{"resources":{"k8s":{"id":"k8s","name":"k8s","fields":{"accessReview":{"name":"accessReview","type":"\u001bk8s.accessReview","title":"Authoritative RBAC access check","desc":"Answers, via the Kubernetes API server's SubjectAccessReview, whether a subject may perform a verb on a resource. Unlike the rule-derived RBAC rollups, this folds in aggregated ClusterRoles, group bindings, and built-in roles. Requires a live cluster connection; on a manifest scan the result fields error. Construct it with the action under test, for example k8s.accessReview(subject: \"system:serviceaccount:prod:web\", verb: \"create\", resource: \"pods\") or k8s.accessReview(subject: \"alice\", verb: \"get\", resource: \"secrets\", namespace: \"prod\").","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"admission":{"name":"admission","type":"\u001bk8s.admission","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"admissionrequest":{"name":"admissionrequest","type":"\u001bk8s.admissionrequest","title":"Kubernetes AdmissionRequest","desc":"AdmissionRequest that a dynamic admission webhook is asked to evaluate, carrying the operation being attempted, the requesting user, and the target name and namespace, along with the object being admitted and, for UPDATE and DELETE, its prior state. Policies read it to decide whether to admit a request, for example rejecting a privileged pod or an image pulled from an untrusted registry.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"admissionreview":{"name":"admissionreview","type":"\u001bk8s.admissionreview","title":"Kubernetes AdmissionReview","desc":"AdmissionReview that an admission controller is being asked to evaluate. The `request` field exposes the embedded `k8s.admissionrequest`: the operation, requesting user, target namespace, the incoming object, and (for UPDATE/DELETE) the prior object. This resource is populated when MQL is invoked from inside a dynamic admission webhook so policies can decide whether to admit the request.","provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"apiResources":{"name":"apiResources","type":"\u0019\u001bk8s.apiresource","title":"Available resource types","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"apiServices":{"name":"apiServices","type":"\u0019\u001bk8s.apiservice","title":"Kubernetes APIServices (aggregation layer)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"apiresource":{"name":"apiresource","type":"\u001bk8s.apiresource","title":"Kubernetes API resource type","desc":"Resource type the API server advertises through discovery, selected by its plural name and kind. The group and version report the preferred API path, namespaced indicates whether instances are scoped to a namespace, and shortNames and categories list the kubectl aliases and groupings (such as \"all\") the type belongs to.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"apiservice":{"name":"apiservice","type":"\u001bk8s.apiservice","title":"Kubernetes APIService (aggregation layer)","desc":"Registration that adds an API group and version to the cluster through the aggregation layer, selected by name. The group and version fields name the API the registration serves, serviceName and serviceNamespace identify the backend that handles it (reached through service, or empty when served by kube-apiserver itself), and caBundle and insecureSkipTLSVerify govern how the API server trusts that backend. The conditions field reports whether the API is available.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"app":{"name":"app","type":"\u001bk8s.app","title":"Kubernetes Application","desc":"Logical application reconstructed from the recommended app.kubernetes.io labels shared across a group of objects. The name, version, and instance fields identify the application, managedBy names the tool that operates it (such as helm), partOf names a larger application it belongs to, and components lists the architectural pieces (such as database, cache, or frontend) discovered for it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"apps":{"name":"apps","type":"\u0019\u001bk8s.app","title":"Kubernetes applications","min_provider_version":"11.1.75","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificateSigningRequests":{"name":"certificateSigningRequests","type":"\u0019\u001bk8s.certificatesigningrequest","title":"Kubernetes CertificateSigningRequests","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificatesigningrequest":{"name":"certificatesigningrequest","type":"\u001bk8s.certificatesigningrequest","title":"Kubernetes CertificateSigningRequest","desc":"Request for a certificate to be issued by a cluster signer, selected by name. The request field carries the PEM-encoded certificate signing request, signerName names the signer that should handle it, and usages and expirationSeconds state the requested key usages and lifetime. The username, groups, and requesterUid fields identify the requester, conditions reports approval state, and certificate holds the issued certificate once signed.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"clusterrolebindings":{"name":"clusterrolebindings","type":"\u0019\u001bk8s.rbac.clusterrolebinding","title":"Kubernetes RBAC ClusterRoleBindings","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterroles":{"name":"clusterroles","type":"\u0019\u001bk8s.rbac.clusterrole","title":"Kubernetes RBAC ClusterRoles","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"configmap":{"name":"configmap","type":"\u001bk8s.configmap","title":"Kubernetes ConfigMap","desc":"Object that holds non-confidential configuration as key-value pairs, selected by namespace and name. The data field exposes the stored configuration entries, and usedBy returns the pods that consume the ConfigMap through volumes, environment variables, or envFrom.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"configmaps":{"name":"configmaps","type":"\u0019\u001bk8s.configmap","title":"ConfigMaps","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"container":{"name":"container","type":"\u001bk8s.container","title":"Kubernetes workload container","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"containerStatus":{"name":"containerStatus","type":"\u001bk8s.containerStatus","title":"Kubernetes container status","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"context":{"name":"context","type":"\u001bk8s.context","title":"Kubernetes manifest source context","desc":"Source location and raw text of a resource declared in a manifest file: the file path, the line range it spans, and the manifest text within that range. Points a reviewer at the exact source of a flagged resource. Available only for manifest-file scans; empty for live-cluster and admission connections.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"cronjob":{"name":"cronjob","type":"\u001bk8s.cronjob","title":"Kubernetes CronJob","desc":"Controller that creates Jobs on a repeating schedule, selected by namespace and name. The schedule and timeZone fields define when jobs run, concurrencyPolicy, startingDeadlineSeconds, and suspend govern execution, and successfulJobsHistoryLimit and failedJobsHistoryLimit control how many finished jobs are retained. The activeJobs field returns the jobs currently running, jobs returns every job the CronJob still owns, and the shared pod template is available through podSpec, containers, and initContainers.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"cronjobs":{"name":"cronjobs","type":"\u0019\u001bk8s.cronjob","title":"Cluster CronJobs","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"customresource":{"name":"customresource","type":"\u001bk8s.customresource","title":"Kubernetes CustomResource","desc":"Instance of a custom resource defined by a CustomResourceDefinition, selected by namespace and name. The kind field reports the custom type and manifest exposes the object's full content, so custom API extensions can be queried alongside built-in Kubernetes objects.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"customresources":{"name":"customresources","type":"\u0019\u001bk8s.customresource","title":"Kubernetes custom resources","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"daemonset":{"name":"daemonset","type":"\u001bk8s.daemonset","title":"Kubernetes DaemonSet","desc":"Controller that runs one copy of a pod on every matching node, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers, the rollout is governed by updateStrategy and revisionHistoryLimit, and scheduling coverage is reported by desiredNumberScheduled, currentNumberScheduled, numberReady, numberAvailable, numberMisscheduled, and updatedNumberScheduled. The pods field returns the daemon pods currently running.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"daemonsets":{"name":"daemonsets","type":"\u0019\u001bk8s.daemonset","title":"Cluster DaemonSets","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"deployment":{"name":"deployment","type":"\u001bk8s.deployment","title":"Kubernetes Deployment","desc":"Controller that manages a replicated, declaratively updated set of pods through ReplicaSets, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; the rollout is governed by desiredReplicas, strategy, paused, and revisionHistoryLimit; and the current rollout state is reported by replicas, readyReplicas, availableReplicas, updatedReplicas, unavailableReplicas, and conditions. The pods field returns the pods currently backing the deployment.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"deployments":{"name":"deployments","type":"\u0019\u001bk8s.deployment","title":"Cluster deployments","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"egressNat":{"name":"egressNat","type":"\u001bk8s.egressNat","title":"Normalized Kubernetes egress NAT","desc":"Represents NAT intent or observed compiled NAT state from Coil Egress, Calico IPPool, HBN, and compatible network integrations. Kubernetes-only clusters without those integrations expose an empty list.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"egressNats":{"name":"egressNats","type":"\u0019\u001bk8s.egressNat","title":"Normalized egress NAT entries from HBN/network intent sources","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"egressRoute":{"name":"egressRoute","type":"\u001bk8s.egressRoute","title":"Normalized Kubernetes egress route","desc":"Represents egress routing intent or observed compiled routing state from HBN network CRDs, Coil Egress resources, and compatible integrations. Kubernetes-only clusters without those integrations expose an empty list.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"egressRoutes":{"name":"egressRoutes","type":"\u0019\u001bk8s.egressRoute","title":"Normalized egress routes from HBN/network intent sources","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpointSlices":{"name":"endpointSlices","type":"\u0019\u001bk8s.endpointslice","title":"Kubernetes EndpointSlices","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpointslice":{"name":"endpointslice","type":"\u001bk8s.endpointslice","title":"Kubernetes EndpointSlice","desc":"Scalable list of network endpoints that back a Service, selected by namespace and name. The addressType field reports whether the slice holds IPv4, IPv6, or FQDN endpoints, endpoints lists the backing addresses and their readiness, ports lists the ports they expose, and service returns the Service the slice belongs to.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ephemeralContainer":{"name":"ephemeralContainer","type":"\u001bk8s.ephemeralContainer","title":"Kubernetes ephemeral container","desc":"Temporary container added to a running pod for interactive debugging, exposing the same image, command, security context, and volume mounts a permanent container would. Because an ephemeral container is injected into an existing pod and shares that pod's namespaces, its privileges, capabilities, and mounts are worth auditing: an over-permissioned debug container is a path to inspecting or tampering with the workloads it runs alongside. The `name` field identifies the container within its pod.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"gateway":{"name":"gateway","type":"\u001bk8s.gateway","title":"Kubernetes Gateway API Gateway","desc":"Gateway API object that configures how external traffic enters the cluster, selected by namespace and name. The gatewayClass field selects the implementing controller, listeners defines the ports, protocols, and hostnames the Gateway accepts, and addresses requests specific entry addresses. The statusAddresses and listenerStatus fields report the addresses the controller assigned and the routes attached to each listener.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"gatewayClasses":{"name":"gatewayClasses","type":"\u0019\u001bk8s.gatewayclass","title":"Kubernetes Gateway API GatewayClasses","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"gatewayclass":{"name":"gatewayclass","type":"\u001bk8s.gatewayclass","title":"Kubernetes Gateway API GatewayClass","desc":"Gateway API template that ties Gateways to a controller implementation, selected by name. The controllerName field names the controller that manages Gateways of this class, parametersRef points to a controller-specific configuration resource, and conditions reports whether the class has been accepted.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"gateways":{"name":"gateways","type":"\u0019\u001bk8s.gateway","title":"Kubernetes Gateway API Gateways","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grpcRoutes":{"name":"grpcRoutes","type":"\u0019\u001bk8s.grpcroute","title":"Kubernetes Gateway API GRPCRoutes","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grpcroute":{"name":"grpcroute","type":"\u001bk8s.grpcroute","title":"Kubernetes Gateway API GRPCRoute","desc":"Gateway API rules that route gRPC traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways or Services that delegate to it, hostnames narrows the route to specific hosts, and rules describes the method matches, filters, and backend forwarding applied to requests. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"horizontalPodAutoscalers":{"name":"horizontalPodAutoscalers","type":"\u0019\u001bk8s.horizontalpodautoscaler","title":"Kubernetes HorizontalPodAutoscalers","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"horizontalpodautoscaler":{"name":"horizontalpodautoscaler","type":"\u001bk8s.horizontalpodautoscaler","title":"Kubernetes HorizontalPodAutoscaler","desc":"Controller that scales a workload's replica count to meet observed metrics, selected by namespace and name. The scaleTargetKind and scaleTargetName fields identify the scaled workload (reached through scaleTargetDeployment, scaleTargetStatefulSet, or scaleTargetReplicaSet), minReplicas and maxReplicas bound the replica count, and metrics and behavior define the targets and scaling policies. Current state is reported by currentReplicas, desiredReplicas, currentMetrics, lastScaleTime, and conditions.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"httpRoutes":{"name":"httpRoutes","type":"\u0019\u001bk8s.httproute","title":"Kubernetes Gateway API HTTPRoutes","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"httproute":{"name":"httproute","type":"\u001bk8s.httproute","title":"Kubernetes Gateway API HTTPRoute","desc":"Gateway API rules that route HTTP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways or Services that delegate to it, hostnames narrows the route to specific hosts, and rules describes the matches, filters, and backend forwarding applied to requests. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingress":{"name":"ingress","type":"\u001bk8s.ingress","title":"Kubernetes Ingress","desc":"HTTP and HTTPS routing rules that expose Services to traffic from outside the cluster, selected by namespace and name. The rules field maps hostnames and paths to backend services, tls lists the hostnames and certificates terminated by the ingress, and ingressClass identifies the controller that implements the rules. The loadBalancerIngress field reports the addresses the controller has assigned.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressClasses":{"name":"ingressClasses","type":"\u0019\u001bk8s.ingressclass","title":"Kubernetes IngressClasses","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingressbackend":{"name":"ingressbackend","type":"\u001bk8s.ingressbackend","title":"Kubernetes Ingress backend","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressclass":{"name":"ingressclass","type":"\u001bk8s.ingressclass","title":"Kubernetes IngressClass","desc":"Template that ties Ingress objects to a controller implementation, selected by name. The controller field names the controller that handles ingresses of this class, and parameters points to a controller-specific configuration resource that tunes its behavior.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingresses":{"name":"ingresses","type":"\u0019\u001bk8s.ingress","title":"Kubernetes Ingresses","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingresshttprulepath":{"name":"ingresshttprulepath","type":"\u001bk8s.ingresshttprulepath","title":"Kubernetes Ingress HTTP rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressresourceref":{"name":"ingressresourceref","type":"\u001bk8s.ingressresourceref","title":"Kubernetes Ingress resource backend","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressrule":{"name":"ingressrule","type":"\u001bk8s.ingressrule","title":"Kubernetes Ingress rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingressservicebackend":{"name":"ingressservicebackend","type":"\u001bk8s.ingressservicebackend","title":"Kubernetes Ingress service backend","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"ingresstls":{"name":"ingresstls","type":"\u001bk8s.ingresstls","title":"Kubernetes Ingress TLS termination","desc":"TLS settings for a single entry in an Ingress spec, pairing the hostnames served over HTTPS with the certificate material resolved from the referenced TLS Secret. The hosts field lists the names the certificate is expected to cover, and certificates exposes the parsed certificate data so you can audit expiry, issuer, key strength, and hostname coverage for traffic terminated at the ingress.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"initContainer":{"name":"initContainer","type":"\u001bk8s.initContainer","title":"Kubernetes init container","desc":"Init container defined on a pod, run to completion in sequence before the pod's application containers start. Init containers commonly perform setup work such as fetching secrets, running migrations, or waiting on dependencies, so they frequently mount sensitive volumes and may request elevated privileges. Their security posture is queryable through the same fields as application containers, including securityContext, privileged, runAsNonRoot, and addedCapabilities. An init container whose restartPolicy is Always runs as a sidecar alongside the application containers rather than to completion.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"job":{"name":"job","type":"\u001bk8s.job","title":"Kubernetes Job","desc":"Controller that runs pods to completion, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; execution is governed by parallelism, completions, completionMode, backoffLimit, activeDeadlineSeconds, and suspend; and progress is reported by active, succeeded, failed, ready, startTime, completionTime, and conditions. The pods field returns the pods the job has created.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"jobs":{"name":"jobs","type":"\u0019\u001bk8s.job","title":"Cluster Jobs","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lease":{"name":"lease","type":"\u001bk8s.lease","title":"Kubernetes Lease (coordination.k8s.io)","desc":"Coordination object that backs leader election and node heartbeats, selected by namespace and name. The holderIdentity field names the current holder, leaseDurationSeconds and renewTime report how long the lease is held and when it was last renewed, and acquireTime and leaseTransitions track when it was acquired and how often it has changed hands.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"leases":{"name":"leases","type":"\u0019\u001bk8s.lease","title":"Kubernetes coordination Leases","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"limitRanges":{"name":"limitRanges","type":"\u0019\u001bk8s.limitrange","title":"Kubernetes LimitRanges","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"limitrange":{"name":"limitrange","type":"\u001bk8s.limitrange","title":"Kubernetes LimitRange","desc":"Policy that constrains resource requests and limits for objects in a namespace, selected by namespace and name. The limits field lists the default, minimum, and maximum values applied per object type (Container, Pod, or PersistentVolumeClaim), supplying defaults to objects that omit them and rejecting objects that fall outside the bounds.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"managedField":{"name":"managedField","type":"\u001bk8s.managedField","title":"Kubernetes managed field entry","desc":"Server-side-apply authorship record from an object's metadata.managedFields. Each record names the manager that owns a set of fields, the operation it used, and the apiVersion those fields are expressed in, so you can see which controller or tool last wrote each part of an object. The fieldsV1 set enumerates exactly which fields the manager owns.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"mutatingWebhookConfigurations":{"name":"mutatingWebhookConfigurations","type":"\u0019\u001bk8s.admission.mutatingwebhookconfiguration","title":"Kubernetes admission mutating webhook configurations","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u001bk8s.namespace","title":"Kubernetes namespace","desc":"Namespace that partitions a cluster into isolated scopes, selected by name. The workload accessors (pods, deployments, statefulsets, daemonsets, replicasets, jobs, cronjobs) and the services, ingresses, endpointSlices, and networkPolicies accessors return only the objects in this namespace, while secrets, configmaps, serviceaccounts, persistentVolumeClaims, roles, and rolebindings cover its configuration, identity, storage, and RBAC. The podSecurityEnforce, podSecurityAudit, and podSecurityWarn fields (with their version companions) report the Pod Security Standards level applied by Pod Security admission.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"namespaces":{"name":"namespaces","type":"\u0019\u001bk8s.namespace","title":"Cluster namespaces","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposure":{"name":"networkExposure","type":"\u001bk8s.networkExposure","title":"Normalized Kubernetes network exposure","desc":"Represents an inbound exposure signal from Kubernetes Services, Ingresses, Gateway API resources, and HBN/network intent sources when they are available. The `confidence` field describes static-analysis confidence, not packet-level reachability.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposures from Services, Ingresses, Gateways, and network intent sources","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkPolicies":{"name":"networkPolicies","type":"\u0019\u001bk8s.networkpolicy","title":"Kubernetes network policies","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkPolicyCoverage":{"name":"networkPolicyCoverage","type":"\u001bk8s.networkPolicyCoverage","title":"Normalized Kubernetes network policy coverage","desc":"Represents policy coverage for a workload selector and network interfaces. Native Kubernetes NetworkPolicy applies to primary pod networking unless the CNI explicitly extends it; secondary-interface policy coverage is tracked separately through MultiNetworkPolicy and compatible integrations.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"networkPolicyCoverages":{"name":"networkPolicyCoverages","type":"\u0019\u001bk8s.networkPolicyCoverage","title":"Normalized network policy coverage summaries","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkpolicy":{"name":"networkpolicy","type":"\u001bk8s.networkpolicy","title":"Kubernetes Network Policy","desc":"Rule set that controls allowed network traffic to and from pods, selected by namespace and name. The podSelector field chooses the pods the policy governs, policyTypes reports whether ingress, egress, or both are restricted, and the ingress and egress fields list the permitted peers and ports. Pods selected by a policy deny all traffic not explicitly allowed by these rules.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"node":{"name":"node","type":"\u001bk8s.node","title":"Kubernetes node","desc":"Worker or control-plane machine that runs pods, selected by name. The capacity and allocatable fields report total and schedulable resources, conditions surfaces health signals such as Ready and MemoryPressure, taints lists the scheduling restrictions pods must tolerate, and addresses holds the node's hostnames and IPs. The osImage, kernelVersion, kubeletVersion, containerRuntimeVersion, operatingSystem, and architecture fields report the node's software stack, and unschedulable reports whether the node is cordoned.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"nodeAddress":{"name":"nodeAddress","type":"\u001bk8s.nodeAddress","title":"Kubernetes node address","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"nodeCondition":{"name":"nodeCondition","type":"\u001bk8s.nodeCondition","title":"Kubernetes node condition","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"nodeTaint":{"name":"nodeTaint","type":"\u001bk8s.nodeTaint","title":"Kubernetes node taint","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"nodes":{"name":"nodes","type":"\u0019\u001bk8s.node","title":"Cluster nodes","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReference":{"name":"ownerReference","type":"\u001bk8s.ownerReference","title":"Kubernetes owner reference","desc":"Controller or parent object that owns this object, as recorded in metadata.ownerReferences. The referent is identified by apiVersion, kind, name, and uid, with flags for whether it is the managing controller and whether it blocks foreground cascading deletion. Correlate uid against the uid of any modeled object to trace provenance and ownership chains across the cluster.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"persistentVolumeClaims":{"name":"persistentVolumeClaims","type":"\u0019\u001bk8s.persistentvolumeclaim","title":"Kubernetes PersistentVolumeClaims","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentVolumes":{"name":"persistentVolumes","type":"\u0019\u001bk8s.persistentvolume","title":"Kubernetes PersistentVolumes","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentvolume":{"name":"persistentvolume","type":"\u001bk8s.persistentvolume","title":"Kubernetes PersistentVolume","desc":"Cluster-wide piece of storage provisioned for use by pods, selected by name. The capacity, accessModes, volumeMode, and storageClass fields describe the volume's size and capabilities, persistentVolumeReclaimPolicy governs what happens when its claim is released, and phase reports its lifecycle state (Available, Bound, Released, or Failed). The claim field returns the PersistentVolumeClaim currently bound to the volume.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"persistentvolumeclaim":{"name":"persistentvolumeclaim","type":"\u001bk8s.persistentvolumeclaim","title":"Kubernetes PersistentVolumeClaim","desc":"Request for storage by a pod, selected by namespace and name. The accessModes, resources, storageClass, and volumeMode fields describe the storage requested, volume and volumeName identify the bound PersistentVolume, and phase reports whether the claim is Pending, Bound, or Lost. The capacity and boundAccessModes fields report what the bound volume actually provides.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"pod":{"name":"pod","type":"\u001bk8s.pod","title":"Kubernetes Pod","desc":"Smallest deployable unit, one or more co-scheduled containers sharing a network and storage context, selected by namespace and name. The containers, initContainers, and ephemeralContainers accessors expose the workload and its images, command, resources, and securityContext, while containerStatuses reports their runtime state. Scheduling is described by node, nodeSelector, tolerations, affinity, priorityClass, and serviceAccount; the host-namespace and security posture by hostNetwork, hostPID, hostIPC, and securityContext; and runtime status by phase, qosClass, podIP, and conditions. The owning controller is reached through replicaSet, statefulSet, daemonSet, job, and deployment.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"podDisruptionBudgets":{"name":"podDisruptionBudgets","type":"\u0019\u001bk8s.poddisruptionbudget","title":"Kubernetes PodDisruptionBudgets","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"poddisruptionbudget":{"name":"poddisruptionbudget","type":"\u001bk8s.poddisruptionbudget","title":"Kubernetes PodDisruptionBudget","desc":"Policy that limits how many pods of a workload may be down at once during voluntary disruptions, selected by namespace and name. The minAvailable and maxUnavailable fields set the budget, selector chooses the protected pods, and unhealthyPodEvictionPolicy governs eviction of unhealthy pods. Current state is reported by currentHealthy, desiredHealthy, expectedPods, and disruptionsAllowed.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Cluster Pods","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"priorityClasses":{"name":"priorityClasses","type":"\u0019\u001bk8s.priorityclass","title":"Kubernetes PriorityClasses","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"priorityclass":{"name":"priorityclass","type":"\u001bk8s.priorityclass","title":"Kubernetes PriorityClass","desc":"Named scheduling priority that pods can request, selected by name. The value field sets the integer priority used during scheduling and preemption, globalDefault marks the class applied to pods that request none, and preemptionPolicy controls whether higher-priority pods may evict lower-priority ones.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"rbac":{"name":"rbac","type":"\u001bk8s.rbac","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"rbacSubjects":{"name":"rbacSubjects","type":"\u0019\u001bk8s.rbac.subject","title":"Distinct RBAC subjects with their effective cluster permissions","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"referenceGrants":{"name":"referenceGrants","type":"\u0019\u001bk8s.referencegrant","title":"Kubernetes Gateway API ReferenceGrants","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"referencegrant":{"name":"referencegrant","type":"\u001bk8s.referencegrant","title":"Kubernetes Gateway API ReferenceGrant","desc":"Gateway API grant that permits cross-namespace references into its namespace, selected by namespace and name. The from field lists the resource kinds and namespaces allowed to make references, and the to field lists the resource kinds in this namespace they may reference, letting routes and other objects point at targets they would otherwise be denied.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"replicaset":{"name":"replicaset","type":"\u001bk8s.replicaset","title":"Kubernetes ReplicaSet","desc":"Controller that maintains a stable set of replica pods, usually owned by a Deployment, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers, the target count comes from desiredReplicas and selector, and the observed state is reported by replicas, readyReplicas, availableReplicas, fullyLabeledReplicas, and conditions. The pods field returns the pods the ReplicaSet owns.