timonel 1.0.0 → 2.1.0

package/dist/lib/Rutter.js

@@ -240,6 +240,50 @@ export class Rutter {
         this.capture(rs, `${spec.name}-replicaset`);
         return rs;
     }
+    addJob(spec) {
+        // Validate Job specification
+        this.validateJobSpec(spec);
+        const { envEntries, envFromEntries, volumeDefs, volumeMountDefs } = this.buildPodEnvironment(spec);
+        const jobSpec = this.buildJobSpec(spec);
+        const podTemplate = this.buildJobPodTemplate(spec, envEntries, envFromEntries, volumeDefs, volumeMountDefs);
+        const job = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'batch/v1',
+            kind: 'Job',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                ...jobSpec,
+                template: podTemplate,
+            },
+        });
+        this.capture(job, `${spec.name}-job`);
+        return job;
+    }
+    addCronJob(spec) {
+        // Validate CronJob specification
+        this.validateCronJobSpec(spec);
+        const { envEntries, envFromEntries, volumeDefs, volumeMountDefs } = this.buildPodEnvironment(spec);
+        const cronJobSpec = this.buildCronJobSpec(spec);
+        const jobTemplate = this.buildCronJobTemplate(spec, envEntries, envFromEntries, volumeDefs, volumeMountDefs);
+        const cronJob = new ApiObject(this.chart, spec.name, {
+            apiVersion: 'batch/v1',
+            kind: 'CronJob',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            spec: {
+                ...cronJobSpec,
+                jobTemplate,
+            },
+        });
+        this.capture(cronJob, `${spec.name}-cronjob`);
+        return cronJob;
+    }
     addIngress(spec) {
         const ing = new ApiObject(this.chart, spec.name, {
             apiVersion: Rutter.NETWORKING_API_VERSION,
@@ -348,10 +392,10 @@ export class Rutter {
         else if (spec.cloudProvider === 'azure') {
             optimized.annotations = {
                 ...optimized.annotations,
-                'volume.beta.kubernetes.io/storage-provisioner': 'disk.csi.azure.com',
+                [Rutter.AZURE_DISK_PROVISIONER_ANNOTATION]: Rutter.AZURE_DISK_CSI_DRIVER,
             };
             // Default to Premium_ZRS for multi-zone clusters
-            if (spec.source.csi?.driver === 'disk.csi.azure.com' && optimized.source.csi) {
+            if (spec.source.csi?.driver === Rutter.AZURE_DISK_CSI_DRIVER && optimized.source.csi) {
                 optimized.source.csi.volumeAttributes = {
                     skuName: 'Premium_ZRS',
                     ...spec.source.csi.volumeAttributes,
@@ -583,7 +627,7 @@ export class Rutter {
             parameters['throughput'] = String(spec.throughput);
         }
         const sc = new ApiObject(this.chart, spec.name, {
-            apiVersion: 'storage.k8s.io/v1',
+            apiVersion: Rutter.STORAGE_API_VERSION,
             kind: 'StorageClass',
             metadata: {
                 name: spec.name,
@@ -623,7 +667,7 @@ export class Rutter {
     }
     addAWSEFSStorageClass(spec) {
         const sc = new ApiObject(this.chart, spec.name, {
-            apiVersion: 'storage.k8s.io/v1',
+            apiVersion: Rutter.STORAGE_API_VERSION,
             kind: 'StorageClass',
             metadata: {
                 name: spec.name,
@@ -788,12 +832,165 @@ export class Rutter {
     }
     addTagsAnnotation(annotations, spec) {
         if (spec.tags && Object.keys(spec.tags).length > 0) {
-            const tagString = Object.entries(spec.tags)
-                .map(([key, value]) => `${key}=${value}`)
-                .join(',');
+            const tagString = this.formatCloudResourceTags(spec.tags);
             annotations['alb.ingress.kubernetes.io/tags'] = tagString;
         }
     }
+    /**
+     * Add Azure Application Gateway Ingress Controller (AGIC) Ingress.
+     * Creates an Ingress resource with AGIC-specific annotations for AKS deployments.
