{"resources":{"kustomize":{"id":"kustomize","name":"kustomize","fields":{"generator":{"name":"generator","type":"\u001bkustomize.generator","title":"Kustomize ConfigMap or Secret generator","desc":"ConfigMap or Secret generator declared in a kustomization, which produces a Kubernetes ConfigMap or Secret from inline literal key=value pairs, included files, and env-file sources. The `type` field is \"configmap\" or \"secret\", and `behavior` (\"create\", \"replace\", or \"merge\") controls how the generated object interacts with an existing one. Query this to surface inline secrets, audit generated ConfigMap contents, or detect drift in overlay rendering.","provider":"go.mondoo.com/mql/v13/providers/kustomize","is_implicit_resource":true},"image":{"name":"image","type":"\u001bkustomize.image","title":"Kustomize image override","desc":"Image name and tag or digest substitution applied by an `images:` entry during overlay rendering. Each entry maps an original image name to an optional replacement name and either a new tag or a new digest, letting you detect non-pinned tags or unintended image swaps. The `name` field selects the entry by its original image name, for example `kustomize.image(name: \"nginx\")`.","provider":"go.mondoo.com/mql/v13/providers/kustomize","is_implicit_resource":true},"kustomization":{"name":"kustomization","type":"\u001bkustomize.kustomization","title":"kustomization.yaml configuration","desc":"Single parsed kustomization, identified by its directory `path`. Exposes the transformers it applies (namespace, name prefix/suffix, common labels and annotations), the resources and components it pulls in, its patches, ConfigMap and Secret generators, image overrides, and replacements, alongside the Kubernetes resources rendered by `kustomize build`. Query this to enforce policy on Kustomize-driven manifests before they reach a cluster.","provider":"go.mondoo.com/mql/v13/providers/kustomize","is_implicit_resource":true},"kustomizations":{"name":"kustomizations","type":"\u0019\u001bkustomize.kustomization","title":"List of all parsed kustomizations","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"patch":{"name":"patch","type":"\u001bkustomize.patch","title":"Kustomize patch (strategic merge or JSON patch)","desc":"Single patch that Kustomize applies to base resources during rendering, mutating them in place. A patch carries its content (inline YAML or a file path) and a target selector (group, version, kind, name, namespace, and label or annotation selector) that picks which resources it modifies. The `format` field distinguishes a strategic-merge overlay from an RFC6902 JSON patch, and `operations` decomposes a JSON patch into its individual steps so an audit can spot changes that weaken a security control.","provider":"go.mondoo.com/mql/v13/providers/kustomize","is_implicit_resource":true},"replacement":{"name":"replacement","type":"\u001bkustomize.replacement","title":"Kustomize replacement","desc":"A `replacements:` entry that copies one field's value from a source resource into multiple target fields, the modern successor to Kustomize vars. The `sourceKind` and `sourceName` selectors identify the resource to read from, `sourcePath` is the field-path expression that locates the value, and `targets` lists every destination that receives it. Auditing replacements surfaces where values are injected across a rendered manifest set, which matters when a single source drives security-relevant fields such as image tags, names, or annotations.","provider":"go.mondoo.com/mql/v13/providers/kustomize","is_implicit_resource":true},"replacementTarget":{"name":"replacementTarget","type":"\u001bkustomize.replacementTarget","title":"Kustomize replacement target","desc":"One destination within a `replacements:` entry. The `fieldPath` expression pins where the substituted value is written, while the optional `kind` and `name` selectors narrow which rendered resources are affected. Reviewing targets shows exactly which fields a replacement rewrites, so an over-broad selector that touches more resources than intended becomes visible.","provider":"go.mondoo.com/mql/v13/providers/kustomize","is_implicit_resource":true},"resource":{"name":"resource","type":"\u001bkustomize.resource","title":"Rendered Kubernetes resource from `kustomize build`","desc":"Kubernetes manifest produced by running Kustomize over the overlay tree, exactly as a cluster would receive it. Its apiVersion, kind, name, namespace, labels, and annotations reflect the final state after every patch, transformer, and name/namespace prefix has been applied, so policy checks run against what actually gets deployed rather than the pre-transformation sources.","provider":"go.mondoo.com/mql/v13/providers/kustomize","is_implicit_resource":true}},"title":"Kustomize overlay","desc":"Parsed `kustomization.yaml` trees discovered under the connection, each carrying its transformer configuration, generators, patches, image overrides, replacements, and the Kubernetes resources rendered by `kustomize build`. Use this to enforce policy on Kustomize-driven manifests before they reach a cluster.