@opensoha/contracts 0.1.24 → 0.1.25

package/resource/network_topology_projection.go

@@ -0,0 +1,208 @@
+package resource
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// ProjectNetworkTopologyObject is the wire allowlist shared by both Kubernetes readers.
+// Wildcards copy scalar label values only; no arbitrary manifest subtree is transported.
+func ProjectNetworkTopologyObject(source string, object map[string]any) (map[string]any, error) {
+	paths, ok := topologyProjectionPaths[source]
+	if !ok {
+		return nil, fmt.Errorf("unknown topology source")
+	}
+	paths = append(strings.Fields("metadata.name metadata.namespace metadata.uid metadata.resourceVersion metadata.generation"), paths...)
+	tree := map[string]any{}
+	for _, path := range paths {
+		addTopologyProjectionPath(tree, strings.Split(path, "."))
+	}
+	projected, _ := projectTopologyValue(object, tree).(map[string]any)
+	redactTopologyMatches(projected, "")
+	if source == "kubernetes.endpointslices" {
+		if metadata, ok := projected["metadata"].(map[string]any); ok {
+			if labels, ok := metadata["labels"].(map[string]any); ok {
+				metadata["labels"] = map[string]any{"kubernetes.io/service-name": labels["kubernetes.io/service-name"]}
+			}
+		}
+	}
+	if source == "traefik.middlewares" || source == "traefik.middlewaretcps" {
+		projected["processorTypes"] = topologyMiddlewareTypes(object)
+	}
+	raw, err := json.Marshal(projected)
+	if err != nil || len(raw) > NetworkTopologyMaxObjectBytes {
+		return nil, fmt.Errorf("topology object exceeds projection budget")
+	}
+	return projected, nil
+}
+
+func addTopologyProjectionPath(tree map[string]any, path []string) {
+	if len(path) == 0 {
+		return
+	}
+	if len(path) == 1 {
+		tree[path[0]] = true
+		return
+	}
+	next, _ := tree[path[0]].(map[string]any)
+	if next == nil {
+		next = map[string]any{}
+		tree[path[0]] = next
+	}
+	addTopologyProjectionPath(next, path[1:])
+}
+
+func projectTopologyValue(value any, tree map[string]any) any {
+	switch input := value.(type) {
+	case map[string]any:
+		output := map[string]any{}
+		for key, value := range input {
+			rule, ok := tree[key]
+			if !ok {
+				rule, ok = tree["*"]
+			}
+			if !ok {
+				continue
+			}
+			if children, ok := rule.(map[string]any); ok {
+				output[key] = projectTopologyValue(value, children)
+			} else if safe, ok := topologyLeaf(value); ok {
+				output[key] = safe
+			}
+		}
+		return output
+	case []any:
+		output := make([]any, 0, len(input))
+		for _, value := range input {
+			if scalarTopologyValue(value) {
+				output = append(output, value)
+			} else {
+				output = append(output, projectTopologyValue(value, tree))
+			}
+		}
+		return output
+	default:
+		if scalarTopologyValue(value) {
+			return value
+		}
+		return nil
+	}
+}
+
+func scalarTopologyValue(value any) bool {
+	switch value.(type) {
+	case nil, string, bool, float64, json.Number, int, int32, int64:
+		return true
+	}
+	return false
+}
+
+func redactTopologyMatches(value any, key string) {
+	switch item := value.(type) {
+	case map[string]any:
+		if key == "headers" || key == "queryParams" || key == "exprs" {
+			if _, ok := item["value"]; ok {
+				item["value"] = "[redacted]"
+			}
+			if _, ok := item["set"]; ok {
+				item["set"] = []any{"[redacted]"}
+			}
+		}
+		if match, ok := item["match"].(string); ok && (strings.Contains(strings.ToLower(match), "header") || strings.Contains(strings.ToLower(match), "query")) {
+			item["match"] = "[redacted match expression]"
+		}
+		for child, value := range item {
+			redactTopologyMatches(value, child)
+		}
+	case []any:
