timonel 2.2.0 → 2.4.0

package/dist/lib/Rutter.d.ts

@@ -1,1334 +0,0 @@
-import { ApiObject } from 'cdk8s';
-import type { HelmChartMeta, HelperDefinition } from './HelmChartWriter.js';
-export interface HttpHeader {
-    name: string;
-    value: string;
-}
-export interface HttpGetAction {
-    path?: string;
-    port: number | string;
-    scheme?: 'HTTP' | 'HTTPS';
-    httpHeaders?: HttpHeader[];
-}
-export interface ExecAction {
-    command: string[];
-}
-export interface TcpSocketAction {
-    port: number | string;
-}
-export interface Probe {
-    httpGet?: HttpGetAction;
-    exec?: ExecAction;
-    tcpSocket?: TcpSocketAction;
-    initialDelaySeconds?: number;
-    periodSeconds?: number;
-    timeoutSeconds?: number;
-    successThreshold?: number;
-    failureThreshold?: number;
-}
-export interface EnvFromSource {
-    configMapRef?: string;
-    secretRef?: string;
-}
-export interface VolumeSourceSpec {
-    name: string;
-    configMap?: string;
-    secret?: string;
-    persistentVolumeClaim?: string;
-}
-export interface VolumeMountSpec {
-    name: string;
-    mountPath: string;
-    readOnly?: boolean;
-    subPath?: string;
-}
-export interface ResourceRequirements {
-    limits?: {
-        cpu?: string;
-        memory?: string;
-    };
-    requests?: {
-        cpu?: string;
-        memory?: string;
-    };
-}
-export type AccessMode = 'ReadWriteOnce' | 'ReadOnlyMany' | 'ReadWriteMany' | 'ReadWriteOncePod';
-export type VolumeMode = 'Filesystem' | 'Block';
-export type ReclaimPolicy = 'Retain' | 'Recycle' | 'Delete';
-export interface CsiVolumeSource {
-    driver: string;
-    volumeHandle: string;
-    fsType?: string;
-    readOnly?: boolean;
-    volumeAttributes?: Record<string, string>;
-    controllerPublishSecretRef?: {
-        name: string;
-        namespace?: string;
-    };
-    nodeStageSecretRef?: {
-        name: string;
-        namespace?: string;
-    };
-    nodePublishSecretRef?: {
-        name: string;
-        namespace?: string;
-    };
-    controllerExpandSecretRef?: {
-        name: string;
-        namespace?: string;
-    };
-}
-export interface NfsVolumeSource {
-    server: string;
-    path: string;
-    readOnly?: boolean;
-}
-export interface AwsElasticBlockStoreSource {
-    volumeID: string;
-    fsType?: string;
-    partition?: number;
-    readOnly?: boolean;
-}
-export interface HostPathSource {
-    path: string;
-    type?: string;
-}
-export interface PersistentVolumeSourceSpec {
-    csi?: CsiVolumeSource;
-    nfs?: NfsVolumeSource;
-    awsElasticBlockStore?: AwsElasticBlockStoreSource;
-    hostPath?: HostPathSource;
-    azureDisk?: {
-        diskName: string;
-        diskURI: string;
-        cachingMode?: 'None' | 'ReadOnly' | 'ReadWrite';
-        fsType?: string;
-        readOnly?: boolean;
-        kind?: 'Shared' | 'Dedicated' | 'Managed';
-    };
-    azureFile?: {
-        secretName: string;
-        shareName: string;
-        readOnly?: boolean;
-        secretNamespace?: string;
-    };
-    gcePersistentDisk?: {
-        pdName: string;
-        fsType?: string;
-        partition?: number;
-        readOnly?: boolean;
-    };
-    [key: string]: unknown;
-}
-export interface PersistentVolumeSpec {
-    name: string;
-    capacity: string;
-    accessModes: AccessMode[];
-    storageClassName?: string;
-    volumeMode?: VolumeMode;
-    reclaimPolicy?: ReclaimPolicy;
-    mountOptions?: string[];
-    nodeAffinity?: Record<string, unknown>;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-    source: PersistentVolumeSourceSpec;
-    /** Reference to related PVC for binding */
-    claimRef?: {
-        name: string;
-        namespace?: string;
-    };
-    /** Cloud provider for optimized defaults */
-    cloudProvider?: 'aws' | 'azure' | 'gcp';
-}
-export interface DeploymentSpec {
-    name: string;
-    image: string;
-    replicas?: number;
-    containerPort?: number;
-    env?: Record<string, string>;
-    envFrom?: EnvFromSource[];
-    volumes?: VolumeSourceSpec[];
-    volumeMounts?: VolumeMountSpec[];
-    resources?: ResourceRequirements;
-    livenessProbe?: Probe;
-    readinessProbe?: Probe;
-    imagePullPolicy?: 'Always' | 'IfNotPresent' | 'Never';
-    serviceAccountName?: string;
-    matchLabels?: Record<string, string>;
-    /** Optional extra labels on the Deployment metadata */
-    labels?: Record<string, string>;
-    /** Optional annotations on the Deployment metadata */
-    annotations?: Record<string, string>;
-    /** Optional extra labels on the pod template (merged with matchLabels) */
-    podLabels?: Record<string, string>;
-    /** Optional annotations on the pod template (useful for reloaders, etc.) */
-    podAnnotations?: Record<string, string>;
-}
-export interface ReplicaSetSpec {
-    name: string;
-    image: string;
-    replicas?: number;
-    containerPort?: number;
-    env?: Record<string, string>;
-    envFrom?: EnvFromSource[];
-    volumes?: VolumeSourceSpec[];
-    volumeMounts?: VolumeMountSpec[];
-    resources?: ResourceRequirements;
-    livenessProbe?: Probe;
-    readinessProbe?: Probe;
-    imagePullPolicy?: 'Always' | 'IfNotPresent' | 'Never';
-    serviceAccountName?: string;
-    matchLabels?: Record<string, string>;
-    /** Optional extra labels on the ReplicaSet metadata */
-    labels?: Record<string, string>;
-    /** Optional annotations on the ReplicaSet metadata */
-    annotations?: Record<string, string>;
-    /** Optional extra labels on the pod template (merged with matchLabels) */
-    podLabels?: Record<string, string>;
-    /** Optional annotations on the pod template (useful for reloaders, etc.) */
-    podAnnotations?: Record<string, string>;
-}
-export interface JobSpec {
-    name: string;
-    image: string;
-    command?: string[];
-    args?: string[];
-    env?: Record<string, string>;
-    envFrom?: EnvFromSource[];
-    volumes?: VolumeSourceSpec[];
-    volumeMounts?: VolumeMountSpec[];
-    resources?: ResourceRequirements;
-    restartPolicy?: 'Never' | 'OnFailure';
-    backoffLimit?: number;
-    activeDeadlineSeconds?: number;
