diff --git a/docs/map/README.md b/docs/map/README.md
new file mode 100644
index 0000000..16757a7
--- /dev/null
+++ b/docs/map/README.md
@@ -0,0 +1,25 @@
+# Coverage map
+
+This directory is a [todography](https://github.com/mkmik/todography) map of
+which Kubernetes kinds have a template in `k8s.libsonnet`.
+
+- Each directory is an *area*: one built-in API group, or one add-on project.
+  Its `AREA.md` says which.
+- Each other `.md` file is one kind. `status = "done"` means it has a
+  template; a missing status means it doesn't yet; `dropped` means it is
+  created by controllers or API calls, so a template would add little.
+- Built-in kinds come from Kubernetes v1.37. Add-on areas cover the projects
+  the library supports plus other widely used ones. Each lists the kinds in
+  the project's CRDs, and its `AREA.md` names the release and CRD source they
+  were checked against. Add-on APIs change
+  versions on their own schedule, so re-check them when bumping.
+- `lib/` holds the shared pieces the templates are built on.
+
+```sh
+todography lint        # check the map
+todography next --all  # what to add next
+todography open        # look at it in a browser
+```
+
+When you add a template to `k8s.libsonnet`, mark its kind as done here in the
+same commit.
diff --git a/docs/map/admission/AREA.md b/docs/map/admission/AREA.md
new file mode 100644
index 0000000..be92abb
--- /dev/null
+++ b/docs/map/admission/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "admissionregistration.k8s.io"
+band = "cluster"
+summary = "Admission webhooks and admission policies"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/admission/mutatingadmissionpolicy.md b/docs/map/admission/mutatingadmissionpolicy.md
new file mode 100644
index 0000000..6e7056e
--- /dev/null
+++ b/docs/map/admission/mutatingadmissionpolicy.md
@@ -0,0 +1,17 @@
++++
+title = "MutatingAdmissionPolicy"
+summary = "In-process mutation rules written in CEL"
+aka = ["admissionregistration.k8s.io/v1 MutatingAdmissionPolicy"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: admissionregistration.k8s.io/v1`, `kind: MutatingAdmissionPolicy`, cluster-wide.
+
+New in v1; wait and see how much it is used.
diff --git a/docs/map/admission/mutatingadmissionpolicybinding.md b/docs/map/admission/mutatingadmissionpolicybinding.md
new file mode 100644
index 0000000..c64c6ae
--- /dev/null
+++ b/docs/map/admission/mutatingadmissionpolicybinding.md
@@ -0,0 +1,15 @@
++++
+title = "MutatingAdmissionPolicyBinding"
+summary = "Turns a MutatingAdmissionPolicy on for some objects"
+aka = ["admissionregistration.k8s.io/v1 MutatingAdmissionPolicyBinding"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: admissionregistration.k8s.io/v1`, `kind: MutatingAdmissionPolicyBinding`, cluster-wide.
diff --git a/docs/map/admission/mutatingwebhookconfiguration.md b/docs/map/admission/mutatingwebhookconfiguration.md
new file mode 100644
index 0000000..4e925b9
--- /dev/null
+++ b/docs/map/admission/mutatingwebhookconfiguration.md
@@ -0,0 +1,18 @@
++++
+title = "MutatingWebhookConfiguration"
+summary = "Sends objects to a webhook that can change them"
+aka = ["admissionregistration.k8s.io/v1 MutatingWebhookConfiguration"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: admissionregistration.k8s.io/v1`, `kind: MutatingWebhookConfiguration`, cluster-wide.
+
+Ships with every operator that has a mutating webhook.
diff --git a/docs/map/admission/validatingadmissionpolicy.md b/docs/map/admission/validatingadmissionpolicy.md
new file mode 100644
index 0000000..36848cc
--- /dev/null
+++ b/docs/map/admission/validatingadmissionpolicy.md
@@ -0,0 +1,18 @@
++++
+title = "ValidatingAdmissionPolicy"
+summary = "In-process validation rules written in CEL"
+aka = ["admissionregistration.k8s.io/v1 ValidatingAdmissionPolicy"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: admissionregistration.k8s.io/v1`, `kind: ValidatingAdmissionPolicy`, cluster-wide.
+
+v1 since Kubernetes 1.30.
diff --git a/docs/map/admission/validatingadmissionpolicybinding.md b/docs/map/admission/validatingadmissionpolicybinding.md
new file mode 100644
index 0000000..8dbbe01
--- /dev/null
+++ b/docs/map/admission/validatingadmissionpolicybinding.md
@@ -0,0 +1,16 @@
++++
+title = "ValidatingAdmissionPolicyBinding"
+summary = "Turns a ValidatingAdmissionPolicy on for some objects"
+aka = ["admissionregistration.k8s.io/v1 ValidatingAdmissionPolicyBinding"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: admissionregistration.k8s.io/v1`, `kind: ValidatingAdmissionPolicyBinding`, cluster-wide.
diff --git a/docs/map/admission/validatingwebhookconfiguration.md b/docs/map/admission/validatingwebhookconfiguration.md
new file mode 100644
index 0000000..a614eed
--- /dev/null
+++ b/docs/map/admission/validatingwebhookconfiguration.md
@@ -0,0 +1,18 @@
++++
+title = "ValidatingWebhookConfiguration"
+summary = "Sends objects to a webhook that can reject them"
+aka = ["admissionregistration.k8s.io/v1 ValidatingWebhookConfiguration"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: admissionregistration.k8s.io/v1`, `kind: ValidatingWebhookConfiguration`, cluster-wide.
+
+Ships with every operator that has a validating webhook.
diff --git a/docs/map/apiextensions/AREA.md b/docs/map/apiextensions/AREA.md
new file mode 100644
index 0000000..bce080d
--- /dev/null
+++ b/docs/map/apiextensions/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "apiextensions.k8s.io"
+band = "cluster"
+summary = "CustomResourceDefinitions"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['apiextensions.k8s.io'].v1`.
diff --git a/docs/map/apiextensions/customresourcedefinition.md b/docs/map/apiextensions/customresourcedefinition.md
new file mode 100644
index 0000000..4c3e72a
--- /dev/null
+++ b/docs/map/apiextensions/customresourcedefinition.md
@@ -0,0 +1,18 @@
++++
+title = "CustomResourceDefinition"
+summary = "Adds a new kind to the API"
+aka = ["apiextensions.k8s.io/v1 CustomResourceDefinition", "crd"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: apiextensions.k8s.io/v1`, `kind: CustomResourceDefinition`, cluster-wide.
+
+Template only.
diff --git a/docs/map/apiregistration/AREA.md b/docs/map/apiregistration/AREA.md
new file mode 100644
index 0000000..2d40fb3
--- /dev/null
+++ b/docs/map/apiregistration/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "apiregistration.k8s.io"
+band = "cluster"
+summary = "Aggregated API servers"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/apiregistration/apiservice.md b/docs/map/apiregistration/apiservice.md
new file mode 100644
index 0000000..da3f547
--- /dev/null
+++ b/docs/map/apiregistration/apiservice.md
@@ -0,0 +1,17 @@
++++
+title = "APIService"
+summary = "Plugs an extra API server into the main one"
+aka = ["apiregistration.k8s.io/v1 APIService"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: apiregistration.k8s.io/v1`, `kind: APIService`, cluster-wide.
+
+Ships with metrics-server and similar.
diff --git a/docs/map/apiserver-internal/AREA.md b/docs/map/apiserver-internal/AREA.md
new file mode 100644
index 0000000..dd77c83
--- /dev/null
+++ b/docs/map/apiserver-internal/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "internal.apiserver.k8s.io"
+band = "runtime"
+summary = "Storage versions (alpha)"
++++
+
+Every kind in this group is created by the cluster or by API calls, so none of them needs a template.
diff --git a/docs/map/apiserver-internal/storageversion.md b/docs/map/apiserver-internal/storageversion.md
new file mode 100644
index 0000000..992f13b
--- /dev/null
+++ b/docs/map/apiserver-internal/storageversion.md
@@ -0,0 +1,17 @@
++++
+title = "StorageVersion"
+summary = "Which version each API server stores"
+aka = ["internal.apiserver.k8s.io/v1alpha1 StorageVersion"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: internal.apiserver.k8s.io/v1alpha1`, `kind: StorageVersion`, cluster-wide.
+
+Alpha, and written by API servers.
diff --git a/docs/map/apps/AREA.md b/docs/map/apps/AREA.md
new file mode 100644
index 0000000..73a0a41
--- /dev/null
+++ b/docs/map/apps/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "apps"
+band = "workloads"
+summary = "Deployments, StatefulSets and DaemonSets"
++++
+
+Templates live in `k8s.libsonnet` under `k8s.apps.v1`.
diff --git a/docs/map/apps/controllerrevision.md b/docs/map/apps/controllerrevision.md
new file mode 100644
index 0000000..d79e3e9
--- /dev/null
+++ b/docs/map/apps/controllerrevision.md
@@ -0,0 +1,13 @@
++++
+title = "ControllerRevision"
+summary = "A saved revision of a StatefulSet or DaemonSet"
+aka = ["apps/v1 ControllerRevision"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: apps/v1`, `kind: ControllerRevision`.
+
+Created by the cluster or by API calls, not written by hand, so a template would add little.
diff --git a/docs/map/apps/daemonset.md b/docs/map/apps/daemonset.md
new file mode 100644
index 0000000..6d0a87a
--- /dev/null
+++ b/docs/map/apps/daemonset.md
@@ -0,0 +1,25 @@
++++
+title = "DaemonSet"
+summary = "One pod on every node"
+aka = ["apps/v1 DaemonSet", "ds"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "pod-overlays"
+title = "Pod template gets the shared PodTemplateSpec overlays"
+status = "done"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: apps/v1`, `kind: DaemonSet`.
diff --git a/docs/map/apps/deployment.md b/docs/map/apps/deployment.md
new file mode 100644
index 0000000..d550800
--- /dev/null
+++ b/docs/map/apps/deployment.md
@@ -0,0 +1,27 @@
++++
+title = "Deployment"
+summary = "Keeps a set of identical pods running"
+aka = ["apps/v1 Deployment", "deploy"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "pod-overlays"
+title = "Pod template gets the shared PodTemplateSpec overlays"
+status = "done"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: apps/v1`, `kind: Deployment`.
+
+The main workload kind.
diff --git a/docs/map/apps/replicaset.md b/docs/map/apps/replicaset.md
new file mode 100644
index 0000000..234bb21
--- /dev/null
+++ b/docs/map/apps/replicaset.md
@@ -0,0 +1,13 @@
++++
+title = "ReplicaSet"
+summary = "Keeps N copies of a pod"
+aka = ["apps/v1 ReplicaSet", "rs"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: apps/v1`, `kind: ReplicaSet`.
+
+Created and managed by Deployments.
diff --git a/docs/map/apps/statefulset.md b/docs/map/apps/statefulset.md
new file mode 100644
index 0000000..09f1bc9
--- /dev/null
+++ b/docs/map/apps/statefulset.md
@@ -0,0 +1,32 @@
++++
+title = "StatefulSet"
+summary = "Pods with stable names and their own storage"
+aka = ["apps/v1 StatefulSet", "sts"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "pod-overlays"
+title = "Pod template gets the shared PodTemplateSpec overlays"
+status = "done"
+
+[[feature]]
+id = "volume-claim-templates"
+title = "volumeClaimTemplates_ keyed by metadata.name"
+status = "done"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: apps/v1`, `kind: StatefulSet`.
+
+`serviceName` is optional (documented so since Kubernetes v1.33), so the template doesn't require it.
diff --git a/docs/map/argo-cd/AREA.md b/docs/map/argo-cd/AREA.md
new file mode 100644
index 0000000..c5b7246
--- /dev/null
+++ b/docs/map/argo-cd/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Argo CD"
+band = "addons"
+summary = "argoproj.io: GitOps deployment"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against Argo CD v3.5.5: https://github.com/argoproj/argo-cd/tree/v3.5.5/manifests/crds. Argo Rollouts and Argo Workflows share the argoproj.io group but are separate projects, not mapped.
diff --git a/docs/map/argo-cd/application.md b/docs/map/argo-cd/application.md
new file mode 100644
index 0000000..d141bad
--- /dev/null
+++ b/docs/map/argo-cd/application.md
@@ -0,0 +1,14 @@
++++
+title = "Application"
+summary = "Something Argo CD deploys from Git and keeps in sync"
+aka = ["argoproj.io/v1alpha1 Application", "app"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: argoproj.io/v1alpha1`, `kind: Application`.
+
+Very common in GitOps repositories.
diff --git a/docs/map/argo-cd/applicationset.md b/docs/map/argo-cd/applicationset.md
new file mode 100644
index 0000000..a8b6ba1
--- /dev/null
+++ b/docs/map/argo-cd/applicationset.md
@@ -0,0 +1,11 @@
++++
+title = "ApplicationSet"
+summary = "Generates Applications from a template"
+aka = ["argoproj.io/v1alpha1 ApplicationSet", "appset"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: argoproj.io/v1alpha1`, `kind: ApplicationSet`.
diff --git a/docs/map/argo-cd/appproject.md b/docs/map/argo-cd/appproject.md
new file mode 100644
index 0000000..57e4955
--- /dev/null
+++ b/docs/map/argo-cd/appproject.md
@@ -0,0 +1,14 @@
++++
+title = "AppProject"
+summary = "Limits what a group of Argo CD Applications may deploy, and where"
+aka = ["argoproj.io/v1alpha1 AppProject", "appproj"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: argoproj.io/v1alpha1`, `kind: AppProject`.
+
+Very common in GitOps repositories.
diff --git a/docs/map/authentication/AREA.md b/docs/map/authentication/AREA.md
new file mode 100644
index 0000000..397d329
--- /dev/null
+++ b/docs/map/authentication/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "authentication.k8s.io"
+band = "runtime"
+summary = "Token and identity reviews"
++++
+
+Every kind in this group is created by the cluster or by API calls, so none of them needs a template.
diff --git a/docs/map/authentication/selfsubjectreview.md b/docs/map/authentication/selfsubjectreview.md
new file mode 100644
index 0000000..0807610
--- /dev/null
+++ b/docs/map/authentication/selfsubjectreview.md
@@ -0,0 +1,17 @@
++++
+title = "SelfSubjectReview"
+summary = "Asks who the caller is"
+aka = ["authentication.k8s.io/v1 SelfSubjectReview"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: authentication.k8s.io/v1`, `kind: SelfSubjectReview`, cluster-wide.
+
+An API call, not a stored object.
diff --git a/docs/map/authentication/tokenreview.md b/docs/map/authentication/tokenreview.md
new file mode 100644
index 0000000..1f9f038
--- /dev/null
+++ b/docs/map/authentication/tokenreview.md
@@ -0,0 +1,17 @@
++++
+title = "TokenReview"
+summary = "Checks a token"
+aka = ["authentication.k8s.io/v1 TokenReview"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: authentication.k8s.io/v1`, `kind: TokenReview`, cluster-wide.
+
+An API call, not a stored object.
diff --git a/docs/map/authorization/AREA.md b/docs/map/authorization/AREA.md
new file mode 100644
index 0000000..1c18ed3
--- /dev/null
+++ b/docs/map/authorization/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "authorization.k8s.io"
+band = "runtime"
+summary = "Access reviews"
++++
+
+Every kind in this group is created by the cluster or by API calls, so none of them needs a template.
diff --git a/docs/map/authorization/localsubjectaccessreview.md b/docs/map/authorization/localsubjectaccessreview.md
new file mode 100644
index 0000000..3180fcc
--- /dev/null
+++ b/docs/map/authorization/localsubjectaccessreview.md
@@ -0,0 +1,13 @@
++++
+title = "LocalSubjectAccessReview"
+summary = "Asks whether someone may do something in a namespace"
+aka = ["authorization.k8s.io/v1 LocalSubjectAccessReview"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: authorization.k8s.io/v1`, `kind: LocalSubjectAccessReview`.
+
+An API call, not a stored object.
diff --git a/docs/map/authorization/selfsubjectaccessreview.md b/docs/map/authorization/selfsubjectaccessreview.md
new file mode 100644
index 0000000..ee228b5
--- /dev/null
+++ b/docs/map/authorization/selfsubjectaccessreview.md
@@ -0,0 +1,17 @@
++++
+title = "SelfSubjectAccessReview"
+summary = "Asks whether the caller may do something"
+aka = ["authorization.k8s.io/v1 SelfSubjectAccessReview"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: authorization.k8s.io/v1`, `kind: SelfSubjectAccessReview`, cluster-wide.
+
+An API call, not a stored object.
diff --git a/docs/map/authorization/selfsubjectrulesreview.md b/docs/map/authorization/selfsubjectrulesreview.md
new file mode 100644
index 0000000..11ed4de
--- /dev/null
+++ b/docs/map/authorization/selfsubjectrulesreview.md
@@ -0,0 +1,17 @@
++++
+title = "SelfSubjectRulesReview"
+summary = "Lists what the caller may do"
+aka = ["authorization.k8s.io/v1 SelfSubjectRulesReview"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: authorization.k8s.io/v1`, `kind: SelfSubjectRulesReview`, cluster-wide.
+
+An API call, not a stored object.
diff --git a/docs/map/authorization/subjectaccessreview.md b/docs/map/authorization/subjectaccessreview.md
new file mode 100644
index 0000000..e2ffa4e
--- /dev/null
+++ b/docs/map/authorization/subjectaccessreview.md
@@ -0,0 +1,17 @@
++++
+title = "SubjectAccessReview"
+summary = "Asks whether someone may do something"
+aka = ["authorization.k8s.io/v1 SubjectAccessReview"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: authorization.k8s.io/v1`, `kind: SubjectAccessReview`, cluster-wide.
+
+An API call, not a stored object.
diff --git a/docs/map/autoscaling/AREA.md b/docs/map/autoscaling/AREA.md
new file mode 100644
index 0000000..e9aa674
--- /dev/null
+++ b/docs/map/autoscaling/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "autoscaling"
+band = "workloads"
+summary = "Horizontal pod autoscaling"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/autoscaling/horizontalpodautoscaler.md b/docs/map/autoscaling/horizontalpodautoscaler.md
new file mode 100644
index 0000000..a1db7d5
--- /dev/null
+++ b/docs/map/autoscaling/horizontalpodautoscaler.md
@@ -0,0 +1,14 @@
++++
+title = "HorizontalPodAutoscaler"
+summary = "Scales a workload by CPU, memory or custom metrics"
+aka = ["autoscaling/v2 HorizontalPodAutoscaler", "hpa"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: autoscaling/v2`, `kind: HorizontalPodAutoscaler`.
+
+Sits next to almost every Deployment. Use `autoscaling/v2`; v1 only knows CPU.
diff --git a/docs/map/batch/AREA.md b/docs/map/batch/AREA.md
new file mode 100644
index 0000000..2ebe29c
--- /dev/null
+++ b/docs/map/batch/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "batch"
+band = "workloads"
+summary = "Jobs and CronJobs"
++++
+
+Templates live in `k8s.libsonnet` under `k8s.batch.v1`.
diff --git a/docs/map/batch/cronjob.md b/docs/map/batch/cronjob.md
new file mode 100644
index 0000000..a5ab2ee
--- /dev/null
+++ b/docs/map/batch/cronjob.md
@@ -0,0 +1,27 @@
++++
+title = "CronJob"
+summary = "A Job on a schedule"
+aka = ["batch/v1 CronJob", "cj"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "pod-overlays"
+title = "Pod template gets the shared PodTemplateSpec overlays"
+status = "done"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: batch/v1`, `kind: CronJob`.
+
+The pod template inside `jobTemplate` gets the shared overlays.
diff --git a/docs/map/batch/job.md b/docs/map/batch/job.md
new file mode 100644
index 0000000..e13a089
--- /dev/null
+++ b/docs/map/batch/job.md
@@ -0,0 +1,25 @@
++++
+title = "Job"
+summary = "Pods that run to completion"
+aka = ["batch/v1 Job"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "pod-overlays"
+title = "Pod template gets the shared PodTemplateSpec overlays"
+status = "done"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: batch/v1`, `kind: Job`.
diff --git a/docs/map/cert-manager/AREA.md b/docs/map/cert-manager/AREA.md
new file mode 100644
index 0000000..6964773
--- /dev/null
+++ b/docs/map/cert-manager/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "cert-manager"
+band = "addons"
+summary = "cert-manager.io: certificates and issuers"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['cert-manager.io'].v1`.
+
+Checked against cert-manager v1.21.2: https://github.com/cert-manager/cert-manager/releases/download/v1.21.2/cert-manager.crds.yaml
diff --git a/docs/map/cert-manager/certificate.md b/docs/map/cert-manager/certificate.md
new file mode 100644
index 0000000..cd9dac6
--- /dev/null
+++ b/docs/map/cert-manager/certificate.md
@@ -0,0 +1,14 @@
++++
+title = "Certificate"
+summary = "A certificate cert-manager keeps renewed"
+aka = ["cert-manager.io/v1 Certificate", "cert"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
++++
+
+`apiVersion: cert-manager.io/v1`, `kind: Certificate`.
+
+Template only.
diff --git a/docs/map/cert-manager/certificaterequest.md b/docs/map/cert-manager/certificaterequest.md
new file mode 100644
index 0000000..b79bcb7
--- /dev/null
+++ b/docs/map/cert-manager/certificaterequest.md
@@ -0,0 +1,13 @@
++++
+title = "CertificateRequest"
+summary = "One request to sign a certificate"
+aka = ["cert-manager.io/v1 CertificateRequest", "cr"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: cert-manager.io/v1`, `kind: CertificateRequest`.
+
+Created by cert-manager for each Certificate.
diff --git a/docs/map/cert-manager/challenge.md b/docs/map/cert-manager/challenge.md
new file mode 100644
index 0000000..ed45629
--- /dev/null
+++ b/docs/map/cert-manager/challenge.md
@@ -0,0 +1,13 @@
++++
+title = "Challenge"
+summary = "An ACME challenge"
+aka = ["acme.cert-manager.io/v1 Challenge"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: acme.cert-manager.io/v1`, `kind: Challenge`.
+
+Created by cert-manager.
diff --git a/docs/map/cert-manager/clusterissuer.md b/docs/map/cert-manager/clusterissuer.md
new file mode 100644
index 0000000..2a27c28
--- /dev/null
+++ b/docs/map/cert-manager/clusterissuer.md
@@ -0,0 +1,18 @@
++++
+title = "ClusterIssuer"
+summary = "Where the whole cluster gets its certificates from"
+aka = ["cert-manager.io/v1 ClusterIssuer"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cert-manager.io/v1`, `kind: ClusterIssuer`, cluster-wide.
