rules

type ActionType string

type AdmissionCondition struct {
	// Name identifies a condition in admission errors. Names must be unique within a block.
	// +optional
	// +kubebuilder:validation:MaxLength=63
	Name string `json:"name,omitempty"`

	// Expression must evaluate to bool. Any false condition skips this block.
	// An evaluation error rejects the request unless another condition is false.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=4096
	Expression string `json:"expression"`
}

type Audience struct {
	// +kubebuilder:validation:Enum=User;Group;ServiceAccount;Custom
	Kind AudienceKind `json:"kind"`
	Name string       `json:"name"`
}

type AudienceKind string

type CustomAudience string

type GatewayParentReference struct {
	// Group identifies the parent's API group. An explicit empty string selects
	// the core API group, following Gateway API reference semantics.
	// +optional
	// +kubebuilder:default="gateway.networking.k8s.io"
	// +kubebuilder:validation:MaxLength=4096
	Group *string `json:"group,omitempty"`

	// Kind identifies the parent's kind.
	// +optional
	// +kubebuilder:default=Gateway
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=4096
	Kind *string `json:"kind,omitempty"`

	// Name identifies the parent resource.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=4096
	Name string `json:"name"`

	// Namespace identifies the parent's namespace. Omitted means the
	// ListenerSet's namespace; an explicit empty string is invalid.
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=4096
	Namespace *string `json:"namespace,omitempty"`
}

type ImagePullPolicySpec string

type IngressMutation struct {
	// ListenerSets configures gateway.networking.k8s.io/v1 ListenerSets.
	// +optional
	ListenerSets ListenerSetMutation `json:"listenerSets,omitzero"`
}

type IngressType string

type ListenerSetMutation struct {
	// ParentRef supplies the complete spec.parentRef. Merge fills only an absent
	// or null reference; any supplied reference is retained, including an omitted
	// namespace. Replace replaces the entire reference. Nil leaves it unchanged.
	// The first applicable merge wins; later replacements can override it.
	// Attachment remains subject to the parent's allowedListeners configuration.
	// +optional
	ParentRef *GatewayParentReference `json:"parentRef,omitempty"`
}

type MetadataRule struct {
	runtime.VersionKinds `json:",inline"`

	// Labels defines metadata policies by label key.
	//
	// +optional
	Labels map[string]MetadataValueRule `json:"labels,omitempty"`

	// Annotations defines metadata policies by annotation key.
	//
	// +optional
	Annotations map[string]MetadataValueRule `json:"annotations,omitempty"`
}

type MetadataValueRule struct {
	// Required enforces that the metadata key must be present.
	//
	// This is only meaningful with action=allow. Deny and audit rules do not
	// require missing metadata to exist.
	//
	// +optional
	// +kubebuilder:default:=false
	Required bool `json:"required,omitempty"`

	// Values defines allowed, denied, or audited values for the metadata key.
	//
	// With action=allow and no values, only Required is enforced.
	// With action=deny or action=audit and no values, any present value matches,
	// including an empty string.
	//
	// +optional
	Values []runtime.ExpressionMatch `json:"values,omitempty"`

	// Default is applied by admission mutation when the concrete metadata key is absent.
	// It is not reconciled after admission.
	// +optional
	Default *string `json:"default,omitempty"`

	// Managed is enforced by admission mutation and reconciled by the RuleStatus
	// controller using server-side apply when the rule configuration changes.
	// Present metadata matching the effective managed value is exempt from
	// metadata value validation, including overlapping deny rules. The last
	// applicable managed value for each concrete key wins.
	// During admission, only rules matching the request's audience contribute
	// to the effective managed value.
	// +optional
	Managed *string `json:"managed,omitempty"`
}

type MutationAction string

type NamespaceRuleBodyNamespace struct {
	// Audience limits this rule to matching request subjects.
	// An empty audience matches every request.
	// +optional
	Audience []Audience `json:"audience,omitempty"`

	// Quota contains native Kubernetes ResourceQuota specifications shared by
	// all namespaces selected by this rule. Unlike Enforce, quota accounting is
	// independent of the request audience.
	// +optional
	// +listType=map
	// +listMapKey=name
	Quota []ResourceQuotaRule `json:"quota,omitempty"`

