{"resources":{"kustomize":{"id":"kustomize","name":"kustomize","fields":{"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/kustomize","is_implicit_resource":true},"generator":{"name":"generator","type":"\u001bkustomize.generator","title":"Kustomize ConfigMap or Secret generator","desc":"ConfigMap or Secret generator declared in a kustomization, which produces a Kubernetes ConfigMap or Secret from inline literal key=value pairs, included files, and env-file sources. The `type` field is \"configmap\" or \"secret\", and `behavior` (\"create\", \"replace\", or \"merge\") controls how the generated object interacts with an existing one. Query this to surface inline secrets, audit generated ConfigMap contents, or detect drift in overlay rendering.","is_private":true,"provider":"go.mondoo.com/mql/providers/kustomize","is_implicit_resource":true},"image":{"name":"image","type":"\u001bkustomize.image","title":"Kustomize image override","desc":"Image name and tag or digest substitution applied by an `images:` entry during overlay rendering. Each entry maps an original image name to an optional replacement name and either a new tag or a new digest, letting you detect non-pinned tags or unintended image swaps. The `name` field selects the entry by its original image name, for example `kustomize.image(name: \"nginx\")`.","provider":"go.mondoo.com/mql/providers/kustomize","is_implicit_resource":true},"kustomization":{"name":"kustomization","type":"\u001bkustomize.kustomization","title":"kustomization.yaml configuration","desc":"Single parsed kustomization, identified by its directory `path`. Exposes the transformers it applies (namespace, name prefix/suffix, common labels and annotations), the resources and components it pulls in, its patches, ConfigMap and Secret generators, image overrides, and replacements, alongside the Kubernetes resources rendered by `kustomize build`. Query this to enforce policy on Kustomize-driven manifests before they reach a cluster.","provider":"go.mondoo.com/mql/providers/kustomize","is_implicit_resource":true},"kustomizations":{"name":"kustomizations","type":"\u0019\u001bkustomize.kustomization","title":"List of all parsed kustomizations","provider":"go.mondoo.com/mql/providers/kustomize"},"patch":{"name":"patch","type":"\u001bkustomize.patch","title":"Kustomize patch (strategic merge or JSON patch)","desc":"Single patch that Kustomize applies to base resources during rendering, mutating them in place. A patch carries its content (inline YAML or a file path) and a target selector (group, version, kind, name, namespace, and label or annotation selector) that picks which resources it modifies. The `format` field distinguishes a strategic-merge overlay from an RFC6902 JSON patch, and `operations` decomposes a JSON patch into its individual steps so an audit can spot changes that weaken a security control.","is_private":true,"provider":"go.mondoo.com/mql/providers/kustomize","is_implicit_resource":true},"replacement":{"name":"replacement","type":"\u001bkustomize.replacement","title":"Kustomize replacement","desc":"A `replacements:` entry that copies one field's value from a source resource into multiple target fields, the modern successor to Kustomize vars. The `sourceKind` and `sourceName` selectors identify the resource to read from, `sourcePath` is the field-path expression that locates the value, and `targets` lists every destination that receives it. Auditing replacements surfaces where values are injected across a rendered manifest set, which matters when a single source drives security-relevant fields such as image tags, names, or annotations.","is_private":true,"provider":"go.mondoo.com/mql/providers/kustomize","is_implicit_resource":true},"replacementTarget":{"name":"replacementTarget","type":"\u001bkustomize.replacementTarget","title":"Kustomize replacement target","desc":"One destination within a `replacements:` entry. The `fieldPath` expression pins where the substituted value is written, while the optional `kind` and `name` selectors narrow which rendered resources are affected. Reviewing targets shows exactly which fields a replacement rewrites, so an over-broad selector that touches more resources than intended becomes visible.","is_private":true,"provider":"go.mondoo.com/mql/providers/kustomize","is_implicit_resource":true},"resource":{"name":"resource","type":"\u001bkustomize.resource","title":"Rendered Kubernetes resource from `kustomize build`","desc":"Kubernetes manifest produced by running Kustomize over the overlay tree, exactly as