+		for _, value := range item {
+			redactTopologyMatches(value, key)
+		}
+	}
+}
+
+var topologyProjectionPaths = map[string][]string{
+	"kubernetes.services":       strings.Fields("spec.type spec.externalName spec.clusterIP spec.selector.* spec.ports.name spec.ports.port spec.ports.targetPort spec.ports.protocol spec.publishNotReadyAddresses"),
+	"kubernetes.pods":           strings.Fields("metadata.labels.* status.phase status.conditions.type status.conditions.status"),
+	"kubernetes.endpointslices": strings.Fields("metadata.labels.* addressType ports.name ports.port ports.protocol endpoints.addresses endpoints.conditions.ready endpoints.conditions.serving endpoints.conditions.terminating endpoints.targetRef.kind endpoints.targetRef.namespace endpoints.targetRef.name endpoints.targetRef.uid"),
+	"kubernetes.ingresses":      strings.Fields("spec.ingressClassName spec.defaultBackend.service.name spec.defaultBackend.service.port.name spec.defaultBackend.service.port.number spec.defaultBackend.resource.kind spec.rules.host spec.rules.http.paths.path spec.rules.http.paths.pathType spec.rules.http.paths.backend.service.name spec.rules.http.paths.backend.service.port.name spec.rules.http.paths.backend.service.port.number spec.rules.http.paths.backend.resource.kind spec.tls.hosts"),
+	"kubernetes.ingressclasses": strings.Fields("spec.controller"),
+	"gateway.gateways":          strings.Fields("spec.gatewayClassName spec.listeners.name spec.listeners.port spec.listeners.protocol spec.listeners.hostname spec.listeners.allowedRoutes.namespaces.from spec.listeners.allowedRoutes.namespaces.selector.matchLabels.* spec.listeners.allowedRoutes.kinds.kind spec.listeners.allowedRoutes.kinds.group spec.listeners.tls.mode"),
+	"gateway.gatewayclasses":    strings.Fields("spec.controllerName"),
+	"gateway.httproutes":        gatewayTopologyPaths(),
+	"gateway.grpcroutes":        gatewayTopologyPaths(),
+	"gateway.tcproutes":         gatewayL4TopologyPaths(),
+	"gateway.tlsroutes":         gatewayL4TopologyPaths(),
+	"gateway.udproutes":         gatewayL4TopologyPaths(),
+	"gateway.referencegrants":   strings.Fields("spec.from.group spec.from.kind spec.from.namespace spec.to.group spec.to.kind spec.to.name"),
+	"traefik.ingressroutes":     traefikTopologyPaths(),
+	"traefik.ingressroutetcps":  traefikTopologyPaths(),
+	"traefik.ingressrouteudps":  traefikTopologyPaths(),
+	"traefik.traefikservices":   strings.Fields("spec.weighted.services.name spec.weighted.services.namespace spec.weighted.services.kind spec.weighted.services.port spec.weighted.services.weight spec.mirroring.name spec.mirroring.namespace spec.mirroring.kind spec.mirroring.port spec.mirroring.mirrors.name spec.mirroring.mirrors.namespace spec.mirroring.mirrors.kind spec.mirroring.mirrors.port spec.mirroring.mirrors.percent"),
+	"traefik.middlewares":       strings.Fields("spec.chain.middlewares.name spec.chain.middlewares.namespace"),
+	"traefik.middlewaretcps":    strings.Fields("spec.chain.middlewares.name spec.chain.middlewares.namespace"),
+	"apisix.apisixroutes":       apisixTopologyPaths(),
+	"apisix.apisixupstreams":    strings.Fields("spec.scheme spec.loadbalancer.type spec.externalNodes.type spec.externalNodes.name spec.externalNodes.port spec.externalNodes.weight spec.subsets.name spec.subsets.labels.*"),
+	"apisix.apisixtls":          strings.Fields("spec.hosts spec.secret.name spec.secret.namespace"),
+}
+
+func gatewayTopologyPaths() []string {