	// Mutate applies ordered typed mutations before enforcement. It shares the
	// rule's namespace selection and audience. Workload mutations apply on Pod creation;
	// ListenerSet parent references apply on main-resource creation and update.
	// +optional
	// +kubebuilder:validation:MaxItems=64
	// +listType=atomic
	Mutate []NamespaceRuleMutation `json:"mutate,omitempty"`

	// Enforcement for given rule
	//+optional
	Enforce *NamespaceRuleEnforceBody `json:"enforce,omitzero"`
}

type NamespaceRuleBodyTenant struct {
	*NamespaceRuleBodyNamespace `json:",inline"`

	// Select namespaces which are going to be targeted with this rule
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

	// Permissions for given rule
	//+optional
	Permissions NamespaceRulePermissionBody `json:"permissions,omitempty"`
}

type NamespaceRuleEnforceBody struct {
	// Conditions gate this entire enforcement rule, including workloads, services,
	// metadata, ingress, network and storage. All conditions must be true; empty means apply.
	// Conditions run during admission; managed metadata in a conditional rule
	// is applied on matching requests only and is not reconciled in the background.
	// +optional
	// +kubebuilder:validation:MaxItems=64
	// +listType=atomic
	Conditions []AdmissionCondition `json:"conditions,omitempty"`

	// Declare the action being performed on the enforcement rule:
	// deny: On match, deny admission request
	// allow: On match, allowed admission request
	// audit: On match, audit (post event) of admission request
	//+kubebuilder:default:=deny
	Action ActionType `json:"action,omitempty"`

	// Enforcement for native workload kinds and Pod properties.
	Workloads NamespaceRuleEnforceWorkloadsBody `json:"workloads,omitempty"`

	// Enforcement for Services.
	// +optional
	Services NamespaceRuleEnforceServicesBody `json:"services,omitempty"`

	// Additional access to PersistentVolumes without a tenant ownership label.
	// +optional
	Storage NamespaceRuleEnforceStorageBody `json:"storage,omitempty"`

	// Network configures network enforcement for namespace resources.
	// +optional
	Network NamespaceRuleEnforceNetworkBody `json:"network,omitempty"`

	// Enforcement for object metadata on namespaced resources.
	//
	// +optional
	Metadata []MetadataRule `json:"metadata,omitempty"`

	// Enforcement for Ingress and Gateway API resource hostnames.
	// +optional
	Ingress NamespaceRuleEnforceIngressBody `json:"ingress,omitempty"`
}

type NamespaceRuleEnforceIngressBody struct {
	// Types defines the resource kinds to which hostname enforcement applies.
	//
	// +kubebuilder:validation:MinItems=1
	Types []IngressType `json:"types,omitempty"`

	// Hostnames defines allowed, denied, or audited hostname expressions.
	// A resource targeted by an allow or deny rule must declare non-empty values
	// in all hostname fields. Audit-only rules record missing hostnames without
	// denying them.
	//
	// +kubebuilder:validation:MinItems=1
	Hostnames []runtime.ExpressionMatch `json:"hostnames,omitempty"`
}

type NamespaceRuleEnforceNetworkBody struct {
	// Policies constrains native NetworkPolicies.
	// +optional
	Policies NamespaceRuleEnforceNetworkPoliciesBody `json:"policies,omitempty"`
}

type NamespaceRuleEnforceNetworkPoliciesBody struct {
	// Ingress constrains source address grants. Selector-based peers are
	// unaffected. No constraints are applied when omitted.
	// +optional
	Ingress *NetworkPolicyCIDRRule `json:"ingress,omitempty"`

	// Egress constrains destination address grants. Selector-based peers are
	// unaffected. No constraints are applied when omitted.
	// +optional
	Egress *NetworkPolicyCIDRRule `json:"egress,omitempty"`
}

type NamespaceRuleEnforceServicesBody struct {
	// Types defines the Service types matched by this rule.
	//
	// Supported values:
	// - ClusterIP
	// - NodePort
	// - LoadBalancer
	// - ExternalName
	//
	// +optional
	// +kubebuilder:validation:items:Enum=ClusterIP;NodePort;LoadBalancer;ExternalName
	Types []ServiceType `json:"types,omitempty"`

	// LoadBalancers defines additional constraints for Services of type LoadBalancer.
	// +optional
	LoadBalancers *ServiceLoadBalancerRule `json:"loadBalancers,omitempty"`

	// ExternalIPs defines constraints for spec.externalIPs.
	// +optional
	ExternalIPs *ServiceExternalIPRule `json:"externalIPs,omitempty"`

