{"resources":{"k8s":{"id":"k8s","name":"k8s","fields":{"accessReview":{"name":"accessReview","type":"\u001bk8s.accessReview","title":"Authoritative RBAC access check","desc":"Answers, via the Kubernetes API server's SubjectAccessReview, whether a subject may perform a verb on a resource. Unlike the rule-derived RBAC rollups, this folds in aggregated ClusterRoles, group bindings, and built-in roles. Requires a live cluster connection; on a manifest scan the result fields error. Construct it with the action under test, for example k8s.accessReview(subject: \"system:serviceaccount:prod:web\", verb: \"create\", resource: \"pods\") or k8s.accessReview(subject: \"alice\", verb: \"get\", resource: \"secrets\", namespace: \"prod\").","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"admission":{"name":"admission","type":"\u001bk8s.admission","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"admissionrequest":{"name":"admissionrequest","type":"\u001bk8s.admissionrequest","title":"Kubernetes AdmissionRequest","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"admissionreview":{"name":"admissionreview","type":"\u001bk8s.admissionreview","title":"Kubernetes AdmissionReview","desc":"Examine an AdmissionReview that an admission controller is being asked to evaluate. Use `request()` to read the embedded `k8s.admissionrequest`: the operation, requesting user, target namespace, the incoming object, and (for UPDATE/DELETE) the prior object. This resource is populated when MQL is invoked from inside a dynamic admission webhook so policies can decide whether to admit the request.","provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"apiResources":{"name":"apiResources","type":"\u0019\u001bk8s.apiresource","title":"Available resource types","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"apiServices":{"name":"apiServices","type":"\u0019\u001bk8s.apiservice","title":"Kubernetes APIServices (aggregation layer)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"apiresource":{"name":"apiresource","type":"\u001bk8s.apiresource","title":"Kubernetes API resource type","desc":"Resource type the API server advertises through discovery, selected by its plural name and kind. The group and version report the preferred API path, namespaced indicates whether instances are scoped to a namespace, and shortNames and categories list the kubectl aliases and groupings (such as \"all\") the type belongs to.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"apiservice":{"name":"apiservice","type":"\u001bk8s.apiservice","title":"Kubernetes APIService (aggregation layer)","desc":"Registration that adds an API group and version to the cluster through the aggregation layer, selected by name. The group and version fields name the API the registration serves, serviceName and serviceNamespace identify the backend that handles it (reached through service, or empty when served by kube-apiserver itself), and caBundle and insecureSkipTLSVerify govern how the API server trusts that backend. The conditions field reports whether the API is available.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"app":{"name":"app","type":"\u001bk8s.app","title":"Kubernetes Application","desc":"Logical application reconstructed from the recommended app.kubernetes.io labels shared across a group of objects. The name, version, and instance fields identify the application, managedBy names the tool that operates it (such as helm), partOf names a larger application it belongs to, and components lists the architectural pieces (such as database, cache, or frontend) discovered for it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"apps":{"name":"apps","type":"\u0019\u001bk8s.app","title":"Kubernetes applications","min_provider_version":"11.1.75","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificateSigningRequests":{"name":"certificateSigningRequests","type":"\u0019\u001bk8s.certificatesigningrequest","title":"Kubernetes CertificateSigningRequests","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificatesigningrequest":{"name":"certificatesigningrequest","type":"\u001bk8s.certificatesigningrequest","title":"Kubernetes CertificateSigningRequest","desc":"Request for a certificate to be issued by a cluster signer, selected by name. The request field carries the PEM-encoded certificate signing request, signerName names the signer that should handle it, and usages and expirationSeconds state the requested key usages and lifetime. The username, groups, and requesterUid fields identify the requester, conditions reports approval state, and certificate holds the issued certificate once signed.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"clusterrolebindings":{"name":"clusterrolebindings","type":"\u0019\u001bk8s.rbac.clusterrolebinding","title":"Kubernetes RBAC ClusterRoleBindings","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterroles":{"name":"clusterroles","type":"\u0019\u001bk8s.rbac.clusterrole","title":"Kubernetes RBAC ClusterRoles","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"configmap":{"name":"configmap","type":"\u001bk8s.configmap","title":"Kubernetes ConfigMap","desc":"Object that holds non-confidential configuration as key-value pairs, selected by namespace and name. The data field exposes the stored configuration entries, and usedBy returns the pods that consume the ConfigMap through volumes, environment variables, or envFrom.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"configmaps":{"name":"configmaps","type":"\u0019\u001bk8s.configmap","title":"ConfigMaps","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"container":{"name":"container","type":"\u001bk8s.container","title":"Kubernetes workload container","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"containerStatus":{"name":"containerStatus","type":"\u001bk8s.containerStatus","title":"Kubernetes container status","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"context":{"name":"context","type":"\u001bk8s.context","title":"Kubernetes manifest source context","desc":"Source location and raw text of a resource declared in a manifest file: the file path, the line range it spans, and the manifest text within that range. Points a reviewer at the exact source of a flagged resource. Available only for manifest-file scans; empty for live-cluster and admission connections.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"cronjob":{"name":"cronjob","type":"\u001bk8s.cronjob","title":"Kubernetes CronJob","desc":"Controller that creates Jobs on a repeating schedule, selected by namespace and name. The schedule and timeZone fields define when jobs run, concurrencyPolicy, startingDeadlineSeconds, and suspend govern execution, and successfulJobsHistoryLimit and failedJobsHistoryLimit control how many finished jobs are retained. The activeJobs field returns the jobs currently running, jobs returns every job the CronJob still owns, and the shared pod template is available through podSpec, containers, and initContainers.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"cronjobs":{"name":"cronjobs","type":"\u0019\u001bk8s.cronjob","title":"Cluster CronJobs","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"customresource":{"name":"customresource","type":"\u001bk8s.customresource","title":"Kubernetes CustomResource","desc":"Instance of a custom resource defined by a CustomResourceDefinition, selected by namespace and name. The kind field reports the custom type and manifest exposes the object's full content, so custom API extensions can be queried alongside built-in Kubernetes objects.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"customresources":{"name":"customresources","type":"\u0019\u001bk8s.customresource","title":"Kubernetes custom resources","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"daemonset":{"name":"daemonset","type":"\u001bk8s.daemonset","title":"Kubernetes DaemonSet","desc":"Controller that runs one copy of a pod on every matching node, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers, the rollout is governed by updateStrategy and revisionHistoryLimit, and scheduling coverage is reported by desiredNumberScheduled, currentNumberScheduled, numberReady, numberAvailable, numberMisscheduled, and updatedNumberScheduled. The pods field returns the daemon pods currently running.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"daemonsets":{"name":"daemonsets","type":"\u0019\u001bk8s.daemonset","title":"Cluster DaemonSets","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"deployment":{"name":"deployment","type":"\u001bk8s.deployment","title":"Kubernetes Deployment","desc":"Controller that manages a replicated, declaratively updated set of pods through ReplicaSets, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; the rollout is governed by desiredReplicas, strategy, paused, and revisionHistoryLimit; and the current rollout state is reported by replicas, readyReplicas, availableReplicas, updatedReplicas, unavailableReplicas, and conditions. The pods field returns the pods currently backing the deployment.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"deployments":{"name":"deployments","type":"\u0019\u001bk8s.deployment","title":"Cluster deployments","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"egressNat":{"name":"egressNat","type":"\u001bk8s.egressNat","title":"Normalized Kubernetes egress NAT","desc":"Represents NAT intent or observed compiled NAT state from Coil Egress, Calico IPPool, HBN, and compatible network integrations. Kubernetes-only clusters without those integrations expose an empty list.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"egressNats":{"name":"egressNats","type":"\u0019\u001bk8s.egressNat","title":"Normalized egress NAT entries from HBN/network intent sources","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"egressRoute":{"name":"egressRoute","type":"\u001bk8s.egressRoute","title":"Normalized Kubernetes egress route","desc":"Represents egress routing intent or observed compiled routing state from HBN network CRDs, Coil Egress resources, and compatible integrations. Kubernetes-only clusters without those integrations expose an empty list.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"egressRoutes":{"name":"egressRoutes","type":"\u0019\u001bk8s.egressRoute","title":"Normalized egress routes from HBN/network intent sources","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpointSlices":{"name":"endpointSlices","type":"\u0019\u001bk8s.endpointslice","title":"Kubernetes EndpointSlices","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpointslice":{"name":"endpointslice","type":"\u001bk8s.endpointslice","title":"Kubernetes EndpointSlice","desc":"Scalable list of network endpoints that back a Service, selected by namespace and name. The addressType field reports whether the slice holds IPv4, IPv6, or FQDN endpoints, endpoints lists the backing addresses and their readiness, ports lists the ports they expose, and service returns the Service the slice belongs to.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ephemeralContainer":{"name":"ephemeralContainer","type":"\u001bk8s.ephemeralContainer","title":"Kubernetes ephemeral container","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"gateway":{"name":"gateway","type":"\u001bk8s.gateway","title":"Kubernetes Gateway API Gateway","desc":"Gateway API object that configures how external traffic enters the cluster, selected by namespace and name. The gatewayClass field selects the implementing controller, listeners defines the ports, protocols, and hostnames the Gateway accepts, and addresses requests specific entry addresses. The statusAddresses and listenerStatus fields report the addresses the controller assigned and the routes attached to each listener.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"gatewayClasses":{"name":"gatewayClasses","type":"\u0019\u001bk8s.gatewayclass","title":"Kubernetes Gateway API GatewayClasses","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"gatewayclass":{"name":"gatewayclass","type":"\u001bk8s.gatewayclass","title":"Kubernetes Gateway API GatewayClass","desc":"Gateway API template that ties Gateways to a controller implementation, selected by name. The controllerName field names the controller that manages Gateways of this class, parametersRef points to a controller-specific configuration resource, and conditions reports whether the class has been accepted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"gateways":{"name":"gateways","type":"\u0019\u001bk8s.gateway","title":"Kubernetes Gateway API Gateways","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grpcRoutes":{"name":"grpcRoutes","type":"\u0019\u001bk8s.grpcroute","title":"Kubernetes Gateway API GRPCRoutes","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grpcroute":{"name":"grpcroute","type":"\u001bk8s.grpcroute","title":"Kubernetes Gateway API GRPCRoute","desc":"Gateway API rules that route gRPC traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways or Services that delegate to it, hostnames narrows the route to specific hosts, and rules describes the method matches, filters, and backend forwarding applied to requests. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"horizontalPodAutoscalers":{"name":"horizontalPodAutoscalers","type":"\u0019\u001bk8s.horizontalpodautoscaler","title":"Kubernetes HorizontalPodAutoscalers","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"horizontalpodautoscaler":{"name":"horizontalpodautoscaler","type":"\u001bk8s.horizontalpodautoscaler","title":"Kubernetes HorizontalPodAutoscaler","desc":"Controller that scales a workload's replica count to meet observed metrics, selected by namespace and name. The scaleTargetKind and scaleTargetName fields identify the scaled workload (reached through scaleTargetDeployment, scaleTargetStatefulSet, or scaleTargetReplicaSet), minReplicas and maxReplicas bound the replica count, and metrics and behavior define the targets and scaling policies. Current state is reported by currentReplicas, desiredReplicas, currentMetrics, lastScaleTime, and conditions.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"httpRoutes":{"name":"httpRoutes","type":"\u0019\u001bk8s.httproute","title":"Kubernetes Gateway API HTTPRoutes","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"httproute":{"name":"httproute","type":"\u001bk8s.httproute","title":"Kubernetes Gateway API HTTPRoute","desc":"Gateway API rules that route HTTP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways or Services that delegate to it, hostnames narrows the route to specific hosts, and rules describes the matches, filters, and backend forwarding applied to requests. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingress":{"name":"ingress","type":"\u001bk8s.ingress","title":"Kubernetes Ingress","desc":"HTTP and HTTPS routing rules that expose Services to traffic from outside the cluster, selected by namespace and name. The rules field maps hostnames and paths to backend services, tls lists the hostnames and certificates terminated by the ingress, and ingressClass identifies the controller that implements the rules. The loadBalancerIngress field reports the addresses the controller has assigned.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressClasses":{"name":"ingressClasses","type":"\u0019\u001bk8s.ingressclass","title":"Kubernetes IngressClasses","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingressbackend":{"name":"ingressbackend","type":"\u001bk8s.ingressbackend","title":"Kubernetes Ingress backend","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressclass":{"name":"ingressclass","type":"\u001bk8s.ingressclass","title":"Kubernetes IngressClass","desc":"Template that ties Ingress objects to a controller implementation, selected by name. The controller field names the controller that handles ingresses of this class, and parameters points to a controller-specific configuration resource that tunes its behavior.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingresses":{"name":"ingresses","type":"\u0019\u001bk8s.ingress","title":"Kubernetes Ingresses","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingresshttprulepath":{"name":"ingresshttprulepath","type":"\u001bk8s.ingresshttprulepath","title":"Kubernetes Ingress HTTP rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressresourceref":{"name":"ingressresourceref","type":"\u001bk8s.ingressresourceref","title":"Kubernetes Ingress resource backend","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressrule":{"name":"ingressrule","type":"\u001bk8s.ingressrule","title":"Kubernetes Ingress rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressservicebackend":{"name":"ingressservicebackend","type":"\u001bk8s.ingressservicebackend","title":"Kubernetes Ingress service backend","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingresstls":{"name":"ingresstls","type":"\u001bk8s.ingresstls","title":"Kubernetes Ingress TLS","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"initContainer":{"name":"initContainer","type":"\u001bk8s.initContainer","title":"Kubernetes init container","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"job":{"name":"job","type":"\u001bk8s.job","title":"Kubernetes Job","desc":"Controller that runs pods to completion, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; execution is governed by parallelism, completions, completionMode, backoffLimit, activeDeadlineSeconds, and suspend; and progress is reported by active, succeeded, failed, ready, startTime, completionTime, and conditions. The pods field returns the pods the job has created.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"jobs":{"name":"jobs","type":"\u0019\u001bk8s.job","title":"Cluster Jobs","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lease":{"name":"lease","type":"\u001bk8s.lease","title":"Kubernetes Lease (coordination.k8s.io)","desc":"Coordination object that backs leader election and node heartbeats, selected by namespace and name. The holderIdentity field names the current holder, leaseDurationSeconds and renewTime report how long the lease is held and when it was last renewed, and acquireTime and leaseTransitions track when it was acquired and how often it has changed hands.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"leases":{"name":"leases","type":"\u0019\u001bk8s.lease","title":"Kubernetes coordination Leases","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"limitRanges":{"name":"limitRanges","type":"\u0019\u001bk8s.limitrange","title":"Kubernetes LimitRanges","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"limitrange":{"name":"limitrange","type":"\u001bk8s.limitrange","title":"Kubernetes LimitRange","desc":"Policy that constrains resource requests and limits for objects in a namespace, selected by namespace and name. The limits field lists the default, minimum, and maximum values applied per object type (Container, Pod, or PersistentVolumeClaim), supplying defaults to objects that omit them and rejecting objects that fall outside the bounds.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"managedField":{"name":"managedField","type":"\u001bk8s.managedField","title":"Kubernetes managed field entry","desc":"Examine one server-side-apply field-management record from metadata.managedFields: the manager that owns a set of fields, the operation it used, the apiVersion those fields are expressed in, the time of the change, the optional subresource, and the fieldsV1 set enumerating exactly which fields the manager owns. Use these records to see which controller or tool last wrote each part of an object.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"mutatingWebhookConfigurations":{"name":"mutatingWebhookConfigurations","type":"\u0019\u001bk8s.admission.mutatingwebhookconfiguration","title":"Kubernetes admission mutating webhook configurations","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u001bk8s.namespace","title":"Kubernetes namespace","desc":"Namespace that partitions a cluster into isolated scopes, selected by name. The workload accessors (pods, deployments, statefulsets, daemonsets, replicasets, jobs, cronjobs) and the services, ingresses, endpointSlices, and networkPolicies accessors return only the objects in this namespace, while secrets, configmaps, serviceaccounts, persistentVolumeClaims, roles, and rolebindings cover its configuration, identity, storage, and RBAC. The podSecurityEnforce, podSecurityAudit, and podSecurityWarn fields (with their version companions) report the Pod Security Standards level applied by Pod Security admission.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"namespaces":{"name":"namespaces","type":"\u0019\u001bk8s.namespace","title":"Cluster namespaces","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposure":{"name":"networkExposure","type":"\u001bk8s.networkExposure","title":"Normalized Kubernetes network exposure","desc":"Represents an inbound exposure signal from Kubernetes Services, Ingresses, Gateway API resources, and HBN/network intent sources when they are available. The `confidence` field describes static-analysis confidence, not packet-level reachability.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposures from Services, Ingresses, Gateways, and network intent sources","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkPolicies":{"name":"networkPolicies","type":"\u0019\u001bk8s.networkpolicy","title":"Kubernetes network policies","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkPolicyCoverage":{"name":"networkPolicyCoverage","type":"\u001bk8s.networkPolicyCoverage","title":"Normalized Kubernetes network policy coverage","desc":"Represents policy coverage for a workload selector and network interfaces. Native Kubernetes NetworkPolicy applies to primary pod networking unless the CNI explicitly extends it; secondary-interface policy coverage is tracked separately through MultiNetworkPolicy and compatible integrations.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"networkPolicyCoverages":{"name":"networkPolicyCoverages","type":"\u0019\u001bk8s.networkPolicyCoverage","title":"Normalized network policy coverage summaries","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkpolicy":{"name":"networkpolicy","type":"\u001bk8s.networkpolicy","title":"Kubernetes Network Policy","desc":"Rule set that controls allowed network traffic to and from pods, selected by namespace and name. The podSelector field chooses the pods the policy governs, policyTypes reports whether ingress, egress, or both are restricted, and the ingress and egress fields list the permitted peers and ports. Pods selected by a policy deny all traffic not explicitly allowed by these rules.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"node":{"name":"node","type":"\u001bk8s.node","title":"Kubernetes node","desc":"Worker or control-plane machine that runs pods, selected by name. The capacity and allocatable fields report total and schedulable resources, conditions surfaces health signals such as Ready and MemoryPressure, taints lists the scheduling restrictions pods must tolerate, and addresses holds the node's hostnames and IPs. The osImage, kernelVersion, kubeletVersion, containerRuntimeVersion, operatingSystem, and architecture fields report the node's software stack, and unschedulable reports whether the node is cordoned.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"nodeAddress":{"name":"nodeAddress","type":"\u001bk8s.nodeAddress","title":"Kubernetes node address","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"nodeCondition":{"name":"nodeCondition","type":"\u001bk8s.nodeCondition","title":"Kubernetes node condition","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"nodeTaint":{"name":"nodeTaint","type":"\u001bk8s.nodeTaint","title":"Kubernetes node taint","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"nodes":{"name":"nodes","type":"\u0019\u001bk8s.node","title":"Cluster nodes","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReference":{"name":"ownerReference","type":"\u001bk8s.ownerReference","title":"Kubernetes owner reference","desc":"Examine the controller or parent object that owns this object, as recorded in metadata.ownerReferences: the referent's apiVersion, kind, name, and uid, whether it is the managing controller, and whether it blocks foreground cascading deletion. Correlate uid against the uid of any modeled object to trace provenance and ownership chains across the cluster.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"persistentVolumeClaims":{"name":"persistentVolumeClaims","type":"\u0019\u001bk8s.persistentvolumeclaim","title":"Kubernetes PersistentVolumeClaims","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentVolumes":{"name":"persistentVolumes","type":"\u0019\u001bk8s.persistentvolume","title":"Kubernetes PersistentVolumes","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentvolume":{"name":"persistentvolume","type":"\u001bk8s.persistentvolume","title":"Kubernetes PersistentVolume","desc":"Cluster-wide piece of storage provisioned for use by pods, selected by name. The capacity, accessModes, volumeMode, and storageClass fields describe the volume's size and capabilities, persistentVolumeReclaimPolicy governs what happens when its claim is released, and phase reports its lifecycle state (Available, Bound, Released, or Failed). The claim field returns the PersistentVolumeClaim currently bound to the volume.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"persistentvolumeclaim":{"name":"persistentvolumeclaim","type":"\u001bk8s.persistentvolumeclaim","title":"Kubernetes PersistentVolumeClaim","desc":"Request for storage by a pod, selected by namespace and name. The accessModes, resources, storageClass, and volumeMode fields describe the storage requested, volume and volumeName identify the bound PersistentVolume, and phase reports whether the claim is Pending, Bound, or Lost. The capacity and boundAccessModes fields report what the bound volume actually provides.