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"replicasets":{"name":"replicasets","type":"\u0019\u001bk8s.replicaset","title":"Cluster ReplicaSets","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceQuotas":{"name":"resourceQuotas","type":"\u0019\u001bk8s.resourcequota","title":"Kubernetes ResourceQuotas","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourcequota":{"name":"resourcequota","type":"\u001bk8s.resourcequota","title":"Kubernetes ResourceQuota","desc":"Constraint on the aggregate resource consumption of a namespace, selected by namespace and name. The hard field lists the enforced limits (such as CPU, memory, and object counts) and used reports current consumption against them. The scopes and scopeSelector fields narrow which objects the quota applies to.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"rolebindings":{"name":"rolebindings","type":"\u0019\u001bk8s.rbac.rolebinding","title":"Kubernetes RBAC RoleBindings","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roles":{"name":"roles","type":"\u0019\u001bk8s.rbac.role","title":"Kubernetes RBAC roles","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secret":{"name":"secret","type":"\u001bk8s.secret","title":"Kubernetes Secret","desc":"Object that holds sensitive data such as passwords, tokens, and keys, selected by namespace and name. The type field reports the secret's purpose (for example kubernetes.io/tls or kubernetes.io/dockerconfigjson), certificates parses any X.509 certificates the secret carries, and usedBy returns the pods that consume the secret through volumes, environment variables, or image-pull references.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"secrets":{"name":"secrets","type":"\u0019\u001bk8s.secret","title":"Cluster Secrets","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serverVersion":{"name":"serverVersion","type":"\n","title":"Control-plane version","desc":"Version reported by the API server, as a dict including the keys major, minor, gitVersion, gitCommit, gitTreeState, buildDate, goVersion, compiler, and platform.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"service":{"name":"service","type":"\u001bk8s.service","title":"Kubernetes Service","desc":"Stable network endpoint that load-balances traffic to a set of pods, selected by namespace and name. The type field distinguishes ClusterIP, NodePort, LoadBalancer, and ExternalName services; clusterIP, externalIPs, loadBalancerIngress, and ports report the addresses and ports it exposes; and selector identifies the backing pods. Traffic and affinity behavior is governed by externalTrafficPolicy, internalTrafficPolicy, and sessionAffinity, and endpointSlices returns the slices listing the current backing endpoints.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"serviceaccount":{"name":"serviceaccount","type":"\u001bk8s.serviceaccount","title":"Kubernetes service account","desc":"Identity that pods use to authenticate to the API server, selected by namespace and name. The secrets and imagePullSecrets fields list the tokens and registry credentials associated with the account, and automountServiceAccountToken reports whether its API token is mounted into pods by default.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"serviceaccounts":{"name":"serviceaccounts","type":"\u0019\u001bk8s.serviceaccount","title":"Kubernetes service accounts","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"services":{"name":"services","type":"\u0019\u001bk8s.service","title":"Kubernetes Services","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"statefulset":{"name":"statefulset","type":"\u001bk8s.statefulset","title":"Kubernetes StatefulSet","desc":"Controller that manages pods with stable identities and persistent storage, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; identity and ordering are governed by serviceName, podManagementPolicy, ordinalsStart, and updateStrategy; and persistentVolumeClaimRetentionPolicy controls whether per-pod volumes survive scale-down. Rollout state is reported by replicas, readyReplicas, currentReplicas, updatedReplicas, currentRevision, updateRevision, and conditions, and the pods field returns the backing pods.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"statefulsets":{"name":"statefulsets","type":"\u0019\u001bk8s.statefulset","title":"Cluster StatefulSets","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClasses":{"name":"storageClasses","type":"\u0019\u001bk8s.storageclass","title":"Kubernetes StorageClasses","min_provider_version":"11.1.139","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageclass":{"name":"storageclass","type":"\u001bk8s.storageclass","title":"Kubernetes StorageClass","desc":"Template that describes how volumes are dynamically provisioned, selected by name. The provisioner field names the plugin that creates volumes, parameters carries the provisioner-specific settings, and reclaimPolicy, volumeBindingMode, and allowVolumeExpansion govern reclamation, binding timing, and whether bound volumes may grow.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"tcpRoutes":{"name":"tcpRoutes","type":"\u0019\u001bk8s.tcproute","title":"Kubernetes Gateway API TCPRoutes","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tcproute":{"name":"tcproute","type":"\u001bk8s.tcproute","title":"Kubernetes Gateway API TCPRoute","desc":"Gateway API rules that route raw TCP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it and rules describes the backend forwarding applied to connections; TCPRoute does not match on hostnames. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"tlsRoutes":{"name":"tlsRoutes","type":"\u0019\u001bk8s.tlsroute","title":"Kubernetes Gateway API TLSRoutes","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tlsroute":{"name":"tlsroute","type":"\u001bk8s.tlsroute","title":"Kubernetes Gateway API TLSRoute","desc":"Gateway API rules that route TLS traffic from Gateways to backend services by SNI hostname without terminating the connection, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it, hostnames narrows the route to specific SNI hosts, and rules describes the backend forwarding applied to connections. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"udpRoutes":{"name":"udpRoutes","type":"\u0019\u001bk8s.udproute","title":"Kubernetes Gateway API UDPRoutes","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"udproute":{"name":"udproute","type":"\u001bk8s.udproute","title":"Kubernetes Gateway API UDPRoute","desc":"Gateway API rules that route raw UDP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it and rules describes the backend forwarding applied to datagrams; UDPRoute does not match on hostnames. The parentStatus field reports whether each parent accepted the route.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"userinfo":{"name":"userinfo","type":"\u001bk8s.userinfo","title":"Kubernetes UserInfo","desc":"Identity of the authenticated user that issued an admission request, as recorded on the review. The username field is the authenticated subject (for a service account, the form is system:serviceaccount:\u003cnamespace\u003e:\u003cname\u003e), and uid is the unique identifier the API server assigned to that identity. Use it to attribute a create, update, or delete to the principal that made the change when auditing admission activity.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"validatingAdmissionPolicies":{"name":"validatingAdmissionPolicies","type":"\u0019\u001bk8s.admission.validatingadmissionpolicy","title":"Kubernetes built-in (CEL) ValidatingAdmissionPolicies","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"validatingAdmissionPolicyBindings":{"name":"validatingAdmissionPolicyBindings","type":"\u0019\u001bk8s.admission.validatingadmissionpolicybinding","title":"Kubernetes built-in (CEL) ValidatingAdmissionPolicyBindings","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"validatingWebhookConfigurations":{"name":"validatingWebhookConfigurations","type":"\u0019\u001bk8s.admission.validatingwebhookconfiguration","title":"Kubernetes admission webhook configurations","min_provider_version":"11.1.63","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes cluster","desc":"Cluster-wide handle for every modeled Kubernetes API object and the entry point for cluster-scoped security and configuration audits. From here you can enumerate every object of a given kind and correlate them across concerns: workloads (Pods, Deployments, DaemonSets, StatefulSets, ReplicaSets, Jobs, CronJobs, and higher-level apps); the network plane (Services, Ingresses, EndpointSlices, network policies, and Gateway API routes); identity, configuration, and the RBAC graph (Secrets, ConfigMaps, service accounts, roles, bindings, and the distinct subjects with their effective permissions); storage, scheduling, and quota policy; and admission control, including webhook and CEL-based validating policies. The serverVersion field reports the control-plane version and apiResources lists the resource types the API server advertises through discovery.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.accessReview":{"id":"k8s.accessReview","name":"k8s.accessReview","fields":{"allowed":{"name":"allowed","type":"\u0004","title":"Whether the API server allows the action","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"API group of the resource (\"\" for the core group)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Optional specific object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace of the action (\"\" for a cluster-scoped check)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reason":{"name":"reason","type":"\u0007","title":"Authorizer's explanation for the decision","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resource":{"name":"resource","type":"\u0007","is_mandatory":true,"title":"Resource type (secrets, pods, *, ...)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subject":{"name":"subject","type":"\u0007","is_mandatory":true,"title":"Subject under test (e.g. \"system:serviceaccount:prod:web\", a user, or a group)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"verb":{"name":"verb","type":"\u0007","is_mandatory":true,"title":"Kubernetes API verb (get, list, create, delete, *, ...)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"init":{"args":[{"name":"subject","type":"\u0007"},{"name":"verb","type":"\u0007"},{"name":"resource","type":"\u0007"},{"name":"group","type":"\u0007"},{"name":"namespace","type":"\u0007"},{"name":"name","type":"\u0007"}]},"title":"Authoritative RBAC access check","desc":"Answers, via the Kubernetes API server's SubjectAccessReview, whether a subject may perform a verb on a resource. Unlike the rule-derived RBAC rollups, this folds in aggregated ClusterRoles, group bindings, and built-in roles. Requires a live cluster connection; on a manifest scan the result fields error. Construct it with the action under test, for example k8s.accessReview(subject: \"system:serviceaccount:prod:web\", verb: \"create\", resource: \"pods\") or k8s.accessReview(subject: \"alice\", verb: \"get\", resource: \"secrets\", namespace: \"prod\").","private":true,"min_provider_version":"13.3.1","defaults":"subject verb resource allowed","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admission":{"id":"k8s.admission","fields":{"mutatingwebhookconfiguration":{"name":"mutatingwebhookconfiguration","type":"\u001bk8s.admission.mutatingwebhookconfiguration","title":"Kubernetes MutatingWebhookConfiguration","desc":"Configuration that registers external webhooks to modify API requests, selected by name. The webhooks field lists each registered webhook with its endpoint, the resource rules and namespace and object selectors that decide when it is called, its reinvocation and failure policies, and its admission side effects. Mutating webhooks run before validation and may patch the incoming object.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"validatingadmissionpolicy":{"name":"validatingadmissionpolicy","type":"\u001bk8s.admission.validatingadmissionpolicy","title":"Kubernetes ValidatingAdmissionPolicy","desc":"Built-in, CEL-based admission policy the API server evaluates in-process without an external webhook, selected by name. The failurePolicy field controls how CEL evaluation errors are handled, validations holds the expressions enforced against matching requests, matchConstraints scopes the resources the policy targets, and matchConditions and variables supply the guards and reusable expressions. A policy is inert until a k8s.admission.validatingadmissionpolicybinding activates it; bindings reaches the bindings that reference this policy by name and reports the enforcement actions (Deny, Warn, Audit) they apply.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"validatingadmissionpolicybinding":{"name":"validatingadmissionpolicybinding","type":"\u001bk8s.admission.validatingadmissionpolicybinding","title":"Kubernetes ValidatingAdmissionPolicyBinding","desc":"Binding that activates a k8s.admission.validatingadmissionpolicy and decides how its validation failures are enforced, selected by name. The policyName field and the policy reference identify the bound policy, and validationActions lists the enforcement actions applied on failure: Deny blocks the request, Warn returns a client warning, and Audit records the failure in the audit log. The matchResources field narrows the policy's scope, and paramRef supplies the parameter resource the policy consumes.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"validatingwebhookconfiguration":{"name":"validatingwebhookconfiguration","type":"\u001bk8s.admission.validatingwebhookconfiguration","title":"Kubernetes Validating Webhook Configuration","desc":"Configuration that registers external webhooks to validate API requests, selected by name. The webhooks field lists each registered webhook with its endpoint, the resource rules and namespace and object selectors that decide when it is called, its failure policy, and its admission side effects. Validating webhooks may reject a request but cannot modify the object.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true}},"is_extension":true},"k8s.admission.mutatingwebhookconfiguration":{"id":"k8s.admission.mutatingwebhookconfiguration","name":"k8s.admission.mutatingwebhookconfiguration","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failsOpen":{"name":"failsOpen","type":"\u0004","title":"Whether any webhook is fail-open (failurePolicy: Ignore), so admission proceeds when the webhook errors or is unreachable","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"webhooks":{"name":"webhooks","type":"\u0019\n","title":"Registered mutating webhooks","desc":"One entry per webhook, each with keys: name, clientConfig (the URL or in-cluster service the request is sent to), rules (the operations and resource groups that trigger it), failurePolicy (Ignore or Fail), matchPolicy (Exact or Equivalent), reinvocationPolicy (Never or IfNeeded), namespaceSelector and objectSelector (which objects it applies to), sideEffects, timeoutSeconds, admissionReviewVersions, and matchConditions (CEL guards).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes MutatingWebhookConfiguration","desc":"Configuration that registers external webhooks to modify API requests, selected by name. The webhooks field lists each registered webhook with its endpoint, the resource rules and namespace and object selectors that decide when it is called, its reinvocation and failure policies, and its admission side effects. Mutating webhooks run before validation and may patch the incoming object.","private":true,"min_provider_version":"13.0.16","defaults":"name","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admission.validatingadmissionpolicy":{"id":"k8s.admission.validatingadmissionpolicy","name":"k8s.admission.validatingadmissionpolicy","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"auditAnnotations":{"name":"auditAnnotations","type":"\u0019\n","title":"CEL expressions that produce audit annotations on the audit event","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"bindings":{"name":"bindings","type":"\u0019\u001bk8s.admission.validatingadmissionpolicybinding","title":"Bindings that activate this policy (filtered by spec.policyName)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failurePolicy":{"name":"failurePolicy","type":"\u0007","is_mandatory":true,"title":"How CEL evaluation failures are handled (Ignore or Fail; defaults to Fail)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"matchConditions":{"name":"matchConditions","type":"\u0019\n","title":"CEL match conditions that gate whether the policy is evaluated for a request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"matchConstraints":{"name":"matchConstraints","type":"\n","title":"Resource matching constraints (resourceRules, namespaceSelector, objectSelector, matchPolicy)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"paramKind":{"name":"paramKind","type":"\n","title":"Kind of resource used to parameterize the policy (apiVersion, kind); null when the policy takes no parameters","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"validations":{"name":"validations","type":"\u0019\n","title":"CEL validation expressions enforced against matching requests (expression, message, reason)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"variables":{"name":"variables","type":"\u0019\n","title":"Named CEL variables available to the policy's expressions","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ValidatingAdmissionPolicy","desc":"Built-in, CEL-based admission policy the API server evaluates in-process without an external webhook, selected by name. The failurePolicy field controls how CEL evaluation errors are handled, validations holds the expressions enforced against matching requests, matchConstraints scopes the resources the policy targets, and matchConditions and variables supply the guards and reusable expressions. A policy is inert until a k8s.admission.validatingadmissionpolicybinding activates it; bindings reaches the bindings that reference this policy by name and reports the enforcement actions (Deny, Warn, Audit) they apply.","private":true,"min_provider_version":"13.2.2","defaults":"name failurePolicy","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admission.validatingadmissionpolicybinding":{"id":"k8s.admission.validatingadmissionpolicybinding","name":"k8s.admission.validatingadmissionpolicybinding","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"matchResources":{"name":"matchResources","type":"\n","title":"Additional resource matching constraints, intersected with the policy's matchConstraints; null when unset","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"paramRef":{"name":"paramRef","type":"\n","title":"Parameter resource reference used to configure the policy (name, namespace, selector, parameterNotFoundAction); null when unset","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policy":{"name":"policy","type":"\u001bk8s.admission.validatingadmissionpolicy","title":"The ValidatingAdmissionPolicy this binding activates (null if the referenced policy does not exist)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyName":{"name":"policyName","type":"\u0007","is_mandatory":true,"title":"Name of the ValidatingAdmissionPolicy this binding activates","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"validationActions":{"name":"validationActions","type":"\u0019\u0007","is_mandatory":true,"title":"Enforcement actions applied to validation failures (Deny, Warn, Audit)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ValidatingAdmissionPolicyBinding","desc":"Binding that activates a k8s.admission.validatingadmissionpolicy and decides how its validation failures are enforced, selected by name. The policyName field and the policy reference identify the bound policy, and validationActions lists the enforcement actions applied on failure: Deny blocks the request, Warn returns a client warning, and Audit records the failure in the audit log. The matchResources field narrows the policy's scope, and paramRef supplies the parameter resource the policy consumes.","private":true,"min_provider_version":"13.2.2","defaults":"name policyName","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admission.validatingwebhookconfiguration":{"id":"k8s.admission.validatingwebhookconfiguration","name":"k8s.admission.validatingwebhookconfiguration","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failsOpen":{"name":"failsOpen","type":"\u0004","title":"Whether any webhook is fail-open (failurePolicy: Ignore), so admission proceeds when the webhook errors or is unreachable","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"webhooks":{"name":"webhooks","type":"\u0019\n","title":"Registered validating webhooks","desc":"One entry per webhook, each with keys: name, clientConfig (the URL or in-cluster service the request is sent to), rules (the operations and resource groups that trigger it), failurePolicy (Ignore or Fail), matchPolicy (Exact or Equivalent), namespaceSelector and objectSelector (which objects it applies to), sideEffects, timeoutSeconds, admissionReviewVersions, and matchConditions (CEL guards).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Validating Webhook Configuration","desc":"Configuration that registers external webhooks to validate API requests, selected by name. The webhooks field lists each registered webhook with its endpoint, the resource rules and namespace and object selectors that decide when it is called, its failure policy, and its admission side effects. Validating webhooks may reject a request but cannot modify the object.","private":true,"min_provider_version":"11.1.63","defaults":"name","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admissionrequest":{"id":"k8s.admissionrequest","name":"k8s.admissionrequest","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The name of the object presented in the request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"The namespace associated with the request (if any)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"object":{"name":"object","type":"\n","is_mandatory":true,"title":"Incoming object being admitted","desc":"Full manifest of the object presented for admission, with its apiVersion, kind, metadata, spec, and status keys. Empty on DELETE requests, where the object being removed appears in oldObject instead.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"oldObject":{"name":"oldObject","type":"\n","is_mandatory":true,"title":"Prior state of the object","desc":"Full manifest of the object as it existed before the request, with the same apiVersion, kind, metadata, spec, and status keys as object. Populated only on UPDATE and DELETE requests. Compare it against object to see what an UPDATE would change.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"operation":{"name":"operation","type":"\u0007","is_mandatory":true,"title":"Operation being performed","desc":"One of CREATE, UPDATE, DELETE, or CONNECT.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"userInfo":{"name":"userInfo","type":"\u001bk8s.userinfo","title":"Information about the requesting user","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes AdmissionRequest","desc":"AdmissionRequest that a dynamic admission webhook is asked to evaluate, carrying the operation being attempted, the requesting user, and the target name and namespace, along with the object being admitted and, for UPDATE and DELETE, its prior state. Policies read it to decide whether to admit a request, for example rejecting a privileged pod or an image pulled from an untrusted registry.","private":true,"min_provider_version":"9.0.0","defaults":"name namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.admissionreview":{"id":"k8s.admissionreview","name":"k8s.admissionreview","fields":{"request":{"name":"request","type":"\u001bk8s.admissionrequest","title":"Requested admission","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes AdmissionReview","desc":"AdmissionReview that an admission controller is being asked to evaluate. The `request` field exposes the embedded `k8s.admissionrequest`: the operation, requesting user, target namespace, the incoming object, and (for UPDATE/DELETE) the prior object. This resource is populated when MQL is invoked from inside a dynamic admission webhook so policies can decide whether to admit the request.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.apiresource":{"id":"k8s.apiresource","name":"k8s.apiresource","fields":{"categories":{"name":"categories","type":"\u0019\u0007","is_mandatory":true,"title":"List of the grouped resources","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"Preferred group of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plural name of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespaced":{"name":"namespaced","type":"\u0004","is_mandatory":true,"title":"Whether a resource is namespaced","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"shortNames":{"name":"shortNames","type":"\u0019\u0007","is_mandatory":true,"title":"List of suggested short names of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"singularName":{"name":"singularName","type":"\u0007","is_mandatory":true,"title":"Singular name of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Preferred version of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes API resource type","desc":"Resource type the API server advertises through discovery, selected by its plural name and kind. The group and version report the preferred API path, namespaced indicates whether instances are scoped to a namespace, and shortNames and categories list the kubectl aliases and groupings (such as \"all\") the type belongs to.","private":true,"min_provider_version":"9.0.0","defaults":"name kind","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.apiservice":{"id":"k8s.apiservice","name":"k8s.apiservice","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"caBundle":{"name":"caBundle","type":"\u0007","is_mandatory":true,"title":"PEM-encoded CA bundle used to validate the backend service","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Availability conditions for the aggregated API","desc":"Each entry reports one condition of the registration. The only condition type is `Available`, whose `status` is `True` when the aggregation layer can reach the backend and route requests to this API group and version, and `False` or `Unknown` otherwise. Each entry carries `type`, `status`, `reason`, `message`, and `lastTransitionTime`.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"API group this APIService handles (empty for the core group)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"groupPriorityMinimum":{"name":"groupPriorityMinimum","type":"\u0005","is_mandatory":true,"title":"Minimum priority for this group across versions","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"insecureSkipTLSVerify":{"name":"insecureSkipTLSVerify","type":"\u0004","is_mandatory":true,"title":"Whether TLS verification of the backend service is skipped","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"service":{"name":"service","type":"\u001bk8s.service","title":"The backend Kubernetes service that handles requests for this APIService","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceName":{"name":"serviceName","type":"\u0007","is_mandatory":true,"title":"Name of the backend service (empty when the APIService is served by kube-apiserver itself)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceNamespace":{"name":"serviceNamespace","type":"\u0007","is_mandatory":true,"title":"Namespace of the backend service","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"servicePort":{"name":"servicePort","type":"\u0005","is_mandatory":true,"title":"Port the backend service is reachable on","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"API version this APIService handles","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"versionPriority":{"name":"versionPriority","type":"\u0005","is_mandatory":true,"title":"Ordering priority for this version within the group","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes APIService (aggregation layer)","desc":"Registration that adds an API group and version to the cluster through the aggregation layer, selected by name. The group and version fields name the API the registration serves, serviceName and serviceNamespace identify the backend that handles it (reached through service, or empty when served by kube-apiserver itself), and caBundle and insecureSkipTLSVerify govern how the API server trusts that backend. The conditions field reports whether the API is available.","private":true,"min_provider_version":"13.0.16","defaults":"name group version created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.app":{"id":"k8s.app","name":"k8s.app","fields":{"components":{"name":"components","type":"\u0019\u0007","is_mandatory":true,"title":"Component names within the architecture (e.g., database, cache, frontend)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"instance":{"name":"instance","type":"\u0007","is_mandatory":true,"title":"Application instance","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedBy":{"name":"managedBy","type":"\u0007","is_mandatory":true,"title":"Tool managing the operation of the application (e.g., helm)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"partOf":{"name":"partOf","type":"\u0007","is_mandatory":true,"title":"Name of the higher-level application","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Application version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Application","desc":"Logical application reconstructed from the recommended app.kubernetes.io labels shared across a group of objects. The name, version, and instance fields identify the application, managedBy names the tool that operates it (such as helm), partOf names a larger application it belongs to, and components lists the architectural pieces (such as database, cache, or frontend) discovered for it.","private":true,"min_provider_version":"11.1.75","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.certificatesigningrequest":{"id":"k8s.certificatesigningrequest","name":"k8s.certificatesigningrequest","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificate":{"name":"certificate","type":"\u0007","is_mandatory":true,"title":"PEM-encoded issued certificate (empty until the request is approved and signed)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Approval and signing state of the request","desc":"One entry per condition. Each dict carries `type` (one of Approved, Denied, or Failed), `status` (True, False, or Unknown), `reason` and `message` giving a human-readable explanation, and the `lastUpdateTime` and `lastTransitionTime` timestamps. A request is issued a certificate only after an Approved condition is present and no Denied or Failed condition exists.