acm/deploy/helm/multicluster-engine-config/charts/policy/crds/policy.open-cluster-management.io

apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.16.3 name: policies.policy.open-cluster-management.io spec: group: policy.open-cluster-management.io names: kind: Policy listKind: PolicyList plural: policies shortNames: - plc singular: policy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.remediationAction name: Remediation action type: string - jsonPath: .status.compliant name: Compliance state type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1 schema: openAPIV3Schema: description: >- Policy is the schema for the policies API. Policy wraps other policy engine resources in its "policy-templates" array in order to deliver the resources to managed clusters. properties: apiVersion: description: >- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: >- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: >- PolicySpec defines the configurations of the policy engine resources to deliver to the managed clusters. properties: copyPolicyMetadata: description: >- CopyPolicyMetadata specifies whether the labels and annotations of a policy should be copied when replicating the policy to a managed cluster. If set to "true", all of the labels and annotations of the policy are copied to the replicated policy. If set to "false", only the policy framework-specific policy labels and annotations are copied to the replicated policy. This setting is useful if there is tracking for metadata that should only exist on the root policy. It is recommended to set this to "false" when using Argo CD to deploy the policy definition since Argo CD uses metadata for tracking that should not be replicated. The default value is "true". type: boolean dependencies: description: >- PolicyDependencies is a list of dependency objects detailed with extra considerations for compliance that should be fulfilled before applying the policies to the managed clusters. items: description: >- Each PolicyDependency defines an object reference which must be in a certain compliance state before the policy should be created. oneOf: - properties: kind: enum: - CertificatePolicy - ConfigurationPolicy namespace: maxLength: 0 - not: properties: kind: pattern: ^(?:(?:Certificate|Configuration)Policy)$ properties: apiVersion: description: >- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string compliance: description: >- Compliance is the required ComplianceState of the object that the policy depends on, at the following path, .status.compliant. enum: - Compliant - Pending - NonCompliant type: string kind: description: >- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string name: description: Name is the name of the object that the policy depends on. type: string namespace: description: Namespace is the namespace of the object that the policy depends on (optional). type: string required: - compliance - name type: object type: array disabled: description: >- Disabled is a boolean parameter you can use to enable and disable the policy. When disabled, the policy is removed from managed clusters. type: boolean hubTemplateOptions: description: HubTemplateOptions changes the default behavior of hub templates. properties: serviceAccountName: description: >- ServiceAccountName is the name of a service account in the same namespace as the policy to use for all hub template lookups. The service account must have list and watch permissions on any object the hub templates look up. If not specified, lookups are restricted to namespaced objects in the same namespace as the policy and to the `ManagedCluster` object associated with the propagated policy. type: string type: object policy-templates: description: >- PolicyTemplates is a list of definitions of policy engine resources to apply to managed clusters along with configurations on how it should be applied. items: description: >- PolicyTemplate is the definition of the policy engine resource to apply to the managed cluster, along with configurations on how it should be applied. properties: extraDependencies: description: >- ExtraDependencies is additional PolicyDependencies that only apply to this policy template. ExtraDependencies is a list of dependency objects detailed with extra considerations for compliance that should be fulfilled before applying the policy template to the managed clusters. items: description: >- Each PolicyDependency defines an object reference which must be in a certain compliance state before the policy should be created. oneOf: - properties: kind: enum: - CertificatePolicy - ConfigurationPolicy namespace: maxLength: 0 - not: properties: kind: pattern: ^(?:(?:Certificate|Configuration)Policy)$ properties: apiVersion: description: >- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string compliance: description: >- Compliance is the required ComplianceState of the object that the policy depends on, at the following path, .status.compliant. enum: - Compliant - Pending - NonCompliant type: string kind: description: >- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string name: description: Name is the name of the object that the policy depends on. type: string namespace: description: Namespace is the namespace of the object that the policy depends on (optional). type: string required: - compliance - name type: object type: array ignorePending: description: >- IgnorePending is a boolean parameter to specify whether to ignore the "Pending" status of this template when calculating the overall policy status. The default value is "false" to not ignore a "Pending" status. type: boolean objectDefinition: description: A Kubernetes object defining the policy to apply to a managed cluster type: object x-kubernetes-preserve-unknown-fields: true required: - objectDefinition type: object type: array remediationAction: description: >- RemediationAction specifies the remediation of the policy. The parameter values are "enforce" and "inform". If specified, the value that is defined overrides any remediationAction parameter defined in the child policies in the "policy-templates" section. Important: Not all policy engine kinds support the enforce feature. enum: - Inform - inform - Enforce - enforce type: string required: - disabled - policy-templates type: object status: description: PolicyStatus reports the observed status of the policy resulting from its policy templates. properties: compliant: description: >- ComplianceState reports the observed status resulting from the definitions of this policy. This status field is only used in the replicated policy in the managed cluster namespace. enum: - Compliant - Pending - NonCompliant type: string details: description: >- Details is the list of compliance details for each policy template definition. This status field is only used in the replicated policy in the managed cluster namespace. items: description: >- DetailsPerTemplate reports the current compliance state and list of recent compliance messages for a given policy template. properties: compliant: description: ComplianceState reports the observed status resulting from the definitions of the policy. enum: - Compliant - Pending - NonCompliant type: string history: items: description: ComplianceHistory reports a compliance message from a given time and event. properties: eventName: description: EventName is the name of the event attached to the message. type: string lastTimestamp: description: LastTimestamp is the timestamp of the event that reported the message. format: date-time type: string message: description: Message is the compliance message resulting from evaluating the policy resource. type: string type: object type: array templateMeta: type: object x-kubernetes-preserve-unknown-fields: true type: object type: array placement: description: >- Placement is a list of managed cluster placement resources bound to the policy. This status field is only used in the root policy on the hub cluster. items: description: Placement reports how and what managed cluster placement resources are attached to the policy. properties: decisions: description: Decisions is the list of managed clusters returned by the placement resource for this binding. items: description: PlacementDecision is the cluster name returned by the placement resource. properties: clusterName: type: string clusterNamespace: type: string type: object type: array placement: description: >- Placement is the name of the Placement resource, from the cluster.open-cluster-management.io API group, that is bound to the policy. type: string placementBinding: description: >- PlacementBinding is the name of the PlacementBinding resource, from the policies.open-cluster-management.io API group, that binds the placement resource to the policy. type: string placementRule: description: >- PlacementRule (deprecated) is the name of the PlacementRule resource, from the apps.open-cluster-management.io API group, that is bound to the policy. type: string policySet: description: >- PolicySet is the name of the policy set containing this policy and bound to the placement. If specified, then for this placement the policy is being propagated through this policy set rather than the policy being bound directly to a placement and propagated individually. type: string type: object type: array status: description: >- Status is a list of managed clusters and the current compliance state of each one. This status field is only used in the root policy on the hub cluster. items: description: >- CompliancePerClusterStatus reports the name of a managed cluster and its compliance state for this policy. properties: clustername: type: string clusternamespace: type: string compliant: description: ComplianceState reports the observed status resulting from the definitions of the policy. enum: - Compliant - Pending - NonCompliant type: string type: object type: array type: object required: - metadata - spec type: object served: true storage: true subresources: status: {}

acm/deploy/helm/multicluster-engine-config/charts/policy/crds/policy.open-cluster-management.io_policies.yaml (297 lines of code) (raw):