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"pod":{"name":"pod","type":"\u001bk8s.pod","title":"Kubernetes Pod","desc":"Smallest deployable unit, one or more co-scheduled containers sharing a network and storage context, selected by namespace and name. The containers, initContainers, and ephemeralContainers accessors expose the workload and its images, command, resources, and securityContext, while containerStatuses reports their runtime state. Scheduling is described by node, nodeSelector, tolerations, affinity, priorityClass, and serviceAccount; the host-namespace and security posture by hostNetwork, hostPID, hostIPC, and securityContext; and runtime status by phase, qosClass, podIP, and conditions. The owning controller is reached through replicaSet, statefulSet, daemonSet, job, and deployment.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"podDisruptionBudgets":{"name":"podDisruptionBudgets","type":"\u0019\u001bk8s.poddisruptionbudget","title":"Kubernetes PodDisruptionBudgets","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"poddisruptionbudget":{"name":"poddisruptionbudget","type":"\u001bk8s.poddisruptionbudget","title":"Kubernetes PodDisruptionBudget","desc":"Policy that limits how many pods of a workload may be down at once during voluntary disruptions, selected by namespace and name. The minAvailable and maxUnavailable fields set the budget, selector chooses the protected pods, and unhealthyPodEvictionPolicy governs eviction of unhealthy pods. Current state is reported by currentHealthy, desiredHealthy, expectedPods, and disruptionsAllowed.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Cluster Pods","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"priorityClasses":{"name":"priorityClasses","type":"\u0019\u001bk8s.priorityclass","title":"Kubernetes PriorityClasses","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"priorityclass":{"name":"priorityclass","type":"\u001bk8s.priorityclass","title":"Kubernetes PriorityClass","desc":"Named scheduling priority that pods can request, selected by name. The value field sets the integer priority used during scheduling and preemption, globalDefault marks the class applied to pods that request none, and preemptionPolicy controls whether higher-priority pods may evict lower-priority ones.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"rbac":{"name":"rbac","type":"\u001bk8s.rbac","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"rbacSubjects":{"name":"rbacSubjects","type":"\u0019\u001bk8s.rbac.subject","title":"Distinct RBAC subjects with their effective cluster permissions","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"referenceGrants":{"name":"referenceGrants","type":"\u0019\u001bk8s.referencegrant","title":"Kubernetes Gateway API ReferenceGrants","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"referencegrant":{"name":"referencegrant","type":"\u001bk8s.referencegrant","title":"Kubernetes Gateway API ReferenceGrant","desc":"Gateway API grant that permits cross-namespace references into its namespace, selected by namespace and name. The from field lists the resource kinds and namespaces allowed to make references, and the to field lists the resource kinds in this namespace they may reference, letting routes and other objects point at targets they would otherwise be denied.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"replicaset":{"name":"replicaset","type":"\u001bk8s.replicaset","title":"Kubernetes ReplicaSet","desc":"Controller that maintains a stable set of replica pods, usually owned by a Deployment, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers, the target count comes from desiredReplicas and selector, and the observed state is reported by replicas, readyReplicas, availableReplicas, fullyLabeledReplicas, and conditions. The pods field returns the pods the ReplicaSet owns.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"replicasets":{"name":"replicasets","type":"\u0019\u001bk8s.replicaset","title":"Cluster ReplicaSets","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceQuotas":{"name":"resourceQuotas","type":"\u0019\u001bk8s.resourcequota","title":"Kubernetes ResourceQuotas","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourcequota":{"name":"resourcequota","type":"\u001bk8s.resourcequota","title":"Kubernetes ResourceQuota","desc":"Constraint on the aggregate resource consumption of a namespace, selected by namespace and name. The hard field lists the enforced limits (such as CPU, memory, and object counts) and used reports current consumption against them. The scopes and scopeSelector fields narrow which objects the quota applies to.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"rolebindings":{"name":"rolebindings","type":"\u0019\u001bk8s.rbac.rolebinding","title":"Kubernetes RBAC RoleBindings","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roles":{"name":"roles","type":"\u0019\u001bk8s.rbac.role","title":"Kubernetes RBAC roles","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secret":{"name":"secret","type":"\u001bk8s.secret","title":"Kubernetes Secret","desc":"Object that holds sensitive data such as passwords, tokens, and keys, selected by namespace and name. The type field reports the secret's purpose (for example kubernetes.io/tls or kubernetes.io/dockerconfigjson), certificates parses any X.509 certificates the secret carries, and usedBy returns the pods that consume the secret through volumes, environment variables, or image-pull references.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"secrets":{"name":"secrets","type":"\u0019\u001bk8s.secret","title":"Cluster Secrets","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serverVersion":{"name":"serverVersion","type":"\n","title":"Cluster version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"service":{"name":"service","type":"\u001bk8s.service","title":"Kubernetes Service","desc":"Stable network endpoint that load-balances traffic to a set of pods, selected by namespace and name. The type field distinguishes ClusterIP, NodePort, LoadBalancer, and ExternalName services; clusterIP, externalIPs, loadBalancerIngress, and ports report the addresses and ports it exposes; and selector identifies the backing pods. Traffic and affinity behavior is governed by externalTrafficPolicy, internalTrafficPolicy, and sessionAffinity, and endpointSlices returns the slices listing the current backing endpoints.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"serviceaccount":{"name":"serviceaccount","type":"\u001bk8s.serviceaccount","title":"Kubernetes service account","desc":"Identity that pods use to authenticate to the API server, selected by namespace and name. The secrets and imagePullSecrets fields list the tokens and registry credentials associated with the account, and automountServiceAccountToken reports whether its API token is mounted into pods by default.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"serviceaccounts":{"name":"serviceaccounts","type":"\u0019\u001bk8s.serviceaccount","title":"Kubernetes service accounts","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"services":{"name":"services","type":"\u0019\u001bk8s.service","title":"Kubernetes Services","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"statefulset":{"name":"statefulset","type":"\u001bk8s.statefulset","title":"Kubernetes StatefulSet","desc":"Controller that manages pods with stable identities and persistent storage, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; identity and ordering are governed by serviceName, podManagementPolicy, ordinalsStart, and updateStrategy; and persistentVolumeClaimRetentionPolicy controls whether per-pod volumes survive scale-down. Rollout state is reported by replicas, readyReplicas, currentReplicas, updatedReplicas, currentRevision, updateRevision, and conditions, and the pods field returns the backing pods.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"statefulsets":{"name":"statefulsets","type":"\u0019\u001bk8s.statefulset","title":"Cluster StatefulSets","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClasses":{"name":"storageClasses","type":"\u0019\u001bk8s.storageclass","title":"Kubernetes StorageClasses","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageclass":{"name":"storageclass","type":"\u001bk8s.storageclass","title":"Kubernetes StorageClass","desc":"Template that describes how volumes are dynamically provisioned, selected by name. The provisioner field names the plugin that creates volumes, parameters carries the provisioner-specific settings, and reclaimPolicy, volumeBindingMode, and allowVolumeExpansion govern reclamation, binding timing, and whether bound volumes may grow.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"tcpRoutes":{"name":"tcpRoutes","type":"\u0019\u001bk8s.tcproute","title":"Kubernetes Gateway API TCPRoutes","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tcproute":{"name":"tcproute","type":"\u001bk8s.tcproute","title":"Kubernetes Gateway API TCPRoute","desc":"Gateway API rules that route raw TCP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it and rules describes the backend forwarding applied to connections; TCPRoute does not match on hostnames. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"tlsRoutes":{"name":"tlsRoutes","type":"\u0019\u001bk8s.tlsroute","title":"Kubernetes Gateway API TLSRoutes","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tlsroute":{"name":"tlsroute","type":"\u001bk8s.tlsroute","title":"Kubernetes Gateway API TLSRoute","desc":"Gateway API rules that route TLS traffic from Gateways to backend services by SNI hostname without terminating the connection, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it, hostnames narrows the route to specific SNI hosts, and rules describes the backend forwarding applied to connections. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"udpRoutes":{"name":"udpRoutes","type":"\u0019\u001bk8s.udproute","title":"Kubernetes Gateway API UDPRoutes","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"udproute":{"name":"udproute","type":"\u001bk8s.udproute","title":"Kubernetes Gateway API UDPRoute","desc":"Gateway API rules that route raw UDP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it and rules describes the backend forwarding applied to datagrams; UDPRoute does not match on hostnames. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"userinfo":{"name":"userinfo","type":"\u001bk8s.userinfo","title":"Kubernetes UserInfo","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"validatingAdmissionPolicies":{"name":"validatingAdmissionPolicies","type":"\u0019\u001bk8s.admission.validatingadmissionpolicy","title":"Kubernetes built-in (CEL) ValidatingAdmissionPolicies","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"validatingAdmissionPolicyBindings":{"name":"validatingAdmissionPolicyBindings","type":"\u0019\u001bk8s.admission.validatingadmissionpolicybinding","title":"Kubernetes built-in (CEL) ValidatingAdmissionPolicyBindings","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"validatingWebhookConfigurations":{"name":"validatingWebhookConfigurations","type":"\u0019\u001bk8s.admission.validatingwebhookconfiguration","title":"Kubernetes admission webhook configurations","min_provider_version":"11.1.63","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes cluster","desc":"Use the Kubernetes namespace as the cluster-wide handle for every modeled API object. Read `serverVersion` for the control-plane version and `apiResources()` for the list of resource types the API server advertises. Iterate the workload accessors `namespaces()`, `nodes()`, `pods()`, `deployments()`, `daemonsets()`, `statefulsets()`, `replicasets()`, `jobs()`, `cronjobs()`, and `apps()` for the running workload, and `services()`, `ingresses()`, `endpointSlices()`, and `networkPolicies()` for the network plane. `secrets()`, `configmaps()`, and `serviceaccounts()` cover identity and configuration data; `clusterroles()`, `clusterrolebindings()`, `roles()`, and `rolebindings()` cover the RBAC graph; `persistentVolumes()`, `persistentVolumeClaims()`, and `storageClasses()` cover storage; `priorityClasses()`, `horizontalPodAutoscalers()`, `resourceQuotas()`, and `limitRanges()` cover scheduling and quota policy. Use `validatingWebhookConfigurations()` for admission control and `customresources()` for custom-resource instances.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.accessReview":{"id":"k8s.accessReview","name":"k8s.accessReview","fields":{"allowed":{"name":"allowed","type":"\u0004","title":"Whether the API server allows the action","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"API group of the resource (\"\" for the core group)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Optional specific object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace of the action (\"\" for a cluster-scoped check)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reason":{"name":"reason","type":"\u0007","title":"Authorizer's explanation for the decision","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resource":{"name":"resource","type":"\u0007","is_mandatory":true,"title":"Resource type (secrets, pods, *, ...)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subject":{"name":"subject","type":"\u0007","is_mandatory":true,"title":"Subject under test (e.g. \"system:serviceaccount:prod:web\", a user, or a group)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"verb":{"name":"verb","type":"\u0007","is_mandatory":true,"title":"Kubernetes API verb (get, list, create, delete, *, ...)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"init":{"args":[{"name":"subject","type":"\u0007"},{"name":"verb","type":"\u0007"},{"name":"resource","type":"\u0007"},{"name":"group","type":"\u0007"},{"name":"namespace","type":"\u0007"},{"name":"name","type":"\u0007"}]},"title":"Authoritative RBAC access check","desc":"Answers, via the Kubernetes API server's SubjectAccessReview, whether a subject may perform a verb on a resource. Unlike the rule-derived RBAC rollups, this folds in aggregated ClusterRoles, group bindings, and built-in roles. Requires a live cluster connection; on a manifest scan the result fields error. Construct it with the action under test, for example k8s.accessReview(subject: \"system:serviceaccount:prod:web\", verb: \"create\", resource: \"pods\") or k8s.accessReview(subject: \"alice\", verb: \"get\", resource: \"secrets\", namespace: \"prod\").","private":true,"min_provider_version":"13.3.1","defaults":"subject verb resource allowed","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admission":{"id":"k8s.admission","fields":{"mutatingwebhookconfiguration":{"name":"mutatingwebhookconfiguration","type":"\u001bk8s.admission.mutatingwebhookconfiguration","title":"Kubernetes MutatingWebhookConfiguration","desc":"Configuration that registers external webhooks to modify API requests, selected by name. The webhooks field lists each registered webhook with its endpoint, the resource rules and namespace and object selectors that decide when it is called, its reinvocation and failure policies, and its admission side effects. Mutating webhooks run before validation and may patch the incoming object.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"validatingadmissionpolicy":{"name":"validatingadmissionpolicy","type":"\u001bk8s.admission.validatingadmissionpolicy","title":"Kubernetes ValidatingAdmissionPolicy","desc":"Examine a built-in, CEL-based admission policy that the API server evaluates in-process (no external webhook). Read `failurePolicy` for how CEL errors are handled, `validations()` for the expressions enforced against matching requests, `matchConstraints()` for the resources the policy targets, and `matchConditions()`/`variables()` for the guards and reusable expressions. A policy is inert until a `k8s.admission.validatingadmissionpolicybinding` activates it; use `bindings()` to reach the bindings that reference this policy by name and the enforcement actions (Deny, Warn, Audit) they apply.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"validatingadmissionpolicybinding":{"name":"validatingadmissionpolicybinding","type":"\u001bk8s.admission.validatingadmissionpolicybinding","title":"Kubernetes ValidatingAdmissionPolicyBinding","desc":"Examine a binding that activates a `k8s.admission.validatingadmissionpolicy` and decides how its validation failures are enforced. `policyName` (and the typed `policy()` accessor) identify the bound policy; `validationActions` lists the enforcement actions applied on failure. `Deny` blocks the request, `Warn` returns a client warning, and `Audit` records the failure in the audit log. Use `matchResources()` to see how the binding narrows the policy's scope and `paramRef()` for the parameter resource it supplies.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"validatingwebhookconfiguration":{"name":"validatingwebhookconfiguration","type":"\u001bk8s.admission.validatingwebhookconfiguration","title":"Kubernetes Validating Webhook Configuration","desc":"Configuration that registers external webhooks to validate API requests, selected by name. The webhooks field lists each registered webhook with its endpoint, the resource rules and namespace and object selectors that decide when it is called, its failure policy, and its admission side effects. Validating webhooks may reject a request but cannot modify the object.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true}},"is_extension":true},"k8s.admission.mutatingwebhookconfiguration":{"id":"k8s.admission.mutatingwebhookconfiguration","name":"k8s.admission.mutatingwebhookconfiguration","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failsOpen":{"name":"failsOpen","type":"\u0004","title":"Whether any webhook is fail-open (failurePolicy: Ignore), so admission proceeds when the webhook errors or is unreachable","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"webhooks":{"name":"webhooks","type":"\u0019\n","title":"Webhooks configuration","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes MutatingWebhookConfiguration","desc":"Configuration that registers external webhooks to modify API requests, selected by name. The webhooks field lists each registered webhook with its endpoint, the resource rules and namespace and object selectors that decide when it is called, its reinvocation and failure policies, and its admission side effects. Mutating webhooks run before validation and may patch the incoming object.","private":true,"min_provider_version":"13.0.16","defaults":"name","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admission.validatingadmissionpolicy":{"id":"k8s.admission.validatingadmissionpolicy","name":"k8s.admission.validatingadmissionpolicy","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"auditAnnotations":{"name":"auditAnnotations","type":"\u0019\n","title":"CEL expressions that produce audit annotations on the audit event","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"bindings":{"name":"bindings","type":"\u0019\u001bk8s.admission.validatingadmissionpolicybinding","title":"Bindings that activate this policy (filtered by spec.policyName)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failurePolicy":{"name":"failurePolicy","type":"\u0007","is_mandatory":true,"title":"How CEL evaluation failures are handled (Ignore or Fail; defaults to Fail)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"matchConditions":{"name":"matchConditions","type":"\u0019\n","title":"CEL match conditions that gate whether the policy is evaluated for a request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"matchConstraints":{"name":"matchConstraints","type":"\n","title":"Resource matching constraints (resourceRules, namespaceSelector, objectSelector, matchPolicy)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"paramKind":{"name":"paramKind","type":"\n","title":"Kind of resource used to parameterize the policy (apiVersion, kind); null when the policy takes no parameters","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"validations":{"name":"validations","type":"\u0019\n","title":"CEL validation expressions enforced against matching requests (expression, message, reason)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"variables":{"name":"variables","type":"\u0019\n","title":"Named CEL variables available to the policy's expressions","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ValidatingAdmissionPolicy","desc":"Examine a built-in, CEL-based admission policy that the API server evaluates in-process (no external webhook). Read `failurePolicy` for how CEL errors are handled, `validations()` for the expressions enforced against matching requests, `matchConstraints()` for the resources the policy targets, and `matchConditions()`/`variables()` for the guards and reusable expressions. A policy is inert until a `k8s.admission.validatingadmissionpolicybinding` activates it; use `bindings()` to reach the bindings that reference this policy by name and the enforcement actions (Deny, Warn, Audit) they apply.","private":true,"min_provider_version":"13.2.2","defaults":"name failurePolicy","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admission.validatingadmissionpolicybinding":{"id":"k8s.admission.validatingadmissionpolicybinding","name":"k8s.admission.validatingadmissionpolicybinding","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"matchResources":{"name":"matchResources","type":"\n","title":"Additional resource matching constraints, intersected with the policy's matchConstraints; null when unset","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"paramRef":{"name":"paramRef","type":"\n","title":"Parameter resource reference used to configure the policy (name, namespace, selector, parameterNotFoundAction); null when unset","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policy":{"name":"policy","type":"\u001bk8s.admission.validatingadmissionpolicy","title":"The ValidatingAdmissionPolicy this binding activates (null if the referenced policy does not exist)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyName":{"name":"policyName","type":"\u0007","is_mandatory":true,"title":"Name of the ValidatingAdmissionPolicy this binding activates","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"validationActions":{"name":"validationActions","type":"\u0019\u0007","is_mandatory":true,"title":"Enforcement actions applied to validation failures (Deny, Warn, Audit)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ValidatingAdmissionPolicyBinding","desc":"Examine a binding that activates a `k8s.admission.validatingadmissionpolicy` and decides how its validation failures are enforced. `policyName` (and the typed `policy()` accessor) identify the bound policy; `validationActions` lists the enforcement actions applied on failure. `Deny` blocks the request, `Warn` returns a client warning, and `Audit` records the failure in the audit log. Use `matchResources()` to see how the binding narrows the policy's scope and `paramRef()` for the parameter resource it supplies.","private":true,"min_provider_version":"13.2.2","defaults":"name policyName","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admission.validatingwebhookconfiguration":{"id":"k8s.admission.validatingwebhookconfiguration","name":"k8s.admission.validatingwebhookconfiguration","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failsOpen":{"name":"failsOpen","type":"\u0004","title":"Whether any webhook is fail-open (failurePolicy: Ignore), so admission proceeds when the webhook errors or is unreachable","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"webhooks":{"name":"webhooks","type":"\u0019\n","title":"Webhooks configuration","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Validating Webhook Configuration","desc":"Configuration that registers external webhooks to validate API requests, selected by name. The webhooks field lists each registered webhook with its endpoint, the resource rules and namespace and object selectors that decide when it is called, its failure policy, and its admission side effects. Validating webhooks may reject a request but cannot modify the object.","private":true,"min_provider_version":"11.1.63","defaults":"name","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admissionrequest":{"id":"k8s.admissionrequest","name":"k8s.admissionrequest","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The name of the object presented in the request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"The namespace associated with the request (if any)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"object":{"name":"object","type":"\n","is_mandatory":true,"title":"The incoming object from the request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"oldObject":{"name":"oldObject","type":"\n","is_mandatory":true,"title":"The existing object (only populated for UPDATE and DELETE requests)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"operation":{"name":"operation","type":"\u0007","is_mandatory":true,"title":"The operation being performed","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"userInfo":{"name":"userInfo","type":"\u001bk8s.userinfo","title":"Information about the requesting user","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes AdmissionRequest","private":true,"min_provider_version":"9.0.0","defaults":"name namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admissionreview":{"id":"k8s.admissionreview","name":"k8s.admissionreview","fields":{"request":{"name":"request","type":"\u001bk8s.admissionrequest","title":"Requested admission","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes AdmissionReview","desc":"Examine an AdmissionReview that an admission controller is being asked to evaluate. Use `request()` to read the embedded `k8s.admissionrequest`: the operation, requesting user, target namespace, the incoming object, and (for UPDATE/DELETE) the prior object. This resource is populated when MQL is invoked from inside a dynamic admission webhook so policies can decide whether to admit the request.