v1alpha1

type CaptorDeployment struct {
	// Strategy is the technical method to deploy the captor.
	// Currently, only "tetragon" is supported, which is also the default.
	// It requires the Tetragon controller to be installed.
	// +kubebuilder:validation:Enum=tetragon
	// +optional
	// +kubebuilder:default="tetragon"
	Strategy string `json:"strategy,omitempty" yaml:"strategy,omitempty"`
}

type ChangeAnnotation struct {
	// DeceptionPolicyName is the name of the DeceptionPolicy that was applied to the object.
	DeceptionPolicyName string `json:"deceptionPolicyName"`

	// Traps is the list of traps that were added to the object.
	Traps []TrapAnnotation `json:"traps"`
}

type DeceptionPolicy struct {
	metav1.TypeMeta `json:",inline" yaml:",inline"`

	// Standard object's metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"`

	// Spec is the specification of the DeceptionPolicy.
	Spec DeceptionPolicySpec `json:"spec,omitempty" yaml:"spec,omitempty"`

	// Status is the status of the DeceptionPolicy.
	Status DeceptionPolicyStatus `json:"status,omitempty" yaml:"status,omitempty"`
}

type DeceptionPolicyCondition struct {
	// Type of deception policy condition.
	// The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=316
	Type string `json:"type" yaml:"type"`

	// Status of the condition, one of True, False, Unknown.
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=True;False;Unknown
	Status metav1.ConditionStatus `json:"status" yaml:"status"`

	// LastTransitionTime is the last time the condition transitioned from one status to another,
	// i.e., when the underlying condition changed.
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Format=date-time
	LastTransitionTime metav1.Time `json:"lastTransitionTime" yaml:"lastTransitionTime"`

	// Reason indicates the reason for the condition's last transition.
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
	Reason string `json:"reason" yaml:"reason"`

	// Message is a human-readable explanation indicating details about the transition.
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=32768
	Message string `json:"message" yaml:"message"`
}

type DeceptionPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DeceptionPolicy `json:"items"`
}

type DeceptionPolicySpec struct {
	// Traps is a list of traps to be deployed by the deception policy.
	// Each trap represents a cyber deception technique.
	Traps []Trap `json:"traps,omitempty" yaml:"traps,omitempty"`

	// StrictValidation is a flag that indicates whether the policy should be strictly validated.
	// If set to true, the traps will be deployed only if all the traps in the policy are valid.
	// If set to false, the valid traps will be deployed even if some of the traps are invalid.
	// By default, it is set to true.
	// +optional
	// +kubebuilder:default:=true
	StrictValidation *bool `json:"strictValidation,omitempty" yaml:"strictValidation,omitempty"`

	// MutateExisting is a flag to also allow adding traps to existing resources.
	// Typically, that means that existing resource definitions will be updated to include the traps.
	// Depending on the decoy and captor deployment strategies, this may require restarting the pods.
	// +optional
	// +kubebuilder:default=true
	MutateExisting *bool `json:"mutateExisting,omitempty" yaml:"mutateExisting,omitempty"`
}

type DeceptionPolicyStatus struct {
	// Conditions is an array of conditions that the DeceptionPolicy can be in.
	// +listType=map
	// +listMapKey=type
	Conditions []DeceptionPolicyCondition `json:"conditions" yaml:"conditions"`
}

type DecoyDeployment struct {
	// Strategy is the technical method to deploy the trap.
	// +kubebuilder:validation:Enum=volumeMount;containerExec;kyvernoPolicy
	// +optional
	// +kubebuilder:default="volumeMount"
	Strategy string `json:"strategy,omitempty" yaml:"strategy,omitempty"`
}

type FilesystemHoneytoken struct {
	// FilePath is the path of the file to be created.
	FilePath string `json:"filePath" yaml:"filePath"`

	// FileContent is the content of the file to be created.
	// +optional
	// +kubebuilder:default=""
	FileContent string `json:"fileContent" yaml:"fileContent"`

	// ReadOnly is a flag to make the file read-only.
	// +optional
	// +kubebuilder:default=true
	ReadOnly bool `json:"readOnly" yaml:"readOnly"`
}

type FilesystemHoneytokenAnnotation struct {
	// FilePath is the absolute path to the honeytoken file.
	FilePath string `json:"filePath"`

