apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata :
  name : practices.openappsec.io

spec:
  group: openappsec.io
  versions:
    - name: v1beta1
      served: true
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              properties:
                web-attacks:
                  type: object
                  properties:
                    override-mode:
                      type: string
                      enum:
                        - prevent-learn
                        - detect-learn
                        - prevent
                        - detect
                        - inactive
                    minimum-confidence:
                      type: string
                      enum:
                        - medium
                        - high
                        - critical
                    max-url-size-bytes:
                      type: integer
                    max-object-depth:
                      type: integer
                    max-body-size-kb:
                      type: integer
                    max-header-size-bytes:
                      type: integer
                    protections:
                      type: object
                      properties:
                        csrf-enabled:
                          type: string
                          enum:
                            - prevent-learn
                            - detect-learn
                            - prevent
                            - detect
                            - inactive
                        error-disclosure-enabled:
                          type: string
                          enum:
                            - prevent-learn
                            - detect-learn
                            - prevent
                            - detect
                            - inactive
                        open-redirect-enabled:
                          type: string
                          enum:
                            - prevent-learn
                            - detect-learn
                            - prevent
                            - detect
                            - inactive
                        non-valid-http-methods:
                          type: boolean
                anti-bot:
                  type: object
                  properties:
                    override-mode:
                      type: string
                      enum:
                        - prevent-learn
                        - detect-learn
                        - prevent
                        - detect
                        - inactive
                    injected-URIs:
                      type: array
                      items:
                        type: object
                        properties:
                          uri:
                            type: string
                    validated-URIs:
                      type: array
                      items:
                        type: object
                        properties:
                          uri:
                            type: string
                snort-signatures:
                  type: object
                  properties:
                    override-mode:
                      type: string
                      enum:
                        - prevent-learn
                        - detect-learn
                        - prevent
                        - detect
                        - inactive
                    configmap:
                      type: array
                      items:
                        type: string                
                openapi-schema-validation:
                  type: object
                  properties:
                    override-mode:
                      type: string
                      enum:
                        - prevent-learn
                        - detect-learn
                        - prevent
                        - detect
                        - inactive
                    configmap:
                      type: array
                      items:
                        type: string

  scope: Cluster
  names:
    plural: practices
    singular: practice
    kind: Practice
    shortNames:
    - practice