This is unreleased documentation for Runtime Enforcer 0.9-dev.

CRD API Reference

API Reference

Packages

security.rancher.io/v1alpha1

Package v1alpha1 contains API Schema definitions for the security v1alpha1 API group.

Resource Types

NodeIssue

NodeIssue represents an issue with a node.

Appears In:
Field Description Default Validation

code NodeIssueCode

code is the issue code.

message string

message is a human-readable description of the issue.

NodeIssueCode

Underlying type: string

NodeIssueCode represents the code for a node issue.

Appears In:

Phase

Underlying type: string

Phase represents the current phase of the workload policy. Possible values are: - "Transitioning": the policy is in the process of changing its enforcement mode. - "Failed": the policy deployment has failed. - "Ready": the policy is ready and actively enforced.

Appears In:

ViolationRecord

ViolationRecord holds the details of a single policy violation.

Appears In:
Field Description Default Validation

timestamp Time

timestamp is when the violation occurred.

podName string

podName is the name of the pod where the violation occurred.

containerName string

containerName is the container where the unauthorized executable ran.

executablePath string

executablePath is the path of the unauthorized executable.

nodeName string

nodeName is the node where the violation occurred.

action string

action is the enforcement action taken (monitor or protect).

WorkloadPolicy

WorkloadPolicy is the Schema for the workloadpolicies API.

Appears In:
Field Description Default Validation

apiVersion string

security.rancher.io/v1alpha1

kind string

WorkloadPolicy

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec WorkloadPolicySpec

status WorkloadPolicyStatus

WorkloadPolicyExecutables

Appears In:
Field Description Default Validation

allowed string array

allowed defines a list of executables that are allowed to run

items:Pattern: ^/.*$

WorkloadPolicyList

WorkloadPolicyList contains a list of WorkloadPolicy.

Field Description Default Validation

apiVersion string

security.rancher.io/v1alpha1

kind string

WorkloadPolicyList

metadata ListMeta

Refer to Kubernetes API documentation for fields of metadata.

items WorkloadPolicy array

WorkloadPolicyProposal

WorkloadPolicyProposal is the Schema for the workloadpolicyproposals API.

Appears In:
Field Description Default Validation

apiVersion string

security.rancher.io/v1alpha1

kind string

WorkloadPolicyProposal

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec WorkloadPolicyProposalSpec

WorkloadPolicyProposalList

WorkloadPolicyProposalList contains a list of WorkloadPolicyProposal.

Field Description Default Validation

apiVersion string

security.rancher.io/v1alpha1

kind string

WorkloadPolicyProposalList

metadata ListMeta

Refer to Kubernetes API documentation for fields of metadata.

items WorkloadPolicyProposal array

WorkloadPolicyProposalSpec

WorkloadPolicyProposalSpec defines the desired state of WorkloadPolicyProposal.

Appears In:
Field Description Default Validation

rulesByContainer object (keys:string, values:WorkloadPolicyRules)

rulesByContainer specifies for each container the list of rules to apply.

WorkloadPolicyRules

Appears In:
Field Description Default Validation

executables WorkloadPolicyExecutables

executables defines a security policy for executables.

WorkloadPolicySpec

Appears In:
Field Description Default Validation

mode string

mode defines the execution mode of this policy. Can be set to
either "protect" or "monitor". In "protect" mode, the policy
blocks and reports violations, while in "monitor" mode,
it only reports violations.

Enum: [monitor protect]
Required: \{}

rulesByContainer object (keys:string, values:WorkloadPolicyRules)

rulesByContainer specifies for each container the list of rules to apply.

WorkloadPolicyStatus

Appears In:
Field Description Default Validation

observedGeneration integer

nodesWithIssues object (keys:string, values:NodeIssue)

nodesWithIssues contains the status of each node with issues.

totalNodes integer

totalNodes is the total number of nodes the policy is applied to.

successfulNodes integer

successfulNodes is the number of nodes where the policy is successfully enforced.

failedNodes integer

failedNodes is the number of nodes where the policy enforcement failed.

transitioningNodes integer

transitioningNodes is the number of nodes where the policy is transitioning mode.

nodesTransitioning string array

nodesTransitioning contains the names of the nodes that are transitioning.

phase Phase

phase indicates the current phase of the workload policy.

violationCount integer

violationCount is the total number of violation records,
including those no longer retained in violations.

Note: This value is maintained by the reconciler and reflects
its best-effort view of the system. It is not guaranteed to be
strongly consistent and may be temporarily outdated depending on
reconciliation.

violations ViolationRecord array

violations is the list of the most recent violation records (max MaxViolationRecords).
Oldest entries are dropped when the limit is reached.