a cluster would receive it. Its apiVersion, kind, name, namespace, labels, and annotations reflect the final state after every patch, transformer, and name/namespace prefix has been applied, so policy checks run against what actually gets deployed rather than the pre-transformation sources.","is_private":true,"provider":"go.mondoo.com/mql/providers/kustomize","is_implicit_resource":true}},"title":"Kustomize overlay","desc":"Parsed `kustomization.yaml` trees discovered under the connection, each carrying its transformer configuration, generators, patches, image overrides, replacements, and the Kubernetes resources rendered by `kustomize build`. Use this to enforce policy on Kustomize-driven manifests before they reach a cluster.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/kustomize","root":true},"kustomize.generator":{"id":"kustomize.generator","name":"kustomize.generator","fields":{"behavior":{"name":"behavior","type":"\u0007","is_mandatory":true,"title":"Behavior: \"create\", \"replace\", or \"merge\"","provider":"go.mondoo.com/mql/providers/kustomize"},"envs":{"name":"envs","type":"\u0019\u0007","is_mandatory":true,"title":"Env file sources","provider":"go.mondoo.com/mql/providers/kustomize"},"files":{"name":"files","type":"\u0019\u0007","is_mandatory":true,"title":"Files to include","provider":"go.mondoo.com/mql/providers/kustomize"},"literals":{"name":"literals","type":"\u0019\u0007","is_mandatory":true,"title":"Literal key=value pairs","provider":"go.mondoo.com/mql/providers/kustomize"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Generator name","provider":"go.mondoo.com/mql/providers/kustomize"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace","provider":"go.mondoo.com/mql/providers/kustomize"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type: \"configmap\" or \"secret\"","provider":"go.mondoo.com/mql/providers/kustomize"}},"title":"Kustomize ConfigMap or Secret generator","desc":"ConfigMap or Secret generator declared in a kustomization, which produces a Kubernetes ConfigMap or Secret from inline literal key=value pairs, included files, and env-file sources. The `type` field is \"configmap\" or \"secret\", and `behavior` (\"create\", \"replace\", or \"merge\") controls how the generated object interacts with an existing one. Query this to surface inline secrets, audit generated ConfigMap contents, or detect drift in overlay rendering.","private":true,"min_provider_version":"13.0.0","defaults":"name type","provider":"go.mondoo.com/mql/providers/kustomize"},"kustomize.image":{"id":"kustomize.image","name":"kustomize.image","fields":{"digest":{"name":"digest","type":"\u0007","is_mandatory":true,"title":"New digest (mutually exclusive with newTag)","provider":"go.mondoo.com/mql/providers/kustomize"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Original image name","provider":"go.mondoo.com/mql/providers/kustomize"},"newName":{"name":"newName","type":"\u0007","is_mandatory":true,"title":"New image name (empty if unchanged)","provider":"go.mondoo.com/mql/providers/kustomize"},"newTag":{"name":"newTag","type":"\u0007","is_mandatory":true,"title":"New tag","provider":"go.mondoo.com/mql/providers/kustomize"},"tagSuffix":{"name":"tagSuffix","type":"\u0007","is_mandatory":true,"title":"Tag suffix appended to the original tag","desc":"Set by a `tagSuffix:` entry, which keeps the original tag and appends this string to it, for example `-debian`. It is an alternative to newTag and digest, so an entry that leaves all three of those empty still rewrites the image reference.","min_provider_version":"13.1.16","provider":"go.mondoo.com/mql/providers/kustomize"}},"title":"Kustomize image override","desc":"Image name and tag or digest substitution applied by an `images:` entry during overlay rendering. Each entry maps an original image name to an optional replacement name and either a new tag or a new digest, letting you detect non-pinned tags or unintended image swaps. The `name` field selects the entry by its original image name, for example `kustomize.image(name: \"nginx\")`.","min_provider_version":"13.0.0","defaults":"name newTag","provider":"go.mondoo.com/mql/providers/kustomize"},"kustomize.kustomization":{"id":"kustomize.kustomization","name":"kustomize.kustomization","fields":{"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"API version","provider":"go.mondoo.com/mql/providers/kustomize"},"commonAnnotations":{"name":"commonAnnotations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Common annotations added to all