timonel 2.4.0 → 2.5.1

package/dist/lib/utils/podTemplates.js

@@ -0,0 +1,331 @@
+/**
+ * @fileoverview Pod template utilities for generating reusable Kubernetes pod specifications
+ * @since 2.5.0
+ */
+/**
+ * Creates a secure pod template with best practices
+ * @param spec - Pod template specification
+ * @param profile - Security profile to apply
+ * @returns Pod template object
+ *
+ * @example
+ * ```typescript
+ * const template = createSecurePodTemplate({
+ *   name: 'web-app',
+ *   containers: [{
+ *     name: 'app',
+ *     image: 'nginx:1.27',
+ *     port: 80
+ *   }]
+ * }, 'restricted');
+ * ```
+ *
+ * @since 2.5.0
+ */
+export function createSecurePodTemplate(spec, profile = 'baseline') {
+    const securityContext = getSecurityContextForProfile(profile);
+    const containers = spec.containers.map((container) => applyContainerSecurity(container, profile));
+    const metadata = {
+        name: spec.name,
+        labels: {
+            'app.kubernetes.io/name': spec.name,
+            ...(spec.labels || {}),
+        },
+    };
+    if (spec.annotations) {
+        metadata['annotations'] = spec.annotations;
+    }
+    const combinedSecurityContext = { ...securityContext };
+    if (spec.securityContext) {
+        Object.assign(combinedSecurityContext, spec.securityContext);
+    }
+    const podSpec = {
+        containers,
+        restartPolicy: spec.restartPolicy ?? 'Always',
+        securityContext: combinedSecurityContext,
+    };
+    if (spec.initContainers) {
+        podSpec['initContainers'] = spec.initContainers.map((container) => applyContainerSecurity(container, profile));
+    }
+    if (spec.volumes) {
+        podSpec['volumes'] = spec.volumes;
+    }
+    if (spec.serviceAccountName) {
+        podSpec['serviceAccountName'] = spec.serviceAccountName;
+    }
+    if (spec.nodeSelector) {
+        podSpec['nodeSelector'] = spec.nodeSelector;
+    }
+    if (spec.tolerations) {
+        podSpec['tolerations'] = spec.tolerations;
+    }
+    if (spec.affinity) {
+        podSpec['affinity'] = spec.affinity;
+    }
+    if (spec.dnsPolicy) {
+        podSpec['dnsPolicy'] = spec.dnsPolicy;
+    }
+    if (spec.hostNetwork) {
+        podSpec['hostNetwork'] = spec.hostNetwork;
+    }
+    if (spec.priorityClassName) {
+        podSpec['priorityClassName'] = spec.priorityClassName;
+    }
+    return {
+        metadata,
+        spec: podSpec,
+    };
+}
+/**
+ * Creates a workload-optimized pod template
+ * @param spec - Pod template specification
+ * @param workloadType - Type of workload
+ * @returns Pod template object
+ *
+ * @example
+ * ```typescript
+ * const template = createWorkloadPodTemplate({
+ *   name: 'api-server',
+ *   containers: [{
+ *     name: 'api',
+ *     image: 'myapi:latest',
+ *     port: 8080
+ *   }]
+ * }, 'api');
+ * ```
+ *
+ * @since 2.5.0
+ */
+export function createWorkloadPodTemplate(spec, workloadType) {
+    const workloadConfig = getWorkloadConfiguration(workloadType);
+    const enhancedSpec = {
+        ...spec,
+        labels: { ...(spec.labels || {}), ...(workloadConfig.labels || {}) },
+    };
+    if (workloadConfig.restartPolicy) {
+        enhancedSpec.restartPolicy = workloadConfig.restartPolicy;
+    }
+    return createSecurePodTemplate(enhancedSpec, 'baseline');
+}
+/**
+ * Creates a multi-container pod template with sidecar pattern
+ * @param mainContainer - Main application container
+ * @param sidecars - Sidecar containers
+ * @param options - Additional pod options
+ * @returns Pod template object
+ *
+ * @example
+ * ```typescript
+ * const template = createSidecarPodTemplate(
+ *   { name: 'app', image: 'myapp:latest', port: 8080 },
+ *   [{ name: 'proxy', image: 'envoy:latest', port: 9901 }],
+ *   { name: 'app-with-proxy' }
+ * );
+ * ```
+ *
+ * @since 2.5.0
+ */
+export function createSidecarPodTemplate(mainContainer, sidecars, options) {
+    const spec = {
+        name: options.name || `${mainContainer.name}-pod`,
