apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: compliancesuites.compliance.openshift.io
spec:
  group: compliance.openshift.io
  names:
    kind: ComplianceSuite
    listKind: ComplianceSuiteList
    plural: compliancesuites
    singular: compliancesuite
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.phase
      name: Phase
      type: string
    - jsonPath: .status.result
      name: Result
      type: string
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: ComplianceSuite represents a set of scans that will be applied
          to the cluster. These should help deployers achieve a certain compliance
          target.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Contains the definition of the suite
            properties:
              autoApplyRemediations:
                description: Defines whether or not the remediations should be applied
                  automatically
                type: boolean
              scans:
                description: Contains a list of the scans to execute on the cluster
                items:
                  description: ComplianceScanSpecWrapper provides a ComplianceScanSpec
                    and a Name
                  properties:
                    content:
                      description: Is the path to the file that contains the content
                        (the data stream). Note that the path needs to be relative
                        to the `/` (root) directory, as it is in the ContentImage
                      type: string
                    contentImage:
                      description: Is the image with the content (Data Stream), that
                        will be used to run OpenSCAP.
                      type: string
                    debug:
                      description: Enable debug logging of workloads and OpenSCAP
                      type: boolean
                    httpsProxy:
                      description: Defines a proxy for the scan to get external resources
                        from. This is useful for disconnected installations with access
                        to a proxy.
                      type: string
                    name:
                      description: Contains a human readable name for the scan. This
                        is to identify the objects that it creates.
                      type: string
                    noExternalResources:
                      description: Defines that no external resources in the Data
                        Stream should be used. External resources could be, for instance,
                        CVE feeds. This is useful for disconnected installations without
                        access to a proxy.
                      type: boolean
                    nodeSelector:
                      additionalProperties:
                        type: string
                      description: By setting this, it's possible to only run the
                        scan on certain nodes in the cluster. Note that when applying
                        remediations generated from the scan, this should match the
                        selector of the MachineConfigPool you want to apply the remediations
                        to.
                      type: object
                    profile:
                      description: Is the profile in the data stream to be used. This
                        is the collection of rules that will be checked for.
                      type: string
                    rawResultStorage:
                      description: Specifies settings that pertain to raw result storage.
                      properties:
                        pvAccessModes:
                          default:
                          - ReadWriteOnce
                          description: Specifies the access modes that the PersistentVolume
                            will be created with. The persistent volume will hold
                            the raw results of the scan.
                          items:
                            type: string
                          type: array
                        rotation:
                          default: 3
                          description: Specifies the amount of scans for which the
                            raw results will be stored. Older results will get rotated,
                            and it's the responsibility of administrators to store
                            these results elsewhere before rotation happens. Note
                            that a rotation policy of '0' disables rotation entirely.
                            Defaults to 3.
                          type: integer
                        size:
                          default: 1Gi
                          description: Specifies the amount of storage to ask for
                            storing the raw results. Note that if re-scans happen,
                            the new results will also need to be stored. Defaults
                            to 1Gi.
                          type: string
                        storageClassName:
                          description: Specifies the StorageClassName to use when
                            creating the PersistentVolumeClaim to hold the raw results.
                            By default this is null, which will attempt to use the
                            default storage class configured in the cluster. If there
                            is no default class specified then this needs to be set.
                          nullable: true
                          type: string
                      type: object
                    rule:
                      description: A Rule can be specified if the scan should check
                        only for a specific rule. Note that when leaving this empty,
                        the scan will check for all the rules for a specific profile.
                      type: string
                    scanTolerations:
                      default:
                      - effect: NoSchedule
                        key: node-role.kubernetes.io/master
                        operator: Exists
                      description: Specifies tolerations needed for the scan to run
                        on the nodes. This is useful in case the target set of nodes
                        have custom taints that don't allow certain workloads to run.
                        Defaults to allowing scheduling on the master nodes.
                      items:
                        description: The pod this Toleration is attached to tolerates
                          any taint that matches the triple <key,value,effect> using
                          the matching operator <operator>.
                        properties:
                          effect:
                            description: Effect indicates the taint effect to match.
                              Empty means match all taint effects. When specified,
                              allowed values are NoSchedule, PreferNoSchedule and
                              NoExecute.
                            type: string
                          key:
                            description: Key is the taint key that the toleration
                              applies to. Empty means match all taint keys. If the
                              key is empty, operator must be Exists; this combination
                              means to match all values and all keys.
                            type: string
                          operator:
                            description: Operator represents a key's relationship
                              to the value. Valid operators are Exists and Equal.
                              Defaults to Equal. Exists is equivalent to wildcard
                              for value, so that a pod can tolerate all taints of
                              a particular category.
                            type: string
                          tolerationSeconds:
                            description: TolerationSeconds represents the period of
                              time the toleration (which must be of effect NoExecute,
                              otherwise this field is ignored) tolerates the taint.
                              By default, it is not set, which means tolerate the
                              taint forever (do not evict). Zero and negative values
                              will be treated as 0 (evict immediately) by the system.
                            format: int64
                            type: integer
                          value:
                            description: Value is the taint value the toleration matches
                              to. If the operator is Exists, the value should be empty,
                              otherwise just a regular string.
                            type: string
                        type: object
                      type: array
                    scanType:
                      default: Node
                      description: The type of Compliance scan.
                      type: string
                    tailoringConfigMap:
                      description: Is a reference to a ConfigMap that contains the
                        tailoring file. It assumes a key called `tailoring.xml` which
                        will have the tailoring contents.
                      properties:
                        name:
                          description: Name of the ConfigMap being referenced
                          type: string
                      required:
                      - name
                      type: object
                  type: object
                type: array
                x-kubernetes-list-type: atomic
              schedule:
                description: Defines a schedule for the scans to run. This is in cronjob
                  format. Note the scan will still be triggered immediately, and the
                  scheduled scans will start running only after the initial results
                  are ready.
                type: string
            required:
            - scans
            type: object
          status:
            description: Contains the current state of the suite
            properties:
              errorMessage:
                type: string
              phase:
                description: Represents the status of the compliance scan run.
                type: string
              result:
                description: Represents the result of the compliance scan
                type: string
              scanStatuses:
                items:
                  description: ComplianceScanStatusWrapper provides a ComplianceScanStatus
                    and a Name
                  properties:
                    currentIndex:
                      description: Specifies the current index of the scan. Given
                        multiple scans, this marks the amount that have been executed.
                      format: int64
                      type: integer
                    errormsg:
                      description: If there are issues on the scan, this will be filled
                        up with an error message.
                      type: string
                    name:
                      description: Contains a human readable name for the scan. This
                        is to identify the objects that it creates.
                      type: string
                    phase:
                      description: Is the phase where the scan is at. Normally, one
                        must wait for the scan to reach the phase DONE.
                      type: string
                    result:
                      description: Once the scan reaches the phase DONE, this will
                        contain the result of the scan. Where COMPLIANT means that
                        the scan succeeded; NON-COMPLIANT means that there were rule
                        violations; and ERROR means that the scan couldn't complete
                        due to an issue.
                      type: string
                    resultsStorage:
                      description: Specifies the object that's storing the raw results
                        for the scan.
                      properties:
                        apiVersion:
                          description: API version of the referent.
                          type: string
                        kind:
                          description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
                          type: string
                        name:
                          description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                          type: string
                        namespace:
                          description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                          type: string
                      type: object
                    warnings:
                      description: If there are warnings on the scan, this will be
                        filled up with warning messages.
                      type: string
                  type: object
                type: array
                x-kubernetes-list-type: atomic
            required:
            - scanStatuses
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