-    ttlSecondsAfterFinished?: number;
-    completions?: number;
-    parallelism?: number;
-    completionMode?: 'NonIndexed' | 'Indexed';
-    suspend?: boolean;
-    imagePullPolicy?: 'Always' | 'IfNotPresent' | 'Never';
-    serviceAccountName?: string;
-    /** Optional extra labels on the Job metadata */
-    labels?: Record<string, string>;
-    /** Optional annotations on the Job metadata */
-    annotations?: Record<string, string>;
-    /** Optional extra labels on the pod template */
-    podLabels?: Record<string, string>;
-    /** Optional annotations on the pod template */
-    podAnnotations?: Record<string, string>;
-}
-export interface CronJobSpec {
-    name: string;
-    schedule: string;
-    image: string;
-    command?: string[];
-    args?: string[];
-    env?: Record<string, string>;
-    envFrom?: EnvFromSource[];
-    volumes?: VolumeSourceSpec[];
-    volumeMounts?: VolumeMountSpec[];
-    resources?: ResourceRequirements;
-    restartPolicy?: 'Never' | 'OnFailure';
-    backoffLimit?: number;
-    activeDeadlineSeconds?: number;
-    ttlSecondsAfterFinished?: number;
-    completions?: number;
-    parallelism?: number;
-    completionMode?: 'NonIndexed' | 'Indexed';
-    suspend?: boolean;
-    startingDeadlineSeconds?: number;
-    concurrencyPolicy?: 'Allow' | 'Forbid' | 'Replace';
-    successfulJobsHistoryLimit?: number;
-    failedJobsHistoryLimit?: number;
-    timeZone?: string;
-    imagePullPolicy?: 'Always' | 'IfNotPresent' | 'Never';
-    serviceAccountName?: string;
-    /** Optional extra labels on the CronJob metadata */
-    labels?: Record<string, string>;
-    /** Optional annotations on the CronJob metadata */
-    annotations?: Record<string, string>;
-    /** Optional extra labels on the pod template */
-    podLabels?: Record<string, string>;
-    /** Optional annotations on the pod template */
-    podAnnotations?: Record<string, string>;
-}
-export interface ServiceSpec {
-    name: string;
-    ports: Array<{
-        port: number;
-        targetPort?: number;
-        protocol?: 'TCP' | 'UDP' | 'SCTP';
-        name?: string;
-        nodePort?: number;
-    }>;
-    type?: 'ClusterIP' | 'NodePort' | 'LoadBalancer' | 'ExternalName';
-    selector?: Record<string, string>;
-    clusterIP?: string;
-    externalName?: string;
-    sessionAffinity?: 'None' | 'ClientIP';
-    loadBalancerIP?: string;
-    loadBalancerSourceRanges?: string[];
-    loadBalancerClass?: string;
-    externalTrafficPolicy?: 'Cluster' | 'Local';
-    internalTrafficPolicy?: 'Cluster' | 'Local';
-    ipFamilyPolicy?: 'SingleStack' | 'PreferDualStack' | 'RequireDualStack';
-    ipFamilies?: Array<'IPv4' | 'IPv6'>;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface IngressRule {
-    host?: string;
-    paths: Array<{
-        path: string;
-        pathType: 'Exact' | 'Prefix' | 'ImplementationSpecific';
-        backend: {
-            service: {
-                name: string;
-                port: {
-                    number?: number;
-                    name?: string;
-                };
-            };
-        };
-    }>;
-}
-export interface IngressTLS {
-    hosts?: string[];
-    secretName?: string;
-}
-export interface IngressSpec {
-    name: string;
-    rules: IngressRule[];
-    tls?: IngressTLS[];
-    ingressClassName?: string;
-    defaultBackend?: {
-        service: {
-            name: string;
-            port: {
-                number?: number;
-                name?: string;
-            };
-        };
-    };
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface ConfigMapSpec {
-    name: string;
-    data?: Record<string, string>;
-    binaryData?: Record<string, string>;
-    immutable?: boolean;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface SecretSpec {
-    name: string;
-    type?: string;
-    stringData?: Record<string, string>;
-    data?: Record<string, string>;
-    immutable?: boolean;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface PersistentVolumeClaimSpec {
-    name: string;
-    accessModes: AccessMode[];
-    resources: {
-        requests: {
-            storage: string;
-        };
-        limits?: {
-            storage: string;
-        };
-    };
-    storageClassName?: string;
-    volumeMode?: VolumeMode;
-    selector?: {
-        matchLabels?: Record<string, string>;
-        matchExpressions?: unknown[];
-    };
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-    /** Reference to specific PV for static binding */
-    volumeName?: string;
-    /** Cloud provider for optimized defaults */
-    cloudProvider?: 'aws' | 'azure' | 'gcp';
-}
-export interface ServiceAccountSpec {
-    name: string;
-    annotations?: Record<string, string>;
-    labels?: Record<string, string>;
-    automountServiceAccountToken?: boolean;
-    imagePullSecrets?: string[];
-    secrets?: string[];
-    /**
-     * EKS IRSA support: IAM role ARN for service account to assume
-     * Example: arn:aws:iam::<account-id>:role/<role-name>
-     * Adds annotation eks.amazonaws.com/role-arn
-     */
-    awsRoleArn?: string;
-    /**
-     * IRSA audience for token validation (default: sts.amazonaws.com)
-     * Adds annotation eks.amazonaws.com/audience when provided
-     */
-    awsAudience?: string;
-    /**
-     * AWS STS endpoint type for IRSA (regional recommended for better performance)
-     * Adds annotation eks.amazonaws.com/sts-regional-endpoints when provided
-     * @default 'regional'
-     */
-    awsStsEndpointType?: 'regional' | 'legacy';
-    /**
-     * AWS region for regional STS endpoint (auto-detected if not provided)
-     * Used with awsStsEndpointType: 'regional'
-     */
-    awsRegion?: string;
-    /**
-     * Token expiration time in seconds for IRSA tokens (3600-43200)
-     * Adds annotation eks.amazonaws.com/token-expiration when provided
-     * @default 3600
-     */
-    awsTokenExpiration?: number;
-    /**
-     * AKS Workload Identity: Azure application client ID
-     * Adds annotation azure.workload.identity/client-id when provided
-     */
-    azureClientId?: string;
-    /**