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"expirationSeconds":{"name":"expirationSeconds","type":"\u0005","is_mandatory":true,"title":"Requested duration for the issued certificate, in seconds","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"groups":{"name":"groups","type":"\u0019\u0007","is_mandatory":true,"title":"Groups of the user that created the request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"request":{"name":"request","type":"\u0007","is_mandatory":true,"title":"PEM-encoded certificate signing request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"requesterUid":{"name":"requesterUid","type":"\u0007","is_mandatory":true,"title":"UID of the user that created the request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"signerName":{"name":"signerName","type":"\u0007","is_mandatory":true,"title":"Name of the signer that should handle this request (e.g., kubernetes.io/kube-apiserver-client)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usages":{"name":"usages","type":"\u0019\u0007","is_mandatory":true,"title":"Requested key usages for the certificate (e.g., client auth, server auth)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Username of the user that created the request","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes CertificateSigningRequest","desc":"Request for a certificate to be issued by a cluster signer, selected by name. The request field carries the PEM-encoded certificate signing request, signerName names the signer that should handle it, and usages and expirationSeconds state the requested key usages and lifetime. The username, groups, and requesterUid fields identify the requester, conditions reports approval state, and certificate holds the issued certificate once signed.","private":true,"min_provider_version":"13.0.16","defaults":"name signerName username created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.configmap":{"id":"k8s.configmap","name":"k8s.configmap","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"data":{"name":"data","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Key-value pairs containing the configuration data","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usedBy":{"name":"usedBy","type":"\u0019\u001bk8s.pod","title":"Pods that reference this ConfigMap through volumes, env, or envFrom","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ConfigMap","desc":"Object that holds non-confidential configuration as key-value pairs, selected by namespace and name. The data field exposes the stored configuration entries, and usedBy returns the pods that consume the ConfigMap through volumes, environment variables, or envFrom.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.container":{"id":"k8s.container","name":"k8s.container","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities added to the container","desc":"From `securityContext.capabilities.add`; empty when none are added.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowPrivilegeEscalation":{"name":"allowPrivilegeEscalation","type":"\u0004","is_mandatory":true,"title":"Whether a process can gain more privileges than its parent process","desc":"Null when not set. Parsed from `securityContext.allowPrivilegeEscalation`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Arguments to the entry point","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"command":{"name":"command","type":"\u0019\u0007","is_mandatory":true,"title":"Entry point array","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImage":{"name":"containerImage","type":"\u001bcontainer.image","title":"Container image","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"droppedCapabilities":{"name":"droppedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities dropped from the container","desc":"From `securityContext.capabilities.drop`; empty when none are dropped.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"env":{"name":"env","type":"\n","is_mandatory":true,"title":"Environment variables","desc":"One entry per variable, with keys `name`, `value` (a literal value), and `valueFrom` for values sourced from elsewhere (`configMapKeyRef`, `secretKeyRef`, `fieldRef`, or `resourceFieldRef`).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"envFrom":{"name":"envFrom","type":"\n","is_mandatory":true,"title":"Sources to populate environment variables in bulk","desc":"One entry per source, with keys `configMapRef` or `secretRef` naming the ConfigMap or Secret whose keys become environment variables, and an optional `prefix` prepended to each variable name.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageName":{"name":"imageName","type":"\u0007","is_mandatory":true,"title":"Container image name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullPolicy":{"name":"imagePullPolicy","type":"\u0007","is_mandatory":true,"title":"Image pull policy: Always, Never, or IfNotPresent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lifecycle":{"name":"lifecycle","type":"\n","is_mandatory":true,"title":"Lifecycle hooks (postStart, preStop)","desc":"Keys `postStart` (run immediately after the container is created) and `preStop` (run immediately before the container is terminated). Each hook is a handler specified as `exec`, `httpGet`, `tcpSocket`, or `sleep`.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"livenessProbe":{"name":"livenessProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container liveness","desc":"A failing liveness probe causes the kubelet to restart the container. One of `exec`, `httpGet`, `tcpSocket`, or `grpc` selects the check; timing keys are `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`, `successThreshold`, `failureThreshold`, and `terminationGracePeriodSeconds`.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Network ports exposed by the container (containerPort, protocol, hostPort, hostIP, name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"privileged":{"name":"privileged","type":"\u0004","is_mandatory":true,"title":"Whether the container runs in privileged mode","desc":"Null when not set by the container's security context. Parsed from `securityContext.privileged`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readOnlyRootFilesystem":{"name":"readOnlyRootFilesystem","type":"\u0004","is_mandatory":true,"title":"Whether the container's root filesystem is mounted read-only","desc":"Null when not set. Parsed from `securityContext.readOnlyRootFilesystem`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readinessProbe":{"name":"readinessProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container service readiness","desc":"A failing readiness probe removes the pod from Service endpoints. One of `exec`, `httpGet`, `tcpSocket`, or `grpc` selects the check; timing keys are `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`, `successThreshold`, `failureThreshold`, and `terminationGracePeriodSeconds`.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resizePolicy":{"name":"resizePolicy","type":"\u0019\n","is_mandatory":true,"title":"Per-resource resize policy entries (resourceName + restartPolicy)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\n","is_mandatory":true,"title":"Compute resources required by this container","desc":"Resource requirements with keys `limits` and `requests`, each a map of resource name (`cpu`, `memory`, `ephemeral-storage`, or an extended resource) to a quantity, plus `claims` referencing named resource claims.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"restartPolicy":{"name":"restartPolicy","type":"\u0007","is_mandatory":true,"title":"Container-level restart policy override (currently used to mark a container as a sidecar via Always)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsGroup":{"name":"runAsGroup","type":"\u0005","is_mandatory":true,"title":"GID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsGroup`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsNonRoot":{"name":"runAsNonRoot","type":"\u0004","is_mandatory":true,"title":"Whether the container must run as a non-root user","desc":"Null when not set on the container; in that case the pod-level setting (if any) applies. Parsed from `securityContext.runAsNonRoot`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsUser":{"name":"runAsUser","type":"\u0005","is_mandatory":true,"title":"UID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsUser`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"seccompProfileType":{"name":"seccompProfileType","type":"\u0007","is_mandatory":true,"title":"Seccomp profile type applied to the container","desc":"One of `RuntimeDefault`, `Localhost`, or `Unconfined`. Empty when the container sets no seccomp profile, in which case the pod-level profile (if any) applies. Parsed from `securityContext.seccompProfile.type`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","is_mandatory":true,"title":"Security options the container runs with","desc":"Raw security context with keys `privileged`, `allowPrivilegeEscalation`, `runAsUser`, `runAsGroup`, `runAsNonRoot`, `readOnlyRootFilesystem`, `capabilities` (`add`/`drop` lists), `seLinuxOptions`, `seccompProfile`, `appArmorProfile`, `procMount`, and `windowsOptions`. The most commonly audited values are also exposed as scalar fields (`privileged`, `allowPrivilegeEscalation`, `runAsNonRoot`, `runAsUser`, `runAsGroup`, `readOnlyRootFilesystem`, `addedCapabilities`, `droppedCapabilities`, `seccompProfileType`).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startupProbe":{"name":"startupProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container startup, gating other probes until it succeeds","desc":"The liveness and readiness probes are held off until this probe first succeeds. One of `exec`, `httpGet`, `tcpSocket`, or `grpc` selects the check; timing keys are `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`, `successThreshold`, `failureThreshold`, and `terminationGracePeriodSeconds`.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdin":{"name":"stdin","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be left open after the container starts","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdinOnce":{"name":"stdinOnce","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be closed after the first attached client disconnects","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePath":{"name":"terminationMessagePath","type":"\u0007","is_mandatory":true,"title":"Path at which the file to which the container's termination message will be written","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePolicy":{"name":"terminationMessagePolicy","type":"\u0007","is_mandatory":true,"title":"Policy for handling the termination message (File or FallbackToLogsOnError)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tty":{"name":"tty","type":"\u0004","is_mandatory":true,"title":"Whether this container should allocate a TTY for itself","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeDevices":{"name":"volumeDevices","type":"\u0019\n","is_mandatory":true,"title":"List of block devices to be used by the container","desc":"One entry per raw block device, with keys `name` (the volume name) and `devicePath` (the path inside the container where the device is mapped).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMounts":{"name":"volumeMounts","type":"\u0019\n","is_mandatory":true,"title":"Pod volumes to mount into the container's file system","desc":"One entry per mount, with keys `name` (the volume name), `mountPath` (path inside the container), `readOnly`, `subPath`, `subPathExpr`, `mountPropagation`, and `recursiveReadOnly`.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"workingDir":{"name":"workingDir","type":"\u0007","is_mandatory":true,"title":"Container's working directory","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes workload container","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.containerStatus":{"id":"k8s.containerStatus","name":"k8s.containerStatus","fields":{"containerId":{"name":"containerId","type":"\u0007","is_mandatory":true,"title":"The ID of the container in the format '\\\u003ctype\\\u003e://\\\u003ccontainer_id\\\u003e'","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"image":{"name":"image","type":"\u0007","is_mandatory":true,"title":"Name of the container image that the container is running","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageId":{"name":"imageId","type":"\u0007","is_mandatory":true,"title":"The image ID of the container's image","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastState":{"name":"lastState","type":"\n","is_mandatory":true,"title":"State of the container's previous instance, if any","desc":"Same shape as `state`: one of `waiting` (`reason`, `message`), `running` (`startedAt`), or `terminated` (`exitCode`, `signal`, `reason`, `message`, `startedAt`, `finishedAt`, `containerID`). Taken from the last termination state, useful for diagnosing crash loops.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ready":{"name":"ready","type":"\u0004","is_mandatory":true,"title":"Whether the container is currently passing its readiness check","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\n","is_mandatory":true,"title":"Actual compute resources allocated to the container","desc":"Holds `limits` and `requests`, each a map of resource name (such as `cpu` or `memory`) to quantity, plus `claims`, a list of resource claim references by name.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"restartCount":{"name":"restartCount","type":"\u0005","is_mandatory":true,"title":"The amount of times the container has been restarted","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"started":{"name":"started","type":"\u0004","is_mandatory":true,"title":"Whether the container has passed its startup probe","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"state":{"name":"state","type":"\n","is_mandatory":true,"title":"Current state of the container","desc":"Exactly one of three keys is populated. `waiting` holds `reason` and `message`. `running` holds `startedAt`. `terminated` holds `exitCode`, `signal`, `reason`, `message`, `startedAt`, `finishedAt`, and `containerID`.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes container status","private":true,"min_provider_version":"11.1.110","defaults":"name ready restartCount","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.context":{"id":"k8s.context","name":"k8s.context","fields":{"content":{"name":"content","type":"\u0007","refs":["\"path\"","\"range\""],"title":"Manifest text within the range, shown as an excerpt","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path of the manifest file this resource is declared in","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"range":{"name":"range","type":"\u001e","is_mandatory":true,"title":"Line range the resource spans in the manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes manifest source context","desc":"Source location and raw text of a resource declared in a manifest file: the file path, the line range it spans, and the manifest text within that range. Points a reviewer at the exact source of a flagged resource. Available only for manifest-file scans; empty for live-cluster and admission connections.","private":true,"min_provider_version":"13.6.1","defaults":"path range content","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.cronjob":{"id":"k8s.cronjob","name":"k8s.cronjob","fields":{"active":{"name":"active","type":"\u0019\n","title":"Object references to the jobs this CronJob currently has running","desc":"The raw status.active entries, one dict per running job with keys kind, namespace, name, uid, apiVersion, resourceVersion, and fieldPath. For the resolved job objects rather than bare references, use activeJobs.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"activeJobs":{"name":"activeJobs","type":"\u0019\u001bk8s.job","title":"Currently active jobs created by this CronJob (resolves status.active ObjectReferences)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"concurrencyPolicy":{"name":"concurrencyPolicy","type":"\u0007","title":"Concurrency policy (Allow, Forbid, Replace)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failedJobsHistoryLimit":{"name":"failedJobsHistoryLimit","type":"\u0005","title":"Number of failed finished jobs to retain","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"jobs":{"name":"jobs","type":"\u0019\u001bk8s.job","title":"All jobs ever owned by this CronJob (filtered from k8s.jobs by ownerReference UID; subject to the CronJob's history limits)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastScheduleTime":{"name":"lastScheduleTime","type":"\t","title":"Time of the last scheduling attempt","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastSuccessfulTime":{"name":"lastSuccessfulTime","type":"\t","title":"Time of the last successful job completion","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"schedule":{"name":"schedule","type":"\u0007","title":"Cron schedule expression that determines when jobs are created","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startingDeadlineSeconds":{"name":"startingDeadlineSeconds","type":"\u0005","title":"Seconds within which a missed scheduled job is still allowed to start","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"successfulJobsHistoryLimit":{"name":"successfulJobsHistoryLimit","type":"\u0005","title":"Number of successful finished jobs to retain","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"suspend":{"name":"suspend","type":"\u0004","title":"Whether the CronJob is suspended","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"timeZone":{"name":"timeZone","type":"\u0007","title":"IANA time zone the schedule is evaluated in (e.g., \"America/New_York\")","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes CronJob","desc":"Controller that creates Jobs on a repeating schedule, selected by namespace and name. The schedule and timeZone fields define when jobs run, concurrencyPolicy, startingDeadlineSeconds, and suspend govern execution, and successfulJobsHistoryLimit and failedJobsHistoryLimit control how many finished jobs are retained. The activeJobs field returns the jobs currently running, jobs returns every job the CronJob still owns, and the shared pod template is available through podSpec, containers, and initContainers.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name schedule suspend created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.customresource":{"id":"k8s.customresource","name":"k8s.customresource","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes CustomResource","desc":"Instance of a custom resource defined by a CustomResourceDefinition, selected by namespace and name. The kind field reports the custom type and manifest exposes the object's full content, so custom API extensions can be queried alongside built-in Kubernetes objects.","private":true,"min_provider_version":"9.0.0","defaults":"name namespace created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.daemonset":{"id":"k8s.daemonset","name":"k8s.daemonset","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"collisionCount":{"name":"collisionCount","type":"\u0005","title":"Count of ControllerRevision name hash collisions handled by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentNumberScheduled":{"name":"currentNumberScheduled","type":"\u0005","title":"Number of nodes running at least one daemon pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredNumberScheduled":{"name":"desiredNumberScheduled","type":"\u0005","title":"Total number of nodes that should be running a daemon pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReadySeconds":{"name":"minReadySeconds","type":"\u0005","title":"Minimum seconds a newly created pod must be ready without crashes to be considered available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"numberAvailable":{"name":"numberAvailable","type":"\u0005","title":"Number of nodes whose daemon pod is available for at least minReadySeconds","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"numberMisscheduled":{"name":"numberMisscheduled","type":"\u0005","title":"Number of nodes running a daemon pod that shouldn't be running one","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"numberReady":{"name":"numberReady","type":"\u0005","title":"Number of nodes that should be running the daemon pod with the pod in Ready state","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"numberUnavailable":{"name":"numberUnavailable","type":"\u0005","title":"Number of nodes whose daemon pod is not available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this DaemonSet (label-selector match)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"revisionHistoryLimit":{"name":"revisionHistoryLimit","type":"\u0005","title":"Number of old ControllerRevisions retained to allow rollback","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this DaemonSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updateStrategy":{"name":"updateStrategy","type":"\n","title":"Update strategy (OnDelete or RollingUpdate with maxUnavailable/maxSurge)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updatedNumberScheduled":{"name":"updatedNumberScheduled","type":"\u0005","title":"Number of nodes running an updated daemon pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes DaemonSet","desc":"Controller that runs one copy of a pod on every matching node, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers, the rollout is governed by updateStrategy and revisionHistoryLimit, and scheduling coverage is reported by desiredNumberScheduled, currentNumberScheduled, numberReady, numberAvailable, numberMisscheduled, and updatedNumberScheduled. The pods field returns the daemon pods currently running.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name desiredNumberScheduled numberReady created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.deployment":{"id":"k8s.deployment","name":"k8s.deployment","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"availableReplicas":{"name":"availableReplicas","type":"\u0005","title":"Number of pods available for at least minReadySeconds","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"collisionCount":{"name":"collisionCount","type":"\u0005","title":"Count of ReplicaSet name hash collisions handled by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Rollout status conditions reported by the controller","desc":"List of dicts, one per condition. Each has type (Available, Progressing, or ReplicaFailure), status (True, False, or Unknown), reason and message explaining the current state, and the lastUpdateTime and lastTransitionTime timestamps.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredReplicas":{"name":"desiredReplicas","type":"\u0005","title":"Number of pods requested by the deployment","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReadySeconds":{"name":"minReadySeconds","type":"\u0005","title":"Minimum seconds a newly created pod must be ready without crashes to be considered available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"paused":{"name":"paused","type":"\u0004","title":"Whether the deployment rollout is paused","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this deployment (label-selector match; technically owned by the deployment's ReplicaSets)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"progressDeadlineSeconds":{"name":"progressDeadlineSeconds","type":"\u0005","title":"Maximum seconds for the deployment to make progress before being marked failed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readyReplicas":{"name":"readyReplicas","type":"\u0005","title":"Number of ready pods","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicas":{"name":"replicas","type":"\u0005","title":"Total non-terminated pods observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"revisionHistoryLimit":{"name":"revisionHistoryLimit","type":"\u0005","title":"Number of old ReplicaSets retained to allow rollback","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this deployment","desc":"Dict with matchLabels (a map of label key/value pairs a pod must carry) and matchExpressions (a list of {key, operator, values} requirements). A pod is selected only when it satisfies every entry.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"strategy":{"name":"strategy","type":"\n","title":"Rollout strategy (Recreate or RollingUpdate with maxSurge/maxUnavailable)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unavailableReplicas":{"name":"unavailableReplicas","type":"\u0005","title":"Number of pods that are not available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updatedReplicas":{"name":"updatedReplicas","type":"\u0005","title":"Number of pods updated to the desired pod template","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Deployment","desc":"Controller that manages a replicated, declaratively updated set of pods through ReplicaSets, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; the rollout is governed by desiredReplicas, strategy, paused, and revisionHistoryLimit; and the current rollout state is reported by replicas, readyReplicas, availableReplicas, updatedReplicas, unavailableReplicas, and conditions. The pods field returns the pods currently backing the deployment.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name desiredReplicas readyReplicas created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.egressNat":{"id":"k8s.egressNat","name":"k8s.egressNat","fields":{"addresses":{"name":"addresses","type":"\u0019\u0007","is_mandatory":true,"title":"NAT addresses","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"cidrs":{"name":"cidrs","type":"\u0019\u0007","is_mandatory":true,"title":"NAT CIDRs","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"classification":{"name":"classification","type":"\u0007","is_mandatory":true,"title":"NAT classification","desc":"Derived from the NAT CIDRs measured against the configured public, private, and trusted egress ranges. One of publicEgress (reaches a public range), privateEgress, trustedEgress (matches a configured trusted egress CIDR), or unknown (no CIDRs available to classify).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"metadataClassification":{"name":"metadataClassification","type":"\u0007","is_mandatory":true,"title":"Explicit classification metadata from the source object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"network":{"name":"network","type":"\u0007","is_mandatory":true,"title":"Network associated with this NAT entry","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeStatuses":{"name":"nodeStatuses","type":"\u0019\u0007","is_mandatory":true,"title":"Node status references that reported this NAT entry","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Owning object reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"publicCidrs":{"name":"publicCidrs","type":"\u0019\u0007","is_mandatory":true,"title":"Public CIDRs included in the NAT entry","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sourceRef":{"name":"sourceRef","type":"\u0007","is_mandatory":true,"title":"Source object reference in kind:namespace:name or kind:name form","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF associated with this NAT entry","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Normalized Kubernetes egress NAT","desc":"Represents NAT intent or observed compiled NAT state from Coil Egress, Calico IPPool, HBN, and compatible network integrations. Kubernetes-only clusters without those integrations expose an empty list.","private":true,"min_provider_version":"13.3.2","defaults":"sourceRef vrf network classification","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.egressRoute":{"id":"k8s.egressRoute","name":"k8s.egressRoute","fields":{"bgpPeerings":{"name":"bgpPeerings","type":"\u0019\u0007","is_mandatory":true,"title":"BGP peering references associated with this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"cidrs":{"name":"cidrs","type":"\u0019\u0007","is_mandatory":true,"title":"Route CIDRs","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"classification":{"name":"classification","type":"\u0007","is_mandatory":true,"title":"Route classification","desc":"Derived from the route CIDRs when the source object carries no explicit classification metadata. One of publicEgress (a route CIDR falls outside the configured private ranges), trustedEgress (every CIDR matches a configured trusted egress range), privateEgress (all CIDRs are private), or unknown (no CIDRs were resolved).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"confidence":{"name":"confidence","type":"\u0007","is_mandatory":true,"title":"Static-analysis confidence: high, medium, or low","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"destinations":{"name":"destinations","type":"\u0019\u0007","is_mandatory":true,"title":"Destination references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"metadataClassification":{"name":"metadataClassification","type":"\u0007","is_mandatory":true,"title":"Explicit classification metadata from the source object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nat":{"name":"nat","type":"\u0004","is_mandatory":true,"title":"Whether NAT is configured or inferred for this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"network":{"name":"network","type":"\u0007","is_mandatory":true,"title":"Network associated with this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeStatuses":{"name":"nodeStatuses","type":"\u0019\u0007","is_mandatory":true,"title":"Node status references that reported this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Explicit owner metadata from the source object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"publicCidrs":{"name":"publicCidrs","type":"\u0019\u0007","is_mandatory":true,"title":"Public CIDRs included in the route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sourceRef":{"name":"sourceRef","type":"\u0007","is_mandatory":true,"title":"Source object reference in kind:namespace:name or kind:name form","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF associated with this route","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Normalized Kubernetes egress route","desc":"Represents egress routing intent or observed compiled routing state from HBN network CRDs, Coil Egress resources, and compatible integrations. Kubernetes-only clusters without those integrations expose an empty list.","private":true,"min_provider_version":"13.3.2","defaults":"sourceRef vrf network classification confidence","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.endpointslice":{"id":"k8s.endpointslice","name":"k8s.endpointslice","fields":{"addressType":{"name":"addressType","type":"\u0007","is_mandatory":true,"title":"Address type (IPv4, IPv6, or FQDN)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpoints":{"name":"endpoints","type":"\u0019\n","title":"Backing endpoints of this slice","desc":"One dict per endpoint. Keys: `addresses` (list of IPs or FQDNs for the endpoint), `conditions` (a dict with `ready`, `serving`, and `terminating` booleans reporting readiness and shutdown state), `hostname`, `targetRef` (reference to the object backing the endpoint, typically a Pod), `deprecatedTopology`, `nodeName`, `zone`, and `hints` (topology hints used for topology-aware routing).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalAddresses":{"name":"externalAddresses","type":"\u0019\u0007","title":"Endpoint addresses not backed by an in-cluster pod","desc":"Addresses of endpoints whose targetRef is not a Pod, i.e. manually managed targets. On a selectorless service these often point outside the cluster.","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","title":"Ports exposed by the endpoints in this slice","desc":"One dict per port. Keys: `name` (port name, matching a Service port), `protocol` (one of TCP, UDP, or SCTP), `port` (the port number), and `appProtocol` (application protocol hint, e.g. http or https).