+	return strings.Fields("spec.hostnames spec.parentRefs.group spec.parentRefs.kind spec.parentRefs.name spec.parentRefs.namespace spec.parentRefs.sectionName spec.parentRefs.port spec.rules.name spec.rules.matches.path.type spec.rules.matches.path.value spec.rules.matches.method spec.rules.matches.method.type spec.rules.matches.method.service spec.rules.matches.method.method spec.rules.matches.headers.name spec.rules.matches.headers.type spec.rules.matches.headers.value spec.rules.matches.queryParams.name spec.rules.matches.queryParams.type spec.rules.matches.queryParams.value spec.rules.backendRefs.group spec.rules.backendRefs.kind spec.rules.backendRefs.name spec.rules.backendRefs.namespace spec.rules.backendRefs.port spec.rules.backendRefs.weight spec.rules.filters.type spec.rules.filters.requestMirror.backendRef.group spec.rules.filters.requestMirror.backendRef.kind spec.rules.filters.requestMirror.backendRef.name spec.rules.filters.requestMirror.backendRef.namespace spec.rules.filters.requestMirror.backendRef.port spec.rules.filters.requestMirror.percent status.parents.parentRef.name status.parents.parentRef.namespace status.parents.parentRef.sectionName status.parents.conditions.type status.parents.conditions.status status.parents.conditions.reason status.parents.conditions.observedGeneration status.parents.conditions.lastTransitionTime")
+}
+func gatewayL4TopologyPaths() []string {
+	return strings.Fields("spec.hostnames spec.parentRefs.group spec.parentRefs.kind spec.parentRefs.name spec.parentRefs.namespace spec.parentRefs.sectionName spec.parentRefs.port spec.rules.name spec.rules.backendRefs.group spec.rules.backendRefs.kind spec.rules.backendRefs.name spec.rules.backendRefs.namespace spec.rules.backendRefs.port spec.rules.backendRefs.weight status.parents.parentRef.name status.parents.parentRef.namespace status.parents.parentRef.sectionName status.parents.conditions.type status.parents.conditions.status status.parents.conditions.reason status.parents.conditions.observedGeneration status.parents.conditions.lastTransitionTime")
+}
+func traefikTopologyPaths() []string {
+	return strings.Fields("spec.entryPoints spec.tls.passthrough spec.routes.kind spec.routes.match spec.routes.priority spec.routes.middlewares.name spec.routes.middlewares.namespace spec.routes.services.name spec.routes.services.namespace spec.routes.services.kind spec.routes.services.port spec.routes.services.weight spec.routes.services.scheme")
+}
+func apisixTopologyPaths() []string {
+	return strings.Fields("spec.ingressClassName spec.http.name spec.http.priority spec.http.match.hosts spec.http.match.paths spec.http.match.methods spec.http.match.remoteAddrs spec.http.match.exprs.subject.scope spec.http.match.exprs.subject.name spec.http.match.exprs.op spec.http.match.exprs.value spec.http.match.exprs.set spec.http.backend.serviceName spec.http.backend.servicePort spec.http.backend.weight spec.http.backends.serviceName spec.http.backends.servicePort spec.http.backends.weight spec.http.plugins.name spec.http.plugins.enable spec.stream.name spec.stream.protocol spec.stream.match.ingressPort spec.stream.backend.serviceName spec.stream.backend.servicePort spec.stream.backend.weight")
+}
+
+func topologyLeaf(value any) (any, bool) {
+	if scalarTopologyValue(value) {
+		return value, true
+	}
+	if items, ok := value.([]any); ok {
+		output := []any{}
+		for _, item := range items {
+			if !scalarTopologyValue(item) {
+				return nil, false
+			}
+			output = append(output, item)
+		}
+		return output, true
+	}
+	return nil, false
+}
+
+func topologyMiddlewareTypes(input map[string]any) []string {