-     * AKS Workload Identity: Azure tenant ID
-     * Adds annotation azure.workload.identity/tenant-id when provided
-     */
-    azureTenantId?: string;
-    /**
-     * AKS Workload Identity: projected SA token expiration (seconds)
-     * Adds annotation azure.workload.identity/service-account-token-expiration
-     */
-    azureServiceAccountTokenExpiration?: number;
-    /**
-     * GKE Workload Identity: Google service account email
-     * Adds annotation iam.gke.io/gcp-service-account when provided
-     */
-    gcpServiceAccountEmail?: string;
-}
-export interface HorizontalPodAutoscalerMetric {
-    type: 'Resource' | 'Pods' | 'Object' | 'External';
-    resource?: {
-        name: 'cpu' | 'memory';
-        target: {
-            type: 'Utilization' | 'AverageValue';
-            averageUtilization?: number;
-            averageValue?: string;
-        };
-    };
-    pods?: {
-        metric: {
-            name: string;
-            selector?: Record<string, unknown>;
-        };
-        target: {
-            type: 'AverageValue';
-            averageValue: string;
-        };
-    };
-    object?: {
-        metric: {
-            name: string;
-            selector?: Record<string, unknown>;
-        };
-        describedObject: {
-            apiVersion: string;
-            kind: string;
-            name: string;
-        };
-        target: {
-            type: 'Value' | 'AverageValue';
-            value?: string;
-            averageValue?: string;
-        };
-    };
-    external?: {
-        metric: {
-            name: string;
-            selector?: Record<string, unknown>;
-        };
-        target: {
-            type: 'Value' | 'AverageValue';
-            value?: string;
-            averageValue?: string;
-        };
-    };
-}
-export interface HorizontalPodAutoscalerBehavior {
-    scaleUp?: {
-        stabilizationWindowSeconds?: number;
-        selectPolicy?: 'Max' | 'Min' | 'Disabled';
-        policies?: Array<{
-            type: 'Pods' | 'Percent';
-            value: number;
-            periodSeconds: number;
-        }>;
-    };
-    scaleDown?: {
-        stabilizationWindowSeconds?: number;
-        selectPolicy?: 'Max' | 'Min' | 'Disabled';
-        policies?: Array<{
-            type: 'Pods' | 'Percent';
-            value: number;
-            periodSeconds: number;
-        }>;
-    };
-}
-export interface HorizontalPodAutoscalerSpec {
-    name: string;
-    scaleTargetRef: {
-        apiVersion: string;
-        kind: 'Deployment' | 'StatefulSet' | 'ReplicaSet';
-        name: string;
-    };
-    minReplicas?: number;
-    maxReplicas: number;
-    metrics?: HorizontalPodAutoscalerMetric[];
-    behavior?: HorizontalPodAutoscalerBehavior;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface VerticalPodAutoscalerResourcePolicy {
-    containerName?: string;
-    mode?: 'Auto' | 'Off';
-    minAllowed?: {
-        cpu?: string;
-        memory?: string;
-    };
-    maxAllowed?: {
-        cpu?: string;
-        memory?: string;
-    };
-    controlledResources?: Array<'cpu' | 'memory'>;
-    controlledValues?: 'RequestsAndLimits' | 'RequestsOnly';
-}
-export interface VerticalPodAutoscalerUpdatePolicy {
-    updateMode?: 'Off' | 'Initial' | 'Recreation' | 'Auto';
-    minReplicas?: number;
-}
-export interface PodDisruptionBudgetSpec {
-    name: string;
-    minAvailable?: number | string;
-    maxUnavailable?: number | string;
-    selector?: {
-        matchLabels?: Record<string, string>;
-        matchExpressions?: Array<{
-            key: string;
-            operator: 'In' | 'NotIn' | 'Exists' | 'DoesNotExist';
-            values?: string[];
-        }>;
-    };
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface AWSEBSStorageClassSpec extends CloudResourceTags {
-    name: string;
-    volumeType?: 'gp2' | 'gp3' | 'io1' | 'io2' | 'sc1' | 'st1';
-    fsType?: 'ext4' | 'xfs';
-    encrypted?: boolean;
-    kmsKeyId?: string;
-    iops?: number;
-    throughput?: number;
-    reclaimPolicy?: 'Delete' | 'Retain';
-    allowVolumeExpansion?: boolean;
-    volumeBindingMode?: 'Immediate' | 'WaitForFirstConsumer';
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface AWSEBSPersistentVolumeClaimSpec {
-    name: string;
-    storageClassName: string;
-    size: string;
-    accessModes?: AccessMode[];
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface AWSEFSStorageClassSpec {
-    name: string;
-    reclaimPolicy?: 'Delete' | 'Retain';
-    volumeBindingMode?: 'Immediate' | 'WaitForFirstConsumer';
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface AWSEFSPersistentVolumeSpec {
-    name: string;
-    fileSystemId: string;
-    accessPoint?: string;
-    directoryPerms?: string;
-    gidRangeStart?: number;
-    gidRangeEnd?: number;
-    basePath?: string;
-    subPath?: string;
-    capacity?: string;
-    accessModes?: AccessMode[];
-    storageClassName?: string;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface AWSEFSPersistentVolumeClaimSpec {
-    name: string;
-    storageClassName: string;
-    size?: string;
-    accessModes?: AccessMode[];
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface AWSIRSAServiceAccountSpec {
-    name: string;
-    roleArn: string;
-    audience?: string;
-    stsEndpointType?: 'regional' | 'legacy';
-    region?: string;
-    tokenExpiration?: number;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-    automountServiceAccountToken?: boolean;
-    imagePullSecrets?: string[];
-    secrets?: string[];
-}
-export interface AWSSecretsManagerObject {
-    objectName: string;
-    objectType: 'secretsmanager';
-    objectAlias?: string;
-    jmesPath?: string;
-}
-export interface AWSParameterStoreObject {
-    objectName: string;
-    objectType: 'ssmparameter';
-    objectAlias?: string;
-}
-export interface AWSSecretProviderClassSpec {
-    name: string;
-    region?: string;
-    objects: (AWSSecretsManagerObject | AWSParameterStoreObject)[];
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-/**
- * Configuration interface for Azure Workload Identity ServiceAccount.