resources","provider":"go.mondoo.com/mql/providers/kustomize"},"commonLabels":{"name":"commonLabels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Common labels added to all resources","desc":"Every label pair the kustomization adds to the objects it renders, gathered from both declaration syntaxes: the legacy `commonLabels` mapping and the current `labels` list, whose `pairs` entries are folded in on top of it. A pair declared in `labels` wins when the same key appears in both, and a later `labels` entry wins over an earlier one. The map reports which pairs are added, not how far they reach: a `labels` entry may set includeSelectors or includeTemplates to control whether it also rewrites selectors and pod templates, and those flags are not represented here.","provider":"go.mondoo.com/mql/providers/kustomize"},"componentRefs":{"name":"componentRefs","type":"\u0019\u0007","is_mandatory":true,"title":"Component references","provider":"go.mondoo.com/mql/providers/kustomize"},"configMapGenerators":{"name":"configMapGenerators","type":"\u0019\u001bkustomize.generator","title":"ConfigMap generators","provider":"go.mondoo.com/mql/providers/kustomize"},"images":{"name":"images","type":"\u0019\u001bkustomize.image","title":"Image overrides","provider":"go.mondoo.com/mql/providers/kustomize"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Kind (Kustomization or Component)","provider":"go.mondoo.com/mql/providers/kustomize"},"namePrefix":{"name":"namePrefix","type":"\u0007","is_mandatory":true,"title":"Name prefix applied to all resources","provider":"go.mondoo.com/mql/providers/kustomize"},"nameSuffix":{"name":"nameSuffix","type":"\u0007","is_mandatory":true,"title":"Name suffix applied to all resources","provider":"go.mondoo.com/mql/providers/kustomize"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace override applied to all resources","provider":"go.mondoo.com/mql/providers/kustomize"},"patches":{"name":"patches","type":"\u0019\u001bkustomize.patch","title":"Patches (strategic merge and JSON)","provider":"go.mondoo.com/mql/providers/kustomize"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the kustomization directory","provider":"go.mondoo.com/mql/providers/kustomize"},"replacements":{"name":"replacements","type":"\u0019\u001bkustomize.replacement","title":"Replacements (var-free field substitution)","provider":"go.mondoo.com/mql/providers/kustomize"},"resourceRefs":{"name":"resourceRefs","type":"\u0019\u0007","is_mandatory":true,"title":"Raw resource file references","provider":"go.mondoo.com/mql/providers/kustomize"},"resources":{"name":"resources","type":"\u0019\u001bkustomize.resource","title":"Rendered Kubernetes resources (kustomize build output)","provider":"go.mondoo.com/mql/providers/kustomize"},"secretGenerators":{"name":"secretGenerators","type":"\u0019\u001bkustomize.generator","title":"Secret generators","provider":"go.mondoo.com/mql/providers/kustomize"}},"title":"kustomization.yaml configuration","desc":"Single parsed kustomization, identified by its directory `path`. Exposes the transformers it applies (namespace, name prefix/suffix, common labels and annotations), the resources and components it pulls in, its patches, ConfigMap and Secret generators, image overrides, and replacements, alongside the Kubernetes resources rendered by `kustomize build`. Query this to enforce policy on Kustomize-driven manifests before they reach a cluster.","min_provider_version":"13.0.0","defaults":"path","provider":"go.mondoo.com/mql/providers/kustomize"},"kustomize.patch":{"id":"kustomize.patch","name":"kustomize.patch","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Patch content (inline YAML or file content)","provider":"go.mondoo.com/mql/providers/kustomize"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Patch format","desc":"Either \"strategicMerge\" or \"json6902\", determined from the patch declaration or by inspecting the patch content shape. A patch whose content is a sequence of operation objects (each carrying an `op` key) is classified as \"json6902\"; any mapping-shaped patch is \"strategicMerge\". Use this to distinguish a strategic-merge overlay from a JSON patch.","min_provider_version":"13.0.10","provider":"go.mondoo.com/mql/providers/kustomize"},"operation":{"name":"operation","type":"\u001bkustomize.patch.operation","title":"JSON patch operation from a JSON6902 Kustomize patch","desc":"Single RFC6902 operation decomposed from a \"json6902\" patch. The `op` is one of add, remove, replace, move, copy, or test; `path` is the RFC6901 JSON pointer the