apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: compliancescans.compliance.openshift.io
spec:
  group: compliance.openshift.io
  names:
    kind: ComplianceScan
    listKind: ComplianceScanList
    plural: compliancescans
    singular: compliancescan
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.phase
      name: Phase
      type: string
    - jsonPath: .status.result
      name: Result
      type: string
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: ComplianceScan represents a scan with a certain configuration
          that will be applied to objects of a certain entity in the host. These could
          be nodes that apply to a certain nodeSelector, or the cluster itself.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: The spec is the configuration for the compliance scan.
            properties:
              content:
                description: Is the path to the file that contains the content (the
                  data stream). Note that the path needs to be relative to the `/`
                  (root) directory, as it is in the ContentImage
                type: string
              contentImage:
                description: Is the image with the content (Data Stream), that will
                  be used to run OpenSCAP.
                type: string
              debug:
                description: Enable debug logging of workloads and OpenSCAP
                type: boolean
              httpsProxy:
                description: Defines a proxy for the scan to get external resources
                  from. This is useful for disconnected installations with access
                  to a proxy.
                type: string
              noExternalResources:
                description: Defines that no external resources in the Data Stream
                  should be used. External resources could be, for instance, CVE feeds.
                  This is useful for disconnected installations without access to
                  a proxy.
                type: boolean
              nodeSelector:
                additionalProperties:
                  type: string
                description: By setting this, it's possible to only run the scan on
                  certain nodes in the cluster. Note that when applying remediations
                  generated from the scan, this should match the selector of the MachineConfigPool
                  you want to apply the remediations to.
                type: object
              profile:
                description: Is the profile in the data stream to be used. This is
                  the collection of rules that will be checked for.
                type: string
              rawResultStorage:
                description: Specifies settings that pertain to raw result storage.
                properties:
                  pvAccessModes:
                    default:
                    - ReadWriteOnce
                    description: Specifies the access modes that the PersistentVolume
                      will be created with. The persistent volume will hold the raw
                      results of the scan.
                    items:
                      type: string
                    type: array
                  rotation:
                    default: 3
                    description: Specifies the amount of scans for which the raw results
                      will be stored. Older results will get rotated, and it's the
                      responsibility of administrators to store these results elsewhere
                      before rotation happens. Note that a rotation policy of '0'
                      disables rotation entirely. Defaults to 3.
                    type: integer
                  size:
                    default: 1Gi
                    description: Specifies the amount of storage to ask for storing
                      the raw results. Note that if re-scans happen, the new results
                      will also need to be stored. Defaults to 1Gi.
                    type: string
                  storageClassName:
                    description: Specifies the StorageClassName to use when creating
                      the PersistentVolumeClaim to hold the raw results. By default
                      this is null, which will attempt to use the default storage
                      class configured in the cluster. If there is no default class
                      specified then this needs to be set.
                    nullable: true
                    type: string
                type: object
              rule:
                description: A Rule can be specified if the scan should check only
                  for a specific rule. Note that when leaving this empty, the scan
                  will check for all the rules for a specific profile.
                type: string
              scanTolerations:
                default:
                - effect: NoSchedule
                  key: node-role.kubernetes.io/master
                  operator: Exists
                description: Specifies tolerations needed for the scan to run on the
                  nodes. This is useful in case the target set of nodes have custom
                  taints that don't allow certain workloads to run. Defaults to allowing
                  scheduling on the master nodes.
                items:
                  description: The pod this Toleration is attached to tolerates any
                    taint that matches the triple <key,value,effect> using the matching
                    operator <operator>.
                  properties:
                    effect:
                      description: Effect indicates the taint effect to match. Empty
                        means match all taint effects. When specified, allowed values
                        are NoSchedule, PreferNoSchedule and NoExecute.
                      type: string
                    key:
                      description: Key is the taint key that the toleration applies
                        to. Empty means match all taint keys. If the key is empty,
                        operator must be Exists; this combination means to match all
                        values and all keys.
                      type: string
                    operator:
                      description: Operator represents a key's relationship to the
                        value. Valid operators are Exists and Equal. Defaults to Equal.
                        Exists is equivalent to wildcard for value, so that a pod
                        can tolerate all taints of a particular category.
                      type: string
                    tolerationSeconds:
                      description: TolerationSeconds represents the period of time
                        the toleration (which must be of effect NoExecute, otherwise
                        this field is ignored) tolerates the taint. By default, it
                        is not set, which means tolerate the taint forever (do not
                        evict). Zero and negative values will be treated as 0 (evict
                        immediately) by the system.
                      format: int64
                      type: integer
                    value:
                      description: Value is the taint value the toleration matches
                        to. If the operator is Exists, the value should be empty,
                        otherwise just a regular string.
                      type: string
                  type: object
                type: array
              scanType:
                default: Node
                description: The type of Compliance scan.
                type: string
              tailoringConfigMap:
                description: Is a reference to a ConfigMap that contains the tailoring
                  file. It assumes a key called `tailoring.xml` which will have the
                  tailoring contents.
                properties:
                  name:
                    description: Name of the ConfigMap being referenced
                    type: string
                required:
                - name
                type: object
            type: object
          status:
            description: The status will give valuable information on what's going
              on with the scan; and, more importantly, if the scan is successful (compliant)
              or not (non-compliant)
            properties:
              currentIndex:
                description: Specifies the current index of the scan. Given multiple
                  scans, this marks the amount that have been executed.
                format: int64
                type: integer
              errormsg:
                description: If there are issues on the scan, this will be filled
                  up with an error message.
                type: string
              phase:
                description: Is the phase where the scan is at. Normally, one must
                  wait for the scan to reach the phase DONE.
                type: string
              result:
                description: Once the scan reaches the phase DONE, this will contain
                  the result of the scan. Where COMPLIANT means that the scan succeeded;
                  NON-COMPLIANT means that there were rule violations; and ERROR means
                  that the scan couldn't complete due to an issue.
                type: string
              resultsStorage:
                description: Specifies the object that's storing the raw results for
                  the scan.
                properties:
                  apiVersion:
                    description: API version of the referent.
                    type: string
                  kind:
                    description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                    type: string
                  name:
                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                    type: string
                  namespace:
                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                    type: string
                type: object
              warnings:
                description: If there are warnings on the scan, this will be filled
                  up with warning messages.
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