	// ExternalNames defines additional constraints for Services of type ExternalName.
	// +optional
	ExternalNames *ServiceExternalNameRule `json:"externalNames,omitempty"`

	// NodePorts defines additional constraints for nodePort values.
	// +optional
	NodePorts *ServiceNodePortRule `json:"nodePorts,omitempty"`
}

type NamespaceRuleEnforceStorageBody struct {
	// Volumes matches additional PersistentVolumes. Entries are ORed. Conditions
	// on the enclosing enforcement rule must also match. The last matching
	// allow/deny decides the exception; audit never grants access.
	// +optional
	// +kubebuilder:validation:MaxItems=64
	// +listType=atomic
	Volumes []PersistentVolumeMatch `json:"volumes,omitempty"`
}

type NamespaceRuleEnforceWorkloadsBody struct {
	// DisruptionBudgets constrains PDB coverage of selected Pods and controller templates.
	// Only whole-workload targets apply; omitted targets select Pods.
	// +optional
	DisruptionBudgets *WorkloadDisruptionBudgetRules `json:"disruptionBudgets,omitempty"`

	// Targets selects native workloads and, optionally, parts of their Pod specs.
	// With no workload policies, the action matches the selected kinds themselves.
	// With policies, targets scopes those policies; it does not also match the kind.
	// Omitted targets preserve Pod-only defaults. Controller targets are opt-in.
	// Whole-controller targets include every compatible location in the Pod template.
	// Existing pod and pod/* part targets retain their established policy scope.
	// +optional
	Targets []WorkloadValidationTarget `json:"targets,omitempty"`

	// Resources defines mutation and enforcement policies for Pod and container
	// resource requests and limits. The workload targets select where the
	// policies apply. With no targets, resource policies apply to all compatible
	// locations: Pod-level resources, regular containers, and init containers.
	// Resource names unsupported at Pod level still apply to compatible container
	// locations.
	// Mutation is applied when a Pod is created, or when an explicitly targeted
	// controller is created or updated (to its Pod template). Remove and MatchRequest manage
	// explicit values, Default fills an absent value, and Ratio fills an absent
	// limit from its request. An explicit Ratio violation is then handled by the
	// enclosing allow, deny, or audit action.
	//
	// +optional
	Resources *WorkloadResourceRules `json:"resources,omitempty"`

	// Define Pod QoS classes matched by this enforcement rule.
	// Supported values are Guaranteed, Burstable and BestEffort.
	// +optional
	QoSClasses []corev1.PodQOSClass `json:"qosClasses,omitempty"`

	// Define registries which are allowed to be used within this tenant
	// The rules are aggregated, since you can use Regular Expressions the match registry endpoints
	// +optional
	Registries []OCIRegistry `json:"registries,omitempty"`

	// Schedulers defines additional schedulerName matchers for selected Pods and
	// Pod templates. These are combined with placement.schedulers under the same
	// rule action; a match in either field counts as a match.
	//
	// Deprecated: use Placement.Schedulers instead.
	//
	// +optional
	Schedulers []runtime.ExpressionMatch `json:"schedulers,omitempty"`

	// Placement matches the Pod scheduler and scheduling constraints.
	// +optional
	Placement WorkloadPlacementEnforcement `json:"placement,omitzero"`

	// Security matches effective Pod and container security profiles.
	// +optional
	Security WorkloadSecurityEnforcement `json:"security,omitzero"`
}

type NamespaceRuleMutation struct {
	// Conditions gate this entire mutation entry and inspect the object after
	// preceding mutations. All conditions must be true; empty means apply.
	// +optional
	// +kubebuilder:validation:MaxItems=64
	// +listType=atomic
	Conditions []AdmissionCondition `json:"conditions,omitempty"`

	// Action chooses how explicitly supplied properties are applied.
	// Merge fills an empty schedulerName and absent security profiles, sets hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy,
	// and map keys, adds missing imagePullSecrets by name, upserts lists, and conjoins required affinity.
	// Replace replaces each supplied property in full: scheduler, hostUsers, readOnlyRootFilesystem, registries.imagePullPolicy, nodeSelector,
	// registries.imagePullSecrets, tolerations, topologySpreadConstraints, affinity, or security profiles. Omitted properties are
	// retained. Supplying affinity replaces all its branches, including omitted ones.
	// ListenerSet parent references are atomic: merge fills an absent or null
	// reference, while replace replaces the entire supplied reference.
	// +optional
	// +kubebuilder:default=merge
	// +kubebuilder:validation:Enum=merge;replace
	Action MutationAction `json:"action,omitempty"`

