rules

type ActionType string

type Audience struct {
	// +kubebuilder:validation:Enum=User;Group;ServiceAccount;Custom
	Kind AudienceKind `json:"kind"`
	Name string       `json:"name"`
}

type AudienceKind string

type CustomAudience string

type ImagePullPolicySpec string

type IngressType string

type MetadataRule struct {
	runtime.VersionKinds `json:",inline"`

	// Labels defines metadata policies by label key.
	//
	// +optional
	Labels map[string]MetadataValueRule `json:"labels,omitempty"`

	// Annotations defines metadata policies by annotation key.
	//
	// +optional
	Annotations map[string]MetadataValueRule `json:"annotations,omitempty"`
}

type MetadataValueRule struct {
	// Required enforces that the metadata key must be present.
	//
	// This is mainly meaningful with action=allow. Deny and audit rules remain
	// value matchers and do not require missing metadata to exist.
	//
	// +optional
	// +kubebuilder:default:=false
	Required bool `json:"required,omitempty"`

	// Values defines allowed, denied, or audited values for the metadata key.
	//
	// If Required=true and Values is empty, only presence is enforced.
	//
	// +optional
	Values []runtime.ExpressionMatch `json:"values,omitempty"`

	// Default is applied by admission mutation when the concrete metadata key is absent.
	// It is not reconciled after admission.
	// +optional
	Default *string `json:"default,omitempty"`

	// Managed is enforced by admission mutation and reconciled by the RuleStatus
	// controller using server-side apply when the rule configuration changes.
	// +optional
	Managed *string `json:"managed,omitempty"`
}

type NamespaceRuleBodyNamespace struct {
	// Audience limits this rule to matching request subjects.
	// An empty audience matches every request.
	// +optional
	Audience []Audience `json:"audience,omitempty"`

	// Enforcement for given rule
	//+optional
	Enforce *NamespaceRuleEnforceBody `json:"enforce,omitzero"`
}

type NamespaceRuleBodyTenant struct {
	*NamespaceRuleBodyNamespace `json:",inline"`

	// Select namespaces which are going to be targeted with this rule
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

	// Permissions for given rule
	//+optional
	Permissions NamespaceRulePermissionBody `json:"permissions,omitempty"`
}

type NamespaceRuleEnforceBody struct {
	// Declare the action being performed on the enforcement rule:
	// deny: On match, deny admission request
	// allow: On match, allowed admission request
	// audit: On match, audit (post event) of admission request
	//+kubebuilder:default:=deny
	Action ActionType `json:"action,omitempty"`

	// Enforcement for Workloads (Pods)
	Workloads NamespaceRuleEnforceWorkloadsBody `json:"workloads,omitempty"`

	// Enforcement for Services.
	// +optional
	Services NamespaceRuleEnforceServicesBody `json:"services,omitempty"`

	// Enforcement for object metadata on namespaced resources.
	//
	// +optional
	Metadata []MetadataRule `json:"metadata,omitempty"`

	// Enforcement for Ingress and Gateway API resource hostnames.
	// +optional
	Ingress NamespaceRuleEnforceIngressBody `json:"ingress,omitempty"`
}

type NamespaceRuleEnforceIngressBody struct {
	// Types defines the resource kinds to which hostname enforcement applies.
	//
	// +kubebuilder:validation:MinItems=1
	Types []IngressType `json:"types,omitempty"`

	// Hostnames defines allowed, denied, or audited hostname expressions.
	// A resource targeted by an allow or deny rule must declare non-empty values
	// in all hostname fields. Audit-only rules record missing hostnames without
	// denying them.
	//
	// +kubebuilder:validation:MinItems=1
	Hostnames []runtime.ExpressionMatch `json:"hostnames,omitempty"`
}

type NamespaceRuleEnforceServicesBody struct {
	// Types defines the Service types matched by this rule.
	//
	// Supported values:
	// - ClusterIP
	// - NodePort
	// - LoadBalancer
	// - ExternalName
	//
	// +optional
	// +kubebuilder:validation:items:Enum=ClusterIP;NodePort;LoadBalancer;ExternalName
	Types []ServiceType `json:"types,omitempty"`