+     *
+     * @param spec - AGIC Ingress specification
+     * @returns The created Ingress ApiObject
+     *
+     * @example
+     * ```typescript
+     * rutter.addAzureAGICIngress({
+     *   name: 'app-ingress',
+     *   rules: [{
+     *     host: 'app.example.com',
+     *     paths: [{
+     *       path: '/',
+     *       pathType: 'Prefix',
+     *       backend: { service: { name: 'app-service', port: { number: 80 } } }
+     *     }]
+     *   }],
+     *   sslRedirect: true,
+     *   backendProtocol: 'https',
+     *   healthProbePath: '/health'
+     * });
+     * ```
+     */
+    addAzureAGICIngress(spec) {
+        this.validateAGICHealthProbeParams(spec);
+        this.validateAGICSecurityParams(spec);
+        this.validateAGICAnnotationConsistency(spec);
+        const annotations = this.buildAGICAnnotations(spec);
+        const ingress = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.NETWORKING_API_VERSION,
+            kind: 'Ingress',
+            metadata: {
+                name: spec.name,
+                annotations,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+            },
+            spec: {
+                tls: spec.tls,
+                rules: spec.rules.map((rule) => ({
+                    host: rule.host,
+                    http: {
+                        paths: rule.paths.map((path) => ({
+                            path: path.path,
+                            pathType: path.pathType,
+                            backend: path.backend,
+                        })),
+                    },
+                })),
+            },
+        });
+        this.capture(ingress, `${spec.name}-ingress`);
+        return ingress;
+    }
+    buildAGICAnnotations(spec) {
+        const annotations = {
+            'kubernetes.io/ingress.class': 'azure/application-gateway',
+            ...(spec.annotations ?? {}),
+        };
+        this.addAGICPathAnnotations(annotations, spec);
+        this.addAGICProtocolAnnotations(annotations, spec);
+        this.addAGICHealthProbeAnnotations(annotations, spec);
+        this.addAGICConnectionAnnotations(annotations, spec);
+        this.addAGICSecurityAnnotations(annotations, spec);
+        this.addAGICAdvancedAnnotations(annotations, spec);
+        return annotations;
+    }
+    addAGICPathAnnotations(annotations, spec) {
+        if (spec.backendPathPrefix) {
+            annotations['appgw.ingress.kubernetes.io/backend-path-prefix'] = spec.backendPathPrefix;
+        }
+        if (spec.backendHostname) {
+            annotations['appgw.ingress.kubernetes.io/backend-hostname'] = spec.backendHostname;
+        }
+    }
+    addAGICProtocolAnnotations(annotations, spec) {
+        if (spec.backendProtocol) {
+            annotations['appgw.ingress.kubernetes.io/backend-protocol'] = spec.backendProtocol;
+        }
+        if (spec.sslRedirect) {
+            annotations['appgw.ingress.kubernetes.io/ssl-redirect'] = 'true';
+        }
+        if (spec.usePrivateIp) {
+            annotations['appgw.ingress.kubernetes.io/use-private-ip'] = 'true';
+        }
+        if (spec.overrideFrontendPort !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/override-frontend-port'] = String(spec.overrideFrontendPort);
+        }
+    }
+    addAGICHealthProbeAnnotations(annotations, spec) {
+        if (spec.healthProbeHostname) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-hostname'] = spec.healthProbeHostname;
+        }
+        if (spec.healthProbePort !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-port'] = String(spec.healthProbePort);
+        }
+        if (spec.healthProbePath) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-path'] = spec.healthProbePath;
+        }
+        if (spec.healthProbeStatusCodes) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-status-codes'] =
+                spec.healthProbeStatusCodes;
+        }
+        if (spec.healthProbeInterval !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-interval'] = String(spec.healthProbeInterval);
+        }
+        if (spec.healthProbeTimeout !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-timeout'] = String(spec.healthProbeTimeout);
+        }
