rules

type ActionType string

type Audience struct {
	// +kubebuilder:validation:Enum=User;Group;ServiceAccount;Custom
	Kind AudienceKind `json:"kind"`
	Name string       `json:"name"`
}

type AudienceKind string

type CustomAudience string

type ImagePullPolicySpec string

type IngressType string

type MetadataRule struct {
	runtime.VersionKinds `json:",inline"`

	// Labels defines metadata policies by label key.
	//
	// +optional
	Labels map[string]MetadataValueRule `json:"labels,omitempty"`

	// Annotations defines metadata policies by annotation key.
	//
	// +optional
	Annotations map[string]MetadataValueRule `json:"annotations,omitempty"`
}

type MetadataValueRule struct {
	// Required enforces that the metadata key must be present.
	//
	// This is mainly meaningful with action=allow. Deny and audit rules remain
	// value matchers and do not require missing metadata to exist.
	//
	// +optional
	// +kubebuilder:default:=false
	Required bool `json:"required,omitempty"`

	// Values defines allowed, denied, or audited values for the metadata key.
	//
	// If Required=true and Values is empty, only presence is enforced.
	//
	// +optional
	Values []runtime.ExpressionMatch `json:"values,omitempty"`

	// Default is applied by admission mutation when the concrete metadata key is absent.
	// It is not reconciled after admission.
	// +optional
	Default *string `json:"default,omitempty"`

	// Managed is enforced by admission mutation and reconciled by the RuleStatus
	// controller using server-side apply when the rule configuration changes.
	// +optional
	Managed *string `json:"managed,omitempty"`
}

type NamespaceRuleBodyNamespace struct {
	// Audience limits this rule to matching request subjects.
	// An empty audience matches every request.
	// +optional
	Audience []Audience `json:"audience,omitempty"`

	// Quota contains native Kubernetes ResourceQuota specifications shared by
	// all namespaces selected by this rule. Unlike Enforce, quota accounting is
	// independent of the request audience.
	// +optional
	// +listType=map
	// +listMapKey=name
	Quota []ResourceQuotaRule `json:"quota,omitempty"`

	// Enforcement for given rule
	//+optional
	Enforce *NamespaceRuleEnforceBody `json:"enforce,omitzero"`
}

type NamespaceRuleBodyTenant struct {
	*NamespaceRuleBodyNamespace `json:",inline"`

	// Select namespaces which are going to be targeted with this rule
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

	// Permissions for given rule
	//+optional
	Permissions NamespaceRulePermissionBody `json:"permissions,omitempty"`
}

type NamespaceRuleEnforceBody struct {
	// Declare the action being performed on the enforcement rule:
	// deny: On match, deny admission request
	// allow: On match, allowed admission request
	// audit: On match, audit (post event) of admission request
	//+kubebuilder:default:=deny
	Action ActionType `json:"action,omitempty"`

	// Enforcement for Workloads (Pods)
	Workloads NamespaceRuleEnforceWorkloadsBody `json:"workloads,omitempty"`

	// Enforcement for Services.
	// +optional
	Services NamespaceRuleEnforceServicesBody `json:"services,omitempty"`

	// Enforcement for object metadata on namespaced resources.
	//
	// +optional
	Metadata []MetadataRule `json:"metadata,omitempty"`

	// Enforcement for Ingress and Gateway API resource hostnames.
	// +optional
	Ingress NamespaceRuleEnforceIngressBody `json:"ingress,omitempty"`
}

type NamespaceRuleEnforceIngressBody struct {
	// Types defines the resource kinds to which hostname enforcement applies.
	//
	// +kubebuilder:validation:MinItems=1
	Types []IngressType `json:"types,omitempty"`

	// Hostnames defines allowed, denied, or audited hostname expressions.
	// A resource targeted by an allow or deny rule must declare non-empty values
	// in all hostname fields. Audit-only rules record missing hostnames without
	// denying them.
	//
	// +kubebuilder:validation:MinItems=1
	Hostnames []runtime.ExpressionMatch `json:"hostnames,omitempty"`
}

type NamespaceRuleEnforceServicesBody struct {
	// Types defines the Service types matched by this rule.
	//
	// Supported values:
	// - ClusterIP
	// - NodePort
	// - LoadBalancer
	// - ExternalName
	//
	// +optional
	// +kubebuilder:validation:items:Enum=ClusterIP;NodePort;LoadBalancer;ExternalName
	Types []ServiceType `json:"types,omitempty"`

	// LoadBalancers defines additional constraints for Services of type LoadBalancer.
	// +optional
	LoadBalancers *ServiceLoadBalancerRule `json:"loadBalancers,omitempty"`

	// ExternalIPs defines constraints for spec.externalIPs.
	// +optional
	ExternalIPs *ServiceExternalIPRule `json:"externalIPs,omitempty"`

	// ExternalNames defines additional constraints for Services of type ExternalName.
	// +optional
	ExternalNames *ServiceExternalNameRule `json:"externalNames,omitempty"`

	// NodePorts defines additional constraints for nodePort values.
	// +optional
	NodePorts *ServiceNodePortRule `json:"nodePorts,omitempty"`
}

type NamespaceRuleEnforceWorkloadsBody struct {
	// Define the enforcement targets this rule applies to.
	// If empty, each webhook applies its own backwards-compatible default.
	// +optional
	Targets []WorkloadValidationTarget `json:"targets,omitempty"`