+
+Without a template it picks up the shared namespace.
diff --git a/docs/map/cert-manager/issuer.md b/docs/map/cert-manager/issuer.md
new file mode 100644
index 0000000..0b54206
--- /dev/null
+++ b/docs/map/cert-manager/issuer.md
@@ -0,0 +1,14 @@
++++
+title = "Issuer"
+summary = "Where a namespace gets its certificates from"
+aka = ["cert-manager.io/v1 Issuer"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: cert-manager.io/v1`, `kind: Issuer`.
+
+Usually written next to the Certificates that use it.
diff --git a/docs/map/cert-manager/order.md b/docs/map/cert-manager/order.md
new file mode 100644
index 0000000..156fc9b
--- /dev/null
+++ b/docs/map/cert-manager/order.md
@@ -0,0 +1,13 @@
++++
+title = "Order"
+summary = "An ACME order"
+aka = ["acme.cert-manager.io/v1 Order"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: acme.cert-manager.io/v1`, `kind: Order`.
+
+Created by cert-manager.
diff --git a/docs/map/certificates/AREA.md b/docs/map/certificates/AREA.md
new file mode 100644
index 0000000..d317aee
--- /dev/null
+++ b/docs/map/certificates/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "certificates.k8s.io"
+band = "cluster"
+summary = "Certificate signing requests and trust bundles"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/certificates/certificatesigningrequest.md b/docs/map/certificates/certificatesigningrequest.md
new file mode 100644
index 0000000..87603f4
--- /dev/null
+++ b/docs/map/certificates/certificatesigningrequest.md
@@ -0,0 +1,17 @@
++++
+title = "CertificateSigningRequest"
+summary = "A request to sign a certificate"
+aka = ["certificates.k8s.io/v1 CertificateSigningRequest", "csr"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: certificates.k8s.io/v1`, `kind: CertificateSigningRequest`, cluster-wide.
+
+Created by clients and kubelets.
diff --git a/docs/map/certificates/clustertrustbundle.md b/docs/map/certificates/clustertrustbundle.md
new file mode 100644
index 0000000..bbdbef9
--- /dev/null
+++ b/docs/map/certificates/clustertrustbundle.md
@@ -0,0 +1,15 @@
++++
+title = "ClusterTrustBundle"
+summary = "CA certificates pods can mount"
+aka = ["certificates.k8s.io/v1 ClusterTrustBundle"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: certificates.k8s.io/v1`, `kind: ClusterTrustBundle`, cluster-wide.
diff --git a/docs/map/certificates/podcertificaterequest.md b/docs/map/certificates/podcertificaterequest.md
new file mode 100644
index 0000000..f1ef878
--- /dev/null
+++ b/docs/map/certificates/podcertificaterequest.md
@@ -0,0 +1,13 @@
++++
+title = "PodCertificateRequest"
+summary = "A pod asking for a certificate"
+aka = ["certificates.k8s.io/v1 PodCertificateRequest"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: certificates.k8s.io/v1`, `kind: PodCertificateRequest`.
+
+Created by the kubelet.
diff --git a/docs/map/cilium/AREA.md b/docs/map/cilium/AREA.md
new file mode 100644
index 0000000..f00df41
--- /dev/null
+++ b/docs/map/cilium/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Cilium"
+band = "addons"
+summary = "cilium.io: networking, network policy and BGP"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against Cilium v1.20.3: https://github.com/cilium/cilium/tree/v1.20.3/pkg/k8s/apis/cilium.io/client/crds
diff --git a/docs/map/cilium/ciliumbgpadvertisement.md b/docs/map/cilium/ciliumbgpadvertisement.md
new file mode 100644
index 0000000..3d68b9b
--- /dev/null
+++ b/docs/map/cilium/ciliumbgpadvertisement.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumBGPAdvertisement"
+summary = "Which routes BGP announces"
+aka = ["cilium.io/v2 CiliumBGPAdvertisement"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumBGPAdvertisement`, cluster-wide.
diff --git a/docs/map/cilium/ciliumbgpclusterconfig.md b/docs/map/cilium/ciliumbgpclusterconfig.md
new file mode 100644
index 0000000..6d25c8c
--- /dev/null
+++ b/docs/map/cilium/ciliumbgpclusterconfig.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumBGPClusterConfig"
+summary = "Which nodes run BGP, and with whom"
+aka = ["cilium.io/v2 CiliumBGPClusterConfig"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumBGPClusterConfig`, cluster-wide.
diff --git a/docs/map/cilium/ciliumbgpnodeconfig.md b/docs/map/cilium/ciliumbgpnodeconfig.md
new file mode 100644
index 0000000..4911f17
--- /dev/null
+++ b/docs/map/cilium/ciliumbgpnodeconfig.md
@@ -0,0 +1,17 @@
++++
+title = "CiliumBGPNodeConfig"
+summary = "BGP settings Cilium works out for one node"
+aka = ["cilium.io/v2 CiliumBGPNodeConfig"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumBGPNodeConfig`, cluster-wide.
+
+Generated from CiliumBGPClusterConfig.
diff --git a/docs/map/cilium/ciliumbgpnodeconfigoverride.md b/docs/map/cilium/ciliumbgpnodeconfigoverride.md
new file mode 100644
index 0000000..5073565
--- /dev/null
+++ b/docs/map/cilium/ciliumbgpnodeconfigoverride.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumBGPNodeConfigOverride"
+summary = "BGP settings for one node"
+aka = ["cilium.io/v2 CiliumBGPNodeConfigOverride"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumBGPNodeConfigOverride`, cluster-wide.
diff --git a/docs/map/cilium/ciliumbgppeerconfig.md b/docs/map/cilium/ciliumbgppeerconfig.md
new file mode 100644
index 0000000..574bbda
--- /dev/null
+++ b/docs/map/cilium/ciliumbgppeerconfig.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumBGPPeerConfig"
+summary = "Settings for a BGP peer"
+aka = ["cilium.io/v2 CiliumBGPPeerConfig"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumBGPPeerConfig`, cluster-wide.
diff --git a/docs/map/cilium/ciliumcidrgroup.md b/docs/map/cilium/ciliumcidrgroup.md
new file mode 100644
index 0000000..0d1f647
--- /dev/null
+++ b/docs/map/cilium/ciliumcidrgroup.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumCIDRGroup"
+summary = "A named list of IP ranges for policies"
+aka = ["cilium.io/v2 CiliumCIDRGroup"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumCIDRGroup`, cluster-wide.
diff --git a/docs/map/cilium/ciliumclusterwideenvoyconfig.md b/docs/map/cilium/ciliumclusterwideenvoyconfig.md
new file mode 100644
index 0000000..3deb891
--- /dev/null
+++ b/docs/map/cilium/ciliumclusterwideenvoyconfig.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumClusterwideEnvoyConfig"
+summary = "Envoy settings for the whole cluster"
+aka = ["cilium.io/v2 CiliumClusterwideEnvoyConfig", "ccec"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumClusterwideEnvoyConfig`, cluster-wide.
diff --git a/docs/map/cilium/ciliumclusterwidenetworkpolicy.md b/docs/map/cilium/ciliumclusterwidenetworkpolicy.md
new file mode 100644
index 0000000..ed94f1d
--- /dev/null
+++ b/docs/map/cilium/ciliumclusterwidenetworkpolicy.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumClusterwideNetworkPolicy"
+summary = "A CiliumNetworkPolicy for the whole cluster"
+aka = ["cilium.io/v2 CiliumClusterwideNetworkPolicy", "ccnp"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumClusterwideNetworkPolicy`, cluster-wide.
diff --git a/docs/map/cilium/ciliumdatapathplugin.md b/docs/map/cilium/ciliumdatapathplugin.md
new file mode 100644
index 0000000..717fef8
--- /dev/null
+++ b/docs/map/cilium/ciliumdatapathplugin.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumDatapathPlugin"
+summary = "Plugs extra programs into the datapath"
+aka = ["cilium.io/v2alpha1 CiliumDatapathPlugin"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2alpha1`, `kind: CiliumDatapathPlugin`, cluster-wide.
diff --git a/docs/map/cilium/ciliumegressgatewaypolicy.md b/docs/map/cilium/ciliumegressgatewaypolicy.md
new file mode 100644
index 0000000..181767a
--- /dev/null
+++ b/docs/map/cilium/ciliumegressgatewaypolicy.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumEgressGatewayPolicy"
+summary = "Sends outgoing traffic through chosen nodes"
+aka = ["cilium.io/v2 CiliumEgressGatewayPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumEgressGatewayPolicy`, cluster-wide.
diff --git a/docs/map/cilium/ciliumendpoint.md b/docs/map/cilium/ciliumendpoint.md
new file mode 100644
index 0000000..c7d120b
--- /dev/null
+++ b/docs/map/cilium/ciliumendpoint.md
@@ -0,0 +1,13 @@
++++
+title = "CiliumEndpoint"
+summary = "A pod as Cilium sees it"
+aka = ["cilium.io/v2 CiliumEndpoint", "cep"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumEndpoint`.
+
+Written by the Cilium agent.
diff --git a/docs/map/cilium/ciliumendpointslice.md b/docs/map/cilium/ciliumendpointslice.md
new file mode 100644
index 0000000..a8acae6
--- /dev/null
+++ b/docs/map/cilium/ciliumendpointslice.md
@@ -0,0 +1,17 @@
++++
+title = "CiliumEndpointSlice"
+summary = "Groups CiliumEndpoints"
+aka = ["cilium.io/v2alpha1 CiliumEndpointSlice"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2alpha1`, `kind: CiliumEndpointSlice`, cluster-wide.
+
+Written by the Cilium operator.
diff --git a/docs/map/cilium/ciliumenvoyconfig.md b/docs/map/cilium/ciliumenvoyconfig.md
new file mode 100644
index 0000000..001c233
--- /dev/null
+++ b/docs/map/cilium/ciliumenvoyconfig.md
@@ -0,0 +1,11 @@
++++
+title = "CiliumEnvoyConfig"
+summary = "Envoy settings for some services"
+aka = ["cilium.io/v2 CiliumEnvoyConfig", "cec"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumEnvoyConfig`.
diff --git a/docs/map/cilium/ciliumgatewayclassconfig.md b/docs/map/cilium/ciliumgatewayclassconfig.md
new file mode 100644
index 0000000..3efed13
--- /dev/null
+++ b/docs/map/cilium/ciliumgatewayclassconfig.md
@@ -0,0 +1,11 @@
++++
+title = "CiliumGatewayClassConfig"
+summary = "Settings for Cilium's Gateway API classes"
+aka = ["cilium.io/v2alpha1 CiliumGatewayClassConfig"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cilium.io/v2alpha1`, `kind: CiliumGatewayClassConfig`.
diff --git a/docs/map/cilium/ciliumidentity.md b/docs/map/cilium/ciliumidentity.md
new file mode 100644
index 0000000..09ff4b9
--- /dev/null
+++ b/docs/map/cilium/ciliumidentity.md
@@ -0,0 +1,17 @@
++++
+title = "CiliumIdentity"
+summary = "A security identity"
+aka = ["cilium.io/v2 CiliumIdentity"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumIdentity`, cluster-wide.
+
+Written by Cilium.
diff --git a/docs/map/cilium/ciliuml2announcementpolicy.md b/docs/map/cilium/ciliuml2announcementpolicy.md
new file mode 100644
index 0000000..ba78bca
--- /dev/null
+++ b/docs/map/cilium/ciliuml2announcementpolicy.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumL2AnnouncementPolicy"
+summary = "Which nodes answer ARP for service IPs"
+aka = ["cilium.io/v2alpha1 CiliumL2AnnouncementPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2alpha1`, `kind: CiliumL2AnnouncementPolicy`, cluster-wide.
diff --git a/docs/map/cilium/ciliumloadbalancerippool.md b/docs/map/cilium/ciliumloadbalancerippool.md
new file mode 100644
index 0000000..104410f
--- /dev/null
+++ b/docs/map/cilium/ciliumloadbalancerippool.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumLoadBalancerIPPool"
+summary = "IPs that LoadBalancer services may get"
+aka = ["cilium.io/v2 CiliumLoadBalancerIPPool"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumLoadBalancerIPPool`, cluster-wide.
diff --git a/docs/map/cilium/ciliumlocalredirectpolicy.md b/docs/map/cilium/ciliumlocalredirectpolicy.md
new file mode 100644
index 0000000..dd895e2
--- /dev/null
+++ b/docs/map/cilium/ciliumlocalredirectpolicy.md
@@ -0,0 +1,11 @@
++++
+title = "CiliumLocalRedirectPolicy"
+summary = "Sends traffic to a pod on the same node"
+aka = ["cilium.io/v2 CiliumLocalRedirectPolicy", "clrp"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumLocalRedirectPolicy`.
diff --git a/docs/map/cilium/ciliumnetworkpolicy.md b/docs/map/cilium/ciliumnetworkpolicy.md
new file mode 100644
index 0000000..82a2ce2
--- /dev/null
+++ b/docs/map/cilium/ciliumnetworkpolicy.md
@@ -0,0 +1,11 @@
++++
+title = "CiliumNetworkPolicy"
+summary = "Network policy with L7 and DNS rules"
+aka = ["cilium.io/v2 CiliumNetworkPolicy", "cnp"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumNetworkPolicy`.
diff --git a/docs/map/cilium/ciliumnode.md b/docs/map/cilium/ciliumnode.md
new file mode 100644
index 0000000..e006634
--- /dev/null
+++ b/docs/map/cilium/ciliumnode.md
@@ -0,0 +1,17 @@
++++
+title = "CiliumNode"
+summary = "A node as Cilium sees it"
+aka = ["cilium.io/v2 CiliumNode", "cn"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumNode`, cluster-wide.
+
+Written by the Cilium agent.
diff --git a/docs/map/cilium/ciliumnodeconfig.md b/docs/map/cilium/ciliumnodeconfig.md
new file mode 100644
index 0000000..5496852
--- /dev/null
+++ b/docs/map/cilium/ciliumnodeconfig.md
@@ -0,0 +1,11 @@
++++
+title = "CiliumNodeConfig"
+summary = "Agent settings for some nodes"
+aka = ["cilium.io/v2 CiliumNodeConfig"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cilium.io/v2`, `kind: CiliumNodeConfig`.
diff --git a/docs/map/cilium/ciliumpodippool.md b/docs/map/cilium/ciliumpodippool.md
new file mode 100644
index 0000000..fcbd489
--- /dev/null
+++ b/docs/map/cilium/ciliumpodippool.md
@@ -0,0 +1,15 @@
++++
+title = "CiliumPodIPPool"
+summary = "An IP pool pods can get addresses from"
+aka = ["cilium.io/v2alpha1 CiliumPodIPPool"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: cilium.io/v2alpha1`, `kind: CiliumPodIPPool`, cluster-wide.
diff --git a/docs/map/cloudnative-pg/AREA.md b/docs/map/cloudnative-pg/AREA.md
new file mode 100644
index 0000000..56b287e
--- /dev/null
+++ b/docs/map/cloudnative-pg/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "CloudNativePG"
+band = "addons"
+summary = "postgresql.cnpg.io: PostgreSQL clusters"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against CloudNativePG v1.30.1: https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.30.1/cnpg-1.30.1.yaml
diff --git a/docs/map/cloudnative-pg/backup.md b/docs/map/cloudnative-pg/backup.md
new file mode 100644
index 0000000..c995acc
--- /dev/null
+++ b/docs/map/cloudnative-pg/backup.md
@@ -0,0 +1,13 @@
++++
+title = "Backup"
+summary = "One backup"
+aka = ["postgresql.cnpg.io/v1 Backup"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: Backup`.
+
+Usually created by a ScheduledBackup or on demand.
diff --git a/docs/map/cloudnative-pg/cluster.md b/docs/map/cloudnative-pg/cluster.md
new file mode 100644
index 0000000..bf60553
--- /dev/null
+++ b/docs/map/cloudnative-pg/cluster.md
@@ -0,0 +1,11 @@
++++
+title = "Cluster"
+summary = "A PostgreSQL cluster"
+aka = ["postgresql.cnpg.io/v1 Cluster"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: Cluster`.
diff --git a/docs/map/cloudnative-pg/clusterimagecatalog.md b/docs/map/cloudnative-pg/clusterimagecatalog.md
new file mode 100644
index 0000000..0e29bdc
--- /dev/null
+++ b/docs/map/cloudnative-pg/clusterimagecatalog.md
@@ -0,0 +1,15 @@
++++
+title = "ClusterImageCatalog"
+summary = "PostgreSQL images to pick from, for the whole cluster"
+aka = ["postgresql.cnpg.io/v1 ClusterImageCatalog"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: ClusterImageCatalog`, cluster-wide.
diff --git a/docs/map/cloudnative-pg/database.md b/docs/map/cloudnative-pg/database.md
new file mode 100644
index 0000000..a0421c8
--- /dev/null
+++ b/docs/map/cloudnative-pg/database.md
@@ -0,0 +1,11 @@
++++
+title = "Database"
+summary = "A database inside a cluster"
+aka = ["postgresql.cnpg.io/v1 Database"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: Database`.
diff --git a/docs/map/cloudnative-pg/databaserole.md b/docs/map/cloudnative-pg/databaserole.md
new file mode 100644
index 0000000..a5ba20e
--- /dev/null
+++ b/docs/map/cloudnative-pg/databaserole.md
@@ -0,0 +1,11 @@
++++
+title = "DatabaseRole"
+summary = "A role inside a cluster"
+aka = ["postgresql.cnpg.io/v1 DatabaseRole"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: DatabaseRole`.
diff --git a/docs/map/cloudnative-pg/failoverquorum.md b/docs/map/cloudnative-pg/failoverquorum.md
new file mode 100644
index 0000000..6a5ec5b
--- /dev/null
+++ b/docs/map/cloudnative-pg/failoverquorum.md
@@ -0,0 +1,13 @@
++++
+title = "FailoverQuorum"
+summary = "Failover state for synchronous replication"
+aka = ["postgresql.cnpg.io/v1 FailoverQuorum"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: FailoverQuorum`.
+
+Written by the operator.
diff --git a/docs/map/cloudnative-pg/imagecatalog.md b/docs/map/cloudnative-pg/imagecatalog.md
new file mode 100644
index 0000000..07772b6
--- /dev/null
+++ b/docs/map/cloudnative-pg/imagecatalog.md
@@ -0,0 +1,11 @@
++++
+title = "ImageCatalog"
+summary = "PostgreSQL images to pick from, for one namespace"
+aka = ["postgresql.cnpg.io/v1 ImageCatalog"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: ImageCatalog`.
diff --git a/docs/map/cloudnative-pg/pooler.md b/docs/map/cloudnative-pg/pooler.md
new file mode 100644
index 0000000..3156564
--- /dev/null
+++ b/docs/map/cloudnative-pg/pooler.md
@@ -0,0 +1,11 @@
++++
+title = "Pooler"
+summary = "A PgBouncer connection pool in front of a cluster"
+aka = ["postgresql.cnpg.io/v1 Pooler"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: Pooler`.
diff --git a/docs/map/cloudnative-pg/publication.md b/docs/map/cloudnative-pg/publication.md
new file mode 100644
index 0000000..e4dec75
--- /dev/null
+++ b/docs/map/cloudnative-pg/publication.md
@@ -0,0 +1,11 @@
++++
+title = "Publication"
+summary = "A logical replication publication"
+aka = ["postgresql.cnpg.io/v1 Publication"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: Publication`.
diff --git a/docs/map/cloudnative-pg/scheduledbackup.md b/docs/map/cloudnative-pg/scheduledbackup.md
new file mode 100644
index 0000000..e51ab3f
--- /dev/null
+++ b/docs/map/cloudnative-pg/scheduledbackup.md
@@ -0,0 +1,11 @@
++++
+title = "ScheduledBackup"
+summary = "Takes backups on a schedule"
+aka = ["postgresql.cnpg.io/v1 ScheduledBackup"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: ScheduledBackup`.
diff --git a/docs/map/cloudnative-pg/subscription.md b/docs/map/cloudnative-pg/subscription.md
new file mode 100644
index 0000000..d905885
--- /dev/null
+++ b/docs/map/cloudnative-pg/subscription.md
@@ -0,0 +1,11 @@
++++
+title = "Subscription"
+summary = "A logical replication subscription"
+aka = ["postgresql.cnpg.io/v1 Subscription"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: postgresql.cnpg.io/v1`, `kind: Subscription`.
diff --git a/docs/map/cluster-api/AREA.md b/docs/map/cluster-api/AREA.md
new file mode 100644
index 0000000..f9d38b3
--- /dev/null
+++ b/docs/map/cluster-api/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Cluster API"
+band = "official"
+summary = "cluster.x-k8s.io and friends: clusters managed as Kubernetes objects"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against Cluster API v1.14.3 (core, kubeadm bootstrap and control plane, IPAM, runtime extensions): https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.14.3/cluster-api-components.yaml. Infrastructure providers add their own kinds and are not mapped.
diff --git a/docs/map/cluster-api/cluster.md b/docs/map/cluster-api/cluster.md
new file mode 100644
index 0000000..e916766
--- /dev/null
+++ b/docs/map/cluster-api/cluster.md
@@ -0,0 +1,11 @@
++++
+title = "Cluster"
+summary = "A Kubernetes cluster that Cluster API manages"
+aka = ["cluster.x-k8s.io/v1beta2 Cluster"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cluster.x-k8s.io/v1beta2`, `kind: Cluster`.
diff --git a/docs/map/cluster-api/clusterclass.md b/docs/map/cluster-api/clusterclass.md
new file mode 100644
index 0000000..581adb2
--- /dev/null
+++ b/docs/map/cluster-api/clusterclass.md
@@ -0,0 +1,11 @@
++++
+title = "ClusterClass"
+summary = "A reusable template for clusters"
+aka = ["cluster.x-k8s.io/v1beta2 ClusterClass"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cluster.x-k8s.io/v1beta2`, `kind: ClusterClass`.
diff --git a/docs/map/cluster-api/clusterresourceset.md b/docs/map/cluster-api/clusterresourceset.md
new file mode 100644
index 0000000..80b38e3
--- /dev/null
+++ b/docs/map/cluster-api/clusterresourceset.md
@@ -0,0 +1,11 @@
++++
+title = "ClusterResourceSet"
+summary = "Applies a set of objects to matching clusters"
+aka = ["addons.cluster.x-k8s.io/v1beta2 ClusterResourceSet", "crs"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: addons.cluster.x-k8s.io/v1beta2`, `kind: ClusterResourceSet`.
diff --git a/docs/map/cluster-api/clusterresourcesetbinding.md b/docs/map/cluster-api/clusterresourcesetbinding.md
new file mode 100644
index 0000000..9b638d8
--- /dev/null
+++ b/docs/map/cluster-api/clusterresourcesetbinding.md
@@ -0,0 +1,13 @@
++++
+title = "ClusterResourceSetBinding"
+summary = "Records which ClusterResourceSets reached a cluster"
+aka = ["addons.cluster.x-k8s.io/v1beta2 ClusterResourceSetBinding"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: addons.cluster.x-k8s.io/v1beta2`, `kind: ClusterResourceSetBinding`.