	// +optional
	Workloads WorkloadMutation `json:"workloads,omitempty"`

	// Ingress configures Kubernetes ingress and Gateway API resource mutations.
	// +optional
	Ingress IngressMutation `json:"ingress,omitzero"`
}

type NamespaceRulePermissionBody struct {
	// Bindings defines additional RoleBindings for namespaces selected by this rule.
	Bindings []rbac.AdditionalRoleBindingsSpec `json:"bindings,omitempty"`

	// Define Promotion Rules which distributed additional ClusterRoles across the Tenant
	// for promoted ServiceAccounts.
	Promotions []*NamespaceRulePromotionRule `json:"promotions,omitempty"`
}

type NamespaceRulePromotionRule struct {
	// ClusterRoles granted to the promoted ServiceAccounts across the Tenant
	// kubebuilder:validation:Minimum=1
	ClusterRoles []string `json:"clusterRoles,omitempty"`

	// Match ServiceAccounts which are promoted which are granted these additional ClusterRoles
	// across the Tenant
	Selector *metav1.LabelSelector `json:"selector,omitempty"`
}

type NetworkPolicyCIDRRule struct {
	// CIDRs matches addresses granted by ipBlock.cidr after subtracting except.
	// Omitted peers on an ingress or egress rule grant both IPv4 and IPv6 address
	// space. An empty NetworkPolicy ingress or egress list has no grants in that
	// direction to validate. Each direction is evaluated independently.
	// An empty CIDRs list imposes no constraint.
	// Ordered allow/deny decisions apply to every granted address: deny rejects
	// overlapping grants, allow requires complete coverage, and audit reports
	// overlaps. A later allow cannot authorize addresses outside its CIDRs.
	// +optional
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:validation:items:MaxLength=49
	// +listType=set
	CIDRs []string `json:"cidrs,omitempty"`
}

type OCIRegistry struct {
	runtime.ExpressionMatch `json:",inline"`

	// Allowed PullPolicy for the given registry. Supplying no value allows all policies.
	// +optional
	// +kubebuilder:validation:Items:Enum=Always;Never;IfNotPresent
	Policy []corev1.PullPolicy `json:"policy,omitempty"`
}

type PersistentVolumeMatch struct {
	// Name identifies this match in admission and audit messages.
	// +optional
	// +kubebuilder:validation:MaxLength=63
	Name string `json:"name,omitempty"`

	// Selector matches existing PV labels, independently of PVC.spec.selector.
	// An explicit empty selector matches all PVs. Capsule's tenant ownership
	// label cannot be overridden by a selector or an allow decision.
	// +kubebuilder:validation:Required
	Selector *metav1.LabelSelector `json:"selector"`
}

type PlacementAffinityMode string

type PlacementAffinityType string

type PlacementExpressionMatch struct {
	runtime.ExpressionRegex `json:",inline"`

	// Exact matches one of the provided values exactly.
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:validation:items:MinLength=1
	// +optional
	Exact []string `json:"exact,omitempty"`
}

type PlacementLabelSelectorMatch struct {
	// Required requires at least one effective selector requirement.
	// +optional
	Required bool `json:"required,omitempty"`
	// Requirements is an allowlist within this matcher. If empty, requirements
	// are unrestricted. Each actual requirement must match one complete entry.
	// +optional
	Requirements []PlacementRequirementMatch `json:"requirements,omitempty"`
}

type PlacementNamespaceScope string

type PlacementRange struct {
	// +optional
	Min *int64 `json:"min,omitempty"`
	// +optional
	Max *int64 `json:"max,omitempty"`
}

type PlacementRequirementMatch struct {
	WorkloadNodeSelectorMatch `json:",inline"`

