refactor: migrate Kubernetes functions to filter_functions (Phase 12)

Migrate k8s_label_safe, k8s_dns_label_safe, k8s_annotation_safe to the
unified filter-functions architecture, supporting both function and
filter syntax:

- Function: {{ k8s_label_safe(value="My App") }}
- Filter: {{ "My App" | k8s_label_safe }}

Other Kubernetes functions remain function-only as they don't fit the
filter pattern (multi-argument or complex objects).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: bordeux

README.md

@@ -3090,7 +3090,7 @@ spec:
           {{ k8s_resource_request(cpu="1000m", memory="1Gi") | indent(10) }}
 ```
 
-#### `k8s_label_safe(value)`
+#### `k8s_label_safe(value)` / `| k8s_label_safe`
 
 Sanitize string to be Kubernetes label-safe.
 
@@ -3105,18 +3105,22 @@ Sanitize string to be Kubernetes label-safe.
 
 **Example:**
 ```jinja
-{# Sanitize label value #}
+{# Function syntax #}
 {{ k8s_label_safe(value="My App (v2.0)") }}
 {# Output: my-app-v2.0 #}
 
+{# Filter syntax #}
+{{ "My App (v2.0)" | k8s_label_safe }}
+{# Output: my-app-v2.0 #}
+
 {# Use in labels #}
 metadata:
   labels:
-    app: {{ k8s_label_safe(value=app_name) }}
-    version: {{ k8s_label_safe(value=version) }}
+    app: {{ app_name | k8s_label_safe }}
+    version: {{ version | k8s_label_safe }}
 ```
 
-#### `k8s_dns_label_safe(value)`
+#### `k8s_dns_label_safe(value)` / `| k8s_dns_label_safe`
 
 Format DNS-safe label (max 63 chars, lowercase, alphanumeric and dashes only).
 
@@ -3127,15 +3131,19 @@ Format DNS-safe label (max 63 chars, lowercase, alphanumeric and dashes only).
 
 **Example:**
 ```jinja
-{# Format DNS label #}
+{# Function syntax #}
 {{ k8s_dns_label_safe(value="My Service Name") }}
 {# Output: my-service-name #}
 
+{# Filter syntax #}
+{{ "My Service Name" | k8s_dns_label_safe }}
+{# Output: my-service-name #}
+
 {# Use in service names #}
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ k8s_dns_label_safe(value=service_name) }}
+  name: {{ service_name | k8s_dns_label_safe }}
 ```
 
 #### `k8s_env_var_ref(var_name, source, name)`
@@ -3290,26 +3298,30 @@ metadata:
   name: {{ helm_tpl(template="{{ .Release.Name }}-{{ .Chart.Name }}", values={"Release": {"Name": "prod"}, "Chart": {"Name": "webapp"}}) }}
 ```
 
-#### `k8s_annotation_safe(string)`
+#### `k8s_annotation_safe(value)` / `| k8s_annotation_safe`
 
 Sanitize a string for use as a Kubernetes annotation value.
 
 **Arguments:**
-- `string` (required): The string to sanitize
+- `value` (required): The string to sanitize
 
-**Returns:** Sanitized string safe for annotation values (max 256KB, control chars removed)
+**Returns:** Sanitized string safe for annotation values (max 64KB, control chars replaced with spaces)
 
 **Example:**
 ```jinja
-{# Sanitize annotation value #}
-{{ k8s_annotation_safe(string="Description with\nnewlines and\ttabs") }}
+{# Function syntax #}
+{{ k8s_annotation_safe(value="Description with\nnewlines and\ttabs") }}
 {# Output: Description with newlines and tabs #}
 
+{# Filter syntax #}
+{{ "Description with\nnewlines" | k8s_annotation_safe }}
+{# Output: Description with newlines #}
+
 {# In Kubernetes manifest #}
 metadata:
   annotations:
-    description: "{{ k8s_annotation_safe(string=description) }}"
-    config: "{{ k8s_annotation_safe(string=to_json(config_obj)) }}"
+    description: "{{ description | k8s_annotation_safe }}"
+    config: "{{ config_obj | to_json | k8s_annotation_safe }}"
 ```
 
 #### `k8s_quantity_to_bytes(quantity)`

REFACTOR.md

@@ -668,22 +668,26 @@ These should NOT become filters (they require context, have side effects, or are
 
 **Commit:** 4399e70
 
-### Phase 12: Kubernetes Functions
+### Phase 12: Kubernetes Functions ✅
 
-**Category:** `kubernetes.rs`
+**Category:** `filter_functions/kubernetes.rs`
 
 | Function | Filter | Status |
 |----------|--------|--------|
-| `k8s_label_safe` | `k8s_label_safe` | [ ] |
-| `k8s_dns_label_safe` | `k8s_dns_label_safe` | [ ] |
-| `k8s_annotation_safe` | `k8s_annotation_safe` | [ ] |
-
-- [ ] Migrate implementations
-- [ ] Update unit tests
-- [ ] Update integration tests to test filter syntax
-- [ ] Update README.md
-- [ ] Run `cargo make qa`
-- [ ] Update REFACTOR.md with current state
+| `k8s_label_safe` | `k8s_label_safe` | [x] |
+| `k8s_dns_label_safe` | `k8s_dns_label_safe` | [x] |
+| `k8s_annotation_safe` | `k8s_annotation_safe` | [x] |
+
+- [x] Migrate implementations to `src/filter_functions/kubernetes.rs`
+- [x] Update unit tests (existing tests still pass)
+- [x] Update integration tests to test filter syntax (6 new tests)
+- [x] Update README.md with both syntaxes
+- [x] Run `cargo make qa`
+- [x] Update REFACTOR.md with current state
+
+**Note:** Other Kubernetes functions (`k8s_resource_request`, `k8s_env_var_ref`, `k8s_secret_ref`, `k8s_configmap_ref`, `helm_tpl`, `k8s_quantity_to_bytes`, `k8s_bytes_to_quantity`, `k8s_selector`, `k8s_pod_affinity`, `k8s_toleration`, `k8s_probe`) remain function-only as they don't fit the filter pattern (multi-argument or complex objects).
+
+**Commit:** acfd33d
 
 ### Phase 13: Final Cleanup