+
+Created by the cluster or by API calls, not written by hand, so a template would add little.
diff --git a/docs/map/cluster-api/extensionconfig.md b/docs/map/cluster-api/extensionconfig.md
new file mode 100644
index 0000000..58d4251
--- /dev/null
+++ b/docs/map/cluster-api/extensionconfig.md
@@ -0,0 +1,15 @@
++++
+title = "ExtensionConfig"
+summary = "Registers a runtime extension server"
+aka = ["runtime.cluster.x-k8s.io/v1beta2 ExtensionConfig"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: runtime.cluster.x-k8s.io/v1beta2`, `kind: ExtensionConfig`, cluster-wide.
diff --git a/docs/map/cluster-api/ipaddress.md b/docs/map/cluster-api/ipaddress.md
new file mode 100644
index 0000000..20a9110
--- /dev/null
+++ b/docs/map/cluster-api/ipaddress.md
@@ -0,0 +1,13 @@
++++
+title = "IPAddress"
+summary = "An address handed out by an IP pool"
+aka = ["ipam.cluster.x-k8s.io/v1beta2 IPAddress"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: ipam.cluster.x-k8s.io/v1beta2`, `kind: IPAddress`.
+
+Created by IPAM providers.
diff --git a/docs/map/cluster-api/ipaddressclaim.md b/docs/map/cluster-api/ipaddressclaim.md
new file mode 100644
index 0000000..a9f14d2
--- /dev/null
+++ b/docs/map/cluster-api/ipaddressclaim.md
@@ -0,0 +1,11 @@
++++
+title = "IPAddressClaim"
+summary = "Asks an IP pool for an address"
+aka = ["ipam.cluster.x-k8s.io/v1beta2 IPAddressClaim"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: ipam.cluster.x-k8s.io/v1beta2`, `kind: IPAddressClaim`.
diff --git a/docs/map/cluster-api/kubeadmconfig.md b/docs/map/cluster-api/kubeadmconfig.md
new file mode 100644
index 0000000..8ed328c
--- /dev/null
+++ b/docs/map/cluster-api/kubeadmconfig.md
@@ -0,0 +1,13 @@
++++
+title = "KubeadmConfig"
+summary = "kubeadm settings for one machine"
+aka = ["bootstrap.cluster.x-k8s.io/v1beta2 KubeadmConfig"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: bootstrap.cluster.x-k8s.io/v1beta2`, `kind: KubeadmConfig`.
+
+Created from a KubeadmConfigTemplate.
diff --git a/docs/map/cluster-api/kubeadmconfigtemplate.md b/docs/map/cluster-api/kubeadmconfigtemplate.md
new file mode 100644
index 0000000..59fe954
--- /dev/null
+++ b/docs/map/cluster-api/kubeadmconfigtemplate.md
@@ -0,0 +1,11 @@
++++
+title = "KubeadmConfigTemplate"
+summary = "How kubeadm sets up each new machine"
+aka = ["bootstrap.cluster.x-k8s.io/v1beta2 KubeadmConfigTemplate"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: bootstrap.cluster.x-k8s.io/v1beta2`, `kind: KubeadmConfigTemplate`.
diff --git a/docs/map/cluster-api/kubeadmcontrolplane.md b/docs/map/cluster-api/kubeadmcontrolplane.md
new file mode 100644
index 0000000..53ea78e
--- /dev/null
+++ b/docs/map/cluster-api/kubeadmcontrolplane.md
@@ -0,0 +1,11 @@
++++
+title = "KubeadmControlPlane"
+summary = "A control plane run with kubeadm"
+aka = ["controlplane.cluster.x-k8s.io/v1beta2 KubeadmControlPlane", "kcp"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: controlplane.cluster.x-k8s.io/v1beta2`, `kind: KubeadmControlPlane`.
diff --git a/docs/map/cluster-api/kubeadmcontrolplanetemplate.md b/docs/map/cluster-api/kubeadmcontrolplanetemplate.md
new file mode 100644
index 0000000..49599d0
--- /dev/null
+++ b/docs/map/cluster-api/kubeadmcontrolplanetemplate.md
@@ -0,0 +1,11 @@
++++
+title = "KubeadmControlPlaneTemplate"
+summary = "A template for kubeadm control planes, for ClusterClass"
+aka = ["controlplane.cluster.x-k8s.io/v1beta2 KubeadmControlPlaneTemplate"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: controlplane.cluster.x-k8s.io/v1beta2`, `kind: KubeadmControlPlaneTemplate`.
diff --git a/docs/map/cluster-api/machine.md b/docs/map/cluster-api/machine.md
new file mode 100644
index 0000000..0a392e3
--- /dev/null
+++ b/docs/map/cluster-api/machine.md
@@ -0,0 +1,13 @@
++++
+title = "Machine"
+summary = "One node that Cluster API manages"
+aka = ["cluster.x-k8s.io/v1beta2 Machine", "ma"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: cluster.x-k8s.io/v1beta2`, `kind: Machine`.
+
+Created by MachineSets and control planes.
diff --git a/docs/map/cluster-api/machinedeployment.md b/docs/map/cluster-api/machinedeployment.md
new file mode 100644
index 0000000..9e8e1f4
--- /dev/null
+++ b/docs/map/cluster-api/machinedeployment.md
@@ -0,0 +1,11 @@
++++
+title = "MachineDeployment"
+summary = "Keeps a set of identical machines, like a Deployment for nodes"
+aka = ["cluster.x-k8s.io/v1beta2 MachineDeployment", "md"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cluster.x-k8s.io/v1beta2`, `kind: MachineDeployment`.
diff --git a/docs/map/cluster-api/machinedrainrule.md b/docs/map/cluster-api/machinedrainrule.md
new file mode 100644
index 0000000..bf29dee
--- /dev/null
+++ b/docs/map/cluster-api/machinedrainrule.md
@@ -0,0 +1,11 @@
++++
+title = "MachineDrainRule"
+summary = "How to drain pods off a machine before removing it"
+aka = ["cluster.x-k8s.io/v1beta2 MachineDrainRule"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cluster.x-k8s.io/v1beta2`, `kind: MachineDrainRule`.
diff --git a/docs/map/cluster-api/machinehealthcheck.md b/docs/map/cluster-api/machinehealthcheck.md
new file mode 100644
index 0000000..1df2fea
--- /dev/null
+++ b/docs/map/cluster-api/machinehealthcheck.md
@@ -0,0 +1,11 @@
++++
+title = "MachineHealthCheck"
+summary = "Replaces machines that become unhealthy"
+aka = ["cluster.x-k8s.io/v1beta2 MachineHealthCheck", "mhc"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cluster.x-k8s.io/v1beta2`, `kind: MachineHealthCheck`.
diff --git a/docs/map/cluster-api/machinepool.md b/docs/map/cluster-api/machinepool.md
new file mode 100644
index 0000000..640a2b1
--- /dev/null
+++ b/docs/map/cluster-api/machinepool.md
@@ -0,0 +1,11 @@
++++
+title = "MachinePool"
+summary = "A group of machines run by a cloud scaling group"
+aka = ["cluster.x-k8s.io/v1beta2 MachinePool", "mp"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: cluster.x-k8s.io/v1beta2`, `kind: MachinePool`.
diff --git a/docs/map/cluster-api/machineset.md b/docs/map/cluster-api/machineset.md
new file mode 100644
index 0000000..aaaee8c
--- /dev/null
+++ b/docs/map/cluster-api/machineset.md
@@ -0,0 +1,13 @@
++++
+title = "MachineSet"
+summary = "Keeps N copies of a machine"
+aka = ["cluster.x-k8s.io/v1beta2 MachineSet", "ms"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: cluster.x-k8s.io/v1beta2`, `kind: MachineSet`.
+
+Created by MachineDeployments.
diff --git a/docs/map/coordination/AREA.md b/docs/map/coordination/AREA.md
new file mode 100644
index 0000000..be7f333
--- /dev/null
+++ b/docs/map/coordination/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "coordination.k8s.io"
+band = "runtime"
+summary = "Leases for leader election"
++++
+
+Every kind in this group is created by the cluster or by API calls, so none of them needs a template.
diff --git a/docs/map/coordination/lease.md b/docs/map/coordination/lease.md
new file mode 100644
index 0000000..2cd6747
--- /dev/null
+++ b/docs/map/coordination/lease.md
@@ -0,0 +1,13 @@
++++
+title = "Lease"
+summary = "A lock for leader election and node heartbeats"
+aka = ["coordination.k8s.io/v1 Lease"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: coordination.k8s.io/v1`, `kind: Lease`.
+
+Created by the programs that hold it.
diff --git a/docs/map/coordination/leasecandidate.md b/docs/map/coordination/leasecandidate.md
new file mode 100644
index 0000000..cba0ea3
--- /dev/null
+++ b/docs/map/coordination/leasecandidate.md
@@ -0,0 +1,13 @@
++++
+title = "LeaseCandidate"
+summary = "A candidate in coordinated leader election"
+aka = ["coordination.k8s.io/v1beta1 LeaseCandidate"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: coordination.k8s.io/v1beta1`, `kind: LeaseCandidate`.
+
+Created by the cluster or by API calls, not written by hand, so a template would add little.
diff --git a/docs/map/core/AREA.md b/docs/map/core/AREA.md
new file mode 100644
index 0000000..576717c
--- /dev/null
+++ b/docs/map/core/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "Core (v1)"
+band = "workloads"
+summary = "The core API group, apiVersion v1"
++++
+
+Templates live in `k8s.libsonnet` under `k8s.v1`.
diff --git a/docs/map/core/binding.md b/docs/map/core/binding.md
new file mode 100644
index 0000000..722be74
--- /dev/null
+++ b/docs/map/core/binding.md
@@ -0,0 +1,13 @@
++++
+title = "Binding"
+summary = "Assigns a pod to a node"
+aka = ["v1 Binding"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: v1`, `kind: Binding`.
+
+Created by the scheduler.
diff --git a/docs/map/core/componentstatus.md b/docs/map/core/componentstatus.md
new file mode 100644
index 0000000..aff1b14
--- /dev/null
+++ b/docs/map/core/componentstatus.md
@@ -0,0 +1,13 @@
++++
+title = "ComponentStatus"
+summary = "Health of control plane components"
+aka = ["v1 ComponentStatus", "cs"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: v1`, `kind: ComponentStatus`.
+
+Read-only and deprecated.
diff --git a/docs/map/core/configmap.md b/docs/map/core/configmap.md
new file mode 100644
index 0000000..dac0d4f
--- /dev/null
+++ b/docs/map/core/configmap.md
@@ -0,0 +1,14 @@
++++
+title = "ConfigMap"
+summary = "Plain configuration data"
+aka = ["v1 ConfigMap", "cm"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
++++
+
+`apiVersion: v1`, `kind: ConfigMap`.
+
+Template only.
diff --git a/docs/map/core/endpoints.md b/docs/map/core/endpoints.md
new file mode 100644
index 0000000..b7e2abd
--- /dev/null
+++ b/docs/map/core/endpoints.md
@@ -0,0 +1,13 @@
++++
+title = "Endpoints"
+summary = "The old way to list a service's backends"
+aka = ["v1 Endpoints", "ep"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: v1`, `kind: Endpoints`.
+
+Replaced by EndpointSlice, and filled in by the cluster.
diff --git a/docs/map/core/event.md b/docs/map/core/event.md
new file mode 100644
index 0000000..71cc0bd
--- /dev/null
+++ b/docs/map/core/event.md
@@ -0,0 +1,13 @@
++++
+title = "Event"
+summary = "Something that happened to an object"
+aka = ["v1 Event", "ev"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: v1`, `kind: Event`.
+
+Created by the cluster or by API calls, not written by hand, so a template would add little.
diff --git a/docs/map/core/limitrange.md b/docs/map/core/limitrange.md
new file mode 100644
index 0000000..ff21179
--- /dev/null
+++ b/docs/map/core/limitrange.md
@@ -0,0 +1,14 @@
++++
+title = "LimitRange"
+summary = "Default and maximum resources per pod or container in a namespace"
+aka = ["v1 LimitRange", "limits"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m3"
++++
+
+`apiVersion: v1`, `kind: LimitRange`.
+
+Usually part of setting up a namespace.
diff --git a/docs/map/core/namespace.md b/docs/map/core/namespace.md
new file mode 100644
index 0000000..54beae5
--- /dev/null
+++ b/docs/map/core/namespace.md
@@ -0,0 +1,18 @@
++++
+title = "Namespace"
+summary = "A namespace"
+aka = ["v1 Namespace", "ns"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: v1`, `kind: Namespace`, cluster-wide.
+
+Does not pick up the namespace set on the shared `ObjectMeta`.
diff --git a/docs/map/core/node.md b/docs/map/core/node.md
new file mode 100644
index 0000000..41bec82
--- /dev/null
+++ b/docs/map/core/node.md
@@ -0,0 +1,13 @@
++++
+title = "Node"
+summary = "A machine in the cluster"
+aka = ["v1 Node", "no"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: v1`, `kind: Node`.
+
+Registered by the kubelet.
diff --git a/docs/map/core/persistentvolume.md b/docs/map/core/persistentvolume.md
new file mode 100644
index 0000000..d9313dc
--- /dev/null
+++ b/docs/map/core/persistentvolume.md
@@ -0,0 +1,18 @@
++++
+title = "PersistentVolume"
+summary = "A piece of storage in the cluster"
+aka = ["v1 PersistentVolume", "pv"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: v1`, `kind: PersistentVolume`, cluster-wide.
+
+Without a template it picks up the shared namespace.
diff --git a/docs/map/core/persistentvolumeclaim.md b/docs/map/core/persistentvolumeclaim.md
new file mode 100644
index 0000000..12effe8
--- /dev/null
+++ b/docs/map/core/persistentvolumeclaim.md
@@ -0,0 +1,24 @@
++++
+title = "PersistentVolumeClaim"
+summary = "A request for storage"
+aka = ["v1 PersistentVolumeClaim", "pvc"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "in-statefulset"
+title = "Inside StatefulSet volumeClaimTemplates_, keyed by metadata.name"
+status = "done"
+
+[[feature]]
+id = "template"
+title = "Standalone template"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: v1`, `kind: PersistentVolumeClaim`.
+
+Today a PVC only gets help inside a StatefulSet. A standalone template would let a PVC share the same overlays.
diff --git a/docs/map/core/pod.md b/docs/map/core/pod.md
new file mode 100644
index 0000000..f3773d9
--- /dev/null
+++ b/docs/map/core/pod.md
@@ -0,0 +1,27 @@
++++
+title = "Pod"
+summary = "A bare pod, with the same overlays as every pod template"
+aka = ["v1 Pod", "po"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "pod-overlays"
+title = "Pod template gets the shared PodTemplateSpec overlays"
+status = "done"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: v1`, `kind: Pod`.
+
+Uses the same `PodTemplateSpec` as the workload kinds, so overlays on it reach bare pods too.
diff --git a/docs/map/core/podtemplate.md b/docs/map/core/podtemplate.md
new file mode 100644
index 0000000..718ba09
--- /dev/null
+++ b/docs/map/core/podtemplate.md
@@ -0,0 +1,17 @@
++++
+title = "PodTemplate"
+summary = "A stored pod template"
+aka = ["v1 PodTemplate"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: v1`, `kind: PodTemplate`.
+
+Rarely written by hand. If added, it should use the shared `PodTemplateSpec`.
diff --git a/docs/map/core/replicationcontroller.md b/docs/map/core/replicationcontroller.md
new file mode 100644
index 0000000..e8a67c3
--- /dev/null
+++ b/docs/map/core/replicationcontroller.md
@@ -0,0 +1,13 @@
++++
+title = "ReplicationController"
+summary = "The old way to keep pods running"
+aka = ["v1 ReplicationController", "rc"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: v1`, `kind: ReplicationController`.
+
+Legacy: use a Deployment.
diff --git a/docs/map/core/resourcequota.md b/docs/map/core/resourcequota.md
new file mode 100644
index 0000000..36f32ad
--- /dev/null
+++ b/docs/map/core/resourcequota.md
@@ -0,0 +1,14 @@
++++
+title = "ResourceQuota"
+summary = "Resource limits for a whole namespace"
+aka = ["v1 ResourceQuota", "quota"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m3"
++++
+
+`apiVersion: v1`, `kind: ResourceQuota`.
+
+Usually part of setting up a namespace.
diff --git a/docs/map/core/secret.md b/docs/map/core/secret.md
new file mode 100644
index 0000000..c0c3978
--- /dev/null
+++ b/docs/map/core/secret.md
@@ -0,0 +1,14 @@
++++
+title = "Secret"
+summary = "Secret configuration data"
+aka = ["v1 Secret"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
++++
+
+`apiVersion: v1`, `kind: Secret`.
+
+Template only.
diff --git a/docs/map/core/service.md b/docs/map/core/service.md
new file mode 100644
index 0000000..0aef385
--- /dev/null
+++ b/docs/map/core/service.md
@@ -0,0 +1,27 @@
++++
+title = "Service"
+summary = "A stable address in front of pods"
+aka = ["v1 Service", "svc"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "named-ports"
+title = "ports_ keyed by name"
+status = "done"
+
+[[needs]]
+on = "/lib/named-arrays"
+why = "Its arrays are keyed by name"
++++
+
+`apiVersion: v1`, `kind: Service`.
+
+Write ports as `ports_+: { http: { port: 80 } }` so overlays can change one port by name.
diff --git a/docs/map/core/serviceaccount.md b/docs/map/core/serviceaccount.md
new file mode 100644
index 0000000..478604d
--- /dev/null
+++ b/docs/map/core/serviceaccount.md
@@ -0,0 +1,14 @@
++++
+title = "ServiceAccount"
+summary = "An identity for pods"
+aka = ["v1 ServiceAccount", "sa"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
++++
+
+`apiVersion: v1`, `kind: ServiceAccount`.
+
+Template only. RBAC bindings can point at one with `ServiceAccountRef`.
diff --git a/docs/map/discovery/AREA.md b/docs/map/discovery/AREA.md
new file mode 100644
index 0000000..5efa8ca
--- /dev/null
+++ b/docs/map/discovery/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "discovery.k8s.io"
+band = "workloads"
+summary = "EndpointSlices"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/discovery/endpointslice.md b/docs/map/discovery/endpointslice.md
new file mode 100644
index 0000000..a0657d8
--- /dev/null
+++ b/docs/map/discovery/endpointslice.md
@@ -0,0 +1,13 @@
++++
+title = "EndpointSlice"
+summary = "A slice of a Service's backends"
+aka = ["discovery.k8s.io/v1 EndpointSlice"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: discovery.k8s.io/v1`, `kind: EndpointSlice`.
+
+Usually filled in by the cluster. Written by hand only for Services without a selector.
diff --git a/docs/map/events/AREA.md b/docs/map/events/AREA.md
new file mode 100644
index 0000000..bd1dacc
--- /dev/null
+++ b/docs/map/events/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "events.k8s.io"
+band = "runtime"
+summary = "Events"
++++
+
+Every kind in this group is created by the cluster or by API calls, so none of them needs a template.
diff --git a/docs/map/events/event.md b/docs/map/events/event.md
new file mode 100644
index 0000000..ceec2bb
--- /dev/null
+++ b/docs/map/events/event.md
@@ -0,0 +1,13 @@
++++
+title = "Event"
+summary = "Something that happened to an object"
+aka = ["events.k8s.io/v1 Event", "ev"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: events.k8s.io/v1`, `kind: Event`.
+
+Created by the cluster or by API calls, not written by hand, so a template would add little.
diff --git a/docs/map/external-secrets/AREA.md b/docs/map/external-secrets/AREA.md
new file mode 100644
index 0000000..31228e3
--- /dev/null
+++ b/docs/map/external-secrets/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "External Secrets"
+band = "addons"
+summary = "external-secrets.io: syncs secrets from outside stores"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against External Secrets v2.13.0: https://github.com/external-secrets/external-secrets/blob/v2.13.0/deploy/crds/bundle.yaml. The 19 secret generator kinds in generators.external-secrets.io (Password, ECRAuthorizationToken, ...) are not mapped one by one.
diff --git a/docs/map/external-secrets/clusterexternalsecret.md b/docs/map/external-secrets/clusterexternalsecret.md
new file mode 100644
index 0000000..ede7d13
--- /dev/null
+++ b/docs/map/external-secrets/clusterexternalsecret.md
@@ -0,0 +1,15 @@
++++
+title = "ClusterExternalSecret"
+summary = "Creates the same ExternalSecret in many namespaces"
+aka = ["external-secrets.io/v1 ClusterExternalSecret", "ces"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: external-secrets.io/v1`, `kind: ClusterExternalSecret`, cluster-wide.
diff --git a/docs/map/external-secrets/clusterpushsecret.md b/docs/map/external-secrets/clusterpushsecret.md
new file mode 100644
index 0000000..033c684
--- /dev/null
+++ b/docs/map/external-secrets/clusterpushsecret.md
@@ -0,0 +1,15 @@
++++
+title = "ClusterPushSecret"
+summary = "A PushSecret for many namespaces"
+aka = ["external-secrets.io/v1alpha1 ClusterPushSecret"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: external-secrets.io/v1alpha1`, `kind: ClusterPushSecret`, cluster-wide.
diff --git a/docs/map/external-secrets/clustersecretstore.md b/docs/map/external-secrets/clustersecretstore.md
new file mode 100644
index 0000000..02086bf
--- /dev/null
+++ b/docs/map/external-secrets/clustersecretstore.md
@@ -0,0 +1,18 @@
++++
+title = "ClusterSecretStore"
+summary = "How the whole cluster reaches an outside secret store"
+aka = ["external-secrets.io/v1 ClusterSecretStore", "css"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: external-secrets.io/v1`, `kind: ClusterSecretStore`, cluster-wide.
+
+Without a template it picks up the shared namespace.
diff --git a/docs/map/external-secrets/externalsecret.md b/docs/map/external-secrets/externalsecret.md
new file mode 100644
index 0000000..a1f0604
--- /dev/null
+++ b/docs/map/external-secrets/externalsecret.md
@@ -0,0 +1,14 @@
++++
+title = "ExternalSecret"
+summary = "Copies values from an outside secret store into a Secret"
+aka = ["external-secrets.io/v1 ExternalSecret", "es"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: external-secrets.io/v1`, `kind: ExternalSecret`.