	// +optional
	// +kubebuilder:validation:items:Enum=In;NotIn;Exists;DoesNotExist;Gt;Lt
	Operators []corev1.NodeSelectorOperator `json:"operators,omitempty"`
}

type ResourceQuotaRule struct {
	corev1.ResourceQuotaSpec `json:",inline"`

	// Name is the stable identity of this quota within the Tenant. Changing the
	// name replaces the generated GlobalResourceQuota; changing the quota or its
	// namespace selector updates the existing object.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	Name string `json:"name"`
}

type RuleDecision struct {
	Action ActionType
	Rule   *NamespaceRuleBodyNamespace
}

type SecurityProfileType string

type ServiceExternalIPRule struct {
	// CIDRs restricts spec.externalIPs. Individual IP addresses are treated as
	// host CIDRs (/32 for IPv4 and /128 for IPv6).
	// For deny rules, empty means all external IPs are denied. For allow and
	// audit rules, empty means no external IP restriction.
	// +optional
	CIDRs []string `json:"cidrs,omitempty"`
}

type ServiceExternalNameRule struct {
	// Hostnames restricts spec.externalName.
	// Empty means no additional hostname restriction once ExternalName is allowed by types.
	// +optional
	Hostnames []runtime.ExpressionMatch `json:"hostnames,omitempty"`
}

type ServiceLoadBalancerRule struct {
	// CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges.
	// Empty means no additional CIDR restriction once LoadBalancer is allowed by types.
	// +optional
	CIDRs []string `json:"cidrs,omitempty"`
}

type ServiceNodePortRange struct {
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	From int32 `json:"from"`

	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	To int32 `json:"to"`
}

type ServiceNodePortRule struct {
	// Ports restricts explicitly requested nodePort values.
	// Empty means no additional port restriction once NodePort is allowed by types.
	// +optional
	Ports []ServiceNodePortRange `json:"ports,omitempty"`
}

type ServiceType string

type TolerationDurationMatch struct {
	PlacementRange `json:",inline"`

	// AllowUnlimited defaults to true. Set false to require a finite duration.
	// +optional
	AllowUnlimited *bool `json:"allowUnlimited,omitempty"`
}

type WorkloadAffinityMatch struct {
	// Types defaults to all types. Type-specific constraints only match the
	// types on which they are meaningful.
	// +optional
	Types []PlacementAffinityType `json:"types,omitempty"`
	// Modes defaults to both scheduling modes; it does not require their presence.
	// +optional
	Modes []PlacementAffinityMode `json:"modes,omitempty"`
	// Weight requires modes: [preferred].
	// +optional
	Weight *PlacementRange `json:"weight,omitempty"`
	// Requirements constrains node matchExpressions.
	// +optional
	Requirements []PlacementRequirementMatch `json:"requirements,omitempty"`
	// FieldRequirements constrains node matchFields. When Requirements is set,
	// matchFields must be explicitly permitted here to avoid an unchecked path.
	// +optional
	FieldRequirements []PlacementRequirementMatch `json:"fieldRequirements,omitempty"`
	// TopologyKey applies to Pod affinity and anti-affinity.
	// +optional
	TopologyKey *PlacementExpressionMatch `json:"topologyKey,omitempty"`
	// SameNamespace requires no namespaceSelector and only the Pod's namespace
	// in namespaces (or an omitted namespaces list). Any imposes no restriction.
	// +optional
	NamespaceScope PlacementNamespaceScope `json:"namespaceScope,omitempty"`
	// Namespaces constrains each explicitly supplied namespace.
	// +optional
	Namespaces *PlacementExpressionMatch `json:"namespaces,omitempty"`
	// +optional
	NamespaceSelector *PlacementLabelSelectorMatch `json:"namespaceSelector,omitempty"`
	// +optional
	LabelSelector *PlacementLabelSelectorMatch `json:"labelSelector,omitempty"`
}

type WorkloadDisruptionBudgetRules struct {
	// AllowOverlap permits multiple PDBs to select the same Pod or selected
	// controller template. False rejects overlap for allow/deny actions and
	// reports violations for audit. True permits overlap in an allow rule;
	// omitted does not participate in evaluation. Rule ordering is preserved.
	// Checks run on PDB selector changes and selected Pod/template label changes.
	// Conditions and audience apply to the admission request, including PDB writes.
	// Cross-resource admission reads are not an atomic transaction.
	// +optional
	AllowOverlap *bool `json:"allowOverlap,omitempty"`

