<def-group>
{{% set resourcequota_api_path = '/api/v1/resourcequotas' %}}
{{% set namespaces_api_path = '/api/v1/namespaces' %}}
{{% set resourcequota_for_non_ctlplane_namespaces_filter = '[.items[] | select((.metadata.namespace | startswith("openshift") | not) and (.metadata.namespace | startswith("kube-") | not) and .metadata.namespace != "default" and .metadata.namespace != "rhacs-operator" and ({{if ne .var_resource_requests_quota_per_project_exempt_regex "None"}}.metadata.namespace | test("{{.var_resource_requests_quota_per_project_exempt_regex}}") | not{{else}}true{{end}})) | .metadata.namespace] | unique' %}}
{{% set non_ctlplane_namespaces_filter = '[.items[] | select((.metadata.name | startswith("openshift") | not) and (.metadata.name | startswith("kube-") | not) and .metadata.name != "default" and .metadata.name != "rhacs-operator" and ({{if ne .var_resource_requests_quota_per_project_exempt_regex "None"}}.metadata.name | test("{{.var_resource_requests_quota_per_project_exempt_regex}}") | not{{else}}true{{end}}))]' %}}
  <definition class="compliance" id="resource_requests_quota_per_project" version="1">
    {{{ oval_metadata("Ensure that application Namespaces have Network Policies defined", rule_title=rule_title) }}}
    <criteria>
      <criterion comment="Make sure that the file '{{{ openshift_filtered_path(resourcequota_api_path, resourcequota_for_non_ctlplane_namespaces_filter) }}} exists."
                 test_ref="test_file_for_resource_requests_quota_per_project"/>
      <criterion comment="Make sure that the file '{{{ openshift_filtered_path(namespaces_api_path, non_ctlplane_namespaces_filter) }}}' exists."
                 test_ref="test_file_for_resource_requests_quotas_filtered_namespaces"/>
      <criteria operator="OR">
        <criterion comment="Make sure that all target elements exist"
                   test_ref="test_elements_count_for_resource_requests_quota_per_project"/>
        <criteria operator="AND">
          <criterion comment="Make sure there are no resource quotas in non-ctlplane namespaces"
                     test_ref="test_resource_requests_quota_per_project"/>
          <criterion comment="Make sure there are no namespaces in non-ctlplane namespaces"
                     test_ref="test_resource_requests_quotas_filtered_namespaces"/>
        </criteria>
      </criteria>
    </criteria>
  </definition>

  <!-- OCP object file locations -->
  <local_variable id="resource_requests_quota_per_project_file_location" datatype="string"
                  comment="Path of file containing filtered non-ctlplane namespaces with network policies." version="1">
    <concat>
      <variable_component var_ref="ocp_data_root"/>
      <literal_component>{{{ openshift_filtered_path(resourcequota_api_path, resourcequota_for_non_ctlplane_namespaces_filter) }}}</literal_component>
    </concat>
  </local_variable>

  <local_variable id="resource_requests_quotas_filtered_namespaces_file_location" datatype="string"
                  comment="Path of file containing filtered non-ctlplane namespaces." version="1">
    <concat>
      <variable_component var_ref="ocp_data_root"/>
      <literal_component>{{{ openshift_filtered_path(namespaces_api_path, non_ctlplane_namespaces_filter) }}}</literal_component>
    </concat>
  </local_variable>

  <!-- File existence checks -->
  <unix:file_test id="test_file_for_resource_requests_quota_per_project" check="all" check_existence="only_one_exists"
    comment="Find the file to be checked ('{{{ openshift_filtered_path(resourcequota_api_path, resourcequota_for_non_ctlplane_namespaces_filter) }}}')." version="1">
    <unix:object object_ref="object_file_for_resource_requests_quota_per_project"/>
  </unix:file_test>

  <unix:file_object id="object_file_for_resource_requests_quota_per_project" version="1">
    <unix:filepath var_ref="resource_requests_quota_per_project_file_location"/>
  </unix:file_object>

