swagger: '2.0'
info:
description: Secure Docker and Kubernetes based container deployments with the NeuVector run-time security solution.
version: 5.6.0
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
title: NeuVector Admission API
contact:
email: support@neuvector.com
schemes:
- https
tags:
- name: Admission
description: Admission Control
paths:
/v1/admission/options:
get:
tags:
- Admission
summary: Get a list of admission options
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTAdmissionConfigData'
/v1/admission/rule/{id}:
get:
tags:
- Admission
summary: Show an admission rule
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
parameters:
- in: path
name: id
description: Rule ID
required: true
type: string
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTAdmissionRuleData'
delete:
tags:
- Admission
summary: Delete an admission rule
security:
- ApiKeyAuth: []
- TokenAuth: []
parameters:
- in: path
name: id
description: Rule ID
required: true
type: string
responses:
'200':
description: Success
/v1/admission/rule:
post:
tags:
- Admission
summary: Add admission control rule
security:
- ApiKeyAuth: []
- TokenAuth: []
consumes:
- application/json
parameters:
- in: body
name: body
description: Admission rule data
required: true
schema:
$ref: '#/definitions/RESTAdmissionRuleConfigData'
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTAdmissionRuleData'
patch:
tags:
- Admission
summary: Update admission rule
security:
- ApiKeyAuth: []
- TokenAuth: []
consumes:
- application/json
parameters:
- in: body
name: body
description: Admission rule data
required: true
schema:
$ref: '#/definitions/RESTAdmissionRuleConfigData'
responses:
'200':
description: Success
/v1/admission/rule/promote:
post:
tags:
- Admission
summary: Promote admission control rule
security:
- ApiKeyAuth: []
- TokenAuth: []
consumes:
- application/json
parameters:
- in: body
name: body
description: Admission control rule data
required: true
schema:
$ref: '#/definitions/RESTAdmCtrlPromoteRequestData'
responses:
'200':
description: Success
/v1/admission/rules:
get:
tags:
- Admission
summary: Get a list of admission rules
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
parameters:
- in: query
name: scope
type: string
required: false
enum:
- fed
- local
description: When set to fed, returned fed admission rules. When set to local, returned local admission rules. If there is no query string 'scope', all admission rules will be returned.
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTAdmissionRulesData'
delete:
tags:
- Admission
summary: Delete all admission rules
security:
- ApiKeyAuth: []
- TokenAuth: []
parameters:
- in: query
name: scope
type: string
required: false
enum:
- fed
- local
description: When set to fed, fed admission rules get removed. When set to local or no query string, local admission rules will be removed.
responses:
'200':
description: Success
/v1/admission/state:
get:
tags:
- Admission
summary: Get admission state
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTAdmissionConfigData'
'404':
description: Operation not allowed
schema:
$ref: '#/definitions/RESTError'
patch:
tags:
- Admission
summary: Update admission state
security:
- ApiKeyAuth: []
- TokenAuth: []
consumes:
- application/json
parameters:
- in: body
name: body
description: Admission config state data
required: true
schema:
$ref: '#/definitions/RESTAdmissionConfigData'
responses:
'200':
description: Success
'404':
description: Operation not allowed
schema:
$ref: '#/definitions/RESTError'
/v1/admission/stats:
get:
tags:
- Admission
summary: Get admission control statistics
security:
- ApiKeyAuth: []
- TokenAuth: []
produces:
- application/json
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTAdmissionStatsData'
/v1/assess/admission/rule:
post:
tags:
- Admission
description: Testing admission control rules. The payload body is the content of a resource yaml file.