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"service":{"name":"service","type":"\u001bk8s.service","title":"The Service this slice backs (resolved from the kubernetes.io/service-name label)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes EndpointSlice","desc":"Scalable list of network endpoints that back a Service, selected by namespace and name. The addressType field reports whether the slice holds IPv4, IPv6, or FQDN endpoints, endpoints lists the backing addresses and their readiness, ports lists the ports they expose, and service returns the Service the slice belongs to.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name addressType","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ephemeralContainer":{"id":"k8s.ephemeralContainer","name":"k8s.ephemeralContainer","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities added to the container","desc":"From `securityContext.capabilities.add`; empty when none are added.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowPrivilegeEscalation":{"name":"allowPrivilegeEscalation","type":"\u0004","is_mandatory":true,"title":"Whether a process can gain more privileges than its parent process","desc":"Null when not set. Parsed from `securityContext.allowPrivilegeEscalation`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Arguments to the entry point","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"command":{"name":"command","type":"\u0019\u0007","is_mandatory":true,"title":"Entry point array","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImage":{"name":"containerImage","type":"\u001bcontainer.image","title":"Container image","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"droppedCapabilities":{"name":"droppedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities dropped from the container","desc":"From `securityContext.capabilities.drop`; empty when none are dropped.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"env":{"name":"env","type":"\n","is_mandatory":true,"title":"Environment variables","desc":"One entry per variable, each with `name` and either an inline `value` or a `valueFrom` source (`fieldRef`, `resourceFieldRef`, `configMapKeyRef`, or `secretKeyRef`).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"envFrom":{"name":"envFrom","type":"\n","is_mandatory":true,"title":"Sources that populate environment variables in bulk","desc":"One entry per source, each with an optional `prefix` and either a `configMapRef` or `secretRef` naming the ConfigMap or Secret whose keys become environment variables.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageName":{"name":"imageName","type":"\u0007","is_mandatory":true,"title":"Container image name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullPolicy":{"name":"imagePullPolicy","type":"\u0007","is_mandatory":true,"title":"Image pull policy: Always, Never, or IfNotPresent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Network ports exposed by the container (typically empty for ephemeral containers)","desc":"One entry per port, each with `containerPort`, an optional `name`, `hostPort`, `hostIP`, and `protocol` (TCP, UDP, or SCTP).","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"privileged":{"name":"privileged","type":"\u0004","is_mandatory":true,"title":"Whether the container runs in privileged mode","desc":"Null when not set by the container's security context. Parsed from `securityContext.privileged`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readOnlyRootFilesystem":{"name":"readOnlyRootFilesystem","type":"\u0004","is_mandatory":true,"title":"Whether the container's root filesystem is mounted read-only","desc":"Null when not set. Parsed from `securityContext.readOnlyRootFilesystem`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsGroup":{"name":"runAsGroup","type":"\u0005","is_mandatory":true,"title":"GID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsGroup`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsNonRoot":{"name":"runAsNonRoot","type":"\u0004","is_mandatory":true,"title":"Whether the container must run as a non-root user","desc":"Null when not set on the container; in that case the pod-level setting (if any) applies. Parsed from `securityContext.runAsNonRoot`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsUser":{"name":"runAsUser","type":"\u0005","is_mandatory":true,"title":"UID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsUser`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"seccompProfileType":{"name":"seccompProfileType","type":"\u0007","is_mandatory":true,"title":"Seccomp profile type applied to the container","desc":"One of `RuntimeDefault`, `Localhost`, or `Unconfined`. Empty when the container sets no seccomp profile, in which case the pod-level profile (if any) applies. Parsed from `securityContext.seccompProfile.type`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","is_mandatory":true,"title":"Container security options","desc":"Raw container security context. Keys include `privileged`, `allowPrivilegeEscalation`, `runAsUser`, `runAsGroup`, `runAsNonRoot`, `readOnlyRootFilesystem`, `capabilities` (with `add` and `drop` lists), and `seccompProfile`. The common settings are also flattened into the `privileged`, `allowPrivilegeEscalation`, `runAsNonRoot`, `runAsUser`, `runAsGroup`, `readOnlyRootFilesystem`, `addedCapabilities`, `droppedCapabilities`, and `seccompProfileType` fields for direct querying.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdin":{"name":"stdin","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be left open after the container starts","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdinOnce":{"name":"stdinOnce","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be closed after the first attached client disconnects","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePath":{"name":"terminationMessagePath","type":"\u0007","is_mandatory":true,"title":"Path at which the file to which the container's termination message will be written","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePolicy":{"name":"terminationMessagePolicy","type":"\u0007","is_mandatory":true,"title":"Policy for handling the termination message (File or FallbackToLogsOnError)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tty":{"name":"tty","type":"\u0004","is_mandatory":true,"title":"Whether this container should allocate a TTY for itself","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeDevices":{"name":"volumeDevices","type":"\u0019\n","is_mandatory":true,"title":"List of block devices to be used by the container","desc":"One entry per raw block device, each with `name` (the pod volume) and `devicePath` (the path inside the container where the device is mapped).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMounts":{"name":"volumeMounts","type":"\u0019\n","is_mandatory":true,"title":"Pod volumes to mount into the container's file system","desc":"One entry per mount, each with `name` (the pod volume), `mountPath` (where it is mounted inside the container), `readOnly`, `subPath` or `subPathExpr`, and `mountPropagation`.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"workingDir":{"name":"workingDir","type":"\u0007","is_mandatory":true,"title":"Container's working directory","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ephemeral container","desc":"Temporary container added to a running pod for interactive debugging, exposing the same image, command, security context, and volume mounts a permanent container would. Because an ephemeral container is injected into an existing pod and shares that pod's namespaces, its privileges, capabilities, and mounts are worth auditing: an over-permissioned debug container is a path to inspecting or tampering with the workloads it runs alongside. The `name` field identifies the container within its pod.","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.gateway":{"id":"k8s.gateway","name":"k8s.gateway","fields":{"addresses":{"name":"addresses","type":"\u0019\n","is_mandatory":true,"title":"Addresses requested for the Gateway","desc":"Entry keys are type (IPAddress, Hostname, or NamedAddress) and value, the requested address. These are the addresses the Gateway asks the controller to bind, as opposed to statusAddresses, which reports what the controller actually assigned.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Status conditions","desc":"Each entry has keys type, status (True, False, or Unknown), reason, message, observedGeneration, and lastTransitionTime, reporting whether the Gateway is accepted and programmed by its controller.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"gatewayClass":{"name":"gatewayClass","type":"\u001bk8s.gatewayclass","title":"The GatewayClass that backs this Gateway","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"gatewayClassName":{"name":"gatewayClassName","type":"\u0007","is_mandatory":true,"title":"Name of the GatewayClass that backs this Gateway","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"infrastructure":{"name":"infrastructure","type":"\n","is_mandatory":true,"title":"Infrastructure settings (labels, annotations, parametersRef)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"listenerStatus":{"name":"listenerStatus","type":"\u0019\n","is_mandatory":true,"title":"Per-listener status reported by the controller","desc":"Each entry has keys name (the listener the status corresponds to), supportedKinds (route kinds the listener accepts), attachedRoutes (the number of routes bound to the listener), and conditions (the listener's status conditions).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"listeners":{"name":"listeners","type":"\u0019\n","is_mandatory":true,"title":"Listeners associated with the Gateway","desc":"Each entry describes a port the Gateway accepts traffic on, with keys name, hostname, port, protocol (HTTP, HTTPS, TLS, TCP, or UDP), tls (the certificate and TLS mode configuration), and allowedRoutes (which route kinds and namespaces may attach to this listener).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposure records for this Gateway","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods behind the gateway, resolved through the HTTPRoutes and GRPCRoutes attached to it and their backend services","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"statusAddresses":{"name":"statusAddresses","type":"\u0019\n","is_mandatory":true,"title":"Network addresses assigned to the Gateway by the controller","desc":"Entry keys are type (IPAddress, Hostname, or NamedAddress) and value, the assigned address. These are the addresses external clients use to reach the Gateway.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API Gateway","desc":"Gateway API object that configures how external traffic enters the cluster, selected by namespace and name. The gatewayClass field selects the implementing controller, listeners defines the ports, protocols, and hostnames the Gateway accepts, and addresses requests specific entry addresses. The statusAddresses and listenerStatus fields report the addresses the controller assigned and the routes attached to each listener.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name gatewayClassName created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.gatewayclass":{"id":"k8s.gatewayclass","name":"k8s.gatewayclass","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Status conditions (Accepted, SupportedVersion)","desc":"Each entry has keys `type`, `status`, `reason`, `message`, `observedGeneration`, and `lastTransitionTime`. The `Accepted` condition reports whether the controller named in controllerName has adopted this class.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"controllerName":{"name":"controllerName","type":"\u0007","is_mandatory":true,"title":"Name of the controller that manages Gateways of this class","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the GatewayClass","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parametersRef":{"name":"parametersRef","type":"\n","is_mandatory":true,"title":"Reference to a controller-specific configuration resource","desc":"Dict with keys `group`, `kind`, `name`, and `namespace` identifying the custom resource that holds controller-specific configuration for this class. The `namespace` key is set only when the referenced resource is namespace-scoped.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API GatewayClass","desc":"Gateway API template that ties Gateways to a controller implementation, selected by name. The controllerName field names the controller that manages Gateways of this class, parametersRef points to a controller-specific configuration resource, and conditions reports whether the class has been accepted.","private":true,"min_provider_version":"13.0.16","defaults":"name controllerName created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.grpcroute":{"id":"k8s.grpcroute","name":"k8s.grpcroute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames this route should respond to","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Gateways and Services that delegate traffic to this route","desc":"Each entry carries group, kind, namespace, name, sectionName, and port identifying one parent binding.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Acceptance status reported by each parent","desc":"Each entry carries parentRef, controllerName, and conditions describing whether the parent Gateway or Service accepted and resolved the route.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Rules describing gRPC method matches, filters, and backend forwarding","desc":"Each entry carries name, matches (gRPC service and method plus header matches), filters (request and response header modification, request mirroring, and extension references), backendRefs (weighted backend targets), and sessionPersistence.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API GRPCRoute","desc":"Gateway API rules that route gRPC traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways or Services that delegate to it, hostnames narrows the route to specific hosts, and rules describes the method matches, filters, and backend forwarding applied to requests. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.horizontalpodautoscaler":{"id":"k8s.horizontalpodautoscaler","name":"k8s.horizontalpodautoscaler","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"behavior":{"name":"behavior","type":"\n","title":"Scaling behavior policies","desc":"Holds `scaleUp` and `scaleDown` keys, each with a `stabilizationWindowSeconds`, a `selectPolicy` (`Max`, `Min`, or `Disabled`), and a `policies` list. Each policy has a `type` (`Pods` or `Percent`), a `value`, and a `periodSeconds` that together cap how fast the HPA may change the replica count in that direction.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions","desc":"Each entry has `type` (`AbleToScale`, `ScalingActive`, or `ScalingLimited`), `status` (`True`, `False`, or `Unknown`), `lastTransitionTime`, `reason`, and `message` keys reporting whether the autoscaler can act and why it is or is not scaling.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentMetrics":{"name":"currentMetrics","type":"\u0019\n","title":"Most recent metric readings the autoscaler used to compute desiredReplicas","desc":"Each entry has a `type` key selecting the metric source (`Resource`, `Pods`, `Object`, `External`, or `ContainerResource`) and the matching key (`resource`, `pods`, `object`, `external`, or `containerResource`) holding the current reading for that source.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentReplicas":{"name":"currentReplicas","type":"\u0005","title":"Current number of replicas observed by the autoscaler","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredReplicas":{"name":"desiredReplicas","type":"\u0005","title":"Desired number of replicas the autoscaler computed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastScaleTime":{"name":"lastScaleTime","type":"\t","title":"Last time the HPA scaled the target","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"maxReplicas":{"name":"maxReplicas","type":"\u0005","title":"Upper bound on the number of replicas the HPA will allow","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"metrics":{"name":"metrics","type":"\u0019\n","title":"Metrics the HPA evaluates to compute the desired replica count","desc":"Each entry has a `type` key selecting the metric source: `Resource`, `Pods`, `Object`, `External`, or `ContainerResource`. The matching key (`resource`, `pods`, `object`, `external`, or `containerResource`) holds that source's target, including the metric name and the target value, average value, or average utilization.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReplicas":{"name":"minReplicas","type":"\u0005","title":"Lower bound on the number of replicas the HPA will allow (defaults to 1)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetApiVersion":{"name":"scaleTargetApiVersion","type":"\u0007","title":"API version of the workload the HPA scales","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetDeployment":{"name":"scaleTargetDeployment","type":"\u001bk8s.deployment","title":"The scaled Deployment (null if the target is not a Deployment)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetKind":{"name":"scaleTargetKind","type":"\u0007","title":"Kind of the workload the HPA scales (Deployment, StatefulSet, ReplicaSet)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetName":{"name":"scaleTargetName","type":"\u0007","title":"Name of the workload the HPA scales","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetReplicaSet":{"name":"scaleTargetReplicaSet","type":"\u001bk8s.replicaset","title":"The scaled ReplicaSet (null if the target is not a ReplicaSet)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scaleTargetStatefulSet":{"name":"scaleTargetStatefulSet","type":"\u001bk8s.statefulset","title":"The scaled StatefulSet (null if the target is not a StatefulSet)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"HorizontalPodAutoscaler spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\n","title":"HorizontalPodAutoscaler status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes HorizontalPodAutoscaler","desc":"Controller that scales a workload's replica count to meet observed metrics, selected by namespace and name. The scaleTargetKind and scaleTargetName fields identify the scaled workload (reached through scaleTargetDeployment, scaleTargetStatefulSet, or scaleTargetReplicaSet), minReplicas and maxReplicas bound the replica count, and metrics and behavior define the targets and scaling policies. Current state is reported by currentReplicas, desiredReplicas, currentMetrics, lastScaleTime, and conditions.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name minReplicas maxReplicas currentReplicas created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.httproute":{"id":"k8s.httproute","name":"k8s.httproute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames this route should respond to","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Gateways or Services that delegate to this route","desc":"Each entry identifies one parent that binds this route, with keys `group`, `kind`, `namespace`, `name`, `sectionName` (the specific listener or section on the parent), and `port`. When `kind` is omitted it defaults to Gateway and `group` to gateway.networking.k8s.io.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Acceptance status of the route for each parent","desc":"One entry per parent, with keys `parentRef` (the parent this status is for), `controllerName` (the controller that produced it), and `conditions` (the reported state, each carrying `type`, `status`, `reason`, `message`, `lastTransitionTime`, and `observedGeneration`). Inspect the Accepted condition to confirm the parent admitted the route.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Request matches, filters, and backend forwarding rules","desc":"Each entry describes one routing rule with keys `matches` (the request conditions, each carrying `path`, `headers`, `queryParams`, and `method`), `filters` (in-flight header rewrites, redirects, mirrors, and URL rewrites), `backendRefs` (the weighted backend services traffic is forwarded to), plus optional `name`, `timeouts`, `retry`, and `sessionPersistence`.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API HTTPRoute","desc":"Gateway API rules that route HTTP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways or Services that delegate to it, hostnames narrows the route to specific hosts, and rules describes the matches, filters, and backend forwarding applied to requests. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingress":{"id":"k8s.ingress","name":"k8s.ingress","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingressClass":{"name":"ingressClass","type":"\u001bk8s.ingressclass","title":"The IngressClass that handles this ingress","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingressClassName":{"name":"ingressClassName","type":"\u0007","title":"Name of the IngressClass that handles this ingress","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerIngress":{"name":"loadBalancerIngress","type":"\u0019\n","title":"Load-balancer addresses published in the ingress status","desc":"Entries the ingress controller has provisioned for external traffic. Each entry carries `ip` and `hostname` (whichever the controller assigned), plus a `ports` list whose entries hold the exposed port number and protocol.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposure records for this Ingress","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods behind the ingress, resolved through its backend services","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\u001bk8s.ingressrule","is_mandatory":true,"title":"Ingress rules","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tls":{"name":"tls","type":"\u0019\u001bk8s.ingresstls","title":"Ingress TLS data","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress","desc":"HTTP and HTTPS routing rules that expose Services to traffic from outside the cluster, selected by namespace and name. The rules field maps hostnames and paths to backend services, tls lists the hostnames and certificates terminated by the ingress, and ingressClass identifies the controller that implements the rules. The loadBalancerIngress field reports the addresses the controller has assigned.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressbackend":{"id":"k8s.ingressbackend","name":"k8s.ingressbackend","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceRef":{"name":"resourceRef","type":"\u001bk8s.ingressresourceref","is_mandatory":true,"title":"Kubernetes resource reference for Ingress backend","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"service":{"name":"service","type":"\u001bk8s.ingressservicebackend","is_mandatory":true,"title":"Kubernetes service for Ingress backend","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress backend","private":true,"min_provider_version":"9.0.0","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressclass":{"id":"k8s.ingressclass","name":"k8s.ingressclass","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"controller":{"name":"controller","type":"\u0007","is_mandatory":true,"title":"Name of the controller that handles ingresses of this class (e.g., k8s.io/ingress-nginx)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parameters":{"name":"parameters","type":"\n","is_mandatory":true,"title":"Controller-specific configuration resource reference","desc":"Points to a resource that tunes the controller's behavior for this class. Keys: apiGroup and kind identify the referent's type, name is its name, scope is either Cluster or Namespace, and namespace names the namespace of the referent when scope is Namespace.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes IngressClass","desc":"Template that ties Ingress objects to a controller implementation, selected by name. The controller field names the controller that handles ingresses of this class, and parameters points to a controller-specific configuration resource that tunes its behavior.","private":true,"min_provider_version":"13.0.16","defaults":"name controller created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingresshttprulepath":{"id":"k8s.ingresshttprulepath","name":"k8s.ingresshttprulepath","fields":{"backend":{"name":"backend","type":"\u001bk8s.ingressbackend","is_mandatory":true,"title":"Backend to forward matching Ingress traffic","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"HTTP path for Ingress rule","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pathType":{"name":"pathType","type":"\u0007","is_mandatory":true,"title":"Path matching mode","desc":"How the `path` value is interpreted when matching request URLs. One of Exact (matches the URL path exactly), Prefix (matches by URL path prefix split on `/` elements), or ImplementationSpecific (matching is delegated to the IngressClass controller).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress HTTP rule","private":true,"min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressresourceref":{"id":"k8s.ingressresourceref","name":"k8s.ingressresourceref","fields":{"apiGroup":{"name":"apiGroup","type":"\u0007","is_mandatory":true,"title":"APIGroup specified as part of the resource reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress resource backend","private":true,"min_provider_version":"9.0.0","defaults":"name kind","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressrule":{"id":"k8s.ingressrule","name":"k8s.ingressrule","fields":{"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Hostname to match for Ingress rule","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"httpPaths":{"name":"httpPaths","type":"\u0019\u001bk8s.ingresshttprulepath","is_mandatory":true,"title":"HTTP paths to manage Ingress for","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress rule","private":true,"min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingressservicebackend":{"id":"k8s.ingressservicebackend","name":"k8s.ingressservicebackend","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes service name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"portName":{"name":"portName","type":"\u0007","is_mandatory":true,"title":"Kubernetes service port name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"portNumber":{"name":"portNumber","type":"\u0005","is_mandatory":true,"title":"Kubernetes service port number","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress service backend","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ingresstls":{"id":"k8s.ingresstls","name":"k8s.ingresstls","fields":{"certificates":{"name":"certificates","type":"\u0019\u001bcertificate","is_mandatory":true,"title":"Certificates data from the TLS Secret","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hosts":{"name":"hosts","type":"\u0019\u0007","is_mandatory":true,"title":"List of hosts associated with TLS certificate","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Ingress TLS termination","desc":"TLS settings for a single entry in an Ingress spec, pairing the hostnames served over HTTPS with the certificate material resolved from the referenced TLS Secret. The hosts field lists the names the certificate is expected to cover, and certificates exposes the parsed certificate data so you can audit expiry, issuer, key strength, and hostname coverage for traffic terminated at the ingress.","private":true,"min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.initContainer":{"id":"k8s.initContainer","name":"k8s.initContainer","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities added to the container","desc":"From `securityContext.capabilities.add`; empty when none are added.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowPrivilegeEscalation":{"name":"allowPrivilegeEscalation","type":"\u0004","is_mandatory":true,"title":"Whether a process can gain more privileges than its parent process","desc":"Null when not set. Parsed from `securityContext.allowPrivilegeEscalation`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"args":{"name":"args","type":"\u0019\u0007","is_mandatory":true,"title":"Arguments to the entrypoint","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"command":{"name":"command","type":"\u0019\u0007","is_mandatory":true,"title":"Entrypoint array","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImage":{"name":"containerImage","type":"\u001bcontainer.image","title":"Container image","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"droppedCapabilities":{"name":"droppedCapabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Linux capabilities dropped from the container","desc":"From `securityContext.capabilities.drop`; empty when none are dropped.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"env":{"name":"env","type":"\n","is_mandatory":true,"title":"Environment variables set directly on the container","desc":"Each entry has `name` and either a literal `value` or a `valueFrom` source (`fieldRef`, `resourceFieldRef`, `configMapKeyRef`, or `secretKeyRef`). Values pulled from a ConfigMap or Secret can expose sensitive data to the container.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"envFrom":{"name":"envFrom","type":"\n","is_mandatory":true,"title":"Sources that populate environment variables in bulk","desc":"Each entry references a `configMapRef` or `secretRef` whose keys become environment variables, with an optional `prefix` applied to every name.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageName":{"name":"imageName","type":"\u0007","is_mandatory":true,"title":"Container image name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullPolicy":{"name":"imagePullPolicy","type":"\u0007","is_mandatory":true,"title":"Image pull policy: Always, Never, or IfNotPresent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lifecycle":{"name":"lifecycle","type":"\n","is_mandatory":true,"title":"Lifecycle hooks (postStart, preStop)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"livenessProbe":{"name":"livenessProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container liveness (sidecar init containers only)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the container","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Network ports exposed by the container (containerPort, protocol, hostPort, hostIP, name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"privileged":{"name":"privileged","type":"\u0004","is_mandatory":true,"title":"Whether the container runs in privileged mode","desc":"Null when not set by the container's security context. Parsed from `securityContext.privileged`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readOnlyRootFilesystem":{"name":"readOnlyRootFilesystem","type":"\u0004","is_mandatory":true,"title":"Whether the container's root filesystem is mounted read-only","desc":"Null when not set. Parsed from `securityContext.readOnlyRootFilesystem`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readinessProbe":{"name":"readinessProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container service readiness (sidecar init containers only)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resizePolicy":{"name":"resizePolicy","type":"\u0019\n","is_mandatory":true,"title":"Per-resource resize policy entries (resourceName + restartPolicy)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\n","is_mandatory":true,"title":"Compute resources requested by and limited for this container","desc":"Keys `limits` and `requests` map resource names (for example `cpu`, `memory`, or `ephemeral-storage`) to quantities, and `claims` lists the resource claims (by `name`) drawn from the pod's declared resourceClaims.