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.apiresource":{"id":"k8s.apiresource","name":"k8s.apiresource","fields":{"categories":{"name":"categories","type":"\u0019\u0007","is_mandatory":true,"title":"List of the grouped resources","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"Preferred group of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plural name of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespaced":{"name":"namespaced","type":"\u0004","is_mandatory":true,"title":"Whether a resource is namespaced","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"shortNames":{"name":"shortNames","type":"\u0019\u0007","is_mandatory":true,"title":"List of suggested short names of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"singularName":{"name":"singularName","type":"\u0007","is_mandatory":true,"title":"Singular name of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Preferred version of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes API resource type","desc":"Resource type the API server advertises through discovery, selected by its plural name and kind. The group and version report the preferred API path, namespaced indicates whether instances are scoped to a namespace, and shortNames and categories list the kubectl aliases and groupings (such as \"all\") the type belongs to.","private":true,"min_provider_version":"9.0.0","defaults":"name kind","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.apiservice":{"id":"k8s.apiservice","name":"k8s.apiservice","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"caBundle":{"name":"caBundle","type":"\u0007","is_mandatory":true,"title":"PEM-encoded CA bundle used to validate the backend service","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Status conditions (Available)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"API group this APIService handles (empty for the core group)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"groupPriorityMinimum":{"name":"groupPriorityMinimum","type":"\u0005","is_mandatory":true,"title":"Minimum priority for this group across versions","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"insecureSkipTLSVerify":{"name":"insecureSkipTLSVerify","type":"\u0004","is_mandatory":true,"title":"Whether TLS verification of the backend service is skipped","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"service":{"name":"service","type":"\u001bk8s.service","title":"The backend Kubernetes service that handles requests for this APIService","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceName":{"name":"serviceName","type":"\u0007","is_mandatory":true,"title":"Name of the backend service (empty when the APIService is served by kube-apiserver itself)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceNamespace":{"name":"serviceNamespace","type":"\u0007","is_mandatory":true,"title":"Namespace of the backend service","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"servicePort":{"name":"servicePort","type":"\u0005","is_mandatory":true,"title":"Port the backend service is reachable on","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"API version this APIService handles","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"versionPriority":{"name":"versionPriority","type":"\u0005","is_mandatory":true,"title":"Ordering priority for this version within the group","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes APIService (aggregation layer)","desc":"Registration that adds an API group and version to the cluster through the aggregation layer, selected by name. The group and version fields name the API the registration serves, serviceName and serviceNamespace identify the backend that handles it (reached through service, or empty when served by kube-apiserver itself), and caBundle and insecureSkipTLSVerify govern how the API server trusts that backend. The conditions field reports whether the API is available.","private":true,"min_provider_version":"13.0.16","defaults":"name group version created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.app":{"id":"k8s.app","name":"k8s.app","fields":{"components":{"name":"components","type":"\u0019\u0007","is_mandatory":true,"title":"Component names within the architecture (e.g., database, cache, frontend)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"instance":{"name":"instance","type":"\u0007","is_mandatory":true,"title":"Application instance","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedBy":{"name":"managedBy","type":"\u0007","is_mandatory":true,"title":"Tool managing the operation of the application (e.g., helm)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"partOf":{"name":"partOf","type":"\u0007","is_mandatory":true,"title":"Name of the higher-level application","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Application version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Application","desc":"Logical application reconstructed from the recommended app.kubernetes.io labels shared across a group of objects. The name, version, and instance fields identify the application, managedBy names the tool that operates it (such as helm), partOf names a larger application it belongs to, and components lists the architectural pieces (such as database, cache, or frontend) discovered for it.","private":true,"min_provider_version":"11.1.75","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.certificatesigningrequest":{"id":"k8s.certificatesigningrequest","name":"k8s.certificatesigningrequest","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificate":{"name":"certificate","type":"\u0007","is_mandatory":true,"title":"PEM-encoded issued certificate (empty until the request is approved and signed)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Status conditions (Approved, Denied, Failed)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"expirationSeconds":{"name":"expirationSeconds","type":"\u0005","is_mandatory":true,"title":"Requested duration for the issued certificate, in seconds","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"groups":{"name":"groups","type":"\u0019\u0007","is_mandatory":true,"title":"Groups of the user that created the request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"request":{"name":"request","type":"\u0007","is_mandatory":true,"title":"PEM-encoded certificate signing request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"requesterUid":{"name":"requesterUid","type":"\u0007","is_mandatory":true,"title":"UID of the user that created the request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"signerName":{"name":"signerName","type":"\u0007","is_mandatory":true,"title":"Name of the signer that should handle this request (e.g., kubernetes.io/kube-apiserver-client)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usages":{"name":"usages","type":"\u0019\u0007","is_mandatory":true,"title":"Requested key usages for the certificate (e.g., client auth, server auth)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Username of the user that created the request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes CertificateSigningRequest","desc":"Request for a certificate to be issued by a cluster signer, selected by name. The request field carries the PEM-encoded certificate signing request, signerName names the signer that should handle it, and usages and expirationSeconds state the requested key usages and lifetime. The username, groups, and requesterUid fields identify the requester, conditions reports approval state, and certificate holds the issued certificate once signed.","private":true,"min_provider_version":"13.0.16","defaults":"name signerName username created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.configmap":{"id":"k8s.configmap","name":"k8s.configmap","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"data":{"name":"data","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Key-value pairs containing the configuration data","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usedBy":{"name":"usedBy","type":"\u0019\u001bk8s.pod","title":"Pods that reference this ConfigMap through volumes, env, or envFrom","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ConfigMap","desc":"Object that holds non-confidential configuration as key-value pairs, selected by namespace and name. The data field exposes the stored configuration entries, and usedBy returns the pods that consume the ConfigMap through volumes, environment variables, or envFrom.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.container":{"id":"k8s.container","name":"k8s.container","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities added to the container","desc":"From `securityContext.capabilities.add`; empty when none are added.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowPrivilegeEscalation":{"name":"allowPrivilegeEscalation","type":"\u0004","is_mandatory":true,"title":"Whether a process can gain more privileges than its parent process","desc":"Null when not set. Parsed from `securityContext.allowPrivilegeEscalation`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Arguments to the entry point","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"command":{"name":"command","type":"\u0019\u0007","is_mandatory":true,"title":"Entry point array","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImage":{"name":"containerImage","type":"\u001bcontainer.image","title":"Container image","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"droppedCapabilities":{"name":"droppedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities dropped from the container","desc":"From `securityContext.capabilities.drop`; empty when none are dropped.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"env":{"name":"env","type":"\n","is_mandatory":true,"title":"Environment variables","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"envFrom":{"name":"envFrom","type":"\n","is_mandatory":true,"title":"envFrom settings","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageName":{"name":"imageName","type":"\u0007","is_mandatory":true,"title":"Container image name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullPolicy":{"name":"imagePullPolicy","type":"\u0007","is_mandatory":true,"title":"Image pull policy: Always, Never, or IfNotPresent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lifecycle":{"name":"lifecycle","type":"\n","is_mandatory":true,"title":"Lifecycle hooks (postStart, preStop)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"livenessProbe":{"name":"livenessProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container liveness","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Network ports exposed by the container (containerPort, protocol, hostPort, hostIP, name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"privileged":{"name":"privileged","type":"\u0004","is_mandatory":true,"title":"Whether the container runs in privileged mode","desc":"Null when not set by the container's security context. Parsed from `securityContext.privileged`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readOnlyRootFilesystem":{"name":"readOnlyRootFilesystem","type":"\u0004","is_mandatory":true,"title":"Whether the container's root filesystem is mounted read-only","desc":"Null when not set. Parsed from `securityContext.readOnlyRootFilesystem`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readinessProbe":{"name":"readinessProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container service readiness","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resizePolicy":{"name":"resizePolicy","type":"\u0019\n","is_mandatory":true,"title":"Per-resource resize policy entries (resourceName + restartPolicy)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\n","is_mandatory":true,"title":"Compute resources required by this container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"restartPolicy":{"name":"restartPolicy","type":"\u0007","is_mandatory":true,"title":"Container-level restart policy override (currently used to mark a container as a sidecar via Always)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsGroup":{"name":"runAsGroup","type":"\u0005","is_mandatory":true,"title":"GID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsGroup`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsNonRoot":{"name":"runAsNonRoot","type":"\u0004","is_mandatory":true,"title":"Whether the container must run as a non-root user","desc":"Null when not set on the container; in that case the pod-level setting (if any) applies. Parsed from `securityContext.runAsNonRoot`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsUser":{"name":"runAsUser","type":"\u0005","is_mandatory":true,"title":"UID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsUser`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"seccompProfileType":{"name":"seccompProfileType","type":"\u0007","is_mandatory":true,"title":"Seccomp profile type applied to the container","desc":"One of `RuntimeDefault`, `Localhost`, or `Unconfined`. Empty when the container sets no seccomp profile, in which case the pod-level profile (if any) applies. Parsed from `securityContext.seccompProfile.type`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","is_mandatory":true,"title":"Security options the pod should run with","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startupProbe":{"name":"startupProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container startup, gating other probes until it succeeds","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdin":{"name":"stdin","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be left open after the container starts","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdinOnce":{"name":"stdinOnce","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be closed after the first attached client disconnects","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePath":{"name":"terminationMessagePath","type":"\u0007","is_mandatory":true,"title":"Path at which the file to which the container's termination message will be written","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePolicy":{"name":"terminationMessagePolicy","type":"\u0007","is_mandatory":true,"title":"Policy for handling the termination message (File or FallbackToLogsOnError)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tty":{"name":"tty","type":"\u0004","is_mandatory":true,"title":"Whether this container should allocate a TTY for itself","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeDevices":{"name":"volumeDevices","type":"\u0019\n","is_mandatory":true,"title":"List of block devices to be used by the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMounts":{"name":"volumeMounts","type":"\u0019\n","is_mandatory":true,"title":"Pod volumes to mount into the container's file system","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"workingDir":{"name":"workingDir","type":"\u0007","is_mandatory":true,"title":"Container's working directory","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes workload container","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.containerStatus":{"id":"k8s.containerStatus","name":"k8s.containerStatus","fields":{"containerId":{"name":"containerId","type":"\u0007","is_mandatory":true,"title":"The ID of the container in the format '\\\u003ctype\\\u003e://\\\u003ccontainer_id\\\u003e'","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"image":{"name":"image","type":"\u0007","is_mandatory":true,"title":"Name of the container image that the container is running","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageId":{"name":"imageId","type":"\u0007","is_mandatory":true,"title":"The image ID of the container's image","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastState":{"name":"lastState","type":"\n","is_mandatory":true,"title":"State of the container's previous instance, if any","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ready":{"name":"ready","type":"\u0004","is_mandatory":true,"title":"Whether the container is currently passing its readiness check","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\n","is_mandatory":true,"title":"Actual compute resources allocated to the container","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"restartCount":{"name":"restartCount","type":"\u0005","is_mandatory":true,"title":"The amount of times the container has been restarted","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"started":{"name":"started","type":"\u0004","is_mandatory":true,"title":"Whether the container has passed its startup probe","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"state":{"name":"state","type":"\n","is_mandatory":true,"title":"Current state of the container (waiting, running, or terminated)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes container status","private":true,"min_provider_version":"11.1.110","defaults":"name ready restartCount","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.context":{"id":"k8s.context","name":"k8s.context","fields":{"content":{"name":"content","type":"\u0007","refs":["\"path\"","\"range\""],"title":"Manifest text within the range, shown as an excerpt","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path of the manifest file this resource is declared in","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"range":{"name":"range","type":"\u001e","is_mandatory":true,"title":"Line range the resource spans in the manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes manifest source context","desc":"Source location and raw text of a resource declared in a manifest file: the file path, the line range it spans, and the manifest text within that range. Points a reviewer at the exact source of a flagged resource. Available only for manifest-file scans; empty for live-cluster and admission connections.","private":true,"min_provider_version":"13.6.1","defaults":"path range content","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.cronjob":{"id":"k8s.cronjob","name":"k8s.cronjob","fields":{"active":{"name":"active","type":"\u0019\n","title":"References to currently running jobs created by this CronJob","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"activeJobs":{"name":"activeJobs","type":"\u0019\u001bk8s.job","title":"Currently active jobs created by this CronJob (resolves status.active ObjectReferences)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"concurrencyPolicy":{"name":"concurrencyPolicy","type":"\u0007","title":"Concurrency policy (Allow, Forbid, Replace)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failedJobsHistoryLimit":{"name":"failedJobsHistoryLimit","type":"\u0005","title":"Number of failed finished jobs to retain","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"jobs":{"name":"jobs","type":"\u0019\u001bk8s.job","title":"All jobs ever owned by this CronJob (filtered from k8s.jobs by ownerReference UID; subject to the CronJob's history limits)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastScheduleTime":{"name":"lastScheduleTime","type":"\t","title":"Time of the last scheduling attempt","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastSuccessfulTime":{"name":"lastSuccessfulTime","type":"\t","title":"Time of the last successful job completion","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"schedule":{"name":"schedule","type":"\u0007","title":"Cron schedule expression that determines when jobs are created","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startingDeadlineSeconds":{"name":"startingDeadlineSeconds","type":"\u0005","title":"Seconds within which a missed scheduled job is still allowed to start","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"successfulJobsHistoryLimit":{"name":"successfulJobsHistoryLimit","type":"\u0005","title":"Number of successful finished jobs to retain","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"suspend":{"name":"suspend","type":"\u0004","title":"Whether the CronJob is suspended","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"timeZone":{"name":"timeZone","type":"\u0007","title":"IANA time zone the schedule is evaluated in (e.g., \"America/New_York\")","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes CronJob","desc":"Controller that creates Jobs on a repeating schedule, selected by namespace and name. The schedule and timeZone fields define when jobs run, concurrencyPolicy, startingDeadlineSeconds, and suspend govern execution, and successfulJobsHistoryLimit and failedJobsHistoryLimit control how many finished jobs are retained. The activeJobs field returns the jobs currently running, jobs returns every job the CronJob still owns, and the shared pod template is available through podSpec, containers, and initContainers.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name schedule suspend created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.customresource":{"id":"k8s.customresource","name":"k8s.customresource","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes CustomResource","desc":"Instance of a custom resource defined by a CustomResourceDefinition, selected by namespace and name. The kind field reports the custom type and manifest exposes the object's full content, so custom API extensions can be queried alongside built-in Kubernetes objects.","private":true,"min_provider_version":"9.0.0","defaults":"name namespace created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.daemonset":{"id":"k8s.daemonset","name":"k8s.daemonset","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"collisionCount":{"name":"collisionCount","type":"\u0005","title":"Count of ControllerRevision name hash collisions handled by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentNumberScheduled":{"name":"currentNumberScheduled","type":"\u0005","title":"Number of nodes running at least one daemon pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredNumberScheduled":{"name":"desiredNumberScheduled","type":"\u0005","title":"Total number of nodes that should be running a daemon pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReadySeconds":{"name":"minReadySeconds","type":"\u0005","title":"Minimum seconds a newly created pod must be ready without crashes to be considered available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"numberAvailable":{"name":"numberAvailable","type":"\u0005","title":"Number of nodes whose daemon pod is available for at least minReadySeconds","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"numberMisscheduled":{"name":"numberMisscheduled","type":"\u0005","title":"Number of nodes running a daemon pod that shouldn't be running one","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"numberReady":{"name":"numberReady","type":"\u0005","title":"Number of nodes that should be running the daemon pod with the pod in Ready state","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"numberUnavailable":{"name":"numberUnavailable","type":"\u0005","title":"Number of nodes whose daemon pod is not available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this DaemonSet (label-selector match)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"revisionHistoryLimit":{"name":"revisionHistoryLimit","type":"\u0005","title":"Number of old ControllerRevisions retained to allow rollback","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this DaemonSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updateStrategy":{"name":"updateStrategy","type":"\n","title":"Update strategy (OnDelete or RollingUpdate with maxUnavailable/maxSurge)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updatedNumberScheduled":{"name":"updatedNumberScheduled","type":"\u0005","title":"Number of nodes running an updated daemon pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes DaemonSet","desc":"Controller that runs one copy of a pod on every matching node, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers, the rollout is governed by updateStrategy and revisionHistoryLimit, and scheduling coverage is reported by desiredNumberScheduled, currentNumberScheduled, numberReady, numberAvailable, numberMisscheduled, and updatedNumberScheduled. The pods field returns the daemon pods currently running.