policy_spec.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://github.com/enterprise-contract/enterprise-contract-controller/api/v1alpha1/enterprise-contract-policy-spec",
  "$ref": "#/$defs/EnterpriseContractPolicySpec",
  "$defs": {
    "EnterpriseContractPolicyConfiguration": {
      "properties": {
        "exclude": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "Exclude set of policy exclusions that, in case of failure, do not block\nthe success of the outcome.\n+optional\n+listType:=set"
        },
        "include": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "Include set of policy inclusions that are added to the policy evaluation.\nThese override excluded rules.\n+optional\n+listType:=set"
        },
        "collections": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "Collections set of predefined rules.  DEPRECATED: Collections can be listed in include\nwith the \"@\" prefix.\n+optional\n+listType:=set"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "EnterpriseContractPolicyConfiguration configuration of modifications to policy evaluation."
    },
    "EnterpriseContractPolicySpec": {
      "properties": {
        "name": {
          "type": "string",
          "description": "Optional name of the policy\n+optional"
        },
        "description": {
          "type": "string",
          "description": "Description of the policy or its intended use\n+optional"
        },
        "sources": {
          "items": {
            "$ref": "#/$defs/Source"
          },
          "type": "array",
          "description": "One or more groups of policy rules\n+kubebuilder:validation:MinItems:=1"
        },
        "configuration": {
          "$ref": "#/$defs/EnterpriseContractPolicyConfiguration",
          "description": "Configuration handles policy modification configuration (exclusions and inclusions)\n+optional"
        },
        "rekorUrl": {
          "type": "string",
          "description": "URL of the Rekor instance. Empty string disables Rekor integration\n+optional"
        },
        "publicKey": {
          "type": "string",
          "description": "Public key used to validate the signature of images and attestations\n+optional"
        },
        "identity": {
          "$ref": "#/$defs/Identity",
          "description": "Identity to be used for keyless verification. This is an experimental feature.\n+optional"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "EnterpriseContractPolicySpec is used to configure the Enterprise Contract Policy"
    },
    "Identity": {
      "properties": {
        "subject": {
          "type": "string",
          "description": "Subject is the URL of the certificate identity for keyless verification.\n+optional"
        },
        "subjectRegExp": {
          "type": "string",
          "description": "SubjectRegExp is a regular expression to match the URL of the certificate identity for\nkeyless verification.\n+optional"
        },
        "issuer": {
          "type": "string",
          "description": "Issuer is the URL of the certificate OIDC issuer for keyless verification.\n+optional"
        },
        "issuerRegExp": {
          "type": "string",
          "description": "IssuerRegExp is a regular expression to match the URL of the certificate OIDC issuer for\nkeyless verification.\n+optional"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Identity defines the allowed identity for keyless signing."
    },
    "JSON": {
      "properties": {},
      "additionalProperties": true,
      "type": "object"
    },
    "Source": {
      "properties": {
        "name": {
          "type": "string",
          "description": "Optional name for the source\n+optional"
        },
        "policy": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "List of go-getter style policy source urls\n+kubebuilder:validation:MinItems:=1"
        },
        "data": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "List of go-getter style policy data source urls\n+optional"
        },
        "ruleData": {
          "$ref": "#/$defs/JSON",
          "description": "Arbitrary rule data that will be visible to policy rules\n+optional\n+kubebuilder:validation:Type:=object"
        },
        "config": {
          "$ref": "#/$defs/SourceConfig",
          "description": "Config specifies which policy rules are included, or excluded, from the\nprovided policy source urls.\n+optional\n+kubebuilder:validation:Type:=object"
        },
        "volatileConfig": {
          "$ref": "#/$defs/VolatileSourceConfig",
          "description": "Specifies volatile configuration that can include or exclude policy rules\nbased on effective time.\n+optional\n+kubebuilder:validation:Type:=object"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Source defines policies and data that are evaluated together"
    },
    "SourceConfig": {
      "properties": {
        "exclude": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "Exclude is a set of policy exclusions that, in case of failure, do not block\nthe success of the outcome.\n+optional\n+listType:=set"
        },
        "include": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "description": "Include is a set of policy inclusions that are added to the policy evaluation.\nThese take precedence over policy exclusions.\n+optional\n+listType:=set"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "SourceConfig specifies config options for a policy source."
    },
    "VolatileCriteria": {
      "properties": {
        "value": {
          "type": "string"
        },
        "effectiveOn": {
          "type": "string",
          "description": "+optional\n+kubebuilder:validation:Format:=date-time"
        },
        "effectiveUntil": {
          "type": "string",
          "description": "+optional\n+kubebuilder:validation:Format:=date-time"
        },
        "imageRef": {
          "type": "string",
          "description": "DEPRECATED: Use ImageDigest instead\nImageRef is used to specify an image by its digest.\n+optional\n+kubebuilder:validation:Pattern=`^sha256:[a-fA-F0-9]{64}$`"
        },
        "imageDigest": {
          "type": "string",
          "description": "ImageDigest is used to specify an image by its digest.\n+optional\n+kubebuilder:validation:Pattern=`^sha256:[a-fA-F0-9]{64}$`"
        },
        "imageUrl": {
          "type": "string",
          "description": "ImageUrl is used to specify an image by its URL without a tag.\n+optional\n+kubebuilder:validation:Pattern=`^[a-z0-9][a-z0-9.-]*[a-z0-9](?:\\/[a-z0-9][a-z0-9-]*[a-z0-9]){2,}$`"
        },
        "reference": {
          "type": "string",
          "description": "Reference is used to include a link to related information such as a Jira issue URL.\n+optional"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "value"
      ],
      "description": "VolatileCriteria includes or excludes a policy rule with effective dates as an option."
    },
    "VolatileSourceConfig": {
      "properties": {
        "exclude": {
          "items": {
            "$ref": "#/$defs/VolatileCriteria"
          },
          "type": "array",
          "description": "Exclude is a set of policy exclusions that, in case of failure, do not block\nthe success of the outcome.\n+optional"
        },
        "include": {
          "items": {
            "$ref": "#/$defs/VolatileCriteria"
          },
          "type": "array",
          "description": "Include is a set of policy inclusions that are added to the policy evaluation.\nThese take precedence over policy exclusions.\n+optional"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "VolatileSourceConfig specifies volatile configuration for a policy source."
    }
  }
}