+
+Very common in GitOps repositories.
diff --git a/docs/map/external-secrets/pushsecret.md b/docs/map/external-secrets/pushsecret.md
new file mode 100644
index 0000000..5ecdd13
--- /dev/null
+++ b/docs/map/external-secrets/pushsecret.md
@@ -0,0 +1,11 @@
++++
+title = "PushSecret"
+summary = "Copies a Secret out to an outside store"
+aka = ["external-secrets.io/v1alpha1 PushSecret"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: external-secrets.io/v1alpha1`, `kind: PushSecret`.
diff --git a/docs/map/external-secrets/secretstore.md b/docs/map/external-secrets/secretstore.md
new file mode 100644
index 0000000..1d0d7d2
--- /dev/null
+++ b/docs/map/external-secrets/secretstore.md
@@ -0,0 +1,14 @@
++++
+title = "SecretStore"
+summary = "How a namespace reaches an outside secret store"
+aka = ["external-secrets.io/v1 SecretStore", "ss"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: external-secrets.io/v1`, `kind: SecretStore`.
+
+ExternalSecrets point at a SecretStore or a ClusterSecretStore.
diff --git a/docs/map/flowcontrol/AREA.md b/docs/map/flowcontrol/AREA.md
new file mode 100644
index 0000000..72cfad2
--- /dev/null
+++ b/docs/map/flowcontrol/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "flowcontrol.apiserver.k8s.io"
+band = "cluster"
+summary = "API server priority and fairness"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/flowcontrol/flowschema.md b/docs/map/flowcontrol/flowschema.md
new file mode 100644
index 0000000..8621a3d
--- /dev/null
+++ b/docs/map/flowcontrol/flowschema.md
@@ -0,0 +1,15 @@
++++
+title = "FlowSchema"
+summary = "Sorts API requests into priority levels"
+aka = ["flowcontrol.apiserver.k8s.io/v1 FlowSchema"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: flowcontrol.apiserver.k8s.io/v1`, `kind: FlowSchema`, cluster-wide.
diff --git a/docs/map/flowcontrol/prioritylevelconfiguration.md b/docs/map/flowcontrol/prioritylevelconfiguration.md
new file mode 100644
index 0000000..ed5f88e
--- /dev/null
+++ b/docs/map/flowcontrol/prioritylevelconfiguration.md
@@ -0,0 +1,15 @@
++++
+title = "PriorityLevelConfiguration"
+summary = "How much API server capacity a priority level gets"
+aka = ["flowcontrol.apiserver.k8s.io/v1 PriorityLevelConfiguration"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: flowcontrol.apiserver.k8s.io/v1`, `kind: PriorityLevelConfiguration`, cluster-wide.
diff --git a/docs/map/flux/AREA.md b/docs/map/flux/AREA.md
new file mode 100644
index 0000000..2ec6566
--- /dev/null
+++ b/docs/map/flux/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Flux"
+band = "addons"
+summary = "toolkit.fluxcd.io groups: GitOps deployment"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against Flux v2.9.6: https://github.com/fluxcd/flux2/releases/download/v2.9.6/install.yaml. Kinds come from several groups: source, kustomize, helm, notification and image (all .toolkit.fluxcd.io).
diff --git a/docs/map/flux/alert.md b/docs/map/flux/alert.md
new file mode 100644
index 0000000..b4b806b
--- /dev/null
+++ b/docs/map/flux/alert.md
@@ -0,0 +1,11 @@
++++
+title = "Alert"
+summary = "Which Flux events to send, and where"
+aka = ["notification.toolkit.fluxcd.io/v1beta3 Alert"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: notification.toolkit.fluxcd.io/v1beta3`, `kind: Alert`.
diff --git a/docs/map/flux/artifactgenerator.md b/docs/map/flux/artifactgenerator.md
new file mode 100644
index 0000000..495fa21
--- /dev/null
+++ b/docs/map/flux/artifactgenerator.md
@@ -0,0 +1,11 @@
++++
+title = "ArtifactGenerator"
+summary = "Builds a new artifact out of other sources"
+aka = ["source.extensions.fluxcd.io/v1beta1 ArtifactGenerator"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: source.extensions.fluxcd.io/v1beta1`, `kind: ArtifactGenerator`.
diff --git a/docs/map/flux/bucket.md b/docs/map/flux/bucket.md
new file mode 100644
index 0000000..c434c85
--- /dev/null
+++ b/docs/map/flux/bucket.md
@@ -0,0 +1,11 @@
++++
+title = "Bucket"
+summary = "An S3-style bucket Flux watches"
+aka = ["source.toolkit.fluxcd.io/v1 Bucket"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: source.toolkit.fluxcd.io/v1`, `kind: Bucket`.
diff --git a/docs/map/flux/externalartifact.md b/docs/map/flux/externalartifact.md
new file mode 100644
index 0000000..8150950
--- /dev/null
+++ b/docs/map/flux/externalartifact.md
@@ -0,0 +1,13 @@
++++
+title = "ExternalArtifact"
+summary = "An artifact produced by another controller"
+aka = ["source.toolkit.fluxcd.io/v1 ExternalArtifact"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: source.toolkit.fluxcd.io/v1`, `kind: ExternalArtifact`.
+
+Written by controllers, not by hand.
diff --git a/docs/map/flux/gitrepository.md b/docs/map/flux/gitrepository.md
new file mode 100644
index 0000000..429474d
--- /dev/null
+++ b/docs/map/flux/gitrepository.md
@@ -0,0 +1,11 @@
++++
+title = "GitRepository"
+summary = "A Git repository Flux watches"
+aka = ["source.toolkit.fluxcd.io/v1 GitRepository", "gitrepo"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: source.toolkit.fluxcd.io/v1`, `kind: GitRepository`.
diff --git a/docs/map/flux/helmchart.md b/docs/map/flux/helmchart.md
new file mode 100644
index 0000000..ba174ff
--- /dev/null
+++ b/docs/map/flux/helmchart.md
@@ -0,0 +1,13 @@
++++
+title = "HelmChart"
+summary = "A chart fetched for a HelmRelease"
+aka = ["source.toolkit.fluxcd.io/v1 HelmChart"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: source.toolkit.fluxcd.io/v1`, `kind: HelmChart`.
+
+Usually created by Flux for each HelmRelease.
diff --git a/docs/map/flux/helmrelease.md b/docs/map/flux/helmrelease.md
new file mode 100644
index 0000000..6fdc06f
--- /dev/null
+++ b/docs/map/flux/helmrelease.md
@@ -0,0 +1,11 @@
++++
+title = "HelmRelease"
+summary = "Installs and upgrades a Helm chart"
+aka = ["helm.toolkit.fluxcd.io/v2 HelmRelease", "hr"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: helm.toolkit.fluxcd.io/v2`, `kind: HelmRelease`.
diff --git a/docs/map/flux/helmrepository.md b/docs/map/flux/helmrepository.md
new file mode 100644
index 0000000..7834170
--- /dev/null
+++ b/docs/map/flux/helmrepository.md
@@ -0,0 +1,11 @@
++++
+title = "HelmRepository"
+summary = "A Helm chart repository"
+aka = ["source.toolkit.fluxcd.io/v1 HelmRepository", "helmrepo"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: source.toolkit.fluxcd.io/v1`, `kind: HelmRepository`.
diff --git a/docs/map/flux/imagepolicy.md b/docs/map/flux/imagepolicy.md
new file mode 100644
index 0000000..3e6e1d8
--- /dev/null
+++ b/docs/map/flux/imagepolicy.md
@@ -0,0 +1,11 @@
++++
+title = "ImagePolicy"
+summary = "Which image tag to pick"
+aka = ["image.toolkit.fluxcd.io/v1 ImagePolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: image.toolkit.fluxcd.io/v1`, `kind: ImagePolicy`.
diff --git a/docs/map/flux/imagerepository.md b/docs/map/flux/imagerepository.md
new file mode 100644
index 0000000..cfc95b4
--- /dev/null
+++ b/docs/map/flux/imagerepository.md
@@ -0,0 +1,11 @@
++++
+title = "ImageRepository"
+summary = "A container image repository Flux scans"
+aka = ["image.toolkit.fluxcd.io/v1 ImageRepository"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: image.toolkit.fluxcd.io/v1`, `kind: ImageRepository`.
diff --git a/docs/map/flux/imageupdateautomation.md b/docs/map/flux/imageupdateautomation.md
new file mode 100644
index 0000000..385ae50
--- /dev/null
+++ b/docs/map/flux/imageupdateautomation.md
@@ -0,0 +1,11 @@
++++
+title = "ImageUpdateAutomation"
+summary = "Commits new image tags back to Git"
+aka = ["image.toolkit.fluxcd.io/v1 ImageUpdateAutomation"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: image.toolkit.fluxcd.io/v1`, `kind: ImageUpdateAutomation`.
diff --git a/docs/map/flux/kustomization.md b/docs/map/flux/kustomization.md
new file mode 100644
index 0000000..f9f4405
--- /dev/null
+++ b/docs/map/flux/kustomization.md
@@ -0,0 +1,11 @@
++++
+title = "Kustomization"
+summary = "Applies a path from a source to the cluster"
+aka = ["kustomize.toolkit.fluxcd.io/v1 Kustomization", "ks"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kustomize.toolkit.fluxcd.io/v1`, `kind: Kustomization`.
diff --git a/docs/map/flux/ocirepository.md b/docs/map/flux/ocirepository.md
new file mode 100644
index 0000000..a3ee67a
--- /dev/null
+++ b/docs/map/flux/ocirepository.md
@@ -0,0 +1,11 @@
++++
+title = "OCIRepository"
+summary = "An OCI artifact Flux watches"
+aka = ["source.toolkit.fluxcd.io/v1 OCIRepository", "ocirepo"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: source.toolkit.fluxcd.io/v1`, `kind: OCIRepository`.
diff --git a/docs/map/flux/provider.md b/docs/map/flux/provider.md
new file mode 100644
index 0000000..5e2fa8d
--- /dev/null
+++ b/docs/map/flux/provider.md
@@ -0,0 +1,11 @@
++++
+title = "Provider"
+summary = "Where Flux sends notifications"
+aka = ["notification.toolkit.fluxcd.io/v1beta3 Provider"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: notification.toolkit.fluxcd.io/v1beta3`, `kind: Provider`.
diff --git a/docs/map/flux/receiver.md b/docs/map/flux/receiver.md
new file mode 100644
index 0000000..637af82
--- /dev/null
+++ b/docs/map/flux/receiver.md
@@ -0,0 +1,11 @@
++++
+title = "Receiver"
+summary = "A webhook that makes Flux sync right away"
+aka = ["notification.toolkit.fluxcd.io/v1 Receiver"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: notification.toolkit.fluxcd.io/v1`, `kind: Receiver`.
diff --git a/docs/map/gateway-api/AREA.md b/docs/map/gateway-api/AREA.md
new file mode 100644
index 0000000..4bfae3b
--- /dev/null
+++ b/docs/map/gateway-api/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Gateway API"
+band = "official"
+summary = "gateway.networking.k8s.io: the successor to Ingress"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against Gateway API v1.6.3, standard channel: https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.3/standard-install.yaml
diff --git a/docs/map/gateway-api/backendtlspolicy.md b/docs/map/gateway-api/backendtlspolicy.md
new file mode 100644
index 0000000..5097bdd
--- /dev/null
+++ b/docs/map/gateway-api/backendtlspolicy.md
@@ -0,0 +1,11 @@
++++
+title = "BackendTLSPolicy"
+summary = "How a Gateway talks TLS to a backend"
+aka = ["gateway.networking.k8s.io/v1 BackendTLSPolicy"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: BackendTLSPolicy`.
diff --git a/docs/map/gateway-api/gateway.md b/docs/map/gateway-api/gateway.md
new file mode 100644
index 0000000..d82b85f
--- /dev/null
+++ b/docs/map/gateway-api/gateway.md
@@ -0,0 +1,13 @@
++++
+title = "Gateway"
+summary = "A load balancer that routes attach to"
+aka = ["gateway.networking.k8s.io/v1 Gateway"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: Gateway`.
+
+Often owned by the platform team rather than each app.
diff --git a/docs/map/gateway-api/gatewayclass.md b/docs/map/gateway-api/gatewayclass.md
new file mode 100644
index 0000000..f6ec4c0
--- /dev/null
+++ b/docs/map/gateway-api/gatewayclass.md
@@ -0,0 +1,15 @@
++++
+title = "GatewayClass"
+summary = "Which controller runs a Gateway"
+aka = ["gateway.networking.k8s.io/v1 GatewayClass"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: GatewayClass`, cluster-wide.
diff --git a/docs/map/gateway-api/grpcroute.md b/docs/map/gateway-api/grpcroute.md
new file mode 100644
index 0000000..fcf1da4
--- /dev/null
+++ b/docs/map/gateway-api/grpcroute.md
@@ -0,0 +1,11 @@
++++
+title = "GRPCRoute"
+summary = "gRPC routing rules attached to a Gateway"
+aka = ["gateway.networking.k8s.io/v1 GRPCRoute"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: GRPCRoute`.
diff --git a/docs/map/gateway-api/httproute.md b/docs/map/gateway-api/httproute.md
new file mode 100644
index 0000000..2aa899a
--- /dev/null
+++ b/docs/map/gateway-api/httproute.md
@@ -0,0 +1,14 @@
++++
+title = "HTTPRoute"
+summary = "HTTP routing rules attached to a Gateway"
+aka = ["gateway.networking.k8s.io/v1 HTTPRoute"]
+kind = "sig-crd"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: HTTPRoute`.
+
+The successor to Ingress (t8y:/networking/ingress), which no longer gets new features.
diff --git a/docs/map/gateway-api/listenerset.md b/docs/map/gateway-api/listenerset.md
new file mode 100644
index 0000000..63dbab2
--- /dev/null
+++ b/docs/map/gateway-api/listenerset.md
@@ -0,0 +1,11 @@
++++
+title = "ListenerSet"
+summary = "Extra listeners attached to a Gateway"
+aka = ["gateway.networking.k8s.io/v1 ListenerSet"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: ListenerSet`.
diff --git a/docs/map/gateway-api/referencegrant.md b/docs/map/gateway-api/referencegrant.md
new file mode 100644
index 0000000..28a028d
--- /dev/null
+++ b/docs/map/gateway-api/referencegrant.md
@@ -0,0 +1,11 @@
++++
+title = "ReferenceGrant"
+summary = "Lets routes point at objects in another namespace"
+aka = ["gateway.networking.k8s.io/v1 ReferenceGrant"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: ReferenceGrant`.
diff --git a/docs/map/gateway-api/tcproute.md b/docs/map/gateway-api/tcproute.md
new file mode 100644
index 0000000..166729e
--- /dev/null
+++ b/docs/map/gateway-api/tcproute.md
@@ -0,0 +1,11 @@
++++
+title = "TCPRoute"
+summary = "TCP routing attached to a Gateway"
+aka = ["gateway.networking.k8s.io/v1 TCPRoute"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: TCPRoute`.
diff --git a/docs/map/gateway-api/tlsroute.md b/docs/map/gateway-api/tlsroute.md
new file mode 100644
index 0000000..7952b5f
--- /dev/null
+++ b/docs/map/gateway-api/tlsroute.md
@@ -0,0 +1,11 @@
++++
+title = "TLSRoute"
+summary = "Routing by TLS server name"
+aka = ["gateway.networking.k8s.io/v1 TLSRoute"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: TLSRoute`.
diff --git a/docs/map/gateway-api/udproute.md b/docs/map/gateway-api/udproute.md
new file mode 100644
index 0000000..cb4a6a9
--- /dev/null
+++ b/docs/map/gateway-api/udproute.md
@@ -0,0 +1,11 @@
++++
+title = "UDPRoute"
+summary = "UDP routing attached to a Gateway"
+aka = ["gateway.networking.k8s.io/v1 UDPRoute"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: gateway.networking.k8s.io/v1`, `kind: UDPRoute`.
diff --git a/docs/map/gpu-operator/AREA.md b/docs/map/gpu-operator/AREA.md
new file mode 100644
index 0000000..04b2ffa
--- /dev/null
+++ b/docs/map/gpu-operator/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "NVIDIA GPU Operator"
+band = "addons"
+summary = "nvidia.com: GPU drivers and device plugins"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against GPU Operator v26.7.2: https://github.com/NVIDIA/gpu-operator/tree/v26.7.2/deployments/gpu-operator/crds
diff --git a/docs/map/gpu-operator/clusterpolicy.md b/docs/map/gpu-operator/clusterpolicy.md
new file mode 100644
index 0000000..9cf6fa9
--- /dev/null
+++ b/docs/map/gpu-operator/clusterpolicy.md
@@ -0,0 +1,15 @@
++++
+title = "ClusterPolicy"
+summary = "How the GPU Operator sets up GPU nodes"
+aka = ["nvidia.com/v1 ClusterPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: nvidia.com/v1`, `kind: ClusterPolicy`, cluster-wide.
diff --git a/docs/map/gpu-operator/nvidiadriver.md b/docs/map/gpu-operator/nvidiadriver.md
new file mode 100644
index 0000000..cf85da5
--- /dev/null
+++ b/docs/map/gpu-operator/nvidiadriver.md
@@ -0,0 +1,15 @@
++++
+title = "NVIDIADriver"
+summary = "Which GPU driver to run on which nodes"
+aka = ["nvidia.com/v1alpha1 NVIDIADriver"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: nvidia.com/v1alpha1`, `kind: NVIDIADriver`, cluster-wide.
diff --git a/docs/map/istio/AREA.md b/docs/map/istio/AREA.md
new file mode 100644
index 0000000..4033d0d
--- /dev/null
+++ b/docs/map/istio/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Istio"
+band = "addons"
+summary = "networking.istio.io and friends: service mesh traffic and security"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['networking.istio.io'].v1beta1` and `.v1alpha3`.
+
+Checked against Istio 1.31.2: https://github.com/istio/istio/blob/1.31.2/manifests/charts/base/files/crd-all.gen.yaml
diff --git a/docs/map/istio/authorizationpolicy.md b/docs/map/istio/authorizationpolicy.md
new file mode 100644
index 0000000..7008644
--- /dev/null
+++ b/docs/map/istio/authorizationpolicy.md
@@ -0,0 +1,11 @@
++++
+title = "AuthorizationPolicy"
+summary = "Who may call a workload"
+aka = ["security.istio.io/v1 AuthorizationPolicy", "ap"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: security.istio.io/v1`, `kind: AuthorizationPolicy`.
diff --git a/docs/map/istio/destinationrule.md b/docs/map/istio/destinationrule.md
new file mode 100644
index 0000000..405b83a
--- /dev/null
+++ b/docs/map/istio/destinationrule.md
@@ -0,0 +1,23 @@
++++
+title = "DestinationRule"
+summary = "Istio traffic policy for a destination"
+aka = ["networking.istio.io/v1 DestinationRule", "dr"]
+kind = "crd"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "v1beta1"
+title = "networking.istio.io/v1beta1 template"
+status = "done"
+
+[[feature]]
+id = "v1"
+title = "networking.istio.io/v1 template"
+status = "todo"
+milestone = "m3"
+note = "v1 since Istio 1.22"
++++
+
+`apiVersion: networking.istio.io/v1`, `kind: DestinationRule`.
diff --git a/docs/map/istio/envoyfilter.md b/docs/map/istio/envoyfilter.md
new file mode 100644
index 0000000..d13961a
--- /dev/null
+++ b/docs/map/istio/envoyfilter.md
@@ -0,0 +1,25 @@
++++
+title = "EnvoyFilter"
+summary = "Low-level Envoy configuration patches"
+aka = ["networking.istio.io/v1alpha3 EnvoyFilter"]
+kind = "crd"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "v1beta1"
+title = "networking.istio.io/v1beta1 template"
+status = "done"
+note = "Istio rejects it; kept so existing configs still evaluate"
+
+[[feature]]
+id = "v1alpha3"
+title = "networking.istio.io/v1alpha3 template"
+status = "done"
+note = "The only version Istio serves"
++++
+
+`apiVersion: networking.istio.io/v1alpha3`, `kind: EnvoyFilter`.