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name desiredNumberScheduled numberReady created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.deployment":{"id":"k8s.deployment","name":"k8s.deployment","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"availableReplicas":{"name":"availableReplicas","type":"\u0005","title":"Number of pods available for at least minReadySeconds","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"collisionCount":{"name":"collisionCount","type":"\u0005","title":"Count of ReplicaSet name hash collisions handled by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions (Available, Progressing, ReplicaFailure)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredReplicas":{"name":"desiredReplicas","type":"\u0005","title":"Number of pods requested by the deployment","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReadySeconds":{"name":"minReadySeconds","type":"\u0005","title":"Minimum seconds a newly created pod must be ready without crashes to be considered available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"paused":{"name":"paused","type":"\u0004","title":"Whether the deployment rollout is paused","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this deployment (label-selector match; technically owned by the deployment's ReplicaSets)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"progressDeadlineSeconds":{"name":"progressDeadlineSeconds","type":"\u0005","title":"Maximum seconds for the deployment to make progress before being marked failed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readyReplicas":{"name":"readyReplicas","type":"\u0005","title":"Number of ready pods","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicas":{"name":"replicas","type":"\u0005","title":"Total non-terminated pods observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"revisionHistoryLimit":{"name":"revisionHistoryLimit","type":"\u0005","title":"Number of old ReplicaSets retained to allow rollback","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this deployment","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"strategy":{"name":"strategy","type":"\n","title":"Rollout strategy (Recreate or RollingUpdate with maxSurge/maxUnavailable)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unavailableReplicas":{"name":"unavailableReplicas","type":"\u0005","title":"Number of pods that are not available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updatedReplicas":{"name":"updatedReplicas","type":"\u0005","title":"Number of pods updated to the desired pod template","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Deployment","desc":"Controller that manages a replicated, declaratively updated set of pods through ReplicaSets, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; the rollout is governed by desiredReplicas, strategy, paused, and revisionHistoryLimit; and the current rollout state is reported by replicas, readyReplicas, availableReplicas, updatedReplicas, unavailableReplicas, and conditions. The pods field returns the pods currently backing the deployment.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name desiredReplicas readyReplicas created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.egressNat":{"id":"k8s.egressNat","name":"k8s.egressNat","fields":{"addresses":{"name":"addresses","type":"\u0019\u0007","is_mandatory":true,"title":"NAT addresses","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"cidrs":{"name":"cidrs","type":"\u0019\u0007","is_mandatory":true,"title":"NAT CIDRs","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"classification":{"name":"classification","type":"\u0007","is_mandatory":true,"title":"NAT classification","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"metadataClassification":{"name":"metadataClassification","type":"\u0007","is_mandatory":true,"title":"Explicit classification metadata from the source object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"network":{"name":"network","type":"\u0007","is_mandatory":true,"title":"Network associated with this NAT entry","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeStatuses":{"name":"nodeStatuses","type":"\u0019\u0007","is_mandatory":true,"title":"Node status references that reported this NAT entry","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning object reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"publicCidrs":{"name":"publicCidrs","type":"\u0019\u0007","is_mandatory":true,"title":"Public CIDRs included in the NAT entry","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sourceRef":{"name":"sourceRef","type":"\u0007","is_mandatory":true,"title":"Source object reference in kind:namespace:name or kind:name form","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF associated with this NAT entry","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Normalized Kubernetes egress NAT","desc":"Represents NAT intent or observed compiled NAT state from Coil Egress, Calico IPPool, HBN, and compatible network integrations. Kubernetes-only clusters without those integrations expose an empty list.","private":true,"min_provider_version":"13.3.2","defaults":"sourceRef vrf network classification","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.egressRoute":{"id":"k8s.egressRoute","name":"k8s.egressRoute","fields":{"bgpPeerings":{"name":"bgpPeerings","type":"\u0019\u0007","is_mandatory":true,"title":"BGP peering references associated with this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"cidrs":{"name":"cidrs","type":"\u0019\u0007","is_mandatory":true,"title":"Route CIDRs","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"classification":{"name":"classification","type":"\u0007","is_mandatory":true,"title":"Route classification","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"confidence":{"name":"confidence","type":"\u0007","is_mandatory":true,"title":"Static-analysis confidence: high, medium, or low","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"destinations":{"name":"destinations","type":"\u0019\u0007","is_mandatory":true,"title":"Destination references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"metadataClassification":{"name":"metadataClassification","type":"\u0007","is_mandatory":true,"title":"Explicit classification metadata from the source object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nat":{"name":"nat","type":"\u0004","is_mandatory":true,"title":"Whether NAT is configured or inferred for this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"network":{"name":"network","type":"\u0007","is_mandatory":true,"title":"Network associated with this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeStatuses":{"name":"nodeStatuses","type":"\u0019\u0007","is_mandatory":true,"title":"Node status references that reported this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Explicit owner metadata from the source object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"publicCidrs":{"name":"publicCidrs","type":"\u0019\u0007","is_mandatory":true,"title":"Public CIDRs included in the route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sourceRef":{"name":"sourceRef","type":"\u0007","is_mandatory":true,"title":"Source object reference in kind:namespace:name or kind:name form","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF associated with this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Normalized Kubernetes egress route","desc":"Represents egress routing intent or observed compiled routing state from HBN network CRDs, Coil Egress resources, and compatible integrations. Kubernetes-only clusters without those integrations expose an empty list.","private":true,"min_provider_version":"13.3.2","defaults":"sourceRef vrf network classification confidence","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.endpointslice":{"id":"k8s.endpointslice","name":"k8s.endpointslice","fields":{"addressType":{"name":"addressType","type":"\u0007","is_mandatory":true,"title":"Address type (IPv4, IPv6, or FQDN)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpoints":{"name":"endpoints","type":"\u0019\n","title":"List of endpoints in this slice","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalAddresses":{"name":"externalAddresses","type":"\u0019\u0007","title":"Endpoint addresses not backed by an in-cluster pod","desc":"Addresses of endpoints whose targetRef is not a Pod, i.e. manually managed targets. On a selectorless service these often point outside the cluster.","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","title":"List of network ports exposed by each endpoint","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"service":{"name":"service","type":"\u001bk8s.service","title":"The Service this slice backs (resolved from the kubernetes.io/service-name label)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes EndpointSlice","desc":"Scalable list of network endpoints that back a Service, selected by namespace and name. The addressType field reports whether the slice holds IPv4, IPv6, or FQDN endpoints, endpoints lists the backing addresses and their readiness, ports lists the ports they expose, and service returns the Service the slice belongs to.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name addressType","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ephemeralContainer":{"id":"k8s.ephemeralContainer","name":"k8s.ephemeralContainer","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities added to the container","desc":"From `securityContext.capabilities.add`; empty when none are added.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowPrivilegeEscalation":{"name":"allowPrivilegeEscalation","type":"\u0004","is_mandatory":true,"title":"Whether a process can gain more privileges than its parent process","desc":"Null when not set. Parsed from `securityContext.allowPrivilegeEscalation`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Arguments to the entry point","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"command":{"name":"command","type":"\u0019\u0007","is_mandatory":true,"title":"Entry point array","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImage":{"name":"containerImage","type":"\u001bcontainer.image","title":"Container image","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"droppedCapabilities":{"name":"droppedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities dropped from the container","desc":"From `securityContext.capabilities.drop`; empty when none are dropped.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"env":{"name":"env","type":"\n","is_mandatory":true,"title":"Environment variables","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"envFrom":{"name":"envFrom","type":"\n","is_mandatory":true,"title":"envFrom settings","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageName":{"name":"imageName","type":"\u0007","is_mandatory":true,"title":"Container image name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullPolicy":{"name":"imagePullPolicy","type":"\u0007","is_mandatory":true,"title":"Image pull policy: Always, Never, or IfNotPresent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Network ports exposed by the container (typically empty for ephemeral containers)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"privileged":{"name":"privileged","type":"\u0004","is_mandatory":true,"title":"Whether the container runs in privileged mode","desc":"Null when not set by the container's security context. Parsed from `securityContext.privileged`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readOnlyRootFilesystem":{"name":"readOnlyRootFilesystem","type":"\u0004","is_mandatory":true,"title":"Whether the container's root filesystem is mounted read-only","desc":"Null when not set. Parsed from `securityContext.readOnlyRootFilesystem`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsGroup":{"name":"runAsGroup","type":"\u0005","is_mandatory":true,"title":"GID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsGroup`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsNonRoot":{"name":"runAsNonRoot","type":"\u0004","is_mandatory":true,"title":"Whether the container must run as a non-root user","desc":"Null when not set on the container; in that case the pod-level setting (if any) applies. Parsed from `securityContext.runAsNonRoot`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsUser":{"name":"runAsUser","type":"\u0005","is_mandatory":true,"title":"UID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsUser`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"seccompProfileType":{"name":"seccompProfileType","type":"\u0007","is_mandatory":true,"title":"Seccomp profile type applied to the container","desc":"One of `RuntimeDefault`, `Localhost`, or `Unconfined`. Empty when the container sets no seccomp profile, in which case the pod-level profile (if any) applies. Parsed from `securityContext.seccompProfile.type`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","is_mandatory":true,"title":"Security options the Pod should run with","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdin":{"name":"stdin","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be left open after the container starts","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdinOnce":{"name":"stdinOnce","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be closed after the first attached client disconnects","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePath":{"name":"terminationMessagePath","type":"\u0007","is_mandatory":true,"title":"Path at which the file to which the container's termination message will be written","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePolicy":{"name":"terminationMessagePolicy","type":"\u0007","is_mandatory":true,"title":"Policy for handling the termination message (File or FallbackToLogsOnError)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tty":{"name":"tty","type":"\u0004","is_mandatory":true,"title":"Whether this container should allocate a TTY for itself","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeDevices":{"name":"volumeDevices","type":"\u0019\n","is_mandatory":true,"title":"List of block devices to be used by the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMounts":{"name":"volumeMounts","type":"\u0019\n","is_mandatory":true,"title":"Pod volumes to mount into the container's file system","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"workingDir":{"name":"workingDir","type":"\u0007","is_mandatory":true,"title":"Container's working directory","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ephemeral container","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.gateway":{"id":"k8s.gateway","name":"k8s.gateway","fields":{"addresses":{"name":"addresses","type":"\u0019\n","is_mandatory":true,"title":"Addresses requested for the Gateway","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Status conditions","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"gatewayClass":{"name":"gatewayClass","type":"\u001bk8s.gatewayclass","title":"The GatewayClass that backs this Gateway","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"gatewayClassName":{"name":"gatewayClassName","type":"\u0007","is_mandatory":true,"title":"Name of the GatewayClass that backs this Gateway","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"infrastructure":{"name":"infrastructure","type":"\n","is_mandatory":true,"title":"Infrastructure settings (labels, annotations, parametersRef)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"listenerStatus":{"name":"listenerStatus","type":"\u0019\n","is_mandatory":true,"title":"Per-listener status (attached route count and conditions)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"listeners":{"name":"listeners","type":"\u0019\n","is_mandatory":true,"title":"Listeners associated with the Gateway","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposure records for this Gateway","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods behind the gateway, resolved through the HTTPRoutes and GRPCRoutes attached to it and their backend services","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"statusAddresses":{"name":"statusAddresses","type":"\u0019\n","is_mandatory":true,"title":"Network addresses assigned to the Gateway by the controller","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API Gateway","desc":"Gateway API object that configures how external traffic enters the cluster, selected by namespace and name. The gatewayClass field selects the implementing controller, listeners defines the ports, protocols, and hostnames the Gateway accepts, and addresses requests specific entry addresses. The statusAddresses and listenerStatus fields report the addresses the controller assigned and the routes attached to each listener.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name gatewayClassName created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.gatewayclass":{"id":"k8s.gatewayclass","name":"k8s.gatewayclass","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Status conditions","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"controllerName":{"name":"controllerName","type":"\u0007","is_mandatory":true,"title":"Name of the controller that manages Gateways of this class","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the GatewayClass","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parametersRef":{"name":"parametersRef","type":"\n","is_mandatory":true,"title":"Reference to a controller-specific configuration resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API GatewayClass","desc":"Gateway API template that ties Gateways to a controller implementation, selected by name. The controllerName field names the controller that manages Gateways of this class, parametersRef points to a controller-specific configuration resource, and conditions reports whether the class has been accepted.","private":true,"min_provider_version":"13.0.16","defaults":"name controllerName created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.grpcroute":{"id":"k8s.grpcroute","name":"k8s.grpcroute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames this route should respond to","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Parent resources this route is associated with (Gateways, Services, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Status of the route per parent reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Rules describing matches, filters, and backend forwarding","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API GRPCRoute","desc":"Gateway API rules that route gRPC traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways or Services that delegate to it, hostnames narrows the route to specific hosts, and rules describes the method matches, filters, and backend forwarding applied to requests. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.horizontalpodautoscaler":{"id":"k8s.horizontalpodautoscaler","name":"k8s.horizontalpodautoscaler","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"behavior":{"name":"behavior","type":"\n","title":"Scale-up and scale-down policies (stabilization windows, policies)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions (AbleToScale, ScalingActive, ScalingLimited)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentMetrics":{"name":"currentMetrics","type":"\u0019\n","title":"Most recent metric readings the autoscaler used to compute desiredReplicas","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentReplicas":{"name":"currentReplicas","type":"\u0005","title":"Current number of replicas observed by the autoscaler","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredReplicas":{"name":"desiredReplicas","type":"\u0005","title":"Desired number of replicas the autoscaler computed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastScaleTime":{"name":"lastScaleTime","type":"\t","title":"Last time the HPA scaled the target","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"maxReplicas":{"name":"maxReplicas","type":"\u0005","title":"Upper bound on the number of replicas the HPA will allow","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"metrics":{"name":"metrics","type":"\u0019\n","title":"Metrics the HPA evaluates to compute the desired replica count","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReplicas":{"name":"minReplicas","type":"\u0005","title":"Lower bound on the number of replicas the HPA will allow (defaults to 1)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetApiVersion":{"name":"scaleTargetApiVersion","type":"\u0007","title":"API version of the workload the HPA scales","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetDeployment":{"name":"scaleTargetDeployment","type":"\u001bk8s.deployment","title":"The scaled Deployment (null if the target is not a Deployment)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetKind":{"name":"scaleTargetKind","type":"\u0007","title":"Kind of the workload the HPA scales (Deployment, StatefulSet, ReplicaSet)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetName":{"name":"scaleTargetName","type":"\u0007","title":"Name of the workload the HPA scales","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetReplicaSet":{"name":"scaleTargetReplicaSet","type":"\u001bk8s.replicaset","title":"The scaled ReplicaSet (null if the target is not a ReplicaSet)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetStatefulSet":{"name":"scaleTargetStatefulSet","type":"\u001bk8s.statefulset","title":"The scaled StatefulSet (null if the target is not a StatefulSet)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"HorizontalPodAutoscaler spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\n","title":"HorizontalPodAutoscaler status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes HorizontalPodAutoscaler","desc":"Controller that scales a workload's replica count to meet observed metrics, selected by namespace and name. The scaleTargetKind and scaleTargetName fields identify the scaled workload (reached through scaleTargetDeployment, scaleTargetStatefulSet, or scaleTargetReplicaSet), minReplicas and maxReplicas bound the replica count, and metrics and behavior define the targets and scaling policies. Current state is reported by currentReplicas, desiredReplicas, currentMetrics, lastScaleTime, and conditions.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name minReplicas maxReplicas currentReplicas created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.httproute":{"id":"k8s.httproute","name":"k8s.httproute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames this route should respond to","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Parent resources this route is associated with (Gateways, Services, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Status of the route per parent reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Rules describing matches, filters, and backend forwarding","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API HTTPRoute","desc":"Gateway API rules that route HTTP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways or Services that delegate to it, hostnames narrows the route to specific hosts, and rules describes the matches, filters, and backend forwarding applied to requests. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingress":{"id":"k8s.ingress","name":"k8s.ingress","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingressClass":{"name":"ingressClass","type":"\u001bk8s.ingressclass","title":"The IngressClass that handles this ingress","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingressClassName":{"name":"ingressClassName","type":"\u0007","title":"Name of the IngressClass that handles this ingress","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerIngress":{"name":"loadBalancerIngress","type":"\u0019\n","title":"Load-balancer ingress entries published in status (ip, hostname, ports)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposure records for this Ingress","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods behind the ingress, resolved through its backend services","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\u001bk8s.ingressrule","is_mandatory":true,"title":"Ingress rules","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tls":{"name":"tls","type":"\u0019\u001bk8s.ingresstls","title":"Ingress TLS data","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress","desc":"HTTP and HTTPS routing rules that expose Services to traffic from outside the cluster, selected by namespace and name. The rules field maps hostnames and paths to backend services, tls lists the hostnames and certificates terminated by the ingress, and ingressClass identifies the controller that implements the rules. The loadBalancerIngress field reports the addresses the controller has assigned.