+        if (spec.healthProbeUnhealthyThreshold !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/health-probe-unhealthy-threshold'] = String(spec.healthProbeUnhealthyThreshold);
+        }
+    }
+    addAGICConnectionAnnotations(annotations, spec) {
+        if (spec.cookieBasedAffinity) {
+            annotations['appgw.ingress.kubernetes.io/cookie-based-affinity'] = 'true';
+        }
+        if (spec.requestTimeout !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/request-timeout'] = String(spec.requestTimeout);
+        }
+        if (spec.connectionDraining) {
+            annotations['appgw.ingress.kubernetes.io/connection-draining'] = 'true';
+        }
+        if (spec.connectionDrainingTimeout !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/connection-draining-timeout'] = String(spec.connectionDrainingTimeout);
+        }
+    }
+    addAGICSecurityAnnotations(annotations, spec) {
+        if (spec.appgwSslCertificate) {
+            annotations['appgw.ingress.kubernetes.io/appgw-ssl-certificate'] = spec.appgwSslCertificate;
+        }
+        if (spec.appgwSslProfile) {
+            annotations['appgw.ingress.kubernetes.io/appgw-ssl-profile'] = spec.appgwSslProfile;
+        }
+        if (spec.appgwTrustedRootCertificate && spec.appgwTrustedRootCertificate.length > 0) {
+            annotations['appgw.ingress.kubernetes.io/appgw-trusted-root-certificate'] =
+                spec.appgwTrustedRootCertificate.join(',');
+        }
+        if (spec.wafPolicyForPath) {
+            annotations['appgw.ingress.kubernetes.io/waf-policy-for-path'] = spec.wafPolicyForPath;
+        }
+    }
+    addAGICAdvancedAnnotations(annotations, spec) {
+        if (spec.hostnameExtension && spec.hostnameExtension.length > 0) {
+            annotations['appgw.ingress.kubernetes.io/hostname-extension'] =
+                spec.hostnameExtension.join(', ');
+        }
+        if (spec.rewriteRuleSet) {
+            annotations['appgw.ingress.kubernetes.io/rewrite-rule-set'] = spec.rewriteRuleSet;
+        }
+        if (spec.rulePriority !== undefined) {
+            annotations['appgw.ingress.kubernetes.io/rule-priority'] = String(spec.rulePriority);
+        }
+    }
     addAWSIRSAServiceAccount(spec) {
         const annotations = {
             'eks.amazonaws.com/role-arn': spec.roleArn,
@@ -858,6 +1055,153 @@ export class Rutter {
         this.capture(spc, `${spec.name}-secretproviderclass`);
         return spc;
     }
+    addAzureDiskStorageClass(spec) {
+        // Validate numeric parameters to prevent runtime errors
+        this.validateAzureDiskNumericParameters(spec);
+        const parameters = this.buildAzureDiskParameters(spec);
+        const sc = new ApiObject(this.chart, spec.name, {
+            apiVersion: Rutter.STORAGE_API_VERSION,
+            kind: 'StorageClass',
+            metadata: {
+                name: spec.name,
+                ...(spec.labels ? { labels: spec.labels } : {}),
+                ...(spec.annotations ? { annotations: spec.annotations } : {}),
+            },
+            provisioner: Rutter.AZURE_DISK_CSI_DRIVER,
+            parameters,
+            reclaimPolicy: spec.reclaimPolicy ?? 'Delete',
+            allowVolumeExpansion: spec.allowVolumeExpansion ?? true,
+            volumeBindingMode: spec.volumeBindingMode ?? 'WaitForFirstConsumer',
+        });
+        this.capture(sc, `${spec.name}-storageclass`);
+        return sc;
+    }
+    buildAzureDiskParameters(spec) {
+        const parameters = {
+            skuName: spec.skuName ?? 'StandardSSD_LRS',
+            fsType: spec.fsType ?? 'ext4',
+            // Security best practices: default to private network access and encryption
+            networkAccessPolicy: spec.networkAccessPolicy ?? 'AllowPrivate',
+        };
+        this.addOptionalAzureDiskParameters(parameters, spec);
+        this.addAzureDiskEncryptionParameters(parameters, spec);
+        this.addAzureDiskPerformanceParameters(parameters, spec);
+        return parameters;
+    }
+    addOptionalAzureDiskParameters(parameters, spec) {
+        if (spec.cachingMode) {
+            parameters['cachingMode'] = spec.cachingMode;
+        }