+        containers: [mainContainer, ...sidecars],
+        ...options,
+    };
+    return createSecurePodTemplate(spec, 'baseline');
+}
+/**
+ * Creates a pod template with health checks
+ * @param spec - Pod template specification
+ * @param healthConfig - Health check configuration
+ * @returns Pod template object
+ *
+ * @example
+ * ```typescript
+ * const template = createHealthyPodTemplate({
+ *   name: 'web-app',
+ *   containers: [{
+ *     name: 'app',
+ *     image: 'nginx:1.27',
+ *     port: 80
+ *   }]
+ * }, {
+ *   httpPath: '/health',
+ *   port: 80
+ * });
+ * ```
+ *
+ * @since 2.5.0
+ */
+export function createHealthyPodTemplate(spec, healthConfig) {
+    const enhancedContainers = spec.containers.map((container) => ({
+        ...container,
+        livenessProbe: createHttpProbe(healthConfig, 'liveness'),
+        readinessProbe: createHttpProbe(healthConfig, 'readiness'),
+    }));
+    return createSecurePodTemplate({ ...spec, containers: enhancedContainers }, 'baseline');
+}
+/**
+ * Gets security context for the specified profile
+ * @private
+ */
+function getSecurityContextForProfile(profile) {
+    switch (profile) {
+        case 'restricted':
+            return {
+                runAsNonRoot: true,
+                runAsUser: 65534,
+                runAsGroup: 65534,
+                fsGroup: 65534,
+                seccompProfile: { type: 'RuntimeDefault' },
+            };
+        case 'baseline':
+            return {
+                runAsNonRoot: true,
+                runAsUser: 1000,
+                runAsGroup: 1000,
+                fsGroup: 1000,
+            };
+        case 'privileged':
+            return {};
+        default:
+            return getSecurityContextForProfile('baseline');
+    }
+}
+/**
+ * Applies container security based on profile
+ * @private
+ */
+function applyContainerSecurity(container, profile) {
+    const baseContainer = {
+        name: container.name,
+        image: container.image,
+    };
+    if (container.port) {
+        baseContainer['ports'] = [{ containerPort: container.port }];
+    }
+    if (container.env) {
+        baseContainer['env'] = container.env;
+    }
+    if (container.resources) {
+        baseContainer['resources'] = container.resources;
+    }
+    if (container.volumeMounts) {
+        baseContainer['volumeMounts'] = container.volumeMounts;
+    }
+    if (container.command) {
+        baseContainer['command'] = container.command;
+    }
+    if (container.args) {
+        baseContainer['args'] = container.args;
+    }
+    if (container.livenessProbe) {
+        baseContainer['livenessProbe'] = container.livenessProbe;
+    }
+    if (container.readinessProbe) {
+        baseContainer['readinessProbe'] = container.readinessProbe;
+    }
+    if (container.startupProbe) {
+        baseContainer['startupProbe'] = container.startupProbe;
+    }
+    const securityContext = getContainerSecurityContext(profile);
+    const containerSecurityContext = { ...securityContext };
+    if (container.securityContext) {
+        Object.assign(containerSecurityContext, container.securityContext);
+    }
+    baseContainer['securityContext'] = containerSecurityContext;
+    return baseContainer;
+}
+/**
+ * Gets container security context for profile
+ * @private
+ */
+function getContainerSecurityContext(profile) {
+    switch (profile) {
+        case 'restricted':
+            return {
+                allowPrivilegeEscalation: false,
+                readOnlyRootFilesystem: true,
+                runAsNonRoot: true,
+                capabilities: { drop: ['ALL'] },
+                seccompProfile: { type: 'RuntimeDefault' },
+            };
+        case 'baseline':
+            return {
+                allowPrivilegeEscalation: false,
+                readOnlyRootFilesystem: false,
+                runAsNonRoot: true,
+                capabilities: { drop: ['ALL'] },
+            };
+        case 'privileged':
+            return {};
