|
| 1 | +{ |
| 2 | + "description": "ClusterPolicyReport is the Schema for the clusterpolicyreports API", |
| 3 | + "properties": { |
| 4 | + "apiVersion": { |
| 5 | + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", |
| 6 | + "type": "string" |
| 7 | + }, |
| 8 | + "kind": { |
| 9 | + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", |
| 10 | + "type": "string" |
| 11 | + }, |
| 12 | + "metadata": { |
| 13 | + "type": "object" |
| 14 | + }, |
| 15 | + "results": { |
| 16 | + "description": "PolicyReportResult provides result details", |
| 17 | + "items": { |
| 18 | + "description": "PolicyReportResult provides the result for an individual policy", |
| 19 | + "properties": { |
| 20 | + "category": { |
| 21 | + "description": "Category indicates policy category", |
| 22 | + "type": "string" |
| 23 | + }, |
| 24 | + "message": { |
| 25 | + "description": "Description is a short user friendly message for the policy rule", |
| 26 | + "type": "string" |
| 27 | + }, |
| 28 | + "policy": { |
| 29 | + "description": "Policy is the name or identifier of the policy", |
| 30 | + "type": "string" |
| 31 | + }, |
| 32 | + "properties": { |
| 33 | + "additionalProperties": { |
| 34 | + "type": "string" |
| 35 | + }, |
| 36 | + "description": "Properties provides additional information for the policy rule", |
| 37 | + "type": "object" |
| 38 | + }, |
| 39 | + "resourceSelector": { |
| 40 | + "description": "SubjectSelector is an optional label selector for checked Kubernetes resources.\nFor example, a policy result may apply to all pods that match a label.\nEither a Subject or a SubjectSelector can be specified.\nIf neither are provided, the result is assumed to be for the policy report scope.", |
| 41 | + "properties": { |
| 42 | + "matchExpressions": { |
| 43 | + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", |
| 44 | + "items": { |
| 45 | + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", |
| 46 | + "properties": { |
| 47 | + "key": { |
| 48 | + "description": "key is the label key that the selector applies to.", |
| 49 | + "type": "string" |
| 50 | + }, |
| 51 | + "operator": { |
| 52 | + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", |
| 53 | + "type": "string" |
| 54 | + }, |
| 55 | + "values": { |
| 56 | + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", |
| 57 | + "items": { |
| 58 | + "type": "string" |
| 59 | + }, |
| 60 | + "type": "array", |
| 61 | + "x-kubernetes-list-type": "atomic" |
| 62 | + } |
| 63 | + }, |
| 64 | + "required": [ |
| 65 | + "key", |
| 66 | + "operator" |
| 67 | + ], |
| 68 | + "type": "object", |
| 69 | + "additionalProperties": false |
| 70 | + }, |
| 71 | + "type": "array", |
| 72 | + "x-kubernetes-list-type": "atomic" |
| 73 | + }, |
| 74 | + "matchLabels": { |
| 75 | + "additionalProperties": { |
| 76 | + "type": "string" |
| 77 | + }, |
| 78 | + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", |
| 79 | + "type": "object" |
| 80 | + } |
| 81 | + }, |
| 82 | + "type": "object", |
| 83 | + "x-kubernetes-map-type": "atomic", |
| 84 | + "additionalProperties": false |
| 85 | + }, |
| 86 | + "resources": { |
| 87 | + "description": "Subjects is an optional reference to the checked Kubernetes resources", |
| 88 | + "items": { |
| 89 | + "description": "ObjectReference contains enough information to let you inspect or modify the referred object.", |
| 90 | + "properties": { |
| 91 | + "apiVersion": { |
| 92 | + "description": "API version of the referent.", |
| 93 | + "type": "string" |
| 94 | + }, |
| 95 | + "fieldPath": { |
| 96 | + "description": "If referring to a piece of an object instead of an entire object, this string\nshould contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].\nFor example, if the object reference is to a container within a pod, this would take on a value like:\n\"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered\nthe event) or if no container name is specified \"spec.containers[2]\" (container with\nindex 2 in this pod). This syntax is chosen only to have some well-defined way of\nreferencing a part of an object.", |