+        if (spec.resourceGroup) {
+            parameters['resourceGroup'] = spec.resourceGroup;
+        }
+        if (spec.logicalSectorSize !== undefined) {
+            parameters['LogicalSectorSize'] = String(spec.logicalSectorSize);
+        }
+        if (spec.tags && Object.keys(spec.tags).length > 0) {
+            const tagString = this.formatCloudResourceTags(spec.tags);
+            parameters['tags'] = tagString;
+        }
+        // networkAccessPolicy is now set as default in buildAzureDiskParameters
+        if (spec.networkAccessPolicy && spec.networkAccessPolicy !== 'AllowPrivate') {
+            parameters['networkAccessPolicy'] = spec.networkAccessPolicy;
+        }
+        if (spec.diskAccessID) {
+            parameters['diskAccessID'] = spec.diskAccessID;
+        }
+        if (spec.maxShares !== undefined) {
+            parameters['maxShares'] = String(spec.maxShares);
+        }
+    }
+    addAzureDiskEncryptionParameters(parameters, spec) {
+        if (spec.diskEncryptionSetID) {
+            parameters['diskEncryptionSetID'] = spec.diskEncryptionSetID;
+        }
+        if (spec.diskEncryptionType) {
+            parameters['diskEncryptionType'] = spec.diskEncryptionType;
+        }
+    }
+    addAzureDiskPerformanceParameters(parameters, spec) {
+        if (spec.diskIOPSReadWrite !== undefined) {
+            parameters['DiskIOPSReadWrite'] = String(spec.diskIOPSReadWrite);
+        }
+        if (spec.diskMBpsReadWrite !== undefined) {
+            parameters['DiskMBpsReadWrite'] = String(spec.diskMBpsReadWrite);
+        }
+        if (spec.writeAcceleratorEnabled !== undefined) {
+            parameters['writeAcceleratorEnabled'] = String(spec.writeAcceleratorEnabled);
+        }
+        if (spec.enableBursting !== undefined) {
+            parameters['enableBursting'] = String(spec.enableBursting);
+        }
+    }
+    validateAzureDiskNumericParameters(spec) {
+        this.validateAzureDiskIOPS(spec);
+        this.validateAzureDiskThroughput(spec);
+        this.validateAzureDiskShares(spec);
+        this.validateAzureDiskSectorSize(spec);
+    }
+    validateAzureDiskIOPS(spec) {
+        if (spec.diskIOPSReadWrite === undefined)
+            return;
+        if (spec.diskIOPSReadWrite < 100) {
+            throw new Error(`Azure Disk ${spec.name}: diskIOPSReadWrite must be at least 100 IOPS`);
+        }
+        if (spec.diskIOPSReadWrite > 400000) {
+            throw new Error(`Azure Disk ${spec.name}: diskIOPSReadWrite cannot exceed 400,000 IOPS`);
+        }
+    }
+    validateAzureDiskThroughput(spec) {
+        if (spec.diskMBpsReadWrite === undefined)
+            return;
+        if (spec.diskMBpsReadWrite < 1) {
+            throw new Error(`Azure Disk ${spec.name}: diskMBpsReadWrite must be at least 1 MB/s`);
+        }
+        if (spec.diskMBpsReadWrite > 10000) {
+            throw new Error(`Azure Disk ${spec.name}: diskMBpsReadWrite cannot exceed 10,000 MB/s`);
+        }
+    }
+    validateAzureDiskShares(spec) {
+        if (spec.maxShares === undefined)
+            return;
+        if (spec.maxShares < 1) {
+            throw new Error(`Azure Disk ${spec.name}: maxShares must be at least 1`);
+        }
+        if (spec.maxShares > 5) {
+            throw new Error(`Azure Disk ${spec.name}: maxShares cannot exceed 5`);
+        }
+    }
+    validateAzureDiskSectorSize(spec) {
+        if (spec.logicalSectorSize === undefined)
+            return;
+        if (spec.logicalSectorSize !== 512 && spec.logicalSectorSize !== 4096) {
+            throw new Error(`Azure Disk ${spec.name}: logicalSectorSize must be either 512 or 4096 bytes`);
+        }
+    }
+    /**
+     * Format cloud resource tags for provider-specific string format.
+     * Provides basic validation and consistent formatting across cloud providers.
+     */
+    formatCloudResourceTags(tags) {
+        this.validateCloudResourceTags(tags);
+        return Object.entries(tags)
+            .map(([key, value]) => `${key}=${value}`)
+            .join(',');
+    }
+    /**
+     * Validate cloud resource tags with basic rules.
+     * Each cloud provider has specific validation, but these are common basics.
