{"resources":{"openstack":{"id":"openstack","name":"openstack","fields":{"aggregates":{"name":"aggregates","type":"\u0019\u001bopenstack.compute.aggregate","title":"Nova host aggregates (admin-only)","provider":"go.mondoo.com/mql/providers/openstack"},"applicationCredential":{"name":"applicationCredential","type":"\u001bopenstack.applicationCredential","title":"OpenStack Keystone application credential","desc":"Long-lived authentication credential for service principals (often used by automation), scoped to a single project with a subset of the owning user's roles.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"authUrl":{"name":"authUrl","type":"\u0007","is_mandatory":true,"title":"Keystone auth URL the connection is bound to","provider":"go.mondoo.com/mql/providers/openstack"},"backups":{"name":"backups","type":"\u0019\u001bopenstack.blockstorage.backup","title":"Cinder volume backups in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"baremetal":{"name":"baremetal","type":"\u001bopenstack.baremetal","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"baremetalNodes":{"name":"baremetalNodes","type":"\u0019\u001bopenstack.baremetal.node","title":"Ironic bare-metal nodes in the scoped project","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"blockStorageQosSpecs":{"name":"blockStorageQosSpecs","type":"\u0019\u001bopenstack.blockstorage.qosSpec","title":"Cinder QoS specifications (IOPS/bandwidth throttling policies); admin-only","min_provider_version":"13.5.2","provider":"go.mondoo.com/mql/providers/openstack"},"blockStorageQuotaSet":{"name":"blockStorageQuotaSet","type":"\u001bopenstack.blockstorage.quotaSet","title":"Per-project Cinder quota","provider":"go.mondoo.com/mql/providers/openstack"},"blockstorage":{"name":"blockstorage","type":"\u001bopenstack.blockstorage","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"clusterTemplates":{"name":"clusterTemplates","type":"\u0019\u001bopenstack.containerinfra.clusterTemplate","title":"Magnum cluster templates (blueprints for new clusters)","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"clusters":{"name":"clusters","type":"\u0019\u001bopenstack.containerinfra.cluster","title":"Magnum container-orchestration clusters (Kubernetes, Docker Swarm) in the scoped project","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"compute":{"name":"compute","type":"\u001bopenstack.compute","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"computeLimits":{"name":"computeLimits","type":"\u001bopenstack.compute.limits","title":"Per-project Nova resource limits and current usage","provider":"go.mondoo.com/mql/providers/openstack"},"computeQuotaSet":{"name":"computeQuotaSet","type":"\u001bopenstack.compute.quotaSet","title":"Per-project Nova compute quota","min_provider_version":"13.5.2","provider":"go.mondoo.com/mql/providers/openstack"},"computeServices":{"name":"computeServices","type":"\u0019\u001bopenstack.compute.service","title":"Nova compute services (admin-only)","provider":"go.mondoo.com/mql/providers/openstack"},"containerinfra":{"name":"containerinfra","type":"\u001bopenstack.containerinfra","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"credential":{"name":"credential","type":"\u001bopenstack.credential","title":"OpenStack Keystone credential","desc":"Stored authentication credential owned by a user and scoped to a project, most commonly an EC2-style access/secret key pair (`type` ec2) or an X.509 certificate (`type` cert). Select a credential by its `id`. The secret material (the credential blob) is intentionally not exposed; query `type`, `user`, and `project` to audit who holds long-lived credentials.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"credentials":{"name":"credentials","type":"\u0019\u001bopenstack.credential","title":"Keystone credentials such as EC2 access keys and X.509 certs (typically admin-only)","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"databaseInstances":{"name":"databaseInstances","type":"\u0019\u001bopenstack.db.instance","title":"Trove managed database instances in the scoped project","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"db":{"name":"db","type":"\u001bopenstack.db","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"dns":{"name":"dns","type":"\u001bopenstack.dns","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"dnsZones":{"name":"dnsZones","type":"\u0019\u001bopenstack.dns.zone","title":"Designate DNS zones visible to the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"domain":{"name":"domain","type":"\u001bopenstack.domain","title":"OpenStack Keystone domain","desc":"Top-level identity boundary in Keystone that contains projects, users, and groups, providing administrative separation between tenants. Auditing a domain reveals whether it is enabled and which groups it holds, which together govern the scope of authentication and authorization within it. A domain is selected by its `id`, for example `openstack.domain(id: \"default\")` for the bootstrap domain.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"domains":{"name":"domains","type":"\u0019\u001bopenstack.domain","title":"Keystone domains (typically admin-only)","provider":"go.mondoo.com/mql/providers/openstack"},"ec2Credential":{"name":"ec2Credential","type":"\u001bopenstack.ec2Credential","title":"OpenStack Keystone EC2-compatible credential","desc":"EC2-style access credential owned by a user, used by EC2/S3-compatible API clients. Select a credential by its `access` key, for example `openstack.ec2Credential(access: \"abc123...\")`. The secret key is intentionally not exposed; query `access`, `user`, `project`, and `trust` to audit long-lived programmatic access.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"firewall":{"name":"firewall","type":"\u001bopenstack.firewall","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"firewallGroups":{"name":"firewallGroups","type":"\u0019\u001bopenstack.firewall.group","title":"Neutron FWaaS v2 firewall groups in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"firewallPolicies":{"name":"firewallPolicies","type":"\u0019\u001bopenstack.firewall.policy","title":"Neutron FWaaS v2 firewall policies in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"firewallRules":{"name":"firewallRules","type":"\u0019\u001bopenstack.firewall.rule","title":"Neutron FWaaS v2 firewall rules in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"flavors":{"name":"flavors","type":"\u0019\u001bopenstack.compute.flavor","title":"Nova flavors (VM sizes)","provider":"go.mondoo.com/mql/providers/openstack"},"floatingIp":{"name":"floatingIp","type":"\u001bopenstack.floatingIp","title":"OpenStack Neutron floating IP","desc":"Public IPv4 address allocated from an external network and mapped through NAT to a private fixed IP on a Neutron port, giving an instance inbound reachability from outside the tenant network. Select a floating IP by its UUID, for example `openstack.floatingIp(id: \"a1b2c3d4-...\")`. Auditing floating IPs reveals which internal workloads are exposed to the internet, the external network they draw from, the port and router carrying their NAT, and any DNAT port-forwarding rules that publish additional private services.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"floatingIps":{"name":"floatingIps","type":"\u0019\u001bopenstack.floatingIp","title":"Neutron floating IPs","provider":"go.mondoo.com/mql/providers/openstack"},"group":{"name":"group","type":"\u001bopenstack.group","title":"OpenStack Keystone group","desc":"Keystone group that aggregates users so roles can be granted collectively rather than to each user individually. Auditing groups reveals who inherits privileged access through membership: the users field lists the members and the roles field reports the effective roles the group confers across project, domain, and system scopes. Select a group by its UUID, for example openstack.group(id: \"a1b2c3d4...\").","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"groups":{"name":"groups","type":"\u0019\u001bopenstack.group","title":"Keystone groups (typically admin-only)","provider":"go.mondoo.com/mql/providers/openstack"},"healthMonitors":{"name":"healthMonitors","type":"\u0019\u001bopenstack.octavia.healthMonitor","title":"Octavia health monitors in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"hypervisors":{"name":"hypervisors","type":"\u0019\u001bopenstack.compute.hypervisor","title":"Nova hypervisors (admin-only)","provider":"go.mondoo.com/mql/providers/openstack"},"identity":{"name":"identity","type":"\u001bopenstack.identity","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"identityEndpoints":{"name":"identityEndpoints","type":"\u0019\u001bopenstack.identity.endpoint","title":"Keystone service-catalog endpoints (typically admin-only)","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"identityServices":{"name":"identityServices","type":"\u0019\u001bopenstack.identity.service","title":"Keystone service-catalog services (typically admin-only)","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"image":{"name":"image","type":"\u001bopenstack.image","title":"OpenStack Glance image","desc":"Virtual machine image registered in Glance, the source template instances boot from. Select one by its UUID, for example `openstack.image(id: \"7c9d9e5f-...\")`. Audit `visibility` to find images exposed publicly or to the whole community, `protected` and `hidden` to understand lifecycle and listing controls, and the integrity fields (`checksum`, `osHashAlgo`, `osHashValue`) alongside `imageSignature` to confirm images are signed and untampered. The `members` field enumerates the projects a shared image is visible to, and `kernel` and `ramdisk` resolve the AMI-style boot components.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"images":{"name":"images","type":"\u0019\u001bopenstack.image","title":"Glance images visible to the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"keymanager":{"name":"keymanager","type":"\u001bopenstack.keymanager","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"keypairs":{"name":"keypairs","type":"\u0019\u001bopenstack.compute.keypair","title":"Nova SSH keypairs","provider":"go.mondoo.com/mql/providers/openstack"},"l7Policies":{"name":"l7Policies","type":"\u0019\u001bopenstack.octavia.l7Policy","title":"Octavia L7 policies in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"listeners":{"name":"listeners","type":"\u0019\u001bopenstack.octavia.listener","title":"Octavia listeners in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"loadBalancers":{"name":"loadBalancers","type":"\u0019\u001bopenstack.octavia.loadBalancer","title":"Octavia load balancers in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"network":{"name":"network","type":"\u001bopenstack.network","title":"OpenStack Neutron network","desc":"Layer-2 virtual network in the Neutron networking service, the broadcast domain that ports and subnets attach to. Query it to audit tenant isolation and exposure: `shared` reveals a network usable by other projects, `external` marks a provider network that bridges to the outside world, and `portSecurityEnabled` sets whether ports created on the network get anti-spoofing and security-group enforcement by default. The provider attributes (providerNetworkType, providerPhysicalNetwork, providerSegmentationId) expose the underlying segmentation, and subnets returns the address ranges carved from the network. Select a network by id with `openstack.network(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"networkQuotaSet":{"name":"networkQuotaSet","type":"\u001bopenstack.network.quotaSet","title":"Per-project Neutron quota","provider":"go.mondoo.com/mql/providers/openstack"},"networks":{"name":"networks","type":"\u0019\u001bopenstack.network","title":"Neutron networks","provider":"go.mondoo.com/mql/providers/openstack"},"objectStorageAccount":{"name":"objectStorageAccount","type":"\u001bopenstack.objectstorage.account","title":"Swift object-storage account for the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"objectStorageContainers":{"name":"objectStorageContainers","type":"\u0019\u001bopenstack.objectstorage.container","title":"Swift object-storage containers in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"objectstorage":{"name":"objectstorage","type":"\u001bopenstack.objectstorage","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"octavia":{"name":"octavia","type":"\u001bopenstack.octavia","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"orchestration":{"name":"orchestration","type":"\u001bopenstack.orchestration","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"placement":{"name":"placement","type":"\u001bopenstack.placement","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"pools":{"name":"pools","type":"\u0019\u001bopenstack.octavia.pool","title":"Octavia pools in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"port":{"name":"port","type":"\u001bopenstack.port","title":"OpenStack Neutron port","desc":"Virtual network interface attached to a server, router, or other network device, carrying the security posture of that attachment. Select a port by its UUID, for example `openstack.port(id: \"a1b2c3d4-...\")`. The `portSecurityEnabled` flag governs whether MAC/IP anti-spoofing and security group filtering apply at all, `allowedAddressPairs` widens which source addresses bypass that filtering, and `deviceOwner` records what the port is bound to (compute instance, router interface, DHCP agent). Fixed and floating IP bindings, attached security groups, and the owning network, server, router, and project are all reachable from the port.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"ports":{"name":"ports","type":"\u0019\u001bopenstack.port","title":"Neutron ports","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"OpenStack Keystone project (formerly \"tenant\")","desc":"Keystone project that owns and scopes cloud resources such as compute instances, networks, and volumes. Projects are the primary unit of ownership, quota, and access control in OpenStack, so auditing them reveals which tenancies exist, whether they are still enabled, and how they nest beneath domains and parent projects. Select a project by its UUID, for example `openstack.project(id: \"a1b2c3d4-...\")`. The isDomain field distinguishes an ordinary project from one that acts as a domain, and parent is null for top-level projects.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Scoped project ID","provider":"go.mondoo.com/mql/providers/openstack"},"projects":{"name":"projects","type":"\u0019\u001bopenstack.project","title":"Keystone projects visible to the authenticated user (admin scope returns all)","provider":"go.mondoo.com/mql/providers/openstack"},"qosPolicies":{"name":"qosPolicies","type":"\u0019\u001bopenstack.qosPolicy","title":"Neutron QoS policies in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"qosPolicy":{"name":"qosPolicy","type":"\u001bopenstack.qosPolicy","title":"OpenStack Neutron QoS policy","desc":"Quality-of-Service policy that attaches traffic-shaping rules to Neutron ports, networks, and floating IPs. Each policy holds a set of rules (bandwidth limits, DSCP marking, minimum guaranteed bandwidth, and packet-rate limits) exposed through `rules`. The `shared` flag governs whether other projects can attach the policy, and `isDefault` marks the policy that new ports inherit, so both are worth auditing when reviewing tenant traffic controls. Select a policy by its UUID, for example `openstack.qosPolicy(id: \"d1e2f3a4-...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"rbacPolicies":{"name":"rbacPolicies","type":"\u0019\u001bopenstack.network.rbacPolicy","title":"Neutron RBAC policies controlling which projects a network or QoS policy is shared with","min_provider_version":"13.5.2","provider":"go.mondoo.com/mql/providers/openstack"},"region":{"name":"region","type":"\u001bopenstack.identity.region","title":"Region the connection is targeting","provider":"go.mondoo.com/mql/providers/openstack"},"regions":{"name":"regions","type":"\u0019\u001bopenstack.identity.region","title":"Keystone regions","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"resourceProviders":{"name":"resourceProviders","type":"\u0019\u001bopenstack.placement.resourceProvider","title":"Placement resource providers (compute nodes, storage pools, and accelerator/GPU devices) with their inventory and traits","min_provider_version":"13.2.2","provider":"go.mondoo.com/mql/providers/openstack"},"role":{"name":"role","type":"\u001bopenstack.role","title":"OpenStack Keystone role","desc":"Named permission set that Keystone grants to users or groups on a project or domain, driving what actions an identity may perform. Auditing roles surfaces the privilege vocabulary of the cloud (for example admin, member, and reader) so you can reason about who holds elevated access. A role is selected by its UUID, for example openstack.role(id: \"9fe2ff9ee4384b1894a90878d3e92bab\"). The domain field is null for global roles and set for roles scoped to a single domain.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"roleAssignments":{"name":"roleAssignments","type":"\u0019\u001bopenstack.identity.roleAssignment","title":"Keystone role assignments showing which principals hold which roles at which scope (typically admin-only)","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"roleInferences":{"name":"roleInferences","type":"\u0019\u001bopenstack.identity.roleInference","title":"Keystone role inference rules mapping a prior role to an implied role (typically admin-only)","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"roles":{"name":"roles","type":"\u0019\u001bopenstack.role","title":"Keystone roles (typically admin-only)","provider":"go.mondoo.com/mql/providers/openstack"},"router":{"name":"router","type":"\u001bopenstack.router","title":"OpenStack Neutron router","desc":"A Neutron router that connects tenant networks to each other and to external networks, providing routing, source NAT, and floating-IP gateway services. Query a single router by its UUID, for example openstack.router(id: \"a1b2c3d4-...\"). Security-relevant surface includes externalGatewayInfo and enableSnat (whether tenant traffic egresses through source NAT), the static routes it advertises, and whether admin state is up. The externalNetwork field resolves the external network used for the gateway.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"routers":{"name":"routers","type":"\u0019\u001bopenstack.router","title":"Neutron routers","provider":"go.mondoo.com/mql/providers/openstack"},"secretContainers":{"name":"secretContainers","type":"\u0019\u001bopenstack.keymanager.container","title":"Barbican secret containers (e.g. TLS bundles referenced by Octavia listeners) in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"secretOrders":{"name":"secretOrders","type":"\u0019\u001bopenstack.keymanager.order","title":"Barbican secret-generation orders in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"secrets":{"name":"secrets","type":"\u0019\u001bopenstack.keymanager.secret","title":"Barbican secrets in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"securityGroup":{"name":"securityGroup","type":"\u001bopenstack.securityGroup","title":"OpenStack Neutron security group","desc":"Set of firewall rules that govern ingress and egress traffic for the ports and instances the group is attached to. Audit security groups to find overly permissive access, such as rules that expose services to the public internet. The stateful field distinguishes connection-tracking groups from stateless ones that require explicit return-traffic rules, and allowsPublicIngress flags any group whose ingress rules reach a public source. Select a group by its UUID, for example openstack.securityGroup(id: \"9d6f...\").","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"securityGroups":{"name":"securityGroups","type":"\u0019\u001bopenstack.securityGroup","title":"Neutron security groups (with embedded rules)","provider":"go.mondoo.com/mql/providers/openstack"},"securityServices":{"name":"securityServices","type":"\u0019\u001bopenstack.sharedfilesystem.securityService","title":"Manila security services (Active Directory, LDAP, or Kerberos) backing share networks","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"serverGroups":{"name":"serverGroups","type":"\u0019\u001bopenstack.compute.serverGroup","title":"Nova server groups (affinity / anti-affinity)","provider":"go.mondoo.com/mql/providers/openstack"},"servers":{"name":"servers","type":"\u0019\u001bopenstack.compute.server","title":"Nova compute servers (instances) in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"shareNetworks":{"name":"shareNetworks","type":"\u0019\u001bopenstack.sharedfilesystem.shareNetwork","title":"Manila share networks tying shares to Neutron networks and subnets","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"sharedfilesystem":{"name":"sharedfilesystem","type":"\u001bopenstack.sharedfilesystem","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"shares":{"name":"shares","type":"\u0019\u001bopenstack.sharedfilesystem.share","title":"Manila shared file systems (NFS/CIFS shares) in the scoped project","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"snapshots":{"name":"snapshots","type":"\u0019\u001bopenstack.blockstorage.snapshot","title":"Cinder volume snapshots in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"stacks":{"name":"stacks","type":"\u0019\u001bopenstack.orchestration.stack","title":"Heat orchestration stacks in the scoped project","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"subnet":{"name":"subnet","type":"\u001bopenstack.subnet","title":"OpenStack Neutron subnet","desc":"IP address range carved out of a Neutron network, defined by its `cidr`, IP version, default gateway, and DHCP behavior. A subnet governs how addresses are handed to ports and which DNS nameservers and host routes instances receive. Selected by ID, for example `openstack.subnet(id: \"a1b2c3d4-...\")`. Query subnets to confirm CIDR sizing, gateway placement, whether DHCP is enabled, and the IPv6 address and router-advertisement modes.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"subnetPool":{"name":"subnetPool","type":"\u001bopenstack.subnetPool","title":"OpenStack Neutron subnet pool","desc":"Pool of CIDR prefixes that Neutron carves tenant subnets from, so address space is managed centrally instead of assigned ad hoc. The `id` field selects a specific pool, for example `openstack.subnetPool(id: \"a1b2c3d4-...\")`. Auditing a pool shows the prefixes it can allocate, the allowed prefix-length bounds (minPrefixLen, maxPrefixLen), the per-project address quota, whether the pool is shared across projects, and the address scope it is bound to, all of which govern how much address space each tenant can claim.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"subnetPools":{"name":"subnetPools","type":"\u0019\u001bopenstack.subnetPool","title":"Neutron subnet pools (admin-allocated CIDR ranges) visible to the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"subnets":{"name":"subnets","type":"\u0019\u001bopenstack.subnet","title":"Neutron subnets","provider":"go.mondoo.com/mql/providers/openstack"},"trunk":{"name":"trunk","type":"\u001bopenstack.trunk","title":"OpenStack Neutron trunk","desc":"Neutron trunk port that multiplexes traffic from several networks onto a single parent port. Traffic for each attached network arrives on a subport tagged with its own VLAN ID, letting one instance reach many networks over one virtual NIC. Select a trunk by its UUID, for example `openstack.trunk(id: \"...\")`. Audit trunks to see which ports an instance is bridged onto, whether the trunk is administratively up (adminStateUp), and its operational status. The parentPort and subportPorts accessors resolve the underlying Neutron ports for reachability and security-group analysis.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"trunks":{"name":"trunks","type":"\u0019\u001bopenstack.trunk","title":"Neutron trunks (parent/subport multi-VLAN containers) in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"trust":{"name":"trust","type":"\u001bopenstack.trust","title":"OpenStack Keystone trust","desc":"Delegation of authorization from a trustor user to a trustee user, optionally limited to a subset of roles on a project, with optional impersonation and re-delegation. Select a trust by its `id`, for example `openstack.trust(id: \"3d2c...\")`. Trusts that allow impersonation or unlimited uses grant standing access on the trustor's behalf and should be reviewed closely.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"trusts":{"name":"trusts","type":"\u0019\u001bopenstack.trust","title":"Keystone trusts delegating authorization between users (typically admin-only)","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"OpenStack Keystone user","desc":"Identity account in the Keystone identity service, selected by its UUID with `openstack.user(id: \"...\")`. Exposes the account's enabled state, password expiry, and per-user security options such as multi-factor authentication enforcement and lockout exemption, along with the domain it belongs to, its effective role assignments, group memberships, and the application and EC2-compatible credentials it owns. Audit these to find over-privileged, stale, or MFA-exempt accounts.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bopenstack.user","title":"Keystone users (typically admin-only)","provider":"go.mondoo.com/mql/providers/openstack"},"volumeTypes":{"name":"volumeTypes","type":"\u0019\u001bopenstack.blockstorage.volumeType","title":"Cinder volume types (storage classes) visible to the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"volumes":{"name":"volumes","type":"\u0019\u001bopenstack.blockstorage.volume","title":"Cinder block-storage volumes in the scoped project","provider":"go.mondoo.com/mql/providers/openstack"},"vpn":{"name":"vpn","type":"\u001bopenstack.vpn","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"vpnEndpointGroups":{"name":"vpnEndpointGroups","type":"\u0019\u001bopenstack.vpn.endpointGroup","title":"Neutron VPNaaS v2 endpoint groups in the scoped project","min_provider_version":"13.6.1","provider":"go.mondoo.com/mql/providers/openstack"},"vpnIkePolicies":{"name":"vpnIkePolicies","type":"\u0019\u001bopenstack.vpn.ikePolicy","title":"Neutron VPNaaS v2 IKE policies in the scoped project","min_provider_version":"13.6.1","provider":"go.mondoo.com/mql/providers/openstack"},"vpnIpsecPolicies":{"name":"vpnIpsecPolicies","type":"\u0019\u001bopenstack.vpn.ipsecPolicy","title":"Neutron VPNaaS v2 IPsec policies in the scoped project","min_provider_version":"13.6.1","provider":"go.mondoo.com/mql/providers/openstack"},"vpnServices":{"name":"vpnServices","type":"\u0019\u001bopenstack.vpn.service","title":"Neutron VPNaaS v2 IPsec VPN services in the scoped project","min_provider_version":"13.6.1","provider":"go.mondoo.com/mql/providers/openstack"},"vpnSiteConnections":{"name":"vpnSiteConnections","type":"\u0019\u001bopenstack.vpn.siteConnection","title":"Neutron VPNaaS v2 IPsec site-to-site connections in the scoped project","min_provider_version":"13.6.1","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack connection","desc":"Root entry point to a single scoped OpenStack project, gathering its identity, compute, networking, storage, load-balancing, key-management, DNS, shared-file, container-infrastructure, database, bare-metal, and orchestration resources under one connection. Keystone principals and the service catalog support identity and access-control audits (who exists, what roles they hold, and where credentials and trusts delegate authority); Nova, Placement, and Cinder collections surface the compute, capacity, and block-storage posture of the project; and the Neutron, FWaaS v2, VPNaaS v2, Octavia, and Barbican collections cover the networking, perimeter firewalling, site-to-site VPN, load-balancing, and secret-management surface most relevant to security review. The `authUrl`, `projectId`, and `region` fields identify the connection scope every other resource is read against.","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.applicationCredential":{"id":"openstack.applicationCredential","name":"openstack.applicationCredential","fields":{"accessRules":{"name":"accessRules","type":"\u0019\n","is_mandatory":true,"title":"API endpoint access rules","desc":"Restrictions limiting which API calls the credential may make. Each entry is a dict with `id` (the rule UUID), `service` (the service type, for example `compute` or `image`), `method` (the HTTP method, for example `GET` or `POST`), and `path` (the request path the rule permits). An empty list means the credential can call every endpoint its granted roles allow.","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Expiration timestamp; null when the credential never expires","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Application credential ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Credential name (human-readable label, unique per owning user)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project the credential is scoped to","provider":"go.mondoo.com/mql/providers/openstack"},"roleNames":{"name":"roleNames","type":"\u0019\u0007","is_mandatory":true,"title":"Role names this credential is allowed to assume (subset of the owning user's roles)","provider":"go.mondoo.com/mql/providers/openstack"},"unrestricted":{"name":"unrestricted","type":"\u0004","is_mandatory":true,"title":"Whether the credential can use restricted operations","desc":"True when the credential is allowed to create other credentials or trusts. Unrestricted credentials are equivalent to long-lived tokens for the scoped roles and should be reviewed closely.","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"Owning user","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone application credential","desc":"Long-lived authentication credential for service principals (often used by automation), scoped to a single project with a subset of the owning user's roles.","private":true,"min_provider_version":"13.0.1","defaults":"id name unrestricted expiresAt","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.baremetal":{"id":"openstack.baremetal","fields":{"node":{"name":"node","type":"\u001bopenstack.baremetal.node","title":"OpenStack Ironic bare-metal node","desc":"Physical machine managed by Ironic, the OpenStack bare-metal provisioning service. Select a node by its `id` (UUID). The `provisionState`, `maintenance`, `powerState`, and `fault` fields report whether the node is in service or has a hardware problem, `instance` links to the Nova instance (if any) that the node backs, and `owner` and `lessee` capture multi-tenant ownership.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"port":{"name":"port","type":"\u001bopenstack.baremetal.port","title":"OpenStack Ironic bare-metal port","desc":"Network port (NIC) on an Ironic bare-metal node, covering its MAC address, PXE setting, and physical-network binding. Select a port by its `id` (UUID). The `pxeEnabled` and `localLinkConnection` fields describe how the port boots and which switch port it connects to.