<def-group>
  <!-- General check for OpenShift Container Platform 4 -->
  <definition class="inventory" id="installed_app_is_ocp4" version="1">
    <metadata>
      <title>Red Hat OpenShift Container Platform</title>
      <affected family="unix">
        <platform>multi_platform_eks</platform>
        <platform>multi_platform_ocp</platform>
      </affected>
      <reference ref_id="cpe:/a:redhat:openshift_container_platform:4.1" source="CPE" />
      <description>The application installed on the system is OpenShift 4.</description>
    </metadata>
    <criteria operator="AND">
      <criterion comment="cluster is OpenShift 4" test_ref="test_ocp4" />
      <criterion comment="Make sure OCP4 clusteroperators file is present" test_ref="test_file_for_ocp4"/>
    </criteria>
  </definition>

  <ind:yamlfilecontent_test id="test_ocp4" check="at least one" comment="Find one match" version="1">
      <ind:object object_ref="object_ocp4"/>
      <ind:state state_ref="state_ocp4"/>
  </ind:yamlfilecontent_test>

  <local_variable id="ocp4_dump_location" datatype="string" comment="The actual filepath of the file to scan." version="1">
      <literal_component>/kubernetes-api-resources/ocp/version</literal_component>
  </local_variable>

  <local_variable id="ocp4_hypershift_dump_location" datatype="string" comment="The actual filepath of the file to scan." version="1">
      <literal_component>/kubernetes-api-resources/hypershift/version</literal_component>
  </local_variable>

  <local_variable id="ocp4_operator_deployment_dump_location" datatype="string" comment="The actual filepath of the file to scan." version="1">
      <literal_component>/kubernetes-api-resources/api/v1/namespaces/openshift-compliance/pods/api-checks-pod</literal_component>
  </local_variable>

  <unix:file_test id="test_file_for_ocp4" check="only one" comment="Find the actual file to be scanned." version="1">
      <unix:object object_ref="object_file_for_ocp4"/>
  </unix:file_test>

  <unix:file_test id="test_hypershift_file_for_ocp4" check="only one" comment="Find the actual file to be scanned for hypershift." version="1">
      <unix:object object_ref="object_hypershift_file_for_ocp4"/>
  </unix:file_test>

  <unix:file_object id="object_hypershift_file_for_ocp4" version="1">
      <unix:filepath var_ref="ocp4_hypershift_dump_location"/>
  </unix:file_object>

  <ind:yamlfilecontent_object id="object_hypershift_ocp4" version="1">
      <ind:filepath var_ref="ocp4_hypershift_dump_location"/>
      <ind:yamlpath>[:]</ind:yamlpath>
  </ind:yamlfilecontent_object>


  <unix:file_object id="object_file_for_ocp4" version="1">
      <unix:filepath var_ref="ocp4_dump_location"/>
  </unix:file_object>

  <ind:yamlfilecontent_object id="object_ocp4" version="1">
      <ind:filepath var_ref="ocp4_dump_location"/>
      <ind:yamlpath>[:]</ind:yamlpath>
  </ind:yamlfilecontent_object>

  <ind:yamlfilecontent_state id="state_ocp4" version="1">
      <ind:value datatype="record">
          <field name="#" datatype="string" operation="pattern match">4\..*</field>
      </ind:value>
  </ind:yamlfilecontent_state>


  <ind:yamlfilecontent_test id="test_hypershift_version" check="at least one" comment="Find one match" version="1">
      <ind:object object_ref="object_hypershift_version"/>
      <ind:state state_ref="state_hypershift_version"/>
  </ind:yamlfilecontent_test>


  <ind:yamlfilecontent_object id="object_hypershift_version" version="1">
      <ind:filepath var_ref="ocp4_hypershift_dump_location"/>
      <ind:yamlpath>[:]</ind:yamlpath>
  </ind:yamlfilecontent_object>

  <ind:yamlfilecontent_state id="state_hypershift_version" version="1">
      <ind:value datatype="record">
          <field name="#" datatype="string" operation="pattern match">4\..*</field>
      </ind:value>
  </ind:yamlfilecontent_state>

  <ind:yamlfilecontent_test id="test_hypershift_hosted" check="at least one" comment="Find one match" version="1">
      <ind:object object_ref="object_hypershift_hosted"/>
      <ind:state state_ref="state_hypershift_hosted"/>
  </ind:yamlfilecontent_test>


  <ind:yamlfilecontent_object id="object_hypershift_hosted" version="1">
      <ind:filepath var_ref="ocp4_operator_deployment_dump_location"/>
      <ind:yamlpath>.spec.containers[:].command[:]</ind:yamlpath>
  </ind:yamlfilecontent_object>

  <ind:yamlfilecontent_state id="state_hypershift_hosted" version="1">
      <ind:value datatype="record" entity_check="at least one">
          <field name="#" datatype="string" operation="pattern match" entity_check="at least one">^--platform=HyperShift$</field>
      </ind:value>
  </ind:yamlfilecontent_state>