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"restartPolicy":{"name":"restartPolicy","type":"\u0007","is_mandatory":true,"title":"Container-level restart policy; setting this to Always turns the init container into a sidecar","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsGroup":{"name":"runAsGroup","type":"\u0005","is_mandatory":true,"title":"GID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsGroup`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsNonRoot":{"name":"runAsNonRoot","type":"\u0004","is_mandatory":true,"title":"Whether the container must run as a non-root user","desc":"Null when not set on the container; in that case the pod-level setting (if any) applies. Parsed from `securityContext.runAsNonRoot`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runAsUser":{"name":"runAsUser","type":"\u0005","is_mandatory":true,"title":"UID the container entry point runs as","desc":"Null when not set. Parsed from `securityContext.runAsUser`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"seccompProfileType":{"name":"seccompProfileType","type":"\u0007","is_mandatory":true,"title":"Seccomp profile type applied to the container","desc":"One of `RuntimeDefault`, `Localhost`, or `Unconfined`. Empty when the container sets no seccomp profile, in which case the pod-level profile (if any) applies. Parsed from `securityContext.seccompProfile.type`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","is_mandatory":true,"title":"Raw container-level security context","desc":"The full security context object, with keys such as `privileged`, `allowPrivilegeEscalation`, `runAsNonRoot`, `runAsUser`, `runAsGroup`, `readOnlyRootFilesystem`, `capabilities` (with `add` and `drop`), and `seccompProfile`. The commonly audited values are also flattened onto this resource as the privileged, allowPrivilegeEscalation, runAsNonRoot, runAsUser, runAsGroup, readOnlyRootFilesystem, addedCapabilities, droppedCapabilities, and seccompProfileType fields.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startupProbe":{"name":"startupProbe","type":"\n","is_mandatory":true,"title":"Periodic probe of container startup (sidecar init containers only)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdin":{"name":"stdin","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be left open after the container starts","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"stdinOnce":{"name":"stdinOnce","type":"\u0004","is_mandatory":true,"title":"Whether stdin should be closed after the first attached client disconnects","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePath":{"name":"terminationMessagePath","type":"\u0007","is_mandatory":true,"title":"Path at which the file to which the container's termination message will be written","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationMessagePolicy":{"name":"terminationMessagePolicy","type":"\u0007","is_mandatory":true,"title":"Policy for handling the termination message (File or FallbackToLogsOnError)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tty":{"name":"tty","type":"\u0004","is_mandatory":true,"title":"Whether this container should allocate a TTY for itself","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeDevices":{"name":"volumeDevices","type":"\u0019\n","is_mandatory":true,"title":"Raw block devices mapped into the container","desc":"Each entry has `name` (the pod volume) and `devicePath`, the path inside the container at which the block device is exposed.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMounts":{"name":"volumeMounts","type":"\u0019\n","is_mandatory":true,"title":"Volume mounts injected into the container's filesystem","desc":"Each entry has `name` (the pod volume) and `mountPath`, plus optional `readOnly`, `subPath`, `subPathExpr`, `mountPropagation`, and `recursiveReadOnly`. Mounts of Secret or ConfigMap volumes surface sensitive data inside the container.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"workingDir":{"name":"workingDir","type":"\u0007","is_mandatory":true,"title":"Container's working directory","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes init container","desc":"Init container defined on a pod, run to completion in sequence before the pod's application containers start. Init containers commonly perform setup work such as fetching secrets, running migrations, or waiting on dependencies, so they frequently mount sensitive volumes and may request elevated privileges. Their security posture is queryable through the same fields as application containers, including securityContext, privileged, runAsNonRoot, and addedCapabilities. An init container whose restartPolicy is Always runs as a sidecar alongside the application containers rather than to completion.","private":true,"min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.job":{"id":"k8s.job","name":"k8s.job","fields":{"active":{"name":"active","type":"\u0005","title":"Number of pods currently running for the job","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"activeDeadlineSeconds":{"name":"activeDeadlineSeconds","type":"\u0005","title":"Maximum seconds the job may run before being terminated","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"backoffLimit":{"name":"backoffLimit","type":"\u0005","title":"Number of retries before marking a pod failed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"backoffLimitPerIndex":{"name":"backoffLimitPerIndex","type":"\u0005","title":"Per-index retry limit when completionMode is Indexed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"completedIndexes":{"name":"completedIndexes","type":"\u0007","title":"Comma-separated list or range of indexes that have successfully completed (Indexed completion mode)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"completionMode":{"name":"completionMode","type":"\u0007","title":"Completion mode (NonIndexed or Indexed)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"completionTime":{"name":"completionTime","type":"\t","title":"Time the job entered a terminal state","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"completions":{"name":"completions","type":"\u0005","title":"Total number of successful completions required to mark the job complete","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions (Complete, Failed, FailureTarget, SuccessCriteriaMet, Suspended)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failed":{"name":"failed","type":"\u0005","title":"Number of pods that have failed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"failedIndexes":{"name":"failedIndexes","type":"\u0007","title":"Comma-separated list of failed indexes (Indexed completion mode)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"maxFailedIndexes":{"name":"maxFailedIndexes","type":"\u0005","title":"Maximum number of failed indexes allowed before the job is marked failed (Indexed completion mode)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parallelism":{"name":"parallelism","type":"\u0005","title":"Maximum number of pods the job should run in parallel","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podReplacementPolicy":{"name":"podReplacementPolicy","type":"\u0007","title":"Policy for replacing pods that are terminating (TerminatingOrFailed or Failed)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this Job (label-selector match)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ready":{"name":"ready","type":"\u0005","title":"Number of pods that are ready","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this job","desc":"Matches pods against the job's `matchLabels` (equality on label key/value pairs) and `matchExpressions` (each a `key`, an `operator` of In, NotIn, Exists, or DoesNotExist, and a `values` list).","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startTime":{"name":"startTime","type":"\t","title":"Time the job controller acknowledged the job","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"succeeded":{"name":"succeeded","type":"\u0005","title":"Number of pods that have successfully completed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"suspend":{"name":"suspend","type":"\u0004","title":"Whether new pod creation is suspended","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminating":{"name":"terminating","type":"\u0005","title":"Number of pods that are terminating","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ttlSecondsAfterFinished":{"name":"ttlSecondsAfterFinished","type":"\u0005","title":"Number of seconds after the job finishes before it is automatically deleted","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Job","desc":"Controller that runs pods to completion, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; execution is governed by parallelism, completions, completionMode, backoffLimit, activeDeadlineSeconds, and suspend; and progress is reported by active, succeeded, failed, ready, startTime, completionTime, and conditions. The pods field returns the pods the job has created.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name succeeded failed created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.lease":{"id":"k8s.lease","name":"k8s.lease","fields":{"acquireTime":{"name":"acquireTime","type":"\t","is_mandatory":true,"title":"Time the current holder acquired the lease","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"holderIdentity":{"name":"holderIdentity","type":"\u0007","is_mandatory":true,"title":"Identity of the lease holder (often \"\u003chostname\u003e_\u003cuuid\u003e\")","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"leaseDurationSeconds":{"name":"leaseDurationSeconds","type":"\u0005","is_mandatory":true,"title":"Lease duration in seconds","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"leaseTransitions":{"name":"leaseTransitions","type":"\u0005","is_mandatory":true,"title":"Number of times this lease has been transferred to a new holder","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"preferredHolder":{"name":"preferredHolder","type":"\u0007","is_mandatory":true,"title":"Preferred future holder for the lease","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"renewTime":{"name":"renewTime","type":"\t","is_mandatory":true,"title":"Time the current holder last renewed the lease","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"strategy":{"name":"strategy","type":"\u0007","is_mandatory":true,"title":"Strategy used to coordinate leadership (e.g., OldestEmulationVersion)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Lease (coordination.k8s.io)","desc":"Coordination object that backs leader election and node heartbeats, selected by namespace and name. The holderIdentity field names the current holder, leaseDurationSeconds and renewTime report how long the lease is held and when it was last renewed, and acquireTime and leaseTransitions track when it was acquired and how often it has changed hands.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name holderIdentity created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.limitrange":{"id":"k8s.limitrange","name":"k8s.limitrange","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"limits":{"name":"limits","type":"\u0019\n","title":"Per-object-type limit items","desc":"One entry per constrained object type. Each entry carries a type key (Container, Pod, or PersistentVolumeClaim) and the constraints applied to that type: max, min, default, defaultRequest, and maxLimitRequestRatio. Each constraint is a map of resource name (such as cpu or memory) to the quantity enforced for it.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"Raw LimitRange spec","desc":"The unprocessed .spec object, whose only content is the list of limit items. For the parsed per-object-type constraints, use limits.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes LimitRange","desc":"Policy that constrains resource requests and limits for objects in a namespace, selected by namespace and name. The limits field lists the default, minimum, and maximum values applied per object type (Container, Pod, or PersistentVolumeClaim), supplying defaults to objects that omit them and rejecting objects that fall outside the bounds.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.managedField":{"id":"k8s.managedField","name":"k8s.managedField","fields":{"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"API version of the fields set","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"fieldsType":{"name":"fieldsType","type":"\u0007","is_mandatory":true,"title":"Type of the fields set, always \"FieldsV1\"","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"fieldsV1":{"name":"fieldsV1","type":"\n","is_mandatory":true,"title":"Set of fields this manager owns","desc":"Nested map in the Kubernetes FieldsV1 format, mirroring the object's own structure. Owned scalar fields appear as \"f:\u003cfieldName\u003e\" keys; entries of an associative list are keyed by \"k:\u003ckeyJSON\u003e\", by \"v:\u003cvalue\u003e\", or by \"i:\u003cindex\u003e\"; and a \".\" key marks the enclosing field itself as owned.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manager":{"name":"manager","type":"\u0007","is_mandatory":true,"title":"Workflow or tool managing these fields, for example kubectl, helm, or kube-controller-manager","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"operation":{"name":"operation","type":"\u0007","is_mandatory":true,"title":"Operation that led to this entry, either \"Apply\" or \"Update\"","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subresource":{"name":"subresource","type":"\u0007","is_mandatory":true,"title":"Subresource this entry applies to, for example \"status\", or empty for the main resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"time":{"name":"time","type":"\t","is_mandatory":true,"title":"Time the manager last modified these fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes managed field entry","desc":"Server-side-apply authorship record from an object's metadata.managedFields. Each record names the manager that owns a set of fields, the operation it used, and the apiVersion those fields are expressed in, so you can see which controller or tool last wrote each part of an object. The fieldsV1 set enumerates exactly which fields the manager owns.","private":true,"min_provider_version":"13.2.2","defaults":"manager operation","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.namespace":{"id":"k8s.namespace","name":"k8s.namespace","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"configmaps":{"name":"configmaps","type":"\u0019\u001bk8s.configmap","title":"ConfigMaps in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"cronjobs":{"name":"cronjobs","type":"\u0019\u001bk8s.cronjob","title":"CronJobs in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"daemonsets":{"name":"daemonsets","type":"\u0019\u001bk8s.daemonset","title":"DaemonSets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"deployments":{"name":"deployments","type":"\u0019\u001bk8s.deployment","title":"Deployments in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpointSlices":{"name":"endpointSlices","type":"\u0019\u001bk8s.endpointslice","title":"EndpointSlices in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"enforcesPodSecurity":{"name":"enforcesPodSecurity","type":"\u0004","title":"Whether the namespace enforces a non-privileged Pod Security Standards level","desc":"True only when the `pod-security.kubernetes.io/enforce` label is baseline or restricted, meaning violating pods are rejected at admission. False when the enforce level is unset or privileged, in which case Pod Security findings on this namespace's workloads are advisory rather than blocked.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"horizontalPodAutoscalers":{"name":"horizontalPodAutoscalers","type":"\u0019\u001bk8s.horizontalpodautoscaler","title":"HorizontalPodAutoscalers in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingresses":{"name":"ingresses","type":"\u0019\u001bk8s.ingress","title":"Ingresses in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"jobs":{"name":"jobs","type":"\u0019\u001bk8s.job","title":"Jobs in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"limitRanges":{"name":"limitRanges","type":"\u0019\u001bk8s.limitrange","title":"LimitRanges in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposures in this namespace","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkPolicies":{"name":"networkPolicies","type":"\u0019\u001bk8s.networkpolicy","title":"NetworkPolicies in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkPolicyCoverages":{"name":"networkPolicyCoverages","type":"\u0019\u001bk8s.networkPolicyCoverage","title":"Normalized network policy coverage summaries in this namespace","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentVolumeClaims":{"name":"persistentVolumeClaims","type":"\u0019\u001bk8s.persistentvolumeclaim","title":"PersistentVolumeClaims in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podDisruptionBudgets":{"name":"podDisruptionBudgets","type":"\u0019\u001bk8s.poddisruptionbudget","title":"PodDisruptionBudgets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityAudit":{"name":"podSecurityAudit","type":"\u0007","title":"Pod Security Standards level audited on this namespace","desc":"Value of the `pod-security.kubernetes.io/audit` label (privileged, baseline, or restricted). Violations are recorded in the audit log but not blocked. Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityAuditVersion":{"name":"podSecurityAuditVersion","type":"\u0007","title":"Pod Security Standards version pinned for auditing","desc":"Value of the `pod-security.kubernetes.io/audit-version` label. Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityEnforce":{"name":"podSecurityEnforce","type":"\u0007","title":"Pod Security Standards level enforced on this namespace","desc":"Value of the `pod-security.kubernetes.io/enforce` label (privileged, baseline, or restricted). Empty when the namespace opts out of Pod Security admission enforcement, in which case violating pods are still admitted.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityEnforceVersion":{"name":"podSecurityEnforceVersion","type":"\u0007","title":"Pod Security Standards version pinned for enforcement","desc":"Value of the `pod-security.kubernetes.io/enforce-version` label (a Kubernetes minor version like \"v1.30\" or \"latest\"). Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityWarn":{"name":"podSecurityWarn","type":"\u0007","title":"Pod Security Standards level warned on this namespace","desc":"Value of the `pod-security.kubernetes.io/warn` label (privileged, baseline, or restricted). Violations return a client warning but are not blocked. Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityWarnVersion":{"name":"podSecurityWarnVersion","type":"\u0007","title":"Pod Security Standards version pinned for warnings","desc":"Value of the `pod-security.kubernetes.io/warn-version` label. Empty when unset.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicasets":{"name":"replicasets","type":"\u0019\u001bk8s.replicaset","title":"ReplicaSets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceQuotas":{"name":"resourceQuotas","type":"\u0019\u001bk8s.resourcequota","title":"ResourceQuotas in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rolebindings":{"name":"rolebindings","type":"\u0019\u001bk8s.rbac.rolebinding","title":"RBAC RoleBindings in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roles":{"name":"roles","type":"\u0019\u001bk8s.rbac.role","title":"RBAC Roles in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secrets":{"name":"secrets","type":"\u0019\u001bk8s.secret","title":"Secrets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceaccounts":{"name":"serviceaccounts","type":"\u0019\u001bk8s.serviceaccount","title":"ServiceAccounts in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"services":{"name":"services","type":"\u0019\u001bk8s.service","title":"Services in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"statefulsets":{"name":"statefulsets","type":"\u0019\u001bk8s.statefulset","title":"StatefulSets in this namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes namespace","desc":"Namespace that partitions a cluster into isolated scopes, selected by name. The workload accessors (pods, deployments, statefulsets, daemonsets, replicasets, jobs, cronjobs) and the services, ingresses, endpointSlices, and networkPolicies accessors return only the objects in this namespace, while secrets, configmaps, serviceaccounts, persistentVolumeClaims, roles, and rolebindings cover its configuration, identity, storage, and RBAC. The podSecurityEnforce, podSecurityAudit, and podSecurityWarn fields (with their version companions) report the Pod Security Standards level applied by Pod Security admission.","private":true,"min_provider_version":"9.0.0","defaults":"name created","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.networkExposure":{"id":"k8s.networkExposure","name":"k8s.networkExposure","fields":{"addresses":{"name":"addresses","type":"\u0019\u0007","is_mandatory":true,"title":"Published IPs or hostnames","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"confidence":{"name":"confidence","type":"\u0007","is_mandatory":true,"title":"Static-analysis confidence: high, medium, or low","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"exposureReason":{"name":"exposureReason","type":"\u0007","is_mandatory":true,"title":"Classification reason, for example publicLoadBalancerAddress, nodePortPublicNode, publicIngressAddress, or gatewayPublicAddress","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"internetExposed":{"name":"internetExposed","type":"\u0004","is_mandatory":true,"title":"Whether this exposure appears reachable from the public Internet","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"metadataClassification":{"name":"metadataClassification","type":"\u0007","is_mandatory":true,"title":"Explicit classification metadata from source object annotations or labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Source name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Source namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"network":{"name":"network","type":"\u0007","is_mandatory":true,"title":"Network associated with the exposure when HBN intent is available","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkClassifications":{"name":"networkClassifications","type":"\u0019\u0007","is_mandatory":true,"title":"Network classifications such as internet, private, hostname, restrictedSourceRange, or internalOnly","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Explicit owner metadata from source object annotations or labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods behind this exposure, resolved through the source Service, Ingress, or Gateway","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyCoverage":{"name":"policyCoverage","type":"\u0019\u0007","is_mandatory":true,"title":"Policy coverage identifiers associated with the exposure","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","is_mandatory":true,"title":"Published ports","desc":"Each entry carries `port` and `protocol`, plus `name` when the source object defines one. Service-derived entries also include `targetPort`, `nodePort`, and `appProtocol`; Gateway-derived entries include `hostname`.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"protocols":{"name":"protocols","type":"\u0019\u0007","is_mandatory":true,"title":"Published protocols such as TCP, UDP, HTTP, HTTPS, or TLS","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"routes":{"name":"routes","type":"\u0019\u0007","is_mandatory":true,"title":"Route identifiers associated with the exposure when HBN intent is available","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sourceKind":{"name":"sourceKind","type":"\u0007","is_mandatory":true,"title":"Source kind that produced the exposure, for example Service, Ingress, Gateway, Pod (hostNetwork or hostPort), HBNInbound, or LegacyHBN","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sourceRef":{"name":"sourceRef","type":"\u0007","is_mandatory":true,"title":"Source object reference in kind:namespace:name or kind:name form","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"vrf":{"name":"vrf","type":"\u0007","is_mandatory":true,"title":"VRF associated with the exposure when HBN intent is available","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Normalized Kubernetes network exposure","desc":"Represents an inbound exposure signal from Kubernetes Services, Ingresses, Gateway API resources, and HBN/network intent sources when they are available. The `confidence` field describes static-analysis confidence, not packet-level reachability.","private":true,"min_provider_version":"13.3.2","defaults":"sourceKind namespace name internetExposed exposureReason","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.networkPolicyCoverage":{"id":"k8s.networkPolicyCoverage","name":"k8s.networkPolicyCoverage","fields":{"adminDefaultDenyEgress":{"name":"adminDefaultDenyEgress","type":"\u0004","is_mandatory":true,"title":"Whether admin network policy coverage supplies egress catch-all deny semantics","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"adminDefaultDenyIngress":{"name":"adminDefaultDenyIngress","type":"\u0004","is_mandatory":true,"title":"Whether admin network policy coverage supplies ingress catch-all deny semantics","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"adminNetworkPolicies":{"name":"adminNetworkPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"Kubernetes AdminNetworkPolicy and BaselineAdminNetworkPolicy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"calicoPolicies":{"name":"calicoPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"Calico policy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ciliumPolicies":{"name":"ciliumPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"Cilium policy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"coverageGaps":{"name":"coverageGaps","type":"\u0019\u0007","is_mandatory":true,"title":"Coverage gaps that should be shown to users","desc":"Human-readable descriptions of where network isolation is missing or incomplete for the selected pods, for example primary ingress not being isolated, egress allowing all traffic, secondary interface coverage requiring MultiNetworkPolicy, or an admin policy that lacks catch-all deny. An empty list means no gaps were detected for this coverage.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"defaultDenyEgress":{"name":"defaultDenyEgress","type":"\u0004","is_mandatory":true,"title":"Whether selected pods have egress default-deny semantics","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"defaultDenyIngress":{"name":"defaultDenyIngress","type":"\u0004","is_mandatory":true,"title":"Whether selected pods have ingress default-deny semantics","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"interfaces":{"name":"interfaces","type":"\u0019\u0007","is_mandatory":true,"title":"Interfaces covered by this summary, for example primary or secondary network names","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"multiNetworkPolicies":{"name":"multiNetworkPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"MultiNetworkPolicy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Policy namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nativeNetworkPolicies":{"name":"nativeNetworkPolicies","type":"\u0019\u0007","is_mandatory":true,"title":"Native Kubernetes NetworkPolicy references","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSelector":{"name":"podSelector","type":"\n","is_mandatory":true,"title":"Pod selector covered by the policy","desc":"Kubernetes label selector identifying the pods this coverage applies to, as declared on the source policy. Keys are `matchLabels` (a map of label key to required value) and `matchExpressions` (a list of set-based requirements, each with `key`, `operator`, and `values`). An empty selector matches every pod in the namespace.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyRef":{"name":"policyRef","type":"\u0007","is_mandatory":true,"title":"Policy object reference","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secondaryInterfaceEgressCovered":{"name":"secondaryInterfaceEgressCovered","type":"\u0004","is_mandatory":true,"title":"Whether secondary interface egress is covered","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secondaryInterfaceIngressCovered":{"name":"secondaryInterfaceIngressCovered","type":"\u0004","is_mandatory":true,"title":"Whether secondary interface ingress is covered","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"workloadRef":{"name":"workloadRef","type":"\u0007","is_mandatory":true,"title":"Workload reference when coverage is tied to a specific workload","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Normalized Kubernetes network policy coverage","desc":"Represents policy coverage for a workload selector and network interfaces. Native Kubernetes NetworkPolicy applies to primary pod networking unless the CNI explicitly extends it; secondary-interface policy coverage is tracked separately through MultiNetworkPolicy and compatible integrations.","private":true,"min_provider_version":"13.3.2","defaults":"namespace policyRef defaultDenyIngress defaultDenyEgress","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.networkpolicy":{"id":"k8s.networkpolicy","name":"k8s.networkpolicy","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"coverage":{"name":"coverage","type":"\u001bk8s.networkPolicyCoverage","title":"Normalized policy coverage summary for this NetworkPolicy","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"egress":{"name":"egress","type":"\u0019\n","title":"Egress rules allowing outbound traffic from the selected pods","desc":"Each rule holds `to` (a list of allowed peers) and `ports` (a list of allowed ports). A peer is one of `podSelector`, `namespaceSelector`, or `ipBlock` ({cidr, except}). A port entry holds `protocol` (TCP, UDP, or SCTP), `port`, and an optional `endPort`. An empty `to` allows all destinations and an empty `ports` allows all ports. When egress is empty and Egress appears in policyTypes, all outbound traffic is denied.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ingress":{"name":"ingress","type":"\u0019\n","title":"Ingress rules allowing inbound traffic to the selected pods","desc":"Each rule holds `from` (a list of allowed peers) and `ports` (a list of allowed ports). A peer is one of `podSelector`, `namespaceSelector`, or `ipBlock` ({cidr, except}). A port entry holds `protocol` (TCP, UDP, or SCTP), `port`, and an optional `endPort`. An empty `from` allows all sources and an empty `ports` allows all ports. When ingress is empty and Ingress appears in policyTypes, all inbound traffic is denied.