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.baremetal.node":{"id":"openstack.baremetal.node","name":"openstack.baremetal.node","fields":{"bootInterface":{"name":"bootInterface","type":"\u0007","is_mandatory":true,"title":"Boot interface driver (for example `pxe` or `ipxe`)","provider":"go.mondoo.com/mql/providers/openstack"},"conductor":{"name":"conductor","type":"\u0007","is_mandatory":true,"title":"Conductor currently responsible for the node","provider":"go.mondoo.com/mql/providers/openstack"},"conductorGroup":{"name":"conductorGroup","type":"\u0007","is_mandatory":true,"title":"Conductor group the node belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"consoleEnabled":{"name":"consoleEnabled","type":"\u0004","is_mandatory":true,"title":"Whether serial console access is enabled","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"deployInterface":{"name":"deployInterface","type":"\u0007","is_mandatory":true,"title":"Deploy interface driver (for example `direct` or `iscsi`)","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-form description of the node","provider":"go.mondoo.com/mql/providers/openstack"},"driver":{"name":"driver","type":"\u0007","is_mandatory":true,"title":"Driver managing the node (for example `ipmi` or `redfish`)","provider":"go.mondoo.com/mql/providers/openstack"},"fault":{"name":"fault","type":"\u0007","is_mandatory":true,"title":"Fault detected on the node (for example `power failure`); empty when healthy","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Node ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"instance":{"name":"instance","type":"\u001bopenstack.compute.server","title":"Nova instance deployed on this node; null when the node is not in use","provider":"go.mondoo.com/mql/providers/openstack"},"instanceUuid":{"name":"instanceUuid","type":"\u0007","is_mandatory":true,"title":"UUID of the Nova instance deployed on this node; empty when the node is not in use","provider":"go.mondoo.com/mql/providers/openstack"},"lastError":{"name":"lastError","type":"\u0007","is_mandatory":true,"title":"Last error recorded for the node; empty when none","provider":"go.mondoo.com/mql/providers/openstack"},"lessee":{"name":"lessee","type":"\u001bopenstack.project","title":"Project the node is leased to; null when not leased","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"maintenance":{"name":"maintenance","type":"\u0004","is_mandatory":true,"title":"Whether the node is in maintenance mode (excluded from scheduling)","provider":"go.mondoo.com/mql/providers/openstack"},"maintenanceReason":{"name":"maintenanceReason","type":"\u0007","is_mandatory":true,"title":"Reason the node was put into maintenance; empty when not in maintenance","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Node name; empty when the node has no name","provider":"go.mondoo.com/mql/providers/openstack"},"networkInterface":{"name":"networkInterface","type":"\u0007","is_mandatory":true,"title":"Network interface driver (for example `flat` or `neutron`)","provider":"go.mondoo.com/mql/providers/openstack"},"owner":{"name":"owner","type":"\u001bopenstack.project","title":"Project that owns the node; null when the node has no owner","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"ports":{"name":"ports","type":"\u0019\u001bopenstack.baremetal.port","title":"Network ports attached to the node","provider":"go.mondoo.com/mql/providers/openstack"},"powerState":{"name":"powerState","type":"\u0007","is_mandatory":true,"title":"Current power state (for example `power on`, `power off`, or null when unknown)","provider":"go.mondoo.com/mql/providers/openstack"},"protected":{"name":"protected","type":"\u0004","is_mandatory":true,"title":"Whether the node is protected from undeploy/deletion","provider":"go.mondoo.com/mql/providers/openstack"},"protectedReason":{"name":"protectedReason","type":"\u0007","is_mandatory":true,"title":"Reason the node is protected; empty when not protected","provider":"go.mondoo.com/mql/providers/openstack"},"provisionState":{"name":"provisionState","type":"\u0007","is_mandatory":true,"title":"Current provisioning state (for example `active`, `available`, `manageable`, or `enroll`)","provider":"go.mondoo.com/mql/providers/openstack"},"resourceClass":{"name":"resourceClass","type":"\u0007","is_mandatory":true,"title":"Scheduling resource class advertised to Nova","provider":"go.mondoo.com/mql/providers/openstack"},"targetPowerState":{"name":"targetPowerState","type":"\u0007","is_mandatory":true,"title":"Requested power state during a transition; empty when stable","provider":"go.mondoo.com/mql/providers/openstack"},"targetProvisionState":{"name":"targetProvisionState","type":"\u0007","is_mandatory":true,"title":"Requested provisioning state during a transition; empty when stable","provider":"go.mondoo.com/mql/providers/openstack"},"traits":{"name":"traits","type":"\u0019\u0007","is_mandatory":true,"title":"Traits advertised by the node for scheduling","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Ironic bare-metal node","desc":"Physical machine managed by Ironic, the OpenStack bare-metal provisioning service. Select a node by its `id` (UUID). The `provisionState`, `maintenance`, `powerState`, and `fault` fields report whether the node is in service or has a hardware problem, `instance` links to the Nova instance (if any) that the node backs, and `owner` and `lessee` capture multi-tenant ownership.","private":true,"min_provider_version":"13.1.4","defaults":"id name provisionState powerState maintenance","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.baremetal.port":{"id":"openstack.baremetal.port","name":"openstack.baremetal.port","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"MAC address of the port","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Port ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"isSmartNic":{"name":"isSmartNic","type":"\u0004","is_mandatory":true,"title":"Whether the port is on a smart NIC","provider":"go.mondoo.com/mql/providers/openstack"},"localLinkConnection":{"name":"localLinkConnection","type":"\n","is_mandatory":true,"title":"Local link connection details (switch ID/port, e.g. `{switch_id, port_id, switch_info}`)","provider":"go.mondoo.com/mql/providers/openstack"},"node":{"name":"node","type":"\u001bopenstack.baremetal.node","title":"Node this port belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"nodeUuid":{"name":"nodeUuid","type":"\u0007","is_mandatory":true,"title":"UUID of the node this port belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"physicalNetwork":{"name":"physicalNetwork","type":"\u0007","is_mandatory":true,"title":"Physical network the port is mapped to; empty when unset","provider":"go.mondoo.com/mql/providers/openstack"},"portgroupUuid":{"name":"portgroupUuid","type":"\u0007","is_mandatory":true,"title":"Port group UUID this port is a member of; empty when standalone","provider":"go.mondoo.com/mql/providers/openstack"},"pxeEnabled":{"name":"pxeEnabled","type":"\u0004","is_mandatory":true,"title":"Whether PXE is enabled on this port","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Ironic bare-metal port","desc":"Network port (NIC) on an Ironic bare-metal node, covering its MAC address, PXE setting, and physical-network binding. Select a port by its `id` (UUID). The `pxeEnabled` and `localLinkConnection` fields describe how the port boots and which switch port it connects to.","private":true,"min_provider_version":"13.1.4","defaults":"id address nodeUuid pxeEnabled","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.blockstorage":{"id":"openstack.blockstorage","fields":{"backup":{"name":"backup","type":"\u001bopenstack.blockstorage.backup","title":"OpenStack Cinder volume backup","desc":"Backup of a Cinder volume stored in object storage (for example Swift). Unlike snapshots, backups can be incremental and live independently of the source volume. Records the backup status, the source volume or snapshot, and whether other incrementals depend on it. Select a backup by id with `openstack.blockstorage.backup(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"qosSpec":{"name":"qosSpec","type":"\u001bopenstack.blockstorage.qosSpec","title":"Cinder QoS specification","desc":"Quality-of-service specification for Cinder: the IOPS and bandwidth throttling limits a deployment can attach to volume types. `consumer` records where the limits are enforced (`front-end` on the Nova host, `back-end` on the storage system, or `both`), and `specs` holds the rate-limit key/value pairs. Volume types reference a QoS spec through the volumeType `qosSpec` field. Listing QoS specs is admin-only. Select a spec by id with `openstack.blockstorage.qosSpec(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"quotaSet":{"name":"quotaSet","type":"\u001bopenstack.blockstorage.quotaSet","title":"OpenStack Cinder block-storage quota for the scoped project (configured maximums; usage values are not exposed by the default API path).","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"snapshot":{"name":"snapshot","type":"\u001bopenstack.blockstorage.snapshot","title":"OpenStack Cinder volume snapshot","desc":"Point-in-time snapshot of a Cinder volume, used for backup and clone workflows. Records the source volume, whether the snapshot counts against project quota, and its status through the creation lifecycle. Select a snapshot by id with `openstack.blockstorage.snapshot(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"volume":{"name":"volume","type":"\u001bopenstack.blockstorage.volume","title":"OpenStack Cinder block-storage volume","desc":"Cinder block-storage volume backing compute servers or held as standalone storage. Records its encryption-at-rest posture, whether it can attach to multiple servers concurrently, its attachment records, and the project and user that own it. Select a volume by id with `openstack.blockstorage.volume(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"volumeType":{"name":"volumeType","type":"\u001bopenstack.blockstorage.volumeType","title":"OpenStack Cinder volume type","desc":"Storage class that governs which backend a volume lands on and its encryption posture. When the type is encrypted, the encryption* fields report the provider class, cipher, key size, and where encryption is performed; they are empty on unencrypted types. `extraSpecs` holds the backend-specific configuration. Select a type by id with `openstack.blockstorage.volumeType(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.blockstorage.backup":{"id":"openstack.blockstorage.backup","name":"openstack.blockstorage.backup","fields":{"availabilityZone":{"name":"availabilityZone","type":"\u0007","is_mandatory":true,"title":"Availability zone of the backup; empty when the backup driver does not report one","provider":"go.mondoo.com/mql/providers/openstack"},"container":{"name":"container","type":"\u0007","is_mandatory":true,"title":"Container that stores the backup (Swift container name when Swift is the backup driver)","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Backup creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"dataTimestamp":{"name":"dataTimestamp","type":"\t","is_mandatory":true,"title":"Timestamp when the data on the source volume was first saved (matches the source's data, not the backup's creation)","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"failReason":{"name":"failReason","type":"\u0007","is_mandatory":true,"title":"Reason for the most recent backup failure; empty when no failure","provider":"go.mondoo.com/mql/providers/openstack"},"hasDependentBackups":{"name":"hasDependentBackups","type":"\u0004","is_mandatory":true,"title":"Whether other backups depend on this backup (true for full backups with dependent incrementals)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Backup ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"isIncremental":{"name":"isIncremental","type":"\u0004","is_mandatory":true,"title":"Whether this is an incremental backup","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Free-form backup metadata (requires Cinder microversion \u003e= 3.43)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Backup name","provider":"go.mondoo.com/mql/providers/openstack"},"objectCount":{"name":"objectCount","type":"\u0005","is_mandatory":true,"title":"Number of objects in the backup (Swift container objects when Swift is the backup driver)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this backup","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Owning project ID (admin-only attribute; empty for non-admin tokens)","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Size in GB","provider":"go.mondoo.com/mql/providers/openstack"},"sourceSnapshot":{"name":"sourceSnapshot","type":"\u001bopenstack.blockstorage.snapshot","title":"Snapshot this backup was taken from; null when the backup was taken directly from a volume","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (available, creating, deleting, error, error_deleting, restoring, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"volume":{"name":"volume","type":"\u001bopenstack.blockstorage.volume","title":"Volume this backup was taken from","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Cinder volume backup","desc":"Backup of a Cinder volume stored in object storage (for example Swift). Unlike snapshots, backups can be incremental and live independently of the source volume. Records the backup status, the source volume or snapshot, and whether other incrementals depend on it. Select a backup by id with `openstack.blockstorage.backup(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name status size createdAt","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.blockstorage.qosSpec":{"id":"openstack.blockstorage.qosSpec","name":"openstack.blockstorage.qosSpec","fields":{"consumer":{"name":"consumer","type":"\u0007","is_mandatory":true,"title":"Where the QoS limits are enforced (front-end, back-end, both)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"QoS spec ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"QoS spec name","provider":"go.mondoo.com/mql/providers/openstack"},"specs":{"name":"specs","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Rate-limit key/value pairs (e.g. total_iops_sec, read_bytes_sec)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"Cinder QoS specification","desc":"Quality-of-service specification for Cinder: the IOPS and bandwidth throttling limits a deployment can attach to volume types. `consumer` records where the limits are enforced (`front-end` on the Nova host, `back-end` on the storage system, or `both`), and `specs` holds the rate-limit key/value pairs. Volume types reference a QoS spec through the volumeType `qosSpec` field. Listing QoS specs is admin-only. Select a spec by id with `openstack.blockstorage.qosSpec(id: \"...\")`.","private":true,"min_provider_version":"13.5.2","defaults":"id name consumer","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.blockstorage.quotaSet":{"id":"openstack.blockstorage.quotaSet","name":"openstack.blockstorage.quotaSet","fields":{"backupGigabytes":{"name":"backupGigabytes","type":"\u0005","is_mandatory":true,"title":"Maximum total backup storage in gigabytes","provider":"go.mondoo.com/mql/providers/openstack"},"backups":{"name":"backups","type":"\u0005","is_mandatory":true,"title":"Maximum number of backups","provider":"go.mondoo.com/mql/providers/openstack"},"gigabytes":{"name":"gigabytes","type":"\u0005","is_mandatory":true,"title":"Maximum total volume storage in gigabytes","provider":"go.mondoo.com/mql/providers/openstack"},"groups":{"name":"groups","type":"\u0005","is_mandatory":true,"title":"Maximum number of volume groups (modern replacement for consistency groups); 0 when groups are unsupported on this cloud","provider":"go.mondoo.com/mql/providers/openstack"},"perVolumeGigabytes":{"name":"perVolumeGigabytes","type":"\u0005","is_mandatory":true,"title":"Maximum size of a single volume in gigabytes (-1 when unlimited)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project the quota applies to","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Project ID the quota applies to","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"snapshots":{"name":"snapshots","type":"\u0005","is_mandatory":true,"title":"Maximum number of snapshots","provider":"go.mondoo.com/mql/providers/openstack"},"volumes":{"name":"volumes","type":"\u0005","is_mandatory":true,"title":"Maximum number of volumes","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Cinder block-storage quota for the scoped project (configured maximums; usage values are not exposed by the default API path).","private":true,"min_provider_version":"13.0.1","defaults":"volumes snapshots gigabytes backups","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.blockstorage.snapshot":{"id":"openstack.blockstorage.snapshot","name":"openstack.blockstorage.snapshot","fields":{"consumesQuota":{"name":"consumesQuota","type":"\u0004","is_mandatory":true,"title":"Whether the snapshot consumes project quota","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"groupSnapshotId":{"name":"groupSnapshotId","type":"\u0007","is_mandatory":true,"title":"Group snapshot ID; empty when not part of a consistency group snapshot","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Snapshot ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"User-defined metadata","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Snapshot name","provider":"go.mondoo.com/mql/providers/openstack"},"progress":{"name":"progress","type":"\u0007","is_mandatory":true,"title":"Progress of the snapshot creation (e.g. \"100%\")","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this snapshot","provider":"go.mondoo.com/mql/providers/openstack"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Size in GB (matches the source volume's size at snapshot time)","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (available, creating, error, deleting, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"User that created this snapshot; null when the snapshot API does not return a user","provider":"go.mondoo.com/mql/providers/openstack"},"volume":{"name":"volume","type":"\u001bopenstack.blockstorage.volume","title":"Volume this snapshot was taken from","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Cinder volume snapshot","desc":"Point-in-time snapshot of a Cinder volume, used for backup and clone workflows. Records the source volume, whether the snapshot counts against project quota, and its status through the creation lifecycle. Select a snapshot by id with `openstack.blockstorage.snapshot(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name status size","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.blockstorage.volume":{"id":"openstack.blockstorage.volume","name":"openstack.blockstorage.volume","fields":{"attachments":{"name":"attachments","type":"\u0019\n","is_mandatory":true,"title":"Attachment records ([{server_id, attached_at, device, attachment_id, host_name}])","provider":"go.mondoo.com/mql/providers/openstack"},"availabilityZone":{"name":"availabilityZone","type":"\u0007","is_mandatory":true,"title":"Availability zone","provider":"go.mondoo.com/mql/providers/openstack"},"backups":{"name":"backups","type":"\u0019\u001bopenstack.blockstorage.backup","title":"Backups of this volume","provider":"go.mondoo.com/mql/providers/openstack"},"bootable":{"name":"bootable","type":"\u0004","is_mandatory":true,"title":"Whether the volume is bootable","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"encrypted":{"name":"encrypted","type":"\u0004","is_mandatory":true,"title":"Whether the volume is encrypted at rest","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Volume ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"imageMetadata":{"name":"imageMetadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Image metadata for volumes booted from a Glance image (empty for non-image volumes)","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"User-defined metadata","provider":"go.mondoo.com/mql/providers/openstack"},"multiAttach":{"name":"multiAttach","type":"\u0004","is_mandatory":true,"title":"Whether the volume can be attached to multiple servers concurrently","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Volume name","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this volume","provider":"go.mondoo.com/mql/providers/openstack"},"replicationStatus":{"name":"replicationStatus","type":"\u0007","is_mandatory":true,"title":"Replication status","provider":"go.mondoo.com/mql/providers/openstack"},"restoredFromBackup":{"name":"restoredFromBackup","type":"\u001bopenstack.blockstorage.backup","title":"Backup this volume was restored from; null when not restored from a backup","provider":"go.mondoo.com/mql/providers/openstack"},"servers":{"name":"servers","type":"\u0019\u001bopenstack.compute.server","title":"Servers this volume is attached to; empty when detached","provider":"go.mondoo.com/mql/providers/openstack"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Size in GB","provider":"go.mondoo.com/mql/providers/openstack"},"sourceSnapshot":{"name":"sourceSnapshot","type":"\u001bopenstack.blockstorage.snapshot","title":"Snapshot this volume was created from; null when not created from a snapshot","provider":"go.mondoo.com/mql/providers/openstack"},"sourceVolume":{"name":"sourceVolume","type":"\u001bopenstack.blockstorage.volume","title":"Source volume this volume was cloned from; null when not cloned","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (available, in-use, error, creating, attaching, detaching, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"User that created this volume; null when the volume API does not return a user","provider":"go.mondoo.com/mql/providers/openstack"},"volumeType":{"name":"volumeType","type":"\u001bopenstack.blockstorage.volumeType","title":"Volume type (storage class) for this volume; null when the API does not report one","provider":"go.mondoo.com/mql/providers/openstack"},"volumeTypeName":{"name":"volumeTypeName","type":"\u0007","is_mandatory":true,"title":"Volume type name (storage class name as reported by the API)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Cinder block-storage volume","desc":"Cinder block-storage volume backing compute servers or held as standalone storage. Records its encryption-at-rest posture, whether it can attach to multiple servers concurrently, its attachment records, and the project and user that own it. Select a volume by id with `openstack.blockstorage.volume(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name status size","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.blockstorage.volumeType":{"id":"openstack.blockstorage.volumeType","name":"openstack.blockstorage.volumeType","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"encryptionCipher":{"name":"encryptionCipher","type":"\u0007","title":"Encryption cipher (e.g. \"aes-xts-plain64\"); empty when the type is unencrypted","provider":"go.mondoo.com/mql/providers/openstack"},"encryptionControlLocation":{"name":"encryptionControlLocation","type":"\u0007","title":"Where encryption is performed (\"front-end\" on the Nova compute host, or \"back-end\" on the storage system); empty when the type is unencrypted","provider":"go.mondoo.com/mql/providers/openstack"},"encryptionId":{"name":"encryptionId","type":"\u0007","title":"Encryption configuration ID (UUID); empty when the type is unencrypted","provider":"go.mondoo.com/mql/providers/openstack"},"encryptionKeySize":{"name":"encryptionKeySize","type":"\u0005","title":"Encryption key size in bits; 0 when the type is unencrypted","provider":"go.mondoo.com/mql/providers/openstack"},"encryptionProvider":{"name":"encryptionProvider","type":"\u0007","title":"Encryption provider class name (e.g. \"luks\", \"nova.volume.encryptors.luks.LuksEncryptor\"); empty when the type is unencrypted","provider":"go.mondoo.com/mql/providers/openstack"},"extraSpecs":{"name":"extraSpecs","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Backend-specific configuration (e.g. volume_backend_name, RESKEY:availability_zones, encryption keys)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Volume type ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"isPublic":{"name":"isPublic","type":"\u0004","is_mandatory":true,"title":"Whether the volume type is publicly available to all projects","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Volume type name","provider":"go.mondoo.com/mql/providers/openstack"},"qosSpec":{"name":"qosSpec","type":"\u001bopenstack.blockstorage.qosSpec","title":"QoS specification (IOPS/bandwidth throttling) associated with this volume type; null when none","min_provider_version":"13.5.2","provider":"go.mondoo.com/mql/providers/openstack"},"volumes":{"name":"volumes","type":"\u0019\u001bopenstack.blockstorage.volume","title":"Volumes that use this volume type (filtered from the scoped project's volumes)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Cinder volume type","desc":"Storage class that governs which backend a volume lands on and its encryption posture. When the type is encrypted, the encryption* fields report the provider class, cipher, key size, and where encryption is performed; they are empty on unencrypted types. `extraSpecs` holds the backend-specific configuration. Select a type by id with `openstack.blockstorage.volumeType(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name isPublic encryptionProvider","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute":{"id":"openstack.compute","fields":{"aggregate":{"name":"aggregate","type":"\u001bopenstack.compute.aggregate","title":"OpenStack Nova host aggregate","desc":"Admin-defined grouping of compute hosts, commonly used as a building block for availability zones or to expose pinned scheduling capabilities.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"flavor":{"name":"flavor","type":"\u001bopenstack.compute.flavor","title":"OpenStack Nova flavor (VM size)","desc":"Nova flavor defining the CPU, memory, and disk a server is allocated at boot. vcpus, ram, disk, swap, and ephemeral set the sizing, while extraSpecs carries scheduler hints and hardware policies (CPU pinning, NUMA placement, hardware acceleration) and isPublic controls whether every project can boot it. Select a flavor by its id with `openstack.compute.flavor(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"hypervisor":{"name":"hypervisor","type":"\u001bopenstack.compute.hypervisor","title":"OpenStack Nova hypervisor (compute host)","desc":"Compute host as reported by Nova, exposing its capacity and current load: total and used vcpus, memoryMb, and localGb, runningVms, currentWorkload, and cpuInfo. state and status show whether the host is reachable and administratively enabled. Reading it requires an admin token. Select a hypervisor by its id with `openstack.compute.hypervisor(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"keypair":{"name":"keypair","type":"\u001bopenstack.compute.keypair","title":"OpenStack Nova SSH keypair","desc":"SSH keypair registered with Nova and injectable into a server at boot. fingerprint and publicKey identify the key material and type distinguishes an ssh key from an x509 certificate. Keypairs are scoped per user, so a stale or widely shared key is worth auditing as a persistent access path into instances that booted with it.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"limits":{"name":"limits","type":"\u001bopenstack.compute.limits","title":"OpenStack Nova compute limits and usage for the scoped project","desc":"Reports both the configured maximum (`max*`) and the current usage (`*Used`) for each tracked resource. Limits without a usage counter are admin-set caps only.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"quotaSet":{"name":"quotaSet","type":"\u001bopenstack.compute.quotaSet","title":"OpenStack Nova compute quota for the scoped project","desc":"Configured per-project ceilings Nova enforces on compute consumption: instances, cores, ram, keyPairs, serverGroups, and the legacy nova-network limits. Comparing these caps against actual usage (see openstack.compute.limits) surfaces projects near capacity or with overly permissive quotas.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"server":{"name":"server","type":"\u001bopenstack.compute.server","title":"OpenStack Nova compute server (instance)","desc":"Nova virtual machine instance, the primary compute workload in an OpenStack cloud. Query lifecycle and power state through status, vmState, powerState, and taskState; the image and flavor it booted from; and attached securityGroups, ports, floatingIps, and volumes. Boot-time inputs such as keyName, metadata, and userData reveal how the instance was provisioned, and userData is a common place to audit for hardcoded credentials. Use exposure to check public reachability. Select a server by its id with `openstack.compute.server(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"serverGroup":{"name":"serverGroup","type":"\u001bopenstack.compute.serverGroup","title":"OpenStack Nova server group (affinity / anti-affinity)","desc":"Nova server group that constrains how its member instances are placed across compute hosts. policies records the scheduling rule (affinity, anti-affinity, soft-affinity, soft-anti-affinity) and members lists the instances bound by it, which matters for availability and blast-radius analysis. Select a server group by its id with `openstack.compute.serverGroup(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"service":{"name":"service","type":"\u001bopenstack.compute.service","title":"OpenStack Nova compute service","desc":"Nova control-plane or compute daemon (nova-compute, nova-scheduler, nova-conductor, and similar) and its health. state reports whether the daemon is up or down, status reports whether it is administratively enabled or disabled, and disabledReason records why a service was taken out of rotation. Reading it requires an admin token. Select a service by its id with `openstack.compute.service(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.compute.aggregate":{"id":"openstack.compute.aggregate","name":"openstack.compute.aggregate","fields":{"availabilityZone":{"name":"availabilityZone","type":"\u0007","is_mandatory":true,"title":"Availability zone this aggregate defines; empty when the aggregate is not zone-defining","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"deleted":{"name":"deleted","type":"\u0004","is_mandatory":true,"title":"Whether the aggregate has been soft-deleted","provider":"go.mondoo.com/mql/providers/openstack"},"hostCount":{"name":"hostCount","type":"\u0005","is_mandatory":true,"title":"Number of hosts in the aggregate (matches hosts.length)","provider":"go.mondoo.com/mql/providers/openstack"},"hosts":{"name":"hosts","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames of compute hosts in this aggregate","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Aggregate ID (Nova-assigned integer)","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Free-form aggregate metadata (e.g. `pinned=true`, `filter_tenant_id=...