	// FileContentHash is the MD5 hash of the file content.
	FileContentHash string `json:"fileContentHash"`

	// ReadOnly is true if the file is read-only.
	ReadOnly bool `json:"readOnly"`
}

type HttpEndpoint struct {
}

type HttpEndpointAnnotation struct {
}

type HttpPayload struct {
}

type HttpPayloadAnnotation struct {
}

type MatchResources struct {
	// Any is a list of resource filters.
	Any []ResourceFilter `json:"any,omitempty" yaml:"any,omitempty"`
}

type ResourceDescription struct {
	// Namespaces is a list of namespaces names.
	// It does not support wildcards.
	// +optional
	Namespaces []string `json:"namespaces,omitempty" yaml:"namespaces,omitempty"`

	// Selector is a label selector.
	// It does not support wildcards.
	// +optional
	Selector *metav1.LabelSelector `json:"selector,omitempty" yaml:"selector,omitempty"`

	// ContainerSelector is a selector to filter the containers to inject the trap into.
	// +optional
	// +kubebuilder:default="*"
	ContainerSelector string `json:"containerSelector,omitempty" yaml:"containerSelector,omitempty"`
}

type ResourceFilter struct {
	// ResourceDescription contains information about the resource being created or modified.
	ResourceDescription `json:"resources,omitempty" yaml:"resources,omitempty"`
}

type Trap struct {
	// FilesystemHoneytoken is the configuration for a filesystem honeytoken trap.
	// +optional
	FilesystemHoneytoken FilesystemHoneytoken `json:"filesystemHoneytoken,omitempty" yaml:"spec,omitempty"`

	// HttpEndpoint is the configuration for an HTTP endpoint trap.
	// +optional
	HttpEndpoint HttpEndpoint `json:"httpEndpoint,omitempty" yaml:"httpEndpoint,omitempty"`

	// HttpPayload is the configuration for an HTTP payload trap.
	// +optional
	HttpPayload HttpPayload `json:"httpPayload,omitempty" yaml:"httpPayload,omitempty"`

	// DecoyDeployment configures how traps (the entities that are attacked) are going to be deployed.
	// +optional
	DecoyDeployment DecoyDeployment `json:"decoyDeployment,omitempty" yaml:"decoyDeployment,omitempty"`

	// CaptorDeployment configures how captors (the entities that monitor access to the traps) are going to be deployed.
	// +optional
	CaptorDeployment CaptorDeployment `json:"captorDeployment,omitempty" yaml:"captorDeployment,omitempty"`

	// Match define what Kubernetes resources to apply this trap to.
	// Matching criteria are resources labels and/or namespaces.
	// +optional
	MatchResources MatchResources `json:"match,omitempty" yaml:"match,omitempty"`
}

type TrapAnnotation struct {
	// DeploymentStrategy is the strategy to deploy the trap.
	DeploymentStrategy string `json:"deploymentStrategy"`

	// Containers is the list of containers where the trap is deployed.
	// kubebuilder:validation:UniqueItems=true
	Containers []string `json:"containers"`

	// CreatedAt is the time in the current local time when the trap was injected in the pod.
	// +kubebuilder:validation:Format=date-time
	CreatedAt string `json:"createdAt"`

	// UpdatedAt is the time in the current local time when the trap was last updated in the pod.
	// +kubebuilder:validation:Format=date-time
	// +optional
	UpdatedAt string `json:"updatedAt"`

	// FilesystemHoneytoken is the configuration for a filesystem honeytoken trap.
	// +optional
	FilesystemHoneytoken FilesystemHoneytokenAnnotation `json:"filesystemHoneytoken"`

	// HttpEndpoint is the configuration for an HTTP endpoint trap.
	// +optional
	HttpEndpoint HttpEndpointAnnotation `json:"httpEndpoint"`

	// HttpPayload is the configuration for an HTTP payload trap.
	// +optional
	HttpPayload HttpPayloadAnnotation `json:"httpPayload"`
}

type TrapType string