- * Enables secure authentication to Azure services without storing credentials.
- *
- * @see https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview
- */
-export interface AzureWorkloadIdentityServiceAccountSpec {
-    /** Name of the ServiceAccount */
-    name: string;
-    /** Azure application client ID for workload identity */
-    clientId: string;
-    /** Azure tenant ID where the application is registered */
-    tenantId: string;
-    /** Service account token expiration in seconds (3600-86400) */
-    tokenExpiration?: number;
-    /** Labels to apply to the ServiceAccount */
-    labels?: Record<string, string>;
-    /** Additional annotations to apply to the ServiceAccount */
-    annotations?: Record<string, string>;
-    /** Whether to automount service account token */
-    automountServiceAccountToken?: boolean;
-    /** Names of image pull secrets */
-    imagePullSecrets?: string[];
-    /** Names of secrets to mount */
-    secrets?: string[];
-}
-/**
- * Azure Key Vault object configuration for SecretProviderClass.
- */
-export interface AzureKeyVaultObject {
-    /** Name of the object in Azure Key Vault */
-    objectName: string;
-    /** Type of object to retrieve */
-    objectType: 'secret' | 'key' | 'cert';
-    /** Optional alias for the object when mounted */
-    objectAlias?: string;
-    /** Optional version of the object */
-    objectVersion?: string;
-}
-/**
- * Configuration interface for Azure Key Vault SecretProviderClass.
- * Enables mounting secrets from Azure Key Vault using CSI driver.
- *
- * @see https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver
- */
-export interface AzureKeyVaultSecretProviderClassSpec {
-    /** Name of the SecretProviderClass */
-    name: string;
-    /** Name of the Azure Key Vault */
-    keyVaultName: string;
-    /** Azure tenant ID */
-    tenantId: string;
-    /** Objects to retrieve from Key Vault */
-    objects: AzureKeyVaultObject[];
-    /** User-assigned managed identity client ID for authentication */
-    userAssignedIdentityID?: string;
-    /** Azure cloud environment */
-    cloudName?: 'AzurePublicCloud' | 'AzureUSGovernmentCloud' | 'AzureChinaCloud';
-    /** Labels to apply to the SecretProviderClass */
-    labels?: Record<string, string>;
-    /** Additional annotations to apply to the SecretProviderClass */
-    annotations?: Record<string, string>;
-}
-/**
- * Configuration interface for Azure Files StorageClass.
- * Defines parameters for creating Azure Files StorageClass in AKS.
- *
- * @see https://learn.microsoft.com/en-us/azure/aks/azure-csi-files-storage-provision
- */
-export interface AzureFilesStorageClassSpec {
-    /** Name of the StorageClass */
-    name: string;
-    /** Azure Files SKU */
-    skuName?: 'Standard_LRS' | 'Standard_GRS' | 'Standard_RAGRS' | 'Standard_ZRS' | 'Premium_LRS' | 'Premium_ZRS';
-    /** File share protocol */
-    protocol?: 'smb' | 'nfs';
-    /** Allow shared access across multiple pods */
-    allowSharedAccess?: boolean;
-    /** Resource group for storage account */
-    resourceGroup?: string;
-    /** Storage account name */
-    storageAccount?: string;
-    /** Location for storage account */
-    location?: string;
-    /** Network endpoints for storage account */
-    networkEndpointType?: 'publicEndpoint' | 'privateEndpoint';
-    /** Mount permissions for NFS (e.g., '0777') */
-    mountPermissions?: string;
-    /** Root squash type for NFS */
-    rootSquashType?: 'NoRootSquash' | 'RootSquash' | 'AllSquash';
-    /** Volume reclaim policy */
-    reclaimPolicy?: 'Delete' | 'Retain';
-    /** Allow volume expansion */
-    allowVolumeExpansion?: boolean;
-    /** Volume binding mode */
-    volumeBindingMode?: 'Immediate' | 'WaitForFirstConsumer';
-    /** Mount options for the storage class */
-    mountOptions?: string[];
-    /** Labels to apply to the StorageClass */
-    labels?: Record<string, string>;
-    /** Annotations to apply to the StorageClass */
-    annotations?: Record<string, string>;
-}
-/**
- * Configuration interface for Azure Files PersistentVolume.
- * Defines parameters for static Azure Files volume provisioning.