	// EvictableReplicas bounds the configured number of evictable replicas of each
	// selected Deployment, StatefulSet, ReplicaSet or ReplicationController.
	// Uses desired spec.replicas and Kubernetes' upward percentage rounding;
	// zero replicas are exempt. Checks controller writes, /scale, and PDB writes.
	// Bounds are inclusive nonnegative integers; omitted bounds are unrestricted.
	// Allow requires compliance; deny/audit match violations, like resource constraints.
	// Other targets do not have a desired replica count and skip this property.
	// At least one supported controller target must be explicitly selected.
	// +optional
	EvictableReplicas *PlacementRange `json:"evictableReplicas,omitempty"`

	// UnhealthyPodEvictionPolicies matches the effective PDB policy. Omission in a
	// PDB means IfHealthyBudget. Allow accepts listed values; deny/audit match
	// listed values, like other enum lists. Empty imposes no restriction.
	// +kubebuilder:validation:MaxItems=2
	// +kubebuilder:validation:items:Enum=IfHealthyBudget;AlwaysAllow
	// +listType=set
	// +optional
	UnhealthyPodEvictionPolicies []policyv1.UnhealthyPodEvictionPolicyType `json:"unhealthyPodEvictionPolicies,omitempty"`
}

type WorkloadMutation struct {
	// Targets selects compatible Pod locations. Omitted or empty selects all
	// compatible locations. The pod target includes Pod-level properties and all
	// container groups; pod/containers, pod/initcontainers and pod/ephemeralcontainers
	// narrow selection to one group. Controller templates and volumes are not supported.
	// +optional
	// +kubebuilder:validation:MaxItems=4
	// +kubebuilder:validation:items:Enum=pod;pod/containers;pod/initcontainers;pod/ephemeralcontainers
	// +listType=set
	Targets []WorkloadValidationTarget `json:"targets,omitempty"`

	// Registries configures Pod image pull secrets and selected containers' pull policies.
	// +optional
	Registries WorkloadRegistryMutation `json:"registries,omitzero"`

	// Placement configures the Pod scheduler and scheduling constraints.
	// +optional
	Placement WorkloadPlacementMutation `json:"placement,omitzero"`

	// Security configures Pod and container security settings.
	// +optional
	Security WorkloadSecurityMutation `json:"security,omitzero"`
}

type WorkloadNodeSelectorMatch struct {
	// +optional
	Key *PlacementExpressionMatch `json:"key,omitempty"`
	// +optional
	Values *PlacementExpressionMatch `json:"values,omitempty"`
}

type WorkloadPlacementEnforcement struct {
	// NodeSelector matches each node selector entry. Empty matchers match any entry.
	// Placement rules apply to the pod target; allowing an entry does not require it.
	// +optional
	NodeSelector []WorkloadNodeSelectorMatch `json:"nodeSelector,omitempty"`

	// Tolerations matches each toleration, including injected and wildcard tolerations.
	// +optional
	Tolerations []WorkloadTolerationMatch `json:"tolerations,omitempty"`

	// TopologySpreadConstraints matches each complete spread constraint.
	// +optional
	TopologySpreadConstraints []WorkloadTopologySpreadMatch `json:"topologySpreadConstraints,omitempty"`

	// Affinity matches each complete required or preferred affinity term.
	// +optional
	Affinity []WorkloadAffinityMatch `json:"affinity,omitempty"`

	// Schedulers defines schedulerName matchers for selected Pods and Pod templates.
	//
	// The rule is evaluated against pod.spec.schedulerName.
	// Empty schedulerName is ignored and is not normalized to default-scheduler.
	//
	// +optional
	Schedulers []runtime.ExpressionMatch `json:"schedulers,omitempty"`
}

type WorkloadPlacementMutation struct {
	// Scheduler sets spec.schedulerName on Pod creation. Merge fills only an empty
	// schedulerName, preserving all non-empty names, including default-scheduler.
	// Kubernetes defaults omitted schedulerName before admission. Use replace with
	// a condition to override default-scheduler while preserving custom schedulers.
	// Replace always overwrites schedulerName when the entry's conditions match.
	// Omitted or null leaves the Pod value unchanged.
	// +optional
	// +kubebuilder:validation:MinLength=1
	Scheduler string `json:"scheduler,omitempty"`

	// NodeSelector sets configured keys on merge, or replaces the map on replace.
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitzero"`

	// Tolerations merges by key, operator (default Equal), value and effect.
	// Changing any identity field adds another toleration, retaining the old one.
	// A matching toleration's duration is replaced; omitting it makes it unlimited.
	// Replace replaces the entire list, including entries with other identities.
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitzero"`