+     */
+    validateCloudResourceTags(tags) {
+        for (const [key, value] of Object.entries(tags)) {
+            if (!key || key.trim() === '') {
+                throw new Error('Tag key cannot be empty');
+            }
+            if (value === undefined || value === null) {
+                throw new Error(`Tag value for key '${key}' cannot be null or undefined`);
+            }
+        }
+    }
     addNetworkPolicy(spec) {
         // Validate policy types
         this.validateNetworkPolicyTypes(spec);
@@ -1042,6 +1386,261 @@ export class Rutter {
             }
         }
     }
+    validateAGICHealthProbeParams(spec) {
+        if (spec.healthProbeInterval !== undefined &&
+            (spec.healthProbeInterval < 1 || spec.healthProbeInterval > 86400)) {
+            throw new Error('Health probe interval must be between 1 and 86400 seconds');
+        }
+        if (spec.healthProbeTimeout !== undefined &&
+            (spec.healthProbeTimeout < 1 || spec.healthProbeTimeout > 86400)) {
+            throw new Error('Health probe timeout must be between 1 and 86400 seconds');
+        }
+        if (spec.healthProbeUnhealthyThreshold !== undefined &&
+            (spec.healthProbeUnhealthyThreshold < 1 || spec.healthProbeUnhealthyThreshold > 20)) {
+            throw new Error('Health probe unhealthy threshold must be between 1 and 20');
+        }
+    }
+    validateAGICSecurityParams(spec) {
+        if (spec.wafPolicyForPath &&
+            !/^\/subscriptions\/[^/]+\/resourceGroups\/[^/]+\/providers\/Microsoft\.Network\/applicationGatewayWebApplicationFirewallPolicies\/[^/]+$/.test(spec.wafPolicyForPath)) {
+            throw new Error('Invalid WAF policy resource ID format');
+        }
+        if (spec.hostnameExtension?.some((hostname) => !this.isValidHostname(hostname))) {
+            throw new Error('Invalid hostname format in hostnameExtension');
+        }
+    }
+    isValidHostname(hostname) {
+        // Basic hostname validation without complex regex to prevent ReDoS
+        if (!hostname || hostname.length > 253)
+            return false;
+        if (hostname.startsWith('.') || hostname.endsWith('.'))
+            return false;
+        const labels = hostname.split('.');
+        return labels.every((label) => {
+            if (!label || label.length > 63)
+                return false;
+            if (label.startsWith('-') || label.endsWith('-'))
+                return false;
+            return /^[a-zA-Z0-9-]+$/.test(label);
+        });
+    }
+    validateAGICAnnotationConsistency(spec) {
+        if (spec.sslRedirect && !spec.appgwSslCertificate) {
+            throw new Error('SSL redirect requires an SSL certificate to be specified');
+        }
+        if (spec.backendProtocol === 'https' && !spec.appgwTrustedRootCertificate?.length) {
+            throw new Error('HTTPS backend protocol requires trusted root certificates');
+        }
+        if (spec.overrideFrontendPort === 443 && !spec.appgwSslCertificate) {
+            throw new Error('Port 443 requires an SSL certificate to be specified');
+        }
+    }
+    buildPodEnvironment(spec) {
+        const envEntries = spec.env
+            ? Object.entries(spec.env).map(([name, value]) => this.sanitizeEnvVar(name, value))
+            : undefined;
+        const envFromEntries = spec.envFrom
+            ? spec.envFrom
+                .map((s) => {
+                const entry = {};
+                if (s.configMapRef) {
+                    entry.configMapRef = { name: s.configMapRef };
+                }
+                if (s.secretRef) {
+                    entry.secretRef = { name: s.secretRef };
+                }
+                return entry;
+            })
+                .filter((entry) => entry.configMapRef || entry.secretRef)
+            : undefined;
+        const volumeDefs = spec.volumes
+            ? spec.volumes.map((v) => ({
+                name: v.name,
+                configMap: v.configMap ? { name: v.configMap } : undefined,
+                secret: v.secret ? { secretName: v.secret } : undefined,
+                persistentVolumeClaim: v.persistentVolumeClaim
+                    ? { claimName: v.persistentVolumeClaim }
+                    : undefined,
+            }))
+            : undefined;
+        const volumeMountDefs = spec.volumeMounts
+            ? spec.volumeMounts.map((m) => ({