+	allowed := strings.Fields("addPrefix basicAuth buffer circuitBreaker chain compress contentType digestAuth errors forwardAuth grpcWeb headers inFlightReq ipAllowList ipWhiteList passTLSClientCert rateLimit redirectRegex redirectScheme replacePath replacePathRegex retry stripPrefix stripPrefixRegex inFlightConn ipAllowListTCP")
+	found := map[string]bool{}
+	if spec, ok := input["spec"].(map[string]any); ok {
+		for key := range spec {
+			for _, name := range allowed {
+				if key == name {
+					found[name] = true
+				}
+			}
+		}
+	}
+	if existing, ok := input["processorTypes"].([]any); ok {
+		for _, value := range existing {
+			for _, name := range allowed {
+				if value == name {
+					found[name] = true
+				}
+			}
+		}
+	}
+	result := []string{}
+	for name := range found {
+		result = append(result, name)
+	}
+	sort.Strings(result)
+	return result
+}

package/resource/network_topology_projection_test.go

@@ -0,0 +1,53 @@
+package resource
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestTopologyProjectionExcludesCredentialsAndPreservesAlternatives(t *testing.T) {
+	for _, test := range []struct {
+		source, input string
+		keep          []string
+	}{
+		{"kubernetes.pods", `{"metadata":{"name":"p","namespace":"n","annotations":{"token":"secret-value"},"labels":{"app":"web"}},"spec":{"containers":[{"env":[{"value":"secret-value"}]}]},"status":{"phase":"Running"}}`, []string{"Running", "web"}},
+		{"gateway.httproutes", `{"metadata":{"name":"r"},"spec":{"rules":[{"matches":[{"method":"GET","headers":[{"name":"Authorization","value":"secret-value"}],"queryParams":[{"name":"token","value":"secret-value"}]}],"backendRefs":[{"name":"web","weight":0,"port":80}]}]}}`, []string{"GET", "[redacted]", "\"weight\":0"}},
+		{"gateway.tcproutes", `{"spec":{"parentRefs":[{"name":"gw","sectionName":"tcp","port":9000}],"rules":[{"backendRefs":[{"name":"web","port":9000,"weight":0}],"filters":[{"secret":"secret-value"}]}]}}`, []string{"tcp", "9000", "\"weight\":0"}},
+		{"gateway.tlsroutes", `{"spec":{"hostnames":["secure.test"],"parentRefs":[{"name":"gw","sectionName":"tls"}],"rules":[{"backendRefs":[{"name":"web","port":9443}]}],"tls":{"key":"secret-value"}}}`, []string{"secure.test", "tls", "9443"}},
+		{"gateway.udproutes", `{"spec":{"parentRefs":[{"name":"gw","sectionName":"udp"}],"rules":[{"backendRefs":[{"name":"dns","port":53,"weight":2}]}]},"status":{"parents":[{"conditions":[{"type":"Accepted","status":"True","message":"secret-value"}]}]}}`, []string{"udp", "53", "Accepted"}},
+		{"apisix.apisixroutes", `{"metadata":{"name":"r"},"spec":{"http":[{"match":{"hosts":["a.test","b.test"],"paths":["/a","/b"],"exprs":[{"subject":{"scope":"Header","name":"token"},"value":"secret-value"}]},"plugins":[{"name":"key-auth","enable":true,"config":{"key":"secret-value"},"secretRef":"secret-value"}]}]}}`, []string{"a.test", "b.test", "/a", "/b", "key-auth"}},
+		{"traefik.ingressroutes", `{"metadata":{"name":"r"},"spec":{"routes":[{"match":"Header(authorization,secret-value)","services":[{"name":"web","port":80}]}],"tls":{"secretName":"secret-value"}}}`, []string{"[redacted match expression]", "web"}},
+		{"traefik.middlewares", `{"metadata":{"name":"m"},"spec":{"basicAuth":{"users":["secret-value"]},"chain":{"middlewares":[{"name":"next"}]}}}`, []string{"basicAuth", "next"}},
+	} {
+		t.Run(test.source, func(t *testing.T) {
+			var raw map[string]any
+			if err := json.Unmarshal([]byte(test.input), &raw); err != nil {
+				t.Fatal(err)
+			}
+			projection, err := ProjectNetworkTopologyObject(test.source, raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+			data, _ := json.Marshal(projection)