`)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Aggregate name","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0005","optional":true}]},"title":"OpenStack Nova host aggregate","desc":"Admin-defined grouping of compute hosts, commonly used as a building block for availability zones or to expose pinned scheduling capabilities.","private":true,"min_provider_version":"13.0.1","defaults":"id name availabilityZone hostCount","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute.flavor":{"id":"openstack.compute.flavor","name":"openstack.compute.flavor","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Flavor description (added in microversion 2.55)","provider":"go.mondoo.com/mql/providers/openstack"},"disk":{"name":"disk","type":"\u0005","is_mandatory":true,"title":"Root disk size in GB","provider":"go.mondoo.com/mql/providers/openstack"},"ephemeral":{"name":"ephemeral","type":"\u0005","is_mandatory":true,"title":"Ephemeral disk size in GB","provider":"go.mondoo.com/mql/providers/openstack"},"extraSpecs":{"name":"extraSpecs","type":"\u001a\u0007\u0007","title":"Extra specs (e.g., hw:cpu_policy, aggregate_instance_extra_specs:*)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Flavor ID (UUID for v2.55+, integer string for older clouds)","provider":"go.mondoo.com/mql/providers/openstack"},"isPublic":{"name":"isPublic","type":"\u0004","is_mandatory":true,"title":"Whether the flavor is publicly visible","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Flavor name","provider":"go.mondoo.com/mql/providers/openstack"},"ram":{"name":"ram","type":"\u0005","is_mandatory":true,"title":"RAM in MB","provider":"go.mondoo.com/mql/providers/openstack"},"rxtxFactor":{"name":"rxtxFactor","type":"\u0006","is_mandatory":true,"title":"RX/TX bandwidth factor","provider":"go.mondoo.com/mql/providers/openstack"},"swap":{"name":"swap","type":"\u0005","is_mandatory":true,"title":"Swap size in MB (0 when no swap)","provider":"go.mondoo.com/mql/providers/openstack"},"vcpus":{"name":"vcpus","type":"\u0005","is_mandatory":true,"title":"vCPU count","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Nova flavor (VM size)","desc":"Nova flavor defining the CPU, memory, and disk a server is allocated at boot. vcpus, ram, disk, swap, and ephemeral set the sizing, while extraSpecs carries scheduler hints and hardware policies (CPU pinning, NUMA placement, hardware acceleration) and isPublic controls whether every project can boot it. Select a flavor by its id with `openstack.compute.flavor(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name vcpus ram disk","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute.hypervisor":{"id":"openstack.compute.hypervisor","name":"openstack.compute.hypervisor","fields":{"cpuInfo":{"name":"cpuInfo","type":"\n","is_mandatory":true,"title":"Hypervisor CPU information","desc":"Keys: `vendor`, `arch`, `model`, `features` (list of CPU feature flags), and `topology` (with `sockets`, `cores`, and `threads`).","provider":"go.mondoo.com/mql/providers/openstack"},"currentWorkload":{"name":"currentWorkload","type":"\u0005","is_mandatory":true,"title":"Current scheduler workload metric","provider":"go.mondoo.com/mql/providers/openstack"},"freeDiskGb":{"name":"freeDiskGb","type":"\u0005","is_mandatory":true,"title":"Free local disk in gigabytes","provider":"go.mondoo.com/mql/providers/openstack"},"freeRamMb":{"name":"freeRamMb","type":"\u0005","is_mandatory":true,"title":"Free RAM in megabytes","provider":"go.mondoo.com/mql/providers/openstack"},"hostIp":{"name":"hostIp","type":"\u0007","is_mandatory":true,"title":"IP address of the hypervisor host","provider":"go.mondoo.com/mql/providers/openstack"},"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"Hypervisor hostname as reported by the compute service","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Hypervisor ID (Nova-assigned UUID or integer string)","provider":"go.mondoo.com/mql/providers/openstack"},"localGb":{"name":"localGb","type":"\u0005","is_mandatory":true,"title":"Total local disk in gigabytes","provider":"go.mondoo.com/mql/providers/openstack"},"localGbUsed":{"name":"localGbUsed","type":"\u0005","is_mandatory":true,"title":"Local disk allocated in gigabytes","provider":"go.mondoo.com/mql/providers/openstack"},"memoryMb":{"name":"memoryMb","type":"\u0005","is_mandatory":true,"title":"Total RAM in megabytes","provider":"go.mondoo.com/mql/providers/openstack"},"memoryMbUsed":{"name":"memoryMbUsed","type":"\u0005","is_mandatory":true,"title":"RAM allocated to running instances in megabytes","provider":"go.mondoo.com/mql/providers/openstack"},"runningVms":{"name":"runningVms","type":"\u0005","is_mandatory":true,"title":"Number of instances currently running on the host","provider":"go.mondoo.com/mql/providers/openstack"},"service":{"name":"service","type":"\u001bopenstack.compute.service","title":"The compute service backing this hypervisor (typically the nova-compute on the same host)","provider":"go.mondoo.com/mql/providers/openstack"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Connection state (up, down)","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Administrative status (enabled, disabled)","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Hypervisor type (e.g. QEMU, KVM, VMware, Xen, ironic)","provider":"go.mondoo.com/mql/providers/openstack"},"vcpus":{"name":"vcpus","type":"\u0005","is_mandatory":true,"title":"Total vCPUs on the host","provider":"go.mondoo.com/mql/providers/openstack"},"vcpusUsed":{"name":"vcpusUsed","type":"\u0005","is_mandatory":true,"title":"vCPUs allocated to running instances","provider":"go.mondoo.com/mql/providers/openstack"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Hypervisor driver version (Nova `hypervisor_version`)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Nova hypervisor (compute host)","desc":"Compute host as reported by Nova, exposing its capacity and current load: total and used vcpus, memoryMb, and localGb, runningVms, currentWorkload, and cpuInfo. state and status show whether the host is reachable and administratively enabled. Reading it requires an admin token. Select a hypervisor by its id with `openstack.compute.hypervisor(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id hostname type state status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute.keypair":{"id":"openstack.compute.keypair","name":"openstack.compute.keypair","fields":{"fingerprint":{"name":"fingerprint","type":"\u0007","is_mandatory":true,"title":"Public key fingerprint","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Keypair name (unique per user)","provider":"go.mondoo.com/mql/providers/openstack"},"publicKey":{"name":"publicKey","type":"\u0007","is_mandatory":true,"title":"Public key material","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type (ssh, x509)","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"User that owns this keypair","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Nova SSH keypair","desc":"SSH keypair registered with Nova and injectable into a server at boot. fingerprint and publicKey identify the key material and type distinguishes an ssh key from an x509 certificate. Keypairs are scoped per user, so a stale or widely shared key is worth auditing as a persistent access path into instances that booted with it.","private":true,"min_provider_version":"13.0.1","defaults":"name type fingerprint","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute.limits":{"id":"openstack.compute.limits","name":"openstack.compute.limits","fields":{"maxImageMeta":{"name":"maxImageMeta","type":"\u0005","is_mandatory":true,"title":"Maximum image metadata items per image","provider":"go.mondoo.com/mql/providers/openstack"},"maxPersonality":{"name":"maxPersonality","type":"\u0005","is_mandatory":true,"title":"Maximum number of personality files per instance (legacy)","provider":"go.mondoo.com/mql/providers/openstack"},"maxPersonalitySize":{"name":"maxPersonalitySize","type":"\u0005","is_mandatory":true,"title":"Maximum personality file content size in bytes (legacy)","provider":"go.mondoo.com/mql/providers/openstack"},"maxSecurityGroupRules":{"name":"maxSecurityGroupRules","type":"\u0005","is_mandatory":true,"title":"Maximum number of security group rules per security group","provider":"go.mondoo.com/mql/providers/openstack"},"maxSecurityGroups":{"name":"maxSecurityGroups","type":"\u0005","is_mandatory":true,"title":"Maximum number of security groups","provider":"go.mondoo.com/mql/providers/openstack"},"maxServerGroupMembers":{"name":"maxServerGroupMembers","type":"\u0005","is_mandatory":true,"title":"Maximum number of members per server group","provider":"go.mondoo.com/mql/providers/openstack"},"maxServerGroups":{"name":"maxServerGroups","type":"\u0005","is_mandatory":true,"title":"Maximum number of server groups","provider":"go.mondoo.com/mql/providers/openstack"},"maxServerMeta":{"name":"maxServerMeta","type":"\u0005","is_mandatory":true,"title":"Maximum server metadata items per instance","provider":"go.mondoo.com/mql/providers/openstack"},"maxTotalCores":{"name":"maxTotalCores","type":"\u0005","is_mandatory":true,"title":"Maximum number of vCPU cores","provider":"go.mondoo.com/mql/providers/openstack"},"maxTotalFloatingIps":{"name":"maxTotalFloatingIps","type":"\u0005","is_mandatory":true,"title":"Maximum number of floating IPs","provider":"go.mondoo.com/mql/providers/openstack"},"maxTotalInstances":{"name":"maxTotalInstances","type":"\u0005","is_mandatory":true,"title":"Maximum number of running instances","provider":"go.mondoo.com/mql/providers/openstack"},"maxTotalKeypairs":{"name":"maxTotalKeypairs","type":"\u0005","is_mandatory":true,"title":"Maximum number of SSH keypairs","provider":"go.mondoo.com/mql/providers/openstack"},"maxTotalRAMSize":{"name":"maxTotalRAMSize","type":"\u0005","is_mandatory":true,"title":"Maximum total RAM in megabytes","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project the limits report applies to","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Project ID the limits report applies to","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"totalCoresUsed":{"name":"totalCoresUsed","type":"\u0005","is_mandatory":true,"title":"vCPU cores currently in use","provider":"go.mondoo.com/mql/providers/openstack"},"totalFloatingIpsUsed":{"name":"totalFloatingIpsUsed","type":"\u0005","is_mandatory":true,"title":"Floating IPs currently in use","provider":"go.mondoo.com/mql/providers/openstack"},"totalInstancesUsed":{"name":"totalInstancesUsed","type":"\u0005","is_mandatory":true,"title":"Running instances currently in use","provider":"go.mondoo.com/mql/providers/openstack"},"totalRAMUsed":{"name":"totalRAMUsed","type":"\u0005","is_mandatory":true,"title":"RAM currently allocated in megabytes","provider":"go.mondoo.com/mql/providers/openstack"},"totalSecurityGroupsUsed":{"name":"totalSecurityGroupsUsed","type":"\u0005","is_mandatory":true,"title":"Security groups currently in use","provider":"go.mondoo.com/mql/providers/openstack"},"totalServerGroupsUsed":{"name":"totalServerGroupsUsed","type":"\u0005","is_mandatory":true,"title":"Server groups currently in use","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Nova compute limits and usage for the scoped project","desc":"Reports both the configured maximum (`max*`) and the current usage (`*Used`) for each tracked resource. Limits without a usage counter are admin-set caps only.","private":true,"min_provider_version":"13.0.1","defaults":"maxTotalInstances totalInstancesUsed maxTotalCores totalCoresUsed maxTotalRAMSize totalRAMUsed","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute.quotaSet":{"id":"openstack.compute.quotaSet","name":"openstack.compute.quotaSet","fields":{"cores":{"name":"cores","type":"\u0005","is_mandatory":true,"title":"Maximum number of instance cores (vCPUs)","provider":"go.mondoo.com/mql/providers/openstack"},"fixedIps":{"name":"fixedIps","type":"\u0005","is_mandatory":true,"title":"Maximum number of fixed IPs (legacy nova-network)","provider":"go.mondoo.com/mql/providers/openstack"},"floatingIps":{"name":"floatingIps","type":"\u0005","is_mandatory":true,"title":"Maximum number of floating IPs (legacy nova-network)","provider":"go.mondoo.com/mql/providers/openstack"},"injectedFileContentBytes":{"name":"injectedFileContentBytes","type":"\u0005","is_mandatory":true,"title":"Maximum bytes per injected file","provider":"go.mondoo.com/mql/providers/openstack"},"injectedFilePathBytes":{"name":"injectedFilePathBytes","type":"\u0005","is_mandatory":true,"title":"Maximum bytes for each injected file path","provider":"go.mondoo.com/mql/providers/openstack"},"injectedFiles":{"name":"injectedFiles","type":"\u0005","is_mandatory":true,"title":"Maximum number of injected files","provider":"go.mondoo.com/mql/providers/openstack"},"instances":{"name":"instances","type":"\u0005","is_mandatory":true,"title":"Maximum number of instances","provider":"go.mondoo.com/mql/providers/openstack"},"keyPairs":{"name":"keyPairs","type":"\u0005","is_mandatory":true,"title":"Maximum number of SSH keypairs","provider":"go.mondoo.com/mql/providers/openstack"},"metadataItems":{"name":"metadataItems","type":"\u0005","is_mandatory":true,"title":"Maximum number of metadata items per instance","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project the quota applies to","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Project ID the quota applies to","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"ram":{"name":"ram","type":"\u0005","is_mandatory":true,"title":"Maximum instance RAM in megabytes","provider":"go.mondoo.com/mql/providers/openstack"},"securityGroupRules":{"name":"securityGroupRules","type":"\u0005","is_mandatory":true,"title":"Maximum number of security group rules (legacy nova-network)","provider":"go.mondoo.com/mql/providers/openstack"},"securityGroups":{"name":"securityGroups","type":"\u0005","is_mandatory":true,"title":"Maximum number of security groups (legacy nova-network)","provider":"go.mondoo.com/mql/providers/openstack"},"serverGroupMembers":{"name":"serverGroupMembers","type":"\u0005","is_mandatory":true,"title":"Maximum number of members per server group","provider":"go.mondoo.com/mql/providers/openstack"},"serverGroups":{"name":"serverGroups","type":"\u0005","is_mandatory":true,"title":"Maximum number of server groups","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Nova compute quota for the scoped project","desc":"Configured per-project ceilings Nova enforces on compute consumption: instances, cores, ram, keyPairs, serverGroups, and the legacy nova-network limits. Comparing these caps against actual usage (see openstack.compute.limits) surfaces projects near capacity or with overly permissive quotas.","private":true,"min_provider_version":"13.5.2","defaults":"instances cores ram","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute.server":{"id":"openstack.compute.server","name":"openstack.compute.server","fields":{"accessIPv4":{"name":"accessIPv4","type":"\u0007","is_mandatory":true,"title":"Public IPv4 address (Nova `accessIPv4`)","provider":"go.mondoo.com/mql/providers/openstack"},"accessIPv6":{"name":"accessIPv6","type":"\u0007","is_mandatory":true,"title":"Public IPv6 address (Nova `accessIPv6`)","provider":"go.mondoo.com/mql/providers/openstack"},"addresses":{"name":"addresses","type":"\n","is_mandatory":true,"title":"Per-network address allocations","desc":"Keyed by network name; each value is a list of address entries with `addr`, `version` (4 or 6), `OS-EXT-IPS:type` (fixed or floating), and `OS-EXT-IPS-MAC:mac_addr`.","provider":"go.mondoo.com/mql/providers/openstack"},"availabilityZone":{"name":"availabilityZone","type":"\u0007","is_mandatory":true,"title":"Availability zone","provider":"go.mondoo.com/mql/providers/openstack"},"configDrive":{"name":"configDrive","type":"\u0004","is_mandatory":true,"title":"Whether the server was booted with a config drive carrying instance metadata and cloud-init data (Nova `config_drive`)","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"diskConfig":{"name":"diskConfig","type":"\u0007","is_mandatory":true,"title":"Disk config (AUTO or MANUAL)","provider":"go.mondoo.com/mql/providers/openstack"},"exposure":{"name":"exposure","type":"\u001bopenstack.compute.server.exposure","title":"Internet-exposure summary for this server (public reachability plus the security-group rules that open it up)","provider":"go.mondoo.com/mql/providers/openstack"},"flavor":{"name":"flavor","type":"\u001bopenstack.compute.flavor","title":"Flavor (VM size) the server was booted with","provider":"go.mondoo.com/mql/providers/openstack"},"floatingIps":{"name":"floatingIps","type":"\u0019\u001bopenstack.floatingIp","title":"Floating (public) IPs mapped to this server through its ports; empty when the server has none","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Hypervisor host the server runs on (Nova `OS-EXT-SRV-ATTR:host`); admin-only, empty for non-admin tokens","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"hostId":{"name":"hostId","type":"\u0007","is_mandatory":true,"title":"Hypervisor host ID (opaque hash)","provider":"go.mondoo.com/mql/providers/openstack"},"hypervisorHostname":{"name":"hypervisorHostname","type":"\u0007","is_mandatory":true,"title":"Hypervisor hostname the server runs on (Nova `OS-EXT-SRV-ATTR:hypervisor_hostname`); admin-only, empty for non-admin tokens","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Server ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"image":{"name":"image","type":"\u001bopenstack.image","title":"Image the server was booted from; null when booted from a volume","provider":"go.mondoo.com/mql/providers/openstack"},"instanceName":{"name":"instanceName","type":"\u0007","is_mandatory":true,"title":"Hypervisor-level instance name (Nova `OS-EXT-SRV-ATTR:instance_name`, e.g. \"instance-0000004f\"); admin-only, empty for non-admin tokens","min_provider_version":"13.5.2","provider":"go.mondoo.com/mql/providers/openstack"},"keyName":{"name":"keyName","type":"\u0007","is_mandatory":true,"title":"SSH keypair name used at boot","provider":"go.mondoo.com/mql/providers/openstack"},"keypair":{"name":"keypair","type":"\u001bopenstack.compute.keypair","title":"SSH keypair injected at boot; null when no key was used","provider":"go.mondoo.com/mql/providers/openstack"},"launchedAt":{"name":"launchedAt","type":"\t","is_mandatory":true,"title":"Launch timestamp (Nova `OS-SRV-USG:launched_at`)","provider":"go.mondoo.com/mql/providers/openstack"},"locked":{"name":"locked","type":"\u0004","is_mandatory":true,"title":"Whether the server is locked","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Free-form server metadata","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server name","provider":"go.mondoo.com/mql/providers/openstack"},"ports":{"name":"ports","type":"\u0019\u001bopenstack.port","title":"Neutron ports attached to this server","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"powerState":{"name":"powerState","type":"\u0005","is_mandatory":true,"title":"Power state (Nova `OS-EXT-STS:power_state`)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this server","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"securityGroups":{"name":"securityGroups","type":"\u0019\u001bopenstack.securityGroup","title":"Security groups attached at boot","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (ACTIVE, SHUTOFF, ERROR, BUILD, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"taskState":{"name":"taskState","type":"\u0007","is_mandatory":true,"title":"Task state (Nova `OS-EXT-STS:task_state`)","provider":"go.mondoo.com/mql/providers/openstack"},"terminatedAt":{"name":"terminatedAt","type":"\t","is_mandatory":true,"title":"Termination timestamp (Nova `OS-SRV-USG:terminated_at`; null while running)","provider":"go.mondoo.com/mql/providers/openstack"},"updated":{"name":"updated","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"User that created this server","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"userData":{"name":"userData","type":"\u0007","is_mandatory":true,"title":"Cloud-init user data the server was booted with (Nova `OS-EXT-SRV-ATTR:user_data`)","desc":"Admin-only and empty for non-admin tokens. The raw value may embed bootstrap secrets, so auditing it for hardcoded credentials is a common use.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"vmState":{"name":"vmState","type":"\u0007","is_mandatory":true,"title":"VM state (Nova `OS-EXT-STS:vm_state`)","provider":"go.mondoo.com/mql/providers/openstack"},"volumes":{"name":"volumes","type":"\u0019\u001bopenstack.blockstorage.volume","title":"Cinder volumes attached to this server","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Nova compute server (instance)","desc":"Nova virtual machine instance, the primary compute workload in an OpenStack cloud. Query lifecycle and power state through status, vmState, powerState, and taskState; the image and flavor it booted from; and attached securityGroups, ports, floatingIps, and volumes. Boot-time inputs such as keyName, metadata, and userData reveal how the instance was provisioned, and userData is a common place to audit for hardcoded credentials. Use exposure to check public reachability. Select a server by its id with `openstack.compute.server(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute.server.exposure":{"id":"openstack.compute.server.exposure","name":"openstack.compute.server.exposure","fields":{"floatingIps":{"name":"floatingIps","type":"\u0019\u001bopenstack.floatingIp","is_mandatory":true,"title":"Floating (public) IPs mapped to the server","provider":"go.mondoo.com/mql/providers/openstack"},"internetReachable":{"name":"internetReachable","type":"\u0004","is_mandatory":true,"title":"Whether the server is reachable from the internet (publicly accessible and a security group permits ingress from a public source)","provider":"go.mondoo.com/mql/providers/openstack"},"openIngressRules":{"name":"openIngressRules","type":"\u0019\u001bopenstack.securityGroup.rule","is_mandatory":true,"title":"Security-group ingress rules that open the server to the internet, including their port ranges","provider":"go.mondoo.com/mql/providers/openstack"},"publiclyAccessible":{"name":"publiclyAccessible","type":"\u0004","is_mandatory":true,"title":"Whether the server has a public edge: a floating IP, or a port on an external network","provider":"go.mondoo.com/mql/providers/openstack"},"securityGroupAllowsIngress":{"name":"securityGroupAllowsIngress","type":"\u0004","is_mandatory":true,"title":"Whether a security group attached to the server permits ingress from a public source","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Nova compute server internet exposure","desc":"Summarizes whether a server is reachable from the public internet and, when it is, the security-group rules that open it up. A server is publicly accessible when it has a floating IP or a port on an external network; internetReachable additionally requires a security-group rule permitting ingress from a public source. Inspect openIngressRules for the rules and their port ranges.","private":true,"min_provider_version":"13.4.2","defaults":"internetReachable publiclyAccessible securityGroupAllowsIngress","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute.serverGroup":{"id":"openstack.compute.serverGroup","name":"openstack.compute.serverGroup","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Server group ID","provider":"go.mondoo.com/mql/providers/openstack"},"memberServers":{"name":"memberServers","type":"\u0019\u001bopenstack.compute.server","title":"Servers in this group","provider":"go.mondoo.com/mql/providers/openstack"},"members":{"name":"members","type":"\u0019\u0007","is_mandatory":true,"title":"Member server IDs","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"User-defined metadata","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Server group name","provider":"go.mondoo.com/mql/providers/openstack"},"policies":{"name":"policies","type":"\u0019\u0007","is_mandatory":true,"title":"Scheduling policies (e.g., affinity, anti-affinity, soft-affinity, soft-anti-affinity)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this server group","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"User that created this server group","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Nova server group (affinity / anti-affinity)","desc":"Nova server group that constrains how its member instances are placed across compute hosts. policies records the scheduling rule (affinity, anti-affinity, soft-affinity, soft-anti-affinity) and members lists the instances bound by it, which matters for availability and blast-radius analysis. Select a server group by its id with `openstack.compute.serverGroup(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name policies","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.compute.service":{"id":"openstack.compute.service","name":"openstack.compute.service","fields":{"binary":{"name":"binary","type":"\u0007","is_mandatory":true,"title":"Service binary name (nova-compute, nova-scheduler, nova-conductor, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"disabledReason":{"name":"disabledReason","type":"\u0007","is_mandatory":true,"title":"Reason given when the service was administratively disabled; empty when enabled","provider":"go.mondoo.com/mql/providers/openstack"},"forcedDown":{"name":"forcedDown","type":"\u0004","is_mandatory":true,"title":"Whether the service is forced down (Nova `forced_down`)","provider":"go.mondoo.com/mql/providers/openstack"},"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Host the service runs on","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Service ID (Nova-assigned UUID or integer string)","provider":"go.mondoo.com/mql/providers/openstack"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Connection state (up, down)","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Administrative status (enabled, disabled)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp reported by the service","provider":"go.mondoo.com/mql/providers/openstack"},"zone":{"name":"zone","type":"\u0007","is_mandatory":true,"title":"Availability zone","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Nova compute service","desc":"Nova control-plane or compute daemon (nova-compute, nova-scheduler, nova-conductor, and similar) and its health. state reports whether the daemon is up or down, status reports whether it is administratively enabled or disabled, and disabledReason records why a service was taken out of rotation. Reading it requires an admin token. Select a service by its id with `openstack.compute.service(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id binary host zone status state","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.containerinfra":{"id":"openstack.containerinfra","fields":{"cluster":{"name":"cluster","type":"\u001bopenstack.containerinfra.cluster","title":"OpenStack Magnum cluster","desc":"Container-orchestration cluster (typically Kubernetes) provisioned by Magnum from a cluster template. Select a cluster by its `id`, for example `openstack.containerinfra.cluster(id: \"...\")`. The `apiAddress` and `floatingIpEnabled` fields reveal whether the control plane is reachable externally, and `clusterTemplate` carries the security posture it was built from (TLS, registry, network).","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"clusterTemplate":{"name":"clusterTemplate","type":"\u001bopenstack.containerinfra.clusterTemplate","title":"OpenStack Magnum cluster template","desc":"Reusable blueprint that defines how Magnum builds clusters (orchestration engine, image, network, TLS, and registry settings). Select a template by its `id`, for example `openstack.containerinfra.clusterTemplate(id: \"...\")`. The `tlsDisabled`, `public`, and `floatingIpEnabled` fields are the key security toggles to audit.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.containerinfra.cluster":{"id":"openstack.containerinfra.cluster","name":"openstack.containerinfra.cluster","fields":{"apiAddress":{"name":"apiAddress","type":"\u0007","is_mandatory":true,"title":"API endpoint address of the cluster control plane","provider":"go.mondoo.com/mql/providers/openstack"},"clusterTemplate":{"name":"clusterTemplate","type":"\u001bopenstack.containerinfra.clusterTemplate","title":"Template the cluster was created from","provider":"go.mondoo.com/mql/providers/openstack"},"coeVersion":{"name":"coeVersion","type":"\u0007","is_mandatory":true,"title":"Container-orchestration engine version (for example the Kubernetes version)","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"discoveryUrl":{"name":"discoveryUrl","type":"\u0007","is_mandatory":true,"title":"etcd discovery URL used during cluster bootstrap","provider":"go.mondoo.com/mql/providers/openstack"},"dockerVolumeSize":{"name":"dockerVolumeSize","type":"\u0005","is_mandatory":true,"title":"Per-node Docker volume size in gibibytes","provider":"go.mondoo.com/mql/providers/openstack"},"fixedNetwork":{"name":"fixedNetwork","type":"\u001bopenstack.network","title":"Fixed (private) network the cluster runs on; null when unset or when the API returned a name that does not resolve to a known network","provider":"go.mondoo.com/mql/providers/openstack"},"fixedSubnet":{"name":"fixedSubnet","type":"\u001bopenstack.subnet","title":"Fixed (private) subnet the cluster runs on; null when unset or when the API returned a name that does not resolve to a known subnet","provider":"go.mondoo.com/mql/providers/openstack"},"flavor":{"name":"flavor","type":"\u001bopenstack.compute.flavor","title":"Flavor used for the worker nodes","provider":"go.mondoo.com/mql/providers/openstack"},"floatingIpEnabled":{"name":"floatingIpEnabled","type":"\u0004","is_mandatory":true,"title":"Whether nodes are assigned floating (public) IPs","provider":"go.mondoo.com/mql/providers/openstack"},"healthStatus":{"name":"healthStatus","type":"\u0007","is_mandatory":true,"title":"Health status (for example `HEALTHY` or `UNHEALTHY`)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cluster ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"keypair":{"name":"keypair","type":"\u001bopenstack.compute.keypair","title":"SSH key pair injected into the nodes","provider":"go.mondoo.com/mql/providers/openstack"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Labels (key/value tuning and feature flags) applied to the cluster","provider":"go.mondoo.com/mql/providers/openstack"},"masterAddresses":{"name":"masterAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses of the master nodes","provider":"go.mondoo.com/mql/providers/openstack"},"masterCount":{"name":"masterCount","type":"\u0005","is_mandatory":true,"title":"Number of master (control-plane) nodes","provider":"go.mondoo.com/mql/providers/openstack"},"masterFlavor":{"name":"masterFlavor","type":"\u001bopenstack.compute.flavor","title":"Flavor used for the master nodes","provider":"go.mondoo.com/mql/providers/openstack"},"masterLbEnabled":{"name":"masterLbEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the master nodes sit behind a load balancer","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cluster name","provider":"go.mondoo.com/mql/providers/openstack"},"nodeAddresses":{"name":"nodeAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses of the worker nodes","provider":"go.mondoo.com/mql/providers/openstack"},"nodeCount":{"name":"nodeCount","type":"\u0005","is_mandatory":true,"title":"Number of worker nodes","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns the cluster","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Owning project ID","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"stack":{"name":"stack","type":"\u001bopenstack.orchestration.stack","title":"Heat stack backing the cluster; null when the API did not report a stack","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Lifecycle status (for example `CREATE_COMPLETE` or `CREATE_FAILED`)","provider":"go.mondoo.com/mql/providers/openstack"},"statusReason":{"name":"statusReason","type":"\u0007","is_mandatory":true,"title":"Human-readable reason for the current status","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"User that created the cluster","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Magnum cluster","desc":"Container-orchestration cluster (typically Kubernetes) provisioned by Magnum from a cluster template. Select a cluster by its `id`, for example `openstack.containerinfra.cluster(id: \"...\")`. The `apiAddress` and `floatingIpEnabled` fields reveal whether the control plane is reachable externally, and `clusterTemplate` carries the security posture it was built from (TLS, registry, network).","private":true,"min_provider_version":"13.1.4","defaults":"id name status nodeCount masterCount","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.containerinfra.clusterTemplate":{"id":"openstack.containerinfra.clusterTemplate","name":"openstack.containerinfra.clusterTemplate","fields":{"apiServerPort":{"name":"apiServerPort","type":"\u0005","is_mandatory":true,"title":"API server port","provider":"go.mondoo.com/mql/providers/openstack"},"clusterDistro":{"name":"clusterDistro","type":"\u0007","is_mandatory":true,"title":"Base OS distribution for cluster nodes (for example `fedora-coreos`)","provider":"go.mondoo.com/mql/providers/openstack"},"coe":{"name":"coe","type":"\u0007","is_mandatory":true,"title":"Container-orchestration engine","desc":"One of `kubernetes`, `swarm`, `swarm-mode`, or `mesos`.","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"dnsNameserver":{"name":"dnsNameserver","type":"\u0007","is_mandatory":true,"title":"DNS nameserver configured for cluster nodes","provider":"go.mondoo.com/mql/providers/openstack"},"dockerStorageDriver":{"name":"dockerStorageDriver","type":"\u0007","is_mandatory":true,"title":"Docker storage driver (for example `overlay2`)","provider":"go.mondoo.com/mql/providers/openstack"},"dockerVolumeSize":{"name":"dockerVolumeSize","type":"\u0005","is_mandatory":true,"title":"Per-node Docker volume size in gibibytes","provider":"go.mondoo.com/mql/providers/openstack"},"externalNetwork":{"name":"externalNetwork","type":"\u001bopenstack.network","title":"External (public) network clusters attach to","provider":"go.mondoo.com/mql/providers/openstack"},"flavor":{"name":"flavor","type":"\u001bopenstack.compute.flavor","title":"Flavor used for worker nodes","provider":"go.mondoo.com/mql/providers/openstack"},"floatingIpEnabled":{"name":"floatingIpEnabled","type":"\u0004","is_mandatory":true,"title":"Whether nodes are assigned floating (public) IPs","provider":"go.mondoo.com/mql/providers/openstack"},"hidden":{"name":"hidden","type":"\u0004","is_mandatory":true,"title":"Whether the template is hidden from the default template list","provider":"go.mondoo.com/mql/providers/openstack"},"httpProxy":{"name":"httpProxy","type":"\u0007","is_mandatory":true,"title":"HTTP proxy configured for cluster nodes; empty when unset","provider":"go.mondoo.com/mql/providers/openstack"},"httpsProxy":{"name":"httpsProxy","type":"\u0007","is_mandatory":true,"title":"HTTPS proxy configured for cluster nodes; empty when unset","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cluster template ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"image":{"name":"image","type":"\u001bopenstack.image","title":"Glance image used for cluster nodes","provider":"go.mondoo.com/mql/providers/openstack"},"insecureRegistry":{"name":"insecureRegistry","type":"\u0007","is_mandatory":true,"title":"Insecure (non-TLS) registry the cluster is allowed to pull from; empty when unset","provider":"go.mondoo.com/mql/providers/openstack"},"keypair":{"name":"keypair","type":"\u001bopenstack.compute.keypair","title":"SSH key pair injected into cluster nodes","provider":"go.mondoo.com/mql/providers/openstack"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Labels (key/value tuning and feature flags) applied to clusters","provider":"go.mondoo.com/mql/providers/openstack"},"masterFlavor":{"name":"masterFlavor","type":"\u001bopenstack.compute.flavor","title":"Flavor used for master nodes","provider":"go.mondoo.com/mql/providers/openstack"},"masterLbEnabled":{"name":"masterLbEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the master nodes sit behind a load balancer","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Template name","provider":"go.mondoo.com/mql/providers/openstack"},"networkDriver":{"name":"networkDriver","type":"\u0007","is_mandatory":true,"title":"Container network driver (for example `flannel` or `calico`)","provider":"go.mondoo.com/mql/providers/openstack"},"noProxy":{"name":"noProxy","type":"\u0007","is_mandatory":true,"title":"Hosts excluded from proxying; empty when unset","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns the template","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"public":{"name":"public","type":"\u0004","is_mandatory":true,"title":"Whether the template is visible to all projects","provider":"go.mondoo.com/mql/providers/openstack"},"registryEnabled":{"name":"registryEnabled","type":"\u0004","is_mandatory":true,"title":"Whether a private container registry is enabled in the cluster","provider":"go.mondoo.com/mql/providers/openstack"},"serverType":{"name":"serverType","type":"\u0007","is_mandatory":true,"title":"Node server type (`vm` or `bm` for bare metal)","provider":"go.mondoo.com/mql/providers/openstack"},"tlsDisabled":{"name":"tlsDisabled","type":"\u0004","is_mandatory":true,"title":"Whether TLS is disabled for the cluster API","desc":"True disables TLS on the control-plane API — clusters built from this template expose an unauthenticated/unencrypted endpoint and should be flagged.","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"User that created the template","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"volumeDriver":{"name":"volumeDriver","type":"\u0007","is_mandatory":true,"title":"Container volume driver (for example `cinder`)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Magnum cluster template","desc":"Reusable blueprint that defines how Magnum builds clusters (orchestration engine, image, network, TLS, and registry settings). Select a template by its `id`, for example `openstack.containerinfra.clusterTemplate(id: \"...