+                name: m.name,
+                mountPath: m.mountPath,
+                readOnly: m.readOnly,
+                subPath: m.subPath,
+            }))
+            : undefined;
+        return { envEntries, envFromEntries, volumeDefs, volumeMountDefs };
+    }
+    buildJobSpec(spec) {
+        return {
+            ...(spec.backoffLimit !== undefined ? { backoffLimit: spec.backoffLimit } : {}),
+            ...(spec.activeDeadlineSeconds !== undefined
+                ? { activeDeadlineSeconds: spec.activeDeadlineSeconds }
+                : {}),
+            ...(spec.ttlSecondsAfterFinished !== undefined
+                ? { ttlSecondsAfterFinished: spec.ttlSecondsAfterFinished }
+                : {}),
+            ...(spec.completions !== undefined ? { completions: spec.completions } : {}),
+            ...(spec.parallelism !== undefined ? { parallelism: spec.parallelism } : {}),
+            ...(spec.completionMode !== undefined ? { completionMode: spec.completionMode } : {}),
+            ...(spec.suspend !== undefined ? { suspend: spec.suspend } : {}),
+        };
+    }
+    buildJobPodTemplate(spec, envEntries, envFromEntries, volumeDefs, volumeMountDefs) {
+        return {
+            metadata: {
+                ...(spec.podLabels ? { labels: spec.podLabels } : {}),
+                ...(spec.podAnnotations ? { annotations: spec.podAnnotations } : {}),
+            },
+            spec: {
+                restartPolicy: spec.restartPolicy ?? 'Never',
+                serviceAccountName: spec.serviceAccountName,
+                volumes: volumeDefs,
+                containers: [
+                    {
+                        name: spec.name,
+                        image: spec.image,
+                        imagePullPolicy: spec.imagePullPolicy,
+                        ...(spec.command ? { command: spec.command } : {}),
+                        ...(spec.args ? { args: spec.args } : {}),
+                        env: envEntries,
+                        envFrom: envFromEntries,
+                        volumeMounts: volumeMountDefs,
+                        resources: spec.resources ?? this.getDefaultResources(),
+                    },
+                ],
+            },
+        };
+    }
+    buildCronJobSpec(spec) {
+        return {
+            schedule: spec.schedule,
+            ...(spec.startingDeadlineSeconds !== undefined
+                ? { startingDeadlineSeconds: spec.startingDeadlineSeconds }
+                : {}),
+            ...(spec.concurrencyPolicy !== undefined
+                ? { concurrencyPolicy: spec.concurrencyPolicy }
+                : {}),
+            ...(spec.suspend !== undefined ? { suspend: spec.suspend } : {}),
+            ...(spec.successfulJobsHistoryLimit !== undefined
+                ? { successfulJobsHistoryLimit: spec.successfulJobsHistoryLimit }
+                : {}),
+            ...(spec.failedJobsHistoryLimit !== undefined
+                ? { failedJobsHistoryLimit: spec.failedJobsHistoryLimit }
+                : {}),
+            ...(spec.timeZone !== undefined ? { timeZone: spec.timeZone } : {}),
+        };
+    }
+    buildCronJobTemplate(spec, envEntries, envFromEntries, volumeDefs, volumeMountDefs) {
+        return {
+            spec: {
+                ...(spec.backoffLimit !== undefined ? { backoffLimit: spec.backoffLimit } : {}),
+                ...(spec.activeDeadlineSeconds !== undefined
+                    ? { activeDeadlineSeconds: spec.activeDeadlineSeconds }
+                    : {}),
+                ...(spec.ttlSecondsAfterFinished !== undefined
+                    ? { ttlSecondsAfterFinished: spec.ttlSecondsAfterFinished }
+                    : {}),
+                ...(spec.completions !== undefined ? { completions: spec.completions } : {}),
+                ...(spec.parallelism !== undefined ? { parallelism: spec.parallelism } : {}),
+                ...(spec.completionMode !== undefined ? { completionMode: spec.completionMode } : {}),
+                template: {
+                    metadata: {
+                        ...(spec.podLabels ? { labels: spec.podLabels } : {}),
+                        ...(spec.podAnnotations ? { annotations: spec.podAnnotations } : {}),
+                    },
+                    spec: {
+                        restartPolicy: spec.restartPolicy ?? 'Never',
+                        serviceAccountName: spec.serviceAccountName,