| 97 | + "type": "string" |
| 98 | + }, |
| 99 | + "kind": { |
| 100 | + "description": "Kind of the referent.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", |
| 101 | + "type": "string" |
| 102 | + }, |
| 103 | + "name": { |
| 104 | + "description": "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", |
| 105 | + "type": "string" |
| 106 | + }, |
| 107 | + "namespace": { |
| 108 | + "description": "Namespace of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/", |
| 109 | + "type": "string" |
| 110 | + }, |
| 111 | + "resourceVersion": { |
| 112 | + "description": "Specific resourceVersion to which this reference is made, if any.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", |
| 113 | + "type": "string" |
| 114 | + }, |
| 115 | + "uid": { |
| 116 | + "description": "UID of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids", |
| 117 | + "type": "string" |
| 118 | + } |
| 119 | + }, |
| 120 | + "type": "object", |
| 121 | + "x-kubernetes-map-type": "atomic", |
| 122 | + "additionalProperties": false |
| 123 | + }, |
| 124 | + "type": "array" |
| 125 | + }, |
| 126 | + "result": { |
| 127 | + "description": "Result indicates the outcome of the policy rule execution", |
| 128 | + "enum": [ |
| 129 | + "pass", |
| 130 | + "fail", |
| 131 | + "warn", |
| 132 | + "error", |
| 133 | + "skip" |
| 134 | + ], |
| 135 | + "type": "string" |
| 136 | + }, |
| 137 | + "rule": { |
| 138 | + "description": "Rule is the name or identifier of the rule within the policy", |
| 139 | + "type": "string" |
| 140 | + }, |
| 141 | + "scored": { |
| 142 | + "description": "Scored indicates if this result is scored", |
| 143 | + "type": "boolean" |
| 144 | + }, |
| 145 | + "severity": { |
| 146 | + "description": "Severity indicates policy check result criticality", |
| 147 | + "enum": [ |
| 148 | + "critical", |
| 149 | + "high", |
| 150 | + "low", |
| 151 | + "medium", |
| 152 | + "info" |
| 153 | + ], |
| 154 | + "type": "string" |
| 155 | + }, |
| 156 | + "source": { |
| 157 | + "description": "Source is an identifier for the policy engine that manages this report", |
| 158 | + "type": "string" |
| 159 | + }, |
| 160 | + "timestamp": { |
| 161 | + "description": "Timestamp indicates the time the result was found", |
| 162 | + "properties": { |
| 163 | + "nanos": { |
| 164 | + "description": "Non-negative fractions of a second at nanosecond resolution. Negative\nsecond values with fractions must still have non-negative nanos values\nthat count forward in time. Must be from 0 to 999,999,999\ninclusive. This field may be limited in precision depending on context.", |
| 165 | + "format": "int32", |
| 166 | + "type": "integer" |
| 167 | + }, |
| 168 | + "seconds": { |
| 169 | + "description": "Represents seconds of UTC time since Unix epoch\n1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to\n9999-12-31T23:59:59Z inclusive.", |
| 170 | + "format": "int64", |
| 171 | + "type": "integer" |
| 172 | + } |
| 173 | + }, |
| 174 | + "required": [ |
| 175 | + "nanos", |
| 176 | + "seconds" |
| 177 | + ], |
| 178 | + "type": "object", |
| 179 | + "additionalProperties": false |
| 180 | + }, |
| 181 | + "additionalProperties": false |
| 182 | + }, |
| 183 | + "required": [ |
| 184 | + "policy" |
| 185 | + ], |
| 186 | + "type": "object", |
| 187 | + "additionalProperties": false |
| 188 | + }, |
| 189 | + "type": "array" |
| 190 | + }, |
| 191 | + "scope": { |
| 192 | + "description": "Scope is an optional reference to the report scope (e.g. a Deployment, Namespace, or Node)", |
| 193 | + "properties": { |
| 194 | + "apiVersion": { |
| 195 | + "description": "API version of the referent.", |
| 196 | + "type": "string" |
| 197 | + }, |
| 198 | + "fieldPath": { |
| 199 | + "description": "If referring to a piece of an object instead of an entire object, this string\nshould contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].\nFor example, if the object reference is to a container within a pod, this would take on a value like:\n\"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered\nthe event) or if no container name is specified \"spec.containers[2]\" (container with\nindex 2 in this pod). This syntax is chosen only to have some well-defined way of\nreferencing a part of an object.", |
