swagger: '2.0'
info:
  description: Secure Docker and Kubernetes based container deployments with the NeuVector run-time security solution.
  version: 5.6.0
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  title: NeuVector Admission API
  contact:
    email: support@neuvector.com
schemes:
- https
tags:
- name: Admission
  description: Admission Control
paths:
  /v1/admission/options:
    get:
      tags:
      - Admission
      summary: Get a list of admission options
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTAdmissionConfigData'
  /v1/admission/rule/{id}:
    get:
      tags:
      - Admission
      summary: Show an admission rule
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      parameters:
      - in: path
        name: id
        description: Rule ID
        required: true
        type: string
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTAdmissionRuleData'
    delete:
      tags:
      - Admission
      summary: Delete an admission rule
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      parameters:
      - in: path
        name: id
        description: Rule ID
        required: true
        type: string
      responses:
        '200':
          description: Success
  /v1/admission/rule:
    post:
      tags:
      - Admission
      summary: Add admission control rule
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: body
        name: body
        description: Admission rule data
        required: true
        schema:
          $ref: '#/definitions/RESTAdmissionRuleConfigData'
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTAdmissionRuleData'
    patch:
      tags:
      - Admission
      summary: Update admission rule
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: body
        name: body
        description: Admission rule data
        required: true
        schema:
          $ref: '#/definitions/RESTAdmissionRuleConfigData'
      responses:
        '200':
          description: Success
  /v1/admission/rule/promote:
    post:
      tags:
      - Admission
      summary: Promote admission control rule
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: body
        name: body
        description: Admission control rule data
        required: true
        schema:
          $ref: '#/definitions/RESTAdmCtrlPromoteRequestData'
      responses:
        '200':
          description: Success
  /v1/admission/rules:
    get:
      tags:
      - Admission
      summary: Get a list of admission rules
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      parameters:
      - in: query
        name: scope
        type: string
        required: false
        enum:
        - fed
        - local
        description: When set to fed, returned fed admission rules. When set to local, returned local admission rules. If there is no query string 'scope', all admission rules will be returned.
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTAdmissionRulesData'
    delete:
      tags:
      - Admission
      summary: Delete all admission rules
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      parameters:
      - in: query
        name: scope
        type: string
        required: false
        enum:
        - fed
        - local
        description: When set to fed, fed admission rules get removed. When set to local or no query string, local admission rules will be removed.
      responses:
        '200':
          description: Success
  /v1/admission/state:
    get:
      tags:
      - Admission
      summary: Get admission state
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTAdmissionConfigData'
        '404':
          description: Operation not allowed
          schema:
            $ref: '#/definitions/RESTError'
    patch:
      tags:
      - Admission
      summary: Update admission state
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - application/json
      parameters:
      - in: body
        name: body
        description: Admission config state data
        required: true
        schema:
          $ref: '#/definitions/RESTAdmissionConfigData'
      responses:
        '200':
          description: Success
        '404':
          description: Operation not allowed
          schema:
            $ref: '#/definitions/RESTError'
  /v1/admission/stats:
    get:
      tags:
      - Admission
      summary: Get admission control statistics
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      produces:
      - application/json
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTAdmissionStatsData'
  /v1/assess/admission/rule:
    post:
      tags:
      - Admission
      description: Testing admission control rules. The payload body is the content of a resource yaml file.