	// Resources defines mutation and enforcement policies for Pod and container
	// resource requests and limits. The workload targets select where the
	// policies apply. With no targets, resource policies apply to all compatible
	// locations: Pod-level resources, regular containers, and init containers.
	// Resource names unsupported at Pod level still apply to compatible container
	// locations.
	// Mutation is applied when a Pod is created. Remove and MatchRequest manage
	// explicit values, Default fills an absent value, and Ratio fills an absent
	// limit from its request. An explicit Ratio violation is then handled by the
	// enclosing allow, deny, or audit action.
	//
	// +optional
	Resources *WorkloadResourceRules `json:"resources,omitempty"`

	// Define Pod QoS classes matched by this enforcement rule.
	// Supported values are Guaranteed, Burstable and BestEffort.
	// +optional
	QoSClasses []corev1.PodQOSClass `json:"qosClasses,omitempty"`

	// Define registries which are allowed to be used within this tenant
	// The rules are aggregated, since you can use Regular Expressions the match registry endpoints
	// +optional
	Registries []OCIRegistry `json:"registries,omitempty"`

	// Schedulers defines schedulerName matchers for Pod admission.
	//
	// The rule is evaluated against pod.spec.schedulerName.
	// Empty schedulerName is ignored and is not normalized to default-scheduler.
	//
	// +optional
	Schedulers []runtime.ExpressionMatch `json:"schedulers,omitempty"`
}

type NamespaceRulePermissionBody struct {
	// Bindings defines additional RoleBindings for namespaces selected by this rule.
	Bindings []rbac.AdditionalRoleBindingsSpec `json:"bindings,omitempty"`

	// Define Promotion Rules which distributed additional ClusterRoles across the Tenant
	// for promoted ServiceAccounts.
	Promotions []*NamespaceRulePromotionRule `json:"promotions,omitempty"`
}

type NamespaceRulePromotionRule struct {
	// ClusterRoles granted to the promoted ServiceAccounts across the Tenant
	// kubebuilder:validation:Minimum=1
	ClusterRoles []string `json:"clusterRoles,omitempty"`

	// Match ServiceAccounts which are promoted which are granted these additional ClusterRoles
	// across the Tenant
	Selector *metav1.LabelSelector `json:"selector,omitempty"`
}

type OCIRegistry struct {
	runtime.ExpressionMatch `json:",inline"`

	// Allowed PullPolicy for the given registry. Supplying no value allows all policies.
	// +optional
	// +kubebuilder:validation:Items:Enum=Always;Never;IfNotPresent
	Policy []corev1.PullPolicy `json:"policy,omitempty"`
}

type ResourceQuotaRule struct {
	corev1.ResourceQuotaSpec `json:",inline"`

	// Name is the stable identity of this quota within the Tenant. Changing the
	// name replaces the generated GlobalResourceQuota; changing the quota or its
	// namespace selector updates the existing object.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	Name string `json:"name"`
}

type RuleDecision struct {
	Action ActionType
	Rule   *NamespaceRuleBodyNamespace
}

type ServiceExternalIPRule struct {
	// CIDRs restricts spec.externalIPs. Individual IP addresses are treated as
	// host CIDRs (/32 for IPv4 and /128 for IPv6).
	// For deny rules, empty means all external IPs are denied. For allow and
	// audit rules, empty means no external IP restriction.
	// +optional
	CIDRs []string `json:"cidrs,omitempty"`
}

type ServiceExternalNameRule struct {
	// Hostnames restricts spec.externalName.
	// Empty means no additional hostname restriction once ExternalName is allowed by types.
	// +optional
	Hostnames []runtime.ExpressionMatch `json:"hostnames,omitempty"`
}

type ServiceLoadBalancerRule struct {
	// CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges.
	// Empty means no additional CIDR restriction once LoadBalancer is allowed by types.
	// +optional
	CIDRs []string `json:"cidrs,omitempty"`
}

type ServiceNodePortRange struct {
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	From int32 `json:"from"`

	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	To int32 `json:"to"`
}

type ServiceNodePortRule struct {
	// Ports restricts explicitly requested nodePort values.
	// Empty means no additional port restriction once NodePort is allowed by types.
	// +optional
	Ports []ServiceNodePortRange `json:"ports,omitempty"`
}

type ServiceType string

type WorkloadResourceLimitPolicy struct {
	// Policy selects how the limit is handled: Preserve leaves it unchanged,
	// Default fills an absent limit, Remove deletes it, MatchRequest manages it
	// to equal the request, and Ratio defaults an absent limit and enforces the
	// maximum multiplier against explicitly supplied limits.
	// +kubebuilder:validation:Enum=Preserve;Default;Remove;MatchRequest;Ratio
	Policy WorkloadResourceLimitPolicyType `json:"policy"`

	// Value is the quantity applied by Default or the maximum limit-to-request
	// multiplier applied by Ratio.
	// +optional
	Value *resource.Quantity `json:"value,omitempty"`
}

type WorkloadResourceLimitPolicyType string

type WorkloadResourceRequestPolicy struct {
	// Policy selects how the request is handled: Preserve leaves it unchanged,
	// Default fills an absent request, and Remove deletes it.
	// +kubebuilder:validation:Enum=Preserve;Default;Remove
	Policy WorkloadResourceRequestPolicyType `json:"policy"`

	// Value is the quantity applied by the Default policy.
	// +optional
	Value *resource.Quantity `json:"value,omitempty"`
}

type WorkloadResourceRequestPolicyType string

type WorkloadResourceRules struct {
	// Requests defines policies for resource requests.
	// +optional
	// +kubebuilder:validation:MinProperties=1
	Requests map[corev1.ResourceName]WorkloadResourceRequestPolicy `json:"requests,omitempty"`

	// Limits defines policies for resource limits.
	// +optional
	// +kubebuilder:validation:MinProperties=1
	Limits map[corev1.ResourceName]WorkloadResourceLimitPolicy `json:"limits,omitempty"`
}

type WorkloadValidationTarget string