters;
+    }
+    addOptionalAzureDiskParameters(parameters, spec) {
+        if (spec.cachingMode) {
+            parameters['cachingMode'] = spec.cachingMode;
+        }
+        if (spec.resourceGroup) {
+            parameters['resourceGroup'] = spec.resourceGroup;
+        }
+        if (spec.logicalSectorSize !== undefined) {
+            parameters['LogicalSectorSize'] = String(spec.logicalSectorSize);
+        }
+        if (spec.tags && Object.keys(spec.tags).length > 0) {
+            const tagString = this.formatCloudResourceTags(spec.tags);
+            parameters['tags'] = tagString;
+        }
+        // networkAccessPolicy is now set as default in buildAzureDiskParameters
+        if (spec.networkAccessPolicy && spec.networkAccessPolicy !== 'AllowPrivate') {
+            parameters['networkAccessPolicy'] = spec.networkAccessPolicy;
+        }
+        if (spec.diskAccessID) {
+            parameters['diskAccessID'] = spec.diskAccessID;
+        }
+        if (spec.maxShares !== undefined) {
+            parameters['maxShares'] = String(spec.maxShares);
+        }
+    }
+    addAzureDiskEncryptionParameters(parameters, spec) {
+        if (spec.diskEncryptionSetID) {
+            parameters['diskEncryptionSetID'] = spec.diskEncryptionSetID;
+        }
+        if (spec.diskEncryptionType) {
+            parameters['diskEncryptionType'] = spec.diskEncryptionType;
+        }
+    }
+    addAzureDiskPerformanceParameters(parameters, spec) {
+        if (spec.diskIOPSReadWrite !== undefined) {
+            parameters['DiskIOPSReadWrite'] = String(spec.diskIOPSReadWrite);
+        }
+        if (spec.diskMBpsReadWrite !== undefined) {
+            parameters['DiskMBpsReadWrite'] = String(spec.diskMBpsReadWrite);
+        }
+        if (spec.writeAcceleratorEnabled !== undefined) {
+            parameters['writeAcceleratorEnabled'] = String(spec.writeAcceleratorEnabled);
+        }
+        if (spec.enableBursting !== undefined) {
+            parameters['enableBursting'] = String(spec.enableBursting);
+        }
+    }
+    validateAzureDiskNumericParameters(spec) {
+        this.validateAzureDiskIOPS(spec);
+        this.validateAzureDiskThroughput(spec);
+        this.validateAzureDiskShares(spec);
+        this.validateAzureDiskSectorSize(spec);
+    }
+    validateAzureDiskIOPS(spec) {
+        if (spec.diskIOPSReadWrite === undefined)
+            return;
+        if (spec.diskIOPSReadWrite < 100) {
+            throw new Error(`Azure Disk ${spec.name}: diskIOPSReadWrite must be at least 100 IOPS`);
+        }
+        if (spec.diskIOPSReadWrite > 400000) {
+            throw new Error(`Azure Disk ${spec.name}: diskIOPSReadWrite cannot exceed 400,000 IOPS`);
+        }
+    }
+    validateAzureDiskThroughput(spec) {
+        if (spec.diskMBpsReadWrite === undefined)
+            return;
+        if (spec.diskMBpsReadWrite < 1) {
+            throw new Error(`Azure Disk ${spec.name}: diskMBpsReadWrite must be at least 1 MB/s`);
+        }
+        if (spec.diskMBpsReadWrite > 10000) {
+            throw new Error(`Azure Disk ${spec.name}: diskMBpsReadWrite cannot exceed 10,000 MB/s`);
+        }
+    }
+    validateAzureDiskShares(spec) {
+        if (spec.maxShares === undefined)
+            return;
+        if (spec.maxShares < 1) {
+            throw new Error(`Azure Disk ${spec.name}: maxShares must be at least 1`);
+        }
+        if (spec.maxShares > 5) {
+            throw new Error(`Azure Disk ${spec.name}: maxShares cannot exceed 5`);
+        }
+    }
+    validateAzureDiskSectorSize(spec) {
+        if (spec.logicalSectorSize === undefined)
+            return;
+        if (spec.logicalSectorSize !== 512 && spec.logicalSectorSize !== 4096) {
+            throw new Error(`Azure Disk ${spec.name}: logicalSectorSize must be either 512 or 4096 bytes`);
+        }
+    }
+    /**
+     * Format cloud resource tags for provider-specific string format.
+     * Provides basic validation and consistent formatting across cloud providers.