- */
-export interface AzureFilesPersistentVolumeSpec {
-    /** Name of the PersistentVolume */
-    name: string;
-    /** Storage capacity */
-    capacity: string;
-    /** Access modes */
-    accessModes?: AccessMode[];
-    /** Storage account name */
-    storageAccount: string;
-    /** File share name */
-    shareName: string;
-    /** Resource group name */
-    resourceGroup?: string;
-    /** File share protocol */
-    protocol?: 'smb' | 'nfs';
-    /** Secret name containing storage account key (SMB only) */
-    secretName?: string;
-    /** Secret namespace (SMB only) */
-    secretNamespace?: string;
-    /** Server address override */
-    server?: string;
-    /** Folder name within share */
-    folderName?: string;
-    /** Mount permissions for NFS */
-    mountPermissions?: string;
-    /** Volume reclaim policy */
-    reclaimPolicy?: ReclaimPolicy;
-    /** Storage class name */
-    storageClassName?: string;
-    /** Mount options */
-    mountOptions?: string[];
-    /** Labels to apply to the PersistentVolume */
-    labels?: Record<string, string>;
-    /** Annotations to apply to the PersistentVolume */
-    annotations?: Record<string, string>;
-}
-/**
- * Configuration interface for Azure Files PersistentVolumeClaim.
- * Simplifies creation of PVCs for Azure Files.
- */
-export interface AzureFilesPersistentVolumeClaimSpec {
-    /** Name of the PersistentVolumeClaim */
-    name: string;
-    /** Storage class name */
-    storageClassName: string;
-    /** Storage size request */
-    size: string;
-    /** Access modes */
-    accessModes?: AccessMode[];
-    /** Labels to apply to the PersistentVolumeClaim */
-    labels?: Record<string, string>;
-    /** Annotations to apply to the PersistentVolumeClaim */
-    annotations?: Record<string, string>;
-}
-/**
- * Configuration interface for Azure Container Registry ServiceAccount.
- * Simplifies ACR integration with AKS using managed identity.
- */
-export interface AzureACRServiceAccountSpec {
-    /** Name of the ServiceAccount */
-    name: string;
-    /** Azure Container Registry name */
-    acrName: string;
-    /** Resource group containing the ACR */
-    resourceGroup: string;
-    /** Client ID for Workload Identity (optional) */
-    clientId?: string;
-    /** Tenant ID for Workload Identity (optional) */
-    tenantId?: string;
-    /** Labels to apply to the ServiceAccount */
-    labels?: Record<string, string>;
-    /** Additional annotations to apply to the ServiceAccount */
-    annotations?: Record<string, string>;
-    /** Whether to automount service account token */
-    automountServiceAccountToken?: boolean;
-    /** Names of additional image pull secrets */
-    imagePullSecrets?: string[];
-    /** Names of secrets to mount */
-    secrets?: string[];
-}
-/**
- * Configuration interface for Azure Disk StorageClass.
- * Defines the parameters for creating an Azure Disk StorageClass in AKS.
- *
- * @see https://learn.microsoft.com/en-us/azure/aks/azure-csi-disk-storage-provision
- */
-/**
- * Cloud resource tags with basic validation.
- * Provides a consistent interface for tagging resources across cloud providers.
- */
-export interface CloudResourceTags {
-    /** Resource tags as key-value pairs */
-    tags?: Record<string, string>;
-}
-export interface AzureDiskStorageClassSpec extends CloudResourceTags {
-    /** Name of the StorageClass */
-    name: string;
-    /** Azure disk SKU to use */
-    skuName?: 'Standard_LRS' | 'Premium_LRS' | 'StandardSSD_LRS' | 'PremiumV2_LRS' | 'UltraSSD_LRS' | 'Premium_ZRS' | 'StandardSSD_ZRS';
-    /** File system type to use */
-    fsType?: 'ext4' | 'ext3' | 'ext2' | 'xfs' | 'btrfs' | 'ntfs';
-    /** Host caching mode */
-    cachingMode?: 'None' | 'ReadOnly' | 'ReadWrite';
-    /** Resource group where disks will be created */
-    resourceGroup?: string;
-    /** IOPS for the disk (UltraSSD_LRS only) */
-    diskIOPSReadWrite?: number;
-    /** Throughput in MB/s (UltraSSD_LRS only) */
-    diskMBpsReadWrite?: number;
-    /** Logical sector size in bytes */
-    logicalSectorSize?: 512 | 4096;
-    /** ID of the disk encryption set */
-    diskEncryptionSetID?: string;
-    /** Type of disk encryption */
-    diskEncryptionType?: 'EncryptionAtRestWithCustomerKey' | 'EncryptionAtRestWithPlatformAndCustomerKeys';
-    /** Enable write accelerator */
-    writeAcceleratorEnabled?: boolean;
-    /** Network access policy for the disk */
-    networkAccessPolicy?: 'AllowAll' | 'DenyAll' | 'AllowPrivate';
-    /** ID of the disk access resource */
-    diskAccessID?: string;
-    /** Enable bursting (Premium SSD only) */
-    enableBursting?: boolean;
-    /** Maximum number of hosts that can attach to the disk simultaneously */
-    maxShares?: number;
-    /** Volume reclaim policy */
-    reclaimPolicy?: 'Delete' | 'Retain';
-    /** Allow volume expansion */
-    allowVolumeExpansion?: boolean;
-    /** Volume binding mode */
-    volumeBindingMode?: 'Immediate' | 'WaitForFirstConsumer';
-    /** Labels to apply to the StorageClass */
-    labels?: Record<string, string>;
-    /** Annotations to apply to the StorageClass */
-    annotations?: Record<string, string>;
-}
-export interface AWSALBIngressSpec extends CloudResourceTags {
-    name: string;
-    rules: IngressRule[];
-    tls?: IngressTLS[];
-    scheme?: 'internet-facing' | 'internal';
-    targetType?: 'instance' | 'ip';
-    ipAddressType?: 'ipv4' | 'dualstack';
-    groupName?: string;
-    groupOrder?: number;
-    subnets?: string[];
-    securityGroups?: string[];
-    certificateArn?: string;
-    sslRedirect?: boolean;
-    healthCheckPath?: string;
-    healthCheckIntervalSeconds?: number;
-    healthCheckTimeoutSeconds?: number;
-    healthyThresholdCount?: number;
-    unhealthyThresholdCount?: number;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-/**
- * Configuration interface for Azure Application Gateway Ingress Controller (AGIC).
- * Provides comprehensive support for AGIC annotations and features for AKS deployments.
