Roslyn Analyzers📋

[DiagnosticAnalyzer(LanguageNames.CSharp)]
public sealed class KUB060ServiceSelectorMismatch : DiagnosticAnalyzer
{
    public static readonly DiagnosticDescriptor Rule = new(
        id: "KUB060",
        title: "Service selector matches no Pod template",
        messageFormat: "V1Service '{0}' has selector {{{1}}} but no V1PodTemplateSpec in this compilation matches it",
        category: "Kubernetes.Dsl.CrossResource",
        defaultSeverity: DiagnosticSeverity.Warning,
        isEnabledByDefault: true);

    public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics
        => ImmutableArray.Create(Rule);

    public override void Initialize(AnalysisContext context)
    {
        context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.Analyze);
        context.EnableConcurrentExecution();

        context.RegisterCompilationStartAction(compStart =>
        {
            // Collected across the whole compilation:
            var podTemplates = new ConcurrentBag<PodTemplateInfo>();
            var services     = new ConcurrentBag<ServiceInfo>();

            compStart.RegisterSyntaxNodeAction(ctx =>
            {
                if (TryExtractPodTemplate(ctx, out var pt))    podTemplates.Add(pt);
                if (TryExtractServiceSelector(ctx, out var s)) services.Add(s);
            }, SyntaxKind.ObjectCreationExpression, SyntaxKind.InvocationExpression);

            compStart.RegisterCompilationEndAction(end =>
            {
                foreach (var svc in services)
                {
                    if (!podTemplates.Any(pt => pt.Labels.IsSupersetOf(svc.Selector)))
                    {
                        end.ReportDiagnostic(Diagnostic.Create(
                            Rule,
                            svc.Location,
                            svc.Name,
                            FormatSelector(svc.Selector)));
                    }
                }
            });
        });
    }

    private static bool TryExtractServiceSelector(SyntaxNodeAnalysisContext ctx, out ServiceInfo info)
    {
        // Walks ObjectCreationExpressionSyntax for `new V1Service { Spec = ... }` constructions,
        // and InvocationExpressionSyntax for `.WithSelector(...)` builder chains,
        // extracts the (apiVersion, kind, name, selector) tuple, returns true if the node
        // is a V1Service construction.
        // ~80 lines of syntax walking; reusable helper for KUB060-KUB066.
        info = default!;
        return false; // implementation elided
    }

    private static bool TryExtractPodTemplate(SyntaxNodeAnalysisContext ctx, out PodTemplateInfo info)
    {
        // Same shape, walks for V1PodTemplateSpec constructions inside Deployment/StatefulSet/DaemonSet/etc.
        info = default!;
        return false; // implementation elided
    }
}

[DiagnosticAnalyzer(LanguageNames.CSharp)]
public sealed class KUB040ContainerHasNoResourceLimits : DiagnosticAnalyzer
{
    public static readonly DiagnosticDescriptor Rule = new(
        id: "KUB040",
        title: "Container has no resource limits",
        messageFormat: "V1Container '{0}' has no Resources.Limits — add CPU/memory limits or accept namespace defaults",
        category: "Kubernetes.Dsl.BestPractices",
        defaultSeverity: DiagnosticSeverity.Warning,
        isEnabledByDefault: true);

    public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics
        => ImmutableArray.Create(Rule);

    public override void Initialize(AnalysisContext context)
    {
        context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.Analyze);
        context.EnableConcurrentExecution();

        // No CompilationStartAction needed — this is local to a single V1Container construction.
        context.RegisterSyntaxNodeAction(AnalyzeContainer, SyntaxKind.ObjectCreationExpression);
    }

    private void AnalyzeContainer(SyntaxNodeAnalysisContext ctx)
    {
        var creation = (ObjectCreationExpressionSyntax)ctx.Node;
        if (!IsV1Container(creation, ctx.SemanticModel)) return;

        var initializer = creation.Initializer;
        if (initializer is null) return;

        var name = ExtractName(initializer);
        var limits = ExtractResourcesLimits(initializer);

        if (limits is null)
        {
            ctx.ReportDiagnostic(Diagnostic.Create(
                Rule, creation.GetLocation(), name ?? "<unnamed>"));
        }
    }
}

private static IReadOnlyList<VersionId> GetTargets(Compilation compilation)
{
    var attr = compilation.Assembly.GetAttributes()
        .FirstOrDefault(a => a.AttributeClass?.ToDisplayString()
            == "Kubernetes.Dsl.Attributes.KubernetesBundleAttribute");
    if (attr is null) return Array.Empty<VersionId>();

    var targets = attr.NamedArguments
        .FirstOrDefault(na => na.Key == "TargetClusterCompatibility")
        .Value.Values;

    return targets
        .Select(c => VersionId.Parse((string)c.Value!))
        .ToList();
}

#pragma warning disable KUB040 // Container has no resource limits
var sidecar = new V1ContainerBuilder()
    .WithName("init")
    .WithImage("busybox:1.36")
    .Build().Value;
#pragma warning restore KUB040

[*.cs]
dotnet_diagnostic.KUB040.severity = none      # disable globally
dotnet_diagnostic.KUB041.severity = error     # promote liveness probe to error
dotnet_diagnostic.KUB042.severity = silent    # silence latest tag warning in this project

dotnet_diagnostic.KUB081.severity = error     # KEDA target mismatch is an error in our infra
dotnet_diagnostic.KUB085.severity = silent    # Istio PERMISSIVE mTLS warning is too noisy