+     */
+    formatCloudResourceTags(tags) {
+        this.validateCloudResourceTags(tags);
+        return Object.entries(tags)
+            .map(([key, value]) => `${key}=${value}`)
+            .join(',');
+    }
+    /**
+     * Validate cloud resource tags with basic rules.
+     * Each cloud provider has specific validation, but these are common basics.
+     */
+    validateCloudResourceTags(tags) {
+        for (const [key, value] of Object.entries(tags)) {
+            if (!key || key.trim() === '') {
+                throw new Error('Tag key cannot be empty');
+            }
+            if (value === undefined || value === null) {
+                throw new Error(`Tag value for key '${key}' cannot be null or undefined`);
+            }
+        }
+    }
+    addNetworkPolicy(spec) {
+        // Validate policy types
+        this.validateNetworkPolicyTypes(spec);
+        // Validate CIDR blocks if present
+        this.validateNetworkPolicyCIDRs(spec);
+        const np = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
+            kind: 'NetworkPolicy',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                podSelector: spec.podSelector ?? {},
+                policyTypes: spec.policyTypes,
+                ...(spec.ingress ? { ingress: spec.ingress } : {}),
+                ...(spec.egress ? { egress: spec.egress } : {}),
+            },
+        });
+        this.capture(np, `${spec.name}-networkpolicy`);
+        return np;
+    }
+    /**
+     * Create a deny-all ingress NetworkPolicy for the current namespace
+     */
+    addDenyAllIngressNetworkPolicy(name = 'deny-all-ingress') {
+        return this.addNetworkPolicy({
+            name,
+            podSelector: Rutter.EMPTY_POD_SELECTOR,
+            policyTypes: ['Ingress'],
+        });
+    }
+    /**
+     * Create a deny-all egress NetworkPolicy for the current namespace
+     */
+    addDenyAllEgressNetworkPolicy(name = 'deny-all-egress') {
+        return this.addNetworkPolicy({
+            name,
+            podSelector: Rutter.EMPTY_POD_SELECTOR,
+            policyTypes: ['Egress'],
+        });
+    }
+    /**
+     * Create a deny-all NetworkPolicy for both ingress and egress
+     */
+    addDenyAllNetworkPolicy(name = 'deny-all') {
+        return this.addNetworkPolicy({
+            name,
+            podSelector: Rutter.EMPTY_POD_SELECTOR,
+            policyTypes: ['Ingress', 'Egress'],
+        });
+    }
+    /**
+     * Allow traffic from specific pods to target pods on specific ports
+     */
+    addAllowFromPodsNetworkPolicy(spec) {
+        return this.addNetworkPolicy({
+            name: spec.name,
+            podSelector: { matchLabels: spec.targetPodSelector },
+            policyTypes: ['Ingress'],
+            ingress: [
+                {
+                    from: [{ podSelector: { matchLabels: spec.sourcePodSelector } }],
+                    ...(spec.ports ? { ports: spec.ports } : {}),
+                },
+            ],
+            ...(spec.labels ? { labels: spec.labels } : {}),
+            ...(spec.annotations ? { annotations: spec.annotations } : {}),
+        });
+    }
+    /**
+     * Allow traffic from specific namespace to target pods
+     */
+    addAllowFromNamespaceNetworkPolicy(spec) {
+        return this.addNetworkPolicy({
+            name: spec.name,
+            podSelector: { matchLabels: spec.targetPodSelector },
+            policyTypes: ['Ingress'],
+            ingress: [
+                {
+                    from: [{ namespaceSelector: { matchLabels: spec.sourceNamespaceSelector } }],
+                    ...(spec.ports ? { ports: spec.ports } : {}),
+                },
+            ],
+            ...(spec.labels ? { labels: spec.labels } : {}),
+            ...(spec.annotations ? { annotations: spec.annotations } : {}),
+        });
+    }
+    validateNetworkPolicyTypes(spec) {
+        if (!spec.policyTypes || spec.policyTypes.length === 0) {
+            throw new Error(`NetworkPolicy ${spec.name}: policyTypes must be specified`);
+        }
+        this.validatePolicyTypeValues(spec);
+        this.validatePolicyTypeRules(spec);
+    }
+    validatePolicyTypeValues(spec) {
+        const validTypes = ['Ingress', 'Egress'];
+        for (const type of spec.policyTypes) {
+            if (!validTypes.includes(type)) {
+                throw new Error(`NetworkPolicy ${spec.name}: invalid policyType '${type}', must be 'Ingress' or 'Egress'`);
+            }
+        }
+    }
+    validatePolicyTypeRules(spec) {