- *
- * @see https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-annotations
- */
-export interface AzureAGICIngressSpec {
-    /** Name of the Ingress resource */
-    name: string;
-    /** Ingress rules defining routing configuration */
-    rules: IngressRule[];
-    /** TLS configuration for HTTPS termination */
-    tls?: IngressTLS[];
-    /** Backend path prefix to rewrite request paths */
-    backendPathPrefix?: string;
-    /** Backend hostname for Application Gateway to use when communicating with pods */
-    backendHostname?: string;
-    /** Backend protocol (http or https) */
-    backendProtocol?: 'http' | 'https';
-    /** Enable SSL redirect from HTTP to HTTPS */
-    sslRedirect?: boolean;
-    /** Use private IP address of Application Gateway */
-    usePrivateIp?: boolean;
-    /** Override frontend port (default: 80 for HTTP, 443 for HTTPS) */
-    overrideFrontendPort?: number;
-    /** Enable cookie-based session affinity */
-    cookieBasedAffinity?: boolean;
-    /** Request timeout in seconds */
-    requestTimeout?: number;
-    /** Enable connection draining */
-    connectionDraining?: boolean;
-    /** Connection draining timeout in seconds */
-    connectionDrainingTimeout?: number;
-    /** Custom health probe hostname */
-    healthProbeHostname?: string;
-    /** Custom health probe port */
-    healthProbePort?: number;
-    /** Custom health probe path */
-    healthProbePath?: string;
-    /** Accepted HTTP status codes for health probe */
-    healthProbeStatusCodes?: string;
-    /** Health probe interval in seconds */
-    healthProbeInterval?: number;
-    /** Health probe timeout in seconds */
-    healthProbeTimeout?: number;
-    /** Health probe unhealthy threshold */
-    healthProbeUnhealthyThreshold?: number;
-    /**
-     * Additional hostnames for multisite listener
-     * @security Validate hostname format to prevent injection attacks
-     */
-    hostnameExtension?: string[];
-    /**
-     * WAF policy resource ID for path-based protection
-     * @security Validate resource ID format to prevent path traversal attacks
-     */
-    wafPolicyForPath?: string;
-    /**
-     * Application Gateway SSL certificate name
-     * @security Ensure certificate exists and is properly configured
-     */
-    appgwSslCertificate?: string;
-    /** Application Gateway SSL profile name */
-    appgwSslProfile?: string;
-    /** Trusted root certificate names for end-to-end SSL */
-    appgwTrustedRootCertificate?: string[];
-    /** Rewrite rule set name */
-    rewriteRuleSet?: string;
-    /** Rule priority for request routing */
-    rulePriority?: number;
-    /** Labels to apply to the Ingress */
-    labels?: Record<string, string>;
-    /** Additional annotations to apply to the Ingress */
-    annotations?: Record<string, string>;
-}
-export interface VerticalPodAutoscalerSpec {
-    name: string;
-    targetRef: {
-        apiVersion: string;
-        kind: 'Deployment' | 'StatefulSet' | 'ReplicaSet' | 'DaemonSet' | 'Job' | 'CronJob';
-        name: string;
-    };
-    updatePolicy?: VerticalPodAutoscalerUpdatePolicy;
-    resourcePolicy?: {
-        containerPolicies?: VerticalPodAutoscalerResourcePolicy[];
-    };
-    recommenders?: Array<{
-        name: string;
-    }>;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface NetworkPolicyPeer {
-    podSelector?: {
-        matchLabels?: Record<string, string>;
-        matchExpressions?: Array<{
-            key: string;
-            operator: 'In' | 'NotIn' | 'Exists' | 'DoesNotExist';
-            values?: string[];
-        }>;
-    };
-    namespaceSelector?: {
-        matchLabels?: Record<string, string>;
-        matchExpressions?: Array<{
-            key: string;
-            operator: 'In' | 'NotIn' | 'Exists' | 'DoesNotExist';
-            values?: string[];
-        }>;
-    };
-    ipBlock?: {
-        cidr: string;
-        except?: string[];
-    };
-}
-export interface NetworkPolicyPort {
-    protocol?: 'TCP' | 'UDP' | 'SCTP';
-    port?: number | string;
-    endPort?: number;
-}
-export interface NetworkPolicyIngressRule {
-    from?: NetworkPolicyPeer[];
-    ports?: NetworkPolicyPort[];
-}
-export interface NetworkPolicyEgressRule {
-    to?: NetworkPolicyPeer[];
-    ports?: NetworkPolicyPort[];
-}
-export interface NetworkPolicySpec {
-    name: string;
-    podSelector?: {
-        matchLabels?: Record<string, string>;
-        matchExpressions?: Array<{
-            key: string;
-            operator: 'In' | 'NotIn' | 'Exists' | 'DoesNotExist';
-            values?: string[];
-        }>;
-    };
-    policyTypes?: Array<'Ingress' | 'Egress'>;
-    ingress?: NetworkPolicyIngressRule[];
-    egress?: NetworkPolicyEgressRule[];
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-}
-export interface RutterProps {
-    meta: HelmChartMeta;
-    defaultValues?: Record<string, unknown>;
-    envValues?: Record<string, Record<string, unknown>>;
-    /** Optional Helm helpers content for templates/_helpers.tpl */
-    helpersTpl?: string | HelperDefinition[];
-    /** Optional NOTES.txt content */
-    notesTpl?: string;
-    /** Optional values.schema.json object */
-    valuesSchema?: Record<string, unknown>;
-    /** Optional custom name for the generated manifest file (without extension) */
-    manifestName?: string;
-    /**
-     * If true, all Kubernetes resources will be combined into a single manifest file.
-     * If false (default), each resource will be in its own numbered file.
-     * @default false
-     */
-    singleManifestFile?: boolean;
-}
-/**
- * Rutter builds Kubernetes manifests using cdk8s and writes a Helm chart.