+        default:
+            return getContainerSecurityContext('baseline');
+    }
+}
+/**
+ * Gets workload-specific configuration
+ * @private
+ */
+function getWorkloadConfiguration(workloadType) {
+    switch (workloadType) {
+        case 'web':
+            return {
+                labels: { 'app.kubernetes.io/component': 'frontend' },
+                restartPolicy: 'Always',
+            };
+        case 'api':
+            return {
+                labels: { 'app.kubernetes.io/component': 'backend' },
+                restartPolicy: 'Always',
+            };
+        case 'worker':
+            return {
+                labels: { 'app.kubernetes.io/component': 'worker' },
+                restartPolicy: 'Always',
+            };
+        case 'database':
+            return {
+                labels: { 'app.kubernetes.io/component': 'database' },
+                restartPolicy: 'Always',
+            };
+        case 'cache':
+            return {
+                labels: { 'app.kubernetes.io/component': 'cache' },
+                restartPolicy: 'Always',
+            };
+        case 'batch':
+            return {
+                labels: { 'app.kubernetes.io/component': 'batch' },
+                restartPolicy: 'OnFailure',
+            };
+        default:
+            return {};
+    }
+}
+/**
+ * Creates HTTP probe configuration
+ * @private
+ */
+function createHttpProbe(config, type) {
+    const defaults = {
+        liveness: {
+            initialDelaySeconds: 30,
+            periodSeconds: 10,
+            timeoutSeconds: 5,
+            failureThreshold: 3,
+        },
+        readiness: { initialDelaySeconds: 5, periodSeconds: 5, timeoutSeconds: 3, failureThreshold: 3 },
+    };
+    const defaultConfig = type === 'liveness' ? defaults.liveness : defaults.readiness;
+    return {
+        httpGet: {
+            path: config.httpPath || '/health',
+            port: config.port || 8080,
+        },
+        initialDelaySeconds: config.initialDelaySeconds || defaultConfig.initialDelaySeconds,
+        periodSeconds: config.periodSeconds || defaultConfig.periodSeconds,
+        timeoutSeconds: config.timeoutSeconds || defaultConfig.timeoutSeconds,
+        failureThreshold: config.failureThreshold || defaultConfig.failureThreshold,
+    };
+}
+//# sourceMappingURL=podTemplates.js.map

package/dist/lib/utils/podTemplates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"podTemplates.js","sourceRoot":"","sources":["../../../src/lib/utils/podTemplates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuFH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAqB,EACrB,UAA2B,UAAU;IAErC,MAAM,eAAe,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAElG,MAAM,QAAQ,GAA4B;QACxC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE;YACN,wBAAwB,EAAE,IAAI,CAAC,IAAI;YACnC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SACvB;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED,MAAM,uBAAuB,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC;IACvD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,UAAU;QACV,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,QAAQ;QAC7C,eAAe,EAAE,uBAAuB;KACzC,CAAC;IAEF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAChE,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACxD,CAAC;IAED,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,OAAO;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAqB,EACrB,YAA0B;IAE1B,MAAM,cAAc,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAoB;QACpC,GAAG,IAAI;QACP,MAAM,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;KACrE,CAAC;IAEF,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;QACjC,YAAY,CAAC,aAAa,GAAG,cAAc,CAAC,aAAa,CAAC;IAC5D,CAAC;IAED,OAAO,uBAAuB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAA4B,EAC5B,QAAyB,EACzB,OAAiC;IAEjC,MAAM,IAAI,GAAoB;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,GAAG,aAAa,CAAC,IAAI,MAAM;QACjD,UAAU,EAAE,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC;QACxC,GAAG,OAAO;KACX,CAAC;IAEF,OAAO,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAqB,EACrB,YAOC;IAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7D,GAAG,SAAS;QACZ,aAAa,EAAE,eAAe,CAAC,YAAY,EAAE,UAAU,CAAC;QACxD,cAAc,EAAE,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC;KAC3D,CAAC,CAAC,CAAC;IAEJ,OAAO,uBAAuB,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,SAAS,4BAA4B,CAAC,OAAwB;IAC5D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY;YACf,OAAO;gBACL,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,KAAK;gBACd,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;aAC3C,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,SAAwB,EACxB,OAAwB;IAExB,MAAM,aAAa,GAA4B;QAC7C,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC;IAEF,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACnB,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC;QAClB,aAAa,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACxB,aAAa,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;IACnD,CAAC;IACD,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC3B,aAAa,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC;IACzD,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,aAAa,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;IAC/C,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACnB,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,CAAC,aAAa,EAAE,CAAC;QAC5B,aAAa,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC,aAAa,CAAC;IAC3D,CAAC;IACD,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;QAC7B,aAAa,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;QAC3B,aAAa,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC;IACzD,CAAC;IAED,MAAM,eAAe,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,wBAAwB,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC;IACxD,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IACrE,CAAC;IACD,aAAa,CAAC,iBAAiB,CAAC,GAAG,wBAAwB,CAAC;IAE5D,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAS,2BAA2B,CAAC,OAAwB;IAC3D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY;YACf,OAAO;gBACL,wBAAwB,EAAE,KAAK;gBAC/B,sBAAsB,EAAE,IAAI;gBAC5B,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;gBAC/B,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;aAC3C,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,wBAAwB,EAAE,KAAK;gBAC/B,sBAAsB,EAAE,KAAK;gBAC7B,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;aAChC,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,YAA0B;IAC1D,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,KAAK;YACR,OAAO;gBACL,MAAM,EAAE,EAAE,6BAA6B,EAAE,UAAU,EAAE;gBACrD,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,KAAK,KAAK;YACR,OAAO;gBACL,MAAM,EAAE,EAAE,6BAA6B,EAAE,SAAS,EAAE;gBACpD,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO;gBACL,MAAM,EAAE,EAAE,6BAA6B,EAAE,QAAQ,EAAE;gBACnD,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,KAAK,UAAU;YACb,OAAO;gBACL,MAAM,EAAE,EAAE,6BAA6B,EAAE,UAAU,EAAE;gBACrD,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,MAAM,EAAE,EAAE,6BAA6B,EAAE,OAAO,EAAE;gBAClD,aAAa,EAAE,QAAQ;aACxB,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,MAAM,EAAE,EAAE,6BAA6B,EAAE,OAAO,EAAE;gBAClD,aAAa,EAAE,WAAW;aAC3B,CAAC;QACJ;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,MAOC,EACD,IAA8B;IAE9B,MAAM,QAAQ,GAAG;QACf,QAAQ,EAAE;YACR,mBAAmB,EAAE,EAAE;YACvB,aAAa,EAAE,EAAE;YACjB,cAAc,EAAE,CAAC;YACjB,gBAAgB,EAAE,CAAC;SACpB;QACD,SAAS,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE;KAChG,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IAEnF,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;YAClC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;SAC1B;QACD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,aAAa,CAAC,mBAAmB;QACpF,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,aAAa,CAAC,aAAa;QAClE,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc;QACrE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,aAAa,CAAC,gBAAgB;KAC5E,CAAC;AACJ,CAAC"}