+			if strings.Contains(string(data), "secret-value") {
+				t.Fatalf("credential escaped: %s", data)
+			}
+			for _, value := range test.keep {
+				if !strings.Contains(string(data), value) {
+					t.Fatalf("lost %q: %s", value, data)
+				}
+			}
+			var again map[string]any
+			_ = json.Unmarshal(data, &again)
+			second, err := ProjectNetworkTopologyObject(test.source, again)
+			if err != nil {
+				t.Fatal(err)
+			}
+			data2, _ := json.Marshal(second)
+			if string(data) != string(data2) {
+				t.Fatalf("projection is not stable: %s -> %s", data, data2)
+			}
+		})
+	}
+}

package/resource/network_topology_test.go

@@ -0,0 +1,51 @@
+package resource
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestTopologySourceQueriesCannotSelectArbitraryResourcesOrEscapeScope(t *testing.T) {
+	valid := NetworkTopologySnapshotRequest{Queries: []NetworkTopologySourceQuery{{SourceID: "traefik.ingressroutes", Namespace: "team-a"}, {SourceID: "kubernetes.ingressclasses"}}}
+	if err := ValidateNetworkTopologySnapshotRequest(valid); err != nil {
+		t.Fatal(err)
+	}
+	for _, queries := range [][]NetworkTopologySourceQuery{
+		nil,
+		{{SourceID: "kubernetes.secrets", Namespace: "team-a"}},
+		{{SourceID: "traefik.ingressroutes", Namespace: "../../secrets"}},
+		{{SourceID: "kubernetes.ingressclasses", Namespace: "team-a"}},
+		{{SourceID: "traefik.ingressroutes", Namespace: strings.Repeat("a", 64)}},
+		{{SourceID: "traefik.ingressroutes"}, {SourceID: "traefik.ingressroutes"}},
+		make([]NetworkTopologySourceQuery, NetworkTopologyMaxQueries+1),
+	} {
+		if err := ValidateNetworkTopologySnapshotRequest(NetworkTopologySnapshotRequest{Queries: queries}); err == nil {
+			t.Fatalf("unsafe snapshot queries accepted: %+v", queries)
+		}
+	}
+}
+
+func TestTopologySourcesKeepSupportedVersionsAndDedicatedKindsExplicit(t *testing.T) {
+	seen := map[string]bool{}
+	for _, definition := range NetworkTopologySources() {
+		if seen[definition.ID] || definition.Kind == "Secret" || definition.Resource == "secrets" || definition.Resource == "*" || definition.Group == "*" {
+			t.Fatalf("unsafe source registry: %+v", definition)
+		}
+		seen[definition.ID] = true
+	}
+	for _, id := range []string{"gateway.tcproutes", "gateway.tlsroutes", "gateway.udproutes"} {
+		d, ok := LookupNetworkTopologySource(id)
+		if !ok || d.Version != "v1" || d.FallbackVersion != "v1alpha2" || !d.RequiresCustomResourceAccess() {
+			t.Fatalf("Gateway L4 source must be versioned and explicitly authorized: %+v", d)
+		}
+	}
+	grant, ok := LookupNetworkTopologySource("gateway.referencegrants")
+	if !ok || grant.Version != "v1" || grant.FallbackVersion != "v1beta1" {
+		t.Fatalf("ReferenceGrant served-version support: %+v", grant)
+	}
+	definitions := NetworkTopologySources()
+	definitions[0].Kind = "Secret"
+	if NetworkTopologySources()[0].Kind == "Secret" {
+		t.Fatal("source allowlist is mutable by callers")
+	}
+}

package/resource/network_topology_validation.go

@@ -0,0 +1,29 @@
+package resource
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+)
+
+var topologyNamespacePattern = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]*[a-z0-9])?$`)
+
+func ValidateNetworkTopologySnapshotRequest(request NetworkTopologySnapshotRequest) error {
+	if len(request.Queries) == 0 || len(request.Queries) > NetworkTopologyMaxQueries {
+		return fmt.Errorf("topology snapshot requires between 1 and 64 source queries")
+	}
+	seen := make(map[NetworkTopologySourceQuery]bool, len(request.Queries))
+	for _, query := range request.Queries {