- */
-export declare class Rutter {
-    private readonly props;
-    private readonly app;
-    private readonly chart;
-    private readonly assets;
-    private valueOverrides;
-    constructor(props: RutterProps);
-    /**
-     * Set dynamic value overrides (from --set flags)
-     */
-    setValues(overrides: Record<string, string>): void;
-    /**
-     * Apply value overrides to nested object using dot notation
-     */
-    private applyOverrides;
-    private setNestedValue;
-    private parseValue;
-    private static readonly LABEL_NAME;
-    private static readonly LABEL_INSTANCE;
-    private static readonly HELPER_NAME;
-    private static readonly NETWORKING_API_VERSION;
-    private static readonly STORAGE_API_VERSION;
-    private static readonly AZURE_DISK_CSI_DRIVER;
-    private static readonly AZURE_DISK_PROVISIONER_ANNOTATION;
-    private static readonly AZURE_FILES_CSI_DRIVER;
-    addDeployment(spec: DeploymentSpec): ApiObject;
-    addService(spec: ServiceSpec): ApiObject;
-    addReplicaSet(spec: ReplicaSetSpec): ApiObject;
-    addJob(spec: JobSpec): ApiObject;
-    addCronJob(spec: CronJobSpec): ApiObject;
-    addIngress(spec: IngressSpec): ApiObject;
-    addPersistentVolume(spec: PersistentVolumeSpec): ApiObject;
-    private optimizePVForCloud;
-    addPersistentVolumeClaim(spec: PersistentVolumeClaimSpec): ApiObject;
-    private validatePVCAccessModes;
-    addConfigMap(spec: ConfigMapSpec): ApiObject;
-    addSecret(spec: SecretSpec): ApiObject;
-    addServiceAccount(spec: ServiceAccountSpec): ApiObject;
-    private buildServiceAccountAnnotations;
-    private addAWSIRSAAnnotations;
-    private addAzureWorkloadIdentityAnnotations;
-    private addGCPWorkloadIdentityAnnotations;
-    addHorizontalPodAutoscaler(spec: HorizontalPodAutoscalerSpec): ApiObject;
-    addVerticalPodAutoscaler(spec: VerticalPodAutoscalerSpec): ApiObject;
-    addPodDisruptionBudget(spec: PodDisruptionBudgetSpec): ApiObject;
-    addAWSEBSStorageClass(spec: AWSEBSStorageClassSpec): ApiObject;
-    addAWSEBSPersistentVolumeClaim(spec: AWSEBSPersistentVolumeClaimSpec): ApiObject;
-    addAWSEFSStorageClass(spec: AWSEFSStorageClassSpec): ApiObject;
-    addAWSEFSPersistentVolume(spec: AWSEFSPersistentVolumeSpec): ApiObject;
-    addAWSEFSPersistentVolumeClaim(spec: AWSEFSPersistentVolumeClaimSpec): ApiObject;
-    addAWSALBIngress(spec: AWSALBIngressSpec): ApiObject;
-    private buildALBAnnotations;
-    private addOptionalALBAnnotations;
-    private addHealthCheckAnnotations;
-    private addTagsAnnotation;
-    /**
-     * Add Azure Application Gateway Ingress Controller (AGIC) Ingress.
-     * Creates an Ingress resource with AGIC-specific annotations for AKS deployments.
-     *
-     * @param spec - AGIC Ingress specification
-     * @returns The created Ingress ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addAzureAGICIngress({
-     *   name: 'app-ingress',
-     *   rules: [{
-     *     host: 'app.example.com',
-     *     paths: [{
-     *       path: '/',
-     *       pathType: 'Prefix',
-     *       backend: { service: { name: 'app-service', port: { number: 80 } } }
-     *     }]
-     *   }],
-     *   sslRedirect: true,
-     *   backendProtocol: 'https',
-     *   healthProbePath: '/health'
-     * });
-     * ```
-     */
-    addAzureAGICIngress(spec: AzureAGICIngressSpec): ApiObject;
-    private buildAGICAnnotations;
-    private addAGICPathAnnotations;
-    private addAGICProtocolAnnotations;
-    private addAGICHealthProbeAnnotations;
-    private addAGICConnectionAnnotations;
-    private addAGICSecurityAnnotations;
-    private addAGICAdvancedAnnotations;
-    addAWSIRSAServiceAccount(spec: AWSIRSAServiceAccountSpec): ApiObject;
-    addAWSSecretProviderClass(spec: AWSSecretProviderClassSpec): ApiObject;
-    /**
-     * Add Azure Workload Identity ServiceAccount.
-     * Creates a ServiceAccount with Azure Workload Identity annotations for secure authentication.
-     *
-     * @param spec - Azure Workload Identity ServiceAccount specification
-     * @returns The created ServiceAccount ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addAzureWorkloadIdentityServiceAccount({
-     *   name: 'workload-identity-sa',
-     *   clientId: '12345678-1234-1234-1234-123456789012',
-     *   tenantId: '87654321-4321-4321-4321-210987654321',
-     *   tokenExpiration: 3600
-     * });
-     * ```
-     */
-    addAzureWorkloadIdentityServiceAccount(spec: AzureWorkloadIdentityServiceAccountSpec): ApiObject;
-    /**
-     * Add Azure Key Vault SecretProviderClass.
-     * Creates a SecretProviderClass for mounting secrets from Azure Key Vault using CSI driver.
-     *
-     * @param spec - Azure Key Vault SecretProviderClass specification
-     * @returns The created SecretProviderClass ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addAzureKeyVaultSecretProviderClass({
-     *   name: 'app-secrets',
-     *   keyVaultName: 'my-keyvault',
-     *   tenantId: '87654321-4321-4321-4321-210987654321',
-     *   objects: [
-     *     { objectName: 'database-password', objectType: 'secret' },
-     *     { objectName: 'api-key', objectType: 'secret', objectAlias: 'API_KEY' }
-     *   ],
-     *   userAssignedIdentityID: '12345678-1234-1234-1234-123456789012'
-     * });
-     * ```
-     */
-    addAzureKeyVaultSecretProviderClass(spec: AzureKeyVaultSecretProviderClassSpec): ApiObject;
-    /**
-     * Add Azure Files StorageClass.
-     * Creates a StorageClass for dynamic provisioning of Azure Files volumes.