	// TopologySpreadConstraints merges by topologyKey and whenUnsatisfiable.
	// The entire matching constraint is replaced, including its selector and
	// optional fields; other constraints remain. Replace replaces the entire list.
	// +optional
	// +listType=map
	// +listMapKey=topologyKey
	// +listMapKey=whenUnsatisfiable
	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitzero"`

	// Affinity on merge conjoins required restrictions and upserts preferred terms.
	// Preferred terms match by their complete term, excluding weight and normalized
	// ordering. A different term is added; a matching term gets the supplied weight.
	// Required node affinity is distributed over existing OR alternatives, with
	// at most 256 resulting alternatives. Empty node selector terms match no nodes.
	// Replace replaces all affinity, including any branches omitted from the rule.
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`
}

type WorkloadRegistryMutation struct {
	// ImagePullPolicy sets imagePullPolicy on every selected regular or init
	// container at Pod creation, and newly added ephemeral containers on subresource
	// updates. Both merge and replace overwrite explicit and Kubernetes-defaulted
	// values. Omitted or null preserves the existing policy. Applies to all Pod OSes.
	// +optional
	// +kubebuilder:validation:Enum=Always;IfNotPresent;Never
	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`

	// ImagePullSecrets sets spec.imagePullSecrets on Pod creation. Merge appends
	// missing names and removes existing duplicates, retaining first-occurrence order. Replace sets
	// the complete list; an explicit empty list clears it. Omitted or null preserves it.
	// Requires the pod target or omitted/empty targets. References always use the
	// Pod's namespace; Capsule does not create, copy, or check the referenced Secrets.
	// +optional
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:validation:items:XValidation:rule="has(self.name) && self.name != ”",message="secret name must not be empty"
	// +listType=map
	// +listMapKey=name
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitzero"`
}

type WorkloadResourceLimitPolicy struct {
	// Policy selects how the limit is handled: Preserve leaves it unchanged,
	// Default fills an absent limit, Remove deletes it, MatchRequest manages it
	// to equal the request, and Ratio defaults an absent limit and enforces the
	// maximum multiplier against explicitly supplied limits.
	// +kubebuilder:validation:Enum=Preserve;Default;Remove;MatchRequest;Ratio
	Policy WorkloadResourceLimitPolicyType `json:"policy"`

	// Value is the quantity applied by Default or the maximum limit-to-request
	// multiplier applied by Ratio.
	// +optional
	Value *resource.Quantity `json:"value,omitempty"`
}

type WorkloadResourceLimitPolicyType string

type WorkloadResourceRequestPolicy struct {
	// Policy selects how the request is handled: Preserve leaves it unchanged,
	// Default fills an absent request, and Remove deletes it.
	// +kubebuilder:validation:Enum=Preserve;Default;Remove
	Policy WorkloadResourceRequestPolicyType `json:"policy"`

	// Value is the quantity applied by the Default policy.
	// +optional
	Value *resource.Quantity `json:"value,omitempty"`
}

type WorkloadResourceRequestPolicyType string

type WorkloadResourceRules struct {
	// Requests defines policies for resource requests.
	// +optional
	// +kubebuilder:validation:MinProperties=1
	Requests map[corev1.ResourceName]WorkloadResourceRequestPolicy `json:"requests,omitempty"`

	// Limits defines policies for resource limits.
	// +optional
	// +kubebuilder:validation:MinProperties=1
	Limits map[corev1.ResourceName]WorkloadResourceLimitPolicy `json:"limits,omitempty"`
}

type WorkloadSecurityEnforcement struct {
	// SeccompProfiles matches effective Linux container profiles, resolving
	// container overrides before Pod defaults. Privileged containers are Unconfined.
	// Missing profiles do not match any type, so an allow-list rejects them.
	// Omitted targets check regular, init and ephemeral containers; pod explicitly
	// selects only the Pod default. Controller targets check their Pod templates.
	// +optional
	// +kubebuilder:validation:MaxItems=64
	SeccompProfiles []WorkloadSecurityProfileMatch `json:"seccompProfiles,omitempty"`