\")`. The `tlsDisabled`, `public`, and `floatingIpEnabled` fields are the key security toggles to audit.","private":true,"min_provider_version":"13.1.4","defaults":"id name coe tlsDisabled public","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.credential":{"id":"openstack.credential","name":"openstack.credential","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Credential ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project the credential is scoped to","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Credential type","desc":"Common values are `ec2` (an access/secret key pair) and `cert` (an X.509 certificate).","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"Owning user","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone credential","desc":"Stored authentication credential owned by a user and scoped to a project, most commonly an EC2-style access/secret key pair (`type` ec2) or an X.509 certificate (`type` cert). Select a credential by its `id`. The secret material (the credential blob) is intentionally not exposed; query `type`, `user`, and `project` to audit who holds long-lived credentials.","private":true,"min_provider_version":"13.1.4","defaults":"id type","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.db":{"id":"openstack.db","fields":{"instance":{"name":"instance","type":"\u001bopenstack.db.instance","title":"OpenStack Trove database instance","desc":"Managed database instance provisioned by the Trove database service. Select an instance by its `id`, for example `openstack.db.instance(id: \"...\")`. The `addresses` and `hostname` fields show how the database is reachable, and `datastoreType`/`datastoreVersion` identify the engine and version so you can flag outdated database software. The `databases` and `users` fields enumerate the logical databases and accounts on the instance; user passwords are intentionally not exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.db.instance":{"id":"openstack.db.instance","name":"openstack.db.instance","fields":{"addresses":{"name":"addresses","type":"\u0019\n","is_mandatory":true,"title":"Network addresses assigned to the instance ([{type, address}]); `type` is for example `public` or `private`","provider":"go.mondoo.com/mql/providers/openstack"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Creation timestamp","min_provider_version":"13.6.1","provider":"go.mondoo.com/mql/providers/openstack"},"databases":{"name":"databases","type":"\u0019\n","title":"Logical databases hosted on the instance ([{name, charset, collate}])","provider":"go.mondoo.com/mql/providers/openstack"},"datastoreType":{"name":"datastoreType","type":"\u0007","is_mandatory":true,"title":"Datastore type (the database engine, for example `mysql`, `postgresql`, or `mariadb`)","provider":"go.mondoo.com/mql/providers/openstack"},"datastoreVersion":{"name":"datastoreVersion","type":"\u0007","is_mandatory":true,"title":"Datastore version (the engine version, for example `5.7`)","provider":"go.mondoo.com/mql/providers/openstack"},"flavor":{"name":"flavor","type":"\u001bopenstack.compute.flavor","title":"Flavor (compute size) the instance runs on","provider":"go.mondoo.com/mql/providers/openstack"},"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"DNS-resolvable hostname of the instance; empty when only IP addresses are assigned","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Instance ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Instance name","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Build/lifecycle status (for example `ACTIVE`, `BUILD`, or `ERROR`)","provider":"go.mondoo.com/mql/providers/openstack"},"users":{"name":"users","type":"\u0019\n","title":"Database user accounts on the instance ([{name, databases: [string]}]); passwords are not included","provider":"go.mondoo.com/mql/providers/openstack"},"volumeSize":{"name":"volumeSize","type":"\u0005","is_mandatory":true,"title":"Size of the attached data volume in gibibytes","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Trove database instance","desc":"Managed database instance provisioned by the Trove database service. Select an instance by its `id`, for example `openstack.db.instance(id: \"...\")`. The `addresses` and `hostname` fields show how the database is reachable, and `datastoreType`/`datastoreVersion` identify the engine and version so you can flag outdated database software. The `databases` and `users` fields enumerate the logical databases and accounts on the instance; user passwords are intentionally not exposed.","private":true,"min_provider_version":"13.1.4","defaults":"id name status datastoreType datastoreVersion","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.dns":{"id":"openstack.dns","fields":{"recordset":{"name":"recordset","type":"\u001bopenstack.dns.recordset","title":"OpenStack Designate DNS recordset (one or more records sharing a name and type)","desc":"A collection of DNS records that share the same name and record type within a Designate zone, along with the values they resolve to. Query a single recordset by its id, for example `openstack.dns.recordset(id: \"f7b10e9b-0cae-4a91-b162-562bc6096648\")`. Audit recordsets to review what a zone resolves, catch entries pointing at unexpected or externally controlled targets, and check the type and ttl. The records field holds the raw values (one per record, formatted per type) and zone links back to the owning zone.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"zone":{"name":"zone","type":"\u001bopenstack.dns.zone","title":"OpenStack Designate DNS zone","desc":"A domain namespace managed by the Designate DNS service, holding the records that resolve names under it. Query a single zone by its id, for example `openstack.dns.zone(id: \"a86dba58-0043-4cc6-a1bb-69d5e86f3ca3\")`. Audit zones to review which domains a project serves, check the SOA email and default ttl, and spot SECONDARY zones that transfer records from external masters. The type field distinguishes PRIMARY zones from SECONDARY ones, and recordsets returns the individual record collections defined within the zone.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.dns.recordset":{"id":"openstack.dns.recordset","name":"openstack.dns.recordset","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Last action performed (CREATE, UPDATE, DELETE, NONE)","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Recordset ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Recordset name (FQDN, e.g. \"www.example.com.\")","provider":"go.mondoo.com/mql/providers/openstack"},"records":{"name":"records","type":"\u0019\u0007","is_mandatory":true,"title":"Record values (one entry per record; format depends on type)","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Recordset status (ACTIVE, PENDING, ERROR, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"ttl":{"name":"ttl","type":"\u0005","is_mandatory":true,"title":"TTL in seconds; null when the zone default applies","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Record type (A, AAAA, MX, CNAME, TXT, SRV, NS, PTR, SPF, SSHFP, CAA, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"zone":{"name":"zone","type":"\u001bopenstack.dns.zone","title":"Owning zone","provider":"go.mondoo.com/mql/providers/openstack"},"zoneId":{"name":"zoneId","type":"\u0007","is_mandatory":true,"title":"Owning zone ID","desc":"Deprecated in favor of zone.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Designate DNS recordset (one or more records sharing a name and type)","desc":"A collection of DNS records that share the same name and record type within a Designate zone, along with the values they resolve to. Query a single recordset by its id, for example `openstack.dns.recordset(id: \"f7b10e9b-0cae-4a91-b162-562bc6096648\")`. Audit recordsets to review what a zone resolves, catch entries pointing at unexpected or externally controlled targets, and check the type and ttl. The records field holds the raw values (one per record, formatted per type) and zone links back to the owning zone.","private":true,"min_provider_version":"13.0.1","defaults":"id name type ttl","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.dns.zone":{"id":"openstack.dns.zone","name":"openstack.dns.zone","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Last action performed on the zone (CREATE, UPDATE, DELETE, NONE)","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address recorded in the zone SOA","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Zone ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"masters":{"name":"masters","type":"\u0019\u0007","is_mandatory":true,"title":"Master nameservers for SECONDARY zones (empty for PRIMARY zones)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Zone name (FQDN, e.g. \"example.com.\")","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this zone","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Owning project ID","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"recordsets":{"name":"recordsets","type":"\u0019\u001bopenstack.dns.recordset","title":"Recordsets in this zone","provider":"go.mondoo.com/mql/providers/openstack"},"serial":{"name":"serial","type":"\u0005","is_mandatory":true,"title":"SOA serial number","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Zone status (ACTIVE, PENDING, ERROR, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"transferredAt":{"name":"transferredAt","type":"\t","is_mandatory":true,"title":"Last successful transfer timestamp (SECONDARY zones); null when never transferred","provider":"go.mondoo.com/mql/providers/openstack"},"ttl":{"name":"ttl","type":"\u0005","is_mandatory":true,"title":"Default TTL in seconds for records that do not override it","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Zone type (PRIMARY or SECONDARY)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Designate DNS zone","desc":"A domain namespace managed by the Designate DNS service, holding the records that resolve names under it. Query a single zone by its id, for example `openstack.dns.zone(id: \"a86dba58-0043-4cc6-a1bb-69d5e86f3ca3\")`. Audit zones to review which domains a project serves, check the SOA email and default ttl, and spot SECONDARY zones that transfer records from external masters. The type field distinguishes PRIMARY zones from SECONDARY ones, and recordsets returns the individual record collections defined within the zone.","private":true,"min_provider_version":"13.0.1","defaults":"id name type ttl status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.domain":{"id":"openstack.domain","name":"openstack.domain","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the domain is enabled","provider":"go.mondoo.com/mql/providers/openstack"},"groups":{"name":"groups","type":"\u0019\u001bopenstack.group","title":"Groups in this domain","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Domain ID (UUID, or \"default\" for the bootstrap domain)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Domain name","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone domain","desc":"Top-level identity boundary in Keystone that contains projects, users, and groups, providing administrative separation between tenants. Auditing a domain reveals whether it is enabled and which groups it holds, which together govern the scope of authentication and authorization within it. A domain is selected by its `id`, for example `openstack.domain(id: \"default\")` for the bootstrap domain.","private":true,"min_provider_version":"13.0.1","defaults":"id name enabled","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.ec2Credential":{"id":"openstack.ec2Credential","name":"openstack.ec2Credential","fields":{"access":{"name":"access","type":"\u0007","is_mandatory":true,"title":"Access key (UUID) identifying the credential","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project the credential is scoped to","provider":"go.mondoo.com/mql/providers/openstack"},"trust":{"name":"trust","type":"\u001bopenstack.trust","title":"Trust scoping the credential; null when not trust-scoped","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"Owning user","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"access","type":"\u0007","optional":true}]},"title":"OpenStack Keystone EC2-compatible credential","desc":"EC2-style access credential owned by a user, used by EC2/S3-compatible API clients. Select a credential by its `access` key, for example `openstack.ec2Credential(access: \"abc123...\")`. The secret key is intentionally not exposed; query `access`, `user`, `project`, and `trust` to audit long-lived programmatic access.","private":true,"min_provider_version":"13.1.4","defaults":"access","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.firewall":{"id":"openstack.firewall","fields":{"group":{"name":"group","type":"\u001bopenstack.firewall.group","title":"OpenStack FWaaS v2 firewall group","desc":"Firewall-as-a-Service v2 group that binds an ingress and an egress policy to a set of Neutron ports, applying stateful packet filtering at the port level. The status field reports the provisioning state (ACTIVE, INACTIVE, PENDING_*, ERROR), adminStateUp reports whether the group is administratively enabled, and shared reports whether other projects can use it. Selected by group ID.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"policy":{"name":"policy","type":"\u001bopenstack.firewall.policy","title":"OpenStack FWaaS v2 firewall policy","desc":"Firewall-as-a-Service v2 policy holding an ordered list of rules that a firewall group evaluates in sequence. The audited flag records whether an administrator has reviewed the current rule set, and shared reports whether other projects can reference the policy. Selected by policy ID.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"rule":{"name":"rule","type":"\u001bopenstack.firewall.rule","title":"OpenStack FWaaS v2 firewall rule","desc":"Firewall-as-a-Service v2 rule, a single match-action entry that one or more policies reference. Matches on protocol, source and destination IP/CIDR, and source and destination port ranges, then applies the action (allow, deny, reject). The enabled flag controls whether the rule is evaluated, and ipVersion selects IPv4 or IPv6. Selected by rule ID.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.firewall.group":{"id":"openstack.firewall.group","name":"openstack.firewall.group","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the firewall group is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"egressPolicy":{"name":"egressPolicy","type":"\u001bopenstack.firewall.policy","title":"Policy applied to egress traffic; null when no egress policy is bound","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall group ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"ingressPolicy":{"name":"ingressPolicy","type":"\u001bopenstack.firewall.policy","title":"Policy applied to ingress traffic; null when no ingress policy is bound","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall group name","provider":"go.mondoo.com/mql/providers/openstack"},"ports":{"name":"ports","type":"\u0019\u001bopenstack.port","title":"Ports protected by this firewall group","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this firewall group","provider":"go.mondoo.com/mql/providers/openstack"},"shared":{"name":"shared","type":"\u0004","is_mandatory":true,"title":"Whether the group is shared across projects","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (ACTIVE, INACTIVE, PENDING_*, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack FWaaS v2 firewall group","desc":"Firewall-as-a-Service v2 group that binds an ingress and an egress policy to a set of Neutron ports, applying stateful packet filtering at the port level. The status field reports the provisioning state (ACTIVE, INACTIVE, PENDING_*, ERROR), adminStateUp reports whether the group is administratively enabled, and shared reports whether other projects can use it. Selected by group ID.","private":true,"min_provider_version":"13.0.1","defaults":"id name status adminStateUp","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.firewall.policy":{"id":"openstack.firewall.policy","name":"openstack.firewall.policy","fields":{"audited":{"name":"audited","type":"\u0004","is_mandatory":true,"title":"Whether the policy has been audited (an admin has reviewed it)","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall policy ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall policy name","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this firewall policy","provider":"go.mondoo.com/mql/providers/openstack"},"rules":{"name":"rules","type":"\u0019\u001bopenstack.firewall.rule","title":"Rules in this policy in evaluation order","provider":"go.mondoo.com/mql/providers/openstack"},"shared":{"name":"shared","type":"\u0004","is_mandatory":true,"title":"Whether the policy is shared across projects","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack FWaaS v2 firewall policy","desc":"Firewall-as-a-Service v2 policy holding an ordered list of rules that a firewall group evaluates in sequence. The audited flag records whether an administrator has reviewed the current rule set, and shared reports whether other projects can reference the policy. Selected by policy ID.","private":true,"min_provider_version":"13.0.1","defaults":"id name audited shared","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.firewall.rule":{"id":"openstack.firewall.rule","name":"openstack.firewall.rule","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action (allow, deny, reject)","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"destinationIpAddress":{"name":"destinationIpAddress","type":"\u0007","is_mandatory":true,"title":"Destination IP/CIDR; empty matches any","provider":"go.mondoo.com/mql/providers/openstack"},"destinationPort":{"name":"destinationPort","type":"\u0007","is_mandatory":true,"title":"Destination port or range; empty matches any","provider":"go.mondoo.com/mql/providers/openstack"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is currently evaluated (disabled rules are skipped)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Firewall rule ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"ipVersion":{"name":"ipVersion","type":"\u0005","is_mandatory":true,"title":"IP version the rule applies to (4 or 6); 0 when unspecified","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Firewall rule name","provider":"go.mondoo.com/mql/providers/openstack"},"policies":{"name":"policies","type":"\u0019\u001bopenstack.firewall.policy","title":"Policies that reference this rule","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this firewall rule","provider":"go.mondoo.com/mql/providers/openstack"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Match protocol (tcp, udp, icmp, any; empty matches any)","provider":"go.mondoo.com/mql/providers/openstack"},"shared":{"name":"shared","type":"\u0004","is_mandatory":true,"title":"Whether the rule is shared across projects","provider":"go.mondoo.com/mql/providers/openstack"},"sourceIpAddress":{"name":"sourceIpAddress","type":"\u0007","is_mandatory":true,"title":"Source IP/CIDR; empty matches any","provider":"go.mondoo.com/mql/providers/openstack"},"sourcePort":{"name":"sourcePort","type":"\u0007","is_mandatory":true,"title":"Source port or range (e.g. \"443\" or \"1024:65535\"); empty matches any","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack FWaaS v2 firewall rule","desc":"Firewall-as-a-Service v2 rule, a single match-action entry that one or more policies reference. Matches on protocol, source and destination IP/CIDR, and source and destination port ranges, then applies the action (allow, deny, reject). The enabled flag controls whether the rule is evaluated, and ipVersion selects IPv4 or IPv6. Selected by rule ID.","private":true,"min_provider_version":"13.0.1","defaults":"id name action protocol enabled","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.floatingIp":{"id":"openstack.floatingIp","name":"openstack.floatingIp","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"fixedIpAddress":{"name":"fixedIpAddress","type":"\u0007","is_mandatory":true,"title":"The fixed (private) IP address it maps to (empty when unattached)","provider":"go.mondoo.com/mql/providers/openstack"},"floatingIpAddress":{"name":"floatingIpAddress","type":"\u0007","is_mandatory":true,"title":"The floating (public) IP address","provider":"go.mondoo.com/mql/providers/openstack"},"floatingNetwork":{"name":"floatingNetwork","type":"\u001bopenstack.network","title":"External network this floating IP is allocated from","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Floating IP ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"port":{"name":"port","type":"\u001bopenstack.port","title":"Port this floating IP is bound to; null when unattached","provider":"go.mondoo.com/mql/providers/openstack"},"portForwarding":{"name":"portForwarding","type":"\u001bopenstack.floatingIp.portForwarding","title":"OpenStack Neutron floating IP port forwarding rule","desc":"A public-to-private DNAT mapping on a floating IP. The rule forwards traffic arriving on the floating IP's external port (or external port range) to a private port (or port range) on a backing Neutron port, publishing a specific private service to the internet even when the backing instance has no floating IP of its own. A floating IP with port forwarding cannot also be associated one-to-one to a port.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"portForwardings":{"name":"portForwardings","type":"\u0019\u001bopenstack.floatingIp.portForwarding","title":"DNAT port-forwarding rules on this floating IP; empty when none are configured","min_provider_version":"13.6.1","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this floating IP","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"router":{"name":"router","type":"\u001bopenstack.router","title":"Router handling NAT for this floating IP; null when unattached","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status","desc":"One of ACTIVE, DOWN, or ERROR.","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Neutron floating IP","desc":"Public IPv4 address allocated from an external network and mapped through NAT to a private fixed IP on a Neutron port, giving an instance inbound reachability from outside the tenant network. Select a floating IP by its UUID, for example `openstack.floatingIp(id: \"a1b2c3d4-...\")`. Auditing floating IPs reveals which internal workloads are exposed to the internet, the external network they draw from, the port and router carrying their NAT, and any DNAT port-forwarding rules that publish additional private services.","private":true,"min_provider_version":"13.0.1","defaults":"id floatingIpAddress status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.floatingIp.portForwarding":{"id":"openstack.floatingIp.portForwarding","name":"openstack.floatingIp.portForwarding","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"externalPort":{"name":"externalPort","type":"\u0005","is_mandatory":true,"title":"Public port on the floating IP; 0 when a port range is used instead","provider":"go.mondoo.com/mql/providers/openstack"},"externalPortRange":{"name":"externalPortRange","type":"\u0007","is_mandatory":true,"title":"Public port range on the floating IP (for example \"80:90\"); empty when a single port is used","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Port forwarding rule ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"internalIpAddress":{"name":"internalIpAddress","type":"\u0007","is_mandatory":true,"title":"Private IPv4 address traffic is forwarded to","provider":"go.mondoo.com/mql/providers/openstack"},"internalPort":{"name":"internalPort","type":"\u0005","is_mandatory":true,"title":"Private port on the backing Neutron port; 0 when a port range is used instead","provider":"go.mondoo.com/mql/providers/openstack"},"internalPortRange":{"name":"internalPortRange","type":"\u0007","is_mandatory":true,"title":"Private port range on the backing Neutron port (for example \"80:90\"); empty when a single port is used","provider":"go.mondoo.com/mql/providers/openstack"},"port":{"name":"port","type":"\u001bopenstack.port","title":"Backing Neutron port that receives the forwarded traffic","provider":"go.mondoo.com/mql/providers/openstack"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"IP protocol forwarded (tcp, udp, ...)","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Neutron floating IP port forwarding rule","desc":"A public-to-private DNAT mapping on a floating IP. The rule forwards traffic arriving on the floating IP's external port (or external port range) to a private port (or port range) on a backing Neutron port, publishing a specific private service to the internet even when the backing instance has no floating IP of its own. A floating IP with port forwarding cannot also be associated one-to-one to a port.","private":true,"min_provider_version":"13.6.1","defaults":"protocol externalPort internalIpAddress internalPort","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.group":{"id":"openstack.group","name":"openstack.group","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"domain":{"name":"domain","type":"\u001bopenstack.domain","title":"Domain this group belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Group ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Group name","provider":"go.mondoo.com/mql/providers/openstack"},"roles":{"name":"roles","type":"\u0019\u001bopenstack.role","title":"Effective roles assigned to this group (deduplicated across project/domain/system scopes)","provider":"go.mondoo.com/mql/providers/openstack"},"users":{"name":"users","type":"\u0019\u001bopenstack.user","title":"Users that are members of this group","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone group","desc":"Keystone group that aggregates users so roles can be granted collectively rather than to each user individually. Auditing groups reveals who inherits privileged access through membership: the users field lists the members and the roles field reports the effective roles the group confers across project, domain, and system scopes. Select a group by its UUID, for example openstack.group(id: \"a1b2c3d4...\").","private":true,"min_provider_version":"13.0.1","defaults":"id name","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.identity":{"id":"openstack.identity","fields":{"endpoint":{"name":"endpoint","type":"\u001bopenstack.identity.endpoint","title":"OpenStack Keystone service-catalog endpoint","desc":"Single URL at which a service is reachable, for one interface type (public, internal, or admin) in one region. Select an endpoint by its `id`. Auditing which services expose `public` endpoints, and on which URLs, is the primary use.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"region":{"name":"region","type":"\u001bopenstack.identity.region","title":"OpenStack Keystone region","desc":"Logical grouping of service endpoints, optionally nested under a parent region. Select a region by its `id`. Query `parentRegion` to walk the region hierarchy.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"roleAssignment":{"name":"roleAssignment","type":"\u001bopenstack.identity.roleAssignment","title":"OpenStack Keystone role assignment","desc":"Flattened record of a single role granted to a single principal (a user or a group) at a single scope (a project or a domain). Enumerating these is how a policy audits who holds privileged roles such as `admin` across the whole cloud, instead of walking each user or group. System-scoped grants and the inherited flag are not reported, because the underlying client does not return them.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"roleInference":{"name":"roleInference","type":"\u001bopenstack.identity.roleInference","title":"OpenStack Keystone role inference rule","desc":"Mapping from a prior role to an implied role: any principal holding the prior role automatically gains the implied role. Chains of these rules are a privilege-escalation path to audit, since a low-privilege role can imply a more powerful one.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"service":{"name":"service","type":"\u001bopenstack.identity.service","title":"OpenStack Keystone service-catalog service","desc":"Registered service in the Keystone catalog: the abstract service (such as `compute`, `identity`, or `network`) that endpoints attach to. Select a service by its `id`. Query `type` and `enabled` to inventory which services the deployment advertises.