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressbackend":{"id":"k8s.ingressbackend","name":"k8s.ingressbackend","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceRef":{"name":"resourceRef","type":"\u001bk8s.ingressresourceref","is_mandatory":true,"title":"Kubernetes resource reference for Ingress backend","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"service":{"name":"service","type":"\u001bk8s.ingressservicebackend","is_mandatory":true,"title":"Kubernetes service for Ingress backend","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress backend","private":true,"min_provider_version":"9.0.0","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressclass":{"id":"k8s.ingressclass","name":"k8s.ingressclass","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"controller":{"name":"controller","type":"\u0007","is_mandatory":true,"title":"Name of the controller that handles ingresses of this class (e.g., k8s.io/ingress-nginx)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parameters":{"name":"parameters","type":"\n","is_mandatory":true,"title":"Reference to a controller-specific configuration resource (apiGroup, kind, name, namespace, scope)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes IngressClass","desc":"Template that ties Ingress objects to a controller implementation, selected by name. The controller field names the controller that handles ingresses of this class, and parameters points to a controller-specific configuration resource that tunes its behavior.","private":true,"min_provider_version":"13.0.16","defaults":"name controller created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingresshttprulepath":{"id":"k8s.ingresshttprulepath","name":"k8s.ingresshttprulepath","fields":{"backend":{"name":"backend","type":"\u001bk8s.ingressbackend","is_mandatory":true,"title":"Backend to forward matching Ingress traffic","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"HTTP path for Ingress rule","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pathType":{"name":"pathType","type":"\u0007","is_mandatory":true,"title":"PathType for Ingress rule","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress HTTP rule","private":true,"min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressresourceref":{"id":"k8s.ingressresourceref","name":"k8s.ingressresourceref","fields":{"apiGroup":{"name":"apiGroup","type":"\u0007","is_mandatory":true,"title":"APIGroup specified as part of the resource reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress resource backend","private":true,"min_provider_version":"9.0.0","defaults":"name kind","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressrule":{"id":"k8s.ingressrule","name":"k8s.ingressrule","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Hostname to match for Ingress rule","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"httpPaths":{"name":"httpPaths","type":"\u0019\u001bk8s.ingresshttprulepath","is_mandatory":true,"title":"HTTP paths to manage Ingress for","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress rule","private":true,"min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressservicebackend":{"id":"k8s.ingressservicebackend","name":"k8s.ingressservicebackend","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes service name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"portName":{"name":"portName","type":"\u0007","is_mandatory":true,"title":"Kubernetes service port name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"portNumber":{"name":"portNumber","type":"\u0005","is_mandatory":true,"title":"Kubernetes service port number","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress service backend","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingresstls":{"id":"k8s.ingresstls","name":"k8s.ingresstls","fields":{"certificates":{"name":"certificates","type":"\u0019\u001bcertificate","is_mandatory":true,"title":"Certificates data from the TLS Secret","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hosts":{"name":"hosts","type":"\u0019\u0007","is_mandatory":true,"title":"List of hosts associated with TLS certificate","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress TLS","private":true,"min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.initContainer":{"id":"k8s.initContainer","name":"k8s.initContainer","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities added to the container","desc":"From `securityContext.capabilities.add`; empty when none are added.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowPrivilegeEscalation":{"name":"allowPrivilegeEscalation","type":"\u0004","is_mandatory":true,"title":"Whether a process can gain more privileges than its parent process","desc":"Null when not set. Parsed from `securityContext.allowPrivilegeEscalation`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Arguments to the entrypoint","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"command":{"name":"command","type":"\u0019\u0007","is_mandatory":true,"title":"Entrypoint array","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImage":{"name":"containerImage","type":"\u001bcontainer.image","title":"Container image","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"droppedCapabilities":{"name":"droppedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities dropped from the container","desc":"From `securityContext.capabilities.drop`; empty when none are dropped.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"env":{"name":"env","type":"\n","is_mandatory":true,"title":"Environment variables","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"envFrom":{"name":"envFrom","type":"\n","is_mandatory":true,"title":"envFrom settings","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageName":{"name":"imageName","type":"\u0007","is_mandatory":true,"title":"Container image name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullPolicy":{"name":"imagePullPolicy","type":"\u0007","is_mandatory":true,"title":"Image pull policy: Always, Never, or IfNotPresent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lifecycle":{"name":"lifecycle","type":"\n","is_mandatory":true,"title":"Lifecycle hooks (postStart, preStop)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"livenessProbe":{"name":"livenessProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container liveness (sidecar init containers only)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Network ports exposed by the container (containerPort, protocol, hostPort, hostIP, name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"privileged":{"name":"privileged","type":"\u0004","is_mandatory":true,"title":"Whether the container runs in privileged mode","desc":"Null when not set by the container's security context. Parsed from `securityContext.privileged`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readOnlyRootFilesystem":{"name":"readOnlyRootFilesystem","type":"\u0004","is_mandatory":true,"title":"Whether the container's root filesystem is mounted read-only","desc":"Null when not set. Parsed from `securityContext.readOnlyRootFilesystem`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readinessProbe":{"name":"readinessProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container service readiness (sidecar init containers only)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resizePolicy":{"name":"resizePolicy","type":"\u0019\n","is_mandatory":true,"title":"Per-resource resize policy entries (resourceName + restartPolicy)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\n","is_mandatory":true,"title":"Compute resources required by this container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"restartPolicy":{"name":"restartPolicy","type":"\u0007","is_mandatory":true,"title":"Container-level restart policy; setting this to Always turns the init container into a sidecar","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsGroup":{"name":"runAsGroup","type":"\u0005","is_mandatory":true,"title":"GID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsGroup`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsNonRoot":{"name":"runAsNonRoot","type":"\u0004","is_mandatory":true,"title":"Whether the container must run as a non-root user","desc":"Null when not set on the container; in that case the pod-level setting (if any) applies. Parsed from `securityContext.runAsNonRoot`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsUser":{"name":"runAsUser","type":"\u0005","is_mandatory":true,"title":"UID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsUser`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"seccompProfileType":{"name":"seccompProfileType","type":"\u0007","is_mandatory":true,"title":"Seccomp profile type applied to the container","desc":"One of `RuntimeDefault`, `Localhost`, or `Unconfined`. Empty when the container sets no seccomp profile, in which case the pod-level profile (if any) applies. Parsed from `securityContext.seccompProfile.type`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","is_mandatory":true,"title":"Security options the pod should run with","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startupProbe":{"name":"startupProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container startup (sidecar init containers only)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdin":{"name":"stdin","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be left open after the container starts","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdinOnce":{"name":"stdinOnce","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be closed after the first attached client disconnects","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePath":{"name":"terminationMessagePath","type":"\u0007","is_mandatory":true,"title":"Path at which the file to which the container's termination message will be written","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePolicy":{"name":"terminationMessagePolicy","type":"\u0007","is_mandatory":true,"title":"Policy for handling the termination message (File or FallbackToLogsOnError)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tty":{"name":"tty","type":"\u0004","is_mandatory":true,"title":"Whether this container should allocate a TTY for itself","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeDevices":{"name":"volumeDevices","type":"\u0019\n","is_mandatory":true,"title":"List of block devices to be used by the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMounts":{"name":"volumeMounts","type":"\u0019\n","is_mandatory":true,"title":"Pod volumes to mount into the container's file system","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"workingDir":{"name":"workingDir","type":"\u0007","is_mandatory":true,"title":"Container's working directory","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes init container","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.job":{"id":"k8s.job","name":"k8s.job","fields":{"active":{"name":"active","type":"\u0005","title":"Number of pods currently running for the job","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"activeDeadlineSeconds":{"name":"activeDeadlineSeconds","type":"\u0005","title":"Maximum seconds the job may run before being terminated","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"backoffLimit":{"name":"backoffLimit","type":"\u0005","title":"Number of retries before marking a pod failed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"backoffLimitPerIndex":{"name":"backoffLimitPerIndex","type":"\u0005","title":"Per-index retry limit when completionMode is Indexed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"completedIndexes":{"name":"completedIndexes","type":"\u0007","title":"Comma-separated list or range of indexes that have successfully completed (Indexed completion mode)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"completionMode":{"name":"completionMode","type":"\u0007","title":"Completion mode (NonIndexed or Indexed)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"completionTime":{"name":"completionTime","type":"\t","title":"Time the job entered a terminal state","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"completions":{"name":"completions","type":"\u0005","title":"Total number of successful completions required to mark the job complete","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions (Complete, Failed, FailureTarget, Suspended)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failed":{"name":"failed","type":"\u0005","title":"Number of pods that have failed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failedIndexes":{"name":"failedIndexes","type":"\u0007","title":"Comma-separated list of failed indexes (Indexed completion mode)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"maxFailedIndexes":{"name":"maxFailedIndexes","type":"\u0005","title":"Maximum number of failed indexes allowed before the job is marked failed (Indexed completion mode)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parallelism":{"name":"parallelism","type":"\u0005","title":"Maximum number of pods the job should run in parallel","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podReplacementPolicy":{"name":"podReplacementPolicy","type":"\u0007","title":"Policy for replacing pods that are terminating (TerminatingOrFailed or Failed)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this Job (label-selector match)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ready":{"name":"ready","type":"\u0005","title":"Number of pods that are ready","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this job","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startTime":{"name":"startTime","type":"\t","title":"Time the job controller acknowledged the job","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"succeeded":{"name":"succeeded","type":"\u0005","title":"Number of pods that have successfully completed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"suspend":{"name":"suspend","type":"\u0004","title":"Whether new pod creation is suspended","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminating":{"name":"terminating","type":"\u0005","title":"Number of pods that are terminating","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ttlSecondsAfterFinished":{"name":"ttlSecondsAfterFinished","type":"\u0005","title":"Number of seconds after the job finishes before it is automatically deleted","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Job","desc":"Controller that runs pods to completion, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; execution is governed by parallelism, completions, completionMode, backoffLimit, activeDeadlineSeconds, and suspend; and progress is reported by active, succeeded, failed, ready, startTime, completionTime, and conditions. The pods field returns the pods the job has created.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name succeeded failed created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.lease":{"id":"k8s.lease","name":"k8s.lease","fields":{"acquireTime":{"name":"acquireTime","type":"\t","is_mandatory":true,"title":"Time the current holder acquired the lease","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"holderIdentity":{"name":"holderIdentity","type":"\u0007","is_mandatory":true,"title":"Identity of the lease holder (often \"\u003chostname\u003e_\u003cuuid\u003e\")","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"leaseDurationSeconds":{"name":"leaseDurationSeconds","type":"\u0005","is_mandatory":true,"title":"Lease duration in seconds","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"leaseTransitions":{"name":"leaseTransitions","type":"\u0005","is_mandatory":true,"title":"Number of times this lease has been transferred to a new holder","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"preferredHolder":{"name":"preferredHolder","type":"\u0007","is_mandatory":true,"title":"Preferred future holder for the lease","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"renewTime":{"name":"renewTime","type":"\t","is_mandatory":true,"title":"Time the current holder last renewed the lease","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"strategy":{"name":"strategy","type":"\u0007","is_mandatory":true,"title":"Strategy used to coordinate leadership (e.g., OldestEmulationVersion)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Lease (coordination.k8s.io)","desc":"Coordination object that backs leader election and node heartbeats, selected by namespace and name. The holderIdentity field names the current holder, leaseDurationSeconds and renewTime report how long the lease is held and when it was last renewed, and acquireTime and leaseTransitions track when it was acquired and how often it has changed hands.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name holderIdentity created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.limitrange":{"id":"k8s.limitrange","name":"k8s.limitrange","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"limits":{"name":"limits","type":"\u0019\n","title":"Limit items keyed by resource type (Container, Pod, PersistentVolumeClaim): default, defaultRequest, max, min, maxLimitRequestRatio","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"LimitRange spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes LimitRange","desc":"Policy that constrains resource requests and limits for objects in a namespace, selected by namespace and name. The limits field lists the default, minimum, and maximum values applied per object type (Container, Pod, or PersistentVolumeClaim), supplying defaults to objects that omit them and rejecting objects that fall outside the bounds.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.managedField":{"id":"k8s.managedField","name":"k8s.managedField","fields":{"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"API version of the fields set","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"fieldsType":{"name":"fieldsType","type":"\u0007","is_mandatory":true,"title":"Type of the fields set, always \"FieldsV1\"","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"fieldsV1":{"name":"fieldsV1","type":"\n","is_mandatory":true,"title":"Set of fields this manager owns, as a nested map","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manager":{"name":"manager","type":"\u0007","is_mandatory":true,"title":"Workflow or tool managing these fields, for example kubectl, helm, or kube-controller-manager","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"operation":{"name":"operation","type":"\u0007","is_mandatory":true,"title":"Operation that led to this entry, either \"Apply\" or \"Update\"","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subresource":{"name":"subresource","type":"\u0007","is_mandatory":true,"title":"Subresource this entry applies to, for example \"status\", or empty for the main resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"time":{"name":"time","type":"\t","is_mandatory":true,"title":"Time the manager last modified these fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes managed field entry","desc":"Examine one server-side-apply field-management record from metadata.managedFields: the manager that owns a set of fields, the operation it used, the apiVersion those fields are expressed in, the time of the change, the optional subresource, and the fieldsV1 set enumerating exactly which fields the manager owns. Use these records to see which controller or tool last wrote each part of an object.","private":true,"min_provider_version":"13.2.2","defaults":"manager operation","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.namespace":{"id":"k8s.namespace","name":"k8s.namespace","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"configmaps":{"name":"configmaps","type":"\u0019\u001bk8s.configmap","title":"ConfigMaps in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"cronjobs":{"name":"cronjobs","type":"\u0019\u001bk8s.cronjob","title":"CronJobs in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"daemonsets":{"name":"daemonsets","type":"\u0019\u001bk8s.daemonset","title":"DaemonSets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"deployments":{"name":"deployments","type":"\u0019\u001bk8s.deployment","title":"Deployments in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpointSlices":{"name":"endpointSlices","type":"\u0019\u001bk8s.endpointslice","title":"EndpointSlices in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"enforcesPodSecurity":{"name":"enforcesPodSecurity","type":"\u0004","title":"Whether the namespace enforces a non-privileged Pod Security Standards level (baseline or restricted)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"horizontalPodAutoscalers":{"name":"horizontalPodAutoscalers","type":"\u0019\u001bk8s.horizontalpodautoscaler","title":"HorizontalPodAutoscalers in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingresses":{"name":"ingresses","type":"\u0019\u001bk8s.ingress","title":"Ingresses in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"jobs":{"name":"jobs","type":"\u0019\u001bk8s.job","title":"Jobs in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"limitRanges":{"name":"limitRanges","type":"\u0019\u001bk8s.limitrange","title":"LimitRanges in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposures in this namespace","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkPolicies":{"name":"networkPolicies","type":"\u0019\u001bk8s.networkpolicy","title":"NetworkPolicies in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkPolicyCoverages":{"name":"networkPolicyCoverages","type":"\u0019\u001bk8s.networkPolicyCoverage","title":"Normalized network policy coverage summaries in this namespace","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentVolumeClaims":{"name":"persistentVolumeClaims","type":"\u0019\u001bk8s.persistentvolumeclaim","title":"PersistentVolumeClaims in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podDisruptionBudgets":{"name":"podDisruptionBudgets","type":"\u0019\u001bk8s.poddisruptionbudget","title":"PodDisruptionBudgets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityAudit":{"name":"podSecurityAudit","type":"\u0007","title":"Pod Security Standards level audited on this namespace","desc":"Value of the `pod-security.kubernetes.io/audit` label (privileged, baseline, or restricted). Violations are recorded in the audit log but not blocked. Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityAuditVersion":{"name":"podSecurityAuditVersion","type":"\u0007","title":"Pod Security Standards version pinned for auditing","desc":"Value of the `pod-security.kubernetes.io/audit-version` label. Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityEnforce":{"name":"podSecurityEnforce","type":"\u0007","title":"Pod Security Standards level enforced on this namespace","desc":"Value of the `pod-security.kubernetes.io/enforce` label (privileged, baseline, or restricted). Empty when the namespace opts out of Pod Security admission enforcement, in which case violating pods are still admitted.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityEnforceVersion":{"name":"podSecurityEnforceVersion","type":"\u0007","title":"Pod Security Standards version pinned for enforcement","desc":"Value of the `pod-security.kubernetes.io/enforce-version` label (a Kubernetes minor version like \"v1.30\" or \"latest\"). Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityWarn":{"name":"podSecurityWarn","type":"\u0007","title":"Pod Security Standards level warned on this namespace","desc":"Value of the `pod-security.kubernetes.io/warn` label (privileged, baseline, or restricted). Violations return a client warning but are not blocked. Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityWarnVersion":{"name":"podSecurityWarnVersion","type":"\u0007","title":"Pod Security Standards version pinned for warnings","desc":"Value of the `pod-security.kubernetes.io/warn-version` label. Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicasets":{"name":"replicasets","type":"\u0019\u001bk8s.replicaset","title":"ReplicaSets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceQuotas":{"name":"resourceQuotas","type":"\u0019\u001bk8s.resourcequota","title":"ResourceQuotas in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rolebindings":{"name":"rolebindings","type":"\u0019\u001bk8s.rbac.rolebinding","title":"RBAC RoleBindings in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roles":{"name":"roles","type":"\u0019\u001bk8s.rbac.role","title":"RBAC Roles in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secrets":{"name":"secrets","type":"\u0019\u001bk8s.secret","title":"Secrets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceaccounts":{"name":"serviceaccounts","type":"\u0019\u001bk8s.serviceaccount","title":"ServiceAccounts in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"services":{"name":"services","type":"\u0019\u001bk8s.service","title":"Services in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"statefulsets":{"name":"statefulsets","type":"\u0019\u001bk8s.statefulset","title":"StatefulSets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes namespace","desc":"Namespace that partitions a cluster into isolated scopes, selected by name. The workload accessors (pods, deployments, statefulsets, daemonsets, replicasets, jobs, cronjobs) and the services, ingresses, endpointSlices, and networkPolicies accessors return only the objects in this namespace, while secrets, configmaps, serviceaccounts, persistentVolumeClaims, roles, and rolebindings cover its configuration, identity, storage, and RBAC. The podSecurityEnforce, podSecurityAudit, and podSecurityWarn fields (with their version companions) report the Pod Security Standards level applied by Pod Security admission.","private":true,"min_provider_version":"9.0.0","defaults":"name created","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.networkExposure":{"id":"k8s.networkExposure","name":"k8s.networkExposure","fields":{"addresses":{"name":"addresses","type":"\u0019\u0007","is_mandatory":true,"title":"Published IPs or hostnames","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"confidence":{"name":"confidence","type":"\u0007","is_mandatory":true,"title":"Static-analysis confidence: high, medium, or low","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"exposureReason":{"name":"exposureReason","type":"\u0007","is_mandatory":true,"title":"Classification reason, for example publicLoadBalancerAddress, nodePortPublicNode, publicIngressAddress, or gatewayPublicAddress","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"internetExposed":{"name":"internetExposed","type":"\u0004","is_mandatory":true,"title":"Whether this exposure appears reachable from the public Internet","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"metadataClassification":{"name":"metadataClassification","type":"\u0007","is_mandatory":true,"title":"Explicit classification metadata from source object annotations or labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Source name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Source namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"network":{"name":"network","type":"\u0007","is_mandatory":true,"title":"Network associated with the exposure when HBN intent is available","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkClassifications":{"name":"networkClassifications","type":"\u0019\u0007","is_mandatory":true,"title":"Network classifications such as internet, private, hostname, restrictedSourceRange, or internalOnly","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Explicit owner metadata from source object annotations or labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods behind this exposure, resolved through the source Service, Ingress, or Gateway","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyCoverage":{"name":"policyCoverage","type":"\u0019\u0007","is_mandatory":true,"title":"Policy coverage identifiers associated with the exposure","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Published ports with protocol and optional name metadata","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"protocols":{"name":"protocols","type":"\u0019\u0007","is_mandatory":true,"title":"Published protocols such as TCP, UDP, HTTP, HTTPS, or TLS","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"routes":{"name":"routes","type":"\u0019\u0007","is_mandatory":true,"title":"Route identifiers associated with the exposure when HBN intent is available","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sourceKind":{"name":"sourceKind","type":"\u0007","is_mandatory":true,"title":"Source kind that produced the exposure, for example Service, Ingress, Gateway, Pod (hostNetwork or hostPort), HBNInbound, or LegacyHBN","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sourceRef":{"name":"sourceRef","type":"\u0007","is_mandatory":true,"title":"Source object reference in kind:namespace:name or kind:name form","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF associated with the exposure when HBN intent is available","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Normalized Kubernetes network exposure","desc":"Represents an inbound exposure signal from Kubernetes Services, Ingresses, Gateway API resources, and HBN/network intent sources when they are available. The `confidence` field describes static-analysis confidence, not packet-level reachability.","private":true,"min_provider_version":"13.3.2","defaults":"sourceKind namespace name internetExposed exposureReason","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.networkPolicyCoverage":{"id":"k8s.networkPolicyCoverage","name":"k8s.networkPolicyCoverage","fields":{"adminDefaultDenyEgress":{"name":"adminDefaultDenyEgress","type":"\u0004","is_mandatory":true,"title":"Whether admin network policy coverage supplies egress catch-all deny semantics","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"adminDefaultDenyIngress":{"name":"adminDefaultDenyIngress","type":"\u0004","is_mandatory":true,"title":"Whether admin network policy coverage supplies ingress catch-all deny semantics","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"adminNetworkPolicies":{"name":"adminNetworkPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"Kubernetes AdminNetworkPolicy and BaselineAdminNetworkPolicy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"calicoPolicies":{"name":"calicoPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"Calico policy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ciliumPolicies":{"name":"ciliumPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"Cilium policy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"coverageGaps":{"name":"coverageGaps","type":"\u0019\u0007","is_mandatory":true,"title":"Coverage gaps that should be shown to users","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"defaultDenyEgress":{"name":"defaultDenyEgress","type":"\u0004","is_mandatory":true,"title":"Whether selected pods have egress default-deny semantics","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"defaultDenyIngress":{"name":"defaultDenyIngress","type":"\u0004","is_mandatory":true,"title":"Whether selected pods have ingress default-deny semantics","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"interfaces":{"name":"interfaces","type":"\u0019\u0007","is_mandatory":true,"title":"Interfaces covered by this summary, for example primary or secondary network names","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"multiNetworkPolicies":{"name":"multiNetworkPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"MultiNetworkPolicy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Policy namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nativeNetworkPolicies":{"name":"nativeNetworkPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"Native Kubernetes NetworkPolicy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSelector":{"name":"podSelector","type":"\n","is_mandatory":true,"title":"Pod selector covered by the policy","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyRef":{"name":"policyRef","type":"\u0007","is_mandatory":true,"title":"Policy object reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secondaryInterfaceEgressCovered":{"name":"secondaryInterfaceEgressCovered","type":"\u0004","is_mandatory":true,"title":"Whether secondary interface egress is covered","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secondaryInterfaceIngressCovered":{"name":"secondaryInterfaceIngressCovered","type":"\u0004","is_mandatory":true,"title":"Whether secondary interface ingress is covered","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"workloadRef":{"name":"workloadRef","type":"\u0007","is_mandatory":true,"title":"Workload reference when coverage is tied to a specific workload","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Normalized Kubernetes network policy coverage","desc":"Represents policy coverage for a workload selector and network interfaces. Native Kubernetes NetworkPolicy applies to primary pod networking unless the CNI explicitly extends it; secondary-interface policy coverage is tracked separately through MultiNetworkPolicy and compatible integrations.","private":true,"min_provider_version":"13.3.2","defaults":"namespace policyRef defaultDenyIngress defaultDenyEgress","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.networkpolicy":{"id":"k8s.networkpolicy","name":"k8s.networkpolicy","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"coverage":{"name":"coverage","type":"\u001bk8s.networkPolicyCoverage","title":"Normalized policy coverage summary for this NetworkPolicy","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"egress":{"name":"egress","type":"\u0019\n","title":"Egress rules; each rule lists `to` peers and `ports`","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingress":{"name":"ingress","type":"\u0019\n","title":"Ingress rules; each rule lists `from` peers and `ports`","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSelector":{"name":"podSelector","type":"\n","title":"Label selector for pods this policy applies to (empty selects all pods in the namespace)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyTypes":{"name":"policyTypes","type":"\u0019\u0007","title":"Policy types in effect (Ingress and/or Egress)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"Network policy spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Network Policy","desc":"Rule set that controls allowed network traffic to and from pods, selected by namespace and name. The podSelector field chooses the pods the policy governs, policyTypes reports whether ingress, egress, or both are restricted, and the ingress and egress fields list the permitted peers and ports. Pods selected by a policy deny all traffic not explicitly allowed by these rules.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.node":{"id":"k8s.node","name":"k8s.node","fields":{"addresses":{"name":"addresses","type":"\u0019\u001bk8s.nodeAddress","title":"Node network addresses (e.g., InternalIP, ExternalIP, Hostname)","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allocatable":{"name":"allocatable","type":"\n","title":"Resources available for scheduling pods on the node","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"architecture":{"name":"architecture","type":"\u0007","title":"CPU architecture reported by the kubelet (e.g., amd64, arm64)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"capacity":{"name":"capacity","type":"\n","title":"Total resources available on the node (e.g., cpu, memory, pods)","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\u001bk8s.nodeCondition","title":"Node health conditions (e.g., Ready, MemoryPressure, DiskPressure)","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerRuntimeVersion":{"name":"containerRuntimeVersion","type":"\u0007","title":"Container runtime version (e.g., containerd://1.7.20)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","min_provider_version":"11.1.42","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"images":{"name":"images","type":"\u0019\n","title":"Container images present on the node (names + sizeBytes)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kernelVersion":{"name":"kernelVersion","type":"\u0007","title":"Kernel version reported by the kubelet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kubeletPort":{"name":"kubeletPort","type":"\u0005","is_mandatory":true,"title":"Kubelet port","min_provider_version":"11.1.42","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kubeletVersion":{"name":"kubeletVersion","type":"\u0007","title":"Kubelet version","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plural name of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeInfo":{"name":"nodeInfo","type":"\n","title":"Node configuration information","min_provider_version":"11.1.42","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"operatingSystem":{"name":"operatingSystem","type":"\u0007","title":"Operating system reported by the kubelet (e.g., linux, windows)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"osImage":{"name":"osImage","type":"\u0007","title":"OS image reported by the kubelet (e.g., \"Ubuntu 22.04.5 LTS\")","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podCIDR":{"name":"podCIDR","type":"\u0007","title":"CIDR range assigned to pods on this node (legacy single-CIDR field)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podCIDRs":{"name":"podCIDRs","type":"\u0019\u0007","title":"CIDR ranges assigned to pods on this node (one per IP family)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"providerID":{"name":"providerID","type":"\u0007","title":"Cloud-provider node identifier (e.g., aws:///us-east-1a/i-0123456789abcdef0)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"taints":{"name":"taints","type":"\u0019\u001bk8s.nodeTaint","title":"Node taints for pod scheduling","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unschedulable":{"name":"unschedulable","type":"\u0004","title":"Whether the node is marked as unschedulable (cordoned)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumesAttached":{"name":"volumesAttached","type":"\u0019\n","title":"Volumes currently attached to the node","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumesInUse":{"name":"volumesInUse","type":"\u0019\u0007","title":"Names of volumes currently in use by pods on the node","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes node","desc":"Worker or control-plane machine that runs pods, selected by name. The capacity and allocatable fields report total and schedulable resources, conditions surfaces health signals such as Ready and MemoryPressure, taints lists the scheduling restrictions pods must tolerate, and addresses holds the node's hostnames and IPs. The osImage, kernelVersion, kubeletVersion, containerRuntimeVersion, operatingSystem, and architecture fields report the node's software stack, and unschedulable reports whether the node is cordoned.","private":true,"min_provider_version":"9.0.0","defaults":"name labels['kubernetes.io/arch'] labels['kubernetes.io/os'] ","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.nodeAddress":{"id":"k8s.nodeAddress","name":"k8s.nodeAddress","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Node address value","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Address type (Hostname, ExternalIP, InternalIP, ExternalDNS, InternalDNS)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes node address","private":true,"min_provider_version":"11.1.139","defaults":"type address","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.nodeCondition":{"id":"k8s.nodeCondition","name":"k8s.nodeCondition","fields":{"lastHeartbeatTime":{"name":"lastHeartbeatTime","type":"\t","is_mandatory":true,"title":"Last time the condition was updated","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastTransitionTime":{"name":"lastTransitionTime","type":"\t","is_mandatory":true,"title":"Last time the condition transitioned between statuses","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"message":{"name":"message","type":"\u0007","is_mandatory":true,"title":"Human-readable message with details about the last transition","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reason":{"name":"reason","type":"\u0007","is_mandatory":true,"title":"Brief machine-readable reason for the condition's last transition","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Condition status (True, False, Unknown)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Condition type (Ready, MemoryPressure, DiskPressure, PIDPressure, NetworkUnavailable)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes node condition","private":true,"min_provider_version":"11.1.139","defaults":"type status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.nodeTaint":{"id":"k8s.nodeTaint","name":"k8s.nodeTaint","fields":{"effect":{"name":"effect","type":"\u0007","is_mandatory":true,"title":"Taint effect (NoSchedule, PreferNoSchedule, NoExecute)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Taint key that pods must tolerate to be scheduled on the node","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"timeAdded":{"name":"timeAdded","type":"\t","is_mandatory":true,"title":"Time the taint was added","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Taint value (optional) that pods must match alongside the key","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes node taint","private":true,"min_provider_version":"11.1.139","defaults":"key value effect","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ownerReference":{"id":"k8s.ownerReference","name":"k8s.ownerReference","fields":{"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"API version of the referent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"blockOwnerDeletion":{"name":"blockOwnerDeletion","type":"\u0004","is_mandatory":true,"title":"Whether the referent blocks foreground cascading deletion","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"controller":{"name":"controller","type":"\u0004","is_mandatory":true,"title":"Whether the referent is the managing controller","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind of the referent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the referent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"UID of the referent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes owner reference","desc":"Examine the controller or parent object that owns this object, as recorded in metadata.ownerReferences: the referent's apiVersion, kind, name, and uid, whether it is the managing controller, and whether it blocks foreground cascading deletion. Correlate uid against the uid of any modeled object to trace provenance and ownership chains across the cluster.","private":true,"min_provider_version":"13.2.2","defaults":"kind name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.persistentvolume":{"id":"k8s.persistentvolume","name":"k8s.persistentvolume","fields":{"accessModes":{"name":"accessModes","type":"\u0019\u0007","title":"Access modes the volume supports (ReadWriteOnce, ReadOnlyMany, ReadWriteMany, ReadWriteOncePod)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"capacity":{"name":"capacity","type":"\u001a\u0007\u0007","title":"Total capacity of the volume (resource name -\u003e quantity string, e.g., {storage: \"100Gi\"})","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"claim":{"name":"claim","type":"\u001bk8s.persistentvolumeclaim","title":"The PVC bound to this volume (null if unbound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"claimName":{"name":"claimName","type":"\u0007","title":"Name of the PVC bound to this volume (null if unbound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"claimNamespace":{"name":"claimNamespace","type":"\u0007","title":"Namespace of the PVC bound to this volume (null if unbound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"message":{"name":"message","type":"\u0007","title":"Human-readable message about the current phase","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountOptions":{"name":"mountOptions","type":"\u0019\u0007","title":"Mount options propagated to volume mounts","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeAffinity":{"name":"nodeAffinity","type":"\n","title":"Node-affinity constraints that gate where this volume can be attached","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentVolumeReclaimPolicy":{"name":"persistentVolumeReclaimPolicy","type":"\u0007","title":"Reclaim policy when the bound claim is released (Retain, Delete, Recycle)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"phase":{"name":"phase","type":"\u0007","title":"Current phase (Pending, Available, Bound, Released, Failed)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reason":{"name":"reason","type":"\u0007","title":"Reason for the current phase (e.g., why Failed)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"PersistentVolume spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\n","title":"PersistentVolume status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClass":{"name":"storageClass","type":"\u001bk8s.storageclass","title":"The StorageClass that backs this volume (null if storageClassName is empty)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClassName":{"name":"storageClassName","type":"\u0007","title":"Name of the StorageClass that backs this volume","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMode":{"name":"volumeMode","type":"\u0007","title":"Volume mode (Filesystem or Block)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes PersistentVolume","desc":"Cluster-wide piece of storage provisioned for use by pods, selected by name. The capacity, accessModes, volumeMode, and storageClass fields describe the volume's size and capabilities, persistentVolumeReclaimPolicy governs what happens when its claim is released, and phase reports its lifecycle state (Available, Bound, Released, or Failed). The claim field returns the PersistentVolumeClaim currently bound to the volume.","private":true,"min_provider_version":"11.1.139","defaults":"name capacity['storage'] phase storageClassName created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.persistentvolumeclaim":{"id":"k8s.persistentvolumeclaim","name":"k8s.persistentvolumeclaim","fields":{"accessModes":{"name":"accessModes","type":"\u0019\u0007","title":"Access modes the claim requires (ReadWriteOnce, ReadOnlyMany, ReadWriteMany, ReadWriteOncePod)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"boundAccessModes":{"name":"boundAccessModes","type":"\u0019\u0007","title":"Access modes the bound volume actually provides","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"capacity":{"name":"capacity","type":"\u001a\u0007\u0007","title":"Actual capacity of the bound volume (resource name -\u003e quantity string)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions (Resizing, FileSystemResizePending, etc.)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dataSource":{"name":"dataSource","type":"\n","title":"Data source for populating the volume (snapshot, PVC, custom resource)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dataSourceRef":{"name":"dataSourceRef","type":"\n","title":"Typed data-source ref (allows cross-namespace refs and arbitrary kinds)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"phase":{"name":"phase","type":"\u0007","title":"Current phase (Pending, Bound, Lost)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\n","title":"Resource requirements (requests, limits keyed by resource name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector for preexisting PVs eligible to satisfy the claim","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"PersistentVolumeClaim spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\n","title":"PersistentVolumeClaim status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClass":{"name":"storageClass","type":"\u001bk8s.storageclass","title":"The StorageClass requested by the claim (null if storageClassName is empty)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClassName":{"name":"storageClassName","type":"\u0007","title":"Name of the StorageClass requested by the claim","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volume":{"name":"volume","type":"\u001bk8s.persistentvolume","title":"The PV the claim is bound to (null if unbound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMode":{"name":"volumeMode","type":"\u0007","title":"Volume mode (Filesystem or Block)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeName":{"name":"volumeName","type":"\u0007","title":"Name of the PV the claim is bound to (empty until bound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes PersistentVolumeClaim","desc":"Request for storage by a pod, selected by namespace and name. The accessModes, resources, storageClass, and volumeMode fields describe the storage requested, volume and volumeName identify the bound PersistentVolume, and phase reports whether the claim is Pending, Bound, or Lost. The capacity and boundAccessModes fields report what the bound volume actually provides.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name phase capacity['storage'] storageClassName created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.pod":{"id":"k8s.pod","name":"k8s.pod","fields":{"activeDeadlineSeconds":{"name":"activeDeadlineSeconds","type":"\u0005","title":"Maximum number of seconds the pod may run before being terminated","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"affinity":{"name":"affinity","type":"\n","title":"Node, pod, and pod anti-affinity rules","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes object version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Pod-level status conditions (PodScheduled, ContainersReady, Initialized, Ready)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerStatuses":{"name":"containerStatuses","type":"\u0019\u001bk8s.containerStatus","title":"Container statuses","min_provider_version":"11.1.110","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"daemonSet":{"name":"daemonSet","type":"\u001bk8s.daemonset","title":"DaemonSet that owns this pod (null if not owned by one)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"deployment":{"name":"deployment","type":"\u001bk8s.deployment","title":"Deployment that owns this pod via its ReplicaSet (null if not part of a deployment-managed rollout)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dnsConfig":{"name":"dnsConfig","type":"\n","title":"DNS configuration when dnsPolicy is None (nameservers, searches, options)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dnsPolicy":{"name":"dnsPolicy","type":"\u0007","title":"DNS policy (ClusterFirst, ClusterFirstWithHostNet, Default, None)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"enableServiceLinks":{"name":"enableServiceLinks","type":"\u0004","title":"Whether environment variables for active services are injected into containers","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ephemeralContainers":{"name":"ephemeralContainers","type":"\u0019\u001bk8s.ephemeralContainer","title":"Ephemeral containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"escapesNetworkPolicy":{"name":"escapesNetworkPolicy","type":"\u0004","title":"Whether NetworkPolicy does not apply to this pod","desc":"True when the pod uses host networking, so Kubernetes NetworkPolicy governs neither its ingress nor its egress traffic. Such pods are a coverage gap for any default-deny posture.","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"exposures":{"name":"exposures","type":"\u0019\u001bk8s.networkExposure","title":"Network exposures that route to this pod through a Service, Ingress, or Gateway","min_provider_version":"13.3.4","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasImageDigestDrift":{"name":"hasImageDigestDrift","type":"\u0004","title":"Whether a running image has drifted from its spec reference","desc":"True when a container's spec references a mutable tag (not a digest) but the kubelet resolved it to a concrete digest, so a restart or reschedule could silently pull a different image for that tag.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostAliases":{"name":"hostAliases","type":"\u0019\n","title":"Host alias entries added to /etc/hosts","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIP":{"name":"hostIP","type":"\u0007","title":"IP address of the host the pod is running on","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostname":{"name":"hostname","type":"\u0007","title":"Pod hostname (defaults to metadata.name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullSecrets":{"name":"imagePullSecrets","type":"\u0019\n","title":"References to image-pull secrets in the same namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"job":{"name":"job","type":"\u001bk8s.job","title":"Job that owns this pod (null if not owned by one)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"message":{"name":"message","type":"\u0007","title":"Human-readable message about the pod's current phase","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"node":{"name":"node","type":"\u001bk8s.node","title":"Node the pod runs on","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeName":{"name":"nodeName","type":"\u0007","title":"Name of the node the pod is bound to","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeSelector":{"name":"nodeSelector","type":"\u001a\u0007\u0007","title":"Required node labels for scheduling this pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nominatedNodeName":{"name":"nominatedNodeName","type":"\u0007","title":"Name of the node selected by the scheduler for preemption (when applicable)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"os":{"name":"os","type":"\n","title":"OS the pod runs on (e.g., {name: \"linux\"})","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"overhead":{"name":"overhead","type":"\u001a\u0007\u0007","title":"Resource overhead associated with the runtime (CPU, memory, etc.)