apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.18.0
  name: tiers.crd.projectcalico.org
spec:
  group: crd.projectcalico.org
  names:
    kind: Tier
    listKind: TierList
    plural: tiers
    singular: tier
  preserveUnknownFields: false
  scope: Cluster
  versions:
    - name: v1
      schema:
        openAPIV3Schema:
          properties:
            apiVersion:
              type: string
            kind:
              type: string
            metadata:
              type: object
            spec:
              properties:
                defaultAction:
                  enum:
                    - Pass
                    - Deny
                  type: string
                order:
                  type: number
              type: object
          required:
            - metadata
            - spec
          type: object
          x-kubernetes-validations:
            - message: The 'kube-admin' tier must have default action 'Pass'
              rule:
                "self.metadata.name == 'kube-admin' ? self.spec.defaultAction ==
                'Pass' : true"
            - message: The 'kube-baseline' tier must have default action 'Pass'
              rule:
                "self.metadata.name == 'kube-baseline' ? self.spec.defaultAction
                == 'Pass' : true"
            - message: The 'default' tier must have default action 'Deny'
              rule:
                "self.metadata.name == 'default' ? self.spec.defaultAction == 'Deny'
                : true"
      served: true
      storage: true