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.identity.endpoint":{"id":"openstack.identity.endpoint","name":"openstack.identity.endpoint","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the endpoint is enabled","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Endpoint ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"interface":{"name":"interface","type":"\u0007","is_mandatory":true,"title":"Interface type","desc":"One of `public`, `internal`, or `admin`.","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint name","provider":"go.mondoo.com/mql/providers/openstack"},"region":{"name":"region","type":"\u001bopenstack.identity.region","title":"Region the endpoint is located in; null when the endpoint has no region or the region is not listed","provider":"go.mondoo.com/mql/providers/openstack"},"service":{"name":"service","type":"\u001bopenstack.identity.service","title":"Service this endpoint exposes","provider":"go.mondoo.com/mql/providers/openstack"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Endpoint URL","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone service-catalog endpoint","desc":"Single URL at which a service is reachable, for one interface type (public, internal, or admin) in one region. Select an endpoint by its `id`. Auditing which services expose `public` endpoints, and on which URLs, is the primary use.","private":true,"min_provider_version":"13.1.4","defaults":"id interface url","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.identity.region":{"id":"openstack.identity.region","name":"openstack.identity.region","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Region ID","provider":"go.mondoo.com/mql/providers/openstack"},"parentRegion":{"name":"parentRegion","type":"\u001bopenstack.identity.region","title":"Parent region; null for a top-level region","provider":"go.mondoo.com/mql/providers/openstack"},"parentRegionId":{"name":"parentRegionId","type":"\u0007","is_mandatory":true,"title":"ID of the parent region; empty for a top-level region","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone region","desc":"Logical grouping of service endpoints, optionally nested under a parent region. Select a region by its `id`. Query `parentRegion` to walk the region hierarchy.","private":true,"min_provider_version":"13.1.4","defaults":"id parentRegionId","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.identity.roleAssignment":{"id":"openstack.identity.roleAssignment","name":"openstack.identity.roleAssignment","fields":{"actorType":{"name":"actorType","type":"\u0007","is_mandatory":true,"title":"Whether the role is granted to a user or a group (\"user\" or \"group\")","provider":"go.mondoo.com/mql/providers/openstack"},"group":{"name":"group","type":"\u001bopenstack.group","title":"Group the role is granted to; null when the grant is to a user","provider":"go.mondoo.com/mql/providers/openstack"},"role":{"name":"role","type":"\u001bopenstack.role","title":"Role granted by this assignment","provider":"go.mondoo.com/mql/providers/openstack"},"roleName":{"name":"roleName","type":"\u0007","is_mandatory":true,"title":"Name of the granted role; empty when the role catalog is not readable","provider":"go.mondoo.com/mql/providers/openstack"},"scopeDomain":{"name":"scopeDomain","type":"\u001bopenstack.domain","title":"Domain the grant applies to; null when the grant is project-scoped","provider":"go.mondoo.com/mql/providers/openstack"},"scopeProject":{"name":"scopeProject","type":"\u001bopenstack.project","title":"Project the grant applies to; null when the grant is domain-scoped","provider":"go.mondoo.com/mql/providers/openstack"},"scopeType":{"name":"scopeType","type":"\u0007","is_mandatory":true,"title":"Whether the grant applies to a project or a domain (\"project\" or \"domain\")","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u001bopenstack.user","title":"User the role is granted to; null when the grant is to a group","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Keystone role assignment","desc":"Flattened record of a single role granted to a single principal (a user or a group) at a single scope (a project or a domain). Enumerating these is how a policy audits who holds privileged roles such as `admin` across the whole cloud, instead of walking each user or group. System-scoped grants and the inherited flag are not reported, because the underlying client does not return them.","private":true,"min_provider_version":"13.4.2","defaults":"roleName actorType scopeType","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.identity.roleInference":{"id":"openstack.identity.roleInference","name":"openstack.identity.roleInference","fields":{"impliedRole":{"name":"impliedRole","type":"\u001bopenstack.role","title":"Implied role conferred by the prior role","provider":"go.mondoo.com/mql/providers/openstack"},"impliedRoleName":{"name":"impliedRoleName","type":"\u0007","is_mandatory":true,"title":"Name of the implied role conferred by holding the prior role; empty when the role catalog is not readable","provider":"go.mondoo.com/mql/providers/openstack"},"priorRole":{"name":"priorRole","type":"\u001bopenstack.role","title":"Prior role held directly","provider":"go.mondoo.com/mql/providers/openstack"},"priorRoleName":{"name":"priorRoleName","type":"\u0007","is_mandatory":true,"title":"Name of the prior role that is held directly; empty when the role catalog is not readable","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Keystone role inference rule","desc":"Mapping from a prior role to an implied role: any principal holding the prior role automatically gains the implied role. Chains of these rules are a privilege-escalation path to audit, since a low-privilege role can imply a more powerful one.","private":true,"min_provider_version":"13.4.2","defaults":"priorRoleName impliedRoleName","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.identity.service":{"id":"openstack.identity.service","name":"openstack.identity.service","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the service is enabled","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Service ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service name","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Service type","desc":"The catalog type such as `identity`, `compute`, `network`, `image`, or `object-store`.","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone service-catalog service","desc":"Registered service in the Keystone catalog: the abstract service (such as `compute`, `identity`, or `network`) that endpoints attach to. Select a service by its `id`. Query `type` and `enabled` to inventory which services the deployment advertises.","private":true,"min_provider_version":"13.1.4","defaults":"id name type enabled","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.image":{"id":"openstack.image","name":"openstack.image","fields":{"checksum":{"name":"checksum","type":"\u0007","is_mandatory":true,"title":"Image data checksum (MD5; deprecated by Glance but still populated on most clouds)","provider":"go.mondoo.com/mql/providers/openstack"},"containerFormat":{"name":"containerFormat","type":"\u0007","is_mandatory":true,"title":"Container format (ami, ari, aki, bare, ovf)","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"diskFormat":{"name":"diskFormat","type":"\u0007","is_mandatory":true,"title":"Disk format (ami, ari, aki, vhd, vmdk, raw, qcow2, vdi, iso)","provider":"go.mondoo.com/mql/providers/openstack"},"hidden":{"name":"hidden","type":"\u0004","is_mandatory":true,"title":"Whether the image is hidden from the default image list (`os_hidden`)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Image ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"imageSignature":{"name":"imageSignature","type":"\u0007","title":"Glance image signature (`img_signature` property); empty string when the image is unsigned","min_provider_version":"13.3.2","provider":"go.mondoo.com/mql/providers/openstack"},"kernel":{"name":"kernel","type":"\u001bopenstack.image","title":"Kernel image this image boots with (AMI-style `kernel_id` property); null when not set","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"member":{"name":"member","type":"\u001bopenstack.image.member","title":"OpenStack Glance image-sharing member. One entry per project the image has been shared with.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"members":{"name":"members","type":"\u0019\u001bopenstack.image.member","title":"Sharing members for this image (projects the image has been shared with). Returns empty for community/public images and for non-shared private images.","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"User-defined metadata","provider":"go.mondoo.com/mql/providers/openstack"},"minDiskGigabytes":{"name":"minDiskGigabytes","type":"\u0005","is_mandatory":true,"title":"Minimum root disk in GB required to boot the image","provider":"go.mondoo.com/mql/providers/openstack"},"minRamMegabytes":{"name":"minRamMegabytes","type":"\u0005","is_mandatory":true,"title":"Minimum RAM in MB required to boot the image","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Image name","provider":"go.mondoo.com/mql/providers/openstack"},"osHashAlgo":{"name":"osHashAlgo","type":"\u0007","is_mandatory":true,"title":"Secure-hash algorithm used for the image integrity digest (for example `sha512`); empty when the cloud does not report one","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"osHashValue":{"name":"osHashValue","type":"\u0007","is_mandatory":true,"title":"Image integrity digest in the algorithm named by osHashAlgo; empty when the cloud does not report one","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"owner":{"name":"owner","type":"\u001bopenstack.project","title":"Project that owns the image","provider":"go.mondoo.com/mql/providers/openstack"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Free-form image properties","desc":"Carries Glance signing fields (`img_signature`, `img_signature_hash_method`, `img_signature_key_type`, `img_signature_certificate_uuid`), kernel/ramdisk references, and OS distro hints.","provider":"go.mondoo.com/mql/providers/openstack"},"protected":{"name":"protected","type":"\u0004","is_mandatory":true,"title":"Whether the image is delete-protected","provider":"go.mondoo.com/mql/providers/openstack"},"ramdisk":{"name":"ramdisk","type":"\u001bopenstack.image","title":"Ramdisk image this image boots with (AMI-style `ramdisk_id` property); null when not set","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"sizeBytes":{"name":"sizeBytes","type":"\u0005","is_mandatory":true,"title":"Image data size in bytes","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (queued, saving, active, killed, deleted, pending_delete, deactivated, uploading, importing)","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"virtualSize":{"name":"virtualSize","type":"\u0005","is_mandatory":true,"title":"Virtual disk size in bytes","provider":"go.mondoo.com/mql/providers/openstack"},"visibility":{"name":"visibility","type":"\u0007","is_mandatory":true,"title":"Visibility (public, private, community, shared)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Glance image","desc":"Virtual machine image registered in Glance, the source template instances boot from. Select one by its UUID, for example `openstack.image(id: \"7c9d9e5f-...\")`. Audit `visibility` to find images exposed publicly or to the whole community, `protected` and `hidden` to understand lifecycle and listing controls, and the integrity fields (`checksum`, `osHashAlgo`, `osHashValue`) alongside `imageSignature` to confirm images are signed and untampered. The `members` field enumerates the projects a shared image is visible to, and `kernel` and `ramdisk` resolve the AMI-style boot components.","private":true,"min_provider_version":"13.0.1","defaults":"id name status visibility","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.image.member":{"id":"openstack.image.member","name":"openstack.image.member","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"image":{"name":"image","type":"\u001bopenstack.image","title":"Image being shared","provider":"go.mondoo.com/mql/providers/openstack"},"imageId":{"name":"imageId","type":"\u0007","is_mandatory":true,"title":"Image ID (image being shared)","provider":"go.mondoo.com/mql/providers/openstack"},"memberId":{"name":"memberId","type":"\u0007","is_mandatory":true,"title":"Member ID (project UUID the image is shared with)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project the image has been shared with","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Member status (pending, accepted, rejected)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"imageId","type":"\u0007","optional":true},{"name":"memberId","type":"\u0007","optional":true}]},"title":"OpenStack Glance image-sharing member. One entry per project the image has been shared with.","private":true,"min_provider_version":"13.0.1","defaults":"memberId imageId status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.keymanager":{"id":"openstack.keymanager","fields":{"acl":{"name":"acl","type":"\u001bopenstack.keymanager.acl","title":"OpenStack Barbican access control list for a secret or container","desc":"Per-operation grants that override the default project-scoped access to a Barbican secret or container. The `entries` dict is keyed by operation (typically \"read\") and lists the users allowed to perform it, so you can audit whether secret material has been shared beyond its owning project.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"container":{"name":"container","type":"\u001bopenstack.keymanager.container","title":"OpenStack Barbican secret container","desc":"Bundle of related Barbican secrets grouped under a single reference. Select a container by its `id`, for example `openstack.keymanager.container(id: \"...\")`. Certificate-typed containers hold a certificate together with its private key and any intermediate CA bundle, and are what Octavia listeners point at for TLS termination. Query `type` to tell generic, rsa, and certificate containers apart, `secrets` for the referenced secret material, and `consumers` to see which services depend on the container.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"order":{"name":"order","type":"\u001bopenstack.keymanager.order","title":"OpenStack Barbican secret-generation order","desc":"Asynchronous request that has Barbican generate secret material server-side: a key, an asymmetric key pair, or a certificate. Select an order by its `id`, for example `openstack.keymanager.order(id: \"...\")`. Query `type` for what is being produced, `status` and `subStatus` to track progress, `errorReason` when generation fails, and `secret` or `container` for the material produced once the order completes.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"secret":{"name":"secret","type":"\u001bopenstack.keymanager.secret","title":"OpenStack Barbican secret","desc":"Cryptographic secret material held by the Barbican key manager: symmetric keys, public and private keys, passphrases, certificates, and opaque blobs. Select a secret by its `id`, for example `openstack.keymanager.secret(id: \"...\")`. Query `secretType`, `algorithm`, and `bitLength` to audit what kind of key material is stored, `status` and `expiresAt` to find inactive or expired secrets, and `acl` to see who is allowed to read it. The raw `payload` (the secret material itself) is intentionally not exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.keymanager.acl":{"id":"openstack.keymanager.acl","name":"openstack.keymanager.acl","fields":{"entries":{"name":"entries","type":"\n","is_mandatory":true,"title":"ACL entries keyed by operation (e.g. \"read\"); each entry contains `{users: [string], project_access: bool, created, updated}`","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Barbican access control list for a secret or container","desc":"Per-operation grants that override the default project-scoped access to a Barbican secret or container. The `entries` dict is keyed by operation (typically \"read\") and lists the users allowed to perform it, so you can audit whether secret material has been shared beyond its owning project.","private":true,"min_provider_version":"13.0.1","defaults":"entries","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.keymanager.container":{"id":"openstack.keymanager.container","name":"openstack.keymanager.container","fields":{"acl":{"name":"acl","type":"\u001bopenstack.keymanager.acl","title":"Access control list for this container; null when no ACL is set","provider":"go.mondoo.com/mql/providers/openstack"},"certificate":{"name":"certificate","type":"\u001bopenstack.keymanager.secret","title":"Certificate body; only set on certificate-typed containers","provider":"go.mondoo.com/mql/providers/openstack"},"consumers":{"name":"consumers","type":"\u0019\n","is_mandatory":true,"title":"Consumers registered on this container ([{name, url}])","provider":"go.mondoo.com/mql/providers/openstack"},"containerRef":{"name":"containerRef","type":"\u0007","is_mandatory":true,"title":"Full Barbican container URL; matches the `default_tls_container_ref` / `sni_container_refs` strings used by Octavia listeners","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"creator":{"name":"creator","type":"\u001bopenstack.user","title":"User that created this container; null when the API does not return a creator","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Container ID (UUID extracted from containerRef)","provider":"go.mondoo.com/mql/providers/openstack"},"intermediates":{"name":"intermediates","type":"\u001bopenstack.keymanager.secret","title":"Intermediate CA bundle; only set on certificate-typed containers that include intermediates","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Container name","provider":"go.mondoo.com/mql/providers/openstack"},"privateKey":{"name":"privateKey","type":"\u001bopenstack.keymanager.secret","title":"Private key paired with the certificate; only set on certificate-typed containers","provider":"go.mondoo.com/mql/providers/openstack"},"secretRefs":{"name":"secretRefs","type":"\u0019\n","is_mandatory":true,"title":"Raw secret references on this container","desc":"One entry per referenced secret as `{name, secret_ref}`, where `name` is the role within the container (for example certificate, private_key, or intermediates) and `secret_ref` is the full Barbican secret URL. See `secrets` for the resolved secret material.","provider":"go.mondoo.com/mql/providers/openstack"},"secrets":{"name":"secrets","type":"\u0019\u001bopenstack.keymanager.secret","title":"All secrets referenced by this container","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (ACTIVE, PENDING, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type (generic, rsa, certificate)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Barbican secret container","desc":"Bundle of related Barbican secrets grouped under a single reference. Select a container by its `id`, for example `openstack.keymanager.container(id: \"...\")`. Certificate-typed containers hold a certificate together with its private key and any intermediate CA bundle, and are what Octavia listeners point at for TLS termination. Query `type` to tell generic, rsa, and certificate containers apart, `secrets` for the referenced secret material, and `consumers` to see which services depend on the container.","private":true,"min_provider_version":"13.0.1","defaults":"id name type status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.keymanager.order":{"id":"openstack.keymanager.order","name":"openstack.keymanager.order","fields":{"container":{"name":"container","type":"\u001bopenstack.keymanager.container","title":"Container produced by this order; null for secret-producing orders","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"creator":{"name":"creator","type":"\u001bopenstack.user","title":"User that created this order; null when the API does not return a creator","provider":"go.mondoo.com/mql/providers/openstack"},"errorReason":{"name":"errorReason","type":"\u0007","is_mandatory":true,"title":"Error reason; populated when status is ERROR","provider":"go.mondoo.com/mql/providers/openstack"},"errorStatusCode":{"name":"errorStatusCode","type":"\u0007","is_mandatory":true,"title":"Error status code; populated when status is ERROR","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Order ID (UUID extracted from orderRef)","provider":"go.mondoo.com/mql/providers/openstack"},"meta":{"name":"meta","type":"\n","is_mandatory":true,"title":"Order metadata (algorithm, bit_length, expiration, mode, name, payload_content_type)","provider":"go.mondoo.com/mql/providers/openstack"},"orderRef":{"name":"orderRef","type":"\u0007","is_mandatory":true,"title":"Full Barbican order URL","provider":"go.mondoo.com/mql/providers/openstack"},"secret":{"name":"secret","type":"\u001bopenstack.keymanager.secret","title":"Secret produced by this order; null until the order completes (or for container-producing orders)","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (PENDING, ACTIVE, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"subStatus":{"name":"subStatus","type":"\u0007","is_mandatory":true,"title":"Sub-status; finer-grained progress when status is PENDING","provider":"go.mondoo.com/mql/providers/openstack"},"subStatusMessage":{"name":"subStatusMessage","type":"\u0007","is_mandatory":true,"title":"Sub-status human-readable message","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Order type (key, asymmetric, certificate)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Barbican secret-generation order","desc":"Asynchronous request that has Barbican generate secret material server-side: a key, an asymmetric key pair, or a certificate. Select an order by its `id`, for example `openstack.keymanager.order(id: \"...\")`. Query `type` for what is being produced, `status` and `subStatus` to track progress, `errorReason` when generation fails, and `secret` or `container` for the material produced once the order completes.","private":true,"min_provider_version":"13.0.1","defaults":"id type status subStatus","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.keymanager.secret":{"id":"openstack.keymanager.secret","name":"openstack.keymanager.secret","fields":{"acl":{"name":"acl","type":"\u001bopenstack.keymanager.acl","title":"Access control list for this secret; null when no ACL is set","provider":"go.mondoo.com/mql/providers/openstack"},"algorithm":{"name":"algorithm","type":"\u0007","is_mandatory":true,"title":"Algorithm (e.g. AES, RSA)","provider":"go.mondoo.com/mql/providers/openstack"},"bitLength":{"name":"bitLength","type":"\u0005","is_mandatory":true,"title":"Bit length of the secret material","provider":"go.mondoo.com/mql/providers/openstack"},"contentTypes":{"name":"contentTypes","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Available payload content types (e.g. {\"default\": \"application/octet-stream\"})","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"creator":{"name":"creator","type":"\u001bopenstack.user","title":"User that created this secret; null when the API does not return a creator","provider":"go.mondoo.com/mql/providers/openstack"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Expiration timestamp; null when the secret has no expiry","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Secret ID (UUID extracted from secretRef)","provider":"go.mondoo.com/mql/providers/openstack"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Mode (e.g. CBC, GCM); empty when not applicable","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Secret name","provider":"go.mondoo.com/mql/providers/openstack"},"secretRef":{"name":"secretRef","type":"\u0007","is_mandatory":true,"title":"Full Barbican secret URL","desc":"Matches the `default_tls_container_ref` / `sni_container_refs` strings used by Octavia listeners (when those point at a secret rather than a container).","provider":"go.mondoo.com/mql/providers/openstack"},"secretType":{"name":"secretType","type":"\u0007","is_mandatory":true,"title":"Secret type (symmetric, public, private, passphrase, certificate, opaque)","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (ACTIVE, PENDING, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Barbican secret","desc":"Cryptographic secret material held by the Barbican key manager: symmetric keys, public and private keys, passphrases, certificates, and opaque blobs. Select a secret by its `id`, for example `openstack.keymanager.secret(id: \"...\")`. Query `secretType`, `algorithm`, and `bitLength` to audit what kind of key material is stored, `status` and `expiresAt` to find inactive or expired secrets, and `acl` to see who is allowed to read it. The raw `payload` (the secret material itself) is intentionally not exposed.","private":true,"min_provider_version":"13.0.1","defaults":"id name secretType status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.network":{"id":"openstack.network","name":"openstack.network","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the network is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"external":{"name":"external","type":"\u0004","is_mandatory":true,"title":"Whether this is an external (public) network","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"mtu":{"name":"mtu","type":"\u0005","is_mandatory":true,"title":"MTU","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Network name","provider":"go.mondoo.com/mql/providers/openstack"},"portSecurityEnabled":{"name":"portSecurityEnabled","type":"\u0004","is_mandatory":true,"title":"Default port-security setting applied to ports created on this network; false disables anti-spoofing and security groups for those ports by default","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this network","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"providerNetworkType":{"name":"providerNetworkType","type":"\u0007","is_mandatory":true,"title":"Provider network type (vxlan, vlan, flat, gre, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"providerPhysicalNetwork":{"name":"providerPhysicalNetwork","type":"\u0007","is_mandatory":true,"title":"Provider physical network mapping","provider":"go.mondoo.com/mql/providers/openstack"},"providerSegmentationId":{"name":"providerSegmentationId","type":"\u0005","is_mandatory":true,"title":"Provider segmentation ID (VLAN tag, VXLAN VNI, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"qosPolicy":{"name":"qosPolicy","type":"\u001bopenstack.qosPolicy","title":"QoS policy attached to this network; null when none is attached","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"quotaSet":{"name":"quotaSet","type":"\u001bopenstack.network.quotaSet","title":"OpenStack Neutron network-service quota","desc":"Per-project ceilings the networking service enforces on Neutron objects: networks, subnets, ports, routers, floating IPs, security groups and their rules, subnet pools, RBAC policies, and trunks. These are the configured maximums; current usage is not exposed by the default API path. The quota applies to the scoped project, reachable through project.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"rbacPolicy":{"name":"rbacPolicy","type":"\u001bopenstack.network.rbacPolicy","title":"Neutron RBAC policy","desc":"Role-based access control policy that governs cross-project sharing of a network or QoS policy. The `action` distinguishes `access_as_shared` (other projects may use the object) from `access_as_external` (the network may be used as an external gateway), `objectType` together with the `network` and `qosPolicy` accessors identifies the shared object, and `targetProjectId` names the project the share is granted to. The literal `*` means every project, a cloud-wide share worth flagging. Select a policy by id with `openstack.network.rbacPolicy(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"shared":{"name":"shared","type":"\u0004","is_mandatory":true,"title":"Whether the network is shared with other projects","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (ACTIVE, DOWN, BUILD, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"subnets":{"name":"subnets","type":"\u0019\u001bopenstack.subnet","title":"Subnets attached to this network","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Neutron network","desc":"Layer-2 virtual network in the Neutron networking service, the broadcast domain that ports and subnets attach to. Query it to audit tenant isolation and exposure: `shared` reveals a network usable by other projects, `external` marks a provider network that bridges to the outside world, and `portSecurityEnabled` sets whether ports created on the network get anti-spoofing and security-group enforcement by default. The provider attributes (providerNetworkType, providerPhysicalNetwork, providerSegmentationId) expose the underlying segmentation, and subnets returns the address ranges carved from the network. Select a network by id with `openstack.network(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.network.quotaSet":{"id":"openstack.network.quotaSet","name":"openstack.network.quotaSet","fields":{"floatingIp":{"name":"floatingIp","type":"\u0005","is_mandatory":true,"title":"Maximum number of floating IPs","provider":"go.mondoo.com/mql/providers/openstack"},"network":{"name":"network","type":"\u0005","is_mandatory":true,"title":"Maximum number of networks","provider":"go.mondoo.com/mql/providers/openstack"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Maximum number of ports","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project the quota applies to","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Project ID the quota applies to","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"rbacPolicy":{"name":"rbacPolicy","type":"\u0005","is_mandatory":true,"title":"Maximum number of RBAC policies","provider":"go.mondoo.com/mql/providers/openstack"},"router":{"name":"router","type":"\u0005","is_mandatory":true,"title":"Maximum number of routers","provider":"go.mondoo.com/mql/providers/openstack"},"securityGroup":{"name":"securityGroup","type":"\u0005","is_mandatory":true,"title":"Maximum number of security groups","provider":"go.mondoo.com/mql/providers/openstack"},"securityGroupRule":{"name":"securityGroupRule","type":"\u0005","is_mandatory":true,"title":"Maximum number of security group rules","provider":"go.mondoo.com/mql/providers/openstack"},"subnet":{"name":"subnet","type":"\u0005","is_mandatory":true,"title":"Maximum number of subnets","provider":"go.mondoo.com/mql/providers/openstack"},"subnetPool":{"name":"subnetPool","type":"\u0005","is_mandatory":true,"title":"Maximum number of subnet pools","provider":"go.mondoo.com/mql/providers/openstack"},"trunk":{"name":"trunk","type":"\u0005","is_mandatory":true,"title":"Maximum number of trunks","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Neutron network-service quota","desc":"Per-project ceilings the networking service enforces on Neutron objects: networks, subnets, ports, routers, floating IPs, security groups and their rules, subnet pools, RBAC policies, and trunks. These are the configured maximums; current usage is not exposed by the default API path. The quota applies to the scoped project, reachable through project.","private":true,"min_provider_version":"13.0.1","defaults":"network subnet port floatingIp router","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.network.rbacPolicy":{"id":"openstack.network.rbacPolicy","name":"openstack.network.rbacPolicy","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action (access_as_shared, access_as_external)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"RBAC policy ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"network":{"name":"network","type":"\u001bopenstack.network","title":"Shared network; null unless objectType is \"network\"","provider":"go.mondoo.com/mql/providers/openstack"},"objectId":{"name":"objectId","type":"\u0007","is_mandatory":true,"title":"ID of the shared object (a network ID or QoS policy ID, per objectType)","provider":"go.mondoo.com/mql/providers/openstack"},"objectType":{"name":"objectType","type":"\u0007","is_mandatory":true,"title":"Type of the shared object (network, qos-policy)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns the RBAC policy","provider":"go.mondoo.com/mql/providers/openstack"},"qosPolicy":{"name":"qosPolicy","type":"\u001bopenstack.qosPolicy","title":"Shared QoS policy; null unless objectType is \"qos-policy\"","provider":"go.mondoo.com/mql/providers/openstack"},"targetProjectId":{"name":"targetProjectId","type":"\u0007","is_mandatory":true,"title":"Project the share is granted to; the literal \"*\" means all projects (cloud-wide share)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"Neutron RBAC policy","desc":"Role-based access control policy that governs cross-project sharing of a network or QoS policy. The `action` distinguishes `access_as_shared` (other projects may use the object) from `access_as_external` (the network may be used as an external gateway), `objectType` together with the `network` and `qosPolicy` accessors identifies the shared object, and `targetProjectId` names the project the share is granted to. The literal `*` means every project, a cloud-wide share worth flagging. Select a policy by id with `openstack.network.rbacPolicy(id: \"...\")`.","private":true,"min_provider_version":"13.5.2","defaults":"id action objectType targetProjectId","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.objectstorage":{"id":"openstack.objectstorage","fields":{"account":{"name":"account","type":"\u001bopenstack.objectstorage.account","title":"OpenStack Swift object-storage account","desc":"Account-level totals for a scoped project's Swift object storage, aggregating byte usage, container count, and object count across every container. There is one account per scoped project. Compare quotaBytes against bytesUsed for capacity planning, and check tempUrlKeySet to confirm whether a temporary-URL signing key is configured on the account.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"container":{"name":"container","type":"\u001bopenstack.objectstorage.container","title":"OpenStack Swift object-storage container","desc":"Storage container within a Swift account, holding objects along with its own read/write ACLs, storage policy, and versioning settings. The name field selects the container, for example openstack.objectstorage.container(name: \"backups\"). The public predicate reports whether the read ACL grants unauthenticated read access (the ACL contains \".r:*\"), the key check for unintended data exposure.