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSelector":{"name":"podSelector","type":"\n","title":"Label selector for pods this policy applies to","desc":"Selects the pods governed by this policy within the namespace. An empty selector matches all pods in the namespace. Holds `matchLabels` (a map of label key to value) and `matchExpressions` (a list of {key, operator, values} requirements). Pods matching this selector deny all traffic that the ingress and egress rules do not explicitly permit.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyTypes":{"name":"policyTypes","type":"\u0019\u0007","title":"Policy types in effect (Ingress and/or Egress)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"Network policy spec","desc":"Raw NetworkPolicySpec containing `podSelector`, `policyTypes`, `ingress`, and `egress`. The podSelector, policyTypes, ingress, and egress fields expose these same values in a structured form for direct querying.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Network Policy","desc":"Rule set that controls allowed network traffic to and from pods, selected by namespace and name. The podSelector field chooses the pods the policy governs, policyTypes reports whether ingress, egress, or both are restricted, and the ingress and egress fields list the permitted peers and ports. Pods selected by a policy deny all traffic not explicitly allowed by these rules.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.node":{"id":"k8s.node","name":"k8s.node","fields":{"addresses":{"name":"addresses","type":"\u0019\u001bk8s.nodeAddress","title":"Node network addresses (e.g., InternalIP, ExternalIP, Hostname)","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allocatable":{"name":"allocatable","type":"\n","title":"Resources available for scheduling pods on the node","desc":"Keys are resource names such as cpu, memory, pods, and ephemeral-storage; values are Kubernetes quantity strings. This is capacity minus the resources reserved for system daemons and eviction thresholds.","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"architecture":{"name":"architecture","type":"\u0007","title":"CPU architecture reported by the kubelet (e.g., amd64, arm64)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"capacity":{"name":"capacity","type":"\n","title":"Total hardware resources installed on the node","desc":"Keys are resource names such as cpu, memory, pods, and ephemeral-storage; values are Kubernetes quantity strings. Compare with allocatable, which subtracts resources reserved for system daemons and eviction thresholds.","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\u001bk8s.nodeCondition","title":"Node health conditions (e.g., Ready, MemoryPressure, DiskPressure)","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerRuntimeVersion":{"name":"containerRuntimeVersion","type":"\u0007","title":"Container runtime version (e.g., containerd://1.7.20)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","min_provider_version":"11.1.42","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"images":{"name":"images","type":"\u0019\n","title":"Container images present on the node (names + sizeBytes)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kernelVersion":{"name":"kernelVersion","type":"\u0007","title":"Kernel version reported by the kubelet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kubeletPort":{"name":"kubeletPort","type":"\u0005","is_mandatory":true,"title":"Kubelet port","min_provider_version":"11.1.42","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kubeletVersion":{"name":"kubeletVersion","type":"\u0007","title":"Kubelet version","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plural name of the resource","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeInfo":{"name":"nodeInfo","type":"\n","title":"Hardware and software details reported by the kubelet","desc":"Keys are machineID, systemUUID, bootID, kernelVersion, osImage, containerRuntimeVersion, kubeletVersion, kubeProxyVersion, operatingSystem, and architecture. Several of these values are also exposed directly as node fields such as osImage, kernelVersion, kubeletVersion, containerRuntimeVersion, operatingSystem, and architecture.","min_provider_version":"11.1.42","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"operatingSystem":{"name":"operatingSystem","type":"\u0007","title":"Operating system reported by the kubelet (e.g., linux, windows)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"osImage":{"name":"osImage","type":"\u0007","title":"OS image reported by the kubelet (e.g., \"Ubuntu 22.04.5 LTS\")","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podCIDR":{"name":"podCIDR","type":"\u0007","title":"CIDR range assigned to pods on this node (legacy single-CIDR field)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podCIDRs":{"name":"podCIDRs","type":"\u0019\u0007","title":"CIDR ranges assigned to pods on this node (one per IP family)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"providerID":{"name":"providerID","type":"\u0007","title":"Cloud-provider node identifier (e.g., aws:///us-east-1a/i-0123456789abcdef0)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"taints":{"name":"taints","type":"\u0019\u001bk8s.nodeTaint","title":"Node taints for pod scheduling","min_provider_version":"11.1.138","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unschedulable":{"name":"unschedulable","type":"\u0004","title":"Whether the node is marked as unschedulable (cordoned)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumesAttached":{"name":"volumesAttached","type":"\u0019\n","title":"Volumes currently attached to the node","desc":"Each entry has name (the attached volume's unique name) and devicePath (the path at which the device is mounted on the node).","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumesInUse":{"name":"volumesInUse","type":"\u0019\u0007","title":"Names of volumes currently in use by pods on the node","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes node","desc":"Worker or control-plane machine that runs pods, selected by name. The capacity and allocatable fields report total and schedulable resources, conditions surfaces health signals such as Ready and MemoryPressure, taints lists the scheduling restrictions pods must tolerate, and addresses holds the node's hostnames and IPs. The osImage, kernelVersion, kubeletVersion, containerRuntimeVersion, operatingSystem, and architecture fields report the node's software stack, and unschedulable reports whether the node is cordoned.","private":true,"min_provider_version":"9.0.0","defaults":"name labels['kubernetes.io/arch'] labels['kubernetes.io/os'] ","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.nodeAddress":{"id":"k8s.nodeAddress","name":"k8s.nodeAddress","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Node address value","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Address type (Hostname, ExternalIP, InternalIP, ExternalDNS, InternalDNS)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes node address","private":true,"min_provider_version":"11.1.139","defaults":"type address","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.nodeCondition":{"id":"k8s.nodeCondition","name":"k8s.nodeCondition","fields":{"lastHeartbeatTime":{"name":"lastHeartbeatTime","type":"\t","is_mandatory":true,"title":"Last time the condition was updated","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"lastTransitionTime":{"name":"lastTransitionTime","type":"\t","is_mandatory":true,"title":"Last time the condition transitioned between statuses","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"message":{"name":"message","type":"\u0007","is_mandatory":true,"title":"Human-readable message with details about the last transition","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reason":{"name":"reason","type":"\u0007","is_mandatory":true,"title":"Brief machine-readable reason for the condition's last transition","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Condition status (True, False, Unknown)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Condition type (Ready, MemoryPressure, DiskPressure, PIDPressure, NetworkUnavailable)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes node condition","private":true,"min_provider_version":"11.1.139","defaults":"type status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.nodeTaint":{"id":"k8s.nodeTaint","name":"k8s.nodeTaint","fields":{"effect":{"name":"effect","type":"\u0007","is_mandatory":true,"title":"Taint effect (NoSchedule, PreferNoSchedule, NoExecute)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Taint key that pods must tolerate to be scheduled on the node","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"timeAdded":{"name":"timeAdded","type":"\t","is_mandatory":true,"title":"Time the taint was added","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Taint value (optional) that pods must match alongside the key","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes node taint","private":true,"min_provider_version":"11.1.139","defaults":"key value effect","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.ownerReference":{"id":"k8s.ownerReference","name":"k8s.ownerReference","fields":{"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"API version of the referent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"blockOwnerDeletion":{"name":"blockOwnerDeletion","type":"\u0004","is_mandatory":true,"title":"Whether the referent blocks foreground cascading deletion","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"controller":{"name":"controller","type":"\u0004","is_mandatory":true,"title":"Whether the referent is the managing controller","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind of the referent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the referent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"UID of the referent","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes owner reference","desc":"Controller or parent object that owns this object, as recorded in metadata.ownerReferences. The referent is identified by apiVersion, kind, name, and uid, with flags for whether it is the managing controller and whether it blocks foreground cascading deletion. Correlate uid against the uid of any modeled object to trace provenance and ownership chains across the cluster.","private":true,"min_provider_version":"13.2.2","defaults":"kind name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.persistentvolume":{"id":"k8s.persistentvolume","name":"k8s.persistentvolume","fields":{"accessModes":{"name":"accessModes","type":"\u0019\u0007","title":"Access modes the volume supports (ReadWriteOnce, ReadOnlyMany, ReadWriteMany, ReadWriteOncePod)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"capacity":{"name":"capacity","type":"\u001a\u0007\u0007","title":"Total capacity of the volume (resource name -\u003e quantity string, e.g., {storage: \"100Gi\"})","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"claim":{"name":"claim","type":"\u001bk8s.persistentvolumeclaim","title":"The PVC bound to this volume (null if unbound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"claimName":{"name":"claimName","type":"\u0007","title":"Name of the PVC bound to this volume (null if unbound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"claimNamespace":{"name":"claimNamespace","type":"\u0007","title":"Namespace of the PVC bound to this volume (null if unbound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"message":{"name":"message","type":"\u0007","title":"Human-readable message about the current phase","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountOptions":{"name":"mountOptions","type":"\u0019\u0007","title":"Mount options propagated to volume mounts","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeAffinity":{"name":"nodeAffinity","type":"\n","title":"Node-affinity constraints that gate where this volume can be attached","desc":"Raw node-affinity dict. The `required` key holds a node selector whose `nodeSelectorTerms` list the label requirements a node must satisfy for the volume to attach there. Empty when the volume has no topology restrictions.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentVolumeReclaimPolicy":{"name":"persistentVolumeReclaimPolicy","type":"\u0007","title":"Reclaim policy when the bound claim is released (Retain, Delete, Recycle)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"phase":{"name":"phase","type":"\u0007","title":"Current phase (Pending, Available, Bound, Released, Failed)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reason":{"name":"reason","type":"\u0007","title":"Reason for the current phase (e.g., why Failed)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"PersistentVolume spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\n","title":"PersistentVolume status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClass":{"name":"storageClass","type":"\u001bk8s.storageclass","title":"The StorageClass that backs this volume (null if storageClassName is empty)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClassName":{"name":"storageClassName","type":"\u0007","title":"Name of the StorageClass that backs this volume","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMode":{"name":"volumeMode","type":"\u0007","title":"Volume mode (Filesystem or Block)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes PersistentVolume","desc":"Cluster-wide piece of storage provisioned for use by pods, selected by name. The capacity, accessModes, volumeMode, and storageClass fields describe the volume's size and capabilities, persistentVolumeReclaimPolicy governs what happens when its claim is released, and phase reports its lifecycle state (Available, Bound, Released, or Failed). The claim field returns the PersistentVolumeClaim currently bound to the volume.","private":true,"min_provider_version":"11.1.139","defaults":"name capacity['storage'] phase storageClassName created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.persistentvolumeclaim":{"id":"k8s.persistentvolumeclaim","name":"k8s.persistentvolumeclaim","fields":{"accessModes":{"name":"accessModes","type":"\u0019\u0007","title":"Access modes the claim requires (ReadWriteOnce, ReadOnlyMany, ReadWriteMany, ReadWriteOncePod)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"boundAccessModes":{"name":"boundAccessModes","type":"\u0019\u0007","title":"Access modes the bound volume actually provides","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"capacity":{"name":"capacity","type":"\u001a\u0007\u0007","title":"Actual capacity of the bound volume (resource name -\u003e quantity string)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions reporting resize and provisioning progress","desc":"Each entry is a dict with type, status, lastProbeTime, lastTransitionTime, reason, and message keys. Common type values are Resizing and FileSystemResizePending, which surface an in-progress volume expansion.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dataSource":{"name":"dataSource","type":"\n","title":"Data source for populating the volume","desc":"Existing object to clone or restore into the newly provisioned volume, as a dict with apiGroup, kind, and name keys. Common sources are a VolumeSnapshot, another PersistentVolumeClaim, or a custom resource. See dataSourceRef for the form that can also reference objects in another namespace.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dataSourceRef":{"name":"dataSourceRef","type":"\n","title":"Data source reference for populating the volume","desc":"Object to clone or restore into the newly provisioned volume, as a dict with apiGroup, kind, name, and namespace keys. Unlike dataSource it can reference an object in another namespace (subject to a granting ReferenceGrant) and any resource kind.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"phase":{"name":"phase","type":"\u0007","title":"Current phase (Pending, Bound, Lost)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\n","title":"Resource requirements (requests, limits keyed by resource name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector for preexisting PersistentVolumes eligible to satisfy the claim","desc":"Constrains which existing PersistentVolumes may bind to the claim. A dict with matchLabels (label name to required value) and matchExpressions (list of {key, operator, values} requirements) keys. Empty when the claim relies on dynamic provisioning through its StorageClass instead of matching an existing volume.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"PersistentVolumeClaim spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\n","title":"PersistentVolumeClaim status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClass":{"name":"storageClass","type":"\u001bk8s.storageclass","title":"The StorageClass requested by the claim (null if storageClassName is empty)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"storageClassName":{"name":"storageClassName","type":"\u0007","title":"Name of the StorageClass requested by the claim","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volume":{"name":"volume","type":"\u001bk8s.persistentvolume","title":"The PV the claim is bound to (null if unbound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeMode":{"name":"volumeMode","type":"\u0007","title":"Volume mode (Filesystem or Block)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeName":{"name":"volumeName","type":"\u0007","title":"Name of the PV the claim is bound to (empty until bound)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes PersistentVolumeClaim","desc":"Request for storage by a pod, selected by namespace and name. The accessModes, resources, storageClass, and volumeMode fields describe the storage requested, volume and volumeName identify the bound PersistentVolume, and phase reports whether the claim is Pending, Bound, or Lost. The capacity and boundAccessModes fields report what the bound volume actually provides.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name phase capacity['storage'] storageClassName created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.pod":{"id":"k8s.pod","name":"k8s.pod","fields":{"activeDeadlineSeconds":{"name":"activeDeadlineSeconds","type":"\u0005","title":"Maximum number of seconds the pod may run before being terminated","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"affinity":{"name":"affinity","type":"\n","title":"Node, pod, and pod anti-affinity rules","desc":"Scheduling constraints keyed by nodeAffinity, podAffinity, and podAntiAffinity. Each holds requiredDuringSchedulingIgnoredDuringExecution (hard) and preferredDuringSchedulingIgnoredDuringExecution (soft) rules.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes object version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Pod-level status conditions (PodScheduled, ContainersReady, Initialized, Ready)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerStatuses":{"name":"containerStatuses","type":"\u0019\u001bk8s.containerStatus","title":"Container statuses","min_provider_version":"11.1.110","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"daemonSet":{"name":"daemonSet","type":"\u001bk8s.daemonset","title":"DaemonSet that owns this pod (null if not owned by one)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"deployment":{"name":"deployment","type":"\u001bk8s.deployment","title":"Deployment that owns this pod via its ReplicaSet (null if not part of a deployment-managed rollout)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dnsConfig":{"name":"dnsConfig","type":"\n","title":"DNS configuration when dnsPolicy is None (nameservers, searches, options)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dnsPolicy":{"name":"dnsPolicy","type":"\u0007","title":"DNS policy (ClusterFirst, ClusterFirstWithHostNet, Default, None)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"enableServiceLinks":{"name":"enableServiceLinks","type":"\u0004","title":"Whether environment variables for active services are injected into containers","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ephemeralContainers":{"name":"ephemeralContainers","type":"\u0019\u001bk8s.ephemeralContainer","title":"Ephemeral containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"escapesNetworkPolicy":{"name":"escapesNetworkPolicy","type":"\u0004","title":"Whether NetworkPolicy does not apply to this pod","desc":"True when the pod uses host networking, so Kubernetes NetworkPolicy governs neither its ingress nor its egress traffic. Such pods are a coverage gap for any default-deny posture.","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"exposures":{"name":"exposures","type":"\u0019\u001bk8s.networkExposure","title":"Network exposures that route to this pod through a Service, Ingress, or Gateway","min_provider_version":"13.3.4","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasImageDigestDrift":{"name":"hasImageDigestDrift","type":"\u0004","title":"Whether a running image has drifted from its spec reference","desc":"True when a container's spec references a mutable tag (not a digest) but the kubelet resolved it to a concrete digest, so a restart or reschedule could silently pull a different image for that tag.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostAliases":{"name":"hostAliases","type":"\u0019\n","title":"Host alias entries added to /etc/hosts","desc":"Each entry has keys ip and hostnames (the host names mapped to that IP in every container's /etc/hosts).","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIP":{"name":"hostIP","type":"\u0007","title":"IP address of the host the pod is running on","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostname":{"name":"hostname","type":"\u0007","title":"Pod hostname (defaults to metadata.name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullSecrets":{"name":"imagePullSecrets","type":"\u0019\n","title":"References to image-pull secrets in the same namespace","desc":"Each entry has a single key name, referencing a Secret of type kubernetes.io/dockerconfigjson in the pod's namespace used to authenticate to private registries.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"job":{"name":"job","type":"\u001bk8s.job","title":"Job that owns this pod (null if not owned by one)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"message":{"name":"message","type":"\u0007","title":"Human-readable message about the pod's current phase","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"node":{"name":"node","type":"\u001bk8s.node","title":"Node the pod runs on","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeName":{"name":"nodeName","type":"\u0007","title":"Name of the node the pod is bound to","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nodeSelector":{"name":"nodeSelector","type":"\u001a\u0007\u0007","title":"Required node labels for scheduling this pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nominatedNodeName":{"name":"nominatedNodeName","type":"\u0007","title":"Name of the node selected by the scheduler for preemption (when applicable)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"os":{"name":"os","type":"\n","title":"OS the pod runs on (e.g., {name: \"linux\"})","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"overhead":{"name":"overhead","type":"\u001a\u0007\u0007","title":"Resource overhead associated with the runtime (CPU, memory, etc.)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"phase":{"name":"phase","type":"\u0007","title":"Pod phase (Pending, Running, Succeeded, Failed, Unknown)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podIP":{"name":"podIP","type":"\u0007","title":"IP address allocated to the pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podIPs":{"name":"podIPs","type":"\u0019\u0007","title":"All IP addresses allocated to the pod (one per IP family)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"preemptionPolicy":{"name":"preemptionPolicy","type":"\u0007","title":"Preemption policy (PreemptLowerPriority or Never)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"priorityClass":{"name":"priorityClass","type":"\u001bk8s.priorityclass","title":"The PriorityClass that controls scheduling priority","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"priorityClassName":{"name":"priorityClassName","type":"\u0007","title":"Name of the PriorityClass that controls scheduling priority","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"qosClass":{"name":"qosClass","type":"\u0007","title":"Quality-of-Service class assigned to the pod (Guaranteed, Burstable, BestEffort)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readinessGates":{"name":"readinessGates","type":"\u0019\n","title":"Additional readiness gates the pod must satisfy before being marked ready","desc":"Each entry has a single key conditionType, naming a custom pod condition that must report status True before the pod is considered ready.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reason":{"name":"reason","type":"\u0007","title":"Brief CamelCase reason for the pod's current phase","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicaSet":{"name":"replicaSet","type":"\u001bk8s.replicaset","title":"ReplicaSet that owns this pod (null if not owned by one)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"restartPolicy":{"name":"restartPolicy","type":"\u0007","title":"Restart policy for all containers (Always, OnFailure, Never)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runningImageDigests":{"name":"runningImageDigests","type":"\u0019\u0007","title":"Running image digests","desc":"Unique sha256 digests actually running in this pod, as resolved by the kubelet from container statuses. Carries a digest even when the spec used a mutable tag, so it reflects what is really executing rather than declared.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runtimeClassName":{"name":"runtimeClassName","type":"\u0007","title":"Name of the RuntimeClass that selects the container runtime","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"schedulerName":{"name":"schedulerName","type":"\u0007","title":"Name of the scheduler that handles this pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccount":{"name":"serviceAccount","type":"\u001bk8s.serviceaccount","title":"The ServiceAccount used to run the pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccountName":{"name":"serviceAccountName","type":"\u0007","title":"Name of the ServiceAccount used to run the pod","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"services":{"name":"services","type":"\u0019\u001bk8s.service","title":"Services whose label selector matches this pod","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"shareProcessNamespace":{"name":"shareProcessNamespace","type":"\u0004","title":"Whether containers in the pod share a single PID namespace","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"startTime":{"name":"startTime","type":"\t","title":"Time at which the pod was acknowledged by the kubelet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"statefulSet":{"name":"statefulSet","type":"\u001bk8s.statefulset","title":"StatefulSet that owns this pod (null if not owned by one)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subdomain":{"name":"subdomain","type":"\u0007","title":"Subdomain used to construct the pod's FQDN","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"terminationGracePeriodSeconds":{"name":"terminationGracePeriodSeconds","type":"\u0005","title":"Grace period in seconds before forceful termination","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"tolerations":{"name":"tolerations","type":"\u0019\n","title":"Node taints this pod tolerates","desc":"Each entry has keys key, operator (Exists or Equal), value, effect (NoSchedule, PreferNoSchedule, or NoExecute), and tolerationSeconds. An empty effect tolerates the matched key under every taint effect.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"topologySpreadConstraints":{"name":"topologySpreadConstraints","type":"\u0019\n","title":"Topology spread constraints","desc":"Rules controlling how the pod's replicas spread across failure domains. Each entry has keys maxSkew, topologyKey, whenUnsatisfiable (DoNotSchedule or ScheduleAnyway), labelSelector, minDomains, matchLabelKeys, nodeAffinityPolicy, and nodeTaintsPolicy.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Pod","desc":"Smallest deployable unit, one or more co-scheduled containers sharing a network and storage context, selected by namespace and name. The containers, initContainers, and ephemeralContainers accessors expose the workload and its images, command, resources, and securityContext, while containerStatuses reports their runtime state. Scheduling is described by node, nodeSelector, tolerations, affinity, priorityClass, and serviceAccount; the host-namespace and security posture by hostNetwork, hostPID, hostIPC, and securityContext; and runtime status by phase, qosClass, podIP, and conditions. The owning controller is reached through replicaSet, statefulSet, daemonSet, job, and deployment.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.poddisruptionbudget":{"id":"k8s.poddisruptionbudget","name":"k8s.poddisruptionbudget","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","is_mandatory":true,"title":"Status conditions","desc":"The most recently observed conditions for this budget. Each entry carries `type`, `status` (True, False, or Unknown), `reason`, `message`, `observedGeneration`, and `lastTransitionTime`. The `DisruptionAllowed` condition reports whether the budget currently permits a voluntary eviction.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentHealthy":{"name":"currentHealthy","type":"\u0005","is_mandatory":true,"title":"Number of currently healthy pods","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredHealthy":{"name":"desiredHealthy","type":"\u0005","is_mandatory":true,"title":"Minimum number of healthy pods required","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"disruptionsAllowed":{"name":"disruptionsAllowed","type":"\u0005","is_mandatory":true,"title":"Number of pod disruptions currently allowed","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"expectedPods":{"name":"expectedPods","type":"\u0005","is_mandatory":true,"title":"Total number of pods counted by this PDB","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"maxUnavailable":{"name":"maxUnavailable","type":"\n","is_mandatory":true,"title":"Maximum number or percentage of pods that may be unavailable (IntOrString)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minAvailable":{"name":"minAvailable","type":"\n","is_mandatory":true,"title":"Minimum number or percentage of pods that must remain available (IntOrString)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","is_mandatory":true,"title":"Generation of the most recently observed PDB spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","is_mandatory":true,"title":"Label selector for the pods this budget protects","desc":"The standard Kubernetes label selector. `matchLabels` holds a map of label key/value pairs a pod must carry, and `matchExpressions` holds a list of set-based requirements, each with `key`, `operator` (In, NotIn, Exists, or DoesNotExist), and `values`. A pod must satisfy every entry to be counted by the budget.