configurationpolicy

type ComplianceMap map[string]*CompliancePerClusterStatus

type CompliancePerClusterStatus struct {
	AggregatePolicyStatus map[string]*ConfigurationPolicyStatus `json:"aggregatePoliciesStatus,omitempty"`
	ComplianceState       ComplianceState                       `json:"compliant,omitempty"`
	ClusterName           string                                `json:"clustername,omitempty"`
}

type ComplianceState string

type ComplianceType string

type Condition struct {
	// Type of condition, e.g Complete or Failed.
	Type string `json:"type"`
	// Status of the condition, one of True, False, Unknown.
	Status corev1.ConditionStatus `json:"status,omitempty" protobuf:"bytes,12,rep,name=status"`
	// The last time the condition transitioned from one status to another.
	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
	// The reason for the condition's last transition.
	// +optional
	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
	// A human readable message indicating details about the transition.
	// +optional
	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
}

type ConfigurationPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   *ConfigurationPolicySpec  `json:"spec,omitempty"`
	Status ConfigurationPolicyStatus `json:"status,omitempty"`
}

type ConfigurationPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ConfigurationPolicy `json:"items"`
}

type ConfigurationPolicySpec struct {
	Severity          Severity          `json:"severity,omitempty"`          // low, medium, high
	RemediationAction RemediationAction `json:"remediationAction,omitempty"` // enforce, inform
	// 'namespaceSelector' defines the list of namespaces to include/exclude for objects defined in
	// spec.objectTemplates. All selector rules are ANDed. If 'include' is not provided but
	// 'matchLabels' and/or 'matchExpressions' are, 'include' will behave as if ['*'] were given. If
	// 'matchExpressions' and 'matchLabels' are both not provided, 'include' must be provided to
	// retrieve namespaces.
	NamespaceSelector Target `json:"namespaceSelector,omitempty"`
	// 'object-templates' and 'object-templates-raw' are arrays of objects for the configuration
	// policy to check, create, modify, or delete on the cluster. 'object-templates' is an array
	// of objects, while 'object-templates-raw' is a string containing an array of objects in
	// YAML format. Only one of the two object-templates variables can be set in a given
	// configurationPolicy.
	ObjectTemplates []*ObjectTemplate `json:"object-templates,omitempty"`
	// 'object-templates' and 'object-templates-raw' are arrays of objects for the configuration
	// policy to check, create, modify, or delete on the cluster. 'object-templates' is an array
	// of objects, while 'object-templates-raw' is a string containing an array of objects in
	// YAML format. Only one of the two object-templates variables can be set in a given
	// configurationPolicy.
	ObjectTemplatesRaw  string              `json:"object-templates-raw,omitempty"`
	EvaluationInterval  EvaluationInterval  `json:"evaluationInterval,omitempty"`
	PruneObjectBehavior PruneObjectBehavior `json:"pruneObjectBehavior,omitempty"`
}

type ConfigurationPolicyStatus struct {
	ComplianceState   ComplianceState  `json:"compliant,omitempty"`         // Compliant/NonCompliant/UnknownCompliancy
	CompliancyDetails []TemplateStatus `json:"compliancyDetails,omitempty"` // reason for non-compliancy
	// An ISO-8601 timestamp of the last time the policy was evaluated
	LastEvaluated string `json:"lastEvaluated,omitempty"`
	// The generation of the ConfigurationPolicy object when it was last evaluated
	LastEvaluatedGeneration int64 `json:"lastEvaluatedGeneration,omitempty"`
	// List of resources processed by the policy
	RelatedObjects []RelatedObject `json:"relatedObjects,omitempty"`
}

type EvaluationInterval struct {
	// The minimum elapsed time before a ConfigurationPolicy is reevaluated when in the compliant state. Set this to
	// "never" to disable reevaluation when in the compliant state.
	Compliant string `json:"compliant,omitempty"`
	//+kubebuilder:validation:Pattern=`^(?:(?:(?:[0-9]+(?:.[0-9])?)(?:h|m|s|(?:ms)|(?:us)|(?:ns)))|never)+$`
	// The minimum elapsed time before a ConfigurationPolicy is reevaluated when in the noncompliant state. Set this to
	// "never" to disable reevaluation when in the noncompliant state.
	NonCompliant string `json:"noncompliant,omitempty"`
}

type MetadataComplianceType string

type NonEmptyString string

type ObjectMetadata struct {
	// Name of the referent. More info:
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
	Name string `json:"name,omitempty"`
	// Namespace of the referent. More info:
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
	Namespace string `json:"namespace,omitempty"`
}

type ObjectProperties struct {
	// Whether the object was created by the parent policy
	CreatedByPolicy *bool `json:"createdByPolicy,omitempty"`
	// Store object UID to help track object ownership for deletion
	UID string `json:"uid,omitempty"`
}

type ObjectResource struct {
	// Kind of the referent. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	Kind string `json:"kind,omitempty"`
	// API version of the referent.
	APIVersion string `json:"apiVersion,omitempty"`
	// Metadata values from the referent.
	Metadata ObjectMetadata `json:"metadata,omitempty"`
}

type ObjectTemplate struct {
	// ComplianceType specifies whether it is: musthave, mustnothave, mustonlyhave
	ComplianceType ComplianceType `json:"complianceType"`

	MetadataComplianceType MetadataComplianceType `json:"metadataComplianceType,omitempty"`

	// ObjectDefinition defines required fields for the object
	ObjectDefinition runtime.RawExtension `json:"objectDefinition,omitempty"`
}

type PruneObjectBehavior string

type RelatedObject struct {
	//
	Object ObjectResource `json:"object,omitempty"`
	//
	Compliant string `json:"compliant,omitempty"`
	//
	Reason     string            `json:"reason,omitempty"`
	Properties *ObjectProperties `json:"properties,omitempty"`
}

type RemediationAction string

type ResourceState string

type Severity string

type Target struct {
	// 'include' is an array of filepath expressions to include objects by name.
	Include []NonEmptyString `json:"include,omitempty"`
	// 'exclude' is an array of filepath expressions to exclude objects by name.
	Exclude []NonEmptyString `json:"exclude,omitempty"`
	// 'matchLabels' is a map of {key,value} pairs matching objects by label.
	MatchLabels *map[string]string `json:"matchLabels,omitempty"`
	// 'matchExpressions' is an array of label selector requirements matching objects by label.
	MatchExpressions *[]metav1.LabelSelectorRequirement `json:"matchExpressions,omitempty"`
}

type TemplateStatus struct {
	ComplianceState ComplianceState `json:"Compliant,omitempty"` // Compliant, NonCompliant, UnknownCompliancy
	Conditions      []Condition     `json:"conditions,omitempty"`

	Validity Validity `json:"Validity,omitempty"` // a template can be invalid if it has conflicting roles
}

type Validity struct {
	Valid  *bool  `json:"valid,omitempty"`
	Reason string `json:"reason,omitempty"`
}