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"object":{"name":"object","type":"\u001bopenstack.objectstorage.object","title":"OpenStack Swift object stored in a container","desc":"Individual object within a Swift container, exposing its size, content type, MD5/ETag hash, and last-modification time. Selected by container and object name, for example openstack.objectstorage.object(containerName: \"backups\", name: \"db.sql\").","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.objectstorage.account":{"id":"openstack.objectstorage.account","name":"openstack.objectstorage.account","fields":{"bytesUsed":{"name":"bytesUsed","type":"\u0005","is_mandatory":true,"title":"Total bytes stored in this account","provider":"go.mondoo.com/mql/providers/openstack"},"containerCount":{"name":"containerCount","type":"\u0005","is_mandatory":true,"title":"Number of containers","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Account identifier (Swift account URL path, e.g. AUTH_\u003cproject_id\u003e)","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Free-form account metadata (X-Account-Meta-* headers, without the prefix)","provider":"go.mondoo.com/mql/providers/openstack"},"objectCount":{"name":"objectCount","type":"\u0005","is_mandatory":true,"title":"Total number of objects across all containers","provider":"go.mondoo.com/mql/providers/openstack"},"quotaBytes":{"name":"quotaBytes","type":"\u0005","is_mandatory":true,"title":"Account-level byte quota (-1 when unset)","provider":"go.mondoo.com/mql/providers/openstack"},"tempUrlKeySet":{"name":"tempUrlKeySet","type":"\u0004","is_mandatory":true,"title":"Whether an X-Account-Meta-Temp-URL-Key is configured (presence only; value not exposed)","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Swift object-storage account","desc":"Account-level totals for a scoped project's Swift object storage, aggregating byte usage, container count, and object count across every container. There is one account per scoped project. Compare quotaBytes against bytesUsed for capacity planning, and check tempUrlKeySet to confirm whether a temporary-URL signing key is configured on the account.","private":true,"min_provider_version":"13.0.1","defaults":"bytesUsed containerCount objectCount","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.objectstorage.container":{"id":"openstack.objectstorage.container","name":"openstack.objectstorage.container","fields":{"bytes":{"name":"bytes","type":"\u0005","is_mandatory":true,"title":"Total bytes stored in the container","provider":"go.mondoo.com/mql/providers/openstack"},"created":{"name":"created","type":"\t","title":"Creation timestamp (derived from the container's X-Timestamp header)","min_provider_version":"13.6.1","provider":"go.mondoo.com/mql/providers/openstack"},"historyLocation":{"name":"historyLocation","type":"\u0007","title":"Container that records overwritten/deleted object versions (X-History-Location); empty when history is disabled","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","title":"Free-form container metadata (X-Container-Meta-* headers, without the prefix)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Container name (also acts as identifier within the account)","provider":"go.mondoo.com/mql/providers/openstack"},"objectCount":{"name":"objectCount","type":"\u0005","is_mandatory":true,"title":"Number of objects in the container","provider":"go.mondoo.com/mql/providers/openstack"},"objects":{"name":"objects","type":"\u0019\u001bopenstack.objectstorage.object","title":"Objects in this container (lazy; full listing can be expensive)","provider":"go.mondoo.com/mql/providers/openstack"},"public":{"name":"public","type":"\u0004","title":"Whether the container's read ACL grants unauthenticated read access (i.e. contains \".r:*\")","provider":"go.mondoo.com/mql/providers/openstack"},"readACL":{"name":"readACL","type":"\u0019\u0007","title":"Read ACL entries (X-Container-Read; e.g. \".r:*\" means publicly readable)","provider":"go.mondoo.com/mql/providers/openstack"},"storagePolicy":{"name":"storagePolicy","type":"\u0007","title":"Storage policy assigned to the container","provider":"go.mondoo.com/mql/providers/openstack"},"versionsLocation":{"name":"versionsLocation","type":"\u0007","title":"Container that stores prior versions of objects (X-Versions-Location); empty when versioning is disabled","provider":"go.mondoo.com/mql/providers/openstack"},"writeACL":{"name":"writeACL","type":"\u0019\u0007","title":"Write ACL entries (X-Container-Write)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"name","type":"\u0007","optional":true}]},"title":"OpenStack Swift object-storage container","desc":"Storage container within a Swift account, holding objects along with its own read/write ACLs, storage policy, and versioning settings. The name field selects the container, for example openstack.objectstorage.container(name: \"backups\"). The public predicate reports whether the read ACL grants unauthenticated read access (the ACL contains \".r:*\"), the key check for unintended data exposure.","private":true,"min_provider_version":"13.0.1","defaults":"name objectCount bytes public","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.objectstorage.object":{"id":"openstack.objectstorage.object","name":"openstack.objectstorage.object","fields":{"bytes":{"name":"bytes","type":"\u0005","is_mandatory":true,"title":"Object size in bytes","provider":"go.mondoo.com/mql/providers/openstack"},"container":{"name":"container","type":"\u001bopenstack.objectstorage.container","title":"Container that holds this object","provider":"go.mondoo.com/mql/providers/openstack"},"containerName":{"name":"containerName","type":"\u0007","is_mandatory":true,"title":"Name of the container that holds this object","provider":"go.mondoo.com/mql/providers/openstack"},"contentType":{"name":"contentType","type":"\u0007","is_mandatory":true,"title":"MIME content type","provider":"go.mondoo.com/mql/providers/openstack"},"hash":{"name":"hash","type":"\u0007","is_mandatory":true,"title":"ETag / MD5 hash of the object body","provider":"go.mondoo.com/mql/providers/openstack"},"lastModified":{"name":"lastModified","type":"\t","is_mandatory":true,"title":"Last modification timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Object name (path within the container)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"containerName","type":"\u0007","optional":true},{"name":"name","type":"\u0007","optional":true}]},"title":"OpenStack Swift object stored in a container","desc":"Individual object within a Swift container, exposing its size, content type, MD5/ETag hash, and last-modification time. Selected by container and object name, for example openstack.objectstorage.object(containerName: \"backups\", name: \"db.sql\").","private":true,"min_provider_version":"13.0.1","defaults":"name contentType bytes","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.octavia":{"id":"openstack.octavia","fields":{"healthMonitor":{"name":"healthMonitor","type":"\u001bopenstack.octavia.healthMonitor","title":"OpenStack Octavia health monitor","desc":"Probe configuration Octavia uses to test the health of a pool's backend members and remove failing ones from rotation. Query it to audit the probe type, interval and timeout, retry thresholds, and the HTTP method, path, and expected response codes used by HTTP and HTTPS probes. Select one by its UUID, for example `openstack.octavia.healthMonitor(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"l7Policy":{"name":"l7Policy","type":"\u001bopenstack.octavia.l7Policy","title":"OpenStack Octavia L7 policy","desc":"Layer-7 policy on a listener that inspects HTTP requests and, when all of its rules match, redirects them to a pool or URL or rejects them. Query it to audit the action taken, its evaluation position among sibling policies, any redirect target, and the match rules that trigger it. Select one by its UUID, for example `openstack.octavia.l7Policy(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"l7Rule":{"name":"l7Rule","type":"\u001bopenstack.octavia.l7Rule","title":"OpenStack Octavia L7 match rule","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"listener":{"name":"listener","type":"\u001bopenstack.octavia.listener","title":"OpenStack Octavia listener","desc":"Frontend that binds a protocol and port on a load balancer's virtual IP and forwards matching traffic to a default pool or through L7 policies. Query it to audit which ports accept connections, whether traffic is TLS-terminated and with which ciphers, versions, and client authentication mode, and how far the source is restricted through allowedCidrs. The openToWorld field is true when the listener accepts connections from any source. Select one by its UUID, for example `openstack.octavia.listener(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"loadBalancer":{"name":"loadBalancer","type":"\u001bopenstack.octavia.loadBalancer","title":"OpenStack Octavia load balancer","desc":"Load balancer fronting backend pools through Octavia, the OpenStack load-balancing service. Query it to audit public reachability, TLS enforcement across its listeners, the VIP's network and subnet placement, and the provider serving traffic (amphora, ovn). Select one by its UUID, for example `openstack.octavia.loadBalancer(id: \"8f8a...\")`. The exposure field reports whether the VIP is reachable from the internet and which listeners are open to the world, and enforcesTls is true only when every listener uses an encrypted protocol.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"member":{"name":"member","type":"\u001bopenstack.octavia.member","title":"OpenStack Octavia pool member","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"pool":{"name":"pool","type":"\u001bopenstack.octavia.pool","title":"OpenStack Octavia backend pool","desc":"Group of backend members that a listener load-balances across using a selection algorithm. Query it to audit the algorithm in use, whether backend connections are encrypted (tlsEnabled with its ciphers and versions), the session persistence policy, and the health monitor guarding the members. Select one by its UUID, for example `openstack.octavia.pool(id: \"...\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.octavia.healthMonitor":{"id":"openstack.octavia.healthMonitor","name":"openstack.octavia.healthMonitor","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the health monitor is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"delay":{"name":"delay","type":"\u0005","is_mandatory":true,"title":"Seconds between probes","provider":"go.mondoo.com/mql/providers/openstack"},"domainName":{"name":"domainName","type":"\u0007","is_mandatory":true,"title":"HTTP Host header used by HTTP/HTTPS probes","provider":"go.mondoo.com/mql/providers/openstack"},"expectedCodes":{"name":"expectedCodes","type":"\u0007","is_mandatory":true,"title":"Expected HTTP response codes (e.g. \"200\", \"200,201,202\", \"200-299\")","provider":"go.mondoo.com/mql/providers/openstack"},"httpMethod":{"name":"httpMethod","type":"\u0007","is_mandatory":true,"title":"HTTP method used by HTTP/HTTPS probes (GET, HEAD, POST, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"httpVersion":{"name":"httpVersion","type":"\u0007","is_mandatory":true,"title":"HTTP version used by HTTP/HTTPS probes (1.0, 1.1)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Health monitor ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"maxRetries":{"name":"maxRetries","type":"\u0005","is_mandatory":true,"title":"Allowed connection failures before a member is marked unhealthy (1-10)","provider":"go.mondoo.com/mql/providers/openstack"},"maxRetriesDown":{"name":"maxRetriesDown","type":"\u0005","is_mandatory":true,"title":"Allowed connection failures before a member is marked DOWN (1-10)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Health monitor name","provider":"go.mondoo.com/mql/providers/openstack"},"operatingStatus":{"name":"operatingStatus","type":"\u0007","is_mandatory":true,"title":"Operating status (ONLINE, OFFLINE, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"pools":{"name":"pools","type":"\u0019\u001bopenstack.octavia.pool","title":"Pools watched by this health monitor; usually 1","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this health monitor","provider":"go.mondoo.com/mql/providers/openstack"},"provisioningStatus":{"name":"provisioningStatus","type":"\u0007","is_mandatory":true,"title":"Provisioning status (ACTIVE, PENDING_*, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the health monitor itself","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"timeout":{"name":"timeout","type":"\u0005","is_mandatory":true,"title":"Probe connection timeout in seconds (must be \u003c delay)","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Probe type (PING, TCP, HTTP, HTTPS, TLS-HELLO, UDP-CONNECT, SCTP)","provider":"go.mondoo.com/mql/providers/openstack"},"urlPath":{"name":"urlPath","type":"\u0007","is_mandatory":true,"title":"HTTP path probed (must start with /)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Octavia health monitor","desc":"Probe configuration Octavia uses to test the health of a pool's backend members and remove failing ones from rotation. Query it to audit the probe type, interval and timeout, retry thresholds, and the HTTP method, path, and expected response codes used by HTTP and HTTPS probes. Select one by its UUID, for example `openstack.octavia.healthMonitor(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name type delay timeout","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.octavia.l7Policy":{"id":"openstack.octavia.l7Policy","name":"openstack.octavia.l7Policy","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action to take when all rules match (REDIRECT_PREFIX, REDIRECT_TO_POOL, REDIRECT_TO_URL, REJECT)","provider":"go.mondoo.com/mql/providers/openstack"},"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the policy is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"L7 policy ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"listener":{"name":"listener","type":"\u001bopenstack.octavia.listener","title":"Listener this policy is attached to","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"L7 policy name","provider":"go.mondoo.com/mql/providers/openstack"},"operatingStatus":{"name":"operatingStatus","type":"\u0007","is_mandatory":true,"title":"Operating status (ONLINE, OFFLINE, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"position":{"name":"position","type":"\u0005","is_mandatory":true,"title":"Evaluation position relative to other policies on the same listener","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this policy","provider":"go.mondoo.com/mql/providers/openstack"},"provisioningStatus":{"name":"provisioningStatus","type":"\u0007","is_mandatory":true,"title":"Provisioning status (ACTIVE, PENDING_*, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"redirectHttpCode":{"name":"redirectHttpCode","type":"\u0005","is_mandatory":true,"title":"HTTP response code used with REDIRECT_TO_URL or REDIRECT_PREFIX","provider":"go.mondoo.com/mql/providers/openstack"},"redirectPool":{"name":"redirectPool","type":"\u001bopenstack.octavia.pool","title":"Pool requests are redirected to when action is REDIRECT_TO_POOL; null otherwise","provider":"go.mondoo.com/mql/providers/openstack"},"redirectPrefix":{"name":"redirectPrefix","type":"\u0007","is_mandatory":true,"title":"URL prefix when action is REDIRECT_PREFIX","provider":"go.mondoo.com/mql/providers/openstack"},"redirectUrl":{"name":"redirectUrl","type":"\u0007","is_mandatory":true,"title":"URL when action is REDIRECT_TO_URL","provider":"go.mondoo.com/mql/providers/openstack"},"rules":{"name":"rules","type":"\u0019\u001bopenstack.octavia.l7Rule","title":"Match rules; the policy fires when ALL rules match","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Octavia L7 policy","desc":"Layer-7 policy on a listener that inspects HTTP requests and, when all of its rules match, redirects them to a pool or URL or rejects them. Query it to audit the action taken, its evaluation position among sibling policies, any redirect target, and the match rules that trigger it. Select one by its UUID, for example `openstack.octavia.l7Policy(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name action position provisioningStatus","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.octavia.l7Rule":{"id":"openstack.octavia.l7Rule","name":"openstack.octavia.l7Rule","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the rule is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"compareType":{"name":"compareType","type":"\u0007","is_mandatory":true,"title":"Comparison type (CONTAINS, ENDS_WITH, EQUAL_TO, REGEX, STARTS_WITH)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"L7 rule ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"invert":{"name":"invert","type":"\u0004","is_mandatory":true,"title":"Whether the comparison is inverted (e.g. \"not equal to\")","provider":"go.mondoo.com/mql/providers/openstack"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Comparison key (e.g. cookie name when ruleType is COOKIE); empty when not applicable","provider":"go.mondoo.com/mql/providers/openstack"},"l7Policy":{"name":"l7Policy","type":"\u001bopenstack.octavia.l7Policy","title":"L7 policy this rule belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"operatingStatus":{"name":"operatingStatus","type":"\u0007","is_mandatory":true,"title":"Operating status (ONLINE, OFFLINE, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this rule","provider":"go.mondoo.com/mql/providers/openstack"},"provisioningStatus":{"name":"provisioningStatus","type":"\u0007","is_mandatory":true,"title":"Provisioning status (ACTIVE, PENDING_*, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"ruleType":{"name":"ruleType","type":"\u0007","is_mandatory":true,"title":"Rule type (COOKIE, FILE_TYPE, HEADER, HOST_NAME, PATH, SSL_CONN_HAS_CERT, SSL_VERIFY_RESULT, SSL_DN_FIELD)","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Comparison value (e.g. \"/api/v1\", \".example.com\")","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Octavia L7 match rule","private":true,"min_provider_version":"13.0.1","defaults":"id ruleType compareType value","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.octavia.listener":{"id":"openstack.octavia.listener","name":"openstack.octavia.listener","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the listener is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"allowedCidrs":{"name":"allowedCidrs","type":"\u0019\u0007","is_mandatory":true,"title":"CIDRs allowed to connect to the listener; empty list allows all","provider":"go.mondoo.com/mql/providers/openstack"},"alpnProtocols":{"name":"alpnProtocols","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed ALPN protocols (http/1.0, http/1.1, h2); microversion 2.20+","provider":"go.mondoo.com/mql/providers/openstack"},"clientAuthentication":{"name":"clientAuthentication","type":"\u0007","is_mandatory":true,"title":"TLS client authentication mode (NONE, OPTIONAL, MANDATORY); microversion 2.8+","provider":"go.mondoo.com/mql/providers/openstack"},"clientCATlsContainer":{"name":"clientCATlsContainer","type":"\u001bopenstack.keymanager.container","title":"Barbican container holding the client CA bundle for mTLS; null when not configured","provider":"go.mondoo.com/mql/providers/openstack"},"clientCRLContainer":{"name":"clientCRLContainer","type":"\u001bopenstack.keymanager.container","title":"Barbican container holding the client CRL list; null when not configured","provider":"go.mondoo.com/mql/providers/openstack"},"connectionLimit":{"name":"connectionLimit","type":"\u0005","is_mandatory":true,"title":"Maximum simultaneous connections allowed; -1 means unlimited","provider":"go.mondoo.com/mql/providers/openstack"},"defaultPool":{"name":"defaultPool","type":"\u001bopenstack.octavia.pool","title":"Default backend pool for traffic on this listener; null when no default pool is set","provider":"go.mondoo.com/mql/providers/openstack"},"defaultTlsContainer":{"name":"defaultTlsContainer","type":"\u001bopenstack.keymanager.container","title":"Barbican container holding the listener's default TLS material; null when not set or when the ref points at a bare Barbican secret","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"hstsIncludeSubdomains":{"name":"hstsIncludeSubdomains","type":"\u0004","is_mandatory":true,"title":"Whether HSTS includeSubDomains is enabled (microversion 2.27+)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Listener ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"insertHeaders":{"name":"insertHeaders","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Headers Octavia inserts before forwarding to the backend (e.g. X-Forwarded-For)","provider":"go.mondoo.com/mql/providers/openstack"},"l7Policies":{"name":"l7Policies","type":"\u0019\u001bopenstack.octavia.l7Policy","title":"L7 policies attached to this listener","provider":"go.mondoo.com/mql/providers/openstack"},"loadBalancer":{"name":"loadBalancer","type":"\u001bopenstack.octavia.loadBalancer","title":"Load balancer this listener is attached to","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Listener name","provider":"go.mondoo.com/mql/providers/openstack"},"openToWorld":{"name":"openToWorld","type":"\u0004","title":"Whether the listener accepts connections from any source (allowedCidrs is empty or contains a public CIDR)","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this listener","provider":"go.mondoo.com/mql/providers/openstack"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol (TCP, SCTP, UDP, HTTP, HTTPS, TERMINATED_HTTPS, PROMETHEUS)","provider":"go.mondoo.com/mql/providers/openstack"},"protocolPort":{"name":"protocolPort","type":"\u0005","is_mandatory":true,"title":"Listening port (1-65535)","provider":"go.mondoo.com/mql/providers/openstack"},"provisioningStatus":{"name":"provisioningStatus","type":"\u0007","is_mandatory":true,"title":"Provisioning status (ACTIVE, PENDING_*, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"sniContainers":{"name":"sniContainers","type":"\u0019\u001bopenstack.keymanager.container","title":"Barbican containers used for SNI; empty when SNI is not configured","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"timeoutClientData":{"name":"timeoutClientData","type":"\u0005","is_mandatory":true,"title":"Frontend client inactivity timeout in milliseconds","provider":"go.mondoo.com/mql/providers/openstack"},"timeoutMemberConnect":{"name":"timeoutMemberConnect","type":"\u0005","is_mandatory":true,"title":"Backend member connection timeout in milliseconds","provider":"go.mondoo.com/mql/providers/openstack"},"timeoutMemberData":{"name":"timeoutMemberData","type":"\u0005","is_mandatory":true,"title":"Backend member inactivity timeout in milliseconds","provider":"go.mondoo.com/mql/providers/openstack"},"timeoutTcpInspect":{"name":"timeoutTcpInspect","type":"\u0005","is_mandatory":true,"title":"Wait time, in milliseconds, for additional TCP packets for content inspection","provider":"go.mondoo.com/mql/providers/openstack"},"tlsCiphers":{"name":"tlsCiphers","type":"\u0007","is_mandatory":true,"title":"OpenSSL-format colon-separated cipher list applied to TLS-terminated listeners","provider":"go.mondoo.com/mql/providers/openstack"},"tlsVersions":{"name":"tlsVersions","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed TLS protocol versions (e.g. TLSv1.2, TLSv1.3); microversion 2.17+","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Octavia listener","desc":"Frontend that binds a protocol and port on a load balancer's virtual IP and forwards matching traffic to a default pool or through L7 policies. Query it to audit which ports accept connections, whether traffic is TLS-terminated and with which ciphers, versions, and client authentication mode, and how far the source is restricted through allowedCidrs. The openToWorld field is true when the listener accepts connections from any source. Select one by its UUID, for example `openstack.octavia.listener(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name protocol protocolPort provisioningStatus","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.octavia.loadBalancer":{"id":"openstack.octavia.loadBalancer","name":"openstack.octavia.loadBalancer","fields":{"additionalVips":{"name":"additionalVips","type":"\u0019\n","is_mandatory":true,"title":"Additional VIPs ([{subnet_id, ip_address}]); microversion 2.26+","provider":"go.mondoo.com/mql/providers/openstack"},"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the load balancer is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"availabilityZone":{"name":"availabilityZone","type":"\u0007","is_mandatory":true,"title":"Octavia availability zone; empty when not specified","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"enforcesTls":{"name":"enforcesTls","type":"\u0004","title":"Whether every listener uses an encrypted protocol","desc":"True when no listener uses a plaintext protocol (HTTP, TCP, UDP, SCTP, or PROMETHEUS). A load balancer with no listeners has no plaintext exposure and is reported as enforcing; pair with `exposure.internetReachable` to scope an audit to internet-facing load balancers.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"exposure":{"name":"exposure","type":"\u001bopenstack.octavia.loadBalancer.exposure","title":"Internet-exposure summary for this load balancer (public reachability plus the listeners open to the world)","provider":"go.mondoo.com/mql/providers/openstack"},"flavorId":{"name":"flavorId","type":"\u0007","is_mandatory":true,"title":"Octavia flavor ID; empty when no flavor is set","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Load balancer ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"listeners":{"name":"listeners","type":"\u0019\u001bopenstack.octavia.listener","title":"Listeners attached to this load balancer","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Load balancer name","provider":"go.mondoo.com/mql/providers/openstack"},"operatingStatus":{"name":"operatingStatus","type":"\u0007","is_mandatory":true,"title":"Operating status (ONLINE, OFFLINE, DEGRADED, ERROR, NO_MONITOR, DRAINING)","provider":"go.mondoo.com/mql/providers/openstack"},"pools":{"name":"pools","type":"\u0019\u001bopenstack.octavia.pool","title":"Pools attached to this load balancer","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this load balancer","provider":"go.mondoo.com/mql/providers/openstack"},"provider":{"name":"provider","type":"\u0007","is_mandatory":true,"title":"Octavia provider (amphora, ovn, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"provisioningStatus":{"name":"provisioningStatus","type":"\u0007","is_mandatory":true,"title":"Provisioning status (ACTIVE, PENDING_CREATE, PENDING_UPDATE, PENDING_DELETE, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"vipAddress":{"name":"vipAddress","type":"\u0007","is_mandatory":true,"title":"Virtual IP address","provider":"go.mondoo.com/mql/providers/openstack"},"vipNetwork":{"name":"vipNetwork","type":"\u001bopenstack.network","title":"Neutron network the VIP is allocated on","provider":"go.mondoo.com/mql/providers/openstack"},"vipPort":{"name":"vipPort","type":"\u001bopenstack.port","title":"Neutron port hosting the VIP; null when no port is associated yet","provider":"go.mondoo.com/mql/providers/openstack"},"vipSubnet":{"name":"vipSubnet","type":"\u001bopenstack.subnet","title":"Neutron subnet the VIP is allocated from","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Octavia load balancer","desc":"Load balancer fronting backend pools through Octavia, the OpenStack load-balancing service. Query it to audit public reachability, TLS enforcement across its listeners, the VIP's network and subnet placement, and the provider serving traffic (amphora, ovn). Select one by its UUID, for example `openstack.octavia.loadBalancer(id: \"8f8a...\")`. The exposure field reports whether the VIP is reachable from the internet and which listeners are open to the world, and enforcesTls is true only when every listener uses an encrypted protocol.","private":true,"min_provider_version":"13.0.1","defaults":"id name provisioningStatus operatingStatus vipAddress","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.octavia.loadBalancer.exposure":{"id":"openstack.octavia.loadBalancer.exposure","name":"openstack.octavia.loadBalancer.exposure","fields":{"floatingIps":{"name":"floatingIps","type":"\u0019\u001bopenstack.floatingIp","is_mandatory":true,"title":"Floating (public) IPs mapped to the VIP port","provider":"go.mondoo.com/mql/providers/openstack"},"internetReachable":{"name":"internetReachable","type":"\u0004","is_mandatory":true,"title":"Whether the load balancer is reachable from the internet (publicly accessible and at least one listener is open to the world)","provider":"go.mondoo.com/mql/providers/openstack"},"listenersOpenToWorld":{"name":"listenersOpenToWorld","type":"\u0019\u001bopenstack.octavia.listener","is_mandatory":true,"title":"Listeners that accept connections from any source (allowedCidrs is empty or contains a public CIDR)","provider":"go.mondoo.com/mql/providers/openstack"},"publiclyAccessible":{"name":"publiclyAccessible","type":"\u0004","is_mandatory":true,"title":"Whether the VIP has a public edge: it sits on an external network, or a floating IP is mapped to it","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Octavia load balancer internet exposure","desc":"Summarizes whether a load balancer is reachable from the public internet and, when it is, the listeners that accept traffic from any source. A load balancer is publicly accessible when its VIP sits on an external network or has a floating IP; internetReachable additionally requires at least one listener open to the world (an empty or public allowedCidrs list).","private":true,"min_provider_version":"13.4.2","defaults":"internetReachable publiclyAccessible","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.octavia.member":{"id":"openstack.octavia.member","name":"openstack.octavia.member","fields":{"address":{"name":"address","type":"\u0007","is_mandatory":true,"title":"Backend IP address","provider":"go.mondoo.com/mql/providers/openstack"},"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the member is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"backup":{"name":"backup","type":"\u0004","is_mandatory":true,"title":"Whether this is a backup member (only receives traffic when all non-backup members are down)","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Member ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"monitorAddress":{"name":"monitorAddress","type":"\u0007","is_mandatory":true,"title":"Alternate IP address used for health monitoring; empty falls back to address","provider":"go.mondoo.com/mql/providers/openstack"},"monitorPort":{"name":"monitorPort","type":"\u0005","is_mandatory":true,"title":"Alternate port used for health monitoring; 0 falls back to protocolPort","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Member name","provider":"go.mondoo.com/mql/providers/openstack"},"operatingStatus":{"name":"operatingStatus","type":"\u0007","is_mandatory":true,"title":"Operating status (ONLINE, OFFLINE, DEGRADED, ERROR, NO_MONITOR)","provider":"go.mondoo.com/mql/providers/openstack"},"pool":{"name":"pool","type":"\u001bopenstack.octavia.pool","title":"Pool this member belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this member","provider":"go.mondoo.com/mql/providers/openstack"},"protocolPort":{"name":"protocolPort","type":"\u0005","is_mandatory":true,"title":"Backend protocol port (1-65535)","provider":"go.mondoo.com/mql/providers/openstack"},"provisioningStatus":{"name":"provisioningStatus","type":"\u0007","is_mandatory":true,"title":"Provisioning status (ACTIVE, PENDING_*, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"subnet":{"name":"subnet","type":"\u001bopenstack.subnet","title":"Subnet the member's address lives on; null when no subnet is associated","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags (microversion 2.5+)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"weight":{"name":"weight","type":"\u0005","is_mandatory":true,"title":"Member weight (relative weight in the load-balancing algorithm); 0 means standby","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Octavia pool member","private":true,"min_provider_version":"13.0.1","defaults":"id name address protocolPort weight","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.octavia.pool":{"id":"openstack.octavia.pool","name":"openstack.octavia.pool","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the pool is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"alpnProtocols":{"name":"alpnProtocols","type":"\u0019\u0007","is_mandatory":true,"title":"ALPN protocols for backend TLS (microversion 2.24+)","provider":"go.mondoo.com/mql/providers/openstack"},"caTlsContainer":{"name":"caTlsContainer","type":"\u001bopenstack.keymanager.container","title":"Barbican container holding the CA bundle used to verify backend TLS; null when not set","provider":"go.mondoo.com/mql/providers/openstack"},"clientTlsContainer":{"name":"clientTlsContainer","type":"\u001bopenstack.keymanager.container","title":"Barbican container holding the client cert/key bundle for backend mTLS; null when not set","provider":"go.mondoo.com/mql/providers/openstack"},"crlContainer":{"name":"crlContainer","type":"\u001bopenstack.keymanager.container","title":"Barbican container holding the CRL list for backend TLS; null when not set","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"healthMonitor":{"name":"healthMonitor","type":"\u001bopenstack.octavia.healthMonitor","title":"Health monitor watching this pool; null when no monitor is attached","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Pool ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"lbAlgorithm":{"name":"lbAlgorithm","type":"\u0007","is_mandatory":true,"title":"Load-balancing algorithm (ROUND_ROBIN, LEAST_CONNECTIONS, SOURCE_IP, SOURCE_IP_PORT)","provider":"go.mondoo.com/mql/providers/openstack"},"listeners":{"name":"listeners","type":"\u0019\u001bopenstack.octavia.listener","title":"Listeners that use this pool as their default; usually 0 or 1","provider":"go.mondoo.com/mql/providers/openstack"},"loadBalancer":{"name":"loadBalancer","type":"\u001bopenstack.octavia.loadBalancer","title":"Load balancer this pool is attached to; null when standalone","provider":"go.mondoo.com/mql/providers/openstack"},"members":{"name":"members","type":"\u0019\u001bopenstack.octavia.member","title":"Members in this pool","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Pool name","provider":"go.mondoo.com/mql/providers/openstack"},"operatingStatus":{"name":"operatingStatus","type":"\u0007","is_mandatory":true,"title":"Operating status (ONLINE, OFFLINE, DEGRADED, ERROR, NO_MONITOR, DRAINING)","provider":"go.mondoo.com/mql/providers/openstack"},"persistence":{"name":"persistence","type":"\n","is_mandatory":true,"title":"Session persistence config ({type, cookie_name, persistence_timeout, persistence_granularity}); empty when persistence is disabled","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this pool","provider":"go.mondoo.com/mql/providers/openstack"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Pool protocol (TCP, UDP, HTTP, HTTPS, PROXY, PROXYV2, SCTP)","provider":"go.mondoo.com/mql/providers/openstack"},"provider":{"name":"provider","type":"\u0007","is_mandatory":true,"title":"Octavia provider serving this pool","provider":"go.mondoo.com/mql/providers/openstack"},"provisioningStatus":{"name":"provisioningStatus","type":"\u0007","is_mandatory":true,"title":"Provisioning status (ACTIVE, PENDING_*, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"subnet":{"name":"subnet","type":"\u001bopenstack.subnet","title":"Subnet the pool's members live on","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"tlsCiphers":{"name":"tlsCiphers","type":"\u0007","is_mandatory":true,"title":"OpenSSL-format colon-separated cipher list for backend TLS; microversion 2.15+","provider":"go.mondoo.com/mql/providers/openstack"},"tlsEnabled":{"name":"tlsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether backend connections use TLS; microversion 2.8+","provider":"go.mondoo.com/mql/providers/openstack"},"tlsVersions":{"name":"tlsVersions","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed TLS protocol versions for backend TLS; microversion 2.17+","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Octavia backend pool","desc":"Group of backend members that a listener load-balances across using a selection algorithm. Query it to audit the algorithm in use, whether backend connections are encrypted (tlsEnabled with its ciphers and versions), the session persistence policy, and the health monitor guarding the members. Select one by its UUID, for example `openstack.octavia.pool(id: \"...