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unhealthyPodEvictionPolicy":{"name":"unhealthyPodEvictionPolicy","type":"\u0007","is_mandatory":true,"title":"Policy for evicting unhealthy pods (IfHealthyBudget or AlwaysAllow)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes PodDisruptionBudget","desc":"Policy that limits how many pods of a workload may be down at once during voluntary disruptions, selected by namespace and name. The minAvailable and maxUnavailable fields set the budget, selector chooses the protected pods, and unhealthyPodEvictionPolicy governs eviction of unhealthy pods. Current state is reported by currentHealthy, desiredHealthy, expectedPods, and disruptionsAllowed.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.priorityclass":{"id":"k8s.priorityclass","name":"k8s.priorityclass","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Arbitrary text description of this priority class","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"globalDefault":{"name":"globalDefault","type":"\u0004","is_mandatory":true,"title":"Whether this priority class is the global default","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"preemptionPolicy":{"name":"preemptionPolicy","type":"\u0007","is_mandatory":true,"title":"Preemption policy (PreemptLowerPriority or Never)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"value":{"name":"value","type":"\u0005","is_mandatory":true,"title":"The value of this priority class (higher is more important)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes PriorityClass","desc":"Named scheduling priority that pods can request, selected by name. The value field sets the integer priority used during scheduling and preemption, globalDefault marks the class applied to pods that request none, and preemptionPolicy controls whether higher-priority pods may evict lower-priority ones.","private":true,"min_provider_version":"11.1.139","defaults":"name value","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac":{"id":"k8s.rbac","fields":{"clusterrole":{"name":"clusterrole","type":"\u001bk8s.rbac.clusterrole","title":"Kubernetes ClusterRole","desc":"Cluster-wide set of RBAC permissions, selected by name. The rules field lists the API groups, resources, and verbs the role grants, aggregationRule describes how the role aggregates other ClusterRoles by label, and boundBy returns the ClusterRoleBindings that grant this role to subjects.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"clusterrolebinding":{"name":"clusterrolebinding","type":"\u001bk8s.rbac.clusterrolebinding","title":"Kubernetes ClusterRoleBinding","desc":"Grant that binds a ClusterRole to a set of subjects cluster-wide, selected by name. The subjects field lists the users, groups, and service accounts the role is granted to, serviceAccounts resolves the service-account subjects to their objects, and clusterRole returns the ClusterRole named by roleRef.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"policyRule":{"name":"policyRule","type":"\u001bk8s.rbac.policyRule","title":"Kubernetes RBAC policy rule","desc":"Single grant from the rules list of a Role or ClusterRole, combining the verbs, apiGroups, resources, resourceNames, and nonResourceURLs that together determine which actions a subject bound to the role may perform.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"role":{"name":"role","type":"\u001bk8s.rbac.role","title":"Kubernetes Role","desc":"Namespaced set of RBAC permissions, selected by namespace and name. The rules field lists the API groups, resources, and verbs the role grants within its namespace, and boundBy returns the RoleBindings that grant this role to subjects.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"rolebinding":{"name":"rolebinding","type":"\u001bk8s.rbac.rolebinding","title":"Kubernetes RoleBinding","desc":"Grant that binds a Role or ClusterRole to subjects within a namespace, selected by namespace and name. The subjects field lists the users, groups, and service accounts the permissions are granted to, serviceAccounts resolves the service-account subjects to their objects, and role or clusterRole returns the object named by roleRef depending on its kind.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"subject":{"name":"subject","type":"\u001bk8s.rbac.subject","title":"RBAC subject and its effective cluster permissions","desc":"A single user, group, or service account named as a subject in at least one RoleBinding or ClusterRoleBinding, with the permissions of every bound Role and ClusterRole folded into one view of what the subject is allowed to do. The kind, name, and namespace fields identify the subject (namespace is set only for service accounts), serviceAccount resolves a ServiceAccount subject to its object, and roleBindings and clusterRoleBindings list the grants that name the subject. The isClusterAdmin, canEscalatePrivileges, canReadSecrets, and hasWildcardPermissions predicates summarize the most security-relevant capabilities the bound roles confer. Enumerate every subject in the cluster through k8s.rbacSubjects, or find the subjects allowed a specific action with k8s.rbac.whoCan.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true},"whoCan":{"name":"whoCan","type":"\u001bk8s.rbac.whoCan","title":"RBAC subjects permitted to perform an action","desc":"Resolution of which users, groups, and service accounts the cluster's RoleBindings and ClusterRoleBindings allow to perform a given action, computed from the rules of the granted roles. The verb and resource arguments select the action, group narrows it to an API group (empty for the core group), namespace restricts the check to one namespace (empty considers every namespace), and name targets a specific object. For example, `k8s.rbac.whoCan(verb: \"list\", resource: \"secrets\").subjects` lists every subject that can read Secrets across the cluster. The result reflects RBAC grants only and does not account for the node or webhook authorizers; pair it with k8s.accessReview for an authoritative per-subject decision from the API server.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/k8s","is_implicit_resource":true}},"is_extension":true},"k8s.rbac.clusterrole":{"id":"k8s.rbac.clusterrole","name":"k8s.rbac.clusterrole","fields":{"aggregationRule":{"name":"aggregationRule","type":"\n","is_mandatory":true,"title":"Rule controlling how this ClusterRole aggregates others","desc":"Holds `clusterRoleSelectors`, a list of label selectors; the permissions of every ClusterRole matching a selector are merged into this role's rules. Null when the role does not aggregate.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether any rule grants RBAC privilege escalation","desc":"True when a rule allows the `escalate` or `bind` verb on RBAC roles or bindings, or the `impersonate` verb on users, groups, or service accounts. These are the canonical ways a subject can grant itself more privileges than it currently holds. Wildcard verbs/resources/apiGroups that cover those permissions also count.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"boundBy":{"name":"boundBy","type":"\u0019\u001bk8s.rbac.clusterrolebinding","title":"ClusterRoleBindings that reference this ClusterRole via roleRef","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether any rule grants read access (get, list, or watch) to Secrets","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grantsClusterAdmin":{"name":"grantsClusterAdmin","type":"\u0004","title":"Whether any rule grants unrestricted access (wildcard verbs, API groups, and resources), i.e. cluster-admin","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardRule":{"name":"hasWildcardRule","type":"\u0004","title":"Whether any rule uses a wildcard (\"*\") for verbs, API groups, or resources","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyRules":{"name":"policyRules","type":"\u0019\u001bk8s.rbac.policyRule","title":"Access rules as typed policy-rule resources (a structured view of `rules`)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Access rules granted by this ClusterRole","desc":"Each entry has `verbs`, `apiGroups`, `resources`, `resourceNames`, and `nonResourceURLs`. See policyRules for the same rules as structured resources.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ClusterRole","desc":"Cluster-wide set of RBAC permissions, selected by name. The rules field lists the API groups, resources, and verbs the role grants, aggregationRule describes how the role aggregates other ClusterRoles by label, and boundBy returns the ClusterRoleBindings that grant this role to subjects.","private":true,"min_provider_version":"9.0.0","defaults":"name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.clusterrolebinding":{"id":"k8s.rbac.clusterrolebinding","name":"k8s.rbac.clusterrolebinding","fields":{"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether the granted ClusterRole allows RBAC privilege escalation (escalate/bind/impersonate)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether the granted ClusterRole can read Secrets (get, list, or watch)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterRole":{"name":"clusterRole","type":"\u001bk8s.rbac.clusterrole","title":"The ClusterRole granted by this binding (roleRef.name)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grantsClusterAdmin":{"name":"grantsClusterAdmin","type":"\u0004","title":"Whether the granted ClusterRole confers cluster-admin (wildcard verbs, API groups, and resources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardRule":{"name":"hasWildcardRule","type":"\u0004","title":"Whether the granted ClusterRole has any wildcard rule","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roleRef":{"name":"roleRef","type":"\n","is_mandatory":true,"title":"Reference to the ClusterRole this binding grants","desc":"Holds `apiGroup`, `kind` (always ClusterRole), and `name`. See clusterRole for the referenced role resolved to its object.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccounts":{"name":"serviceAccounts","type":"\u0019\u001bk8s.serviceaccount","title":"ServiceAccounts referenced as subjects (entries where kind == \"ServiceAccount\" resolved to typed resources)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subjects":{"name":"subjects","type":"\u0019\n","is_mandatory":true,"title":"Subjects the ClusterRole is granted to","desc":"Each entry has `kind` (User, Group, or ServiceAccount), `name`, `apiGroup`, and `namespace` (set only for ServiceAccount subjects). See serviceAccounts for the ServiceAccount entries resolved to their objects.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ClusterRoleBinding","desc":"Grant that binds a ClusterRole to a set of subjects cluster-wide, selected by name. The subjects field lists the users, groups, and service accounts the role is granted to, serviceAccounts resolves the service-account subjects to their objects, and clusterRole returns the ClusterRole named by roleRef.","private":true,"min_provider_version":"9.0.0","defaults":"name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.policyRule":{"id":"k8s.rbac.policyRule","name":"k8s.rbac.policyRule","fields":{"apiGroups":{"name":"apiGroups","type":"\u0019\u0007","is_mandatory":true,"title":"API groups the rule applies to (\"\" is the core group; \"*\" matches all)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"nonResourceURLs":{"name":"nonResourceURLs","type":"\u0019\u0007","is_mandatory":true,"title":"Non-resource URLs the rule grants access to (e.g., /healthz; mutually exclusive with resources)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceNames":{"name":"resourceNames","type":"\u0019\u0007","is_mandatory":true,"title":"Object names the rule is restricted to (empty means all objects of the listed resources)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resources":{"name":"resources","type":"\u0019\u0007","is_mandatory":true,"title":"Resources the rule applies to (e.g., pods, secrets; \"*\" matches all; may include subresources like pods/exec)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"verbs":{"name":"verbs","type":"\u0019\u0007","is_mandatory":true,"title":"Verbs that apply to the listed resources or non-resource URLs (e.g., get, list, watch, create; \"*\" matches all)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes RBAC policy rule","desc":"Single grant from the rules list of a Role or ClusterRole, combining the verbs, apiGroups, resources, resourceNames, and nonResourceURLs that together determine which actions a subject bound to the role may perform.","private":true,"min_provider_version":"13.2.2","defaults":"verbs apiGroups resources","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.role":{"id":"k8s.rbac.role","name":"k8s.rbac.role","fields":{"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether any rule grants RBAC privilege escalation","desc":"True when a rule allows the `escalate` or `bind` verb on RBAC roles or bindings, or the `impersonate` verb on users, groups, or service accounts. These are the canonical ways a subject can grant itself more privileges than it currently holds. Wildcard verbs/resources/apiGroups that cover those permissions also count.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"boundBy":{"name":"boundBy","type":"\u0019\u001bk8s.rbac.rolebinding","title":"RoleBindings in this namespace that reference this Role via roleRef","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether any rule grants read access (get, list, or watch) to Secrets","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grantsClusterAdmin":{"name":"grantsClusterAdmin","type":"\u0004","title":"Whether any rule grants unrestricted access (wildcard verbs, API groups, and resources), i.e. cluster-admin","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardRule":{"name":"hasWildcardRule","type":"\u0004","title":"Whether any rule uses a wildcard (\"*\") for verbs, API groups, or resources","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"policyRules":{"name":"policyRules","type":"\u0019\u001bk8s.rbac.policyRule","title":"Access rules as typed policy-rule resources (a structured view of `rules`)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Access rules granted by this Role within its namespace","desc":"Each entry has `verbs`, `apiGroups`, `resources`, `resourceNames`, and `nonResourceURLs`. See policyRules for the same rules as structured resources.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Role","desc":"Namespaced set of RBAC permissions, selected by namespace and name. The rules field lists the API groups, resources, and verbs the role grants within its namespace, and boundBy returns the RoleBindings that grant this role to subjects.","private":true,"min_provider_version":"9.0.0","defaults":"name namespace","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.rolebinding":{"id":"k8s.rbac.rolebinding","name":"k8s.rbac.rolebinding","fields":{"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether the granted role allows RBAC privilege escalation (escalate/bind/impersonate)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether the granted role can read Secrets (get, list, or watch)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterRole":{"name":"clusterRole","type":"\u001bk8s.rbac.clusterrole","title":"The ClusterRole granted by this binding (null when roleRef points to a Role)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"grantsClusterAdmin":{"name":"grantsClusterAdmin","type":"\u0004","title":"Whether the granted role confers cluster-admin (wildcard verbs, API groups, and resources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardRule":{"name":"hasWildcardRule","type":"\u0004","title":"Whether the granted role has any wildcard rule","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"role":{"name":"role","type":"\u001bk8s.rbac.role","title":"The Role granted by this binding (null when roleRef points to a ClusterRole)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roleRef":{"name":"roleRef","type":"\n","is_mandatory":true,"title":"Reference to the Role or ClusterRole this binding grants","desc":"Holds `apiGroup`, `kind` (Role or ClusterRole), and `name`. A Role is resolved in this binding's namespace and a ClusterRole is global. See role and clusterRole for the referenced object.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccounts":{"name":"serviceAccounts","type":"\u0019\u001bk8s.serviceaccount","title":"ServiceAccounts referenced as subjects (entries where kind == \"ServiceAccount\" resolved to typed resources)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subjects":{"name":"subjects","type":"\u0019\n","is_mandatory":true,"title":"Subjects the role is granted to","desc":"Each entry has `kind` (User, Group, or ServiceAccount), `name`, `apiGroup`, and `namespace` (set only for ServiceAccount subjects). See serviceAccounts for the ServiceAccount entries resolved to their objects.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes RoleBinding","desc":"Grant that binds a Role or ClusterRole to subjects within a namespace, selected by namespace and name. The subjects field lists the users, groups, and service accounts the permissions are granted to, serviceAccounts resolves the service-account subjects to their objects, and role or clusterRole returns the object named by roleRef depending on its kind.","private":true,"min_provider_version":"9.0.0","defaults":"name namespace created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.subject":{"id":"k8s.rbac.subject","name":"k8s.rbac.subject","fields":{"canEscalatePrivileges":{"name":"canEscalatePrivileges","type":"\u0004","title":"Whether any bound role allows RBAC privilege escalation (escalate, bind, or impersonate)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether any bound role can read Secrets (get, list, or watch)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterRoleBindings":{"name":"clusterRoleBindings","type":"\u0019\u001bk8s.rbac.clusterrolebinding","title":"ClusterRoleBindings that name this subject","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardPermissions":{"name":"hasWildcardPermissions","type":"\u0004","title":"Whether any bound role has a wildcard rule (wildcard verbs, API groups, or resources)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isClusterAdmin":{"name":"isClusterAdmin","type":"\u0004","title":"Whether any bound role confers cluster-admin (wildcard verbs, API groups, and resources)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Subject kind: User, Group, or ServiceAccount","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Subject name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace of a service account subject (empty for users and groups)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roleBindings":{"name":"roleBindings","type":"\u0019\u001bk8s.rbac.rolebinding","title":"RoleBindings that name this subject","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceAccount":{"name":"serviceAccount","type":"\u001bk8s.serviceaccount","title":"ServiceAccount object for a service account subject (null for users and groups)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"RBAC subject and its effective cluster permissions","desc":"A single user, group, or service account named as a subject in at least one RoleBinding or ClusterRoleBinding, with the permissions of every bound Role and ClusterRole folded into one view of what the subject is allowed to do. The kind, name, and namespace fields identify the subject (namespace is set only for service accounts), serviceAccount resolves a ServiceAccount subject to its object, and roleBindings and clusterRoleBindings list the grants that name the subject. The isClusterAdmin, canEscalatePrivileges, canReadSecrets, and hasWildcardPermissions predicates summarize the most security-relevant capabilities the bound roles confer. Enumerate every subject in the cluster through k8s.rbacSubjects, or find the subjects allowed a specific action with k8s.rbac.whoCan.","private":true,"min_provider_version":"13.3.1","defaults":"kind name namespace isClusterAdmin","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.rbac.whoCan":{"id":"k8s.rbac.whoCan","name":"k8s.rbac.whoCan","fields":{"group":{"name":"group","type":"\u0007","is_mandatory":true,"title":"API group of the resource (empty for the core group)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Specific object name the action targets (empty matches any object)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace the action is checked in (empty considers every namespace)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resource":{"name":"resource","type":"\u0007","is_mandatory":true,"title":"Resource type the action targets (secrets, pods, and so on)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"subjects":{"name":"subjects","type":"\u0019\u001bk8s.rbac.subject","title":"Subjects whose bound roles allow the action","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"verb":{"name":"verb","type":"\u0007","is_mandatory":true,"title":"Kubernetes API verb the action requires (get, list, create, delete, and so on)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"init":{"args":[{"name":"verb","type":"\u0007"},{"name":"resource","type":"\u0007"},{"name":"group","type":"\u0007"},{"name":"namespace","type":"\u0007"},{"name":"name","type":"\u0007"}]},"title":"RBAC subjects permitted to perform an action","desc":"Resolution of which users, groups, and service accounts the cluster's RoleBindings and ClusterRoleBindings allow to perform a given action, computed from the rules of the granted roles. The verb and resource arguments select the action, group narrows it to an API group (empty for the core group), namespace restricts the check to one namespace (empty considers every namespace), and name targets a specific object. For example, `k8s.rbac.whoCan(verb: \"list\", resource: \"secrets\").subjects` lists every subject that can read Secrets across the cluster. The result reflects RBAC grants only and does not account for the node or webhook authorizers; pair it with k8s.accessReview for an authoritative per-subject decision from the API server.","private":true,"min_provider_version":"13.3.1","defaults":"verb resource namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.referencegrant":{"id":"k8s.referencegrant","name":"k8s.referencegrant","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"from":{"name":"from","type":"\u0019\n","is_mandatory":true,"title":"Sources permitted to reference targets in this namespace","desc":"Each entry identifies a kind of resource in another namespace that is allowed to make references into this ReferenceGrant's namespace. Keys: `group` (API group of the referencing resource, empty for the core group), `kind` (referencing resource kind, for example HTTPRoute or Gateway), and `namespace` (namespace the reference may originate from).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"to":{"name":"to","type":"\u0019\n","is_mandatory":true,"title":"Targets in this namespace that may be referenced","desc":"Each entry identifies a kind of resource in this namespace that the sources in `from` are allowed to reference. Keys: `group` (API group of the target resource, empty for the core group), `kind` (target resource kind, for example Secret or Service), and `name` (specific target object name, or absent to permit referencing any object of that kind).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API ReferenceGrant","desc":"Gateway API grant that permits cross-namespace references into its namespace, selected by namespace and name. The from field lists the resource kinds and namespaces allowed to make references, and the to field lists the resource kinds in this namespace they may reference, letting routes and other objects point at targets they would otherwise be denied.","private":true,"min_provider_version":"13.0.16","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.replicaset":{"id":"k8s.replicaset","name":"k8s.replicaset","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"availableReplicas":{"name":"availableReplicas","type":"\u0005","title":"Number of pods available for at least minReadySeconds","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Latest observed status conditions of the ReplicaSet","desc":"Each entry has type (currently only ReplicaFailure), status (\"True\", \"False\", or \"Unknown\"), lastTransitionTime, reason, and message.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredReplicas":{"name":"desiredReplicas","type":"\u0005","title":"Number of pods requested by the ReplicaSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"fullyLabeledReplicas":{"name":"fullyLabeledReplicas","type":"\u0005","title":"Number of pods whose labels match the selector and have been fully labeled","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReadySeconds":{"name":"minReadySeconds","type":"\u0005","title":"Minimum seconds a newly created pod must be ready without crashes to be considered available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Raw pod template spec","desc":"Full pod template the ReplicaSet stamps out, including containers, volumes, and pod-level security settings. The containers and initContainers fields expose the same containers with structured accessors.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this ReplicaSet (label-selector match)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readyReplicas":{"name":"readyReplicas","type":"\u0005","title":"Number of ready pods","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicas":{"name":"replicas","type":"\u0005","title":"Total non-terminated pods observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this ReplicaSet","desc":"Keys: matchLabels (an exact label key/value map) and matchExpressions (a list of set-based requirements, each with key, operator, and values).","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ReplicaSet","desc":"Controller that maintains a stable set of replica pods, usually owned by a Deployment, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers, the target count comes from desiredReplicas and selector, and the observed state is reported by replicas, readyReplicas, availableReplicas, fullyLabeledReplicas, and conditions. The pods field returns the pods the ReplicaSet owns.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name desiredReplicas readyReplicas created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.resourcequota":{"id":"k8s.resourcequota","name":"k8s.resourcequota","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hard":{"name":"hard","type":"\u001a\u0007\u0007","title":"Hard limits enforced by the quota (resource name -\u003e quantity string)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scopeSelector":{"name":"scopeSelector","type":"\n","title":"Scope selector for fine-grained scope matching","desc":"Holds a `matchExpressions` list, where each entry is an object with `scopeName` (the scope being matched, e.g. PriorityClass), `operator` (one of In, NotIn, Exists, or DoesNotExist), and `values` (a list of strings compared against the scope). Used together with scopes to restrict which objects the quota counts.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"scopes":{"name":"scopes","type":"\u0019\u0007","title":"Scopes to which the quota applies (e.g., Terminating, NotTerminating, BestEffort, NotBestEffort, PriorityClass, CrossNamespacePodAffinity)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"ResourceQuota spec","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"status":{"name":"status","type":"\n","title":"ResourceQuota status","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"used":{"name":"used","type":"\u001a\u0007\u0007","title":"Current usage observed against the quota (resource name -\u003e quantity string)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes ResourceQuota","desc":"Constraint on the aggregate resource consumption of a namespace, selected by namespace and name. The hard field lists the enforced limits (such as CPU, memory, and object counts) and used reports current consumption against them. The scopes and scopeSelector fields narrow which objects the quota applies to.","private":true,"min_provider_version":"11.1.139","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.secret":{"id":"k8s.secret","name":"k8s.secret","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificateExpiry":{"name":"certificateExpiry","type":"\t","title":"Earliest expiry among the secret's TLS certificates","desc":"The notAfter of the soonest-expiring certificate in the tls.crt chain, so a single comparison covers the whole chain. Null when the secret holds no certificate.","min_provider_version":"13.3.4","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"certificates":{"name":"certificates","type":"\u0019\u001bcertificate","title":"Secret certificates","min_provider_version":"9.0.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasExpiredCertificate":{"name":"hasExpiredCertificate","type":"\u0004","title":"Whether the secret holds a TLS certificate that has expired","min_provider_version":"13.3.4","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isImagePullSecret":{"name":"isImagePullSecret","type":"\u0004","title":"Whether this is an image-pull Secret (type kubernetes.io/dockercfg or kubernetes.io/dockerconfigjson)","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isServiceAccountToken":{"name":"isServiceAccountToken","type":"\u0004","title":"Whether this is a service account token Secret (type kubernetes.io/service-account-token)","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isUnused":{"name":"isUnused","type":"\u0004","title":"Whether no pod and no service account reference this Secret","desc":"True when no pod consumes the Secret through a volume, environment variable, or image-pull reference, and no service account lists it among its tokens or image-pull secrets. A signal for orphaned credentials.","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Secret type","desc":"Purpose of the Secret and the expected layout of its data keys. Built-in values are Opaque, kubernetes.io/service-account-token, kubernetes.io/dockercfg, kubernetes.io/dockerconfigjson, kubernetes.io/basic-auth, kubernetes.io/ssh-auth, kubernetes.io/tls, and bootstrap.kubernetes.io/token. Any other string denotes a custom type.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usedBy":{"name":"usedBy","type":"\u0019\u001bk8s.pod","title":"Pods that reference this Secret through volumes, env, envFrom, or imagePullSecrets","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Secret","desc":"Object that holds sensitive data such as passwords, tokens, and keys, selected by namespace and name. The type field reports the secret's purpose (for example kubernetes.io/tls or kubernetes.io/dockerconfigjson), certificates parses any X.509 certificates the secret carries, and usedBy returns the pods that consume the secret through volumes, environment variables, or image-pull references.