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kustomize.generator":{"id":"kustomize.generator","name":"kustomize.generator","fields":{"behavior":{"name":"behavior","type":"\u0007","is_mandatory":true,"title":"Behavior: \"create\", \"replace\", or \"merge\"","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"envs":{"name":"envs","type":"\u0019\u0007","is_mandatory":true,"title":"Env file sources","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"files":{"name":"files","type":"\u0019\u0007","is_mandatory":true,"title":"Files to include","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"literals":{"name":"literals","type":"\u0019\u0007","is_mandatory":true,"title":"Literal key=value pairs","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Generator name","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type: \"configmap\" or \"secret\"","provider":"go.mondoo.com/mql/v13/providers/kustomize"}},"title":"Kustomize ConfigMap or Secret generator","desc":"ConfigMap or Secret generator declared in a kustomization, which produces a Kubernetes ConfigMap or Secret from inline literal key=value pairs, included files, and env-file sources. The `type` field is \"configmap\" or \"secret\", and `behavior` (\"create\", \"replace\", or \"merge\") controls how the generated object interacts with an existing one. Query this to surface inline secrets, audit generated ConfigMap contents, or detect drift in overlay rendering.","min_provider_version":"13.0.0","defaults":"name type","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kustomize.image":{"id":"kustomize.image","name":"kustomize.image","fields":{"digest":{"name":"digest","type":"\u0007","is_mandatory":true,"title":"New digest (mutually exclusive with newTag)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Original image name","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"newName":{"name":"newName","type":"\u0007","is_mandatory":true,"title":"New image name (empty if unchanged)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"newTag":{"name":"newTag","type":"\u0007","is_mandatory":true,"title":"New tag","provider":"go.mondoo.com/mql/v13/providers/kustomize"}},"title":"Kustomize image override","desc":"Image name and tag or digest substitution applied by an `images:` entry during overlay rendering. Each entry maps an original image name to an optional replacement name and either a new tag or a new digest, letting you detect non-pinned tags or unintended image swaps. The `name` field selects the entry by its original image name, for example `kustomize.image(name: \"nginx\")`.","min_provider_version":"13.0.0","defaults":"name newTag","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kustomize.kustomization":{"id":"kustomize.kustomization","name":"kustomize.kustomization","fields":{"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"API version","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"commonAnnotations":{"name":"commonAnnotations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Common annotations added to all resources","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"commonLabels":{"name":"commonLabels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Common labels added to all resources","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"componentRefs":{"name":"componentRefs","type":"\u0019\u0007","is_mandatory":true,"title":"Component references","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"configMapGenerators":{"name":"configMapGenerators","type":"\u0019\u001bkustomize.generator","title":"ConfigMap generators","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"images":{"name":"images","type":"\u0019\u001bkustomize.image","title":"Image overrides","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind (Kustomization or Component)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"namePrefix":{"name":"namePrefix","type":"\u0007","is_mandatory":true,"title":"Name prefix applied to all resources","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"nameSuffix":{"name":"nameSuffix","type":"\u0007","is_mandatory":true,"title":"Name suffix applied to all resources","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace override applied to all resources","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"patches":{"name":"patches","type":"\u0019\u001bkustomize.patch","title":"Patches (strategic merge and JSON)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the kustomization directory","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"replacements":{"name":"replacements","type":"\u0019\u001bkustomize.replacement","title":"Replacements (var-free field substitution)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"resourceRefs":{"name":"resourceRefs","type":"\u0019\u0007","is_mandatory":true,"title":"Raw resource file