+
+Use `v1alpha3.EnvoyFilter`.
diff --git a/docs/map/istio/gateway.md b/docs/map/istio/gateway.md
new file mode 100644
index 0000000..d95a6d3
--- /dev/null
+++ b/docs/map/istio/gateway.md
@@ -0,0 +1,11 @@
++++
+title = "Gateway"
+summary = "Istio's own load balancer at the mesh edge"
+aka = ["networking.istio.io/v1 Gateway", "gw"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: networking.istio.io/v1`, `kind: Gateway`.
diff --git a/docs/map/istio/peerauthentication.md b/docs/map/istio/peerauthentication.md
new file mode 100644
index 0000000..c439e46
--- /dev/null
+++ b/docs/map/istio/peerauthentication.md
@@ -0,0 +1,11 @@
++++
+title = "PeerAuthentication"
+summary = "Whether workloads require mutual TLS"
+aka = ["security.istio.io/v1 PeerAuthentication", "pa"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: security.istio.io/v1`, `kind: PeerAuthentication`.
diff --git a/docs/map/istio/proxyconfig.md b/docs/map/istio/proxyconfig.md
new file mode 100644
index 0000000..2d11787
--- /dev/null
+++ b/docs/map/istio/proxyconfig.md
@@ -0,0 +1,11 @@
++++
+title = "ProxyConfig"
+summary = "Proxy settings for some workloads"
+aka = ["networking.istio.io/v1beta1 ProxyConfig"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: networking.istio.io/v1beta1`, `kind: ProxyConfig`.
diff --git a/docs/map/istio/requestauthentication.md b/docs/map/istio/requestauthentication.md
new file mode 100644
index 0000000..3861bda
--- /dev/null
+++ b/docs/map/istio/requestauthentication.md
@@ -0,0 +1,11 @@
++++
+title = "RequestAuthentication"
+summary = "Which JWTs a workload accepts"
+aka = ["security.istio.io/v1 RequestAuthentication", "ra"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: security.istio.io/v1`, `kind: RequestAuthentication`.
diff --git a/docs/map/istio/serviceentry.md b/docs/map/istio/serviceentry.md
new file mode 100644
index 0000000..e7f2db6
--- /dev/null
+++ b/docs/map/istio/serviceentry.md
@@ -0,0 +1,11 @@
++++
+title = "ServiceEntry"
+summary = "Adds an outside service to the mesh"
+aka = ["networking.istio.io/v1 ServiceEntry", "se"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: networking.istio.io/v1`, `kind: ServiceEntry`.
diff --git a/docs/map/istio/sidecar.md b/docs/map/istio/sidecar.md
new file mode 100644
index 0000000..bc59eaa
--- /dev/null
+++ b/docs/map/istio/sidecar.md
@@ -0,0 +1,11 @@
++++
+title = "Sidecar"
+summary = "Limits what a workload's proxy sees"
+aka = ["networking.istio.io/v1 Sidecar"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: networking.istio.io/v1`, `kind: Sidecar`.
diff --git a/docs/map/istio/telemetry.md b/docs/map/istio/telemetry.md
new file mode 100644
index 0000000..a6e3a1a
--- /dev/null
+++ b/docs/map/istio/telemetry.md
@@ -0,0 +1,11 @@
++++
+title = "Telemetry"
+summary = "Metrics, logs and tracing settings"
+aka = ["telemetry.istio.io/v1 Telemetry"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: telemetry.istio.io/v1`, `kind: Telemetry`.
diff --git a/docs/map/istio/trafficextension.md b/docs/map/istio/trafficextension.md
new file mode 100644
index 0000000..18a32ab
--- /dev/null
+++ b/docs/map/istio/trafficextension.md
@@ -0,0 +1,11 @@
++++
+title = "TrafficExtension"
+summary = "Extends proxy traffic handling"
+aka = ["extensions.istio.io/v1alpha1 TrafficExtension"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: extensions.istio.io/v1alpha1`, `kind: TrafficExtension`.
diff --git a/docs/map/istio/virtualservice.md b/docs/map/istio/virtualservice.md
new file mode 100644
index 0000000..1a22b7b
--- /dev/null
+++ b/docs/map/istio/virtualservice.md
@@ -0,0 +1,23 @@
++++
+title = "VirtualService"
+summary = "Istio routing rules for a host"
+aka = ["networking.istio.io/v1 VirtualService", "vs"]
+kind = "crd"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "v1beta1"
+title = "networking.istio.io/v1beta1 template"
+status = "done"
+
+[[feature]]
+id = "v1"
+title = "networking.istio.io/v1 template"
+status = "todo"
+milestone = "m3"
+note = "v1 since Istio 1.22"
++++
+
+`apiVersion: networking.istio.io/v1`, `kind: VirtualService`.
diff --git a/docs/map/istio/wasmplugin.md b/docs/map/istio/wasmplugin.md
new file mode 100644
index 0000000..ad3e739
--- /dev/null
+++ b/docs/map/istio/wasmplugin.md
@@ -0,0 +1,11 @@
++++
+title = "WasmPlugin"
+summary = "Adds a WebAssembly filter to proxies"
+aka = ["extensions.istio.io/v1alpha1 WasmPlugin"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: extensions.istio.io/v1alpha1`, `kind: WasmPlugin`.
diff --git a/docs/map/istio/workloadentry.md b/docs/map/istio/workloadentry.md
new file mode 100644
index 0000000..129968d
--- /dev/null
+++ b/docs/map/istio/workloadentry.md
@@ -0,0 +1,11 @@
++++
+title = "WorkloadEntry"
+summary = "A VM or other non-pod workload in the mesh"
+aka = ["networking.istio.io/v1 WorkloadEntry", "we"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: networking.istio.io/v1`, `kind: WorkloadEntry`.
diff --git a/docs/map/istio/workloadgroup.md b/docs/map/istio/workloadgroup.md
new file mode 100644
index 0000000..43a99fa
--- /dev/null
+++ b/docs/map/istio/workloadgroup.md
@@ -0,0 +1,11 @@
++++
+title = "WorkloadGroup"
+summary = "A template for WorkloadEntries"
+aka = ["networking.istio.io/v1 WorkloadGroup", "wg"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: networking.istio.io/v1`, `kind: WorkloadGroup`.
diff --git a/docs/map/jobset/AREA.md b/docs/map/jobset/AREA.md
new file mode 100644
index 0000000..b409dd8
--- /dev/null
+++ b/docs/map/jobset/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "JobSet"
+band = "official"
+summary = "jobset.x-k8s.io: a group of Jobs run as one unit"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against JobSet v0.13.0: https://github.com/kubernetes-sigs/jobset/releases/download/v0.13.0/manifests.yaml
diff --git a/docs/map/jobset/jobset.md b/docs/map/jobset/jobset.md
new file mode 100644
index 0000000..11a268d
--- /dev/null
+++ b/docs/map/jobset/jobset.md
@@ -0,0 +1,15 @@
++++
+title = "JobSet"
+summary = "Several Jobs that start, fail and finish together"
+aka = ["jobset.x-k8s.io/v1alpha2 JobSet"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: jobset.x-k8s.io/v1alpha2`, `kind: JobSet`.
diff --git a/docs/map/karpenter/AREA.md b/docs/map/karpenter/AREA.md
new file mode 100644
index 0000000..931b7bf
--- /dev/null
+++ b/docs/map/karpenter/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Karpenter"
+band = "official"
+summary = "karpenter.sh: node autoscaling"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against the AWS provider v1.15.0: https://github.com/aws/karpenter-provider-aws/tree/v1.15.0/pkg/apis/crds. karpenter.sh comes from kubernetes-sigs/karpenter; EC2NodeClass is AWS-specific, and other clouds have their own node class.
diff --git a/docs/map/karpenter/ec2nodeclass.md b/docs/map/karpenter/ec2nodeclass.md
new file mode 100644
index 0000000..18bad3e
--- /dev/null
+++ b/docs/map/karpenter/ec2nodeclass.md
@@ -0,0 +1,15 @@
++++
+title = "EC2NodeClass"
+summary = "AWS settings for Karpenter nodes"
+aka = ["karpenter.k8s.aws/v1 EC2NodeClass"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: karpenter.k8s.aws/v1`, `kind: EC2NodeClass`, cluster-wide.
diff --git a/docs/map/karpenter/nodeclaim.md b/docs/map/karpenter/nodeclaim.md
new file mode 100644
index 0000000..1cefbb4
--- /dev/null
+++ b/docs/map/karpenter/nodeclaim.md
@@ -0,0 +1,17 @@
++++
+title = "NodeClaim"
+summary = "One node Karpenter is creating"
+aka = ["karpenter.sh/v1 NodeClaim"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: karpenter.sh/v1`, `kind: NodeClaim`, cluster-wide.
+
+Created by Karpenter.
diff --git a/docs/map/karpenter/nodeoverlay.md b/docs/map/karpenter/nodeoverlay.md
new file mode 100644
index 0000000..40c67d3
--- /dev/null
+++ b/docs/map/karpenter/nodeoverlay.md
@@ -0,0 +1,15 @@
++++
+title = "NodeOverlay"
+summary = "Adjusts what Karpenter assumes about instance types"
+aka = ["karpenter.sh/v1alpha1 NodeOverlay"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: karpenter.sh/v1alpha1`, `kind: NodeOverlay`, cluster-wide.
diff --git a/docs/map/karpenter/nodepool.md b/docs/map/karpenter/nodepool.md
new file mode 100644
index 0000000..a1f2b9e
--- /dev/null
+++ b/docs/map/karpenter/nodepool.md
@@ -0,0 +1,15 @@
++++
+title = "NodePool"
+summary = "What kind of nodes Karpenter may create, and limits"
+aka = ["karpenter.sh/v1 NodePool"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: karpenter.sh/v1`, `kind: NodePool`, cluster-wide.
diff --git a/docs/map/keda/AREA.md b/docs/map/keda/AREA.md
new file mode 100644
index 0000000..e674f53
--- /dev/null
+++ b/docs/map/keda/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "KEDA"
+band = "addons"
+summary = "keda.sh: event-driven autoscaling"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against KEDA v2.21.0: https://github.com/kedacore/keda/releases/download/v2.21.0/keda-2.21.0-crds.yaml
diff --git a/docs/map/keda/cloudeventsource.md b/docs/map/keda/cloudeventsource.md
new file mode 100644
index 0000000..e5b5067
--- /dev/null
+++ b/docs/map/keda/cloudeventsource.md
@@ -0,0 +1,11 @@
++++
+title = "CloudEventSource"
+summary = "Sends KEDA events to a CloudEvents sink"
+aka = ["eventing.keda.sh/v1alpha1 CloudEventSource"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: eventing.keda.sh/v1alpha1`, `kind: CloudEventSource`.
diff --git a/docs/map/keda/clustercloudeventsource.md b/docs/map/keda/clustercloudeventsource.md
new file mode 100644
index 0000000..9639f8d
--- /dev/null
+++ b/docs/map/keda/clustercloudeventsource.md
@@ -0,0 +1,15 @@
++++
+title = "ClusterCloudEventSource"
+summary = "A CloudEventSource for the whole cluster"
+aka = ["eventing.keda.sh/v1alpha1 ClusterCloudEventSource"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: eventing.keda.sh/v1alpha1`, `kind: ClusterCloudEventSource`, cluster-wide.
diff --git a/docs/map/keda/clustertriggerauthentication.md b/docs/map/keda/clustertriggerauthentication.md
new file mode 100644
index 0000000..cd8673a
--- /dev/null
+++ b/docs/map/keda/clustertriggerauthentication.md
@@ -0,0 +1,15 @@
++++
+title = "ClusterTriggerAuthentication"
+summary = "Credentials for KEDA triggers, for the whole cluster"
+aka = ["keda.sh/v1alpha1 ClusterTriggerAuthentication", "cta"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: keda.sh/v1alpha1`, `kind: ClusterTriggerAuthentication`, cluster-wide.
diff --git a/docs/map/keda/scaledjob.md b/docs/map/keda/scaledjob.md
new file mode 100644
index 0000000..7fa4698
--- /dev/null
+++ b/docs/map/keda/scaledjob.md
@@ -0,0 +1,15 @@
++++
+title = "ScaledJob"
+summary = "Starts Jobs on events"
+aka = ["keda.sh/v1alpha1 ScaledJob", "sj"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: keda.sh/v1alpha1`, `kind: ScaledJob`.
diff --git a/docs/map/keda/scaledobject.md b/docs/map/keda/scaledobject.md
new file mode 100644
index 0000000..a353058
--- /dev/null
+++ b/docs/map/keda/scaledobject.md
@@ -0,0 +1,11 @@
++++
+title = "ScaledObject"
+summary = "Scales a workload on events, such as queue length"
+aka = ["keda.sh/v1alpha1 ScaledObject", "so"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: keda.sh/v1alpha1`, `kind: ScaledObject`.
diff --git a/docs/map/keda/triggerauthentication.md b/docs/map/keda/triggerauthentication.md
new file mode 100644
index 0000000..e936f6c
--- /dev/null
+++ b/docs/map/keda/triggerauthentication.md
@@ -0,0 +1,11 @@
++++
+title = "TriggerAuthentication"
+summary = "Credentials for KEDA triggers"
+aka = ["keda.sh/v1alpha1 TriggerAuthentication", "ta"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: keda.sh/v1alpha1`, `kind: TriggerAuthentication`.
diff --git a/docs/map/kro/AREA.md b/docs/map/kro/AREA.md
new file mode 100644
index 0000000..2409c61
--- /dev/null
+++ b/docs/map/kro/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "kro"
+band = "official"
+summary = "kro.run: define new APIs as graphs of resources"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against kro v0.9.4: https://github.com/kubernetes-sigs/kro/releases/download/v0.9.4/kro-core-install-manifests.yaml. Each ResourceGraphDefinition creates a new CRD of its own; those are not mapped.
diff --git a/docs/map/kro/graphrevision.md b/docs/map/kro/graphrevision.md
new file mode 100644
index 0000000..99d7c93
--- /dev/null
+++ b/docs/map/kro/graphrevision.md
@@ -0,0 +1,17 @@
++++
+title = "GraphRevision"
+summary = "A saved revision of a ResourceGraphDefinition"
+aka = ["internal.kro.run/v1alpha1 GraphRevision"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: internal.kro.run/v1alpha1`, `kind: GraphRevision`, cluster-wide.
+
+Written by kro.
diff --git a/docs/map/kro/resourcegraphdefinition.md b/docs/map/kro/resourcegraphdefinition.md
new file mode 100644
index 0000000..3a767e5
--- /dev/null
+++ b/docs/map/kro/resourcegraphdefinition.md
@@ -0,0 +1,15 @@
++++
+title = "ResourceGraphDefinition"
+summary = "Defines a new API and the resources each instance creates"
+aka = ["kro.run/v1alpha1 ResourceGraphDefinition", "rgd"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kro.run/v1alpha1`, `kind: ResourceGraphDefinition`, cluster-wide.
diff --git a/docs/map/kueue/AREA.md b/docs/map/kueue/AREA.md
new file mode 100644
index 0000000..0b482a0
--- /dev/null
+++ b/docs/map/kueue/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Kueue"
+band = "official"
+summary = "kueue.x-k8s.io: job queueing and quotas"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against Kueue v0.20.2: https://github.com/kubernetes-sigs/kueue/releases/download/v0.20.2/manifests.yaml
diff --git a/docs/map/kueue/admissioncheck.md b/docs/map/kueue/admissioncheck.md
new file mode 100644
index 0000000..4183d15
--- /dev/null
+++ b/docs/map/kueue/admissioncheck.md
@@ -0,0 +1,15 @@
++++
+title = "AdmissionCheck"
+summary = "An extra check a job must pass before it starts"
+aka = ["kueue.x-k8s.io/v1beta2 AdmissionCheck"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: AdmissionCheck`, cluster-wide.
diff --git a/docs/map/kueue/clusterqueue.md b/docs/map/kueue/clusterqueue.md
new file mode 100644
index 0000000..b809540
--- /dev/null
+++ b/docs/map/kueue/clusterqueue.md
@@ -0,0 +1,15 @@
++++
+title = "ClusterQueue"
+summary = "Quota shared by LocalQueues"
+aka = ["kueue.x-k8s.io/v1beta2 ClusterQueue"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: ClusterQueue`, cluster-wide.
diff --git a/docs/map/kueue/cohort.md b/docs/map/kueue/cohort.md
new file mode 100644
index 0000000..167590d
--- /dev/null
+++ b/docs/map/kueue/cohort.md
@@ -0,0 +1,15 @@
++++
+title = "Cohort"
+summary = "ClusterQueues that can borrow quota from each other"
+aka = ["kueue.x-k8s.io/v1beta2 Cohort"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: Cohort`, cluster-wide.
diff --git a/docs/map/kueue/localqueue.md b/docs/map/kueue/localqueue.md
new file mode 100644
index 0000000..b18b312
--- /dev/null
+++ b/docs/map/kueue/localqueue.md
@@ -0,0 +1,11 @@
++++
+title = "LocalQueue"
+summary = "The queue a namespace submits jobs to"
+aka = ["kueue.x-k8s.io/v1beta2 LocalQueue"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: LocalQueue`.
diff --git a/docs/map/kueue/multikueuecluster.md b/docs/map/kueue/multikueuecluster.md
new file mode 100644
index 0000000..1236b9b
--- /dev/null
+++ b/docs/map/kueue/multikueuecluster.md
@@ -0,0 +1,15 @@
++++
+title = "MultiKueueCluster"
+summary = "One worker cluster for MultiKueue"
+aka = ["kueue.x-k8s.io/v1beta2 MultiKueueCluster"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: MultiKueueCluster`, cluster-wide.
diff --git a/docs/map/kueue/multikueueconfig.md b/docs/map/kueue/multikueueconfig.md
new file mode 100644
index 0000000..dfa0db7
--- /dev/null
+++ b/docs/map/kueue/multikueueconfig.md
@@ -0,0 +1,15 @@
++++
+title = "MultiKueueConfig"
+summary = "Which clusters MultiKueue may dispatch jobs to"
+aka = ["kueue.x-k8s.io/v1beta2 MultiKueueConfig"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: MultiKueueConfig`, cluster-wide.
diff --git a/docs/map/kueue/provisioningrequestconfig.md b/docs/map/kueue/provisioningrequestconfig.md
new file mode 100644
index 0000000..dddeb8e
--- /dev/null
+++ b/docs/map/kueue/provisioningrequestconfig.md
@@ -0,0 +1,15 @@
++++
+title = "ProvisioningRequestConfig"
+summary = "Settings for asking the cluster autoscaler for capacity"
+aka = ["kueue.x-k8s.io/v1beta2 ProvisioningRequestConfig"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: ProvisioningRequestConfig`, cluster-wide.
diff --git a/docs/map/kueue/resourceflavor.md b/docs/map/kueue/resourceflavor.md
new file mode 100644
index 0000000..5d6b746
--- /dev/null
+++ b/docs/map/kueue/resourceflavor.md
@@ -0,0 +1,15 @@
++++
+title = "ResourceFlavor"
+summary = "A kind of node, such as a GPU model, that quota is counted in"
+aka = ["kueue.x-k8s.io/v1beta2 ResourceFlavor"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: ResourceFlavor`, cluster-wide.
diff --git a/docs/map/kueue/topology.md b/docs/map/kueue/topology.md
new file mode 100644
index 0000000..090a7a4
--- /dev/null
+++ b/docs/map/kueue/topology.md
@@ -0,0 +1,15 @@
++++
+title = "Topology"
+summary = "Datacenter layout for topology-aware placement"
+aka = ["kueue.x-k8s.io/v1beta2 Topology"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: Topology`, cluster-wide.
diff --git a/docs/map/kueue/workload.md b/docs/map/kueue/workload.md
new file mode 100644
index 0000000..87b446c
--- /dev/null
+++ b/docs/map/kueue/workload.md
@@ -0,0 +1,13 @@
++++
+title = "Workload"
+summary = "One queued job"
+aka = ["kueue.x-k8s.io/v1beta2 Workload"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: Workload`.
+
+Created by Kueue for each job.
diff --git a/docs/map/kueue/workloadpriorityclass.md b/docs/map/kueue/workloadpriorityclass.md
new file mode 100644
index 0000000..9c8a044
--- /dev/null
+++ b/docs/map/kueue/workloadpriorityclass.md
@@ -0,0 +1,15 @@
++++
+title = "WorkloadPriorityClass"
+summary = "A priority for queued jobs"
+aka = ["kueue.x-k8s.io/v1beta2 WorkloadPriorityClass"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kueue.x-k8s.io/v1beta2`, `kind: WorkloadPriorityClass`, cluster-wide.
diff --git a/docs/map/kyverno/AREA.md b/docs/map/kyverno/AREA.md
new file mode 100644
index 0000000..cd0c687
--- /dev/null
+++ b/docs/map/kyverno/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Kyverno"
+band = "addons"
+summary = "policies.kyverno.io and kyverno.io: policy engine"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against Kyverno v1.19.1: https://github.com/kyverno/kyverno/releases/download/v1.19.1/install.yaml. The older kyverno.io policy kinds are still served but deprecated in favour of policies.kyverno.io.
diff --git a/docs/map/kyverno/cleanuppolicy.md b/docs/map/kyverno/cleanuppolicy.md
new file mode 100644
index 0000000..39b1978
--- /dev/null
+++ b/docs/map/kyverno/cleanuppolicy.md
@@ -0,0 +1,13 @@
++++
+title = "CleanupPolicy"
+summary = "The older namespaced cleanup policy"
+aka = ["kyverno.io/v2 CleanupPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kyverno.io/v2`, `kind: CleanupPolicy`.
+
+Deprecated in favour of NamespacedDeletingPolicy.
diff --git a/docs/map/kyverno/clustercleanuppolicy.md b/docs/map/kyverno/clustercleanuppolicy.md
new file mode 100644
index 0000000..3c2b0d8
--- /dev/null
+++ b/docs/map/kyverno/clustercleanuppolicy.md
@@ -0,0 +1,17 @@
++++
+title = "ClusterCleanupPolicy"
+summary = "The older cluster-wide cleanup policy"
+aka = ["kyverno.io/v2 ClusterCleanupPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kyverno.io/v2`, `kind: ClusterCleanupPolicy`, cluster-wide.
+
+Deprecated in favour of DeletingPolicy.
diff --git a/docs/map/kyverno/clusterephemeralreport.md b/docs/map/kyverno/clusterephemeralreport.md
new file mode 100644
index 0000000..2b4f47d
--- /dev/null
+++ b/docs/map/kyverno/clusterephemeralreport.md
@@ -0,0 +1,17 @@
++++
+title = "ClusterEphemeralReport"
+summary = "A short-lived policy result for cluster-wide objects"
+aka = ["reports.kyverno.io/v1 ClusterEphemeralReport"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: reports.kyverno.io/v1`, `kind: ClusterEphemeralReport`, cluster-wide.
+
+Written by Kyverno.
diff --git a/docs/map/kyverno/clusterpolicy.md b/docs/map/kyverno/clusterpolicy.md
new file mode 100644
index 0000000..30c8247
--- /dev/null
+++ b/docs/map/kyverno/clusterpolicy.md
@@ -0,0 +1,17 @@
++++
+title = "ClusterPolicy"
+summary = "The older cluster-wide policy kind"
+aka = ["kyverno.io/v1 ClusterPolicy", "cpol"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kyverno.io/v1`, `kind: ClusterPolicy`, cluster-wide.
+
+Deprecated in favour of the policies.kyverno.io kinds, but still common.
diff --git a/docs/map/kyverno/clusterpolicyreport.md b/docs/map/kyverno/clusterpolicyreport.md
new file mode 100644
index 0000000..538661b
--- /dev/null
+++ b/docs/map/kyverno/clusterpolicyreport.md
@@ -0,0 +1,17 @@
++++
+title = "ClusterPolicyReport"
+summary = "Policy results for cluster-wide objects"
+aka = ["wgpolicyk8s.io/v1alpha2 ClusterPolicyReport", "cpolr"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: wgpolicyk8s.io/v1alpha2`, `kind: ClusterPolicyReport`, cluster-wide.
+
+Written by Kyverno.
diff --git a/docs/map/kyverno/deletingpolicy.md b/docs/map/kyverno/deletingpolicy.md
new file mode 100644
index 0000000..4199af5
--- /dev/null
+++ b/docs/map/kyverno/deletingpolicy.md
@@ -0,0 +1,15 @@
++++
+title = "DeletingPolicy"
+summary = "Deletes matching objects on a schedule"
+aka = ["policies.kyverno.io/v1 DeletingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: DeletingPolicy`, cluster-wide.
diff --git a/docs/map/kyverno/ephemeralreport.md b/docs/map/kyverno/ephemeralreport.md
new file mode 100644
index 0000000..9d9fb4e
--- /dev/null
+++ b/docs/map/kyverno/ephemeralreport.md
@@ -0,0 +1,13 @@
++++
+title = "EphemeralReport"
+summary = "A short-lived policy result"
+aka = ["reports.kyverno.io/v1 EphemeralReport"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: reports.kyverno.io/v1`, `kind: EphemeralReport`.