{{% for minorversion in range(6, 25) %}}
  <!-- Check for OpenShift Container Platform 4.{{{ minorversion }}} -->
  <definition class="inventory" id="installed_app_is_ocp4_{{{ minorversion }}}" version="1">
    <metadata>
      <title>Red Hat OpenShift Container Platform 4.{{{ minorversion }}}</title>
      <affected family="unix">
        <platform>Red Hat OpenShift Container Platform 4.{{{ minorversion }}}</platform>
      </affected>
      <reference ref_id="cpe:/a:redhat:openshift_container_platform:4.{{{ minorversion }}}" source="CPE" />
      <description>The application installed on the system is OpenShift version 4.{{{ minorversion }}}.</description>
    </metadata>
    <criteria operator="OR">
      <criteria operator="AND">
        <criterion comment="cluster is OpenShift 4.{{{ minorversion }}}" test_ref="test_ocp4_{{{ minorversion }}}" />
        <criterion comment="Make sure OCP4 clusteroperators file is present" test_ref="test_file_for_ocp4"/>
        <criterion negate="true" comment="HyperShift cluster should not have version" test_ref="test_hypershift_version" />
      </criteria>
      <criteria operator="AND">
        <criterion comment="cluster is OpenShift 4.{{{ minorversion }}}" test_ref="test_hypershift_ocp4_{{{ minorversion }}}" />
        <criterion comment="Make sure HyperShift OCP4 clusteroperators file is present" test_ref="test_hypershift_file_for_ocp4"/>
      </criteria>
    </criteria>
  </definition>

  <ind:yamlfilecontent_test id="test_ocp4_{{{ minorversion }}}" check="at least one" comment="Find one match" version="1">
      <ind:object object_ref="object_ocp4"/>
      <ind:state state_ref="state_ocp4_{{{ minorversion }}}"/>
  </ind:yamlfilecontent_test>

  <ind:yamlfilecontent_test id="test_hypershift_ocp4_{{{ minorversion }}}" check="at least one" comment="Find one match" version="1">
      <ind:object object_ref="object_hypershift_ocp4"/>
      <ind:state state_ref="state_ocp4_{{{ minorversion }}}"/>
  </ind:yamlfilecontent_test>


  <ind:yamlfilecontent_state id="state_ocp4_{{{ minorversion }}}" version="1">
      <ind:value datatype="record">
          <field name="#" datatype="string" operation="pattern match">\b4\.{{{ minorversion }}}.*</field>
      </ind:value>
  </ind:yamlfilecontent_state>

{{% endfor %}}

  <!-- helpers for platform/cloud checks -->
  <local_variable id="ocp4_infra_dump_location" datatype="string" comment="The actual filepath of the infra file to scan." version="1">
      <literal_component>/kubernetes-api-resources/apis/config.openshift.io/v1/infrastructures/cluster</literal_component>
  </local_variable>

  <unix:file_test id="test_file_for_ocp4_infra" check="only one" comment="Find the actual file for the infra to be scanned." version="1">
      <unix:object object_ref="object_file_for_ocp4_infra"/>
  </unix:file_test>

  <unix:file_object id="object_file_for_ocp4_infra" version="1">
      <unix:filepath var_ref="ocp4_infra_dump_location"/>
  </unix:file_object>

  <ind:yamlfilecontent_object id="object_ocp4_infra_platform" version="1">
      <ind:filepath var_ref="ocp4_infra_dump_location"/>
      <ind:yamlpath>.status.platform</ind:yamlpath>
  </ind:yamlfilecontent_object>

  <!-- Check for OpenShift Container Platform 4 in specific platforms or clouds -->
{{% for platform in ["AWS", "Azure", "GCP"] %}}
  <!-- Check for OpenShift Container Platform 4.{{{ minorversion }}} -->
  <definition class="inventory" id="installed_app_is_ocp4_on_{{{ platform|lower }}}" version="1">
    <metadata>
      <title>Red Hat OpenShift Container Platform 4 on {{{ platform }}}</title>
      <affected family="unix">
        <platform>Red Hat OpenShift Container Platform 4 on {{{ platform }}}</platform>
      </affected>
      <reference ref_id="cpe:/a:redhat:openshift_container_platform_on_{{{ platform|lower }}}:4" source="CPE" />
      <description>The application installed on the system is OpenShift version 4 on {{{ platform }}}.</description>
    </metadata>
    <criteria operator="AND">
      <criterion comment="cluster is OpenShift 4 on {{{ platform }}}" test_ref="test_ocp4_on_{{{ platform|lower }}}" />
      <criterion comment="Make sure OCP4 infrastructure/cluster file is present" test_ref="test_file_for_ocp4_infra"/>
    </criteria>
  </definition>

  <ind:yamlfilecontent_test id="test_ocp4_on_{{{ platform|lower }}}" check="at least one" comment="Find one match" version="1">
      <ind:object object_ref="object_ocp4_infra_platform"/>
      <ind:state state_ref="state_ocp4_on_{{{ platform|lower }}}"/>
  </ind:yamlfilecontent_test>