package/dist/lib/utils/resourceNaming.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview Resource naming utilities for Helm chart generation
+ * @since 2.5.0
+ */
+/**
+ * Kubernetes resource object interface
+ * @interface KubernetesResource
+ * @since 2.5.0
+ */
+export interface KubernetesResource {
+    /** Resource kind (e.g., Deployment, Service) */
+    kind?: string;
+    /** Resource metadata */
+    metadata?: {
+        /** Resource name */
+        name?: string;
+        /** Resource namespace */
+        namespace?: string;
+    };
+}
+/**
+ * Naming strategy for manifest files
+ * @since 2.5.0
+ */
+export type NamingStrategy = 'descriptive' | 'numbered' | 'kind-only' | 'name-only';
+/**
+ * Generates descriptive resource name from Kubernetes object
+ * @param resource - Kubernetes resource object
+ * @returns Descriptive name in format "kind-name"
+ * @since 2.5.0
+ */
+export declare function getResourceName(resource: unknown): string;
+/**
+ * Generates manifest file name based on strategy
+ * @param resource - Kubernetes resource object
+ * @param strategy - Naming strategy to use
+ * @param index - Resource index for numbered strategy
+ * @param prefix - Optional prefix for file names
+ * @returns Generated file name without extension
+ * @since 2.5.0
+ */
+export declare function generateManifestName(resource: unknown, strategy?: NamingStrategy, index?: number, prefix?: string): string;
+/**
+ * Sanitizes name for Kubernetes compatibility
+ * @param name - Raw name to sanitize
+ * @returns Kubernetes-compatible name
+ * @since 2.5.0
+ */
+export declare function sanitizeKubernetesName(name: string): string;
+/**
+ * Validates Kubernetes resource name
+ * @param name - Name to validate
+ * @returns True if valid, false otherwise
+ * @since 2.5.0
+ */
+export declare function isValidKubernetesName(name: string): boolean;
+//# sourceMappingURL=resourceNaming.d.ts.map

package/dist/lib/utils/resourceNaming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceNaming.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/resourceNaming.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,QAAQ,CAAC,EAAE;QACT,oBAAoB;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,yBAAyB;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,UAAU,GACV,WAAW,GACX,WAAW,CAAC;AAEhB;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAoBzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EACjB,QAAQ,GAAE,cAA8B,EACxC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAyBR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI3D"}

package/dist/lib/utils/resourceNaming.js

@@ -0,0 +1,82 @@
+/**
+ * @fileoverview Resource naming utilities for Helm chart generation
+ * @since 2.5.0
+ */
+/**
+ * Generates descriptive resource name from Kubernetes object
+ * @param resource - Kubernetes resource object
+ * @returns Descriptive name in format "kind-name"
+ * @since 2.5.0
+ */
+export function getResourceName(resource) {
+    if (!resource || typeof resource !== 'object') {
+        return 'resource';
+    }
+    const k8sResource = resource;
+    if (k8sResource.kind && k8sResource.metadata?.name) {
+        return `${k8sResource.kind.toLowerCase()}-${k8sResource.metadata.name}`;
+    }
+    if (k8sResource.kind) {
+        return k8sResource.kind.toLowerCase();
+    }
+    if (k8sResource.metadata?.name) {
+        return k8sResource.metadata.name;
+    }
+    return 'resource';
+}
+/**
+ * Generates manifest file name based on strategy
+ * @param resource - Kubernetes resource object
+ * @param strategy - Naming strategy to use
+ * @param index - Resource index for numbered strategy
+ * @param prefix - Optional prefix for file names
+ * @returns Generated file name without extension
+ * @since 2.5.0
+ */
+export function generateManifestName(resource, strategy = 'descriptive', index, prefix) {
+    const k8sResource = resource;
+    switch (strategy) {
+        case 'descriptive': {
+            return getResourceName(resource);
+        }
+        case 'numbered': {