+
+Written by Kyverno.
diff --git a/docs/map/kyverno/generatingpolicy.md b/docs/map/kyverno/generatingpolicy.md
new file mode 100644
index 0000000..2477e74
--- /dev/null
+++ b/docs/map/kyverno/generatingpolicy.md
@@ -0,0 +1,15 @@
++++
+title = "GeneratingPolicy"
+summary = "Creates objects when others appear"
+aka = ["policies.kyverno.io/v1 GeneratingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: GeneratingPolicy`, cluster-wide.
diff --git a/docs/map/kyverno/globalcontextentry.md b/docs/map/kyverno/globalcontextentry.md
new file mode 100644
index 0000000..a7d39e4
--- /dev/null
+++ b/docs/map/kyverno/globalcontextentry.md
@@ -0,0 +1,15 @@
++++
+title = "GlobalContextEntry"
+summary = "Data that every policy can read"
+aka = ["kyverno.io/v2 GlobalContextEntry"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: kyverno.io/v2`, `kind: GlobalContextEntry`, cluster-wide.
diff --git a/docs/map/kyverno/imagevalidatingpolicy.md b/docs/map/kyverno/imagevalidatingpolicy.md
new file mode 100644
index 0000000..2016d94
--- /dev/null
+++ b/docs/map/kyverno/imagevalidatingpolicy.md
@@ -0,0 +1,15 @@
++++
+title = "ImageValidatingPolicy"
+summary = "Checks image signatures and attestations"
+aka = ["policies.kyverno.io/v1 ImageValidatingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: ImageValidatingPolicy`, cluster-wide.
diff --git a/docs/map/kyverno/mutatingpolicy.md b/docs/map/kyverno/mutatingpolicy.md
new file mode 100644
index 0000000..beb5cf8
--- /dev/null
+++ b/docs/map/kyverno/mutatingpolicy.md
@@ -0,0 +1,15 @@
++++
+title = "MutatingPolicy"
+summary = "Changes objects with CEL rules"
+aka = ["policies.kyverno.io/v1 MutatingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: MutatingPolicy`, cluster-wide.
diff --git a/docs/map/kyverno/namespaceddeletingpolicy.md b/docs/map/kyverno/namespaceddeletingpolicy.md
new file mode 100644
index 0000000..0aeb331
--- /dev/null
+++ b/docs/map/kyverno/namespaceddeletingpolicy.md
@@ -0,0 +1,11 @@
++++
+title = "NamespacedDeletingPolicy"
+summary = "A DeletingPolicy for one namespace"
+aka = ["policies.kyverno.io/v1 NamespacedDeletingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: NamespacedDeletingPolicy`.
diff --git a/docs/map/kyverno/namespacedgeneratingpolicy.md b/docs/map/kyverno/namespacedgeneratingpolicy.md
new file mode 100644
index 0000000..6f20b9d
--- /dev/null
+++ b/docs/map/kyverno/namespacedgeneratingpolicy.md
@@ -0,0 +1,11 @@
++++
+title = "NamespacedGeneratingPolicy"
+summary = "A GeneratingPolicy for one namespace"
+aka = ["policies.kyverno.io/v1 NamespacedGeneratingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: NamespacedGeneratingPolicy`.
diff --git a/docs/map/kyverno/namespacedimagevalidatingpolicy.md b/docs/map/kyverno/namespacedimagevalidatingpolicy.md
new file mode 100644
index 0000000..ce7df18
--- /dev/null
+++ b/docs/map/kyverno/namespacedimagevalidatingpolicy.md
@@ -0,0 +1,11 @@
++++
+title = "NamespacedImageValidatingPolicy"
+summary = "An ImageValidatingPolicy for one namespace"
+aka = ["policies.kyverno.io/v1 NamespacedImageValidatingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: NamespacedImageValidatingPolicy`.
diff --git a/docs/map/kyverno/namespacedmutatingpolicy.md b/docs/map/kyverno/namespacedmutatingpolicy.md
new file mode 100644
index 0000000..8b88d91
--- /dev/null
+++ b/docs/map/kyverno/namespacedmutatingpolicy.md
@@ -0,0 +1,11 @@
++++
+title = "NamespacedMutatingPolicy"
+summary = "A MutatingPolicy for one namespace"
+aka = ["policies.kyverno.io/v1 NamespacedMutatingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: NamespacedMutatingPolicy`.
diff --git a/docs/map/kyverno/namespacedvalidatingpolicy.md b/docs/map/kyverno/namespacedvalidatingpolicy.md
new file mode 100644
index 0000000..22b32d0
--- /dev/null
+++ b/docs/map/kyverno/namespacedvalidatingpolicy.md
@@ -0,0 +1,11 @@
++++
+title = "NamespacedValidatingPolicy"
+summary = "A ValidatingPolicy for one namespace"
+aka = ["policies.kyverno.io/v1 NamespacedValidatingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: NamespacedValidatingPolicy`.
diff --git a/docs/map/kyverno/policy.md b/docs/map/kyverno/policy.md
new file mode 100644
index 0000000..e02ec40
--- /dev/null
+++ b/docs/map/kyverno/policy.md
@@ -0,0 +1,13 @@
++++
+title = "Policy"
+summary = "The older namespaced policy kind"
+aka = ["kyverno.io/v1 Policy", "pol"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kyverno.io/v1`, `kind: Policy`.
+
+Deprecated in favour of the policies.kyverno.io kinds.
diff --git a/docs/map/kyverno/policyexception-v2.md b/docs/map/kyverno/policyexception-v2.md
new file mode 100644
index 0000000..8ec004d
--- /dev/null
+++ b/docs/map/kyverno/policyexception-v2.md
@@ -0,0 +1,13 @@
++++
+title = "PolicyException"
+summary = "The older PolicyException"
+aka = ["kyverno.io/v2 PolicyException"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kyverno.io/v2`, `kind: PolicyException`.
+
+Deprecated in favour of policies.kyverno.io/v1 PolicyException.
diff --git a/docs/map/kyverno/policyexception.md b/docs/map/kyverno/policyexception.md
new file mode 100644
index 0000000..1a87cb1
--- /dev/null
+++ b/docs/map/kyverno/policyexception.md
@@ -0,0 +1,11 @@
++++
+title = "PolicyException"
+summary = "Lets some objects skip a policy"
+aka = ["policies.kyverno.io/v1 PolicyException"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: PolicyException`.
diff --git a/docs/map/kyverno/policyreport.md b/docs/map/kyverno/policyreport.md
new file mode 100644
index 0000000..34490af
--- /dev/null
+++ b/docs/map/kyverno/policyreport.md
@@ -0,0 +1,13 @@
++++
+title = "PolicyReport"
+summary = "Policy results for a namespace"
+aka = ["wgpolicyk8s.io/v1alpha2 PolicyReport", "polr"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: wgpolicyk8s.io/v1alpha2`, `kind: PolicyReport`.
+
+Written by Kyverno.
diff --git a/docs/map/kyverno/updaterequest.md b/docs/map/kyverno/updaterequest.md
new file mode 100644
index 0000000..2974735
--- /dev/null
+++ b/docs/map/kyverno/updaterequest.md
@@ -0,0 +1,13 @@
++++
+title = "UpdateRequest"
+summary = "Pending work for generate and mutate rules"
+aka = ["kyverno.io/v2 UpdateRequest"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: kyverno.io/v2`, `kind: UpdateRequest`.
+
+Written by Kyverno.
diff --git a/docs/map/kyverno/validatingpolicy.md b/docs/map/kyverno/validatingpolicy.md
new file mode 100644
index 0000000..a0f77c3
--- /dev/null
+++ b/docs/map/kyverno/validatingpolicy.md
@@ -0,0 +1,15 @@
++++
+title = "ValidatingPolicy"
+summary = "Rejects objects that break CEL rules"
+aka = ["policies.kyverno.io/v1 ValidatingPolicy"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: policies.kyverno.io/v1`, `kind: ValidatingPolicy`, cluster-wide.
diff --git a/docs/map/leaderworkerset/AREA.md b/docs/map/leaderworkerset/AREA.md
new file mode 100644
index 0000000..d1aa103
--- /dev/null
+++ b/docs/map/leaderworkerset/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "LeaderWorkerSet"
+band = "official"
+summary = "leaderworkerset.x-k8s.io: groups of pods with a leader, for inference"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against LWS v1.0.0: https://github.com/kubernetes-sigs/lws/releases/download/v1.0.0/manifests.yaml
diff --git a/docs/map/leaderworkerset/disaggregatedset.md b/docs/map/leaderworkerset/disaggregatedset.md
new file mode 100644
index 0000000..bc84f1a
--- /dev/null
+++ b/docs/map/leaderworkerset/disaggregatedset.md
@@ -0,0 +1,11 @@
++++
+title = "DisaggregatedSet"
+summary = "Separate prefill and decode groups for LLM serving"
+aka = ["disaggregatedset.x-k8s.io/v1 DisaggregatedSet"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: disaggregatedset.x-k8s.io/v1`, `kind: DisaggregatedSet`.
diff --git a/docs/map/leaderworkerset/disaggregatedsetrolescaler.md b/docs/map/leaderworkerset/disaggregatedsetrolescaler.md
new file mode 100644
index 0000000..28fd12e
--- /dev/null
+++ b/docs/map/leaderworkerset/disaggregatedsetrolescaler.md
@@ -0,0 +1,11 @@
++++
+title = "DisaggregatedSetRoleScaler"
+summary = "Scales one role of a DisaggregatedSet"
+aka = ["disaggregatedset.x-k8s.io/v1 DisaggregatedSetRoleScaler"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: disaggregatedset.x-k8s.io/v1`, `kind: DisaggregatedSetRoleScaler`.
diff --git a/docs/map/leaderworkerset/leaderworkerset.md b/docs/map/leaderworkerset/leaderworkerset.md
new file mode 100644
index 0000000..2b25f9a
--- /dev/null
+++ b/docs/map/leaderworkerset/leaderworkerset.md
@@ -0,0 +1,15 @@
++++
+title = "LeaderWorkerSet"
+summary = "Replicated groups of one leader pod and N worker pods"
+aka = ["leaderworkerset.x-k8s.io/v1 LeaderWorkerSet", "lws"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/pod-template"
+why = "Its pods get the shared overlays"
++++
+
+`apiVersion: leaderworkerset.x-k8s.io/v1`, `kind: LeaderWorkerSet`.
diff --git a/docs/map/lib/AREA.md b/docs/map/lib/AREA.md
new file mode 100644
index 0000000..25b2915
--- /dev/null
+++ b/docs/map/lib/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "Library"
+band = "lib"
+summary = "Shared pieces of k8s.libsonnet that the templates are built on"
++++
+
+Every template starts from `k8s.Object`, whose `metadata` extends the shared `ObjectMeta`. Overriding `ObjectMeta` or `ObjectTemplateMeta` changes every object at once.
diff --git a/docs/map/lib/adopt.md b/docs/map/lib/adopt.md
new file mode 100644
index 0000000..137838d
--- /dev/null
+++ b/docs/map/lib/adopt.md
@@ -0,0 +1,31 @@
++++
+title = "adopt"
+summary = "Turns plain objects, such as parsed YAML, into objects you can override like templates"
+kind = "lib"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "typed"
+title = "Looks up the template for each object's apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "dotted-groups"
+title = "Finds templates for groups with dots, such as networking.k8s.io"
+status = "done"
+
+[[feature]]
+id = "named-arrays"
+title = "Turns arrays back into foo_ objects keyed by name"
+status = "done"
+needs = ["/lib/named-arrays"]
+
+[[feature]]
+id = "unnamed-items"
+title = "Leaves arrays alone when their items have no name"
+status = "done"
++++
+
+Objects of a kind without a template fall back to the plain `k8s.Object`. They still work, but get none of the helpers, and cluster-wide ones get the shared namespace (see t8y:/lib/cluster-scoped).
diff --git a/docs/map/lib/cluster-scoped.md b/docs/map/lib/cluster-scoped.md
new file mode 100644
index 0000000..1235bfc
--- /dev/null
+++ b/docs/map/lib/cluster-scoped.md
@@ -0,0 +1,13 @@
++++
+title = "Cluster-scoped"
+summary = "Hides the shared namespace on kinds that live outside namespaces"
+kind = "lib"
+intent = "induced"
+research = "done"
+refs = ["k8s.libsonnet"]
+status = "done"
++++
+
+The templates for cluster-wide kinds add `clusterScoped`, which hides `metadata.namespace`. Without it, a namespace set on the shared `ObjectMeta` would show up on the object.
+
+Kinds without a template, written as `k8s.Object { apiVersion, kind }` or brought in with `k8s.adopt`, don't get this. A `StorageClass` written that way comes out with `metadata.namespace` set. That is why the cluster-wide kinds have their own milestone.
diff --git a/docs/map/lib/named-arrays.md b/docs/map/lib/named-arrays.md
new file mode 100644
index 0000000..2456e84
--- /dev/null
+++ b/docs/map/lib/named-arrays.md
@@ -0,0 +1,15 @@
++++
+title = "Named arrays"
+summary = "Write Kubernetes arrays as objects keyed by name, so overlays can reach one item"
+kind = "lib"
+intent = "induced"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "by-name"
+title = "asNamedArray and typedNamedArrays: foo_ objects become foo arrays keyed by .name"
+status = "done"
++++
+
+Some arrays use another key: StatefulSet `volumeClaimTemplates_` (`metadata.name`), ServiceMonitor `endpoints_` and PodMonitor `podMetricsEndpoints_` (`port`), VaultSecret `secrets_` (`path`). Those are written out by hand in each template; a TODO in the code asks whether to make one helper for all of them.
diff --git a/docs/map/lib/pod-template.md b/docs/map/lib/pod-template.md
new file mode 100644
index 0000000..bb3578a
--- /dev/null
+++ b/docs/map/lib/pod-template.md
@@ -0,0 +1,26 @@
++++
+title = "PodTemplateSpec"
+summary = "One pod template that every pod-creating kind extends"
+kind = "lib"
+intent = "induced"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "overlays"
+title = "k8s.v1.PodTemplateSpec: overlays on it reach every pod"
+status = "done"
+
+[[feature]]
+id = "default-container"
+title = "Sets kubectl.kubernetes.io/default-container when one container is not a sidecar"
+status = "done"
+
+[[feature]]
+id = "named-arrays"
+title = "containers_, initContainers_, volumes_; and env_, ports_, volumeMounts_ in each container"
+status = "done"
+needs = ["/lib/named-arrays"]
++++
+
+Labels and annotations in `ObjectTemplateMeta` land both on the object and on its pods. Anything added to `k8s.v1.PodTemplateSpec` lands only on the pods.
diff --git a/docs/map/lifecycle/AREA.md b/docs/map/lifecycle/AREA.md
new file mode 100644
index 0000000..386a638
--- /dev/null
+++ b/docs/map/lifecycle/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "lifecycle.k8s.io"
+band = "runtime"
+summary = "Eviction requests (alpha)"
++++
+
+Every kind in this group is created by the cluster or by API calls, so none of them needs a template.
diff --git a/docs/map/lifecycle/eviction.md b/docs/map/lifecycle/eviction.md
new file mode 100644
index 0000000..e3a02f4
--- /dev/null
+++ b/docs/map/lifecycle/eviction.md
@@ -0,0 +1,13 @@
++++
+title = "Eviction"
+summary = "Evicts a pod"
+aka = ["lifecycle.k8s.io/v1alpha1 Eviction"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: lifecycle.k8s.io/v1alpha1`, `kind: Eviction`.
+
+Alpha. Created by the cluster or by API calls, not written by hand, so a template would add little.
diff --git a/docs/map/lifecycle/evictionrequest.md b/docs/map/lifecycle/evictionrequest.md
new file mode 100644
index 0000000..eaac549
--- /dev/null
+++ b/docs/map/lifecycle/evictionrequest.md
@@ -0,0 +1,13 @@
++++
+title = "EvictionRequest"
+summary = "A request to evict a pod"
+aka = ["lifecycle.k8s.io/v1alpha1 EvictionRequest"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: lifecycle.k8s.io/v1alpha1`, `kind: EvictionRequest`.
+
+Alpha. Created by the cluster or by API calls, not written by hand, so a template would add little.
diff --git a/docs/map/networking/AREA.md b/docs/map/networking/AREA.md
new file mode 100644
index 0000000..43a0ffe
--- /dev/null
+++ b/docs/map/networking/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "networking.k8s.io"
+band = "workloads"
+summary = "Ingress, network policies and service IP ranges"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['networking.k8s.io'].v1`.
diff --git a/docs/map/networking/ingress.md b/docs/map/networking/ingress.md
new file mode 100644
index 0000000..7902f0d
--- /dev/null
+++ b/docs/map/networking/ingress.md
@@ -0,0 +1,14 @@
++++
+title = "Ingress"
+summary = "HTTP routing into the cluster"
+aka = ["networking.k8s.io/v1 Ingress", "ing"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
++++
+
+`apiVersion: networking.k8s.io/v1`, `kind: Ingress`.
+
+Template only. Ingress gets no new features upstream; Gateway API (t8y:/gateway-api/httproute) is the successor.
diff --git a/docs/map/networking/ingressclass.md b/docs/map/networking/ingressclass.md
new file mode 100644
index 0000000..3299827
--- /dev/null
+++ b/docs/map/networking/ingressclass.md
@@ -0,0 +1,18 @@
++++
+title = "IngressClass"
+summary = "Which controller handles an Ingress"
+aka = ["networking.k8s.io/v1 IngressClass"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: networking.k8s.io/v1`, `kind: IngressClass`, cluster-wide.
+
+Without a template it picks up the shared namespace.
diff --git a/docs/map/networking/ipaddress.md b/docs/map/networking/ipaddress.md
new file mode 100644
index 0000000..e542cd5
--- /dev/null
+++ b/docs/map/networking/ipaddress.md
@@ -0,0 +1,17 @@
++++
+title = "IPAddress"
+summary = "One allocated Service IP"
+aka = ["networking.k8s.io/v1 IPAddress"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: networking.k8s.io/v1`, `kind: IPAddress`, cluster-wide.
+
+Allocated by the API server.
diff --git a/docs/map/networking/networkpolicy.md b/docs/map/networking/networkpolicy.md
new file mode 100644
index 0000000..53f4180
--- /dev/null
+++ b/docs/map/networking/networkpolicy.md
@@ -0,0 +1,14 @@
++++
+title = "NetworkPolicy"
+summary = "Which pods may talk to which"
+aka = ["networking.k8s.io/v1 NetworkPolicy", "netpol"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: networking.k8s.io/v1`, `kind: NetworkPolicy`.
+
+Common in namespaced apps. The ingress and egress rules are plain arrays.
diff --git a/docs/map/networking/servicecidr.md b/docs/map/networking/servicecidr.md
new file mode 100644
index 0000000..0693e22
--- /dev/null
+++ b/docs/map/networking/servicecidr.md
@@ -0,0 +1,17 @@
++++
+title = "ServiceCIDR"
+summary = "An IP range for Services"
+aka = ["networking.k8s.io/v1 ServiceCIDR"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: networking.k8s.io/v1`, `kind: ServiceCIDR`, cluster-wide.
+
+Cluster setup; rarely in app manifests.
diff --git a/docs/map/node/AREA.md b/docs/map/node/AREA.md
new file mode 100644
index 0000000..6d2dd35
--- /dev/null
+++ b/docs/map/node/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "node.k8s.io"
+band = "cluster"
+summary = "Runtime classes"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/node/runtimeclass.md b/docs/map/node/runtimeclass.md
new file mode 100644
index 0000000..88e699c
--- /dev/null
+++ b/docs/map/node/runtimeclass.md
@@ -0,0 +1,15 @@
++++
+title = "RuntimeClass"
+summary = "A container runtime pods can choose"
+aka = ["node.k8s.io/v1 RuntimeClass"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: node.k8s.io/v1`, `kind: RuntimeClass`, cluster-wide.
diff --git a/docs/map/openshift/AREA.md b/docs/map/openshift/AREA.md
new file mode 100644
index 0000000..22a17c8
--- /dev/null
+++ b/docs/map/openshift/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "OpenShift routes"
+band = "addons"
+summary = "route.openshift.io: OpenShift HTTP routing"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['route.openshift.io'].v1`.
+
+Checked against route/v1 in https://github.com/openshift/api. Only route.openshift.io is mapped; the rest of OpenShift's APIs are out of scope.
diff --git a/docs/map/openshift/route.md b/docs/map/openshift/route.md
new file mode 100644
index 0000000..97c8457
--- /dev/null
+++ b/docs/map/openshift/route.md
@@ -0,0 +1,14 @@
++++
+title = "Route"
+summary = "OpenShift HTTP routing"
+aka = ["route.openshift.io/v1 Route"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
++++
+
+`apiVersion: route.openshift.io/v1`, `kind: Route`.
+
+Template only.
diff --git a/docs/map/opentelemetry/AREA.md b/docs/map/opentelemetry/AREA.md
new file mode 100644
index 0000000..0debbaf
--- /dev/null
+++ b/docs/map/opentelemetry/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "OpenTelemetry Operator"
+band = "addons"
+summary = "opentelemetry.io: collectors and auto-instrumentation"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against OpenTelemetry Operator v0.161.0: https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml
diff --git a/docs/map/opentelemetry/instrumentation.md b/docs/map/opentelemetry/instrumentation.md
new file mode 100644
index 0000000..7bdc60a
--- /dev/null
+++ b/docs/map/opentelemetry/instrumentation.md
@@ -0,0 +1,11 @@
++++
+title = "Instrumentation"
+summary = "Auto-instrumentation injected into pods"
+aka = ["opentelemetry.io/v1alpha1 Instrumentation", "otelinst"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: opentelemetry.io/v1alpha1`, `kind: Instrumentation`.
diff --git a/docs/map/opentelemetry/opampbridge.md b/docs/map/opentelemetry/opampbridge.md
new file mode 100644
index 0000000..5f07a4d
--- /dev/null
+++ b/docs/map/opentelemetry/opampbridge.md
@@ -0,0 +1,11 @@
++++
+title = "OpAMPBridge"
+summary = "Lets an OpAMP server manage collectors"
+aka = ["opentelemetry.io/v1alpha1 OpAMPBridge"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: opentelemetry.io/v1alpha1`, `kind: OpAMPBridge`.
diff --git a/docs/map/opentelemetry/opentelemetrycollector.md b/docs/map/opentelemetry/opentelemetrycollector.md
new file mode 100644
index 0000000..a43fc32
--- /dev/null
+++ b/docs/map/opentelemetry/opentelemetrycollector.md
@@ -0,0 +1,11 @@
++++
+title = "OpenTelemetryCollector"
+summary = "An OpenTelemetry Collector the operator runs"
+aka = ["opentelemetry.io/v1beta1 OpenTelemetryCollector", "otelcol"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: opentelemetry.io/v1beta1`, `kind: OpenTelemetryCollector`.
diff --git a/docs/map/opentelemetry/targetallocator.md b/docs/map/opentelemetry/targetallocator.md
new file mode 100644
index 0000000..fb8294a
--- /dev/null
+++ b/docs/map/opentelemetry/targetallocator.md
@@ -0,0 +1,11 @@
++++
+title = "TargetAllocator"
+summary = "Splits Prometheus scrape targets across collectors"
+aka = ["opentelemetry.io/v1alpha1 TargetAllocator"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: opentelemetry.io/v1alpha1`, `kind: TargetAllocator`.
diff --git a/docs/map/policy/AREA.md b/docs/map/policy/AREA.md
new file mode 100644
index 0000000..1e408e2
--- /dev/null
+++ b/docs/map/policy/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "policy"
+band = "workloads"
+summary = "Pod disruption budgets"
++++
+
+Templates live in `k8s.libsonnet` under `k8s.policy.v1`.
diff --git a/docs/map/policy/poddisruptionbudget.md b/docs/map/policy/poddisruptionbudget.md
new file mode 100644
index 0000000..f116cc3
--- /dev/null
+++ b/docs/map/policy/poddisruptionbudget.md
@@ -0,0 +1,22 @@
++++
+title = "PodDisruptionBudget"
+summary = "How many pods may be down during voluntary disruptions"
+aka = ["policy/v1 PodDisruptionBudget", "pdb"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "v1"
+title = "policy/v1 template"
+status = "done"
+
+[[feature]]
+id = "v1beta1"
+title = "policy/v1beta1 template"
+status = "done"
+note = "Removed in Kubernetes 1.25; kept on purpose for old clusters"
++++
+
+`apiVersion: policy/v1`, `kind: PodDisruptionBudget`.
diff --git a/docs/map/prometheus-operator/AREA.md b/docs/map/prometheus-operator/AREA.md
new file mode 100644
index 0000000..dcbada3
--- /dev/null
+++ b/docs/map/prometheus-operator/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Prometheus Operator"
+band = "addons"
+summary = "monitoring.coreos.com: Prometheus, scrape targets and alert rules"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['monitoring.coreos.com'].v1`.