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"phase":{"name":"phase","type":"\u0007","title":"Pod phase (Pending, Running, Succeeded, Failed, Unknown)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podIP":{"name":"podIP","type":"\u0007","title":"IP address allocated to the pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podIPs":{"name":"podIPs","type":"\u0019\u0007","title":"All IP addresses allocated to the pod (one per IP family)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"preemptionPolicy":{"name":"preemptionPolicy","type":"\u0007","title":"Preemption policy (PreemptLowerPriority or Never)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"priorityClass":{"name":"priorityClass","type":"\u001bk8s.priorityclass","title":"The PriorityClass that controls scheduling priority","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"priorityClassName":{"name":"priorityClassName","type":"\u0007","title":"Name of the PriorityClass that controls scheduling priority","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"qosClass":{"name":"qosClass","type":"\u0007","title":"Quality-of-Service class assigned to the pod (Guaranteed, Burstable, BestEffort)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readinessGates":{"name":"readinessGates","type":"\u0019\n","title":"Additional readiness gates the pod must satisfy before being marked ready","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reason":{"name":"reason","type":"\u0007","title":"Brief CamelCase reason for the pod's current phase","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicaSet":{"name":"replicaSet","type":"\u001bk8s.replicaset","title":"ReplicaSet that owns this pod (null if not owned by one)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"restartPolicy":{"name":"restartPolicy","type":"\u0007","title":"Restart policy for all containers (Always, OnFailure, Never)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runningImageDigests":{"name":"runningImageDigests","type":"\u0019\u0007","title":"Running image digests","desc":"Unique sha256 digests actually running in this pod, as resolved by the kubelet from container statuses. Carries a digest even when the spec used a mutable tag, so it reflects what is really executing rather than declared.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runtimeClassName":{"name":"runtimeClassName","type":"\u0007","title":"Name of the RuntimeClass that selects the container runtime","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"schedulerName":{"name":"schedulerName","type":"\u0007","title":"Name of the scheduler that handles this pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccount":{"name":"serviceAccount","type":"\u001bk8s.serviceaccount","title":"The ServiceAccount used to run the pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccountName":{"name":"serviceAccountName","type":"\u0007","title":"Name of the ServiceAccount used to run the pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"services":{"name":"services","type":"\u0019\u001bk8s.service","title":"Services whose label selector matches this pod","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"shareProcessNamespace":{"name":"shareProcessNamespace","type":"\u0004","title":"Whether containers in the pod share a single PID namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startTime":{"name":"startTime","type":"\t","title":"Time at which the pod was acknowledged by the kubelet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"statefulSet":{"name":"statefulSet","type":"\u001bk8s.statefulset","title":"StatefulSet that owns this pod (null if not owned by one)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subdomain":{"name":"subdomain","type":"\u0007","title":"Subdomain used to construct the pod's FQDN","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationGracePeriodSeconds":{"name":"terminationGracePeriodSeconds","type":"\u0005","title":"Grace period in seconds before forceful termination","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tolerations":{"name":"tolerations","type":"\u0019\n","title":"Node taints this pod tolerates","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"topologySpreadConstraints":{"name":"topologySpreadConstraints","type":"\u0019\n","title":"Topology spread constraints","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Pod","desc":"Smallest deployable unit, one or more co-scheduled containers sharing a network and storage context, selected by namespace and name. The containers, initContainers, and ephemeralContainers accessors expose the workload and its images, command, resources, and securityContext, while containerStatuses reports their runtime state. Scheduling is described by node, nodeSelector, tolerations, affinity, priorityClass, and serviceAccount; the host-namespace and security posture by hostNetwork, hostPID, hostIPC, and securityContext; and runtime status by phase, qosClass, podIP, and conditions. The owning controller is reached through replicaSet, statefulSet, daemonSet, job, and deployment.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.poddisruptionbudget":{"id":"k8s.poddisruptionbudget","name":"k8s.poddisruptionbudget","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Status conditions","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentHealthy":{"name":"currentHealthy","type":"\u0005","is_mandatory":true,"title":"Number of currently healthy pods","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredHealthy":{"name":"desiredHealthy","type":"\u0005","is_mandatory":true,"title":"Minimum number of healthy pods required","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"disruptionsAllowed":{"name":"disruptionsAllowed","type":"\u0005","is_mandatory":true,"title":"Number of pod disruptions currently allowed","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"expectedPods":{"name":"expectedPods","type":"\u0005","is_mandatory":true,"title":"Total number of pods counted by this PDB","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"maxUnavailable":{"name":"maxUnavailable","type":"\n","is_mandatory":true,"title":"Maximum number or percentage of pods that may be unavailable (IntOrString)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minAvailable":{"name":"minAvailable","type":"\n","is_mandatory":true,"title":"Minimum number or percentage of pods that must remain available (IntOrString)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","is_mandatory":true,"title":"Generation of the most recently observed PDB spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","is_mandatory":true,"title":"Label selector for the pods this PDB protects","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unhealthyPodEvictionPolicy":{"name":"unhealthyPodEvictionPolicy","type":"\u0007","is_mandatory":true,"title":"Policy for evicting unhealthy pods (IfHealthyBudget or AlwaysAllow)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes PodDisruptionBudget","desc":"Policy that limits how many pods of a workload may be down at once during voluntary disruptions, selected by namespace and name. The minAvailable and maxUnavailable fields set the budget, selector chooses the protected pods, and unhealthyPodEvictionPolicy governs eviction of unhealthy pods. Current state is reported by currentHealthy, desiredHealthy, expectedPods, and disruptionsAllowed.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.priorityclass":{"id":"k8s.priorityclass","name":"k8s.priorityclass","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Arbitrary text description of this priority class","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"globalDefault":{"name":"globalDefault","type":"\u0004","is_mandatory":true,"title":"Whether this priority class is the global default","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"preemptionPolicy":{"name":"preemptionPolicy","type":"\u0007","is_mandatory":true,"title":"Preemption policy (PreemptLowerPriority or Never)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"value":{"name":"value","type":"\u0005","is_mandatory":true,"title":"The value of this priority class (higher is more important)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes PriorityClass","desc":"Named scheduling priority that pods can request, selected by name. The value field sets the integer priority used during scheduling and preemption, globalDefault marks the class applied to pods that request none, and preemptionPolicy controls whether higher-priority pods may evict lower-priority ones.","private":true,"min_provider_version":"11.1.139","defaults":"name value","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac":{"id":"k8s.rbac","fields":{"clusterrole":{"name":"clusterrole","type":"\u001bk8s.rbac.clusterrole","title":"Kubernetes ClusterRole","desc":"Cluster-wide set of RBAC permissions, selected by name. The rules field lists the API groups, resources, and verbs the role grants, aggregationRule describes how the role aggregates other ClusterRoles by label, and boundBy returns the ClusterRoleBindings that grant this role to subjects.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"clusterrolebinding":{"name":"clusterrolebinding","type":"\u001bk8s.rbac.clusterrolebinding","title":"Kubernetes ClusterRoleBinding","desc":"Grant that binds a ClusterRole to a set of subjects cluster-wide, selected by name. The subjects field lists the users, groups, and service accounts the role is granted to, serviceAccounts resolves the service-account subjects to their objects, and clusterRole returns the ClusterRole named by roleRef.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"policyRule":{"name":"policyRule","type":"\u001bk8s.rbac.policyRule","title":"Kubernetes RBAC policy rule","desc":"Single grant from the rules list of a Role or ClusterRole, combining the verbs, apiGroups, resources, resourceNames, and nonResourceURLs that together determine which actions a subject bound to the role may perform.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"role":{"name":"role","type":"\u001bk8s.rbac.role","title":"Kubernetes Role","desc":"Namespaced set of RBAC permissions, selected by namespace and name. The rules field lists the API groups, resources, and verbs the role grants within its namespace, and boundBy returns the RoleBindings that grant this role to subjects.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"rolebinding":{"name":"rolebinding","type":"\u001bk8s.rbac.rolebinding","title":"Kubernetes RoleBinding","desc":"Grant that binds a Role or ClusterRole to subjects within a namespace, selected by namespace and name. The subjects field lists the users, groups, and service accounts the permissions are granted to, serviceAccounts resolves the service-account subjects to their objects, and role or clusterRole returns the object named by roleRef depending on its kind.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"subject":{"name":"subject","type":"\u001bk8s.rbac.subject","title":"RBAC subject and its effective cluster permissions","desc":"A single user, group, or service account named as a subject in at least one RoleBinding or ClusterRoleBinding, with the permissions of every bound Role and ClusterRole folded into one view of what the subject is allowed to do. The kind, name, and namespace fields identify the subject (namespace is set only for service accounts), serviceAccount resolves a ServiceAccount subject to its object, and roleBindings and clusterRoleBindings list the grants that name the subject. The isClusterAdmin, canEscalatePrivileges, canReadSecrets, and hasWildcardPermissions predicates summarize the most security-relevant capabilities the bound roles confer. Enumerate every subject in the cluster through k8s.rbacSubjects, or find the subjects allowed a specific action with k8s.rbac.whoCan.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"whoCan":{"name":"whoCan","type":"\u001bk8s.rbac.whoCan","title":"RBAC subjects permitted to perform an action","desc":"Resolution of which users, groups, and service accounts the cluster's RoleBindings and ClusterRoleBindings allow to perform a given action, computed from the rules of the granted roles. The verb and resource arguments select the action, group narrows it to an API group (empty for the core group), namespace restricts the check to one namespace (empty considers every namespace), and name targets a specific object. For example, `k8s.rbac.whoCan(verb: \"list\", resource: \"secrets\").subjects` lists every subject that can read Secrets across the cluster. The result reflects RBAC grants only and does not account for the node or webhook authorizers; pair it with k8s.accessReview for an authoritative per-subject decision from the API server.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true}},"is_extension":true},"k8s.rbac.clusterrole":{"id":"k8s.rbac.clusterrole","name":"k8s.rbac.clusterrole","fields":{"aggregationRule":{"name":"aggregationRule","type":"\n","is_mandatory":true,"title":"ClusterRole aggregation rule","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether any rule grants RBAC privilege escalation","desc":"True when a rule allows the `escalate` or `bind` verb on RBAC roles or bindings, or the `impersonate` verb on users, groups, or service accounts — the canonical ways a subject can grant itself more privileges than it currently holds. Wildcard verbs/resources/apiGroups that cover those permissions also count.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"boundBy":{"name":"boundBy","type":"\u0019\u001bk8s.rbac.clusterrolebinding","title":"ClusterRoleBindings that reference this ClusterRole via roleRef","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether any rule grants read access (get, list, or watch) to Secrets","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grantsClusterAdmin":{"name":"grantsClusterAdmin","type":"\u0004","title":"Whether any rule grants unrestricted access (wildcard verbs, API groups, and resources), i.e. cluster-admin","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardRule":{"name":"hasWildcardRule","type":"\u0004","title":"Whether any rule uses a wildcard (\"*\") for verbs, API groups, or resources","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyRules":{"name":"policyRules","type":"\u0019\u001bk8s.rbac.policyRule","title":"Access rules as typed policy-rule resources (a structured view of `rules`)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"ClusterRole rules","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ClusterRole","desc":"Cluster-wide set of RBAC permissions, selected by name. The rules field lists the API groups, resources, and verbs the role grants, aggregationRule describes how the role aggregates other ClusterRoles by label, and boundBy returns the ClusterRoleBindings that grant this role to subjects.","private":true,"min_provider_version":"9.0.0","defaults":"name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.clusterrolebinding":{"id":"k8s.rbac.clusterrolebinding","name":"k8s.rbac.clusterrolebinding","fields":{"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether the granted ClusterRole allows RBAC privilege escalation (escalate/bind/impersonate)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether the granted ClusterRole can read Secrets (get, list, or watch)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterRole":{"name":"clusterRole","type":"\u001bk8s.rbac.clusterrole","title":"The ClusterRole granted by this binding (roleRef.name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grantsClusterAdmin":{"name":"grantsClusterAdmin","type":"\u0004","title":"Whether the granted ClusterRole confers cluster-admin (wildcard verbs, API groups, and resources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardRule":{"name":"hasWildcardRule","type":"\u0004","title":"Whether the granted ClusterRole has any wildcard rule","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roleRef":{"name":"roleRef","type":"\n","is_mandatory":true,"title":"ClusterRole in the global namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccounts":{"name":"serviceAccounts","type":"\u0019\u001bk8s.serviceaccount","title":"ServiceAccounts referenced as subjects (entries where kind == \"ServiceAccount\" resolved to typed resources)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subjects":{"name":"subjects","type":"\u0019\n","is_mandatory":true,"title":"References to the objects the role applies to","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ClusterRoleBinding","desc":"Grant that binds a ClusterRole to a set of subjects cluster-wide, selected by name. The subjects field lists the users, groups, and service accounts the role is granted to, serviceAccounts resolves the service-account subjects to their objects, and clusterRole returns the ClusterRole named by roleRef.","private":true,"min_provider_version":"9.0.0","defaults":"name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.policyRule":{"id":"k8s.rbac.policyRule","name":"k8s.rbac.policyRule","fields":{"apiGroups":{"name":"apiGroups","type":"\u0019\u0007","is_mandatory":true,"title":"API groups the rule applies to (\"\" is the core group; \"*\" matches all)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nonResourceURLs":{"name":"nonResourceURLs","type":"\u0019\u0007","is_mandatory":true,"title":"Non-resource URLs the rule grants access to (e.g., /healthz; mutually exclusive with resources)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceNames":{"name":"resourceNames","type":"\u0019\u0007","is_mandatory":true,"title":"Object names the rule is restricted to (empty means all objects of the listed resources)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\u0019\u0007","is_mandatory":true,"title":"Resources the rule applies to (e.g., pods, secrets; \"*\" matches all; may include subresources like pods/exec)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"verbs":{"name":"verbs","type":"\u0019\u0007","is_mandatory":true,"title":"Verbs that apply to the listed resources or non-resource URLs (e.g., get, list, watch, create; \"*\" matches all)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes RBAC policy rule","desc":"Single grant from the rules list of a Role or ClusterRole, combining the verbs, apiGroups, resources, resourceNames, and nonResourceURLs that together determine which actions a subject bound to the role may perform.","private":true,"min_provider_version":"13.2.2","defaults":"verbs apiGroups resources","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.role":{"id":"k8s.rbac.role","name":"k8s.rbac.role","fields":{"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether any rule grants RBAC privilege escalation","desc":"True when a rule allows the `escalate` or `bind` verb on RBAC roles or bindings, or the `impersonate` verb on users, groups, or service accounts — the canonical ways a subject can grant itself more privileges than it currently holds. Wildcard verbs/resources/apiGroups that cover those permissions also count.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"boundBy":{"name":"boundBy","type":"\u0019\u001bk8s.rbac.rolebinding","title":"RoleBindings in this namespace that reference this Role via roleRef","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether any rule grants read access (get, list, or watch) to Secrets","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grantsClusterAdmin":{"name":"grantsClusterAdmin","type":"\u0004","title":"Whether any rule grants unrestricted access (wildcard verbs, API groups, and resources), i.e. cluster-admin","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardRule":{"name":"hasWildcardRule","type":"\u0004","title":"Whether any rule uses a wildcard (\"*\") for verbs, API groups, or resources","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyRules":{"name":"policyRules","type":"\u0019\u001bk8s.rbac.policyRule","title":"Access rules as typed policy-rule resources (a structured view of `rules`)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Role rules defining the permissions granted within this namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Role","desc":"Namespaced set of RBAC permissions, selected by namespace and name. The rules field lists the API groups, resources, and verbs the role grants within its namespace, and boundBy returns the RoleBindings that grant this role to subjects.","private":true,"min_provider_version":"9.0.0","defaults":"name namespace","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.rolebinding":{"id":"k8s.rbac.rolebinding","name":"k8s.rbac.rolebinding","fields":{"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether the granted role allows RBAC privilege escalation (escalate/bind/impersonate)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether the granted role can read Secrets (get, list, or watch)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterRole":{"name":"clusterRole","type":"\u001bk8s.rbac.clusterrole","title":"The ClusterRole granted by this binding (null when roleRef points to a Role)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grantsClusterAdmin":{"name":"grantsClusterAdmin","type":"\u0004","title":"Whether the granted role confers cluster-admin (wildcard verbs, API groups, and resources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardRule":{"name":"hasWildcardRule","type":"\u0004","title":"Whether the granted role has any wildcard rule","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"role":{"name":"role","type":"\u001bk8s.rbac.role","title":"The Role granted by this binding (null when roleRef points to a ClusterRole)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roleRef":{"name":"roleRef","type":"\n","is_mandatory":true,"title":"RoleRef can only reference a ClusterRole in the global namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccounts":{"name":"serviceAccounts","type":"\u0019\u001bk8s.serviceaccount","title":"ServiceAccounts referenced as subjects (entries where kind == \"ServiceAccount\" resolved to typed resources)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subjects":{"name":"subjects","type":"\u0019\n","is_mandatory":true,"title":"Subjects holds references to the objects the role applies to","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes RoleBinding","desc":"Grant that binds a Role or ClusterRole to subjects within a namespace, selected by namespace and name. The subjects field lists the users, groups, and service accounts the permissions are granted to, serviceAccounts resolves the service-account subjects to their objects, and role or clusterRole returns the object named by roleRef depending on its kind.","private":true,"min_provider_version":"9.0.0","defaults":"name namespace created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.subject":{"id":"k8s.rbac.subject","name":"k8s.rbac.subject","fields":{"canEscalatePrivileges":{"name":"canEscalatePrivileges","type":"\u0004","title":"Whether any bound role allows RBAC privilege escalation (escalate, bind, or impersonate)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether any bound role can read Secrets (get, list, or watch)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterRoleBindings":{"name":"clusterRoleBindings","type":"\u0019\u001bk8s.rbac.clusterrolebinding","title":"ClusterRoleBindings that name this subject","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardPermissions":{"name":"hasWildcardPermissions","type":"\u0004","title":"Whether any bound role has a wildcard rule (wildcard verbs, API groups, or resources)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isClusterAdmin":{"name":"isClusterAdmin","type":"\u0004","title":"Whether any bound role confers cluster-admin (wildcard verbs, API groups, and resources)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Subject kind: User, Group, or ServiceAccount","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Subject name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace of a service account subject (empty for users and groups)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roleBindings":{"name":"roleBindings","type":"\u0019\u001bk8s.rbac.rolebinding","title":"RoleBindings that name this subject","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccount":{"name":"serviceAccount","type":"\u001bk8s.serviceaccount","title":"ServiceAccount object for a service account subject (null for users and groups)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"RBAC subject and its effective cluster permissions","desc":"A single user, group, or service account named as a subject in at least one RoleBinding or ClusterRoleBinding, with the permissions of every bound Role and ClusterRole folded into one view of what the subject is allowed to do. The kind, name, and namespace fields identify the subject (namespace is set only for service accounts), serviceAccount resolves a ServiceAccount subject to its object, and roleBindings and clusterRoleBindings list the grants that name the subject. The isClusterAdmin, canEscalatePrivileges, canReadSecrets, and hasWildcardPermissions predicates summarize the most security-relevant capabilities the bound roles confer. Enumerate every subject in the cluster through k8s.rbacSubjects, or find the subjects allowed a specific action with k8s.rbac.whoCan.","private":true,"min_provider_version":"13.3.1","defaults":"kind name namespace isClusterAdmin","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.whoCan":{"id":"k8s.rbac.whoCan","name":"k8s.rbac.whoCan","fields":{"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"API group of the resource (empty for the core group)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Specific object name the action targets (empty matches any object)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace the action is checked in (empty considers every namespace)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resource":{"name":"resource","type":"\u0007","is_mandatory":true,"title":"Resource type the action targets (secrets, pods, and so on)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subjects":{"name":"subjects","type":"\u0019\u001bk8s.rbac.subject","title":"Subjects whose bound roles allow the action","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"verb":{"name":"verb","type":"\u0007","is_mandatory":true,"title":"Kubernetes API verb the action requires (get, list, create, delete, and so on)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"init":{"args":[{"name":"verb","type":"\u0007"},{"name":"resource","type":"\u0007"},{"name":"group","type":"\u0007"},{"name":"namespace","type":"\u0007"},{"name":"name","type":"\u0007"}]},"title":"RBAC subjects permitted to perform an action","desc":"Resolution of which users, groups, and service accounts the cluster's RoleBindings and ClusterRoleBindings allow to perform a given action, computed from the rules of the granted roles. The verb and resource arguments select the action, group narrows it to an API group (empty for the core group), namespace restricts the check to one namespace (empty considers every namespace), and name targets a specific object. For example, `k8s.rbac.whoCan(verb: \"list\", resource: \"secrets\").subjects` lists every subject that can read Secrets across the cluster. The result reflects RBAC grants only and does not account for the node or webhook authorizers; pair it with k8s.accessReview for an authoritative per-subject decision from the API server.","private":true,"min_provider_version":"13.3.1","defaults":"verb resource namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.referencegrant":{"id":"k8s.referencegrant","name":"k8s.referencegrant","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"from":{"name":"from","type":"\u0019\n","is_mandatory":true,"title":"Resources that are permitted to reference targets in this ReferenceGrant's namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"to":{"name":"to","type":"\u0019\n","is_mandatory":true,"title":"Resources in this namespace that may be referenced","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API ReferenceGrant","desc":"Gateway API grant that permits cross-namespace references into its namespace, selected by namespace and name. The from field lists the resource kinds and namespaces allowed to make references, and the to field lists the resource kinds in this namespace they may reference, letting routes and other objects point at targets they would otherwise be denied.