| 
 | 1 | +openapi: "3.0.0"  | 
 | 2 | +info:  | 
 | 3 | +  version: 1.0.0  | 
 | 4 | +  title: Lock Configuration API  | 
 | 5 | +  description: API for managing deployment template lock configurations that restrict which paths can be modified in deployment templates  | 
 | 6 | +paths:  | 
 | 7 | +  /orchestrator/config/lock:  | 
 | 8 | +    get:  | 
 | 9 | +      description: Get lock configuration for an application and environment. Returns paths that are locked or allowed for modification in deployment templates.  | 
 | 10 | +      parameters:  | 
 | 11 | +        - name: appId  | 
 | 12 | +          in: query  | 
 | 13 | +          required: false  | 
 | 14 | +          schema:  | 
 | 15 | +            type: integer  | 
 | 16 | +          description: Application ID. If not provided, returns global lock configuration.  | 
 | 17 | +        - name: envId  | 
 | 18 | +          in: query  | 
 | 19 | +          required: false  | 
 | 20 | +          schema:  | 
 | 21 | +            type: integer  | 
 | 22 | +          description: Environment ID. If not provided with appId, returns app-level lock configuration. Use -1 for base deployment template.  | 
 | 23 | +      responses:  | 
 | 24 | +        '200':  | 
 | 25 | +          description: Successfully retrieved lock configuration  | 
 | 26 | +          content:  | 
 | 27 | +            application/json:  | 
 | 28 | +              schema:  | 
 | 29 | +                $ref: '#/components/schemas/LockConfigResponse'  | 
 | 30 | +              examples:  | 
 | 31 | +                withLockConfig:  | 
 | 32 | +                  summary: Lock configuration exists  | 
 | 33 | +                  value:  | 
 | 34 | +                    id: 1  | 
 | 35 | +                    allowed: true  | 
 | 36 | +                    config:  | 
 | 37 | +                      - "spec.replicas"  | 
 | 38 | +                      - "spec.template.spec.containers[0].resources"  | 
 | 39 | +                emptyLockConfig:  | 
 | 40 | +                  summary: No lock configuration  | 
 | 41 | +                  value:  | 
 | 42 | +                    config: []  | 
 | 43 | +        '400':  | 
 | 44 | +          description: Bad Request. Invalid appId or envId parameter.  | 
 | 45 | +          content:  | 
 | 46 | +            application/json:  | 
 | 47 | +              schema:  | 
 | 48 | +                $ref: '#/components/schemas/Error'  | 
 | 49 | +        '401':  | 
 | 50 | +          description: Unauthorized. User not authenticated.  | 
 | 51 | +          content:  | 
 | 52 | +            application/json:  | 
 | 53 | +              schema:  | 
 | 54 | +                $ref: '#/components/schemas/Error'  | 
 | 55 | +        '403':  | 
 | 56 | +          description: Forbidden. User does not have required permissions (must be admin/manager or have config approver access).  | 
 | 57 | +          content:  | 
 | 58 | +            application/json:  | 
 | 59 | +              schema:  | 
 | 60 | +                $ref: '#/components/schemas/Error'  | 
 | 61 | +        '500':  | 
 | 62 | +          description: Internal Server Error  | 
 | 63 | +          content:  | 
 | 64 | +            application/json:  | 
 | 65 | +              schema:  | 
 | 66 | +                $ref: '#/components/schemas/Error'  | 
 | 67 | +    post:  | 
 | 68 | +      description: Create or update lock configuration. Requires super admin permissions.  | 
 | 69 | +      requestBody:  | 
 | 70 | +        description: Lock configuration request  | 
 | 71 | +        required: true  | 
 | 72 | +        content:  | 
 | 73 | +          application/json:  | 
 | 74 | +            schema:  | 
 | 75 | +              $ref: '#/components/schemas/LockConfigRequest'  | 
 | 76 | +            examples:  | 
 | 77 | +              allowSpecificPaths:  | 
 | 78 | +                summary: Allow only specific paths to be modified  | 
 | 79 | +                value:  | 
 | 80 | +                  allowed: true  | 
 | 81 | +                  config:  | 
 | 82 | +                    - "spec.replicas"  | 
 | 83 | +                    - "spec.template.spec.containers[0].image"  | 
 | 84 | +              denySpecificPaths:  | 