references","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"resources":{"name":"resources","type":"\u0019\u001bkustomize.resource","title":"Rendered Kubernetes resources (kustomize build output)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"secretGenerators":{"name":"secretGenerators","type":"\u0019\u001bkustomize.generator","title":"Secret generators","provider":"go.mondoo.com/mql/v13/providers/kustomize"}},"title":"kustomization.yaml configuration","desc":"Single parsed kustomization, identified by its directory `path`. Exposes the transformers it applies (namespace, name prefix/suffix, common labels and annotations), the resources and components it pulls in, its patches, ConfigMap and Secret generators, image overrides, and replacements, alongside the Kubernetes resources rendered by `kustomize build`. Query this to enforce policy on Kustomize-driven manifests before they reach a cluster.","min_provider_version":"13.0.0","defaults":"path","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kustomize.patch":{"id":"kustomize.patch","name":"kustomize.patch","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Patch content (inline YAML or file content)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Patch format","desc":"Either \"strategicMerge\" or \"json6902\", determined from the patch declaration or by inspecting the patch content shape. A patch whose content is a sequence of operation objects (each carrying an `op` key) is classified as \"json6902\"; any mapping-shaped patch is \"strategicMerge\". Use this to distinguish a strategic-merge overlay from a JSON patch.","min_provider_version":"13.0.10","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"operation":{"name":"operation","type":"\u001bkustomize.patch.operation","title":"JSON patch operation from a JSON6902 Kustomize patch","desc":"Single RFC6902 operation decomposed from a \"json6902\" patch. The `op` is one of add, remove, replace, move, copy, or test; `path` is the RFC6901 JSON pointer the operation targets (for example `/spec/template/spec/containers/0`); and `value` carries the operand for add, replace, and test operations and is null otherwise. This surfaces operations that strip a security control from a base resource.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/kustomize","is_implicit_resource":true},"operations":{"name":"operations","type":"\u0019\u001bkustomize.patch.operation","title":"JSON patch operations","desc":"Decomposed RFC6902 operations for a \"json6902\" patch — empty for a \"strategicMerge\" patch. Each entry exposes its `op`, `path`, and `value`, so an audit can detect a patch that removes a security control (for example an `op: remove` targeting a securityContext).","min_provider_version":"13.0.10","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Patch file path (empty if inline)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"targetAnnotationSelector":{"name":"targetAnnotationSelector","type":"\u0007","is_mandatory":true,"title":"Target annotation selector","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"targetGroup":{"name":"targetGroup","type":"\u0007","is_mandatory":true,"title":"Target group","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"targetKind":{"name":"targetKind","type":"\u0007","is_mandatory":true,"title":"Target kind","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"targetLabelSelector":{"name":"targetLabelSelector","type":"\u0007","is_mandatory":true,"title":"Target label selector","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"targetName":{"name":"targetName","type":"\u0007","is_mandatory":true,"title":"Target name","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"targetNamespace":{"name":"targetNamespace","type":"\u0007","is_mandatory":true,"title":"Target namespace","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"targetVersion":{"name":"targetVersion","type":"\u0007","is_mandatory":true,"title":"Target version","provider":"go.mondoo.com/mql/v13/providers/kustomize"}},"title":"Kustomize patch (strategic merge or JSON patch)","desc":"Single patch that Kustomize applies to base resources during rendering, mutating them in place. A patch carries its content (inline YAML or a file path) and a target selector (group, version, kind, name, namespace, and label or annotation selector) that picks which resources it modifies. The `format` field distinguishes a strategic-merge overlay from an RFC6902 JSON patch, and `operations` decomposes a JSON patch into its individual steps so an audit can spot changes that weaken a security control.","min_provider_version":"13.0.0","defaults":"path","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kustomize.patch.operation":{"id":"kustomize.patch.operation","name":"kustomize.patch.operation","fields":{"op":{"name":"op","type":"\u0007","is_mandatory":true,"title":"Operation: add, remove, replace, move, copy, or test","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"RFC6901 JSON pointer the operation