summary: Test admission control rules
security:
- ApiKeyAuth: []
- TokenAuth: []
consumes:
- text/plain; charset=utf-8
parameters:
- in: body
name: body
description: Resource yaml file
required: true
schema:
type: string
example: "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: nginx-deployment\n labels:\n app: nginx\nspec:\n replicas: 3\n selector:\n matchLabels:\n app: nginx\n template:\n metadata:\n labels:\n app: nginx\n spec:\n containers:\n - name: nginx\n image: nginx:latest\n ports:\n - containerPort: 80\n"
responses:
'200':
description: Success
schema:
$ref: '#/definitions/RESTAdmCtrlRulesTestResults'
definitions:
RESTAdmRuleOptions:
type: object
required:
- rule_options
properties:
rule_options:
type: object
properties:
rule:
type: string
example: criterion_name
options:
$ref: '#/definitions/RESTAdmissionRuleOption'
RESTAdmissionStats:
type: object
required:
- k8s_allowed_requests
- k8s_denied_requests
- k8s_erroneous_requests
- k8s_ignored_requests
- jenkins_allowed_requests
- jenkins_denied_requests
- jenkins_erroneous_requests
properties:
k8s_allowed_requests:
type: integer
format: int64
example: 2
k8s_denied_requests:
type: integer
format: int64
example: 1
k8s_erroneous_requests:
type: integer
format: int64
example: 1
k8s_ignored_requests:
type: integer
format: int64
example: 1
jenkins_allowed_requests:
type: integer
format: int64
example: 3
jenkins_denied_requests:
type: integer
format: int64
example: 1
jenkins_erroneous_requests:
type: integer
format: int64
example: 1
RESTAdmissionConfigData:
type: object
required:
- k8s_env
properties:
state:
$ref: '#/definitions/RESTAdmissionState'
admission_options:
$ref: '#/definitions/RESTAdmRuleTypeOptions'
k8s_env:
type: boolean
example: false
admission_custom_criteria_options:
$ref: '#/definitions/RESTAdminCustomCriteriaOptions'
admission_custom_criteria_templates:
$ref: '#/definitions/RESTAdminCriteriaTemplate'
predefined_risky_roles:
type: array
items:
type: string
example:
- risky_role_view_secret
- risky_role_create_pod
RESTAdmCtrlRulesTestResults:
type: object
properties:
props_unavailable:
type: array
items:
type: string
example:
- user
- userGroups
global_mode:
type: string
enum:
- monitor
- protect
- ''
results:
type: array
items:
$ref: '#/definitions/RESTAdmCtrlRulesTestResult'
RESTAdminCriteriaTemplate:
type: object
required:
- kind
- rawjson
properties:
kind:
type: string
example: podTemplate
rawjson:
type: string
example: '{"key": "value"}'
RESTPwdProfileBasic:
type: object
required:
- min_len
- min_uppercase_count
- min_lowercase_count
- min_digit_count
- min_special_count
properties:
min_len:
type: integer
example: 6
min_uppercase_count:
type: integer
example: 0
min_lowercase_count:
type: integer
example: 0
min_digit_count:
type: integer
example: 0
min_special_count:
type: integer
example: 0
RESTAdmissionStatsData:
type: object
required:
- stats
properties:
stats:
$ref: '#/definitions/RESTAdmissionStats'
RESTAdmissionRuleOption:
type: object
required:
- name
- ops
properties:
name:
type: string
example: group
ops:
type: array
items:
type: string
example:
- containsAny
- containsAll
- '='
values:
type: array
items:
type: string
example:
- ''
- 'true'
- 'false'
match_src:
type: string
example: yaml
sub_options:
type: object
properties:
rule:
type: string
example: criterion_name
options:
$ref: '#/definitions/RESTAdmissionRuleOption'
RESTAdmissionRulesData:
type: object
required:
- rules
properties:
rules:
type: array
items:
$ref: '#/definitions/RESTAdmissionRule'
RESTImportTaskData:
type: object
required:
- data
properties:
data:
$ref: '#/definitions/RESTImportTask'
RESTAdmCtrlTestRuleInfo:
type: object
required:
- container_image
- id
- disabled
- type
- mode
- rule_details
- rule_cfg_type
properties:
container_image:
type: string
description: the tested container image in the pod
id:
type: integer
format: uint32
example: 10001
disabled:
type: boolean
example: false
type:
type: string
enum:
- allow
- deny
mode:
type: string
description: per-rule mode
enum:
- monitor
- protect
- ''
rule_details:
type: string
example: 'It matches deny rule id 1000 with criteria: (allow privilege escalation = true)'
rule_cfg_type:
type: string
enum:
- federal
- ground
- user_created
RESTImportTask:
type: object
required:
- tid
- ctrler_id
- percentage
properties:
tid:
type: string
example: c5af897b62a258212ece91c0551d3a4a
ctrler_id:
type: string
example: 6e60452b244b90456f3450c9fed0a50f57f4b849dcb74a5fad289e8116f32f36
last_update_time:
type: string
format: date-time
example: '2022-03-17T17:31:55.832768041Z'
percentage:
type: integer
example: 100
triggered_by:
type: string
example: admin
status:
type: string
example: done
temp_token:
type: string
example: ''
fail_to_decrypt_key_fields:
type: object
description: Object key is kv key and value is array of cloaked fields that cannot be decrypted
additionalProperties:
type: array
items:
type: string
example:
- x509_cert
- signing_cert
RESTAdmRuleTypeOptions:
type: object
required:
- deny_options
- exception_options
properties:
deny_options:
$ref: '#/definitions/RESTAdmCatOptions'
exception_options:
$ref: '#/definitions/RESTAdmCatOptions'
psp_collection:
type: array
items:
$ref: '#/definitions/RESTAdmRuleCriterion'
pss_collections:
type: object
description: map key is domain(string type)
additionalProperties:
type: array
items:
type: string
example:
restricted:
- Uses illegal volume type.
- Allows running as root user.
baseline:
- Sets HostNetwork, HostPID, or HostIPC to true.