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name lbAlgorithm protocol provisioningStatus","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.orchestration":{"id":"openstack.orchestration","fields":{"stack":{"name":"stack","type":"\u001bopenstack.orchestration.stack","title":"OpenStack Heat orchestration stack","desc":"Set of OpenStack resources deployed and managed together from a Heat template (OpenStack's infrastructure-as-code). Select a stack by its `id`. The `status` field tracks deployment and drift state (for example `CREATE_COMPLETE`, `UPDATE_FAILED`, or `ROLLBACK_COMPLETE`), and `disableRollback` flags stacks that will not roll back on failure, leaving partially created resources behind.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.orchestration.stack":{"id":"openstack.orchestration.stack","name":"openstack.orchestration.stack","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"disableRollback":{"name":"disableRollback","type":"\u0004","title":"Whether rollback on failure is disabled","desc":"True leaves a failed stack in place instead of rolling back; failed deployments then linger with partially created resources.","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Stack ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Stack name","provider":"go.mondoo.com/mql/providers/openstack"},"parameters":{"name":"parameters","type":"\u001a\u0007\u0007","title":"Input parameters the stack was deployed with","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Stack status (for example `CREATE_COMPLETE`, `UPDATE_FAILED`, or `ROLLBACK_COMPLETE`)","provider":"go.mondoo.com/mql/providers/openstack"},"statusReason":{"name":"statusReason","type":"\u0007","is_mandatory":true,"title":"Human-readable reason for the current status","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags applied to the stack","provider":"go.mondoo.com/mql/providers/openstack"},"timeoutMinutes":{"name":"timeoutMinutes","type":"\u0005","title":"Stack timeout in minutes; 0 when no timeout is set","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Heat orchestration stack","desc":"Set of OpenStack resources deployed and managed together from a Heat template (OpenStack's infrastructure-as-code). Select a stack by its `id`. The `status` field tracks deployment and drift state (for example `CREATE_COMPLETE`, `UPDATE_FAILED`, or `ROLLBACK_COMPLETE`), and `disableRollback` flags stacks that will not roll back on failure, leaving partially created resources behind.","private":true,"min_provider_version":"13.1.4","defaults":"id name status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.placement":{"id":"openstack.placement","fields":{"resourceProvider":{"name":"resourceProvider","type":"\u001bopenstack.placement.resourceProvider","title":"OpenStack Placement resource provider","desc":"Source of consumable inventory in the Placement service, such as a compute node, a shared storage pool, or an accelerator device (GPU/FPGA). Select a provider by its `id` (UUID). The `inventories` and `traits` fields audit accelerator capacity, for example the `VGPU` and `PGPU` resource classes and `HW_GPU_*` traits, and how much of each class is already allocated. The `parent` and `root` fields traverse nested provider trees, such as a compute node with child GPU providers.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.placement.resourceProvider":{"id":"openstack.placement.resourceProvider","name":"openstack.placement.resourceProvider","fields":{"aggregates":{"name":"aggregates","type":"\u0019\u0007","title":"Placement aggregate UUIDs this provider belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"generation":{"name":"generation","type":"\u0005","is_mandatory":true,"title":"Consistency-view generation marker (increments as the provider's inventory/allocations change)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource provider ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"inventories":{"name":"inventories","type":"\u0019\n","title":"Inventory lines, one per resource class","desc":"Each entry has `resource_class` (for example `VCPU`, `MEMORY_MB`, `DISK_GB`, `VGPU`, `PGPU`, or a `CUSTOM_*` device class) plus `total`, `reserved`, `allocation_ratio`, `min_unit`, `max_unit`, `step_size`, and `used` (the amount of that class currently allocated against this provider).","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource provider name (often the compute host name, or a device name for child providers)","provider":"go.mondoo.com/mql/providers/openstack"},"parent":{"name":"parent","type":"\u001bopenstack.placement.resourceProvider","title":"Immediate parent provider in a nested tree; null for a top-level provider","provider":"go.mondoo.com/mql/providers/openstack"},"root":{"name":"root","type":"\u001bopenstack.placement.resourceProvider","title":"Top-most provider in this provider's tree (itself for a top-level provider)","provider":"go.mondoo.com/mql/providers/openstack"},"traits":{"name":"traits","type":"\u0019\u0007","title":"Capability traits advertised by this provider","desc":"Standardized (`HW_GPU_*`, `HW_CPU_*`, `STORAGE_DISK_SSD`, ...) and operator-defined (`CUSTOM_*`) qualitative markers used by the scheduler to place workloads.","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Placement resource provider","desc":"Source of consumable inventory in the Placement service, such as a compute node, a shared storage pool, or an accelerator device (GPU/FPGA). Select a provider by its `id` (UUID). The `inventories` and `traits` fields audit accelerator capacity, for example the `VGPU` and `PGPU` resource classes and `HW_GPU_*` traits, and how much of each class is already allocated. The `parent` and `root` fields traverse nested provider trees, such as a compute node with child GPU providers.","private":true,"min_provider_version":"13.2.2","defaults":"id name generation","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.port":{"id":"openstack.port","name":"openstack.port","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the port is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"allowedAddressPairs":{"name":"allowedAddressPairs","type":"\u0019\n","is_mandatory":true,"title":"Allowed address pairs ([{ip_address, mac_address}])","desc":"Additional IP/MAC pairs the port may send and receive traffic for beyond its fixed IPs. Anti-spoofing does not apply to these, so a wide entry (for example a large CIDR) can bypass it.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"deviceOwner":{"name":"deviceOwner","type":"\u0007","is_mandatory":true,"title":"Device owner (compute:nova, network:router_interface, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"fixedIps":{"name":"fixedIps","type":"\u0019\n","is_mandatory":true,"title":"Fixed IPs ([{subnet_id, ip_address}])","provider":"go.mondoo.com/mql/providers/openstack"},"floatingIps":{"name":"floatingIps","type":"\u0019\u001bopenstack.floatingIp","title":"Floating (public) IPs bound to this port; empty when none are bound","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Port ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"macAddress":{"name":"macAddress","type":"\u0007","is_mandatory":true,"title":"MAC address","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Port name","provider":"go.mondoo.com/mql/providers/openstack"},"network":{"name":"network","type":"\u001bopenstack.network","title":"Network this port belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"portSecurityEnabled":{"name":"portSecurityEnabled","type":"\u0004","is_mandatory":true,"title":"Whether port security is enabled","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this port","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"propagateUplinkStatus":{"name":"propagateUplinkStatus","type":"\u0004","is_mandatory":true,"title":"Whether port uplink status propagation is enabled","provider":"go.mondoo.com/mql/providers/openstack"},"router":{"name":"router","type":"\u001bopenstack.router","title":"Router this port is attached to; null when the port is not a router interface or gateway","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"securityGroups":{"name":"securityGroups","type":"\u0019\u001bopenstack.securityGroup","title":"Security groups attached to the port","provider":"go.mondoo.com/mql/providers/openstack"},"server":{"name":"server","type":"\u001bopenstack.compute.server","title":"Server this port is attached to; null when the port is not bound to a compute instance","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (ACTIVE, DOWN, BUILD)","provider":"go.mondoo.com/mql/providers/openstack"},"subnets":{"name":"subnets","type":"\u0019\u001bopenstack.subnet","title":"Subnets this port has fixed IPs on","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Neutron port","desc":"Virtual network interface attached to a server, router, or other network device, carrying the security posture of that attachment. Select a port by its UUID, for example `openstack.port(id: \"a1b2c3d4-...\")`. The `portSecurityEnabled` flag governs whether MAC/IP anti-spoofing and security group filtering apply at all, `allowedAddressPairs` widens which source addresses bypass that filtering, and `deviceOwner` records what the port is bound to (compute instance, router interface, DHCP agent). Fixed and floating IP bindings, attached security groups, and the owning network, server, router, and project are all reachable from the port.","private":true,"min_provider_version":"13.0.1","defaults":"id name status macAddress","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.project":{"id":"openstack.project","name":"openstack.project","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"domain":{"name":"domain","type":"\u001bopenstack.domain","title":"Domain this project belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the project is enabled","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Project ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"isDomain":{"name":"isDomain","type":"\u0004","is_mandatory":true,"title":"Whether this project acts as a domain","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Project name","provider":"go.mondoo.com/mql/providers/openstack"},"parent":{"name":"parent","type":"\u001bopenstack.project","title":"Parent project; null for top-level projects","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone project (formerly \"tenant\")","desc":"Keystone project that owns and scopes cloud resources such as compute instances, networks, and volumes. Projects are the primary unit of ownership, quota, and access control in OpenStack, so auditing them reveals which tenancies exist, whether they are still enabled, and how they nest beneath domains and parent projects. Select a project by its UUID, for example `openstack.project(id: \"a1b2c3d4-...\")`. The isDomain field distinguishes an ordinary project from one that acts as a domain, and parent is null for top-level projects.","private":true,"min_provider_version":"13.0.1","defaults":"id name enabled","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.qosPolicy":{"id":"openstack.qosPolicy","name":"openstack.qosPolicy","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"QoS policy ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether the policy is the project's default","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"QoS policy name","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this QoS policy","provider":"go.mondoo.com/mql/providers/openstack"},"rules":{"name":"rules","type":"\u0019\n","is_mandatory":true,"title":"Rules attached to this policy","desc":"Rules are heterogeneous; each entry has a `type` key (`bandwidth_limit`, `dscp_marking`, `minimum_bandwidth`, `packet_rate_limit`) plus the type-specific fields (e.g. `max_kbps`, `dscp_mark`, `min_kbps`).","provider":"go.mondoo.com/mql/providers/openstack"},"shared":{"name":"shared","type":"\u0004","is_mandatory":true,"title":"Whether the policy is shared across projects","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Neutron QoS policy","desc":"Quality-of-Service policy that attaches traffic-shaping rules to Neutron ports, networks, and floating IPs. Each policy holds a set of rules (bandwidth limits, DSCP marking, minimum guaranteed bandwidth, and packet-rate limits) exposed through `rules`. The `shared` flag governs whether other projects can attach the policy, and `isDefault` marks the policy that new ports inherit, so both are worth auditing when reviewing tenant traffic controls. Select a policy by its UUID, for example `openstack.qosPolicy(id: \"d1e2f3a4-...\")`.","private":true,"min_provider_version":"13.0.1","defaults":"id name shared isDefault","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.role":{"id":"openstack.role","name":"openstack.role","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"domain":{"name":"domain","type":"\u001bopenstack.domain","title":"Domain this role belongs to; null for global roles","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Role ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name (e.g., admin, member, reader)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone role","desc":"Named permission set that Keystone grants to users or groups on a project or domain, driving what actions an identity may perform. Auditing roles surfaces the privilege vocabulary of the cloud (for example admin, member, and reader) so you can reason about who holds elevated access. A role is selected by its UUID, for example openstack.role(id: \"9fe2ff9ee4384b1894a90878d3e92bab\"). The domain field is null for global roles and set for roles scoped to a single domain.","private":true,"min_provider_version":"13.0.1","defaults":"id name","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.router":{"id":"openstack.router","name":"openstack.router","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the router is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"distributed":{"name":"distributed","type":"\u0004","is_mandatory":true,"title":"Whether the router is distributed (DVR)","provider":"go.mondoo.com/mql/providers/openstack"},"enableSnat":{"name":"enableSnat","type":"\u0004","is_mandatory":true,"title":"Whether source NAT is enabled on the external gateway; false when no external gateway is set","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"externalGatewayInfo":{"name":"externalGatewayInfo","type":"\n","is_mandatory":true,"title":"External gateway info ({network_id, enable_snat, external_fixed_ips})","provider":"go.mondoo.com/mql/providers/openstack"},"externalNetwork":{"name":"externalNetwork","type":"\u001bopenstack.network","title":"External network the router uses for its gateway; null when no external gateway is set","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Router ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Router name","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this router","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"routes":{"name":"routes","type":"\u0019\n","is_mandatory":true,"title":"Static routes ([{destination, nexthop}])","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Operational status","desc":"One of ACTIVE, DOWN, BUILD, or ERROR.","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Neutron router","desc":"A Neutron router that connects tenant networks to each other and to external networks, providing routing, source NAT, and floating-IP gateway services. Query a single router by its UUID, for example openstack.router(id: \"a1b2c3d4-...\"). Security-relevant surface includes externalGatewayInfo and enableSnat (whether tenant traffic egresses through source NAT), the static routes it advertises, and whether admin state is up. The externalNetwork field resolves the external network used for the gateway.","private":true,"min_provider_version":"13.0.1","defaults":"id name status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.securityGroup":{"id":"openstack.securityGroup","name":"openstack.securityGroup","fields":{"allowsPublicIngress":{"name":"allowsPublicIngress","type":"\u0004","title":"Whether any ingress rule permits traffic from a public source (a public CIDR or an unscoped any-source rule)","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Security group ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Security group name","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this security group","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"rule":{"name":"rule","type":"\u001bopenstack.securityGroup.rule","title":"OpenStack Neutron security group rule","desc":"Single ingress or egress rule within a security group, defining the protocol, port range, and remote source or destination that traffic is matched against. Audit rules to find open ports and public exposure: includesPublicSource flags a rule whose source or destination reaches the public internet. A rule scopes its remote endpoint by exactly one of remoteIpPrefix (a CIDR), remoteGroup (another security group), or remoteAddressGroupId (an address group), which determines where the rule applies.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bopenstack.securityGroup.rule","is_mandatory":true,"title":"Embedded rules","provider":"go.mondoo.com/mql/providers/openstack"},"stateful":{"name":"stateful","type":"\u0004","is_mandatory":true,"title":"Whether the security group is stateful (tracks connection state); stateless groups require explicit return-traffic rules","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Neutron security group","desc":"Set of firewall rules that govern ingress and egress traffic for the ports and instances the group is attached to. Audit security groups to find overly permissive access, such as rules that expose services to the public internet. The stateful field distinguishes connection-tracking groups from stateless ones that require explicit return-traffic rules, and allowsPublicIngress flags any group whose ingress rules reach a public source. Select a group by its UUID, for example openstack.securityGroup(id: \"9d6f...\").","private":true,"min_provider_version":"13.0.1","defaults":"id name","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.securityGroup.rule":{"id":"openstack.securityGroup.rule","name":"openstack.securityGroup.rule","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"direction":{"name":"direction","type":"\u0007","is_mandatory":true,"title":"Direction (ingress, egress)","provider":"go.mondoo.com/mql/providers/openstack"},"ethertype":{"name":"ethertype","type":"\u0007","is_mandatory":true,"title":"Ethertype (IPv4, IPv6)","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"includesPublicSource":{"name":"includesPublicSource","type":"\u0004","title":"Whether the rule's source reaches the public internet","desc":"True when remoteIpPrefix is a public CIDR (a broad block such as 0.0.0.0/0 or ::/0, excluding private and reserved ranges) or when the rule is unscoped (no remote IP prefix, no remote group, and no remote address group), which Neutron treats as any source. A rule scoped to a remote security group or remote address group is not public. Direction-agnostic, so it also classifies egress destinations.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"portRangeMax":{"name":"portRangeMax","type":"\u0005","is_mandatory":true,"title":"Upper bound of the matched port range (0 when not set)","provider":"go.mondoo.com/mql/providers/openstack"},"portRangeMin":{"name":"portRangeMin","type":"\u0005","is_mandatory":true,"title":"Lower bound of the matched port range (0 when not set)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this security group rule","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol (tcp, udp, icmp, ...; empty matches any)","provider":"go.mondoo.com/mql/providers/openstack"},"remoteAddressGroupId":{"name":"remoteAddressGroupId","type":"\u0007","is_mandatory":true,"title":"Remote address group ID the rule matches; empty when matched by IP prefix or remote security group instead","min_provider_version":"13.5.2","provider":"go.mondoo.com/mql/providers/openstack"},"remoteGroup":{"name":"remoteGroup","type":"\u001bopenstack.securityGroup","title":"Remote security group the rule matches; null when matched by IP prefix instead","provider":"go.mondoo.com/mql/providers/openstack"},"remoteIpPrefix":{"name":"remoteIpPrefix","type":"\u0007","is_mandatory":true,"title":"Remote IP prefix (CIDR; empty when matched by remote group instead)","provider":"go.mondoo.com/mql/providers/openstack"},"securityGroup":{"name":"securityGroup","type":"\u001bopenstack.securityGroup","title":"Security group this rule belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Neutron security group rule","desc":"Single ingress or egress rule within a security group, defining the protocol, port range, and remote source or destination that traffic is matched against. Audit rules to find open ports and public exposure: includesPublicSource flags a rule whose source or destination reaches the public internet. A rule scopes its remote endpoint by exactly one of remoteIpPrefix (a CIDR), remoteGroup (another security group), or remoteAddressGroupId (an address group), which determines where the rule applies.","private":true,"min_provider_version":"13.0.1","defaults":"id direction protocol portRangeMin portRangeMax","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.sharedfilesystem":{"id":"openstack.sharedfilesystem","fields":{"securityService":{"name":"securityService","type":"\u001bopenstack.sharedfilesystem.securityService","title":"OpenStack Manila security service","desc":"Active Directory, LDAP, or Kerberos configuration that share networks authenticate against. Select a service by its `id`. Stored credentials (the bind password) are intentionally not exposed; query `type`, `server`, `domain`, and `user` to audit directory integration.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"share":{"name":"share","type":"\u001bopenstack.sharedfilesystem.share","title":"OpenStack Manila shared file system","desc":"Shared file system (an NFS or CIFS/SMB export) provisioned by Manila. Select a share by its `id`. Query `isPublic`, `shareProto`, and `accessRules` to audit who can reach the share, and `shareNetwork` to see which Neutron network it is attached to.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"shareNetwork":{"name":"shareNetwork","type":"\u001bopenstack.sharedfilesystem.shareNetwork","title":"OpenStack Manila share network","desc":"Binding of Manila shares to a Neutron network and subnet, with the CIDR and segmentation used to reach the share servers. Select a share network by its `id`. Query `network` and `subnet` to trace shares back to their L2/L3 placement.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.sharedfilesystem.securityService":{"id":"openstack.sharedfilesystem.securityService","name":"openstack.sharedfilesystem.securityService","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"dnsIp":{"name":"dnsIp","type":"\u0007","is_mandatory":true,"title":"DNS IP address used to resolve the directory server","provider":"go.mondoo.com/mql/providers/openstack"},"domain":{"name":"domain","type":"\u0007","is_mandatory":true,"title":"Domain the service authenticates against","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Security service ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service name","provider":"go.mondoo.com/mql/providers/openstack"},"ou":{"name":"ou","type":"\u0007","is_mandatory":true,"title":"Organizational unit (OU) within the directory","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns the security service","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Owning project ID","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"server":{"name":"server","type":"\u0007","is_mandatory":true,"title":"Directory server hostname or IP address","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Security service type","desc":"One of `active_directory`, `ldap`, or `kerberos`.","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"Bind/service account user name","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Manila security service","desc":"Active Directory, LDAP, or Kerberos configuration that share networks authenticate against. Select a service by its `id`. Stored credentials (the bind password) are intentionally not exposed; query `type`, `server`, `domain`, and `user` to audit directory integration.","private":true,"min_provider_version":"13.1.4","defaults":"id name type status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.sharedfilesystem.share":{"id":"openstack.sharedfilesystem.share","name":"openstack.sharedfilesystem.share","fields":{"accessRule":{"name":"accessRule","type":"\u001bopenstack.sharedfilesystem.share.accessRule","title":"OpenStack Manila share access rule","desc":"Single rule granting a client access to a share: the access type (IP, user, or certificate), the value it matches, and the level (read-only or read-write). The access key/secret is intentionally not exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"accessRules":{"name":"accessRules","type":"\u0019\u001bopenstack.sharedfilesystem.share.accessRule","title":"Access rules granting clients access to the share","provider":"go.mondoo.com/mql/providers/openstack"},"availabilityZone":{"name":"availabilityZone","type":"\u0007","is_mandatory":true,"title":"Availability zone the share lives in","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"hasReplicas":{"name":"hasReplicas","type":"\u0004","is_mandatory":true,"title":"Whether the share has replicas","provider":"go.mondoo.com/mql/providers/openstack"},"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Backend host serving the share","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Share ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"isPublic":{"name":"isPublic","type":"\u0004","is_mandatory":true,"title":"Whether the share is visible to all projects","provider":"go.mondoo.com/mql/providers/openstack"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"User-defined metadata","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Share name","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns the share","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Owning project ID","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"replicationType":{"name":"replicationType","type":"\u0007","is_mandatory":true,"title":"Replication type; empty when replication is not configured","provider":"go.mondoo.com/mql/providers/openstack"},"shareNetwork":{"name":"shareNetwork","type":"\u001bopenstack.sharedfilesystem.shareNetwork","title":"Network the share is exported on","provider":"go.mondoo.com/mql/providers/openstack"},"shareProto":{"name":"shareProto","type":"\u0007","is_mandatory":true,"title":"Share protocol","desc":"One of `NFS`, `CIFS`, `CEPHFS`, `GLUSTERFS`, `HDFS`, or `MAPRFS`.","provider":"go.mondoo.com/mql/providers/openstack"},"shareType":{"name":"shareType","type":"\u0007","is_mandatory":true,"title":"Share type ID","provider":"go.mondoo.com/mql/providers/openstack"},"shareTypeName":{"name":"shareTypeName","type":"\u0007","is_mandatory":true,"title":"Share type name","provider":"go.mondoo.com/mql/providers/openstack"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"Size of the share in gibibytes","provider":"go.mondoo.com/mql/providers/openstack"},"snapshotId":{"name":"snapshotId","type":"\u0007","is_mandatory":true,"title":"Snapshot ID the share was created from; empty when not created from a snapshot","provider":"go.mondoo.com/mql/providers/openstack"},"snapshotSupport":{"name":"snapshotSupport","type":"\u0004","is_mandatory":true,"title":"Whether the backend supports creating snapshots of the share","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Build/availability status (for example `available`, `creating`, or `error`)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Manila shared file system","desc":"Shared file system (an NFS or CIFS/SMB export) provisioned by Manila. Select a share by its `id`. Query `isPublic`, `shareProto`, and `accessRules` to audit who can reach the share, and `shareNetwork` to see which Neutron network it is attached to.","private":true,"min_provider_version":"13.1.4","defaults":"id name shareProto status