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.replicaset":{"id":"k8s.replicaset","name":"k8s.replicaset","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"availableReplicas":{"name":"availableReplicas","type":"\u0005","title":"Number of pods available for at least minReadySeconds","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions (ReplicaFailure)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredReplicas":{"name":"desiredReplicas","type":"\u0005","title":"Number of pods requested by the ReplicaSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"fullyLabeledReplicas":{"name":"fullyLabeledReplicas","type":"\u0005","title":"Number of pods whose labels match the selector and have been fully labeled","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReadySeconds":{"name":"minReadySeconds","type":"\u0005","title":"Minimum seconds a newly created pod must be ready without crashes to be considered available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this ReplicaSet (label-selector match)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readyReplicas":{"name":"readyReplicas","type":"\u0005","title":"Number of ready pods","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicas":{"name":"replicas","type":"\u0005","title":"Total non-terminated pods observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this ReplicaSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ReplicaSet","desc":"Controller that maintains a stable set of replica pods, usually owned by a Deployment, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers, the target count comes from desiredReplicas and selector, and the observed state is reported by replicas, readyReplicas, availableReplicas, fullyLabeledReplicas, and conditions. The pods field returns the pods the ReplicaSet owns.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name desiredReplicas readyReplicas created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.resourcequota":{"id":"k8s.resourcequota","name":"k8s.resourcequota","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hard":{"name":"hard","type":"\u001a\u0007\u0007","title":"Hard limits enforced by the quota (resource name -\u003e quantity string)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scopeSelector":{"name":"scopeSelector","type":"\n","title":"Scope selector for fine-grained scope matching (operators on scope names)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scopes":{"name":"scopes","type":"\u0019\u0007","title":"Scopes to which the quota applies (e.g., Terminating, NotTerminating, BestEffort, NotBestEffort, PriorityClass, CrossNamespacePodAffinity)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"ResourceQuota spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\n","title":"ResourceQuota status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"used":{"name":"used","type":"\u001a\u0007\u0007","title":"Current usage observed against the quota (resource name -\u003e quantity string)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ResourceQuota","desc":"Constraint on the aggregate resource consumption of a namespace, selected by namespace and name. The hard field lists the enforced limits (such as CPU, memory, and object counts) and used reports current consumption against them. The scopes and scopeSelector fields narrow which objects the quota applies to.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.secret":{"id":"k8s.secret","name":"k8s.secret","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificateExpiry":{"name":"certificateExpiry","type":"\t","title":"Earliest expiry among the secret's TLS certificates","desc":"The notAfter of the soonest-expiring certificate in the tls.crt chain, so a single comparison covers the whole chain. Null when the secret holds no certificate.","min_provider_version":"13.3.4","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificates":{"name":"certificates","type":"\u0019\u001bcertificate","title":"Secret certificates","min_provider_version":"9.0.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasExpiredCertificate":{"name":"hasExpiredCertificate","type":"\u0004","title":"Whether the secret holds a TLS certificate that has expired","min_provider_version":"13.3.4","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isImagePullSecret":{"name":"isImagePullSecret","type":"\u0004","title":"Whether this is an image-pull Secret (type kubernetes.io/dockercfg or kubernetes.io/dockerconfigjson)","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isServiceAccountToken":{"name":"isServiceAccountToken","type":"\u0004","title":"Whether this is a service account token Secret (type kubernetes.io/service-account-token)","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isUnused":{"name":"isUnused","type":"\u0004","title":"Whether no pod and no service account reference this Secret","desc":"True when no pod consumes the Secret through a volume, environment variable, or image-pull reference, and no service account lists it among its tokens or image-pull secrets. A signal for orphaned credentials.","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Secret type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usedBy":{"name":"usedBy","type":"\u0019\u001bk8s.pod","title":"Pods that reference this Secret through volumes, env, envFrom, or imagePullSecrets","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Secret","desc":"Object that holds sensitive data such as passwords, tokens, and keys, selected by namespace and name. The type field reports the secret's purpose (for example kubernetes.io/tls or kubernetes.io/dockerconfigjson), certificates parses any X.509 certificates the secret carries, and usedBy returns the pods that consume the secret through volumes, environment variables, or image-pull references.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.service":{"id":"k8s.service","name":"k8s.service","fields":{"allocateLoadBalancerNodePorts":{"name":"allocateLoadBalancerNodePorts","type":"\u0004","title":"Whether node ports are automatically allocated for type LoadBalancer","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterIP":{"name":"clusterIP","type":"\u0007","title":"ClusterIP assigned to the service","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterIPs":{"name":"clusterIPs","type":"\u0019\u0007","title":"All cluster IPs allocated to the service (one per IP family)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpointSlices":{"name":"endpointSlices","type":"\u0019\u001bk8s.endpointslice","title":"EndpointSlices that back this service (filtered by the kubernetes.io/service-name label)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalEndpoints":{"name":"externalEndpoints","type":"\u0019\u0007","title":"Backend endpoint addresses that are not in-cluster pods","desc":"Addresses from the service's EndpointSlices whose endpoints have no Pod targetRef, so the service forwards to manually managed targets that are often outside the cluster. Empty for an ordinary selector-backed service.","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalIPs":{"name":"externalIPs","type":"\u0019\u0007","title":"External IPs through which the service is exposed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalName":{"name":"externalName","type":"\u0007","title":"External name the service maps to (for type ExternalName)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalTrafficPolicy":{"name":"externalTrafficPolicy","type":"\u0007","title":"External traffic policy (Cluster or Local)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"healthCheckNodePort":{"name":"healthCheckNodePort","type":"\u0005","title":"Port that the LoadBalancer's health-check uses (type LoadBalancer with Local externalTrafficPolicy)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"internalTrafficPolicy":{"name":"internalTrafficPolicy","type":"\u0007","title":"Internal traffic policy (Cluster or Local)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ipFamilies":{"name":"ipFamilies","type":"\u0019\u0007","title":"IP families backing the service (IPv4, IPv6)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ipFamilyPolicy":{"name":"ipFamilyPolicy","type":"\u0007","title":"IP family policy (SingleStack, PreferDualStack, RequireDualStack)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerClass":{"name":"loadBalancerClass","type":"\u0007","title":"Name of the load-balancer implementation that backs the service","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerIP":{"name":"loadBalancerIP","type":"\u0007","title":"Pre-allocated IP requested for the load balancer (deprecated in newer Kubernetes versions)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerIngress":{"name":"loadBalancerIngress","type":"\u0019\n","title":"Load-balancer ingress entries published in status (ip, hostname, ports)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerSourceRanges":{"name":"loadBalancerSourceRanges","type":"\u0019\u0007","title":"CIDRs allowed to reach the load balancer","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposure records for this Service","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods selected by the service's label selector (empty for selectorless and ExternalName services)","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","title":"Service ports (port, targetPort, protocol, nodePort, name, appProtocol)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"publishNotReadyAddresses":{"name":"publishNotReadyAddresses","type":"\u0004","title":"Whether DNS records are published for not-yet-ready endpoints","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"routesToPublicEndpoint":{"name":"routesToPublicEndpoint","type":"\u0004","title":"Whether the service forwards to a public, non-pod endpoint address","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\u001a\u0007\u0007","title":"Label selector for pods that back the service","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sessionAffinity":{"name":"sessionAffinity","type":"\u0007","title":"Session affinity (ClientIP or None)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sessionAffinityConfig":{"name":"sessionAffinityConfig","type":"\n","title":"Session affinity configuration (clientIP timeout)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"Service Spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"type":{"name":"type","type":"\u0007","title":"Service type (ClusterIP, NodePort, LoadBalancer, ExternalName)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Service","desc":"Stable network endpoint that load-balances traffic to a set of pods, selected by namespace and name. The type field distinguishes ClusterIP, NodePort, LoadBalancer, and ExternalName services; clusterIP, externalIPs, loadBalancerIngress, and ports report the addresses and ports it exposes; and selector identifies the backing pods. Traffic and affinity behavior is governed by externalTrafficPolicy, internalTrafficPolicy, and sessionAffinity, and endpointSlices returns the slices listing the current backing endpoints.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.serviceaccount":{"id":"k8s.serviceaccount","name":"k8s.serviceaccount","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","is_mandatory":true,"title":"Whether pods running as this service account should have an API token automatically mounted","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canEscalatePrivileges":{"name":"canEscalatePrivileges","type":"\u0004","title":"Whether any bound role allows RBAC privilege escalation (escalate/bind/impersonate)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether any bound role can read Secrets (get, list, or watch)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterRoleBindings":{"name":"clusterRoleBindings","type":"\u0019\u001bk8s.rbac.clusterrolebinding","title":"ClusterRoleBindings that grant this service account a cluster role","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardPermissions":{"name":"hasWildcardPermissions","type":"\u0004","title":"Whether any bound role has a wildcard rule (wildcard verbs, API groups, or resources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullSecrets":{"name":"imagePullSecrets","type":"\u0019\n","is_mandatory":true,"title":"List of references to secrets in the same namespace to use for pulling any images","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isClusterAdmin":{"name":"isClusterAdmin","type":"\u0004","title":"Whether any bound role confers cluster-admin (wildcard verbs, API groups, and resources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roleBindings":{"name":"roleBindings","type":"\u0019\u001bk8s.rbac.rolebinding","title":"RoleBindings in this namespace that grant this service account a role","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secrets":{"name":"secrets","type":"\u0019\n","is_mandatory":true,"title":"List of secrets that Pods running using this service account are allowed to use","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes service account","desc":"Identity that pods use to authenticate to the API server, selected by namespace and name. The secrets and imagePullSecrets fields list the tokens and registry credentials associated with the account, and automountServiceAccountToken reports whether its API token is mounted into pods by default.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.statefulset":{"id":"k8s.statefulset","name":"k8s.statefulset","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"availableReplicas":{"name":"availableReplicas","type":"\u0005","title":"Number of pods available for at least minReadySeconds","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"collisionCount":{"name":"collisionCount","type":"\u0005","title":"Count of ControllerRevision name hash collisions handled by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentReplicas":{"name":"currentReplicas","type":"\u0005","title":"Number of pods running the spec's current revision","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentRevision":{"name":"currentRevision","type":"\u0007","title":"Revision hash of the StatefulSet's current configuration","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredReplicas":{"name":"desiredReplicas","type":"\u0005","title":"Number of pods requested by the StatefulSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReadySeconds":{"name":"minReadySeconds","type":"\u0005","title":"Minimum seconds a newly created pod must be ready without crashes to be considered available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ordinalsStart":{"name":"ordinalsStart","type":"\u0005","title":"Starting ordinal for the StatefulSet's pod indices (defaults to 0)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentVolumeClaimRetentionPolicy":{"name":"persistentVolumeClaimRetentionPolicy","type":"\n","title":"Retention policy for PVCs across StatefulSet scale-down and deletion","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podManagementPolicy":{"name":"podManagementPolicy","type":"\u0007","title":"Pod management policy (OrderedReady or Parallel)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this StatefulSet (label-selector match)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readyReplicas":{"name":"readyReplicas","type":"\u0005","title":"Number of ready pods","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicas":{"name":"replicas","type":"\u0005","title":"Total non-terminated pods observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"revisionHistoryLimit":{"name":"revisionHistoryLimit","type":"\u0005","title":"Number of old ControllerRevisions retained to allow rollback","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this StatefulSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceName":{"name":"serviceName","type":"\u0007","title":"Name of the governing headless service for the StatefulSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updateRevision":{"name":"updateRevision","type":"\u0007","title":"Revision hash of the StatefulSet's update configuration","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updateStrategy":{"name":"updateStrategy","type":"\n","title":"Update strategy (OnDelete or RollingUpdate with partition/maxUnavailable)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updatedReplicas":{"name":"updatedReplicas","type":"\u0005","title":"Number of pods updated to the spec's update revision","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes StatefulSet","desc":"Controller that manages pods with stable identities and persistent storage, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; identity and ordering are governed by serviceName, podManagementPolicy, ordinalsStart, and updateStrategy; and persistentVolumeClaimRetentionPolicy controls whether per-pod volumes survive scale-down. Rollout state is reported by replicas, readyReplicas, currentReplicas, updatedReplicas, currentRevision, updateRevision, and conditions, and the pods field returns the backing pods.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name desiredReplicas readyReplicas created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.storageclass":{"id":"k8s.storageclass","name":"k8s.storageclass","fields":{"allowVolumeExpansion":{"name":"allowVolumeExpansion","type":"\u0004","is_mandatory":true,"title":"Whether the storage class allows volume expansion","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountOptions":{"name":"mountOptions","type":"\u0019\u0007","title":"Mount options for PersistentVolumes dynamically created by this storage class","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parameters":{"name":"parameters","type":"\u001a\u0007\u0007","title":"StorageClass parameters for the provisioner","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"provisioner":{"name":"provisioner","type":"\u0007","is_mandatory":true,"title":"Provisioner indicates the type of the provisioner","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reclaimPolicy":{"name":"reclaimPolicy","type":"\u0007","is_mandatory":true,"title":"Reclaim policy (Delete, Retain, or Recycle)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeBindingMode":{"name":"volumeBindingMode","type":"\u0007","is_mandatory":true,"title":"Volume binding mode (Immediate or WaitForFirstConsumer)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes StorageClass","desc":"Template that describes how volumes are dynamically provisioned, selected by name. The provisioner field names the plugin that creates volumes, parameters carries the provisioner-specific settings, and reclaimPolicy, volumeBindingMode, and allowVolumeExpansion govern reclamation, binding timing, and whether bound volumes may grow.","private":true,"min_provider_version":"11.1.139","defaults":"name provisioner","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.tcproute":{"id":"k8s.tcproute","name":"k8s.tcproute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames this route should respond to, empty for TCPRoute","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Parent resources this route is associated with (Gateways, Services, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Status of the route per parent reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Rules describing matches, filters, and backend forwarding","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API TCPRoute","desc":"Gateway API rules that route raw TCP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it and rules describes the backend forwarding applied to connections; TCPRoute does not match on hostnames. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.3.2","defaults":"namespace name created","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.tlsroute":{"id":"k8s.tlsroute","name":"k8s.tlsroute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames this route should respond to","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Parent resources this route is associated with (Gateways, Services, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Status of the route per parent reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Rules describing matches, filters, and backend forwarding","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API TLSRoute","desc":"Gateway API rules that route TLS traffic from Gateways to backend services by SNI hostname without terminating the connection, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it, hostnames narrows the route to specific SNI hosts, and rules describes the backend forwarding applied to connections. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.3.2","defaults":"namespace name created","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.udproute":{"id":"k8s.udproute","name":"k8s.udproute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames this route should respond to, empty for UDPRoute","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Parent resources this route is associated with (Gateways, Services, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Status of the route per parent reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Rules describing matches, filters, and backend forwarding","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API UDPRoute","desc":"Gateway API rules that route raw UDP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it and rules describes the backend forwarding applied to datagrams; UDPRoute does not match on hostnames. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.3.2","defaults":"namespace name created","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.userinfo":{"id":"k8s.userinfo","name":"k8s.userinfo","fields":{"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"The UID of the user","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"The username of the user","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes UserInfo","private":true,"min_provider_version":"9.0.0","defaults":"username","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"dependencies":{"network":{"id":"go.mondoo.com/mql/v13/providers/network","name":"network"},"os":{"id":"go.mondoo.com/mql/v13/providers/os","name":"os"}}}