  <ind:yamlfilecontent_state id="state_ocp4_on_{{{ platform|lower }}}" version="1">
      <ind:value datatype="record">
          <field name="#" datatype="string" operation="pattern match">^{{{ platform }}}$</field>
      </ind:value>
  </ind:yamlfilecontent_state>

{{% endfor %}}

  <!-- helpers for ovn/sdn network cpe check-->
  <local_variable id="ocp4_network_dump_location" datatype="string" comment="The actual filepath of the network file to scan." version="1">
      <literal_component>/kubernetes-api-resources/apis/config.openshift.io/v1/networks/cluster</literal_component>
  </local_variable>

  <unix:file_test id="test_file_for_ocp4_network" check="only one" comment="Find the actual file for the network to be scanned." version="1">
      <unix:object object_ref="object_file_for_ocp4_network"/>
  </unix:file_test>

  <unix:file_object id="object_file_for_ocp4_network" version="1">
      <unix:filepath var_ref="ocp4_network_dump_location"/>
  </unix:file_object>

  <ind:yamlfilecontent_object id="object_ocp4_platform_network" version="1">
      <ind:filepath var_ref="ocp4_network_dump_location"/>
      <ind:yamlpath>.status.networkType</ind:yamlpath>
  </ind:yamlfilecontent_object>

  <!-- Check for OpenShift Container Platform 4 using specific network type -->
{{% for network in ["OpenShiftSDN", "OpenShiftOVN"] %}}
  <definition class="inventory" id="installed_app_is_ocp4_on_{{{ network|lower }}}" version="1">
    <metadata>
      <title>Red Hat OpenShift Container network 4 on {{{ network }}}</title>
      <affected family="unix">
        <platform>Red Hat OpenShift Container network 4 on {{{ network }}}</platform>
      </affected>
      <reference ref_id="cpe:/a:redhat:openshift_container_network_on_{{{ network|lower }}}:4" source="CPE" />
      <description>The application installed on the system is OpenShift version 4 on {{{ network }}}.</description>
    </metadata>
    <criteria operator="AND">
      <criterion comment="cluster is OpenShift 4 on {{{ network }}}" test_ref="test_ocp4_on_{{{ network|lower }}}" />
      <criterion comment="Make sure OCP4 networkstructure/cluster file is present" test_ref="test_file_for_ocp4_network"/>
    </criteria>
  </definition>

  <ind:yamlfilecontent_test id="test_ocp4_on_{{{ network|lower }}}" check="at least one" comment="Find one match" version="1">
      <ind:object object_ref="object_ocp4_platform_network"/>
      <ind:state state_ref="state_ocp4_on_{{{ network|lower }}}"/>
  </ind:yamlfilecontent_test>

  <ind:yamlfilecontent_state id="state_ocp4_on_{{{ network|lower }}}" version="1">
      <ind:value datatype="record">
{{% if network == "OpenShiftOVN" %}}
          <field name="#" datatype="string" operation="pattern match">^(OpenShiftOVN|OVNKubernetes)$</field>
{{% else %}}
          <field name="#" datatype="string" operation="pattern match">^{{{ network }}}$</field>
{{% endif %}}
      </ind:value>
  </ind:yamlfilecontent_state>
{{% endfor %}}

  <!-- Check for OpenShift Container Platform 4 on HyperShift Management Cluster -->
  <definition class="inventory" id="installed_app_is_ocp4_on_hypershift" version="1">
    <metadata>
      <title>Red Hat OpenShift Container Platform</title>
      <affected family="unix">
        <platform>Red Hat OpenShift Container Platform 4 on HyperShift</platform>
      </affected>
      <reference ref_id="cpe:/a:redhat:openshift_container_platform_on_hypershift:4" source="CPE" />
      <description>The application installed on the system is OpenShift 4 on HyperShift Management Cluster.</description>
    </metadata>
    <criteria operator="AND">
      <criterion comment="Make sure there is version for HyperShift HostedCluster" test_ref="test_hypershift_version"/>
    </criteria>
  </definition>

    <!-- Check for OpenShift Container Platform 4 on HyperShift Hosted Cluster -->
  <definition class="inventory" id="installed_app_is_ocp4_on_hypershift_hosted" version="1">
    <metadata>
      <title>Red Hat OpenShift Container Platform</title>
      <affected family="unix">
        <platform>Red Hat OpenShift Container Platform 4 on HyperShift</platform>
      </affected>
      <reference ref_id="cpe:/a:redhat:openshift_container_platform_on_hypershift_hosted:4" source="CPE" />
      <description>The application installed on the system is OpenShift 4 on HyperShift Hosted Cluster.</description>
    </metadata>
    <criteria operator="AND">
      <criterion comment="Make sure there is HyperShift in the Compliance Operator Command flag" test_ref="test_hypershift_hosted"/>
    </criteria>
  </definition>

</def-group>