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.service":{"id":"k8s.service","name":"k8s.service","fields":{"allocateLoadBalancerNodePorts":{"name":"allocateLoadBalancerNodePorts","type":"\u0004","title":"Whether node ports are automatically allocated for type LoadBalancer","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterIP":{"name":"clusterIP","type":"\u0007","title":"ClusterIP assigned to the service","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterIPs":{"name":"clusterIPs","type":"\u0019\u0007","title":"All cluster IPs allocated to the service (one per IP family)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"endpointSlices":{"name":"endpointSlices","type":"\u0019\u001bk8s.endpointslice","title":"EndpointSlices that back this service (filtered by the kubernetes.io/service-name label)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalEndpoints":{"name":"externalEndpoints","type":"\u0019\u0007","title":"Backend endpoint addresses that are not in-cluster pods","desc":"Addresses from the service's EndpointSlices whose endpoints have no Pod targetRef, so the service forwards to manually managed targets that are often outside the cluster. Empty for an ordinary selector-backed service.","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalIPs":{"name":"externalIPs","type":"\u0019\u0007","title":"External IPs through which the service is exposed","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalName":{"name":"externalName","type":"\u0007","title":"External name the service maps to (for type ExternalName)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"externalTrafficPolicy":{"name":"externalTrafficPolicy","type":"\u0007","title":"External traffic policy (Cluster or Local)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"healthCheckNodePort":{"name":"healthCheckNodePort","type":"\u0005","title":"Port that the LoadBalancer's health-check uses (type LoadBalancer with Local externalTrafficPolicy)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"internalTrafficPolicy":{"name":"internalTrafficPolicy","type":"\u0007","title":"Internal traffic policy (Cluster or Local)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ipFamilies":{"name":"ipFamilies","type":"\u0019\u0007","title":"IP families backing the service (IPv4, IPv6)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ipFamilyPolicy":{"name":"ipFamilyPolicy","type":"\u0007","title":"IP family policy (SingleStack, PreferDualStack, RequireDualStack)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerClass":{"name":"loadBalancerClass","type":"\u0007","title":"Name of the load-balancer implementation that backs the service","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerIP":{"name":"loadBalancerIP","type":"\u0007","title":"Pre-allocated IP requested for the load balancer (deprecated in newer Kubernetes versions)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerIngress":{"name":"loadBalancerIngress","type":"\u0019\n","title":"Load-balancer ingress entries published in status (ip, hostname, ports)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"loadBalancerSourceRanges":{"name":"loadBalancerSourceRanges","type":"\u0019\u0007","title":"CIDRs allowed to reach the load balancer","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"networkExposures":{"name":"networkExposures","type":"\u0019\u001bk8s.networkExposure","title":"Normalized network exposure records for this Service","min_provider_version":"13.3.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods selected by the service's label selector (empty for selectorless and ExternalName services)","min_provider_version":"13.3.3","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ports":{"name":"ports","type":"\u0019\n","title":"Service ports (port, targetPort, protocol, nodePort, name, appProtocol)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"publishNotReadyAddresses":{"name":"publishNotReadyAddresses","type":"\u0004","title":"Whether DNS records are published for not-yet-ready endpoints","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"routesToPublicEndpoint":{"name":"routesToPublicEndpoint","type":"\u0004","title":"Whether the service forwards to a public, non-pod endpoint address","desc":"True when any address in externalEndpoints (endpoints from the service's EndpointSlices that have no backing pod) resolves to an internet-routable IP or an external DNS hostname rather than a private or internal address. Flags services that bridge in-cluster traffic to targets living outside the cluster.","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\u001a\u0007\u0007","title":"Label selector for pods that back the service","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sessionAffinity":{"name":"sessionAffinity","type":"\u0007","title":"Session affinity (ClientIP or None)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"sessionAffinityConfig":{"name":"sessionAffinityConfig","type":"\n","title":"Session affinity configuration (clientIP timeout)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"spec":{"name":"spec","type":"\n","title":"Raw Kubernetes ServiceSpec","desc":"The complete `.spec` of the Service as a dict. Most of its contents are also surfaced as dedicated fields on this resource (type, clusterIP, clusterIPs, externalIPs, ports, selector, sessionAffinity, and the traffic and load-balancer settings); reach into spec directly only for keys that are not exposed on their own.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"type":{"name":"type","type":"\u0007","title":"Service type (ClusterIP, NodePort, LoadBalancer, ExternalName)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Service","desc":"Stable network endpoint that load-balances traffic to a set of pods, selected by namespace and name. The type field distinguishes ClusterIP, NodePort, LoadBalancer, and ExternalName services; clusterIP, externalIPs, loadBalancerIngress, and ports report the addresses and ports it exposes; and selector identifies the backing pods. Traffic and affinity behavior is governed by externalTrafficPolicy, internalTrafficPolicy, and sessionAffinity, and endpointSlices returns the slices listing the current backing endpoints.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.serviceaccount":{"id":"k8s.serviceaccount","name":"k8s.serviceaccount","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","is_mandatory":true,"title":"Whether pods running as this service account should have an API token automatically mounted","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canEscalatePrivileges":{"name":"canEscalatePrivileges","type":"\u0004","title":"Whether any bound role allows RBAC privilege escalation (escalate/bind/impersonate)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"canReadSecrets":{"name":"canReadSecrets","type":"\u0004","title":"Whether any bound role can read Secrets (get, list, or watch)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"clusterRoleBindings":{"name":"clusterRoleBindings","type":"\u0019\u001bk8s.rbac.clusterrolebinding","title":"ClusterRoleBindings that grant this service account a cluster role","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWildcardPermissions":{"name":"hasWildcardPermissions","type":"\u0004","title":"Whether any bound role has a wildcard rule (wildcard verbs, API groups, or resources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imagePullSecrets":{"name":"imagePullSecrets","type":"\u0019\n","is_mandatory":true,"title":"Secrets in the same namespace used to pull private container images","desc":"Each entry is a local object reference with a single `name` key naming a Secret (typically of type kubernetes.io/dockerconfigjson) in the account's namespace. Pods that use this service account inherit these image-pull credentials.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"isClusterAdmin":{"name":"isClusterAdmin","type":"\u0004","title":"Whether any bound role confers cluster-admin (wildcard verbs, API groups, and resources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"roleBindings":{"name":"roleBindings","type":"\u0019\u001bk8s.rbac.rolebinding","title":"RoleBindings in this namespace that grant this service account a role","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"secrets":{"name":"secrets","type":"\u0019\n","is_mandatory":true,"title":"Secrets in the same namespace that pods running as this service account may use","desc":"Each entry references a Secret in the account's namespace. The keys mirror a Kubernetes object reference: `name`, `namespace`, `uid`, `apiVersion`, `kind`, `resourceVersion`, and `fieldPath`. In practice only `name` is populated for the secrets a service account carries.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes service account","desc":"Identity that pods use to authenticate to the API server, selected by namespace and name. The secrets and imagePullSecrets fields list the tokens and registry credentials associated with the account, and automountServiceAccountToken reports whether its API token is mounted into pods by default.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.statefulset":{"id":"k8s.statefulset","name":"k8s.statefulset","fields":{"addedCapabilities":{"name":"addedCapabilities","type":"\u0019\u0007","title":"Linux capabilities added to any container, deduplicated across all containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"allowsPrivilegeEscalation":{"name":"allowsPrivilegeEscalation","type":"\u0004","title":"Whether privilege escalation is possible for any container","desc":"True when a container does not explicitly set allowPrivilegeEscalation to false, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"automountServiceAccountToken":{"name":"automountServiceAccountToken","type":"\u0004","title":"Whether an API token is automatically mounted for the ServiceAccount","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"availableReplicas":{"name":"availableReplicas","type":"\u0005","title":"Number of pods available for at least minReadySeconds","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"collisionCount":{"name":"collisionCount","type":"\u0005","title":"Count of ControllerRevision name hash collisions handled by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"conditions":{"name":"conditions","type":"\u0019\n","title":"Status conditions","desc":"Each entry carries type, status (\"True\", \"False\", or \"Unknown\"), lastTransitionTime, reason, and message describing an observed condition of the StatefulSet.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"consumedSecrets":{"name":"consumedSecrets","type":"\u0019\u0007","title":"Names of every Secret the workload references (env vars, mounted/projected volumes, and image-pull secrets)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containerImages":{"name":"containerImages","type":"\u0019\u0007","title":"Image references of all regular and init containers","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"containers":{"name":"containers","type":"\u0019\u001bk8s.container","title":"Contained containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentReplicas":{"name":"currentReplicas","type":"\u0005","title":"Number of pods running the spec's current revision","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"currentRevision":{"name":"currentRevision","type":"\u0007","title":"Revision hash of the StatefulSet's current configuration","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"desiredReplicas":{"name":"desiredReplicas","type":"\u0005","title":"Number of pods requested by the StatefulSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"dropsAllCapabilities":{"name":"dropsAllCapabilities","type":"\u0004","title":"Whether every container drops all Linux capabilities","desc":"True only when each container drops the ALL capability, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasCpuLimit":{"name":"hasCpuLimit","type":"\u0004","title":"Whether every container sets a CPU limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasMemoryLimit":{"name":"hasMemoryLimit","type":"\u0004","title":"Whether every container sets a memory limit (regular and init containers)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceLimits":{"name":"hasResourceLimits","type":"\u0004","title":"Whether every container sets both CPU and memory limits","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasResourceRequests":{"name":"hasResourceRequests","type":"\u0004","title":"Whether every container sets both CPU and memory requests","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasSeccompProfile":{"name":"hasSeccompProfile","type":"\u0004","title":"Whether every container has a confining seccomp profile set","desc":"True only when each container effectively uses RuntimeDefault or Localhost (container-level setting wins over the pod default). An unset or Unconfined profile on any container makes this false.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasUnsafeSysctls":{"name":"hasUnsafeSysctls","type":"\u0004","title":"Whether the pod requests a sysctl outside the kubelet safe set","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hasWritableRootFilesystem":{"name":"hasWritableRootFilesystem","type":"\u0004","title":"Whether any container can write to its own root filesystem","desc":"True when a container does not set readOnlyRootFilesystem to true, across regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostIPC":{"name":"hostIPC","type":"\u0004","title":"Whether the pod shares the host IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostNetwork":{"name":"hostNetwork","type":"\u0004","title":"Whether the pod shares the host network namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostPID":{"name":"hostPID","type":"\u0004","title":"Whether the pod shares the host PID namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"imageRegistries":{"name":"imageRegistries","type":"\u0019\u0007","title":"Distinct registry domains the container images are pulled from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"initContainers":{"name":"initContainers","type":"\u0019\u001bk8s.initContainer","title":"Init containers","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityBaseline":{"name":"meetsPodSecurityBaseline","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards baseline profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"meetsPodSecurityRestricted":{"name":"meetsPodSecurityRestricted","type":"\u0004","title":"Whether the workload satisfies the Pod Security Standards restricted profile","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"minReadySeconds":{"name":"minReadySeconds","type":"\u0005","title":"Minimum seconds a newly created pod must be ready without crashes to be considered available","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountsSecretVolumes":{"name":"mountsSecretVolumes","type":"\u0004","title":"Whether the workload mounts a Secret as a volume (including projected secret sources)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"observedGeneration":{"name":"observedGeneration","type":"\u0005","title":"Generation of the spec most recently observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ordinalsStart":{"name":"ordinalsStart","type":"\u0005","title":"Starting ordinal for the StatefulSet's pod indices (defaults to 0)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"persistentVolumeClaimRetentionPolicy":{"name":"persistentVolumeClaimRetentionPolicy","type":"\n","title":"Retention policy for per-pod PersistentVolumeClaims","desc":"Keys: whenScaled (policy applied when the replica count is reduced) and whenDeleted (policy applied when the StatefulSet is deleted). Each value is \"Retain\", which keeps the PVC and its data, or \"Delete\", which removes the PVC. Governs whether persistent data survives scaling or deletion.","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podManagementPolicy":{"name":"podManagementPolicy","type":"\u0007","title":"Pod management policy (OrderedReady or Parallel)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSecurityStandard":{"name":"podSecurityStandard","type":"\u0007","title":"Highest Pod Security Standards level the workload satisfies","desc":"One of \"restricted\", \"baseline\", or \"privileged\" (the level a PodSecurity admission controller would assign), computed from the pod template's securityContext, capabilities, volumes, and host settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"podSpec":{"name":"podSpec","type":"\n","title":"Pod description","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"pods":{"name":"pods","type":"\u0019\u001bk8s.pod","title":"Pods backing this StatefulSet (label-selector match)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"readyReplicas":{"name":"readyReplicas","type":"\u0005","title":"Number of ready pods","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"replicas":{"name":"replicas","type":"\u0005","title":"Total non-terminated pods observed by the controller","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"revisionHistoryLimit":{"name":"revisionHistoryLimit","type":"\u0005","title":"Number of old ControllerRevisions retained to allow rollback","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"risksStaleImage":{"name":"risksStaleImage","type":"\u0004","title":"Whether any container risks a stale or attacker-cached image: a mutable tag with a pull policy other than Always","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsAsRoot":{"name":"runsAsRoot","type":"\u0004","title":"Whether any container may run as the root user","desc":"True when a container is not guaranteed to run as a non-root user, after folding runAsNonRoot and runAsUser from both the pod and the container. Covers regular, init, and ephemeral containers.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"runsPrivileged":{"name":"runsPrivileged","type":"\u0004","title":"Whether any container runs in privileged mode, across regular, init, and ephemeral containers","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"securityContext":{"name":"securityContext","type":"\n","title":"Pod-level security context (runAsUser, runAsGroup, runAsNonRoot, fsGroup, seccompProfile, supplementalGroups, sysctls, windowsOptions)","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"selector":{"name":"selector","type":"\n","title":"Label selector that identifies pods owned by this StatefulSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"serviceName":{"name":"serviceName","type":"\u0007","title":"Name of the governing headless service for the StatefulSet","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"unpinnedImages":{"name":"unpinnedImages","type":"\u0019\u0007","title":"Image references that are not pinned by digest (mutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updateRevision":{"name":"updateRevision","type":"\u0007","title":"Revision hash of the StatefulSet's update configuration","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updateStrategy":{"name":"updateStrategy","type":"\n","title":"Update strategy (OnDelete or RollingUpdate with partition/maxUnavailable)","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"updatedReplicas":{"name":"updatedReplicas","type":"\u0005","title":"Number of pods updated to the spec's update revision","min_provider_version":"13.0.16","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesAlwaysImagePullPolicy":{"name":"usesAlwaysImagePullPolicy","type":"\u0004","title":"Whether every container uses imagePullPolicy Always (forces a registry re-pull, not a node cache)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostNamespaces":{"name":"usesHostNamespaces","type":"\u0004","title":"Whether the pod shares the host network, PID, or IPC namespace","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesHostPath":{"name":"usesHostPath","type":"\u0004","title":"Whether the pod mounts a hostPath volume","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesImageDigest":{"name":"usesImageDigest","type":"\u0004","title":"Whether every container image is pinned by digest (immutable)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesLatestTag":{"name":"usesLatestTag","type":"\u0004","title":"Whether any container image uses the mutable \"latest\" tag (explicitly or implicitly)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesSecretsAsEnv":{"name":"usesSecretsAsEnv","type":"\u0004","title":"Whether any container injects a Secret as an environment variable (secretKeyRef or envFrom)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedAppArmor":{"name":"usesUnconfinedAppArmor","type":"\u0004","title":"Whether any container runs with an Unconfined AppArmor profile","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnconfinedSeccomp":{"name":"usesUnconfinedSeccomp","type":"\u0004","title":"Whether any container effectively runs with the Unconfined seccomp profile","desc":"Resolves the container-level seccomp profile, falling back to the pod-level default. True when any container ends up Unconfined (no syscall filtering).","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"usesUnmaskedProcMount":{"name":"usesUnmaskedProcMount","type":"\u0004","title":"Whether any container sets procMount to Unmasked","min_provider_version":"13.4.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes StatefulSet","desc":"Controller that manages pods with stable identities and persistent storage, selected by namespace and name. The pod template is available through podSpec, containers, and initContainers; identity and ordering are governed by serviceName, podManagementPolicy, ordinalsStart, and updateStrategy; and persistentVolumeClaimRetentionPolicy controls whether per-pod volumes survive scale-down. Rollout state is reported by replicas, readyReplicas, currentReplicas, updatedReplicas, currentRevision, updateRevision, and conditions, and the pods field returns the backing pods.","private":true,"min_provider_version":"9.0.0","defaults":"namespace name desiredReplicas readyReplicas created","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.storageclass":{"id":"k8s.storageclass","name":"k8s.storageclass","fields":{"allowVolumeExpansion":{"name":"allowVolumeExpansion","type":"\u0004","is_mandatory":true,"title":"Whether the storage class allows volume expansion","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"context":{"name":"context","type":"\u001bk8s.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"mountOptions":{"name":"mountOptions","type":"\u0019\u0007","title":"Mount options for PersistentVolumes dynamically created by this storage class","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parameters":{"name":"parameters","type":"\u001a\u0007\u0007","title":"StorageClass parameters for the provisioner","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"provisioner":{"name":"provisioner","type":"\u0007","is_mandatory":true,"title":"Provisioner indicates the type of the provisioner","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"reclaimPolicy":{"name":"reclaimPolicy","type":"\u0007","is_mandatory":true,"title":"Reclaim policy (Delete, Retain, or Recycle)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"volumeBindingMode":{"name":"volumeBindingMode","type":"\u0007","is_mandatory":true,"title":"Volume binding mode (Immediate or WaitForFirstConsumer)","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes StorageClass","desc":"Template that describes how volumes are dynamically provisioned, selected by name. The provisioner field names the plugin that creates volumes, parameters carries the provisioner-specific settings, and reclaimPolicy, volumeBindingMode, and allowVolumeExpansion govern reclamation, binding timing, and whether bound volumes may grow.","private":true,"min_provider_version":"11.1.139","defaults":"name provisioner","context":"k8s.context","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.tcproute":{"id":"k8s.tcproute","name":"k8s.tcproute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames this route should respond to, empty for TCPRoute","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Parent resources this route is associated with","desc":"One entry per Gateway (or other parent) that delegates to this route. Each dict carries `group`, `kind`, `namespace`, `name`, `sectionName` (the listener within the parent), and `port`.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Acceptance status reported by each parent","desc":"One entry per parent that has processed the route. Each dict carries `parentRef` (the same shape as parentRefs), `controllerName` (the controller managing that parent), and `conditions`, a list of status conditions with `type`, `status`, `reason`, `message`, `lastTransitionTime`, and `observedGeneration` that report whether the parent accepted and resolved the route.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Backend forwarding rules","desc":"One entry per routing rule. Each dict carries an optional `name` and a `backendRefs` list; every backend reference holds `group`, `kind`, `name`, `namespace`, `port`, and `weight` (relative share of connections sent to that backend). TCPRoute rules do not match on hostnames or paths.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API TCPRoute","desc":"Gateway API rules that route raw TCP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it and rules describes the backend forwarding applied to connections; TCPRoute does not match on hostnames. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.3.2","defaults":"namespace name created","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.tlsroute":{"id":"k8s.tlsroute","name":"k8s.tlsroute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"SNI hostnames this route matches","desc":"Server Name Indication hostnames used to select this route for an incoming TLS connection. A connection is routed here when its SNI matches one of these names; an empty list matches all SNI values permitted by the attached Gateway listeners.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Gateways this route attaches to","desc":"Each entry is a Gateway API parent reference with keys group, kind, namespace, name, sectionName, and port. sectionName selects a named listener on the Gateway and port narrows attachment to a specific listener port, so an empty sectionName means the route attaches to every compatible TLS listener on that Gateway.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Attachment status per parent reference","desc":"Each entry has keys parentRef, controllerName, and conditions. The conditions list reports whether the parent Gateway Accepted the route and whether ResolvedRefs succeeded, which is how you confirm the route is actually bound and forwarding traffic.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Backend forwarding rules","desc":"Each rule carries a backendRefs list naming the Services that accepted TLS connections are forwarded to (the connection is passed through without termination). Each backendRef has keys group, kind, name, namespace, port, and weight, where weight sets the relative share of connections sent to that backend.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API TLSRoute","desc":"Gateway API rules that route TLS traffic from Gateways to backend services by SNI hostname without terminating the connection, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it, hostnames narrows the route to specific SNI hosts, and rules describes the backend forwarding applied to connections. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.3.2","defaults":"namespace name created","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.udproute":{"id":"k8s.udproute","name":"k8s.udproute","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","title":"Kubernetes annotations","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Kubernetes object creation timestamp","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames this route should respond to, empty for UDPRoute","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mondoo ID for the Kubernetes object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kubernetes object type","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","title":"Kubernetes labels","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"managedFields":{"name":"managedFields","type":"\u0019\u001bk8s.managedField","title":"Server-side apply records describing which field managers own which fields","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"manifest":{"name":"manifest","type":"\n","title":"Full resource manifest","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Kubernetes object name","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes object namespace","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"ownerReferences":{"name":"ownerReferences","type":"\u0019\u001bk8s.ownerReference","title":"Owner references describing the controllers and parent objects that own this object","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentRefs":{"name":"parentRefs","type":"\u0019\n","is_mandatory":true,"title":"Parent resources this route attaches to","desc":"One entry per parent (Gateway or Service) that delegates traffic to this route. Each entry carries `group`, `kind`, `namespace`, `name`, `sectionName` (the specific listener on the parent), and `port`.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"parentStatus":{"name":"parentStatus","type":"\u0019\n","is_mandatory":true,"title":"Attachment status reported by each parent","desc":"One entry per parent that processed the route. Each entry carries `parentRef` identifying the parent, `controllerName` of the controller that wrote the status, and `conditions` reporting acceptance (for example `Accepted` and `ResolvedRefs`).","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"resourceVersion":{"name":"resourceVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes resource version","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Backend forwarding rules for datagrams","desc":"Each rule carries an optional `name` and a `backendRefs` list naming the Services that receive the forwarded datagrams. Each backend reference holds `group`, `kind`, `name`, `namespace`, `port`, and `weight` (the relative share of traffic sent to that backend). UDPRoute rules do not match on request content or apply filters.","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Kubernetes object UID","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes Gateway API UDPRoute","desc":"Gateway API rules that route raw UDP traffic from Gateways to backend services, selected by namespace and name. The parentRefs field binds the route to the Gateways that delegate to it and rules describes the backend forwarding applied to datagrams; UDPRoute does not match on hostnames. The parentStatus field reports whether each parent accepted the route.","private":true,"min_provider_version":"13.3.2","defaults":"namespace name created","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"k8s.userinfo":{"id":"k8s.userinfo","name":"k8s.userinfo","fields":{"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"The UID of the user","provider":"go.mondoo.com/cnquery/v9/providers/k8s"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"The username of the user","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"title":"Kubernetes UserInfo","desc":"Identity of the authenticated user that issued an admission request, as recorded on the review. The username field is the authenticated subject (for a service account, the form is system:serviceaccount:\u003cnamespace\u003e:\u003cname\u003e), and uid is the unique identifier the API server assigned to that identity. Use it to attribute a create, update, or delete to the principal that made the change when auditing admission activity.","private":true,"min_provider_version":"9.0.0","defaults":"username","provider":"go.mondoo.com/cnquery/v9/providers/k8s"}},"dependencies":{"network":{"id":"go.mondoo.com/mql/v13/providers/network","name":"network"},"os":{"id":"go.mondoo.com/mql/v13/providers/os","name":"os"}}}