+
+Checked against Prometheus Operator v0.94.1: https://github.com/prometheus-operator/prometheus-operator/tree/v0.94.1/example/prometheus-operator-crd
diff --git a/docs/map/prometheus-operator/alertmanager.md b/docs/map/prometheus-operator/alertmanager.md
new file mode 100644
index 0000000..ef94042
--- /dev/null
+++ b/docs/map/prometheus-operator/alertmanager.md
@@ -0,0 +1,13 @@
++++
+title = "Alertmanager"
+summary = "An Alertmanager the operator runs"
+aka = ["monitoring.coreos.com/v1 Alertmanager"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: monitoring.coreos.com/v1`, `kind: Alertmanager`.
+
+Usually owned by the platform team.
diff --git a/docs/map/prometheus-operator/alertmanagerconfig.md b/docs/map/prometheus-operator/alertmanagerconfig.md
new file mode 100644
index 0000000..c5578e3
--- /dev/null
+++ b/docs/map/prometheus-operator/alertmanagerconfig.md
@@ -0,0 +1,11 @@
++++
+title = "AlertmanagerConfig"
+summary = "Alert routing for one namespace"
+aka = ["monitoring.coreos.com/v1alpha1 AlertmanagerConfig"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: monitoring.coreos.com/v1alpha1`, `kind: AlertmanagerConfig`.
diff --git a/docs/map/prometheus-operator/podmonitor.md b/docs/map/prometheus-operator/podmonitor.md
new file mode 100644
index 0000000..a02f88e
--- /dev/null
+++ b/docs/map/prometheus-operator/podmonitor.md
@@ -0,0 +1,26 @@
++++
+title = "PodMonitor"
+summary = "Tells Prometheus to scrape pods"
+aka = ["monitoring.coreos.com/v1 PodMonitor"]
+kind = "crd"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "pod-metrics-endpoints"
+title = "podMetricsEndpoints_ keyed by port"
+status = "done"
+
+[[feature]]
+id = "selector"
+title = "selector.matchExpressions_ keyed by key"
+status = "done"
++++
+
+`apiVersion: monitoring.coreos.com/v1`, `kind: PodMonitor`.
diff --git a/docs/map/prometheus-operator/probe.md b/docs/map/prometheus-operator/probe.md
new file mode 100644
index 0000000..c2b3733
--- /dev/null
+++ b/docs/map/prometheus-operator/probe.md
@@ -0,0 +1,11 @@
++++
+title = "Probe"
+summary = "Scrapes a target through a blackbox prober"
+aka = ["monitoring.coreos.com/v1 Probe"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: monitoring.coreos.com/v1`, `kind: Probe`.
diff --git a/docs/map/prometheus-operator/prometheus.md b/docs/map/prometheus-operator/prometheus.md
new file mode 100644
index 0000000..01ef8ee
--- /dev/null
+++ b/docs/map/prometheus-operator/prometheus.md
@@ -0,0 +1,13 @@
++++
+title = "Prometheus"
+summary = "A Prometheus server the operator runs"
+aka = ["monitoring.coreos.com/v1 Prometheus"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: monitoring.coreos.com/v1`, `kind: Prometheus`.
+
+Usually owned by the platform team.
diff --git a/docs/map/prometheus-operator/prometheusagent.md b/docs/map/prometheus-operator/prometheusagent.md
new file mode 100644
index 0000000..d6cc1eb
--- /dev/null
+++ b/docs/map/prometheus-operator/prometheusagent.md
@@ -0,0 +1,13 @@
++++
+title = "PrometheusAgent"
+summary = "A Prometheus in agent mode"
+aka = ["monitoring.coreos.com/v1alpha1 PrometheusAgent"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: monitoring.coreos.com/v1alpha1`, `kind: PrometheusAgent`.
+
+Usually owned by the platform team.
diff --git a/docs/map/prometheus-operator/prometheusrule.md b/docs/map/prometheus-operator/prometheusrule.md
new file mode 100644
index 0000000..523a10a
--- /dev/null
+++ b/docs/map/prometheus-operator/prometheusrule.md
@@ -0,0 +1,14 @@
++++
+title = "PrometheusRule"
+summary = "Alerting and recording rules"
+aka = ["monitoring.coreos.com/v1 PrometheusRule"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m1"
++++
+
+`apiVersion: monitoring.coreos.com/v1`, `kind: PrometheusRule`.
+
+Alerts usually ship next to the monitors this library already covers.
diff --git a/docs/map/prometheus-operator/scrapeconfig.md b/docs/map/prometheus-operator/scrapeconfig.md
new file mode 100644
index 0000000..95c84c5
--- /dev/null
+++ b/docs/map/prometheus-operator/scrapeconfig.md
@@ -0,0 +1,11 @@
++++
+title = "ScrapeConfig"
+summary = "Raw Prometheus scrape configuration"
+aka = ["monitoring.coreos.com/v1alpha1 ScrapeConfig"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: monitoring.coreos.com/v1alpha1`, `kind: ScrapeConfig`.
diff --git a/docs/map/prometheus-operator/servicemonitor.md b/docs/map/prometheus-operator/servicemonitor.md
new file mode 100644
index 0000000..27614f0
--- /dev/null
+++ b/docs/map/prometheus-operator/servicemonitor.md
@@ -0,0 +1,26 @@
++++
+title = "ServiceMonitor"
+summary = "Tells Prometheus to scrape a Service"
+aka = ["monitoring.coreos.com/v1 ServiceMonitor"]
+kind = "crd"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "endpoints"
+title = "endpoints_ keyed by port"
+status = "done"
+
+[[feature]]
+id = "selector"
+title = "selector.matchExpressions_ keyed by key"
+status = "done"
++++
+
+`apiVersion: monitoring.coreos.com/v1`, `kind: ServiceMonitor`.
diff --git a/docs/map/prometheus-operator/thanosruler.md b/docs/map/prometheus-operator/thanosruler.md
new file mode 100644
index 0000000..f18488f
--- /dev/null
+++ b/docs/map/prometheus-operator/thanosruler.md
@@ -0,0 +1,13 @@
++++
+title = "ThanosRuler"
+summary = "A Thanos Ruler the operator runs"
+aka = ["monitoring.coreos.com/v1 ThanosRuler"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: monitoring.coreos.com/v1`, `kind: ThanosRuler`.
+
+Usually owned by the platform team.
diff --git a/docs/map/rbac/AREA.md b/docs/map/rbac/AREA.md
new file mode 100644
index 0000000..f0397a2
--- /dev/null
+++ b/docs/map/rbac/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "rbac.authorization.k8s.io"
+band = "cluster"
+summary = "Roles, and who gets them"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['rbac.authorization.k8s.io'].v1`.
diff --git a/docs/map/rbac/clusterrole.md b/docs/map/rbac/clusterrole.md
new file mode 100644
index 0000000..061b035
--- /dev/null
+++ b/docs/map/rbac/clusterrole.md
@@ -0,0 +1,18 @@
++++
+title = "ClusterRole"
+summary = "Permissions across the cluster"
+aka = ["rbac.authorization.k8s.io/v1 ClusterRole"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: rbac.authorization.k8s.io/v1`, `kind: ClusterRole`, cluster-wide.
+
+Template with an empty `rules` list.
diff --git a/docs/map/rbac/clusterrolebinding.md b/docs/map/rbac/clusterrolebinding.md
new file mode 100644
index 0000000..11dfb2b
--- /dev/null
+++ b/docs/map/rbac/clusterrolebinding.md
@@ -0,0 +1,25 @@
++++
+title = "ClusterRoleBinding"
+summary = "Gives a ClusterRole across the cluster"
+aka = ["rbac.authorization.k8s.io/v1 ClusterRoleBinding"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "refs"
+title = "ClusterRoleRef, UserRef, GroupRef and ServiceAccountRef helpers"
+status = "done"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: rbac.authorization.k8s.io/v1`, `kind: ClusterRoleBinding`, cluster-wide.
diff --git a/docs/map/rbac/role.md b/docs/map/rbac/role.md
new file mode 100644
index 0000000..e541f2a
--- /dev/null
+++ b/docs/map/rbac/role.md
@@ -0,0 +1,14 @@
++++
+title = "Role"
+summary = "Permissions inside one namespace"
+aka = ["rbac.authorization.k8s.io/v1 Role"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
++++
+
+`apiVersion: rbac.authorization.k8s.io/v1`, `kind: Role`.
+
+Template with an empty `rules` list.
diff --git a/docs/map/rbac/rolebinding.md b/docs/map/rbac/rolebinding.md
new file mode 100644
index 0000000..e05b1a5
--- /dev/null
+++ b/docs/map/rbac/rolebinding.md
@@ -0,0 +1,23 @@
++++
+title = "RoleBinding"
+summary = "Gives a Role or ClusterRole to users, groups or service accounts"
+aka = ["rbac.authorization.k8s.io/v1 RoleBinding"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "refs"
+title = "RoleRef, ClusterRoleRef, UserRef, GroupRef and ServiceAccountRef helpers"
+status = "done"
++++
+
+`apiVersion: rbac.authorization.k8s.io/v1`, `kind: RoleBinding`.
+
+`ServiceAccountRef` picks up the namespace set on the shared `ObjectMeta`.
diff --git a/docs/map/resource/AREA.md b/docs/map/resource/AREA.md
new file mode 100644
index 0000000..792ec81
--- /dev/null
+++ b/docs/map/resource/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "resource.k8s.io"
+band = "cluster"
+summary = "Dynamic resource allocation: GPUs and other devices"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/resource/deviceclass.md b/docs/map/resource/deviceclass.md
new file mode 100644
index 0000000..4c65010
--- /dev/null
+++ b/docs/map/resource/deviceclass.md
@@ -0,0 +1,17 @@
++++
+title = "DeviceClass"
+summary = "A kind of device that claims can ask for"
+aka = ["resource.k8s.io/v1 DeviceClass"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: resource.k8s.io/v1`, `kind: DeviceClass`, cluster-wide.
+
+Usually ships with a device driver.
diff --git a/docs/map/resource/devicetaintrule.md b/docs/map/resource/devicetaintrule.md
new file mode 100644
index 0000000..68a67e9
--- /dev/null
+++ b/docs/map/resource/devicetaintrule.md
@@ -0,0 +1,15 @@
++++
+title = "DeviceTaintRule"
+summary = "Taints devices so pods avoid them"
+aka = ["resource.k8s.io/v1 DeviceTaintRule"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: resource.k8s.io/v1`, `kind: DeviceTaintRule`, cluster-wide.
diff --git a/docs/map/resource/resourceclaim.md b/docs/map/resource/resourceclaim.md
new file mode 100644
index 0000000..4f1dcc2
--- /dev/null
+++ b/docs/map/resource/resourceclaim.md
@@ -0,0 +1,11 @@
++++
+title = "ResourceClaim"
+summary = "A request for a device that pods can share"
+aka = ["resource.k8s.io/v1 ResourceClaim"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: resource.k8s.io/v1`, `kind: ResourceClaim`.
diff --git a/docs/map/resource/resourceclaimtemplate.md b/docs/map/resource/resourceclaimtemplate.md
new file mode 100644
index 0000000..cb44fff
--- /dev/null
+++ b/docs/map/resource/resourceclaimtemplate.md
@@ -0,0 +1,14 @@
++++
+title = "ResourceClaimTemplate"
+summary = "Lets each pod ask for its own device, such as a GPU"
+aka = ["resource.k8s.io/v1 ResourceClaimTemplate"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m3"
++++
+
+`apiVersion: resource.k8s.io/v1`, `kind: ResourceClaimTemplate`.
+
+The usual way pods ask for devices with dynamic resource allocation (GA in Kubernetes 1.34).
diff --git a/docs/map/resource/resourcepoolstatusrequest.md b/docs/map/resource/resourcepoolstatusrequest.md
new file mode 100644
index 0000000..a1f91cd
--- /dev/null
+++ b/docs/map/resource/resourcepoolstatusrequest.md
@@ -0,0 +1,17 @@
++++
+title = "ResourcePoolStatusRequest"
+summary = "Asks the cluster for a one-time report on device pools"
+aka = ["resource.k8s.io/v1alpha3 ResourcePoolStatusRequest"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: resource.k8s.io/v1alpha3`, `kind: ResourcePoolStatusRequest`, cluster-wide.
+
+Alpha. A query that tools create and delete, not something kept in manifests.
diff --git a/docs/map/resource/resourceslice.md b/docs/map/resource/resourceslice.md
new file mode 100644
index 0000000..d8e18d2
--- /dev/null
+++ b/docs/map/resource/resourceslice.md
@@ -0,0 +1,17 @@
++++
+title = "ResourceSlice"
+summary = "Devices a driver has found"
+aka = ["resource.k8s.io/v1 ResourceSlice"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: resource.k8s.io/v1`, `kind: ResourceSlice`, cluster-wide.
+
+Published by device drivers.
diff --git a/docs/map/scheduling/AREA.md b/docs/map/scheduling/AREA.md
new file mode 100644
index 0000000..2cd4cb3
--- /dev/null
+++ b/docs/map/scheduling/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "scheduling.k8s.io"
+band = "cluster"
+summary = "Priority classes and gang scheduling"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/scheduling/compositepodgroup.md b/docs/map/scheduling/compositepodgroup.md
new file mode 100644
index 0000000..9f75836
--- /dev/null
+++ b/docs/map/scheduling/compositepodgroup.md
@@ -0,0 +1,13 @@
++++
+title = "CompositePodGroup"
+summary = "Several pod groups scheduled together"
+aka = ["scheduling.k8s.io/v1alpha3 CompositePodGroup"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: scheduling.k8s.io/v1alpha3`, `kind: CompositePodGroup`.
+
+Alpha. Created by workload controllers such as LeaderWorkerSet and JobSet.
diff --git a/docs/map/scheduling/podgroup.md b/docs/map/scheduling/podgroup.md
new file mode 100644
index 0000000..d4eb0c2
--- /dev/null
+++ b/docs/map/scheduling/podgroup.md
@@ -0,0 +1,13 @@
++++
+title = "PodGroup"
+summary = "A group of pods scheduled all at once"
+aka = ["scheduling.k8s.io/v1beta1 PodGroup"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: scheduling.k8s.io/v1beta1`, `kind: PodGroup`.
+
+Beta. Created by workload controllers from a Workload's podGroupTemplates.
diff --git a/docs/map/scheduling/priorityclass.md b/docs/map/scheduling/priorityclass.md
new file mode 100644
index 0000000..baeed4b
--- /dev/null
+++ b/docs/map/scheduling/priorityclass.md
@@ -0,0 +1,18 @@
++++
+title = "PriorityClass"
+summary = "A scheduling priority pods can ask for"
+aka = ["scheduling.k8s.io/v1 PriorityClass", "pc"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: scheduling.k8s.io/v1`, `kind: PriorityClass`, cluster-wide.
+
+Without a template it picks up the shared namespace.
diff --git a/docs/map/scheduling/workload.md b/docs/map/scheduling/workload.md
new file mode 100644
index 0000000..0e74492
--- /dev/null
+++ b/docs/map/scheduling/workload.md
@@ -0,0 +1,13 @@
++++
+title = "Workload"
+summary = "Describes a group of pods scheduled together"
+aka = ["scheduling.k8s.io/v1beta1 Workload"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: scheduling.k8s.io/v1beta1`, `kind: Workload`.
+
+Beta.
diff --git a/docs/map/sealed-secrets/AREA.md b/docs/map/sealed-secrets/AREA.md
new file mode 100644
index 0000000..f823379
--- /dev/null
+++ b/docs/map/sealed-secrets/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Sealed Secrets"
+band = "addons"
+summary = "bitnami.com: encrypted Secrets that are safe to commit"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['bitnami.com'].v1alpha1`.
+
+Checked against Sealed Secrets v0.40.0: https://github.com/bitnami-labs/sealed-secrets/blob/v0.40.0/helm/sealed-secrets/crds/bitnami.com_sealedsecrets.yaml
diff --git a/docs/map/sealed-secrets/sealedsecret.md b/docs/map/sealed-secrets/sealedsecret.md
new file mode 100644
index 0000000..1265383
--- /dev/null
+++ b/docs/map/sealed-secrets/sealedsecret.md
@@ -0,0 +1,14 @@
++++
+title = "SealedSecret"
+summary = "An encrypted Secret that is safe to commit"
+aka = ["bitnami.com/v1alpha1 SealedSecret"]
+kind = "crd"
+intent = "goal"
+research = "done"
+status = "done"
+refs = ["k8s.libsonnet"]
++++
+
+`apiVersion: bitnami.com/v1alpha1`, `kind: SealedSecret`.
+
+Template only.
diff --git a/docs/map/secrets-store-csi/AREA.md b/docs/map/secrets-store-csi/AREA.md
new file mode 100644
index 0000000..a554ac5
--- /dev/null
+++ b/docs/map/secrets-store-csi/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Secrets Store CSI Driver"
+band = "official"
+summary = "secrets-store.csi.x-k8s.io: mounts secrets from outside stores"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against v1.6.1: https://github.com/kubernetes-sigs/secrets-store-csi-driver/tree/v1.6.1/deploy
diff --git a/docs/map/secrets-store-csi/secretproviderclass.md b/docs/map/secrets-store-csi/secretproviderclass.md
new file mode 100644
index 0000000..900ba95
--- /dev/null
+++ b/docs/map/secrets-store-csi/secretproviderclass.md
@@ -0,0 +1,11 @@
++++
+title = "SecretProviderClass"
+summary = "Which outside secrets to mount, and from where"
+aka = ["secrets-store.csi.x-k8s.io/v1 SecretProviderClass"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: secrets-store.csi.x-k8s.io/v1`, `kind: SecretProviderClass`.
diff --git a/docs/map/secrets-store-csi/secretproviderclasspodstatus.md b/docs/map/secrets-store-csi/secretproviderclasspodstatus.md
new file mode 100644
index 0000000..d0c9fdb
--- /dev/null
+++ b/docs/map/secrets-store-csi/secretproviderclasspodstatus.md
@@ -0,0 +1,13 @@
++++
+title = "SecretProviderClassPodStatus"
+summary = "Which secrets a pod has mounted"
+aka = ["secrets-store.csi.x-k8s.io/v1 SecretProviderClassPodStatus"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: secrets-store.csi.x-k8s.io/v1`, `kind: SecretProviderClassPodStatus`.
+
+Written by the driver.
diff --git a/docs/map/storage/AREA.md b/docs/map/storage/AREA.md
new file mode 100644
index 0000000..d18d5e7
--- /dev/null
+++ b/docs/map/storage/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "storage.k8s.io"
+band = "cluster"
+summary = "Storage classes and CSI drivers"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
diff --git a/docs/map/storage/csidriver.md b/docs/map/storage/csidriver.md
new file mode 100644
index 0000000..9b4afb2
--- /dev/null
+++ b/docs/map/storage/csidriver.md
@@ -0,0 +1,17 @@
++++
+title = "CSIDriver"
+summary = "Settings for a CSI storage driver"
+aka = ["storage.k8s.io/v1 CSIDriver"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: storage.k8s.io/v1`, `kind: CSIDriver`, cluster-wide.
+
+Ships with storage drivers.
diff --git a/docs/map/storage/csinode.md b/docs/map/storage/csinode.md
new file mode 100644
index 0000000..19e22d4
--- /dev/null
+++ b/docs/map/storage/csinode.md
@@ -0,0 +1,17 @@
++++
+title = "CSINode"
+summary = "CSI drivers on one node"
+aka = ["storage.k8s.io/v1 CSINode"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: storage.k8s.io/v1`, `kind: CSINode`, cluster-wide.
+
+Registered by the kubelet.
diff --git a/docs/map/storage/csistoragecapacity.md b/docs/map/storage/csistoragecapacity.md
new file mode 100644
index 0000000..776a038
--- /dev/null
+++ b/docs/map/storage/csistoragecapacity.md
@@ -0,0 +1,13 @@
++++
+title = "CSIStorageCapacity"
+summary = "Storage capacity a CSI driver reports"
+aka = ["storage.k8s.io/v1 CSIStorageCapacity"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: storage.k8s.io/v1`, `kind: CSIStorageCapacity`.
+
+Published by CSI drivers.
diff --git a/docs/map/storage/storageclass.md b/docs/map/storage/storageclass.md
new file mode 100644
index 0000000..f3f729d
--- /dev/null
+++ b/docs/map/storage/storageclass.md
@@ -0,0 +1,18 @@
++++
+title = "StorageClass"
+summary = "A kind of storage that PVCs can ask for"
+aka = ["storage.k8s.io/v1 StorageClass", "sc"]
+kind = "builtin"
+intent = "goal"
+research = "done"
+status = "todo"
+milestone = "m2"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: storage.k8s.io/v1`, `kind: StorageClass`, cluster-wide.
+
+Without a template it picks up the shared namespace.
diff --git a/docs/map/storage/volumeattachment.md b/docs/map/storage/volumeattachment.md
new file mode 100644
index 0000000..7cb926e
--- /dev/null
+++ b/docs/map/storage/volumeattachment.md
@@ -0,0 +1,17 @@
++++
+title = "VolumeAttachment"
+summary = "A volume attached to a node"
+aka = ["storage.k8s.io/v1 VolumeAttachment"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: storage.k8s.io/v1`, `kind: VolumeAttachment`, cluster-wide.