size isPublic","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.sharedfilesystem.share.accessRule":{"id":"openstack.sharedfilesystem.share.accessRule","name":"openstack.sharedfilesystem.share.accessRule","fields":{"accessLevel":{"name":"accessLevel","type":"\u0007","is_mandatory":true,"title":"Access level","desc":"Either `rw` (read-write) or `ro` (read-only).","provider":"go.mondoo.com/mql/providers/openstack"},"accessTo":{"name":"accessTo","type":"\u0007","is_mandatory":true,"title":"Value the rule grants access to (for example a CIDR, user name, or common name)","provider":"go.mondoo.com/mql/providers/openstack"},"accessType":{"name":"accessType","type":"\u0007","is_mandatory":true,"title":"Access type","desc":"One of `ip`, `user`, `cert`, or `cephx`.","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Access rule ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"share":{"name":"share","type":"\u001bopenstack.sharedfilesystem.share","title":"Share this rule applies to","provider":"go.mondoo.com/mql/providers/openstack"},"shareId":{"name":"shareId","type":"\u0007","is_mandatory":true,"title":"ID of the share this rule applies to","provider":"go.mondoo.com/mql/providers/openstack"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Rule state (for example `active`, `new`, or `error`)","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"title":"OpenStack Manila share access rule","desc":"Single rule granting a client access to a share: the access type (IP, user, or certificate), the value it matches, and the level (read-only or read-write). The access key/secret is intentionally not exposed.","private":true,"min_provider_version":"13.1.4","defaults":"id accessType accessTo accessLevel state","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.sharedfilesystem.shareNetwork":{"id":"openstack.sharedfilesystem.shareNetwork","name":"openstack.sharedfilesystem.shareNetwork","fields":{"cidr":{"name":"cidr","type":"\u0007","is_mandatory":true,"title":"CIDR of the share network","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Share network ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"ipVersion":{"name":"ipVersion","type":"\u0005","is_mandatory":true,"title":"IP version (4 or 6)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Share network name","provider":"go.mondoo.com/mql/providers/openstack"},"network":{"name":"network","type":"\u001bopenstack.network","title":"Neutron network the share servers attach to","provider":"go.mondoo.com/mql/providers/openstack"},"networkType":{"name":"networkType","type":"\u0007","is_mandatory":true,"title":"Network type (for example `vlan`, `vxlan`, or `flat`)","provider":"go.mondoo.com/mql/providers/openstack"},"neutronNetId":{"name":"neutronNetId","type":"\u0007","is_mandatory":true,"title":"Neutron network ID the share servers attach to","provider":"go.mondoo.com/mql/providers/openstack"},"neutronSubnetId":{"name":"neutronSubnetId","type":"\u0007","is_mandatory":true,"title":"Neutron subnet ID the share servers attach to","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns the share network","provider":"go.mondoo.com/mql/providers/openstack"},"projectId":{"name":"projectId","type":"\u0007","is_mandatory":true,"title":"Owning project ID","desc":"Deprecated in favor of project.","provider":"go.mondoo.com/mql/providers/openstack","maturity":"deprecated"},"segmentationId":{"name":"segmentationId","type":"\u0005","is_mandatory":true,"title":"Segmentation ID (VLAN/VXLAN tag); 0 when not segmented","provider":"go.mondoo.com/mql/providers/openstack"},"subnet":{"name":"subnet","type":"\u001bopenstack.subnet","title":"Neutron subnet the share servers attach to","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Manila share network","desc":"Binding of Manila shares to a Neutron network and subnet, with the CIDR and segmentation used to reach the share servers. Select a share network by its `id`. Query `network` and `subnet` to trace shares back to their L2/L3 placement.","private":true,"min_provider_version":"13.1.4","defaults":"id name networkType cidr","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.subnet":{"id":"openstack.subnet","name":"openstack.subnet","fields":{"allocationPools":{"name":"allocationPools","type":"\u0019\n","is_mandatory":true,"title":"Allocation pools","desc":"IP ranges from which addresses are assigned to ports on this subnet. Each entry is a dict with `start` and `end` keys holding the first and last IP of the pool.","provider":"go.mondoo.com/mql/providers/openstack"},"cidr":{"name":"cidr","type":"\u0007","is_mandatory":true,"title":"CIDR","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"dnsNameservers":{"name":"dnsNameservers","type":"\u0019\u0007","is_mandatory":true,"title":"DNS nameservers advertised by DHCP","provider":"go.mondoo.com/mql/providers/openstack"},"dnsPublishFixedIp":{"name":"dnsPublishFixedIp","type":"\u0004","is_mandatory":true,"title":"Whether fixed IPs assigned from this subnet are published to DNS","provider":"go.mondoo.com/mql/providers/openstack"},"enableDhcp":{"name":"enableDhcp","type":"\u0004","is_mandatory":true,"title":"Whether DHCP is enabled","provider":"go.mondoo.com/mql/providers/openstack"},"gatewayIp":{"name":"gatewayIp","type":"\u0007","is_mandatory":true,"title":"Default gateway IP","provider":"go.mondoo.com/mql/providers/openstack"},"hostRoutes":{"name":"hostRoutes","type":"\u0019\n","is_mandatory":true,"title":"Host routes","desc":"Additional routes advertised to instances through DHCP. Each entry is a dict with `destination` (the target CIDR) and `nexthop` (the gateway IP used to reach it).","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Subnet ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"ipVersion":{"name":"ipVersion","type":"\u0005","is_mandatory":true,"title":"IP version (4 or 6)","provider":"go.mondoo.com/mql/providers/openstack"},"ipv6AddressMode":{"name":"ipv6AddressMode","type":"\u0007","is_mandatory":true,"title":"IPv6 address assignment mode (slaac, dhcpv6-stateful, dhcpv6-stateless; empty for IPv4 or unset)","provider":"go.mondoo.com/mql/providers/openstack"},"ipv6RaMode":{"name":"ipv6RaMode","type":"\u0007","is_mandatory":true,"title":"IPv6 router-advertisement mode (slaac, dhcpv6-stateful, dhcpv6-stateless; empty for IPv4 or unset)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Subnet name","provider":"go.mondoo.com/mql/providers/openstack"},"network":{"name":"network","type":"\u001bopenstack.network","title":"Network this subnet belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this subnet","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/openstack"},"subnetPool":{"name":"subnetPool","type":"\u001bopenstack.subnetPool","title":"Subnet pool this subnet's CIDR was allocated from; null when the CIDR was assigned manually","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Neutron subnet","desc":"IP address range carved out of a Neutron network, defined by its `cidr`, IP version, default gateway, and DHCP behavior. A subnet governs how addresses are handed to ports and which DNS nameservers and host routes instances receive. Selected by ID, for example `openstack.subnet(id: \"a1b2c3d4-...\")`. Query subnets to confirm CIDR sizing, gateway placement, whether DHCP is enabled, and the IPv6 address and router-advertisement modes.","private":true,"min_provider_version":"13.0.1","defaults":"id name cidr","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.subnetPool":{"id":"openstack.subnetPool","name":"openstack.subnetPool","fields":{"addressScopeId":{"name":"addressScopeId","type":"\u0007","is_mandatory":true,"title":"Address scope ID this pool is bound to; empty when not in any address scope","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"defaultPrefixLen":{"name":"defaultPrefixLen","type":"\u0005","is_mandatory":true,"title":"Default prefix length used when carving a subnet without an explicit length","provider":"go.mondoo.com/mql/providers/openstack"},"defaultQuota":{"name":"defaultQuota","type":"\u0005","is_mandatory":true,"title":"Per-project quota in addresses","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Subnet pool ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"ipVersion":{"name":"ipVersion","type":"\u0005","is_mandatory":true,"title":"IP version (4 or 6)","provider":"go.mondoo.com/mql/providers/openstack"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether the pool is the default for its IP version","provider":"go.mondoo.com/mql/providers/openstack"},"maxPrefixLen":{"name":"maxPrefixLen","type":"\u0005","is_mandatory":true,"title":"Largest prefix the pool can allocate (default 32 for IPv4, 128 for IPv6)","provider":"go.mondoo.com/mql/providers/openstack"},"minPrefixLen":{"name":"minPrefixLen","type":"\u0005","is_mandatory":true,"title":"Smallest prefix the pool can allocate (default 8 for IPv4, 64 for IPv6)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Subnet pool name","provider":"go.mondoo.com/mql/providers/openstack"},"prefixes":{"name":"prefixes","type":"\u0019\u0007","is_mandatory":true,"title":"CIDR prefixes the pool can allocate from","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this subnet pool","provider":"go.mondoo.com/mql/providers/openstack"},"shared":{"name":"shared","type":"\u0004","is_mandatory":true,"title":"Whether the pool is shared across projects","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Neutron subnet pool","desc":"Pool of CIDR prefixes that Neutron carves tenant subnets from, so address space is managed centrally instead of assigned ad hoc. The `id` field selects a specific pool, for example `openstack.subnetPool(id: \"a1b2c3d4-...\")`. Auditing a pool shows the prefixes it can allocate, the allowed prefix-length bounds (minPrefixLen, maxPrefixLen), the per-project address quota, whether the pool is shared across projects, and the address scope it is bound to, all of which govern how much address space each tenant can claim.","private":true,"min_provider_version":"13.0.1","defaults":"id name ipVersion shared isDefault","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.trunk":{"id":"openstack.trunk","name":"openstack.trunk","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the trunk is administratively up","provider":"go.mondoo.com/mql/providers/openstack"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Trunk ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Trunk name","provider":"go.mondoo.com/mql/providers/openstack"},"parentPort":{"name":"parentPort","type":"\u001bopenstack.port","title":"Parent port that carries the trunk","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this trunk","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (ACTIVE, DOWN, BUILD, DEGRADED, ERROR)","provider":"go.mondoo.com/mql/providers/openstack"},"subportPorts":{"name":"subportPorts","type":"\u0019\u001bopenstack.port","title":"Subports as resolved Neutron ports","provider":"go.mondoo.com/mql/providers/openstack"},"subports":{"name":"subports","type":"\u0019\n","is_mandatory":true,"title":"Subport entries","desc":"Each entry is a dict with keys `port_id` (the Neutron port carried on the trunk), `segmentation_type` (the tagging scheme, typically `vlan`), and `segmentation_id` (the VLAN tag that isolates the subport's traffic on the parent port). See subportPorts for these ports resolved as Neutron port resources.","provider":"go.mondoo.com/mql/providers/openstack"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags","provider":"go.mondoo.com/mql/providers/openstack"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Neutron trunk","desc":"Neutron trunk port that multiplexes traffic from several networks onto a single parent port. Traffic for each attached network arrives on a subport tagged with its own VLAN ID, letting one instance reach many networks over one virtual NIC. Select a trunk by its UUID, for example `openstack.trunk(id: \"...\")`. Audit trunks to see which ports an instance is bridged onto, whether the trunk is administratively up (adminStateUp), and its operational status. The parentPort and subportPorts accessors resolve the underlying Neutron ports for reachability and security-group analysis.","private":true,"min_provider_version":"13.0.1","defaults":"id name status","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.trust":{"id":"openstack.trust","name":"openstack.trust","fields":{"allowRedelegation":{"name":"allowRedelegation","type":"\u0004","is_mandatory":true,"title":"Whether the trustee may re-delegate the trust to another user","provider":"go.mondoo.com/mql/providers/openstack"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Expiration timestamp; null when the trust never expires","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Trust ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"impersonation":{"name":"impersonation","type":"\u0004","is_mandatory":true,"title":"Whether the trustee may impersonate the trustor","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project the delegated roles apply to; null for an unscoped trust","provider":"go.mondoo.com/mql/providers/openstack"},"redelegated":{"name":"redelegated","type":"\u001bopenstack.trust","title":"Trust this one was re-delegated from; null when not re-delegated","min_provider_version":"13.2.2","provider":"go.mondoo.com/mql/providers/openstack"},"remainingUses":{"name":"remainingUses","type":"\u0005","is_mandatory":true,"title":"Remaining number of times the trust can be used; 0 when unlimited","provider":"go.mondoo.com/mql/providers/openstack"},"roleNames":{"name":"roleNames","type":"\u0019\u0007","is_mandatory":true,"title":"Role names delegated by this trust","provider":"go.mondoo.com/mql/providers/openstack"},"trustee":{"name":"trustee","type":"\u001bopenstack.user","title":"Trustee user (the principal granted authorization)","provider":"go.mondoo.com/mql/providers/openstack"},"trustor":{"name":"trustor","type":"\u001bopenstack.user","title":"Trustor user (the principal delegating authorization)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone trust","desc":"Delegation of authorization from a trustor user to a trustee user, optionally limited to a subset of roles on a project, with optional impersonation and re-delegation. Select a trust by its `id`, for example `openstack.trust(id: \"3d2c...\")`. Trusts that allow impersonation or unlimited uses grant standing access on the trustor's behalf and should be reviewed closely.","private":true,"min_provider_version":"13.1.4","defaults":"id impersonation","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.user":{"id":"openstack.user","name":"openstack.user","fields":{"applicationCredentials":{"name":"applicationCredentials","type":"\u0019\u001bopenstack.applicationCredential","title":"Application credentials owned by this user","provider":"go.mondoo.com/mql/providers/openstack"},"defaultProject":{"name":"defaultProject","type":"\u001bopenstack.project","title":"Default project the user is scoped to when authenticating without an explicit scope; null when unset","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"domain":{"name":"domain","type":"\u001bopenstack.domain","title":"Domain this user belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"ec2Credentials":{"name":"ec2Credentials","type":"\u0019\u001bopenstack.ec2Credential","title":"EC2-compatible access credentials owned by this user","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/openstack"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the user account is enabled","provider":"go.mondoo.com/mql/providers/openstack"},"groups":{"name":"groups","type":"\u0019\u001bopenstack.group","title":"Groups this user belongs to","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"User ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"ignoreLockoutFailureAttempts":{"name":"ignoreLockoutFailureAttempts","type":"\u0004","is_mandatory":true,"title":"Whether the user is exempt from account lockout after repeated failed authentication attempts (Keystone option `ignore_lockout_failure_attempts`)","provider":"go.mondoo.com/mql/providers/openstack"},"multiFactorAuthEnabled":{"name":"multiFactorAuthEnabled","type":"\u0004","is_mandatory":true,"title":"Whether multi-factor authentication is required for this user (Keystone option `multi_factor_auth_enabled`)","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"multiFactorAuthRules":{"name":"multiFactorAuthRules","type":"\u0019\n","is_mandatory":true,"title":"Multi-factor authentication rule sets (Keystone option `multi_factor_auth_rules`)","desc":"Each entry is a list of auth-method names that together satisfy MFA, for example `[\"password\", \"totp\"]`. Empty when no rules are configured.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Username","provider":"go.mondoo.com/mql/providers/openstack"},"passwordExpiresAt":{"name":"passwordExpiresAt","type":"\t","is_mandatory":true,"title":"When the user's password expires (null when no expiry is set, e.g. federated users)","provider":"go.mondoo.com/mql/providers/openstack"},"roles":{"name":"roles","type":"\u0019\u001bopenstack.role","title":"Roles assigned to this user across all scopes (effective; deduplicated, includes group-derived roles)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack Keystone user","desc":"Identity account in the Keystone identity service, selected by its UUID with `openstack.user(id: \"...\")`. Exposes the account's enabled state, password expiry, and per-user security options such as multi-factor authentication enforcement and lockout exemption, along with the domain it belongs to, its effective role assignments, group memberships, and the application and EC2-compatible credentials it owns. Audit these to find over-privileged, stale, or MFA-exempt accounts.","private":true,"min_provider_version":"13.0.1","defaults":"id name enabled","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.vpn":{"id":"openstack.vpn","fields":{"endpointGroup":{"name":"endpointGroup","type":"\u001bopenstack.vpn.endpointGroup","title":"OpenStack VPNaaS v2 endpoint group","desc":"A named set of local subnets or peer CIDRs that a site-to-site connection references in place of a single bound subnet. The type distinguishes subnet groups (local) from CIDR groups (peer), and endpoints lists the members. Selected by endpoint-group ID.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"ikePolicy":{"name":"ikePolicy","type":"\u001bopenstack.vpn.ikePolicy","title":"OpenStack VPNaaS v2 IKE policy","desc":"IKE key-exchange negotiation parameters referenced by site-to-site connections. The authentication and encryption algorithms, the perfect-forward-secrecy group, the IKE version, the negotiation mode, and the security-association lifetime are the values to audit for weak cryptography (for example a sha1 auth algorithm, 3des encryption, or a disabled PFS group). Selected by policy ID.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"ipsecPolicy":{"name":"ipsecPolicy","type":"\u001bopenstack.vpn.ipsecPolicy","title":"OpenStack VPNaaS v2 IPsec policy","desc":"IPsec data-channel negotiation parameters referenced by site-to-site connections. The authentication and encryption algorithms, the perfect-forward-secrecy group, the encapsulation mode, the transform protocol, and the security-association lifetime are the values to audit for weak cryptography. Selected by policy ID.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"service":{"name":"service","type":"\u001bopenstack.vpn.service","title":"OpenStack VPNaaS v2 IPsec VPN service","desc":"An IPsec VPN service bound to a router, the anchor that site-to-site connections attach to. Fields cover the administrative state, the operational status, and the external IPv4 and IPv6 addresses the service terminates tunnels on. Selected by service ID.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true},"siteConnection":{"name":"siteConnection","type":"\u001bopenstack.vpn.siteConnection","title":"OpenStack VPNaaS v2 IPsec site-to-site connection","desc":"An IPsec tunnel from a local VPN service to a remote peer. Fields cover the peer address and identity, the local and peer CIDRs reachable through the tunnel, the dead-peer-detection settings, the negotiation initiator, and the referenced IKE and IPsec policies, so the cryptographic strength and exposure of a tunnel can be audited end to end. The pre-shared key is intentionally not exposed. Selected by connection ID.","is_private":true,"provider":"go.mondoo.com/mql/providers/openstack","is_implicit_resource":true}},"is_extension":true},"openstack.vpn.endpointGroup":{"id":"openstack.vpn.endpointGroup","name":"openstack.vpn.endpointGroup","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"endpoints":{"name":"endpoints","type":"\u0019\u0007","is_mandatory":true,"title":"Member subnet IDs or CIDRs, depending on the type","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Endpoint group ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint group name","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this endpoint group","provider":"go.mondoo.com/mql/providers/openstack"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Endpoint type (\"subnet\" for local subnet IDs or \"cidr\" for peer CIDRs)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack VPNaaS v2 endpoint group","desc":"A named set of local subnets or peer CIDRs that a site-to-site connection references in place of a single bound subnet. The type distinguishes subnet groups (local) from CIDR groups (peer), and endpoints lists the members. Selected by endpoint-group ID.","private":true,"min_provider_version":"13.6.1","defaults":"id name type","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.vpn.ikePolicy":{"id":"openstack.vpn.ikePolicy","name":"openstack.vpn.ikePolicy","fields":{"authAlgorithm":{"name":"authAlgorithm","type":"\u0007","is_mandatory":true,"title":"Authentication hash algorithm (for example \"sha1\", \"sha256\", \"sha384\", \"sha512\")","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"encryptionAlgorithm":{"name":"encryptionAlgorithm","type":"\u0007","is_mandatory":true,"title":"Encryption algorithm (for example \"3des\", \"aes-128\", \"aes-256\")","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IKE policy ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"ikeVersion":{"name":"ikeVersion","type":"\u0007","is_mandatory":true,"title":"IKE protocol version (\"v1\" or \"v2\")","provider":"go.mondoo.com/mql/providers/openstack"},"lifetimeUnits":{"name":"lifetimeUnits","type":"\u0007","is_mandatory":true,"title":"Security-association lifetime units (\"seconds\" or \"kilobytes\")","provider":"go.mondoo.com/mql/providers/openstack"},"lifetimeValue":{"name":"lifetimeValue","type":"\u0005","is_mandatory":true,"title":"Security-association lifetime value in the lifetime units","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"IKE policy name","provider":"go.mondoo.com/mql/providers/openstack"},"pfs":{"name":"pfs","type":"\u0007","is_mandatory":true,"title":"Perfect forward secrecy group (for example \"group2\", \"group5\", \"group14\")","provider":"go.mondoo.com/mql/providers/openstack"},"phase1NegotiationMode":{"name":"phase1NegotiationMode","type":"\u0007","is_mandatory":true,"title":"IKE key-exchange negotiation mode (for example \"main\")","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this IKE policy","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack VPNaaS v2 IKE policy","desc":"IKE key-exchange negotiation parameters referenced by site-to-site connections. The authentication and encryption algorithms, the perfect-forward-secrecy group, the IKE version, the negotiation mode, and the security-association lifetime are the values to audit for weak cryptography (for example a sha1 auth algorithm, 3des encryption, or a disabled PFS group). Selected by policy ID.","private":true,"min_provider_version":"13.6.1","defaults":"id name authAlgorithm encryptionAlgorithm pfs ikeVersion","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.vpn.ipsecPolicy":{"id":"openstack.vpn.ipsecPolicy","name":"openstack.vpn.ipsecPolicy","fields":{"authAlgorithm":{"name":"authAlgorithm","type":"\u0007","is_mandatory":true,"title":"Authentication hash algorithm (for example \"sha1\", \"sha256\", \"sha384\", \"sha512\")","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"encapsulationMode":{"name":"encapsulationMode","type":"\u0007","is_mandatory":true,"title":"Encapsulation mode (\"tunnel\" or \"transport\")","provider":"go.mondoo.com/mql/providers/openstack"},"encryptionAlgorithm":{"name":"encryptionAlgorithm","type":"\u0007","is_mandatory":true,"title":"Encryption algorithm (for example \"3des\", \"aes-128\", \"aes-256\")","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IPsec policy ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"lifetimeUnits":{"name":"lifetimeUnits","type":"\u0007","is_mandatory":true,"title":"Security-association lifetime units (\"seconds\" or \"kilobytes\")","provider":"go.mondoo.com/mql/providers/openstack"},"lifetimeValue":{"name":"lifetimeValue","type":"\u0005","is_mandatory":true,"title":"Security-association lifetime value in the lifetime units","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"IPsec policy name","provider":"go.mondoo.com/mql/providers/openstack"},"pfs":{"name":"pfs","type":"\u0007","is_mandatory":true,"title":"Perfect forward secrecy group (for example \"group2\", \"group5\", \"group14\")","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this IPsec policy","provider":"go.mondoo.com/mql/providers/openstack"},"transformProtocol":{"name":"transformProtocol","type":"\u0007","is_mandatory":true,"title":"Transform protocol (\"esp\", \"ah\", or \"ah-esp\")","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack VPNaaS v2 IPsec policy","desc":"IPsec data-channel negotiation parameters referenced by site-to-site connections. The authentication and encryption algorithms, the perfect-forward-secrecy group, the encapsulation mode, the transform protocol, and the security-association lifetime are the values to audit for weak cryptography. Selected by policy ID.","private":true,"min_provider_version":"13.6.1","defaults":"id name authAlgorithm encryptionAlgorithm pfs transformProtocol","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.vpn.service":{"id":"openstack.vpn.service","name":"openstack.vpn.service","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the service is administratively enabled","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"externalV4Ip":{"name":"externalV4Ip","type":"\u0007","is_mandatory":true,"title":"External IPv4 address the service terminates tunnels on; empty when none","provider":"go.mondoo.com/mql/providers/openstack"},"externalV6Ip":{"name":"externalV6Ip","type":"\u0007","is_mandatory":true,"title":"External IPv6 address the service terminates tunnels on; empty when none","provider":"go.mondoo.com/mql/providers/openstack"},"flavorId":{"name":"flavorId","type":"\u0007","is_mandatory":true,"title":"Flavor ID applied to the service; empty when none","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"VPN service ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"VPN service name","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this VPN service","provider":"go.mondoo.com/mql/providers/openstack"},"router":{"name":"router","type":"\u001bopenstack.router","title":"Router the service runs on","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Operational status (ACTIVE, DOWN, PENDING_CREATE, ERROR, ...)","provider":"go.mondoo.com/mql/providers/openstack"},"subnet":{"name":"subnet","type":"\u001bopenstack.subnet","title":"Subnet the service is bound to; null when the service uses endpoint groups instead","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack VPNaaS v2 IPsec VPN service","desc":"An IPsec VPN service bound to a router, the anchor that site-to-site connections attach to. Fields cover the administrative state, the operational status, and the external IPv4 and IPv6 addresses the service terminates tunnels on. Selected by service ID.","private":true,"min_provider_version":"13.6.1","defaults":"id name status adminStateUp","provider":"go.mondoo.com/mql/providers/openstack"},"openstack.vpn.siteConnection":{"id":"openstack.vpn.siteConnection","name":"openstack.vpn.siteConnection","fields":{"adminStateUp":{"name":"adminStateUp","type":"\u0004","is_mandatory":true,"title":"Whether the connection is administratively enabled","provider":"go.mondoo.com/mql/providers/openstack"},"authMode":{"name":"authMode","type":"\u0007","is_mandatory":true,"title":"IKE authentication mode (for example \"psk\")","provider":"go.mondoo.com/mql/providers/openstack"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/openstack"},"dpdAction":{"name":"dpdAction","type":"\u0007","is_mandatory":true,"title":"Dead peer detection action (\"hold\", \"clear\", \"restart\", \"disabled\", \"restart-by-peer\")","provider":"go.mondoo.com/mql/providers/openstack"},"dpdInterval":{"name":"dpdInterval","type":"\u0005","is_mandatory":true,"title":"Dead peer detection interval in seconds","provider":"go.mondoo.com/mql/providers/openstack"},"dpdTimeout":{"name":"dpdTimeout","type":"\u0005","is_mandatory":true,"title":"Dead peer detection timeout in seconds","provider":"go.mondoo.com/mql/providers/openstack"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Site connection ID (UUID)","provider":"go.mondoo.com/mql/providers/openstack"},"ikePolicy":{"name":"ikePolicy","type":"\u001bopenstack.vpn.ikePolicy","title":"IKE policy used for key-exchange negotiation","provider":"go.mondoo.com/mql/providers/openstack"},"initiator":{"name":"initiator","type":"\u0007","is_mandatory":true,"title":"Who initiates the tunnel (\"bi-directional\" or \"response-only\")","provider":"go.mondoo.com/mql/providers/openstack"},"ipsecPolicy":{"name":"ipsecPolicy","type":"\u001bopenstack.vpn.ipsecPolicy","title":"IPsec policy used for data-channel negotiation","provider":"go.mondoo.com/mql/providers/openstack"},"localEndpointGroup":{"name":"localEndpointGroup","type":"\u001bopenstack.vpn.endpointGroup","title":"Local endpoint group (local subnets); null when the connection binds a subnet directly","provider":"go.mondoo.com/mql/providers/openstack"},"localId":{"name":"localId","type":"\u0007","is_mandatory":true,"title":"Local identity presented to the peer; empty when defaulted","provider":"go.mondoo.com/mql/providers/openstack"},"mtu":{"name":"mtu","type":"\u0005","is_mandatory":true,"title":"Tunnel MTU","provider":"go.mondoo.com/mql/providers/openstack"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Site connection name","provider":"go.mondoo.com/mql/providers/openstack"},"peerAddress":{"name":"peerAddress","type":"\u0007","is_mandatory":true,"title":"Public address of the remote peer","provider":"go.mondoo.com/mql/providers/openstack"},"peerCidrs":{"name":"peerCidrs","type":"\u0019\u0007","is_mandatory":true,"title":"Remote CIDRs reachable through the tunnel","provider":"go.mondoo.com/mql/providers/openstack"},"peerEndpointGroup":{"name":"peerEndpointGroup","type":"\u001bopenstack.vpn.endpointGroup","title":"Peer endpoint group (peer CIDRs); null when peer CIDRs are set directly","provider":"go.mondoo.com/mql/providers/openstack"},"peerId":{"name":"peerId","type":"\u0007","is_mandatory":true,"title":"Identity of the remote peer (IP, FQDN, or DN)","provider":"go.mondoo.com/mql/providers/openstack"},"project":{"name":"project","type":"\u001bopenstack.project","title":"Project that owns this site connection","provider":"go.mondoo.com/mql/providers/openstack"},"routeMode":{"name":"routeMode","type":"\u0007","is_mandatory":true,"title":"Route advertisement mode (for example \"static\")","provider":"go.mondoo.com/mql/providers/openstack"},"service":{"name":"service","type":"\u001bopenstack.vpn.service","title":"VPN service this connection runs on","provider":"go.mondoo.com/mql/providers/openstack"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Operational status (ACTIVE, DOWN, PENDING_CREATE, ERROR, ...)","provider":"go.mondoo.com/mql/providers/openstack"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"OpenStack VPNaaS v2 IPsec site-to-site connection","desc":"An IPsec tunnel from a local VPN service to a remote peer. Fields cover the peer address and identity, the local and peer CIDRs reachable through the tunnel, the dead-peer-detection settings, the negotiation initiator, and the referenced IKE and IPsec policies, so the cryptographic strength and exposure of a tunnel can be audited end to end. The pre-shared key is intentionally not exposed. Selected by connection ID.","private":true,"min_provider_version":"13.6.1","defaults":"id name status peerAddress adminStateUp","provider":"go.mondoo.com/mql/providers/openstack"}}}