Kubernetes supported resources - Formae

Helm charts

K8S::Helm::Release installs a chart through the embedded Helm SDK and manages the resulting release as one resource. formae owns the release; Helm owns the objects the chart renders, so hooks, hook weights, CRD install ordering and revision history all behave as Helm intends. No helm binary and no Pkl reader are needed.

import "@k8s/helm/Release.pkl" as helm

new helm.Release {
  label = "flux"
  metadata {
    name = "flux"
    namespace = fluxNs.res.name
  }
  chart = "flux2"
  repoURL = "https://fluxcd-community.github.io/helm-charts"
  version = "2.14.0"
}

The objects a release renders are hidden from discovery, since the release stands in for them. See Deploy a Helm chart for the full model, the field reference, and how to migrate from the removed HelmChart wrapper.

Supported resources

Type	Discoverable	Extractable	Comment
K8S::Admissionregistration::MutatingAdmissionPolicy	✅	✅	K8s 1.36+
K8S::Admissionregistration::MutatingWebhookConfiguration	✅	✅
K8S::Admissionregistration::ValidatingWebhookConfiguration	✅	✅
K8S::Apiextensions::CustomResourceDefinition	❌	❌	CRDs are cluster infrastructure; not enumerated during discovery
K8S::Apps::DaemonSet	✅	✅
K8S::Apps::Deployment	✅	✅
K8S::Apps::ReplicaSet	✅	✅
K8S::Apps::StatefulSet	✅	✅
K8S::Autoscaling::HorizontalPodAutoscaler	✅	✅
K8S::Batch::CronJob	✅	✅
K8S::Batch::Job	✅	✅
K8S::Coordination::Lease	✅	✅
K8S::Core::ConfigMap	✅	✅
K8S::Core::Endpoints	✅	✅
K8S::Core::LimitRange	✅	✅
K8S::Core::Namespace	✅	✅
K8S::Core::PersistentVolume	✅	✅
K8S::Core::PersistentVolumeClaim	✅	✅
K8S::Core::Pod	✅	✅
K8S::Core::ResourceQuota	✅	✅
K8S::Core::Secret	✅	✅
K8S::Core::Service	✅	✅
K8S::Core::ServiceAccount	✅	✅
K8S::Custom::Resource	❌	❌	Generic custom resource; one catch-all type spans every CRD kind
K8S::Flowcontrol::FlowSchema	✅	✅
K8S::Flowcontrol::PriorityLevelConfiguration	✅	✅
K8S::Helm::Release	✅	✅	Chart objects are hidden from discovery; the release stands in for them
K8S::Networking::Ingress	✅	✅
K8S::Networking::IngressClass	✅	✅
K8S::Networking::NetworkPolicy	✅	✅
K8S::Node::RuntimeClass	❌	❌
K8S::Policy::PodDisruptionBudget	✅	✅
K8S::Rbac::ClusterRole	❌	❌
K8S::Rbac::ClusterRoleBinding	✅	✅
K8S::Rbac::Role	✅	✅
K8S::Rbac::RoleBinding	✅	✅
K8S::Scheduling::PriorityClass	✅	✅
K8S::Storage::CSIDriver	❌	❌
K8S::Storage::StorageClass	❌	❌

CRDs and arbitrary custom resources are supported via K8S::Apiextensions::CustomResourceDefinition (register the CRD) and the generic K8S::Custom::Resource (manage instances of any CRD kind). Neither is enumerated during discovery. The full per-kind schema lives in the plugin repo.

Discovery filters

formae discover skips a default set of system-installed resources so a fresh managed cluster doesn’t drag control-plane noise into your inventory. Skipped by default:

System namespaces: kube-system, kube-public, kube-node-lease
Default ServiceAccounts and their tokens
Controller-owned Pods (ReplicaSet, DaemonSet, Job, etc.)
system:* ClusterRoles and ClusterRoleBindings
Bootstrap FlowSchemas
Cloud-provider default StorageClasses (gp2, standard, local-path)
Cloud-provider admission webhooks prefixed eks-, gke-, aks-

Want to manage one of these resources instead of skipping it? You’ll need to fork the plugin, remove the matching entry from DiscoveryFilters(), and rebuild.