  <unix:file_test id="test_file_for_resource_requests_quotas_filtered_namespaces" check="all" check_existence="only_one_exists"
    comment="Find the file to be checked ('{{{ openshift_filtered_path(namespaces_api_path, non_ctlplane_namespaces_filter) }}}')." version="1">
    <unix:object object_ref="object_file_for_resource_requests_quotas_filtered_namespaces"/>
  </unix:file_test>

  <unix:file_object id="object_file_for_resource_requests_quotas_filtered_namespaces" version="1">
    <unix:filepath var_ref="resource_requests_quotas_filtered_namespaces_file_location"/>
  </unix:file_object>

  <!-- Check if the number of elements at the two paths are both zero -->
  <ind:yamlfilecontent_test id="test_resource_requests_quota_per_project" version="1" check="all" 
                            comment="Make sure there are no resource quotas in non-ctlplane namespaces" 
                            check_existence="none_exist" state_operator="AND">
    <ind:object object_ref="object_resource_requests_quota_per_project"/>
  </ind:yamlfilecontent_test>

  <ind:yamlfilecontent_test id="test_resource_requests_quotas_filtered_namespaces" version="1" check="all" 
                            comment="Make sure there are no namespaces in non-ctlplane namespaces" 
                            check_existence="none_exist" state_operator="AND">
    <ind:object object_ref="object_resource_requests_quotas_filtered_namespaces"/>
  </ind:yamlfilecontent_test>

  <!-- Object gathering --> 
  <ind:yamlfilecontent_object id="object_resource_requests_quota_per_project" version="1">
    <ind:filepath var_ref="resource_requests_quota_per_project_file_location"/>
    <ind:yamlpath>[:]</ind:yamlpath>
  </ind:yamlfilecontent_object>
  <local_variable comment="Items counter" datatype="int" id="local_variable_counter_resource_requests_quota_per_project" version="1">
    <count>
      <object_component object_ref="object_resource_requests_quota_per_project" item_field="value" record_field="#"/>
    </count>
  </local_variable>

  <ind:yamlfilecontent_object id="object_resource_requests_quotas_filtered_namespaces" version="1">
    <ind:filepath var_ref="resource_requests_quotas_filtered_namespaces_file_location"/>
    <ind:yamlpath>[:].metadata.name</ind:yamlpath>
  </ind:yamlfilecontent_object>
  <local_variable comment="Items counter control" datatype="int" id="local_variable_counter_resource_requests_quotas_filtered_namespaces" version="1">
    <count>
      <object_component object_ref="object_resource_requests_quotas_filtered_namespaces" item_field="value" record_field="#"/>
    </count>
  </local_variable>
  
  <!-- Object counts -->
  <ind:variable_test version="1" id="test_elements_count_for_resource_requests_quota_per_project" check="all"
    comment="Count elements at both paths and compare">
    <ind:object object_ref="object_elements_count_for_resource_requests_quota_per_project"/>
    <ind:state state_ref="state_elements_count_for_resource_requests_quota_per_project"/>
  </ind:variable_test>
  
  <ind:variable_object id="object_elements_count_for_resource_requests_quota_per_project" version="1">
    <ind:var_ref>local_variable_counter_resource_requests_quota_per_project</ind:var_ref>
  </ind:variable_object>

  <!-- Comparison -->
  <!-- This verifies that the filtered namespaces are equal to the namespaces with resourcequota -->
  <ind:variable_state id="state_elements_count_for_resource_requests_quota_per_project" version="1">
    <ind:value datatype="int" var_ref="local_variable_counter_resource_requests_quotas_filtered_namespaces"/>
  </ind:variable_state>
  
  <!-- OCP data root declaration -->
  <external_variable comment="Root of OCP data dump" datatype="string" id="ocp_data_root" version="1" />
</def-group>