+        if (spec.policyTypes.includes('Ingress') && spec.ingress === undefined) {
+            console.warn(`NetworkPolicy ${spec.name}: policyType 'Ingress' specified but no ingress rules defined (will deny all ingress)`);
+        }
+        if (spec.policyTypes.includes('Egress') && spec.egress === undefined) {
+            console.warn(`NetworkPolicy ${spec.name}: policyType 'Egress' specified but no egress rules defined (will deny all egress)`);
+        }
+    }
+    validateNetworkPolicyCIDRs(spec) {
+        const validateCIDR = (cidr, context) => {
+            if (!this.isValidCIDR(cidr)) {
+                throw new Error(`NetworkPolicy ${spec.name}: invalid CIDR '${cidr}' in ${context}`);
+            }
+        };
+        this.validateIngressCIDRs(spec, validateCIDR);
+        this.validateEgressCIDRs(spec, validateCIDR);
+    }
+    isValidCIDR(cidr) {
+        // IPv4 CIDR validation
+        const ipv4Parts = cidr.split('/');
+        if (ipv4Parts.length === 2) {
+            const [ip, prefix] = ipv4Parts;
+            if (ip && prefix && this.isValidIPv4(ip) && this.isValidPrefix(prefix, 32)) {
+                return true;
+            }
+        }
+        // IPv6 CIDR validation (basic)
+        if (cidr.includes(':') && ipv4Parts.length === 2) {
+            const [, prefix] = ipv4Parts;
+            if (prefix) {
+                return this.isValidPrefix(prefix, 128);
+            }
+        }
+        return false;
+    }
+    isValidIPv4(ip) {
+        const parts = ip.split('.');
+        if (parts.length !== 4)
+            return false;
+        return parts.every((part) => {
+            const num = parseInt(part, 10);
+            return !isNaN(num) && num >= 0 && num <= 255 && String(num) === part;
+        });
+    }
+    isValidPrefix(prefix, maxPrefix) {
+        const num = parseInt(prefix, 10);
+        return !isNaN(num) && num >= 0 && num <= maxPrefix && String(num) === prefix;
+    }
+    validateIngressCIDRs(spec, validateCIDR) {
+        if (!spec.ingress)
+            return;
+        for (const rule of spec.ingress) {
+            if (rule.from) {
+                for (const peer of rule.from) {
+                    this.validatePeerCIDRs(peer, validateCIDR, 'ingress rule');
+                }
+            }
+        }
+    }
+    validateEgressCIDRs(spec, validateCIDR) {
+        if (!spec.egress)
+            return;
+        for (const rule of spec.egress) {
+            if (rule.to) {
+                for (const peer of rule.to) {
+                    this.validatePeerCIDRs(peer, validateCIDR, 'egress rule');
+                }
+            }
+        }
+    }
+    validatePeerCIDRs(peer, validateCIDR, context) {
+        if (peer.ipBlock?.cidr) {
+            validateCIDR(peer.ipBlock.cidr, context);
+            if (peer.ipBlock.except) {
+                for (const except of peer.ipBlock.except) {
+                    validateCIDR(except, `${context} except block`);
+                }
+            }
+        }
+    }
+    validateAGICHealthProbeParams(spec) {
+        if (spec.healthProbeInterval !== undefined &&
+            (spec.healthProbeInterval < 1 || spec.healthProbeInterval > 86400)) {
+            throw new Error('Health probe interval must be between 1 and 86400 seconds');
+        }
+        if (spec.healthProbeTimeout !== undefined &&
+            (spec.healthProbeTimeout < 1 || spec.healthProbeTimeout > 86400)) {
+            throw new Error('Health probe timeout must be between 1 and 86400 seconds');
+        }
+        if (spec.healthProbeUnhealthyThreshold !== undefined &&
+            (spec.healthProbeUnhealthyThreshold < 1 || spec.healthProbeUnhealthyThreshold > 20)) {
+            throw new Error('Health probe unhealthy threshold must be between 1 and 20');
+        }
+    }
+    validateAGICSecurityParams(spec) {
+        if (spec.wafPolicyForPath &&
+            !/^\/subscriptions\/[^/]+\/resourceGroups\/[^/]+\/providers\/Microsoft\.Network\/applicationGatewayWebApplicationFirewallPolicies\/[^/]+$/.test(spec.wafPolicyForPath)) {
+            throw new Error('Invalid WAF policy resource ID format');
+        }
+        if (spec.hostnameExtension?.some((hostname) => !this.isValidHostname(hostname))) {
+            throw new Error('Invalid hostname format in hostnameExtension');
+        }
+    }
+    isValidHostname(hostname) {
+        // Basic hostname validation without complex regex to prevent ReDoS
+        if (!hostname || hostname.length > 253)
+            return false;
+        if (hostname.startsWith('.') || hostname.endsWith('.'))