| 200 | + "type": "string" |
| 201 | + }, |
| 202 | + "kind": { |
| 203 | + "description": "Kind of the referent.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", |
| 204 | + "type": "string" |
| 205 | + }, |
| 206 | + "name": { |
| 207 | + "description": "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", |
| 208 | + "type": "string" |
| 209 | + }, |
| 210 | + "namespace": { |
| 211 | + "description": "Namespace of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/", |
| 212 | + "type": "string" |
| 213 | + }, |
| 214 | + "resourceVersion": { |
| 215 | + "description": "Specific resourceVersion to which this reference is made, if any.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", |
| 216 | + "type": "string" |
| 217 | + }, |
| 218 | + "uid": { |
| 219 | + "description": "UID of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids", |
| 220 | + "type": "string" |
| 221 | + } |
| 222 | + }, |
| 223 | + "type": "object", |
| 224 | + "x-kubernetes-map-type": "atomic", |
| 225 | + "additionalProperties": false |
| 226 | + }, |
| 227 | + "scopeSelector": { |
| 228 | + "description": "ScopeSelector is an optional selector for multiple scopes (e.g. Pods).\nEither one of, or none of, but not both of, Scope or ScopeSelector should be specified.", |
| 229 | + "properties": { |
| 230 | + "matchExpressions": { |
| 231 | + "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.", |
| 232 | + "items": { |
| 233 | + "description": "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", |
| 234 | + "properties": { |
| 235 | + "key": { |
| 236 | + "description": "key is the label key that the selector applies to.", |
| 237 | + "type": "string" |
| 238 | + }, |
| 239 | + "operator": { |
| 240 | + "description": "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", |
| 241 | + "type": "string" |
| 242 | + }, |
| 243 | + "values": { |
| 244 | + "description": "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", |
| 245 | + "items": { |
| 246 | + "type": "string" |
| 247 | + }, |
| 248 | + "type": "array", |
| 249 | + "x-kubernetes-list-type": "atomic" |
| 250 | + } |
| 251 | + }, |
| 252 | + "required": [ |
| 253 | + "key", |
| 254 | + "operator" |
| 255 | + ], |
| 256 | + "type": "object", |
| 257 | + "additionalProperties": false |
| 258 | + }, |
| 259 | + "type": "array", |
| 260 | + "x-kubernetes-list-type": "atomic" |
| 261 | + }, |
| 262 | + "matchLabels": { |
| 263 | + "additionalProperties": { |
| 264 | + "type": "string" |
| 265 | + }, |
| 266 | + "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", |
| 267 | + "type": "object" |
| 268 | + } |
| 269 | + }, |
| 270 | + "type": "object", |
| 271 | + "x-kubernetes-map-type": "atomic", |
| 272 | + "additionalProperties": false |
| 273 | + }, |
| 274 | + "summary": { |
| 275 | + "description": "PolicyReportSummary provides a summary of results", |
| 276 | + "properties": { |
| 277 | + "error": { |
| 278 | + "description": "Error provides the count of policies that could not be evaluated", |
| 279 | + "type": "integer" |
| 280 | + }, |
| 281 | + "fail": { |
| 282 | + "description": "Fail provides the count of policies whose requirements were not met", |
| 283 | + "type": "integer" |
| 284 | + }, |
| 285 | + "pass": { |
| 286 | + "description": "Pass provides the count of policies whose requirements were met", |
| 287 | + "type": "integer" |
| 288 | + }, |
| 289 | + "skip": { |
| 290 | + "description": "Skip indicates the count of policies that were not selected for evaluation", |
| 291 | + "type": "integer" |
| 292 | + }, |
| 293 | + "warn": { |
| 294 | + "description": "Warn provides the count of non-scored policies whose requirements were not met", |
| 295 | + "type": "integer" |
| 296 | + } |
| 297 | + }, |
| 298 | + "type": "object", |
| 299 | + "additionalProperties": false |
| 300 | + } |
| 301 | + }, |
| 302 | + "type": "object" |
| 303 | +} |
0 commit comments