      summary: Test admission control rules
      security:
      - ApiKeyAuth: []
      - TokenAuth: []
      consumes:
      - text/plain; charset=utf-8
      parameters:
      - in: body
        name: body
        description: Resource yaml file
        required: true
        schema:
          type: string
          example: "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: nginx-deployment\n  labels:\n    app: nginx\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: nginx\n  template:\n    metadata:\n      labels:\n        app: nginx\n    spec:\n      containers:\n        - name: nginx\n          image: nginx:latest\n          ports:\n            - containerPort: 80\n"
      responses:
        '200':
          description: Success
          schema:
            $ref: '#/definitions/RESTAdmCtrlRulesTestResults'
definitions:
  RESTAdmRuleOptions:
    type: object
    required:
    - rule_options
    properties:
      rule_options:
        type: object
        properties:
          rule:
            type: string
            example: criterion_name
          options:
            $ref: '#/definitions/RESTAdmissionRuleOption'
  RESTAdmissionStats:
    type: object
    required:
    - k8s_allowed_requests
    - k8s_denied_requests
    - k8s_erroneous_requests
    - k8s_ignored_requests
    - jenkins_allowed_requests
    - jenkins_denied_requests
    - jenkins_erroneous_requests
    properties:
      k8s_allowed_requests:
        type: integer
        format: int64
        example: 2
      k8s_denied_requests:
        type: integer
        format: int64
        example: 1
      k8s_erroneous_requests:
        type: integer
        format: int64
        example: 1
      k8s_ignored_requests:
        type: integer
        format: int64
        example: 1
      jenkins_allowed_requests:
        type: integer
        format: int64
        example: 3
      jenkins_denied_requests:
        type: integer
        format: int64
        example: 1
      jenkins_erroneous_requests:
        type: integer
        format: int64
        example: 1
  RESTAdmissionConfigData:
    type: object
    required:
    - k8s_env
    properties:
      state:
        $ref: '#/definitions/RESTAdmissionState'
      admission_options:
        $ref: '#/definitions/RESTAdmRuleTypeOptions'
      k8s_env:
        type: boolean
        example: false
      admission_custom_criteria_options:
        $ref: '#/definitions/RESTAdminCustomCriteriaOptions'
      admission_custom_criteria_templates:
        $ref: '#/definitions/RESTAdminCriteriaTemplate'
      predefined_risky_roles:
        type: array
        items:
          type: string
        example:
        - risky_role_view_secret
        - risky_role_create_pod
  RESTAdmCtrlRulesTestResults:
    type: object
    properties:
      props_unavailable:
        type: array
        items:
          type: string
        example:
        - user
        - userGroups
      global_mode:
        type: string
        enum:
        - monitor
        - protect
        - ''
      results:
        type: array
        items:
          $ref: '#/definitions/RESTAdmCtrlRulesTestResult'
  RESTAdminCriteriaTemplate:
    type: object
    required:
    - kind
    - rawjson
    properties:
      kind:
        type: string
        example: podTemplate
      rawjson:
        type: string
        example: '{"key": "value"}'
  RESTPwdProfileBasic:
    type: object
    required:
    - min_len
    - min_uppercase_count
    - min_lowercase_count
    - min_digit_count
    - min_special_count
    properties:
      min_len:
        type: integer
        example: 6
      min_uppercase_count:
        type: integer
        example: 0
      min_lowercase_count:
        type: integer
        example: 0
      min_digit_count:
        type: integer
        example: 0
      min_special_count:
        type: integer
        example: 0
  RESTAdmissionStatsData:
    type: object
    required:
    - stats
    properties:
      stats:
        $ref: '#/definitions/RESTAdmissionStats'
  RESTAdmissionRuleOption:
    type: object
    required:
    - name
    - ops
    properties:
      name:
        type: string
        example: group
      ops:
        type: array
        items:
          type: string
        example:
        - containsAny
        - containsAll
        - '='
      values:
        type: array
        items:
          type: string
        example:
        - ''
        - 'true'
        - 'false'
      match_src:
        type: string
        example: yaml
      sub_options:
        type: object
        properties:
          rule:
            type: string
            example: criterion_name
          options:
            $ref: '#/definitions/RESTAdmissionRuleOption'
  RESTAdmissionRulesData:
    type: object
    required:
    - rules
    properties:
      rules:
        type: array
        items:
          $ref: '#/definitions/RESTAdmissionRule'
  RESTImportTaskData:
    type: object
    required:
    - data
    properties:
      data:
        $ref: '#/definitions/RESTImportTask'
  RESTAdmCtrlTestRuleInfo:
