v1alpha1

type Behavior struct {
	// Allow specifies allowed entries for this behavior type.
	// +optional
	Allow *BehaviorRule `json:"allow,omitempty"`

	// Deny specifies denied entries for this behavior type.
	// +optional
	Deny *BehaviorRule `json:"deny,omitempty"`
}

type BehaviorRule struct {
	// Values is a list of allowed or denied items (IPs, commands, files, etc.).
	// +optional
	Values []string `json:"values,omitempty"`

	// Expression is a CEL expression that evaluates to a list of items.
	// +optional
	Expression string `json:"expression,omitempty"`
}

type MonitorFilter struct {
	// Expressions each state a condition a finding must satisfy to be reported.
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	Expressions []MonitorFilterExpression `json:"expressions"`
}

type MonitorFilterExpression struct {
	// Name identifies this expression in compile errors, status conditions and
	// the eval-error metric. It is never emitted to a Report.
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Expression is a CEL expression over the event variable that must evaluate
	// to bool. event.kind selects the arm that is populated: event.open.path,
	// event.exec.filename and .argv, event.net.destIP and .domain,
	// event.dns.qname, event.protocol.protocol and .alpn. Every event also
	// carries time, comm, pid, count, kernelDenied, wouldDeny, and pod.
	// +kubebuilder:validation:MinLength=1
	Expression string `json:"expression"`
}

type NodePolicyStatus struct {
	NodeName string `json:"nodeName"`

	// +optional
	LastEvaluatedTime *metav1.Time `json:"lastEvaluatedTime,omitempty"`

	// EnforcementAvailable reports whether the kernel programs and maps
	// enforcing this policy are attached and programmed on this node.
	// +optional
	EnforcementAvailable *bool `json:"enforcementAvailable,omitempty"`

	// ObservationAvailable reports whether observation for this policy is
	// attached on this node.
	// +optional
	ObservationAvailable *bool `json:"observationAvailable,omitempty"`

	// PodsMatched reports whether any pod on this node currently matches the
	// policy's podSelector/namespaceSelector.
	// +optional
	PodsMatched *bool `json:"podsMatched,omitempty"`

	// Message explains a false EnforcementAvailable or ObservationAvailable.
	// +optional
	Message string `json:"message,omitempty"`
}

type PolicyBehavior struct {
	// Network defines network behavior rules.
	// +optional
	Network *Behavior `json:"network,omitempty"`

	// Exec defines command execution behavior rules.
	// +optional
	Exec *Behavior `json:"exec,omitempty"`

	// Open defines file open behavior rules.
	// +optional
	Open *Behavior `json:"open,omitempty"`

	// Protocol defines application protocol behavior rules, evaluated
	// against the first data segment of a connection.
	// +optional
	Protocol *Behavior `json:"protocol,omitempty"`

	// DNS declares the DNS names a selected workload is expected to resolve.
	// It is observation only: it reports, it never blocks, so a policy carrying
	// a dns behavior must use mode monitor and is rejected in mode enforce.
	//
	// Allow is the expected set. Deny names specific unwanted names, and the
	// "*" sentinel in deny means "report every name", which is how an operator
	// discovers what a workload resolves before writing an allow list.
	// +optional
	DNS *Behavior `json:"dns,omitempty"`
}

type RuntimePolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RuntimePolicySpec   `json:"spec,omitempty"`
	Status RuntimePolicyStatus `json:"status,omitempty"`
}

type RuntimePolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []RuntimePolicy `json:"items"`
}

type RuntimePolicyMode string

type RuntimePolicySpec struct {
	// PodSelector identifies the pods this policy applies to. An empty selector
	// and an omitted field both match every pod on the node.
	// +optional
	PodSelector *metav1.LabelSelector `json:"podSelector,omitempty"`

	// NamespaceSelector narrows PodSelector to pods whose namespace carries
	// these labels. An empty selector and an omitted field both match every
	// namespace.
	//
	// Target namespaces by name through kubernetes.io/metadata.name, which the
	// API server sets on every namespace.
	// +optional
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

	// EvaluationInterval specifies how frequently the policy is re-evaluated.
	// +optional
	EvaluationInterval *metav1.Duration `json:"evaluationInterval,omitempty"`

	// Variables defines custom variables that can be used in behavior expressions.
	// +optional
	Variables []admissionregistrationv1.Variable `json:"variables,omitempty"`

	// Behaviors defines the allowed and denied runtime behaviors.
	//
	// The bound is what keeps the per-item XValidation rule inside the CEL cost
	// budget: an unbounded list makes the API server multiply that rule's cost by
	// the largest number of items a request could carry, and the estimate then
	// exceeds the budget and the CRD is refused at apply time.
	// +optional
	// +kubebuilder:validation:MaxItems=64
	Behaviors []PolicyBehavior `json:"behaviors,omitempty"`

	// Mode defines the operational mode of the policy.
	// +optional
	// +kubebuilder:default=monitor
	Mode *RuntimePolicyMode `json:"mode,omitempty"`

	// MonitorFilter narrows which findings a monitor-mode policy reports. It
	// selects what is observed into a finding, never what the kernel blocks.
	// +optional
	MonitorFilter *MonitorFilter `json:"monitorFilter,omitempty"`
}

type RuntimePolicyStatus struct {
	// LastEvaluatedTime is the last time the policy was evaluated.
	// +optional
	LastEvaluatedTime *metav1.Time `json:"lastEvaluatedTime,omitempty"`

	// Nodes holds one per-node shard, each written only by that node's daemon.
	// +optional
	// +listType=map
	// +listMapKey=nodeName
	Nodes []NodePolicyStatus `json:"nodes,omitempty"`

	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}