---
policy: /ce/ca/google/gke/alpha-cluster
logic: /ce/ca/google/gke/alpha-cluster/prod.logic.yaml
executionTime: 2025-10-25T12:02:44.663004589Z
generationMs: 67
executionMs: 781
rows:
  - id: '001'
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 200
      actual: 200
    conditionText:
      expected: otherwise
      actual: otherwise
    runtimeError: {}
  - id: '002'
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 199
      actual: 199
    conditionText:
      expected: extract('CA10G1__kubernetesAlpha__c') == 'ENABLED'
      actual: extract('CA10G1__kubernetesAlpha__c') == 'ENABLED'
    runtimeError: {}
usedFiles:
  - path: /ce/ca/google/gke/alpha-cluster/policy.yaml
    md5Hash: DF7685682192F7EE319B2D8DE56A0077
    content: "---\nnames: \n  full: \"Google GKE Cluster Alpha cluster features are\
      \ enabled\"\n  contextual: \"Cluster Alpha cluster features are enabled\"\n\
      description: \"Ensure that Google GKE Clusters are not running with alpha features\\\
      \n  \\ enabled, especially in production environments. Alpha features are experimental\\\
      \n  \\ and not covered by the GKE SLA.\"\ntype: \"COMPLIANCE_POLICY\"\ncategories:\n\
      \  - \"RELIABILITY\"\nframeworkMappings:\n  - \"/frameworks/cis-gke-v1.8.0/05/10/02\"\
      \n  - \"/frameworks/cloudaware/resource-reliability/system-configuration\""
  - path: /ce/ca/google/gke/alpha-cluster/prod.logic.yaml
    md5Hash: 03AFD2C125CA916F24C17C4FB650306E
    content: |
      ---

      inputType: "CA10G1__CaGoogleGkeCluster__c"
      testData:
        - file: "test-data.json"
      importExtracts:
        - file: "/types/CA10G1__CaGoogleGkeCluster__c/object.extracts.yaml"
      conditions:
        - status: "INCOMPLIANT"
          currentStateMessage: "Alpha cluster features are enabled for this GKE cluster."
          remediationMessage: "Create a new cluster with alpha features disabled."
          check:
            IS_EQUAL:
              left:
                EXTRACT: "CA10G1__kubernetesAlpha__c"
              right:
                TEXT: "ENABLED"
      otherwise:
        status: "COMPLIANT"
        currentStateMessage: "Alpha cluster features are disabled for this GKE cluster."
  - path: /ce/ca/google/gke/alpha-cluster/test-data.json
    md5Hash: C0F06F8620F5463BA9F9295D62B1F75B
    content: |
      [
        {
          "expectedResult": {
            "status": "COMPLIANT",
            "conditionIndex": "200",
            "conditionText": "otherwise",
            "runtimeError": null
          },
          "context": { "snapshotTime": "2025-09-08T10:28:58Z" },
          "Id": "001",
          "CA10G1__disappearanceTime__c": null,
          "CA10G1__kubernetesAlpha__c": ""
        },
        {
          "expectedResult": {
            "status": "INCOMPLIANT",
            "conditionIndex": "199",
            "conditionText": "extract('CA10G1__kubernetesAlpha__c') == 'ENABLED'",
            "runtimeError": null
          },
          "context": { "snapshotTime": "2025-09-08T10:28:58Z" },
          "Id": "002",
          "CA10G1__disappearanceTime__c": null,
          "CA10G1__kubernetesAlpha__c": "ENABLED"
        }
      ]
  - path: /types/CA10G1__CaGoogleGkeCluster__c/object.extracts.yaml
    md5Hash: 27F9CD44BA08A855B08C82AB034505CA
    content: "---\nextracts:\n# Nullable\n  - name: \"CA10G1__kubernetesAlpha__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10G1__kubernetesAlpha__c\"\n\
      \  - name: \"CA10G1__loggingService__c\"\n    value: \n      FIELD:\n      \
      \  path: \"CA10G1__loggingService__c\"\n  - name: \"CA10G1__monitoringService__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10G1__monitoringService__c\"\n\
      \  - name: \"CA10G1__useIpAliases__c\"\n    value: \n      FIELD:\n        path:\
      \ \"CA10G1__useIpAliases__c\"\n  - name: \"CA10G1__legacyAbac__c\"\n    value:\
      \ \n      FIELD:\n        path: \"CA10G1__legacyAbac__c\"\n  - name: \"CA10G1__masterAuthorizedNetworks__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10G1__masterAuthorizedNetworks__c\"\
      \n  - name: \"CA10G1__privateNodes__c\"\n    value: \n      FIELD:\n       \
      \ path: \"CA10G1__privateNodes__c\"\n  - name: \"CA10G1__addonsKubernetesDashboard__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10G1__addonsKubernetesDashboard__c\"\
      \n# Text. Nullable. Values: ENABLED, DISABLED\n  - name: \"CA10G1__networkPolicy__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10G1__networkPolicy__c\"\n# Text.\
      \ Nullable. Values: ENABLED, DISABLED\n  - name: \"CA10G1__addonsNetworkPolicyConfig__c\"\
      \n    value: \n      FIELD:\n        path: \"CA10G1__addonsNetworkPolicyConfig__c\"\
      \n"
script: |-
  CREATE TEMP FUNCTION mock_ExpectedResult()
  RETURNS ARRAY<STRUCT<
          Id STRING,
          expectedResult STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, runtimeError STRING>
      >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "Id" : "001",
    "expectedResult" : {
      "status" : "COMPLIANT",
      "conditionIndex" : "200",
      "conditionText" : "otherwise",
      "runtimeError" : null
    }
  }, {
    "Id" : "002",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "199",
      "conditionText" : "extract('CA10G1__kubernetesAlpha__c') == 'ENABLED'",
      "runtimeError" : null
    }
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10G1__CaGoogleGkeCluster__c()
  RETURNS ARRAY<STRUCT<
      CA10G1__disappearanceTime__c TIMESTAMP,
      CA10G1__kubernetesAlpha__c STRING,
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2025-09-08T10:28:58Z")
    },
    "CA10G1__kubernetesAlpha__c" : "",
    "Id" : "001"
  }, {
    "context" : {
      "snapshotTime" : new Date("2025-09-08T10:28:58Z")
    },
    "CA10G1__kubernetesAlpha__c" : "ENABLED",
    "Id" : "002"
  } ];
  """;