+                        volumes: volumeDefs,
+                        containers: [
+                            {
+                                name: spec.name,
+                                image: spec.image,
+                                imagePullPolicy: spec.imagePullPolicy,
+                                ...(spec.command ? { command: spec.command } : {}),
+                                ...(spec.args ? { args: spec.args } : {}),
+                                env: envEntries,
+                                envFrom: envFromEntries,
+                                volumeMounts: volumeMountDefs,
+                                resources: spec.resources ?? this.getDefaultResources(),
+                            },
+                        ],
+                    },
+                },
+            },
+        };
+    }
+    /**
+     * Validate Job specification for security and best practices
+     */
+    validateJobSpec(spec) {
+        if (spec.activeDeadlineSeconds !== undefined && spec.activeDeadlineSeconds <= 0) {
+            throw new Error('activeDeadlineSeconds must be a positive integer');
+        }
+        if (spec.ttlSecondsAfterFinished !== undefined && spec.ttlSecondsAfterFinished < 0) {
+            throw new Error('ttlSecondsAfterFinished must be a non-negative integer');
+        }
+    }
+    /**
+     * Validate CronJob specification for security and best practices
+     */
+    validateCronJobSpec(spec) {
+        this.validateCronSchedule(spec.schedule);
+        if (spec.suspend && spec.startingDeadlineSeconds !== undefined) {
+            throw new Error('startingDeadlineSeconds should not be set when job is suspended');
+        }
+        if (spec.successfulJobsHistoryLimit !== undefined && spec.successfulJobsHistoryLimit < 0) {
+            throw new Error('successfulJobsHistoryLimit must be non-negative');
+        }
+        if (spec.failedJobsHistoryLimit !== undefined && spec.failedJobsHistoryLimit < 0) {
+            throw new Error('failedJobsHistoryLimit must be non-negative');
+        }
+        if (spec.activeDeadlineSeconds !== undefined && spec.activeDeadlineSeconds <= 0) {
+            throw new Error('activeDeadlineSeconds must be a positive integer');
+        }
+        if (spec.ttlSecondsAfterFinished !== undefined && spec.ttlSecondsAfterFinished < 0) {
+            throw new Error('ttlSecondsAfterFinished must be a non-negative integer');
+        }
+    }
+    /**
+     * Validate cron schedule expression
+     */
+    validateCronSchedule(schedule) {
+        const cronRegex = /^(\*|([0-9]|1[0-9]|2[0-9]|3[0-9]|4[0-9]|5[0-9])|\*\/([0-9]|1[0-9]|2[0-9]|3[0-9]|4[0-9]|5[0-9])) (\*|([0-9]|1[0-9]|2[0-3])|\*\/([0-9]|1[0-9]|2[0-3])) (\*|([1-9]|1[0-9]|2[0-9]|3[0-1])|\*\/([1-9]|1[0-9]|2[0-9]|3[0-1])) (\*|([1-9]|1[0-2])|\*\/([1-9]|1[0-2])) (\*|([0-6])|\*\/([0-6]))$/;
+        if (!cronRegex.test(schedule)) {
+            throw new Error('Invalid cron schedule expression');
+        }
+    }
+    /**
+     * Sanitize environment variable names and values
+     */
+    sanitizeEnvVar(name, value) {
+        const nameRegex = /^[A-Za-z_][A-Za-z0-9_]*$/;
+        if (!nameRegex.test(name)) {
+            throw new Error(`Invalid environment variable name: ${name}`);
+        }
+        // Remove control characters from value (ASCII 0-31 and 127)
+        const sanitizedValue = value.replace(/[\cA-\c_\x7F]/g, '');
+        return { name, value: sanitizedValue };
+    }
+    /**
+     * Get default resource limits for Jobs and CronJobs
+     */
+    getDefaultResources() {
+        return {
+            limits: {
+                cpu: '1',
+                memory: '512Mi',
+            },
+            requests: {
+                cpu: '100m',
+                memory: '128Mi',
+            },
+        };
+    }
     /**
      * Capture the YAML of an ApiObject or Construct into assets.
      */
@@ -1179,5 +1778,8 @@ Rutter.LABEL_NAME = 'app.kubernetes.io/name';
 Rutter.LABEL_INSTANCE = 'app.kubernetes.io/instance';
 Rutter.HELPER_NAME = 'timonel.name';
 Rutter.NETWORKING_API_VERSION = 'networking.k8s.io/v1';
+Rutter.STORAGE_API_VERSION = 'storage.k8s.io/v1';
+Rutter.AZURE_DISK_CSI_DRIVER = 'disk.csi.azure.com';
+Rutter.AZURE_DISK_PROVISIONER_ANNOTATION = 'volume.beta.kubernetes.io/storage-provisioner';
 Rutter.EMPTY_POD_SELECTOR = {};
 //# sourceMappingURL=Rutter.js.map