    type: object
    required:
    - container_image
    - id
    - disabled
    - type
    - mode
    - rule_details
    - rule_cfg_type
    properties:
      container_image:
        type: string
        description: the tested container image in the pod
      id:
        type: integer
        format: uint32
        example: 10001
      disabled:
        type: boolean
        example: false
      type:
        type: string
        enum:
        - allow
        - deny
      mode:
        type: string
        description: per-rule mode
        enum:
        - monitor
        - protect
        - ''
      rule_details:
        type: string
        example: 'It matches deny rule id 1000 with criteria: (allow privilege escalation = true)'
      rule_cfg_type:
        type: string
        enum:
        - federal
        - ground
        - user_created
  RESTImportTask:
    type: object
    required:
    - tid
    - ctrler_id
    - percentage
    properties:
      tid:
        type: string
        example: c5af897b62a258212ece91c0551d3a4a
      ctrler_id:
        type: string
        example: 6e60452b244b90456f3450c9fed0a50f57f4b849dcb74a5fad289e8116f32f36
      last_update_time:
        type: string
        format: date-time
        example: '2022-03-17T17:31:55.832768041Z'
      percentage:
        type: integer
        example: 100
      triggered_by:
        type: string
        example: admin
      status:
        type: string
        example: done
      temp_token:
        type: string
        example: ''
      fail_to_decrypt_key_fields:
        type: object
        description: Object key is kv key and value is array of cloaked fields that cannot be decrypted
        additionalProperties:
          type: array
          items:
            type: string
          example:
          - x509_cert
          - signing_cert
  RESTAdmRuleTypeOptions:
    type: object
    required:
    - deny_options
    - exception_options
    properties:
      deny_options:
        $ref: '#/definitions/RESTAdmCatOptions'
      exception_options:
        $ref: '#/definitions/RESTAdmCatOptions'
      psp_collection:
        type: array
        items:
          $ref: '#/definitions/RESTAdmRuleCriterion'
      pss_collections:
        type: object
        description: map key is domain(string type)
        additionalProperties:
          type: array
          items:
            type: string
        example:
          restricted:
          - Uses illegal volume type.
          - Allows running as root user.
          baseline:
          - Sets HostNetwork, HostPID, or HostIPC to true.
          - Allows privileged container(s).
      sigstore_verifiers:
        type: array
        items:
          type: string
        example:
        - public/verifier1
        - private1/verifier1
        - private1/verifier2
  RESTAdmCatOptions:
    type: object
    properties:
      k8s_options:
        $ref: '#/definitions/RESTAdmRuleOptions'
  RESTAdminCustomCriteriaOptions:
    type: object
    required:
    - ops
    - valuetype
    properties:
      ops:
        type: array
        items:
          type: string
        example:
        - exist
        - notExist
      values:
        type: array
        items:
          type: string
        example:
        - 'true'
        - 'false'
      valuetype:
        type: string
        example: key
  RESTAdmRuleCriterion:
    type: object
    required:
    - name
    - op
    - value
    properties:
      name:
        type: string
        example: namespace
      op:
        type: string
        example: '='
      value:
        type: string
        example: kube-system
      sub_criteria:
        type: array
        items:
          $ref: '#/definitions/RESTAdmRuleCriterion'
      type:
        type: string
        example: customPath
      template_kind:
        type: string
        example: podTemplate
      path:
        type: string
        example: item.spec.serviceAccountName
      value_type:
        type: string
        example: string
  RESTAdmCtrlPromoteRequestData:
    type: object
    required:
    - request
    properties:
      request:
        $ref: '#/definitions/RESTAdmCtrlPromoteRequest'
  RESTAdmissionRuleConfigData:
    type: object
    required:
    - config
    properties:
      config:
        $ref: '#/definitions/RESTAdmissionRuleConfig'
  RESTAdmCtrlPromoteRequest:
    type: object
    required:
    - ids
    properties:
      ids:
        type: array
        items:
          type: integer
          format: uint32
          example: 12
  RESTAdmCtrlRulesTestResult:
    type: object
    required:
    - index
    - name
    - kind
    - message
    - matched_rules
    - allowed
    properties:
      index:
        type: integer
        example: 1
      name:
        type: string
        example: iperfserver
      kind:
        type: string
        example: Deployment
      message:
        type: string
        example: '<Assessment> Creation of Kubernetes Deployment is allowed [Notice: the requested image(s) are not scanned: quay.io/nvlab/iperf].'
