admission

type Baseline struct {
	// SamplePods is the number of pods analyzed.
	SamplePods int `json:"sample_pods" yaml:"sample_pods"`
	// SampleContainers is the number of containers analyzed.
	SampleContainers int `json:"sample_containers" yaml:"sample_containers"`
	// DigestPinFraction is the share of containers using @sha256: digest pins.
	DigestPinFraction float64 `json:"digest_pin_fraction" yaml:"digest_pin_fraction"`
	// NonRootFraction is the share of containers not declared to run as UID 0.
	NonRootFraction float64 `json:"non_root_fraction" yaml:"non_root_fraction"`
	// NoPrivilegeEscalationFraction is the share of containers with
	// allowPrivilegeEscalation set false (the PSS-restricted check).
	NoPrivilegeEscalationFraction float64 `json:"no_privilege_escalation_fraction" yaml:"no_privilege_escalation_fraction"`
	// NamedServiceAccountFraction is the share of pods using a named
	// ServiceAccount (not "default").
	NamedServiceAccountFraction float64 `json:"named_service_account_fraction" yaml:"named_service_account_fraction"`
	// ReadOnlyRootFSFraction is the share of containers with
	// readOnlyRootFilesystem=true.
	ReadOnlyRootFSFraction float64 `json:"read_only_root_fs_fraction" yaml:"read_only_root_fs_fraction"`
	// SourceScanID is the scan the baseline was derived from.
	SourceScanID string `json:"source_scan_id,omitempty" yaml:"source_scan_id,omitempty"`
}

type BaselineProvider interface {
	// Current returns the latest Baseline. Implementations may return a
	// zero-value Baseline with Sufficient()==false when the store has no
	// usable data yet; callers should treat that as "allow without
	// comment."
	Current(ctx context.Context) Baseline
}

type CertSource struct {
	// contains filtered or unexported fields
}

type Check interface {
	// Name identifies the check in log lines and metrics.
	Name() string
	// Evaluate returns warnings and (when applicable) a deny message.
	// An empty warnings slice means the pod is consistent with the fleet.
	Evaluate(pod *corev1.Pod, baseline Baseline) (warnings []string, denyReason string)
}

type Decision struct {
	// Allowed mirrors the AdmissionResponse.Allowed semantic. Always true
	// when mode is advisory.
	Allowed bool
	// Reason is a short message returned to the client when Allowed is false.
	Reason string
	// Warnings are the per-check messages surfaced as Kubernetes warnings.
	Warnings []string
}

type Handler struct {
	// Provider supplies the fleet baseline.
	Provider BaselineProvider
	// Checks is the ordered list of fleet-norm checks to evaluate.
	Checks []Check
	// Mode selects advisory vs enforce semantics.
	Mode Mode
	// Log is the structured logger.
	Log *zap.Logger
	// MaxBytes caps the request body the handler will read. Defaults to
	// 1 MiB which matches the apiserver's default.
	MaxBytes int64
}

type Mode string

type Server struct {
	// contains filtered or unexported fields
}

type ServerConfig struct {
	// Addr is the listen address (typically ":8443").
	Addr string
	// CertPath is an optional path to a PEM-encoded TLS certificate. When
	// empty a fresh self-signed cert is generated.
	CertPath string
	// KeyPath is the matching private key path.
	KeyPath string
	// DNSNames are the SANs to include on a generated certificate. The
	// ValidatingWebhookConfiguration must address the service via one of
	// these names.
	DNSNames []string
	// Handler is the admission handler.
	Handler *Handler
	// Log is the structured logger.
	Log *zap.Logger
}

type StoreBaselineProvider struct {
	// contains filtered or unexported fields
}