+
+Created by the cluster or by API calls, not written by hand, so a template would add little.
diff --git a/docs/map/storage/volumeattributesclass.md b/docs/map/storage/volumeattributesclass.md
new file mode 100644
index 0000000..60b03ad
--- /dev/null
+++ b/docs/map/storage/volumeattributesclass.md
@@ -0,0 +1,15 @@
++++
+title = "VolumeAttributesClass"
+summary = "Changeable volume settings such as IOPS"
+aka = ["storage.k8s.io/v1 VolumeAttributesClass", "vac"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: storage.k8s.io/v1`, `kind: VolumeAttributesClass`, cluster-wide.
diff --git a/docs/map/storagemigration/AREA.md b/docs/map/storagemigration/AREA.md
new file mode 100644
index 0000000..d531c2e
--- /dev/null
+++ b/docs/map/storagemigration/AREA.md
@@ -0,0 +1,7 @@
++++
+title = "storagemigration.k8s.io"
+band = "runtime"
+summary = "Storage version migrations"
++++
+
+Every kind in this group is created by the cluster or by API calls, so none of them needs a template.
diff --git a/docs/map/storagemigration/storageversionmigration.md b/docs/map/storagemigration/storageversionmigration.md
new file mode 100644
index 0000000..663aead
--- /dev/null
+++ b/docs/map/storagemigration/storageversionmigration.md
@@ -0,0 +1,17 @@
++++
+title = "StorageVersionMigration"
+summary = "Rewrites stored objects in a newer version"
+aka = ["storagemigration.k8s.io/v1 StorageVersionMigration"]
+kind = "builtin"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: storagemigration.k8s.io/v1`, `kind: StorageVersionMigration`, cluster-wide.
+
+Run by cluster admins and tools.
diff --git a/docs/map/strimzi/AREA.md b/docs/map/strimzi/AREA.md
new file mode 100644
index 0000000..dc9b21d
--- /dev/null
+++ b/docs/map/strimzi/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Strimzi"
+band = "addons"
+summary = "kafka.strimzi.io: Kafka on Kubernetes"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['kafka.strimzi.io'].v1` and `.v1beta2`.
+
+Checked against Strimzi 1.3.0: https://github.com/strimzi/strimzi-kafka-operator/tree/1.3.0/packaging/install/cluster-operator. Strimzi 1.0 removed every version older than v1.
diff --git a/docs/map/strimzi/kafka.md b/docs/map/strimzi/kafka.md
new file mode 100644
index 0000000..985ed8d
--- /dev/null
+++ b/docs/map/strimzi/kafka.md
@@ -0,0 +1,13 @@
++++
+title = "Kafka"
+summary = "A Kafka cluster"
+aka = ["kafka.strimzi.io/v1 Kafka"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kafka.strimzi.io/v1`, `kind: Kafka`.
+
+Usually owned by the platform team.
diff --git a/docs/map/strimzi/kafkabridge.md b/docs/map/strimzi/kafkabridge.md
new file mode 100644
index 0000000..0f0dfe9
--- /dev/null
+++ b/docs/map/strimzi/kafkabridge.md
@@ -0,0 +1,11 @@
++++
+title = "KafkaBridge"
+summary = "An HTTP bridge to Kafka"
+aka = ["kafka.strimzi.io/v1 KafkaBridge"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kafka.strimzi.io/v1`, `kind: KafkaBridge`.
diff --git a/docs/map/strimzi/kafkaconnect.md b/docs/map/strimzi/kafkaconnect.md
new file mode 100644
index 0000000..1175e94
--- /dev/null
+++ b/docs/map/strimzi/kafkaconnect.md
@@ -0,0 +1,11 @@
++++
+title = "KafkaConnect"
+summary = "A Kafka Connect cluster"
+aka = ["kafka.strimzi.io/v1 KafkaConnect"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kafka.strimzi.io/v1`, `kind: KafkaConnect`.
diff --git a/docs/map/strimzi/kafkaconnector.md b/docs/map/strimzi/kafkaconnector.md
new file mode 100644
index 0000000..470b73f
--- /dev/null
+++ b/docs/map/strimzi/kafkaconnector.md
@@ -0,0 +1,11 @@
++++
+title = "KafkaConnector"
+summary = "A connector running in Kafka Connect"
+aka = ["kafka.strimzi.io/v1 KafkaConnector"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kafka.strimzi.io/v1`, `kind: KafkaConnector`.
diff --git a/docs/map/strimzi/kafkamirrormaker2.md b/docs/map/strimzi/kafkamirrormaker2.md
new file mode 100644
index 0000000..99ae6d8
--- /dev/null
+++ b/docs/map/strimzi/kafkamirrormaker2.md
@@ -0,0 +1,11 @@
++++
+title = "KafkaMirrorMaker2"
+summary = "Copies topics between Kafka clusters"
+aka = ["kafka.strimzi.io/v1 KafkaMirrorMaker2"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kafka.strimzi.io/v1`, `kind: KafkaMirrorMaker2`.
diff --git a/docs/map/strimzi/kafkanodepool.md b/docs/map/strimzi/kafkanodepool.md
new file mode 100644
index 0000000..e728616
--- /dev/null
+++ b/docs/map/strimzi/kafkanodepool.md
@@ -0,0 +1,13 @@
++++
+title = "KafkaNodePool"
+summary = "A group of Kafka nodes in a cluster"
+aka = ["kafka.strimzi.io/v1 KafkaNodePool"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kafka.strimzi.io/v1`, `kind: KafkaNodePool`.
+
+Usually owned by the platform team.
diff --git a/docs/map/strimzi/kafkarebalance.md b/docs/map/strimzi/kafkarebalance.md
new file mode 100644
index 0000000..d80637d
--- /dev/null
+++ b/docs/map/strimzi/kafkarebalance.md
@@ -0,0 +1,13 @@
++++
+title = "KafkaRebalance"
+summary = "Asks Cruise Control to rebalance a cluster"
+aka = ["kafka.strimzi.io/v1 KafkaRebalance"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kafka.strimzi.io/v1`, `kind: KafkaRebalance`.
+
+Usually created when needed, not kept in manifests.
diff --git a/docs/map/strimzi/kafkatopic.md b/docs/map/strimzi/kafkatopic.md
new file mode 100644
index 0000000..03da8d8
--- /dev/null
+++ b/docs/map/strimzi/kafkatopic.md
@@ -0,0 +1,25 @@
++++
+title = "KafkaTopic"
+summary = "A Kafka topic managed by Strimzi"
+aka = ["kafka.strimzi.io/v1 KafkaTopic"]
+kind = "crd"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "v1beta2"
+title = "kafka.strimzi.io/v1beta2 template"
+status = "done"
+note = "Only for Strimzi before 1.0, which removed v1beta2"
+
+[[feature]]
+id = "v1"
+title = "kafka.strimzi.io/v1 template"
+status = "done"
+note = "The only version Strimzi 1.x serves"
++++
+
+`apiVersion: kafka.strimzi.io/v1`, `kind: KafkaTopic`.
+
+`spec.topicName` is required by the template.
diff --git a/docs/map/strimzi/kafkauser.md b/docs/map/strimzi/kafkauser.md
new file mode 100644
index 0000000..0dced15
--- /dev/null
+++ b/docs/map/strimzi/kafkauser.md
@@ -0,0 +1,11 @@
++++
+title = "KafkaUser"
+summary = "A Kafka user and its ACLs"
+aka = ["kafka.strimzi.io/v1 KafkaUser"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: kafka.strimzi.io/v1`, `kind: KafkaUser`.
diff --git a/docs/map/strimzi/strimzipodset.md b/docs/map/strimzi/strimzipodset.md
new file mode 100644
index 0000000..63e264a
--- /dev/null
+++ b/docs/map/strimzi/strimzipodset.md
@@ -0,0 +1,13 @@
++++
+title = "StrimziPodSet"
+summary = "The pods of a Kafka cluster"
+aka = ["core.strimzi.io/v1 StrimziPodSet", "sps"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: core.strimzi.io/v1`, `kind: StrimziPodSet`.
+
+Created by the Strimzi operator.
diff --git a/docs/map/todography.toml b/docs/map/todography.toml
new file mode 100644
index 0000000..426a430
--- /dev/null
+++ b/docs/map/todography.toml
@@ -0,0 +1,61 @@
+# The k8s-libsonnet coverage map: which Kubernetes kinds have a template in
+# k8s.libsonnet and which don't yet. `todography lint` checks it;
+# `todography build` draws it.
+title = "k8s-libsonnet"
+
+# Bands are drawn top to bottom in this order: add-ons on top, built-in
+# Kubernetes below them, the library's own pieces at the bottom.
+[[band]]
+id = "addons"
+title = "Third-party add-on APIs"
+
+[[band]]
+id = "official"
+title = "Official add-on APIs"
+
+[[band]]
+id = "workloads"
+title = "Workloads and app config"
+
+[[band]]
+id = "cluster"
+title = "Cluster-wide and platform"
+
+[[band]]
+id = "runtime"
+title = "Created at runtime"
+
+[[band]]
+id = "lib"
+title = "Library machinery"
+
+[[milestone]]
+id = "m1"
+title = "Common app kinds"
+summary = "Kinds that most app manifests contain"
+
+[[milestone]]
+id = "m2"
+title = "Cluster-wide kinds"
+summary = "Templates that stop the shared namespace leaking into cluster-wide objects"
+
+[[milestone]]
+id = "m3"
+title = "Later"
+summary = "Real but less common kinds"
+
+[[kind]]
+id = "builtin"
+summary = "A kind built into Kubernetes (v1.37)"
+
+[[kind]]
+id = "sig-crd"
+summary = "An official Kubernetes API from a SIG project, installed as CRDs"
+
+[[kind]]
+id = "crd"
+summary = "A third-party API, installed as CRDs"
+
+[[kind]]
+id = "lib"
+summary = "A shared piece of k8s.libsonnet"
diff --git a/docs/map/vault-secrets/AREA.md b/docs/map/vault-secrets/AREA.md
new file mode 100644
index 0000000..07a2ff8
--- /dev/null
+++ b/docs/map/vault-secrets/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Vault secret operator"
+band = "addons"
+summary = "maupu.org: copies Vault secrets into Kubernetes Secrets"
++++
+
+Templates live in `k8s.libsonnet` under `k8s['maupu.org'].v1beta1`.
+
+Checked against the main branch of https://github.com/nmaupu/vault-secret (config/crd/bases/maupu.org_vaultsecrets.yaml). The project has had no commits since February 2023.
diff --git a/docs/map/vault-secrets/vaultsecret.md b/docs/map/vault-secrets/vaultsecret.md
new file mode 100644
index 0000000..7b3e180
--- /dev/null
+++ b/docs/map/vault-secrets/vaultsecret.md
@@ -0,0 +1,28 @@
++++
+title = "VaultSecret"
+summary = "Copies secrets from Vault into a Kubernetes Secret"
+aka = ["maupu.org/v1beta1 VaultSecret"]
+kind = "crd"
+intent = "goal"
+research = "done"
+refs = ["k8s.libsonnet"]
+
+[[feature]]
+id = "template"
+title = "Template with apiVersion and kind"
+status = "done"
+
+[[feature]]
+id = "defaults"
+title = "Default Vault Kubernetes auth settings"
+status = "done"
+
+[[feature]]
+id = "secrets"
+title = "secrets_ keyed by path"
+status = "done"
++++
+
+`apiVersion: maupu.org/v1beta1`, `kind: VaultSecret`.
+
+The upstream project has had no commits since February 2023.
diff --git a/docs/map/velero/AREA.md b/docs/map/velero/AREA.md
new file mode 100644
index 0000000..cb2dcef
--- /dev/null
+++ b/docs/map/velero/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Velero"
+band = "addons"
+summary = "velero.io: backup and restore"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against Velero v1.18.4: https://github.com/vmware-tanzu/velero/tree/v1.18.4/config/crd
diff --git a/docs/map/velero/backup.md b/docs/map/velero/backup.md
new file mode 100644
index 0000000..d5cf410
--- /dev/null
+++ b/docs/map/velero/backup.md
@@ -0,0 +1,13 @@
++++
+title = "Backup"
+summary = "One backup"
+aka = ["velero.io/v1 Backup"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: velero.io/v1`, `kind: Backup`.
+
+Usually created with the velero CLI or by a Schedule.
diff --git a/docs/map/velero/backuprepository.md b/docs/map/velero/backuprepository.md
new file mode 100644
index 0000000..67f54b7
--- /dev/null
+++ b/docs/map/velero/backuprepository.md
@@ -0,0 +1,13 @@
++++
+title = "BackupRepository"
+summary = "A repository for file-level backups"
+aka = ["velero.io/v1 BackupRepository"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: velero.io/v1`, `kind: BackupRepository`.
+
+Created by Velero.
diff --git a/docs/map/velero/backupstoragelocation.md b/docs/map/velero/backupstoragelocation.md
new file mode 100644
index 0000000..5c499bb
--- /dev/null
+++ b/docs/map/velero/backupstoragelocation.md
@@ -0,0 +1,11 @@
++++
+title = "BackupStorageLocation"
+summary = "Where backups are stored"
+aka = ["velero.io/v1 BackupStorageLocation", "bsl"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: velero.io/v1`, `kind: BackupStorageLocation`.
diff --git a/docs/map/velero/datadownload.md b/docs/map/velero/datadownload.md
new file mode 100644
index 0000000..883b5fa
--- /dev/null
+++ b/docs/map/velero/datadownload.md
@@ -0,0 +1,13 @@
++++
+title = "DataDownload"
+summary = "Moves one snapshot's data back"
+aka = ["velero.io/v2alpha1 DataDownload"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: velero.io/v2alpha1`, `kind: DataDownload`.
+
+Created by Velero.
diff --git a/docs/map/velero/dataupload.md b/docs/map/velero/dataupload.md
new file mode 100644
index 0000000..67abccc
--- /dev/null
+++ b/docs/map/velero/dataupload.md
@@ -0,0 +1,13 @@
++++
+title = "DataUpload"
+summary = "Moves one snapshot's data to storage"
+aka = ["velero.io/v2alpha1 DataUpload"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: velero.io/v2alpha1`, `kind: DataUpload`.
+
+Created by Velero.
diff --git a/docs/map/velero/deletebackuprequest.md b/docs/map/velero/deletebackuprequest.md
new file mode 100644
index 0000000..c7805c2
--- /dev/null
+++ b/docs/map/velero/deletebackuprequest.md
@@ -0,0 +1,13 @@
++++
+title = "DeleteBackupRequest"
+summary = "Asks Velero to delete a backup"
+aka = ["velero.io/v1 DeleteBackupRequest"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: velero.io/v1`, `kind: DeleteBackupRequest`.
+
+Created by the velero CLI.
diff --git a/docs/map/velero/downloadrequest.md b/docs/map/velero/downloadrequest.md
new file mode 100644
index 0000000..c934ce4
--- /dev/null
+++ b/docs/map/velero/downloadrequest.md
@@ -0,0 +1,13 @@
++++
+title = "DownloadRequest"
+summary = "Asks Velero for a download link"
+aka = ["velero.io/v1 DownloadRequest"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: velero.io/v1`, `kind: DownloadRequest`.
+
+Created by the velero CLI.
diff --git a/docs/map/velero/podvolumebackup.md b/docs/map/velero/podvolumebackup.md
new file mode 100644
index 0000000..0337874
--- /dev/null
+++ b/docs/map/velero/podvolumebackup.md
@@ -0,0 +1,13 @@
++++
+title = "PodVolumeBackup"
+summary = "A backup of one pod volume"
+aka = ["velero.io/v1 PodVolumeBackup"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: velero.io/v1`, `kind: PodVolumeBackup`.
+
+Created by Velero.
diff --git a/docs/map/velero/podvolumerestore.md b/docs/map/velero/podvolumerestore.md
new file mode 100644
index 0000000..46be35f
--- /dev/null
+++ b/docs/map/velero/podvolumerestore.md
@@ -0,0 +1,13 @@
++++
+title = "PodVolumeRestore"
+summary = "A restore of one pod volume"
+aka = ["velero.io/v1 PodVolumeRestore"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: velero.io/v1`, `kind: PodVolumeRestore`.
+
+Created by Velero.
diff --git a/docs/map/velero/restore.md b/docs/map/velero/restore.md
new file mode 100644
index 0000000..e305dbf
--- /dev/null
+++ b/docs/map/velero/restore.md
@@ -0,0 +1,13 @@
++++
+title = "Restore"
+summary = "One restore"
+aka = ["velero.io/v1 Restore"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: velero.io/v1`, `kind: Restore`.
+
+Usually created with the velero CLI.
diff --git a/docs/map/velero/schedule.md b/docs/map/velero/schedule.md
new file mode 100644
index 0000000..a7a07db
--- /dev/null
+++ b/docs/map/velero/schedule.md
@@ -0,0 +1,11 @@
++++
+title = "Schedule"
+summary = "Takes backups on a schedule"
+aka = ["velero.io/v1 Schedule"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: velero.io/v1`, `kind: Schedule`.
diff --git a/docs/map/velero/serverstatusrequest.md b/docs/map/velero/serverstatusrequest.md
new file mode 100644
index 0000000..f300d36
--- /dev/null
+++ b/docs/map/velero/serverstatusrequest.md
@@ -0,0 +1,13 @@
++++
+title = "ServerStatusRequest"
+summary = "Asks the Velero server for its status"
+aka = ["velero.io/v1 ServerStatusRequest"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: velero.io/v1`, `kind: ServerStatusRequest`.
+
+Created by the velero CLI.
diff --git a/docs/map/velero/volumesnapshotlocation.md b/docs/map/velero/volumesnapshotlocation.md
new file mode 100644
index 0000000..8f59f83
--- /dev/null
+++ b/docs/map/velero/volumesnapshotlocation.md
@@ -0,0 +1,11 @@
++++
+title = "VolumeSnapshotLocation"
+summary = "Where volume snapshots are stored"
+aka = ["velero.io/v1 VolumeSnapshotLocation", "vsl"]
+kind = "crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: velero.io/v1`, `kind: VolumeSnapshotLocation`.
diff --git a/docs/map/vertical-pod-autoscaler/AREA.md b/docs/map/vertical-pod-autoscaler/AREA.md
new file mode 100644
index 0000000..ac7260e
--- /dev/null
+++ b/docs/map/vertical-pod-autoscaler/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Vertical Pod Autoscaler"
+band = "official"
+summary = "autoscaling.k8s.io: sets pod requests from observed usage"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against VPA 1.8.0: https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler-1.8.0/vertical-pod-autoscaler/deploy/vpa-v1-crd-gen.yaml
diff --git a/docs/map/vertical-pod-autoscaler/verticalpodautoscaler.md b/docs/map/vertical-pod-autoscaler/verticalpodautoscaler.md
new file mode 100644
index 0000000..d9ee8ee
--- /dev/null
+++ b/docs/map/vertical-pod-autoscaler/verticalpodautoscaler.md
@@ -0,0 +1,11 @@
++++
+title = "VerticalPodAutoscaler"
+summary = "Sets a workload's CPU and memory requests from its usage"
+aka = ["autoscaling.k8s.io/v1 VerticalPodAutoscaler", "vpa"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: autoscaling.k8s.io/v1`, `kind: VerticalPodAutoscaler`.
diff --git a/docs/map/vertical-pod-autoscaler/verticalpodautoscalercheckpoint.md b/docs/map/vertical-pod-autoscaler/verticalpodautoscalercheckpoint.md
new file mode 100644
index 0000000..523dbac
--- /dev/null
+++ b/docs/map/vertical-pod-autoscaler/verticalpodautoscalercheckpoint.md
@@ -0,0 +1,13 @@
++++
+title = "VerticalPodAutoscalerCheckpoint"
+summary = "Saved usage history"
+aka = ["autoscaling.k8s.io/v1 VerticalPodAutoscalerCheckpoint"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
++++
+
+`apiVersion: autoscaling.k8s.io/v1`, `kind: VerticalPodAutoscalerCheckpoint`.
+
+Written by the VPA recommender.
diff --git a/docs/map/volume-snapshot/AREA.md b/docs/map/volume-snapshot/AREA.md
new file mode 100644
index 0000000..fb15f54
--- /dev/null
+++ b/docs/map/volume-snapshot/AREA.md
@@ -0,0 +1,9 @@
++++
+title = "Volume snapshots"
+band = "official"
+summary = "snapshot.storage.k8s.io: point-in-time copies of volumes"
++++
+
+No templates in `k8s.libsonnet` yet. Kinds without a template still work through `k8s.Object { apiVersion, kind }`.
+
+Checked against external-snapshotter v8.7.0: https://github.com/kubernetes-csi/external-snapshotter/tree/v8.7.0/client/config/crd
diff --git a/docs/map/volume-snapshot/volumesnapshot.md b/docs/map/volume-snapshot/volumesnapshot.md
new file mode 100644
index 0000000..aa73cc1
--- /dev/null
+++ b/docs/map/volume-snapshot/volumesnapshot.md
@@ -0,0 +1,11 @@
++++
+title = "VolumeSnapshot"
+summary = "A point-in-time copy of a PersistentVolumeClaim"
+aka = ["snapshot.storage.k8s.io/v1 VolumeSnapshot"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
++++
+
+`apiVersion: snapshot.storage.k8s.io/v1`, `kind: VolumeSnapshot`.
diff --git a/docs/map/volume-snapshot/volumesnapshotclass.md b/docs/map/volume-snapshot/volumesnapshotclass.md
new file mode 100644
index 0000000..75a92f8
--- /dev/null
+++ b/docs/map/volume-snapshot/volumesnapshotclass.md
@@ -0,0 +1,15 @@
++++
+title = "VolumeSnapshotClass"
+summary = "How snapshots are taken, per CSI driver"
+aka = ["snapshot.storage.k8s.io/v1 VolumeSnapshotClass"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "todo"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: snapshot.storage.k8s.io/v1`, `kind: VolumeSnapshotClass`, cluster-wide.
diff --git a/docs/map/volume-snapshot/volumesnapshotcontent.md b/docs/map/volume-snapshot/volumesnapshotcontent.md
new file mode 100644
index 0000000..b258260
--- /dev/null
+++ b/docs/map/volume-snapshot/volumesnapshotcontent.md
@@ -0,0 +1,17 @@
++++
+title = "VolumeSnapshotContent"
+summary = "The actual snapshot in the storage system"
+aka = ["snapshot.storage.k8s.io/v1 VolumeSnapshotContent"]
+kind = "sig-crd"
+intent = "aspiration"
+research = "done"
+status = "dropped"
+
+[[needs]]
+on = "/lib/cluster-scoped"
+why = "Cluster-wide: must not pick up the shared namespace"
++++
+
+`apiVersion: snapshot.storage.k8s.io/v1`, `kind: VolumeSnapshotContent`, cluster-wide.
+
+Usually created by the snapshot controller for each VolumeSnapshot.