	// LoadBalancers defines additional constraints for Services of type LoadBalancer.
	// +optional
	LoadBalancers *ServiceLoadBalancerRule `json:"loadBalancers,omitempty"`

	// ExternalNames defines additional constraints for Services of type ExternalName.
	// +optional
	ExternalNames *ServiceExternalNameRule `json:"externalNames,omitempty"`

	// NodePorts defines additional constraints for nodePort values.
	// +optional
	NodePorts *ServiceNodePortRule `json:"nodePorts,omitempty"`
}

type NamespaceRuleEnforceWorkloadsBody struct {
	// Define the enforcement targets this rule applies to.
	// If empty, each webhook applies its own backwards-compatible default.
	// +optional
	Targets []WorkloadValidationTarget `json:"targets,omitempty"`

	// Define Pod QoS classes matched by this enforcement rule.
	// Supported values are Guaranteed, Burstable and BestEffort.
	// +optional
	QoSClasses []corev1.PodQOSClass `json:"qosClasses,omitempty"`

	// Define registries which are allowed to be used within this tenant
	// The rules are aggregated, since you can use Regular Expressions the match registry endpoints
	// +optional
	Registries []OCIRegistry `json:"registries,omitempty"`

	// Schedulers defines schedulerName matchers for Pod admission.
	//
	// The rule is evaluated against pod.spec.schedulerName.
	// Empty schedulerName is ignored and is not normalized to default-scheduler.
	//
	// +optional
	Schedulers []runtime.ExpressionMatch `json:"schedulers,omitempty"`
}

type NamespaceRulePermissionBody struct {
	// Bindings defines additional RoleBindings for namespaces selected by this rule.
	Bindings []rbac.AdditionalRoleBindingsSpec `json:"bindings,omitempty"`

	// Define Promotion Rules which distributed additional ClusterRoles across the Tenant
	// for promoted ServiceAccounts.
	Promotions []*NamespaceRulePromotionRule `json:"promotions,omitempty"`
}

type NamespaceRulePromotionRule struct {
	// ClusterRoles granted to the promoted ServiceAccounts across the Tenant
	// kubebuilder:validation:Minimum=1
	ClusterRoles []string `json:"clusterRoles,omitempty"`

	// Match ServiceAccounts which are promoted which are granted these additional ClusterRoles
	// across the Tenant
	Selector *metav1.LabelSelector `json:"selector,omitempty"`
}

type OCIRegistry struct {
	runtime.ExpressionMatch `json:",inline"`

	// Allowed PullPolicy for the given registry. Supplying no value allows all policies.
	// +optional
	// +kubebuilder:validation:Items:Enum=Always;Never;IfNotPresent
	Policy []corev1.PullPolicy `json:"policy,omitempty"`
}

type RuleDecision struct {
	Action ActionType
	Rule   *NamespaceRuleBodyNamespace
}

type ServiceExternalNameRule struct {
	// Hostnames restricts spec.externalName.
	// Empty means no additional hostname restriction once ExternalName is allowed by types.
	// +optional
	Hostnames []runtime.ExpressionMatch `json:"hostnames,omitempty"`
}

type ServiceLoadBalancerRule struct {
	// CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges.
	// Empty means no additional CIDR restriction once LoadBalancer is allowed by types.
	// +optional
	CIDRs []string `json:"cidrs,omitempty"`
}

type ServiceNodePortRange struct {
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	From int32 `json:"from"`

	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	To int32 `json:"to"`
}

type ServiceNodePortRule struct {
	// Ports restricts explicitly requested nodePort values.
	// Empty means no additional port restriction once NodePort is allowed by types.
	// +optional
	Ports []ServiceNodePortRange `json:"ports,omitempty"`
}

type ServiceType string

type WorkloadValidationTarget string