operation targets (for example `/spec/template/spec/containers/0`); and `value` carries the operand for add, replace, and test operations and is null otherwise. This surfaces operations that strip a security control from a base resource.","is_private":true,"provider":"go.mondoo.com/mql/providers/kustomize","is_implicit_resource":true},"operations":{"name":"operations","type":"\u0019\u001bkustomize.patch.operation","title":"JSON patch operations","desc":"Decomposed RFC6902 operations for a \"json6902\" patch — empty for a \"strategicMerge\" patch. Each entry exposes its `op`, `path`, and `value`, so an audit can detect a patch that removes a security control (for example an `op: remove` targeting a securityContext).","min_provider_version":"13.0.10","provider":"go.mondoo.com/mql/providers/kustomize"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Patch file path (empty if inline)","provider":"go.mondoo.com/mql/providers/kustomize"},"targetAnnotationSelector":{"name":"targetAnnotationSelector","type":"\u0007","is_mandatory":true,"title":"Target annotation selector","provider":"go.mondoo.com/mql/providers/kustomize"},"targetGroup":{"name":"targetGroup","type":"\u0007","is_mandatory":true,"title":"Target group","provider":"go.mondoo.com/mql/providers/kustomize"},"targetKind":{"name":"targetKind","type":"\u0007","is_mandatory":true,"title":"Target kind","provider":"go.mondoo.com/mql/providers/kustomize"},"targetLabelSelector":{"name":"targetLabelSelector","type":"\u0007","is_mandatory":true,"title":"Target label selector","provider":"go.mondoo.com/mql/providers/kustomize"},"targetName":{"name":"targetName","type":"\u0007","is_mandatory":true,"title":"Target name","provider":"go.mondoo.com/mql/providers/kustomize"},"targetNamespace":{"name":"targetNamespace","type":"\u0007","is_mandatory":true,"title":"Target namespace","provider":"go.mondoo.com/mql/providers/kustomize"},"targetVersion":{"name":"targetVersion","type":"\u0007","is_mandatory":true,"title":"Target version","provider":"go.mondoo.com/mql/providers/kustomize"}},"title":"Kustomize patch (strategic merge or JSON patch)","desc":"Single patch that Kustomize applies to base resources during rendering, mutating them in place. A patch carries its content (inline YAML or a file path) and a target selector (group, version, kind, name, namespace, and label or annotation selector) that picks which resources it modifies. The `format` field distinguishes a strategic-merge overlay from an RFC6902 JSON patch, and `operations` decomposes a JSON patch into its individual steps so an audit can spot changes that weaken a security control.","private":true,"min_provider_version":"13.0.0","defaults":"path","provider":"go.mondoo.com/mql/providers/kustomize"},"kustomize.patch.operation":{"id":"kustomize.patch.operation","name":"kustomize.patch.operation","fields":{"op":{"name":"op","type":"\u0007","is_mandatory":true,"title":"Operation: add, remove, replace, move, copy, or test","provider":"go.mondoo.com/mql/providers/kustomize"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"RFC6901 JSON pointer the operation targets","provider":"go.mondoo.com/mql/providers/kustomize"},"value":{"name":"value","type":"\n","is_mandatory":true,"title":"Operand value","desc":"Present for add, replace, and test operations; null for remove, move, and copy.","provider":"go.mondoo.com/mql/providers/kustomize"}},"title":"JSON patch operation from a JSON6902 Kustomize patch","desc":"Single RFC6902 operation decomposed from a \"json6902\" patch. The `op` is one of add, remove, replace, move, copy, or test; `path` is the RFC6901 JSON pointer the operation targets (for example `/spec/template/spec/containers/0`); and `value` carries the operand for add, replace, and test operations and is null otherwise. This surfaces operations that strip a security control from a base resource.","private":true,"min_provider_version":"13.0.10","defaults":"op path","provider":"go.mondoo.com/mql/providers/kustomize"},"kustomize.replacement":{"id":"kustomize.replacement","name":"kustomize.replacement","fields":{"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Replacement file path","desc":"Set when the entry is declared as `- path: file.yaml` instead of inline, naming the file (relative to the kustomization directory) that holds the source and targets. Empty for an inline declaration. The field stays populated even when the file cannot be read, so a dangling reference is visible rather than reading as a replacement that substitutes