      matched_rules:
        type: array
        items:
          $ref: '#/definitions/RESTAdmCtrlTestRuleInfo'
      allowed:
        type: boolean
        example: false
  RESTAdmissionState:
    type: object
    properties:
      enable:
        type: boolean
        example: true
      mode:
        type: string
        example: Protect
      default_action:
        type: string
        example: allow
      adm_client_mode:
        type: string
        example: service
      adm_svc_type:
        type: string
        example: ''
      adm_client_mode_options:
        type: object
        properties:
          service:
            type: string
            example: service
          url:
            type: string
            example: service:xyz-svc-admission-webhook.xyz.svc
      ctrl_states:
        type: object
        properties:
          validate:
            type: string
            example: validate
          states:
            type: boolean
            example: true
  RESTError:
    type: object
    required:
    - code
    - error
    - message
    properties:
      code:
        type: integer
        example: 3
      error:
        type: string
        example: Request failed
      message:
        type: string
        example: Invalid format
      password_profile_basic:
        $ref: '#/definitions/RESTPwdProfileBasic'
      import_task_data:
        $ref: '#/definitions/RESTImportTaskData'
  RESTAdmissionRuleConfig:
    type: object
    required:
    - id
    - category
    - cfg_type
    - rule_type
    - containers
    properties:
      id:
        type: integer
        format: uint32
        example: 1
      category:
        type: string
        example: Kubernetes
      comment:
        type: string
        example: comment
      criteria:
        type: array
        items:
          $ref: '#/definitions/RESTAdmRuleCriterion'
      disable:
        type: boolean
        example: true
      actions:
        type: array
        items:
          type: string
          example: ''
      cfg_type:
        type: string
        enum:
        - user_created
        - ground
        - federal
      rule_type:
        type: string
        enum:
        - exception
        - deny
      rule_mode:
        type: string
        enum:
        - ''
        - monitor
        - protect
      containers:
        type: array
        items:
          type: string
          enum:
          - containers
          - init_containers
          - ephemeral_containers
  RESTAdmissionRule:
    type: object
    required:
    - id
    - category
    - comment
    - criteria
    - disable
    - critical
    - cfg_type
    - rule_type
    - rule_mode
    - containers
    properties:
      id:
        type: integer
        format: uint32
        example: 2
      category:
        type: string
        example: Kubernetes
      comment:
        type: string
        example: Do not delete this exception rule
      criteria:
        type: array
        items:
          $ref: '#/definitions/RESTAdmRuleCriterion'
      disable:
        type: boolean
        example: false
      critical:
        type: boolean
        example: false
      cfg_type:
        type: string
        enum:
        - user_created
        - ground
        - federal
      rule_type:
        type: string
        enum:
        - exception
        - deny
      rule_mode:
        type: string
        enum:
        - ''
        - monitor
        - protect
      containers:
        type: array
        items:
          type: string
          enum:
          - containers
          - init_containers
          - ephemeral_containers
  RESTAdmissionRuleData:
    type: object
    required:
    - rule
    properties:
      rule:
        $ref: '#/definitions/RESTAdmissionRule'
securityDefinitions:
  ApiKeyAuth:
    type: apiKey
    in: header
    name: X-Auth-Apikey
  TokenAuth:
    type: apiKey
    in: header
    name: X-Auth-Token
externalDocs:
  description: Find out more about NeuVector
  url: https://www.suse.com/products/neuvector/