+            const paddedIndex = String(index ?? 1).padStart(3, '0');
+            return prefix ? `${prefix}-${paddedIndex}` : `manifests-${paddedIndex}`;
+        }
+        case 'kind-only': {
+            return k8sResource.kind?.toLowerCase() ?? 'resource';
+        }
+        case 'name-only': {
+            return k8sResource.metadata?.name ?? 'resource';
+        }
+        default: {
+            return getResourceName(resource);
+        }
+    }
+}
+/**
+ * Sanitizes name for Kubernetes compatibility
+ * @param name - Raw name to sanitize
+ * @returns Kubernetes-compatible name
+ * @since 2.5.0
+ */
+export function sanitizeKubernetesName(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '')
+        .substring(0, 63);
+}
+/**
+ * Validates Kubernetes resource name
+ * @param name - Name to validate
+ * @returns True if valid, false otherwise
+ * @since 2.5.0
+ */
+export function isValidKubernetesName(name) {
+    // eslint-disable-next-line security/detect-unsafe-regex -- Safe: simple DNS-1123 validation
+    const regex = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;
+    return regex.test(name) && name.length <= 63;
+}
+//# sourceMappingURL=resourceNaming.js.map

package/dist/lib/utils/resourceNaming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceNaming.js","sourceRoot":"","sources":["../../../src/lib/utils/resourceNaming.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6BH;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAiB;IAC/C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,WAAW,GAAG,QAA8B,CAAC;IAEnD,IAAI,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC/B,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAiB,EACjB,WAA2B,aAAa,EACxC,KAAc,EACd,MAAe;IAEf,MAAM,WAAW,GAAG,QAA8B,CAAC;IAEnD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,aAAa,WAAW,EAAE,CAAC;QAC1E,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,OAAO,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,UAAU,CAAC;QACvD,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,OAAO,WAAW,CAAC,QAAQ,EAAE,IAAI,IAAI,UAAU,CAAC;QAClD,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,4FAA4F;IAC5F,MAAM,KAAK,GAAG,iCAAiC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;AAC/C,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "timonel",
   "type": "module",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "description": "Timonel: programmatic Helm chart generator using cdk8s (TypeScript)",
   "bin": {
     "timonel": "dist/cli.js",
@@ -31,13 +31,18 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "security:lint": "eslint .",
-    "security:audit": "pnpm audit --audit-level=moderate",
+    "security:audit": "pnpm audit --audit-level=high",
     "security:check": "pnpm run security:lint && pnpm run security:audit",
     "deps:check": "pnpm outdated",
     "deps:update": "pnpm update --latest",
     "md:lint": "markdownlint \"**/*.md\"",
     "md:fix": "markdownlint --fix \"**/*.md\"",
-    "test": "echo \"No tests specified\" && exit 0",
+    "test": "pnpm test:unit && pnpm test:integration",
+    "test:unit": "vitest run --config vitest.config.ts",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "test:basic-integration": "vitest run tests/integration/basic-chart-generation.int.spec.ts --config vitest.integration.config.ts",
     "ci:check": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm build",
     "release": "semantic-release",
     "release:dry": "semantic-release --dry-run",
@@ -94,6 +99,7 @@
     "@types/node": "^24.3.0",
     "@typescript-eslint/eslint-plugin": "^8.42.0",
     "@typescript-eslint/parser": "^8.42.0",
+    "@vitest/coverage-v8": "^2.1.9",
     "conventional-changelog-cli": "^5.0.0",
     "eslint": "^9.35.0",
     "eslint-config-prettier": "^10.1.8",
@@ -108,7 +114,8 @@
     "markdownlint-cli": "^0.45.0",
     "prettier": "^3.6.2",
     "semantic-release": "^24.2.7",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.2",
+    "vitest": "^2.1.9"
   },
   "files": [
     "dist",