+		definition, ok := LookupNetworkTopologySource(query.SourceID)
+		if !ok || seen[query] {
+			return fmt.Errorf("unknown or duplicate topology source query")
+		}
+		seen[query] = true
+		if query.Namespace != "" && (!definition.Namespaced || len(query.Namespace) > 63 || !topologyNamespacePattern.MatchString(query.Namespace)) {
+			return fmt.Errorf("invalid topology source namespace")
+		}
+	}
+	return nil
+}
+
+var ErrNetworkTopologySnapshotUnsupported = errors.New("agent topology snapshot unsupported")

package/resource/node_drain.go

@@ -0,0 +1,34 @@
+package resource
+
+// NodeDrainError reports an incomplete drain without exposing provider error text.
+type NodeDrainError struct {
+	Code  string
+	Cause error
+}
+
+func (e *NodeDrainError) Error() string {
+	switch e.Code {
+	case "node_drain_pdb_blocked":
+		return "PodDisruptionBudget blocked eviction. The drain did not complete; inspect remaining pods and scheduling before retrying."
+	case "node_drain_eviction_blocked":
+		return "Eviction was repeatedly refused. Check disruption budgets or API throttling and inspect remaining pods before retrying."
+	case "node_drain_timeout":
+		return "The drain timed out before all evictable pods terminated. Inspect remaining pods and scheduling before retrying."
+	case "node_drain_canceled":
+		return "The drain was interrupted. Previously submitted evictions may still finish; inspect remaining pods and scheduling."
+	case "node_drain_pod_selection":
+		return "Evictable pods could not be selected. Check pod read access and drain options for unmanaged pods or emptyDir data."
+	default:
+		return "The drain did not complete. Inspect remaining pods, disruption budgets and permissions before retrying."
+	}
+}
+
+func (e *NodeDrainError) Unwrap() error { return e.Cause }
+
+func IsNodeDrainErrorCode(code string) bool {
+	switch code {
+	case "node_drain_pdb_blocked", "node_drain_eviction_blocked", "node_drain_timeout", "node_drain_canceled", "node_drain_pod_selection", "node_drain_failed":
+		return true
+	}
+	return false
+}

package/resource/resource_monitoring.go

@@ -0,0 +1,99 @@
+package resource
+
+const ResourceMonitoringSnapshotFeature = "resource.monitoring.snapshot.v1"
+const ResourceMonitoringMaxNodes = 500
+const ResourceMonitoringMaxPoints = 1440
+const ResourceMonitoringMaxTotalPoints = 60000
+
+type ResourceMonitoringQuery struct {
+	View         string `json:"view"`
+	Node         string `json:"node,omitempty"`
+	From         string `json:"from,omitempty"`
+	To           string `json:"to,omitempty"`
+	RangeMinutes int    `json:"rangeMinutes,omitempty"`
+	StepSeconds  int    `json:"stepSeconds,omitempty"`
+}
+
+type ResourceMonitoringQuantity struct {
+	CPUCores    *float64 `json:"cpuCores"`
+	MemoryBytes *float64 `json:"memoryBytes"`
+	PodSlots    *float64 `json:"podSlots"`
+}
+
+type ResourceMonitoringNode struct {
+	NodeRef              ResourceRef                `json:"nodeRef"`
+	InternalIP           string                     `json:"internalIP,omitempty"`
+	OS                   string                     `json:"os,omitempty"`
+	CreatedAt            string                     `json:"createdAt,omitempty"`
+	Ready                string                     `json:"ready"`
+	Cordoned             bool                       `json:"cordoned"`
+	MemoryPressure       string                     `json:"memoryPressure"`
+	DiskPressure         string                     `json:"diskPressure"`
+	PIDPressure          string                     `json:"pidPressure"`
+	Capacity             ResourceMonitoringQuantity `json:"capacity"`