+            return false;
+        const labels = hostname.split('.');
+        return labels.every((label) => {
+            if (!label || label.length > 63)
+                return false;
+            if (label.startsWith('-') || label.endsWith('-'))
+                return false;
+            return /^[a-zA-Z0-9-]+$/.test(label);
+        });
+    }
+    validateAGICAnnotationConsistency(spec) {
+        if (spec.sslRedirect && !spec.appgwSslCertificate) {
+            throw new Error('SSL redirect requires an SSL certificate to be specified');
+        }
+        if (spec.backendProtocol === 'https' && !spec.appgwTrustedRootCertificate?.length) {
+            throw new Error('HTTPS backend protocol requires trusted root certificates');
+        }
+        if (spec.overrideFrontendPort === 443 && !spec.appgwSslCertificate) {
+            throw new Error('Port 443 requires an SSL certificate to be specified');
+        }
+    }
     /**
      * Capture the YAML of an ApiObject or Construct into assets.
      */
@@ -898,7 +1425,7 @@ class Rutter {
      */
     write(outDir) {
         // Use cdk8s Testing.synth to obtain manifest objects
-        const manifestObjs = cdk8s_1.Testing.synth(this.chart);
+        const manifestObjs = Testing.synth(this.chart);
         // Enforce common labels best-practice on all rendered objects
         const enriched = manifestObjs.map((obj) => {
             if (obj && typeof obj === 'object') {
@@ -908,11 +1435,11 @@ class Rutter {
                 const labels = o.metadata.labels;
                 const defaults = {
                     'helm.sh/chart': '{{ .Chart.Name }}-{{ .Chart.Version }}',
-                    'app.kubernetes.io/name': (0, helm_1.include)(Rutter.HELPER_NAME),
-                    'app.kubernetes.io/instance': helm_1.helm.releaseName,
-                    'app.kubernetes.io/version': helm_1.helm.chartVersion,
+                    'app.kubernetes.io/name': include(Rutter.HELPER_NAME),
+                    'app.kubernetes.io/instance': helm.releaseName,
+                    'app.kubernetes.io/version': helm.chartVersion,
                     'app.kubernetes.io/managed-by': '{{ .Release.Service }}',
-                    'app.kubernetes.io/part-of': helm_1.helm.chartName,
+                    'app.kubernetes.io/part-of': helm.chartName,
                 };
                 for (const [k, v] of Object.entries(defaults)) {
                     if (!(k in labels)) {
@@ -926,7 +1453,7 @@ class Rutter {
         if (this.props.singleManifestFile) {
             // Combine all resources into a single manifest file
             const combinedYaml = enriched
-                .map((obj) => yaml_1.default.stringify(obj).trim())
+                .map((obj) => YAML.stringify(obj).trim())
                 .filter(Boolean)
                 .join('\n---\n');
             this.assets.length = 0;
@@ -937,7 +1464,7 @@ class Rutter {
             // Create separate files for each resource (default behavior)
             this.assets.length = 0;
             enriched.forEach((obj, _index) => {
-                const yaml = yaml_1.default.stringify(obj).trim();
+                const yaml = YAML.stringify(obj).trim();
                 if (yaml) {
                     const resourceName = this.getResourceName(obj);
                     const manifestId = this.props.manifestName
@@ -994,11 +1521,15 @@ class Rutter {
             ...(this.props.notesTpl !== undefined ? { notesTpl: this.props.notesTpl } : {}),
             ...(this.props.valuesSchema !== undefined ? { valuesSchema: this.props.valuesSchema } : {}),
         };
-        HelmChartWriter_1.HelmChartWriter.write(options);
+        HelmChartWriter.write(options);
     }
 }
-exports.Rutter = Rutter;
 Rutter.LABEL_NAME = 'app.kubernetes.io/name';
 Rutter.LABEL_INSTANCE = 'app.kubernetes.io/instance';
 Rutter.HELPER_NAME = 'timonel.name';
+Rutter.NETWORKING_API_VERSION = 'networking.k8s.io/v1';
+Rutter.STORAGE_API_VERSION = 'storage.k8s.io/v1';
+Rutter.AZURE_DISK_CSI_DRIVER = 'disk.csi.azure.com';
+Rutter.AZURE_DISK_PROVISIONER_ANNOTATION = 'volume.beta.kubernetes.io/storage-provisioner';
+Rutter.EMPTY_POD_SELECTOR = {};
 //# sourceMappingURL=Rutter.js.map