# Copyright 2022 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: clusterimagepolicies.policy.sigstore.dev
spec:
  group: policy.sigstore.dev
  names:
    kind: ClusterImagePolicy
    plural: clusterimagepolicies
    singular: clusterimagepolicy
    categories:
      - all
      - sigstore
    shortNames:
      - cip
  scope: Cluster
  versions:
    - name: v1alpha1
      served: true
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              description: Spec holds the desired state of the ClusterImagePolicy (from the client).
              type: object
              properties:
                authorities:
                  type: array
                  items:
                    type: object
                    properties:
                      attestations:
                        type: array
                        items:
                          type: object
                          properties:
                            name:
                              description: Name of the attestation. These can then be referenced at the CIP level policy.
                              type: string
                            policy:
                              type: object
                              properties:
                                configMapRef:
                                  type: object
                                  properties:
                                    name:
                                      description: Name is unique within a namespace to reference a configmap resource.
                                      type: string
                                    namespace:
                                      description: Namespace defines the space within which the configmap name must be unique.
                                      type: string
                                data:
                                  type: string
                                type:
                                  description: Which kind of policy this is, currently only rego or cue are supported. Furthermore, only cue is tested :)
                                  type: string
                                url:
                                  type: string
                            predicateType:
                              description: Which predicate type to verify. Matches cosign verify-attestation options.
                              type: string
                      ctlog:
                        type: object
                        properties:
                          url:
                            type: string
                      key:
                        type: object
                        properties:
                          data:
                            description: Data contains the inline public key
                            type: string
                          kms:
                            description: KMS contains the KMS url of the public key Supported formats differ based on the KMS system used.
                            type: string
                          secretRef:
                            type: object
                            properties:
                              name:
                                description: Name is unique within a namespace to reference a secret resource.
                                type: string
                              namespace:
                                description: Namespace defines the space within which the secret name must be unique.
                                type: string
                      keyless:
                        type: object
                        properties:
                          ca-cert:
                            type: object
                            properties:
                              data:
                                description: Data contains the inline public key
                                type: string
                              kms:
                                description: KMS contains the KMS url of the public key Supported formats differ based on the KMS system used.
                                type: string
                              secretRef:
                                type: object
                                properties:
                                  name:
                                    description: Name is unique within a namespace to reference a secret resource.
                                    type: string
                                  namespace:
                                    description: Namespace defines the space within which the secret name must be unique.
                                    type: string
                          identities:
                            type: array
                            items:
                              type: object
                              properties:
                                issuer:
                                  type: string
                                issuerRegExp:
                                  type: string
                                subject:
                                  type: string
                                subjectRegExp:
                                  type: string
                          url:
                            type: string
                      name:
                        description: Name is the name for this authority. Used by the CIP Policy validator to be able to reference matching signature or attestation verifications. If not specified, the name will be authority-<index in array>
                        type: string
                      source:
                        type: array
                        items:
                          type: object
                          properties:
                            oci:
                              type: string
                            signaturePullSecrets:
                              description: SignaturePullSecrets is an optional list of references to secrets in the same namespace as the deploying resource for pulling any of the signatures used by this Source.
                              type: array
                              items:
                                type: object
                                properties:
                                  name:
                                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                    type: string
                images:
                  type: array
                  items:
                    type: object
                    properties:
                      glob:
                        type: string
                policy:
                  description: Policy is an optional policy that can be applied against all the successfully validated Authorities. If no authorities pass, this does not even get evaluated, as the Policy is considered failed.
                  type: object
                  properties:
                    configMapRef:
                      type: object
                      properties:
                        name:
                          description: Name is unique within a namespace to reference a configmap resource.
                          type: string
                        namespace:
                          description: Namespace defines the space within which the configmap name must be unique.
                          type: string
                    data:
                      type: string
                    type:
                      description: Which kind of policy this is, currently only rego or cue are supported. Furthermore, only cue is tested :)
                      type: string
                    url:
                      type: string
    - name: v1beta1
      served: true
      storage: false
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              description: Spec holds the desired state of the ClusterImagePolicy (from the client).
              type: object
              properties:
                authorities:
                  type: array
                  items:
                    type: object
                    properties:
                      attestations:
                        type: array
                        items:
                          type: object
                          properties:
                            name:
                              description: Name of the attestation. These can then be referenced at the CIP level policy.
                              type: string
                            policy:
                              type: object
                              properties:
                                configMapRef:
                                  type: object
                                  properties:
                                    name:
                                      description: Name is unique within a namespace to reference a configmap resource.
                                      type: string
                                    namespace:
                                      description: Namespace defines the space within which the configmap name must be unique.
                                      type: string
                                data:
                                  type: string
                                type:
                                  description: Which kind of policy this is, currently only rego or cue are supported. Furthermore, only cue is tested :)
                                  type: string
                                url:
                                  type: string
                            predicateType:
                              description: Which predicate type to verify. Matches cosign verify-attestation options.
                              type: string
                      ctlog:
                        type: object
                        properties:
                          url:
                            type: string
                      key:
                        type: object
                        properties:
                          data:
                            description: Data contains the inline public key
                            type: string
                          kms:
                            description: KMS contains the KMS url of the public key
                            type: string
                          secretRef:
                            type: object
                            properties:
                              name:
                                description: Name is unique within a namespace to reference a secret resource.
                                type: string
                              namespace:
                                description: Namespace defines the space within which the secret name must be unique.
                                type: string
                      keyless:
                        type: object
                        properties:
                          ca-cert:
                            type: object
                            properties:
                              data:
                                description: Data contains the inline public key
                                type: string
                              kms:
                                description: KMS contains the KMS url of the public key
                                type: string
                              secretRef:
                                type: object
                                properties:
                                  name:
                                    description: Name is unique within a namespace to reference a secret resource.
                                    type: string
                                  namespace:
                                    description: Namespace defines the space within which the secret name must be unique.
                                    type: string
                          identities:
                            type: array
                            items:
                              type: object
                              properties:
                                issuer:
                                  type: string
                                issuerRegExp:
                                  type: string
                                subject:
                                  type: string
                                subjectRegExp:
                                  type: string
                          url:
                            type: string
                      name:
                        description: Name is the name for this authority. Used by the CIP Policy validator to be able to reference matching signature or attestation verifications. If not specified, the name will be authority-<index in array>
                        type: string
                      source:
                        type: array
                        items:
                          type: object
                          properties:
                            oci:
                              type: string
                            signaturePullSecrets:
                              description: SignaturePullSecrets is an optional list of references to secrets in the same namespace as the deploying resource for pulling any of the signatures used by this Source.
                              type: array
                              items:
                                type: object
                                properties:
                                  name:
                                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                    type: string
                images:
                  type: array
                  items:
                    type: object
                    properties:
                      glob:
                        type: string
                policy:
                  description: Policy is an optional policy that can be applied against all the successfully validated Authorities. If no authorities pass, this does not even get evaluated, as the Policy is considered failed.
                  type: object
                  properties:
                    configMapRef:
                      type: object
                      properties:
                        name:
                          description: Name is unique within a namespace to reference a configmap resource.
                          type: string
                        namespace:
                          description: Namespace defines the space within which the configmap name must be unique.
                          type: string
                    data:
                      type: string
                    type:
                      description: Which kind of policy this is, currently only rego or cue are supported. Furthermore, only cue is tested :)
                      type: string
                    url:
                      type: string