targets","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"value":{"name":"value","type":"\n","is_mandatory":true,"title":"Operand value","desc":"Present for add, replace, and test operations; null for remove, move, and copy.","provider":"go.mondoo.com/mql/v13/providers/kustomize"}},"title":"JSON patch operation from a JSON6902 Kustomize patch","desc":"Single RFC6902 operation decomposed from a \"json6902\" patch. The `op` is one of add, remove, replace, move, copy, or test; `path` is the RFC6901 JSON pointer the operation targets (for example `/spec/template/spec/containers/0`); and `value` carries the operand for add, replace, and test operations and is null otherwise. This surfaces operations that strip a security control from a base resource.","private":true,"min_provider_version":"13.0.10","defaults":"op path","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kustomize.replacement":{"id":"kustomize.replacement","name":"kustomize.replacement","fields":{"sourceKind":{"name":"sourceKind","type":"\u0007","is_mandatory":true,"title":"Source resource kind","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"sourceName":{"name":"sourceName","type":"\u0007","is_mandatory":true,"title":"Source resource name","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"sourcePath":{"name":"sourcePath","type":"\u0007","is_mandatory":true,"title":"Source field path (e.g., \".metadata.name\")","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"targets":{"name":"targets","type":"\u0019\u001bkustomize.replacementTarget","title":"Target field paths","provider":"go.mondoo.com/mql/v13/providers/kustomize"}},"title":"Kustomize replacement","desc":"A `replacements:` entry that copies one field's value from a source resource into multiple target fields, the modern successor to Kustomize vars. The `sourceKind` and `sourceName` selectors identify the resource to read from, `sourcePath` is the field-path expression that locates the value, and `targets` lists every destination that receives it. Auditing replacements surfaces where values are injected across a rendered manifest set, which matters when a single source drives security-relevant fields such as image tags, names, or annotations.","min_provider_version":"13.0.0","defaults":"sourcePath","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kustomize.replacementTarget":{"id":"kustomize.replacementTarget","name":"kustomize.replacementTarget","fields":{"fieldPath":{"name":"fieldPath","type":"\u0007","is_mandatory":true,"title":"Target field path to replace","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Target resource kind selector","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Target resource name selector","provider":"go.mondoo.com/mql/v13/providers/kustomize"}},"title":"Kustomize replacement target","desc":"One destination within a `replacements:` entry. The `fieldPath` expression pins where the substituted value is written, while the optional `kind` and `name` selectors narrow which rendered resources are affected. Reviewing targets shows exactly which fields a replacement rewrites, so an over-broad selector that touches more resources than intended becomes visible.","min_provider_version":"13.0.0","defaults":"fieldPath","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kustomize.resource":{"id":"kustomize.resource","name":"kustomize.resource","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Annotations (after transformations)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes API version","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Resource kind","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Labels (after transformations)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"manifest":{"name":"manifest","type":"\n","is_mandatory":true,"title":"Full resource manifest","desc":"Complete rendered Kubernetes object with its native structure preserved: top-level `apiVersion`, `kind`, and `metadata` keys plus the kind-specific body (`spec`, `data`, `stringData`, `rules`, and so on). Drill into it to audit fields not surfaced as named accessors, for example `manifest[\"spec\"][\"replicas\"]`.","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name (after transformations)","provider":"go.mondoo.com/mql/v13/providers/kustomize"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Resource namespace (after transformations)","provider":"go.mondoo.com/mql/v13/providers/kustomize"}},"title":"Rendered Kubernetes resource from `kustomize build`","desc":"Kubernetes manifest produced by running Kustomize over the overlay tree, exactly as a cluster would receive it. Its apiVersion, kind, name, namespace, labels, and annotations reflect the final state after every patch, transformer, and name/namespace prefix has been applied, so policy checks run against what actually gets deployed rather than the pre-transformation sources.","min_provider_version":"13.0.0","defaults":"kind name","provider":"go.mondoo.com/mql/v13/providers/kustomize"}}}