- Allows privileged container(s).
sigstore_verifiers:
type: array
items:
type: string
example:
- public/verifier1
- private1/verifier1
- private1/verifier2
RESTAdmCatOptions:
type: object
properties:
k8s_options:
$ref: '#/definitions/RESTAdmRuleOptions'
RESTAdminCustomCriteriaOptions:
type: object
required:
- ops
- valuetype
properties:
ops:
type: array
items:
type: string
example:
- exist
- notExist
values:
type: array
items:
type: string
example:
- 'true'
- 'false'
valuetype:
type: string
example: key
RESTAdmRuleCriterion:
type: object
required:
- name
- op
- value
properties:
name:
type: string
example: namespace
op:
type: string
example: '='
value:
type: string
example: kube-system
sub_criteria:
type: array
items:
$ref: '#/definitions/RESTAdmRuleCriterion'
type:
type: string
example: customPath
template_kind:
type: string
example: podTemplate
path:
type: string
example: item.spec.serviceAccountName
value_type:
type: string
example: string
RESTAdmCtrlPromoteRequestData:
type: object
required:
- request
properties:
request:
$ref: '#/definitions/RESTAdmCtrlPromoteRequest'
RESTAdmissionRuleConfigData:
type: object
required:
- config
properties:
config:
$ref: '#/definitions/RESTAdmissionRuleConfig'
RESTAdmCtrlPromoteRequest:
type: object
required:
- ids
properties:
ids:
type: array
items:
type: integer
format: uint32
example: 12
RESTAdmCtrlRulesTestResult:
type: object
required:
- index
- name
- kind
- message
- matched_rules
- allowed
properties:
index:
type: integer
example: 1
name:
type: string
example: iperfserver
kind:
type: string
example: Deployment
message:
type: string
example: '<Assessment> Creation of Kubernetes Deployment is allowed [Notice: the requested image(s) are not scanned: quay.io/nvlab/iperf].'
matched_rules:
type: array
items:
$ref: '#/definitions/RESTAdmCtrlTestRuleInfo'
allowed:
type: boolean
example: false
RESTAdmissionState:
type: object
properties:
enable:
type: boolean
example: true
mode:
type: string
example: Protect
default_action:
type: string
example: allow
adm_client_mode:
type: string
example: service
adm_svc_type:
type: string
example: ''
adm_client_mode_options:
type: object
properties:
service:
type: string
example: service
url:
type: string
example: service:xyz-svc-admission-webhook.xyz.svc
ctrl_states:
type: object
properties:
validate:
type: string
example: validate
states:
type: boolean
example: true
RESTError:
type: object
required:
- code
- error
- message
properties:
code:
type: integer
example: 3
error:
type: string
example: Request failed
message:
type: string
example: Invalid format
password_profile_basic:
$ref: '#/definitions/RESTPwdProfileBasic'
import_task_data:
$ref: '#/definitions/RESTImportTaskData'
RESTAdmissionRuleConfig:
type: object
required:
- id
- category
- cfg_type
- rule_type
- containers
properties:
id:
type: integer
format: uint32
example: 1
category:
type: string
example: Kubernetes
comment:
type: string
example: comment
criteria:
type: array
items:
$ref: '#/definitions/RESTAdmRuleCriterion'
disable:
type: boolean
example: true
actions:
type: array
items:
type: string
example: ''
cfg_type:
type: string
enum:
- user_created
- ground
- federal
rule_type:
type: string
enum:
- exception
- deny
rule_mode:
type: string
enum:
- ''
- monitor
- protect
containers:
type: array
items:
type: string
enum:
- containers
- init_containers
- ephemeral_containers
RESTAdmissionRule:
type: object
required:
- id
- category
- comment
- criteria
- disable
- critical
- cfg_type
- rule_type
- rule_mode
- containers
properties:
id:
type: integer
format: uint32
example: 2
category:
type: string
example: Kubernetes
comment:
type: string
example: Do not delete this exception rule
criteria:
type: array
items:
$ref: '#/definitions/RESTAdmRuleCriterion'
disable:
type: boolean
example: false
critical:
type: boolean
example: false
cfg_type:
type: string
enum:
- user_created
- ground
- federal
rule_type:
type: string
enum:
- exception
- deny
rule_mode:
type: string
enum:
- ''
- monitor
- protect
containers:
type: array
items:
type: string
enum:
- containers
- init_containers
- ephemeral_containers
RESTAdmissionRuleData:
type: object
required:
- rule
properties:
rule:
$ref: '#/definitions/RESTAdmissionRule'
securityDefinitions:
ApiKeyAuth:
type: apiKey
in: header
name: X-Auth-Apikey
TokenAuth:
type: apiKey
in: header
name: X-Auth-Token
externalDocs:
description: Find out more about NeuVector
url: https://www.suse.com/products/neuvector/