apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: wafs.citrix.com
spec:
  group: citrix.com
  names:
    kind: waf
    plural: wafs
    singular: waf
  scope: Namespaced
  versions:
  - name: v1
    served: true
    storage: true
    subresources:
      status: {}
    additionalPrinterColumns:
    - name: Status
      type: string
      description: "Current Status of the CRD"
      jsonPath: .status.state
    - name: Message
      type: string
      description: "Status Message"
      jsonPath: .status.status_message
    schema:
      openAPIV3Schema:
        type: object
        required: [spec]
        properties:
          status:
            type: object
            properties:
              state:
                 type: string
              status_message:
                 type: string
          spec:
            type: object
            properties:
              ingressclass:
                type: string
                description: "Ingress class, if not specified then all citrix ingress controllers in the cluster will process the resource otherwise only the controller with that ingress class will process this resource"
              servicenames:
                description: 'Name of the services to which the waf policies are applied.'
                type: array
                items:
                  type: string
                  maxLength: 127
              application_type:
                description: 'Type of applications to protect'
                type: array
                items:
                  type: string
                  enum: ['HTML', 'JSON', 'XML']
              signatures:
                description: 'Location of external signature file'
                type: string
              redirect_url:
                description: ''
                type: string
              html_error_object:
                description: 'Location of customized error page to respond when html or common violation are hit'
                type: string
              xml_error_object:
                description: 'Location of customized error page to respond when xml violations are hit'
                type: string
              json_error_object:
                description: 'Location of customized error page to respond when json violations are hit'
                type: string
              ip_reputation:
                type: object
                x-kubernetes-preserve-unknown-fields: true
                description: 'Enabling IP reputation feature'
              target:
                description: 'To control what traffic to be inspected by Web Application Firewall. If you do not provide the target, everything will be inspected by default'
                type: object
                properties:
                  path:
                    type: array
                    description: "List of http urls to inspect"
                    items:
                      type: string
                      description: "URL path"
                  method:
                    type: array
                    description: "List of http methods to inspect"
                    items:
                      type: string
                      enum: ['GET', 'PUT', 'POST','DELETE']
                  header:
                    type: array
                    description: "List of http headers to inspect"
                    items:
                      type: string
                      description: "header name"
              security_checks:
                description: 'To enable/disable application firewall security checks'
                type: object
                properties:
                  common:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  html:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  json:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  xml:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
              settings:
                description: 'To fine tune application firewall security checks default settings'
                type: object
                properties:
                  common:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  html:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  json:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  xml:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
              relaxations:
                description: 'Section which contains relaxation rules for known traffic and false positives'
                type: object
                properties:
                  common:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  html:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  json:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  xml:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
              enforcements:
                description: 'Section which contains enforcement or restriction rules'
                type: object
                properties:
                  common:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  html:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  json:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
                  xml:
                    type: object
                    x-kubernetes-preserve-unknown-fields: true