+	Allocatable          ResourceMonitoringQuantity `json:"allocatable"`
+	Requests             ResourceMonitoringQuantity `json:"requests"`
+	Limits               ResourceMonitoringQuantity `json:"limits"`
+	CPULimitsComplete    bool                       `json:"cpuLimitsComplete"`
+	MemoryLimitsComplete bool                       `json:"memoryLimitsComplete"`
+	BoundPods            *float64                   `json:"boundPods"`
+	PendingPods          *float64                   `json:"pendingPods"`
+	RemainingPodSlots    *float64                   `json:"remainingPodSlots"`
+	OverflowPodSlots     *float64                   `json:"overflowPodSlots"`
+	Quality              string                     `json:"quality"`
+	ObservedAt           string                     `json:"observedAt,omitempty"`
+}
+
+type ResourceMonitoringInventory struct {
+	Nodes                  []ResourceMonitoringNode `json:"nodes"`
+	UnscheduledPendingPods *float64                 `json:"unscheduledPendingPods"`
+	Quality                string                   `json:"quality"`
+	ReasonCode             string                   `json:"reasonCode,omitempty"`
+	ObservedAt             string                   `json:"observedAt"`
+	Truncated              bool                     `json:"truncated,omitempty"`
+}
+
+type ResourceMonitoringPoint struct {
+	Timestamp string   `json:"timestamp"`
+	Value     *float64 `json:"value"`
+}
+
+type ResourceMonitoringSeries struct {
+	NodeRef    ResourceRef               `json:"nodeRef"`
+	MetricKey  string                    `json:"metricKey"`
+	Unit       string                    `json:"unit"`
+	Quality    string                    `json:"quality"`
+	ReasonCode string                    `json:"reasonCode,omitempty"`
+	Source     string                    `json:"source"`
+	SampledAt  string                    `json:"sampledAt,omitempty"`
+	Latest     *float64                  `json:"latest"`
+	Points     []ResourceMonitoringPoint `json:"points"`
+}
+
+type ResourceMonitoringPanel struct {
+	Key           string                     `json:"key"`
+	Label         string                     `json:"label"`
+	Unit          string                     `json:"unit"`
+	Quality       string                     `json:"quality"`
+	ReasonCode    string                     `json:"reasonCode,omitempty"`
+	Estimated     bool                       `json:"estimated,omitempty"`
+	WindowSeconds int                        `json:"windowSeconds,omitempty"`
+	Series        []ResourceMonitoringSeries `json:"series"`
+}
+
+type ResourceMonitoringView struct {
+	NodeOptions            []ResourceRef             `json:"nodeOptions,omitempty"`
+	ClusterID              string                    `json:"clusterId"`
+	View                   string                    `json:"view"`
+	Node                   string                    `json:"node,omitempty"`
+	From                   string                    `json:"from"`
+	To                     string                    `json:"to"`
+	StepSeconds            int                       `json:"stepSeconds"`
+	GeneratedAt            string                    `json:"generatedAt"`
+	SnapshotObservedAt     string                    `json:"snapshotObservedAt,omitempty"`
+	SnapshotQuality        string                    `json:"snapshotQuality"`
+	UnscheduledPendingPods *float64                  `json:"unscheduledPendingPods"`
+	Nodes                  []ResourceMonitoringNode  `json:"nodes"`
+	Panels                 []ResourceMonitoringPanel `json:"panels"`
+	Truncated              bool                      `json:"truncated,omitempty"`
+}