-     *
-     * @param spec - Azure Files StorageClass specification
-     * @returns The created StorageClass ApiObject
-     *
-     * @example
-     * ```typescript
-     * rutter.addAzureFilesStorageClass({
-     *   name: 'azure-files-premium',
-     *   skuName: 'Premium_LRS',
-     *   protocol: 'smb',
-     *   allowSharedAccess: true
-     * });
-     * ```
-     */
-    addAzureFilesStorageClass(spec: AzureFilesStorageClassSpec): ApiObject;
-    /**
-     * Add Azure Files PersistentVolume.
-     * Creates a PersistentVolume for static Azure Files volume provisioning.
-     *
-     * @param spec - Azure Files PersistentVolume specification
-     * @returns The created PersistentVolume ApiObject
-     */
-    addAzureFilesPersistentVolume(spec: AzureFilesPersistentVolumeSpec): ApiObject;
-    /**
-     * Add Azure Files PersistentVolumeClaim.
-     * Creates a PersistentVolumeClaim for Azure Files storage.
-     *
-     * @param spec - Azure Files PersistentVolumeClaim specification
-     * @returns The created PersistentVolumeClaim ApiObject
-     */
-    addAzureFilesPersistentVolumeClaim(spec: AzureFilesPersistentVolumeClaimSpec): ApiObject;
-    /**
-     * Add Azure Container Registry ServiceAccount.
-     * Creates a ServiceAccount configured for ACR access.
-     *
-     * @param spec - Azure ACR ServiceAccount specification
-     * @returns The created ServiceAccount ApiObject
-     */
-    addAzureACRServiceAccount(spec: AzureACRServiceAccountSpec): ApiObject;
-    addAzureDiskStorageClass(spec: AzureDiskStorageClassSpec): ApiObject;
-    private buildAzureDiskParameters;
-    private addOptionalAzureDiskParameters;
-    private addAzureDiskEncryptionParameters;
-    private addAzureDiskPerformanceParameters;
-    private validateAzureDiskNumericParameters;
-    private validateAzureDiskIOPS;
-    private validateAzureDiskThroughput;
-    private validateAzureDiskShares;
-    private validateAzureDiskSectorSize;
-    /**
-     * Format cloud resource tags for provider-specific string format.
-     * Provides basic validation and consistent formatting across cloud providers.
-     */
-    private formatCloudResourceTags;
-    /**
-     * Validate cloud resource tags with basic rules.
-     * Each cloud provider has specific validation, but these are common basics.
-     */
-    private validateCloudResourceTags;
-    addNetworkPolicy(spec: NetworkPolicySpec): ApiObject;
-    private static readonly EMPTY_POD_SELECTOR;
-    /**
-     * Create a deny-all ingress NetworkPolicy for the current namespace
-     */
-    addDenyAllIngressNetworkPolicy(name?: string): ApiObject;
-    /**
-     * Create a deny-all egress NetworkPolicy for the current namespace
-     */
-    addDenyAllEgressNetworkPolicy(name?: string): ApiObject;
-    /**
-     * Create a deny-all NetworkPolicy for both ingress and egress
-     */
-    addDenyAllNetworkPolicy(name?: string): ApiObject;
-    /**
-     * Allow traffic from specific pods to target pods on specific ports
-     */
-    addAllowFromPodsNetworkPolicy(spec: {
-        name: string;
-        targetPodSelector: Record<string, string>;
-        sourcePodSelector: Record<string, string>;
-        ports?: NetworkPolicyPort[];
-        labels?: Record<string, string>;
-        annotations?: Record<string, string>;
-    }): ApiObject;
-    /**
-     * Allow traffic from specific namespace to target pods
-     */
-    addAllowFromNamespaceNetworkPolicy(spec: {
-        name: string;
-        targetPodSelector: Record<string, string>;
-        sourceNamespaceSelector: Record<string, string>;
-        ports?: NetworkPolicyPort[];
-        labels?: Record<string, string>;
-        annotations?: Record<string, string>;
-    }): ApiObject;
-    private validateNetworkPolicyTypes;
-    private validatePolicyTypeValues;
-    private validatePolicyTypeRules;
-    private validateNetworkPolicyCIDRs;
-    private isValidCIDR;
-    private isValidIPv4;
-    private isValidPrefix;
-    private validateIngressCIDRs;
-    private validateEgressCIDRs;
-    private validatePeerCIDRs;
-    private validateAGICHealthProbeParams;
-    private validateAGICSecurityParams;
-    private isValidHostname;
-    private validateAGICAnnotationConsistency;
-    private buildAzureFilesParameters;
-    private buildAzureFilesPVCSISpec;
-    private buildPodEnvironment;
-    private buildJobSpec;
-    private buildJobPodTemplate;
-    private buildCronJobSpec;
-    private buildCronJobTemplate;
-    /**
-     * Validate Job specification for security and best practices
-     */
-    private validateJobSpec;
-    /**
-     * Validate CronJob specification for security and best practices
-     */
-    private validateCronJobSpec;
-    /**
-     * Validate cron schedule expression
-     */
-    private validateCronSchedule;
-    /**
-     * Sanitize environment variable names and values
-     */
-    private sanitizeEnvVar;
-    /**
-     * Get default resource limits for Jobs and CronJobs
-     */
-    private getDefaultResources;
-    /**
-     * Validate Azure Files parameters for security and compliance
-     */
-    private validateAzureFilesParameters;
-    /**
-     * Sanitize volume handle to ensure valid format for CSI driver
-     */
-    private sanitizeVolumeHandle;
-    /**
-     * Capture the YAML of an ApiObject or Construct into assets.
-     */
-    private capture;
-    /**
-     * Extract a meaningful name from a Kubernetes resource object
-     */
-    private getResourceName;
-    /**
-     * Add a raw CRD manifest to the chart (written under crds/).
-     */
-    addCrd(yaml: string, id?: string): void;
-    /**
-     * Synthesize the cdk8s app and write a Helm chart to outDir.
-     */
-    write(outDir: string): void;
-}
-//# sourceMappingURL=Rutter.d.ts.map