	// AppArmorProfiles matches effective Linux container profiles, including
	// legacy AppArmor annotations before Pod defaults. It uses the same target
	// and missing-profile semantics as SeccompProfiles. Privileged containers are
	// Unconfined. Matching a Localhost name does not verify its installation.
	// +optional
	// +kubebuilder:validation:MaxItems=64
	AppArmorProfiles []WorkloadSecurityProfileMatch `json:"appArmorProfiles,omitempty"`
}

type WorkloadSecurityMutation struct {
	// ReadOnlyRootFilesystem sets securityContext.readOnlyRootFilesystem on every
	// selected regular or init container at Pod creation, and newly added ephemeral
	// containers on subresource updates. Both merge and replace overwrite the value.
	// False is an explicit setting; nil preserves it. Windows Pods are skipped.
	// +optional
	ReadOnlyRootFilesystem *bool `json:"readOnlyRootFilesystem,omitempty"`

	// SeccompProfile supplies the Pod-level securityContext.seccompProfile on
	// Linux Pod creation. Merge fills an absent profile; replace replaces the
	// complete profile. Explicit container profiles are preserved. Nil omits it.
	// +optional
	SeccompProfile *corev1.SeccompProfile `json:"seccompProfile,omitempty"`

	// AppArmorProfile supplies the Pod-level securityContext.appArmorProfile on
	// Linux Pod creation. Merge fills an absent profile; replace replaces the
	// complete profile. Explicit container profiles are preserved. Nil omits it.
	// AppArmor and any Localhost profile must be available on eligible nodes.
	// +optional
	AppArmorProfile *corev1.AppArmorProfile `json:"appArmorProfile,omitempty"`

	// HostUsers sets spec.hostUsers on both merge and replace. False requests a
	// separate user namespace; true uses the host user namespace. Omitted or null
	// leaves the Pod value unchanged. Requires Kubernetes/runtime support.
	// +optional
	HostUsers *bool `json:"hostUsers,omitempty"`
}

type WorkloadSecurityProfileMatch struct {
	// Types selects profile types. Missing profiles never match.
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=3
	Types []SecurityProfileType `json:"types"`

	// LocalhostProfiles matches seccomp paths relative to the kubelet seccomp
	// directory, or loaded AppArmor profile names. Omitted permits any Localhost
	// profile. Requires Localhost in types. Expressions use exact, exp and negate.
	// +optional
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	LocalhostProfiles []runtime.ExpressionMatch `json:"localhostProfiles,omitempty"`
}

type WorkloadTolerationMatch struct {
	WorkloadNodeSelectorMatch `json:",inline"`

	// Operators matches Equal (including an omitted operator) or Exists.
	// +optional
	// +kubebuilder:validation:items:Enum=Equal;Exists
	Operators []corev1.TolerationOperator `json:"operators,omitempty"`
	// Effects matches the literal effect. An empty effect on a Pod tolerates all
	// effects and does not match an allowlist of individual effects.
	// +optional
	// +kubebuilder:validation:items:Enum=NoSchedule;PreferNoSchedule;NoExecute;""
	Effects []corev1.TaintEffect `json:"effects,omitempty"`
	// +optional
	TolerationSeconds *TolerationDurationMatch `json:"tolerationSeconds,omitempty"`
}

type WorkloadTopologySpreadMatch struct {
	// +optional
	TopologyKey *PlacementExpressionMatch `json:"topologyKey,omitempty"`
	// +optional
	// +kubebuilder:validation:items:Enum=DoNotSchedule;ScheduleAnyway
	WhenUnsatisfiable []corev1.UnsatisfiableConstraintAction `json:"whenUnsatisfiable,omitempty"`
	// +optional
	MaxSkew *PlacementRange `json:"maxSkew,omitempty"`
	// MinDomains uses 1 when the Pod omits minDomains.
	// +optional
	MinDomains *PlacementRange `json:"minDomains,omitempty"`
	// NodeAffinityPolicy uses Honor when the Pod omits the field.
	// +optional
	// +kubebuilder:validation:items:Enum=Honor;Ignore
	NodeAffinityPolicy []corev1.NodeInclusionPolicy `json:"nodeAffinityPolicy,omitempty"`
	// NodeTaintsPolicy uses Ignore when the Pod omits the field.
	// +optional
	// +kubebuilder:validation:items:Enum=Honor;Ignore
	NodeTaintsPolicy []corev1.NodeInclusionPolicy `json:"nodeTaintsPolicy,omitempty"`
	// +optional
	LabelSelector *PlacementLabelSelectorMatch `json:"labelSelector,omitempty"`
}

type WorkloadValidationTarget string