{
  "type": "object",
  "properties": {
    "spec": {
      "description": "Spec defines the desired state of the EventPolicy.",
      "type": "object",
      "properties": {
        "from": {
          "description": "From is the list of sources or oidc identities, which are allowed to send events to the targets (.spec.to).",
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "ref": {
                "description": "Ref contains a direct reference to a resource which is allowed to send events to the target.",
                "type": "object",
                "properties": {
                  "apiVersion": {
                    "description": "API version of the referent.",
                    "type": "string"
                  },
                  "kind": {
                    "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
                    "type": "string"
                  },
                  "name": {
                    "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
                    "type": "string"
                  },
                  "namespace": {
                    "description": "Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ This is optional field, it gets defaulted to the object holding it if left out.",
                    "type": "string"
                  }
                },
                "additionalProperties": false
              },
              "sub": {
                "description": "Sub sets the OIDC identity name to be allowed to send events to the target. It is also possible to set a glob-like pattern to match any suffix.",
                "type": "string"
              }
            },
            "additionalProperties": false
          }
        },
        "to": {
          "description": "To lists all resources for which this policy applies. Resources in this list must act like an ingress and have an audience. The resources are part of the same namespace as the EventPolicy. An empty list means it applies to all resources in the EventPolicies namespace",
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "ref": {
                "description": "Ref contains the direct reference to a target",
                "type": "object",
                "properties": {
                  "apiVersion": {
                    "description": "API version of the referent.",
                    "type": "string"
                  },
                  "kind": {
                    "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
                    "type": "string"
                  },
                  "name": {
                    "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
                    "type": "string"
                  }
                },
                "additionalProperties": false
              },
              "selector": {
                "description": "Selector contains a selector to group targets",
                "type": "object",
                "properties": {
                  "apiVersion": {
                    "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
                    "type": "string"
                  },
                  "kind": {
                    "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
                    "type": "string"
                  },
                  "matchExpressions": {
                    "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
                    "type": "array",
                    "items": {
                      "type": "object",
                      "properties": {
                        "key": {
                          "description": "key is the label key that the selector applies to.",
                          "type": "string"
                        },
                        "operator": {
                          "description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
                          "type": "string"
                        },
                        "values": {
                          "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
                          "type": "array",
                          "items": {
                            "type": "string"
                          }
                        }
                      },
                      "additionalProperties": false
                    }
                  },
                  "matchLabels": {
                    "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
                    "type": "object",
                    "x-kubernetes-preserve-unknown-fields": true
                  }
                },
                "additionalProperties": false
              }
            },
            "additionalProperties": false
          }
        },
        "filters": {
          "description": "Filters is an array of SubscriptionsAPIFilters that evaluate to true or false. If any filter expression in the array evaluates to false, the event will not continue pass the ingress of the target resources of the policy",
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "all": {
                "description": "All evaluates to true if all the nested expressions evaluate to true. It must contain at least one filter expression",
                "type": "array",
                "items": {
                  "type": "object",
                  "x-kubernetes-preserve-unknown-fields": true
                }
              },
              "any": {
                "description": "Any evaluates to true if any of the nested expressions evaluate to true. It must contain at least one filter expression",
                "type": "array",
                "items": {
                  "type": "object",
                  "x-kubernetes-preserve-unknown-fields": true
                }
              },
              "cesql": {
                "description": "CESQL is a CloudEvents SQL v1 expression that will evaluate to true or false for each CloudEvent.",
                "type": "string"
              },
              "exact": {
                "description": "Exact evaluates to true if the values of the matching CloudEvents attributes all exactly match with the associated value string specified (case sensitive)",
                "type": "object",
                "x-kubernetes-preserve-unknown-fields": true
              },
              "not": {
                "description": "Not evaluates to true if the nested expression evaluates to false.",
                "type": "object",
                "x-kubernetes-preserve-unknown-fields": true
              },
              "prefix": {
                "description": "Prefix evaluates to true if the values of the matching CloudEvents attributes all start with the associated value string specified (case sensitive)",
                "type": "object",
                "x-kubernetes-preserve-unknown-fields": true
              },
              "suffix": {
                "description": "Exact evaluates to true if the values of the matching CloudEvents attributes all end with the associated value string specified (case sensitive)",
                "type": "object",
                "x-kubernetes-preserve-unknown-fields": true
              }
            },
            "additionalProperties": false
          }
        }
      },
      "additionalProperties": false
    },
    "status": {
      "description": "Status represents the current state of the EventPolicy. This data may be out of date.",
      "type": "object",
      "properties": {
        "annotations": {
          "description": "Annotations is additional Status fields for the Resource to save some additional State as well as convey more information to the user. This is roughly akin to Annotations on any k8s resource, just the reconciler conveying richer information outwards.",
          "type": "object",
          "x-kubernetes-preserve-unknown-fields": true
        },
        "conditions": {
          "description": "Conditions the latest available observations of a resource's current state.",
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "type",
              "status"
            ],
            "properties": {
              "lastTransitionTime": {
                "description": "LastTransitionTime is the last time the condition transitioned from one status to another. We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic differences (all other things held constant).",
                "type": "string"
              },
              "message": {
                "description": "A human readable message indicating details about the transition.",
                "type": "string"
              },
              "reason": {
                "description": "The reason for the condition's last transition.",
                "type": "string"
              },
              "severity": {
                "description": "Severity with which to treat failures of this type of condition. When this is not specified, it defaults to Error.",
                "type": "string"
              },
              "status": {
                "description": "Status of the condition, one of True, False, Unknown.",
                "type": "string"
              },
              "type": {
                "description": "Type of condition.",
                "type": "string"
              }
            },
            "additionalProperties": false
          }
        },
        "from": {
          "description": "From is the list of resolved oidc identities from .spec.from",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "observedGeneration": {
          "description": "ObservedGeneration is the 'Generation' of the Service that was last processed by the controller.",
          "type": "integer",
          "format": "int64"
        }
      },
      "additionalProperties": false
    }
  }
}