{
  "description": "Plugin defines a KubeVirt extension that can modify VM domain XML,\nhook into VM lifecycle events, and reference admission objects.",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "Spec defines the plugin's hooks and admission references.",
      "properties": {
        "condition": {
          "description": "Condition is a CEL expression that determines whether this plugin applies to a given VM.\nWhen set, this acts as a baseline filter for all hooks in the plugin.\nIndividual hooks may further narrow the scope with their own Condition fields.",
          "type": "string"
        },
        "domainHooks": {
          "description": "DomainHooks defines hooks that modify the libvirt domain XML.\nHooks are applied in declaration order within each plugin.\nAcross plugins, hooks are applied in alphabetical order by plugin name.",
          "items": {
            "description": "DomainHook defines a hook that modifies the libvirt domain XML.\nExactly one of cel or sidecar must be specified.",
            "properties": {
              "cel": {
                "description": "CEL defines a CEL expression that transforms the domain XML.",
                "properties": {
                  "expression": {
                    "description": "Expression is the CEL expression applied to the domain XML.",
                    "minLength": 1,
                    "type": "string"
                  }
                },
                "required": [
                  "expression"
                ],
                "type": "object",
                "additionalProperties": false
              },
              "condition": {
                "description": "Condition is a CEL expression that determines whether this hook applies to a given VM.",
                "type": "string"
              },
              "failureStrategy": {
                "description": "FailureStrategy specifies how to handle hook failures (Fail or Ignore).",
                "type": "string"
              },
              "sidecar": {
                "description": "Sidecar defines a sidecar-based hook that transforms the domain XML via a Unix socket.",
                "properties": {
                  "socketPath": {
                    "description": "SocketPath is the path to the Unix socket used to communicate with the sidecar.",
                    "minLength": 1,
                    "type": "string"
                  }
                },
                "required": [
                  "socketPath"
                ],
                "type": "object",
                "additionalProperties": false
              },
              "timeout": {
                "description": "Timeout specifies the maximum duration to wait for the hook to complete.",
                "type": "string"
              }
            },
            "type": "object",
            "additionalProperties": false
          },
          "type": "array",
          "x-kubernetes-list-type": "atomic"
        },
        "failureStrategy": {
          "description": "FailureStrategy specifies the default behavior when the plugin itself is unhealthy\n(e.g. a referenced webhook is not ready, or a sidecar socket is unreachable).\nIndividual hooks may override this with their own FailureStrategy.",
          "type": "string"
        },
        "mutatingAdmissionPolicies": {
          "description": "MutatingAdmissionPolicies references MutatingAdmissionPolicy objects managed by the plugin.",
          "items": {
            "description": "AdmissionReference is a reference to an admission object by name.",
            "properties": {
              "name": {
                "description": "Name is the name of the admission object.",
                "minLength": 1,
                "type": "string"
              }
            },
            "required": [
              "name"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array",
          "x-kubernetes-list-type": "atomic"
        },
        "mutatingAdmissionWebhooks": {
          "description": "MutatingAdmissionWebhooks references MutatingWebhookConfiguration objects managed by the plugin.",
          "items": {
            "description": "AdmissionReference is a reference to an admission object by name.",
            "properties": {
              "name": {
                "description": "Name is the name of the admission object.",
                "minLength": 1,
                "type": "string"
              }
            },
            "required": [
              "name"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array",
          "x-kubernetes-list-type": "atomic"
        },
        "nodeHooks": {
          "description": "NodeHooks defines hooks that execute during VM lifecycle events.\nHooks are applied in declaration order within each plugin.\nAcross plugins, hooks are applied in alphabetical order by plugin name.",
          "items": {
            "description": "NodeHook defines a hook that runs an executable on the hosting node during VM lifecycle events.\nUnlike DomainHooks which modify the libvirt domain XML, NodeHooks perform node-level operations\nsuch as configuring networking, storage preparation, or device management.\nHooks may fire multiple times for the same lifecycle event due to reconciliation retries.\nImplementations must be idempotent.",
            "properties": {
              "condition": {
                "description": "Condition is a CEL expression that determines whether this hook applies to a given VM.",
                "type": "string"
              },
              "failureStrategy": {
                "description": "FailureStrategy specifies how to handle hook failures (Fail or Ignore).",
                "type": "string"
              },
              "permittedHooks": {
                "description": "PermittedHooks lists the VM lifecycle events this hook handles.",
                "items": {
                  "description": "NodeHookPoint identifies a VM lifecycle event for node-level hooks.",
                  "type": "string"
                },
                "minItems": 1,
                "type": "array",
                "x-kubernetes-list-type": "atomic"
              },
              "socket": {
                "description": "Socket is the path to the Unix socket for hook communication.",
                "minLength": 1,
                "type": "string"
              },
              "timeout": {
                "description": "Timeout specifies the maximum duration to wait for the hook to complete.",
                "type": "string"
              }
            },
            "required": [
              "permittedHooks",
              "socket"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array",
          "x-kubernetes-list-type": "atomic"
        },
        "validatingAdmissionPolicies": {
          "description": "ValidatingAdmissionPolicies references ValidatingAdmissionPolicy objects managed by the plugin.",
          "items": {
            "description": "AdmissionReference is a reference to an admission object by name.",
            "properties": {
              "name": {
                "description": "Name is the name of the admission object.",
                "minLength": 1,
                "type": "string"
              }
            },
            "required": [
              "name"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array",
          "x-kubernetes-list-type": "atomic"
        },
        "validatingAdmissionWebhooks": {
          "description": "ValidatingAdmissionWebhooks references ValidatingWebhookConfiguration objects managed by the plugin.",
          "items": {
            "description": "AdmissionReference is a reference to an admission object by name.",
            "properties": {
              "name": {
                "description": "Name is the name of the admission object.",
                "minLength": 1,
                "type": "string"
              }
            },
            "required": [
              "name"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array",
          "x-kubernetes-list-type": "atomic"
        }
      },
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "description": "Status reflects the observed state of the plugin.",
      "type": "object"
    }
  },
  "required": [
    "spec"
  ],
  "type": "object"
}