  CREATE TEMP FUNCTION process_CA10G1__CaGoogleGkeCluster__c(
      obj STRUCT<
          CA10G1__disappearanceTime__c TIMESTAMP,
          CA10G1__kubernetesAlpha__c STRING,
          Id STRING
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
  var TextLib = new function () {
      this.normalize = function(arg) {
          return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
      };
      this.isEmpty = function(arg) {
          return this.normalize(arg) == '';
      };
      this.isNotEmpty = function(arg) {
          return this.normalize(arg) != '';
      };
      this.equal = function(left, right) {
          return this.normalize(left) == this.normalize(right);
      };
      this.notEqual = function(left, right) {
          return this.normalize(left) != this.normalize(right);
      };
      this.startsWith = function(arg, substring) {
          return this.normalize(arg).startsWith(this.normalize(substring));
      };
      this.endsWith = function(arg, substring) {
          return this.normalize(arg).endsWith(this.normalize(substring));
      };
      this.contains = function(arg, substring) {
          return this.normalize(arg).includes(this.normalize(substring));
      };
      this.containsAll = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.every(sub => normalizedArg.includes(this.normalize(sub)));
      };
      this.containsAny = function(arg, substrings) {
          if (substrings == null || substrings.length === 0) return false;
          let normalizedArg = this.normalize(arg);
          return substrings.some(sub => normalizedArg.includes(this.normalize(sub)));
      };
  }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From Google [CA10G1__disappearanceTime__c]: ' + obj.CA10G1__disappearanceTime__c);
      if (obj.CA10G1__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10G1__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function extract3() { if (!this.out) { this.out = obj.CA10G1__kubernetesAlpha__c; } return this.out; };
      references1.push('Kubernetes Alpha [obj.CA10G1__kubernetesAlpha__c]: ' + obj.CA10G1__kubernetesAlpha__c);
      if (TextLib.equal(extract3.call(extract3), 'ENABLED')) {
          return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "extract('CA10G1__kubernetesAlpha__c') == 'ENABLED'", currentStateMessage: "Alpha cluster features are enabled for this GKE cluster.", currentStateReferences: references1.join('\n'), remediation: "Create a new cluster with alpha features disabled.", runtimeError: null};
      }
      return {status: 'COMPLIANT', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "Alpha cluster features are disabled for this GKE cluster.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;


  SELECT
    expectedResult.Id as Id,
    IF (
      IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '')
      AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1)
      AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '')
      AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''),
      "MATCH",
      "FAIL"
    ) as match,
    expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus,
    expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex,
    expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText,
    expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError
  FROM UNNEST(mock_ExpectedResult()) expectedResult
  LEFT JOIN (
      SELECT
          sObject.CA10G1__disappearanceTime__c AS CA10G1__disappearanceTime__c,
          sObject.CA10G1__kubernetesAlpha__c AS CA10G1__kubernetesAlpha__c,
          sObject.Id AS Id,
          process_CA10G1__CaGoogleGkeCluster__c(
              STRUCT(
                  sObject.CA10G1__disappearanceTime__c AS CA10G1__disappearanceTime__c,
                  sObject.CA10G1__kubernetesAlpha__c AS CA10G1__kubernetesAlpha__c,
                  sObject.Id AS Id
              ),
              sObject.context.snapshotTime
          ) as result
      FROM UNNEST(mock_CA10G1__CaGoogleGkeCluster__c()) AS sObject
  ) sObject ON sObject.Id = expectedResult.Id;
