kubebench

type Component struct {
	Flags map[string]string `json:"flags,omitempty"`
}

type Evidence struct {
	// Version is the reported Kubernetes server version, e.g. "1.29.3". Used to
	// select the version-matched benchmark profile.
	Version string `json:"version,omitempty"`
	// Platform is the distribution: "self-managed", "eks", "gke", "aks", or ""
	// (auto-detected as self-managed). Drives managed-variant scoping.
	Platform string `json:"platform,omitempty"`

	APIServer         Component `json:"apiserver,omitempty"`
	ControllerManager Component `json:"controller_manager,omitempty"`
	Scheduler         Component `json:"scheduler,omitempty"`
	Etcd              Component `json:"etcd,omitempty"`
	Kubelet           Component `json:"kubelet,omitempty"`

	// Files are permission/ownership stats for manifests and config files.
	Files []FileStat `json:"files,omitempty"`
	// RBAC is a reduced view of cluster roles/bindings and service accounts.
	RBAC RBAC `json:"rbac,omitempty"`
	// PodSecurity captures the Pod Security Admission posture.
	PodSecurity PodSecurity `json:"pod_security,omitempty"`
	// NetworkPolicyNamespaces lists namespaces that have at least one
	// NetworkPolicy; namespaces absent here are treated as having none.
	NetworkPolicyNamespaces []string `json:"network_policy_namespaces,omitempty"`
	// Namespaces is the set of (non-system) namespaces, for default-namespace checks.
	Namespaces []string `json:"namespaces,omitempty"`

	Notes []string `json:"notes,omitempty"`
}

type FileStat struct {
	Path   string `json:"path"`
	Exists bool   `json:"exists"`
	Mode   string `json:"mode,omitempty"`
	Owner  string `json:"owner,omitempty"`
	Group  string `json:"group,omitempty"`
}

type Module struct{}

type PodSecurity struct {
	// AdmissionEnabled is true when the PodSecurity admission plugin is on.
	AdmissionEnabled bool `json:"admission_enabled,omitempty"`
	// NamespaceEnforce maps namespace → the enforce level label value
	// (privileged|baseline|restricted). Missing means unlabeled.
	NamespaceEnforce map[string]string `json:"namespace_enforce,omitempty"`
}

type PolicyRule struct {
	APIGroups []string `json:"api_groups,omitempty"`
	Resources []string `json:"resources,omitempty"`
	Verbs     []string `json:"verbs,omitempty"`
}

type Profile struct {
	// Name is the profile slug reported to the auditor, e.g. "self-managed",
	// "eks". It becomes the benchmark Profile field.
	Name string
	// BenchmarkVersion is the version-matched CIS Kubernetes Benchmark revision.
	BenchmarkVersion string
	// contains filtered or unexported fields
}

type RBAC struct {
	ClusterRoleBindings []RoleBinding    `json:"cluster_role_bindings,omitempty"`
	Roles               []Role           `json:"roles,omitempty"`
	ServiceAccounts     []ServiceAccount `json:"service_accounts,omitempty"`
}

type Role struct {
	Name  string       `json:"name"`
	Rules []PolicyRule `json:"rules,omitempty"`
}

type RoleBinding struct {
	Name     string    `json:"name"`
	RoleRef  string    `json:"role_ref"`
	Subjects []Subject `json:"subjects,omitempty"`
}

type ServiceAccount struct {
	Namespace                    string `json:"namespace"`
	Name                         string `json:"name"`
	AutomountServiceAccountToken *bool  `json:"automount_service_account_token,omitempty"`
}

type Subject struct {
	Kind      string `json:"kind"`
	Name      string `json:"name"`
	Namespace string `json:"namespace,omitempty"`
}