nothing.","min_provider_version":"13.1.16","provider":"go.mondoo.com/mql/providers/kustomize"},"sourceKind":{"name":"sourceKind","type":"\u0007","is_mandatory":true,"title":"Source resource kind","provider":"go.mondoo.com/mql/providers/kustomize"},"sourceName":{"name":"sourceName","type":"\u0007","is_mandatory":true,"title":"Source resource name","provider":"go.mondoo.com/mql/providers/kustomize"},"sourcePath":{"name":"sourcePath","type":"\u0007","is_mandatory":true,"title":"Source field path (e.g., \".metadata.name\")","provider":"go.mondoo.com/mql/providers/kustomize"},"targets":{"name":"targets","type":"\u0019\u001bkustomize.replacementTarget","title":"Target field paths","provider":"go.mondoo.com/mql/providers/kustomize"}},"title":"Kustomize replacement","desc":"A `replacements:` entry that copies one field's value from a source resource into multiple target fields, the modern successor to Kustomize vars. The `sourceKind` and `sourceName` selectors identify the resource to read from, `sourcePath` is the field-path expression that locates the value, and `targets` lists every destination that receives it. Auditing replacements surfaces where values are injected across a rendered manifest set, which matters when a single source drives security-relevant fields such as image tags, names, or annotations.","private":true,"min_provider_version":"13.0.0","defaults":"sourcePath","provider":"go.mondoo.com/mql/providers/kustomize"},"kustomize.replacementTarget":{"id":"kustomize.replacementTarget","name":"kustomize.replacementTarget","fields":{"fieldPath":{"name":"fieldPath","type":"\u0007","is_mandatory":true,"title":"Target field path to replace","provider":"go.mondoo.com/mql/providers/kustomize"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Target resource kind selector","provider":"go.mondoo.com/mql/providers/kustomize"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Target resource name selector","provider":"go.mondoo.com/mql/providers/kustomize"}},"title":"Kustomize replacement target","desc":"One destination within a `replacements:` entry. The `fieldPath` expression pins where the substituted value is written, while the optional `kind` and `name` selectors narrow which rendered resources are affected. Reviewing targets shows exactly which fields a replacement rewrites, so an over-broad selector that touches more resources than intended becomes visible.","private":true,"min_provider_version":"13.0.0","defaults":"fieldPath","provider":"go.mondoo.com/mql/providers/kustomize"},"kustomize.resource":{"id":"kustomize.resource","name":"kustomize.resource","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Annotations (after transformations)","provider":"go.mondoo.com/mql/providers/kustomize"},"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes API version","provider":"go.mondoo.com/mql/providers/kustomize"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Resource kind","provider":"go.mondoo.com/mql/providers/kustomize"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Labels (after transformations)","provider":"go.mondoo.com/mql/providers/kustomize"},"manifest":{"name":"manifest","type":"\n","is_mandatory":true,"title":"Full resource manifest","desc":"Complete rendered Kubernetes object with its native structure preserved: top-level `apiVersion`, `kind`, and `metadata` keys plus the kind-specific body (`spec`, `data`, `stringData`, `rules`, and so on). Drill into it to audit fields not surfaced as named accessors, for example `manifest[\"spec\"][\"replicas\"]`.","provider":"go.mondoo.com/mql/providers/kustomize"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name (after transformations)","provider":"go.mondoo.com/mql/providers/kustomize"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Resource namespace (after transformations)","provider":"go.mondoo.com/mql/providers/kustomize"}},"title":"Rendered Kubernetes resource from `kustomize build`","desc":"Kubernetes manifest produced by running Kustomize over the overlay tree, exactly as a cluster would receive it. Its apiVersion, kind, name, namespace, labels, and annotations reflect the final state after every patch, transformer, and name/namespace prefix has been applied, so policy checks run against what actually gets deployed rather than the pre-transformation sources.","private":true,"min_provider_version":"13.0.0","defaults":"kind name","provider":"go.mondoo.com/mql/providers/kustomize"}},"dependencies":{"core":{"id":"go.mondoo.com/mql/providers/core","name":"core"}},"provider_roots":{"go.mondoo.com/mql/providers/kustomize":"kustomize"}}