 | 85 | +                summary: Deny specific paths from being modified  | 
 | 86 | +                value:  | 
 | 87 | +                  allowed: false  | 
 | 88 | +                  config:  | 
 | 89 | +                    - "spec.template.spec.securityContext"  | 
 | 90 | +                    - "spec.template.spec.serviceAccountName"  | 
 | 91 | +      responses:  | 
 | 92 | +        '200':  | 
 | 93 | +          description: Successfully created/updated lock configuration  | 
 | 94 | +          content:  | 
 | 95 | +            application/json:  | 
 | 96 | +              schema:  | 
 | 97 | +                type: object  | 
 | 98 | +                properties:  | 
 | 99 | +                  id:  | 
 | 100 | +                    type: integer  | 
 | 101 | +                    description: ID of the created/updated lock configuration  | 
 | 102 | +        '400':  | 
 | 103 | +          description: Bad Request. Validation error or invalid request body.  | 
 | 104 | +          content:  | 
 | 105 | +            application/json:  | 
 | 106 | +              schema:  | 
 | 107 | +                $ref: '#/components/schemas/Error'  | 
 | 108 | +        '401':  | 
 | 109 | +          description: Unauthorized. User not authenticated.  | 
 | 110 | +          content:  | 
 | 111 | +            application/json:  | 
 | 112 | +              schema:  | 
 | 113 | +                $ref: '#/components/schemas/Error'  | 
 | 114 | +        '403':  | 
 | 115 | +          description: Forbidden. User does not have super admin permissions.  | 
 | 116 | +          content:  | 
 | 117 | +            application/json:  | 
 | 118 | +              schema:  | 
 | 119 | +                $ref: '#/components/schemas/Error'  | 
 | 120 | +        '500':  | 
 | 121 | +          description: Internal Server Error  | 
 | 122 | +          content:  | 
 | 123 | +            application/json:  | 
 | 124 | +              schema:  | 
 | 125 | +                $ref: '#/components/schemas/Error'  | 
 | 126 | +    delete:  | 
 | 127 | +      description: Delete active lock configuration. Requires super admin permissions.  | 
 | 128 | +      responses:  | 
 | 129 | +        '200':  | 
 | 130 | +          description: Successfully deleted lock configuration  | 
 | 131 | +        '401':  | 
 | 132 | +          description: Unauthorized. User not authenticated.  | 
 | 133 | +          content:  | 
 | 134 | +            application/json:  | 
 | 135 | +              schema:  | 
 | 136 | +                $ref: '#/components/schemas/Error'  | 
 | 137 | +        '403':  | 
 | 138 | +          description: Forbidden. User does not have super admin permissions.  | 
 | 139 | +          content:  | 
 | 140 | +            application/json:  | 
 | 141 | +              schema:  | 
 | 142 | +                $ref: '#/components/schemas/Error'  | 
 | 143 | +        '500':  | 
 | 144 | +          description: Internal Server Error  | 
 | 145 | +          content:  | 
 | 146 | +            application/json:  | 
 | 147 | +              schema:  | 
 | 148 | +                $ref: '#/components/schemas/Error'  | 
 | 149 | +components:  | 
 | 150 | +  schemas:  | 
 | 151 | +    LockConfigRequest:  | 
 | 152 | +      type: object  | 
 | 153 | +      required:  | 
 | 154 | +        - allowed  | 
 | 155 | +        - config  | 
 | 156 | +      properties:  | 
 | 157 | +        allowed:  | 
 | 158 | +          type: boolean  | 
 | 159 | +          description: If true, only paths in 'config' can be modified (allowlist). If false, paths in 'config' cannot be modified (denylist).  | 
 | 160 | +        config:  | 
 | 161 | +          type: array  | 
 | 162 | +          items:  | 
 | 163 | +            type: string  | 
 | 164 | +          description: List of JSON paths in the deployment template. Supports array indexing (e.g., "spec.containers[0].image")  | 
 | 165 | +          example:  | 
 | 166 | +            - "spec.replicas"  | 
 | 167 | +            - "spec.template.spec.containers[0].resources.limits.cpu"  | 
 | 168 | +            - "spec.template.spec.containers[0].resources.limits.memory"  | 
 | 169 | +    LockConfigResponse:  | 
 | 170 | +      type: object  | 
 | 171 | +      properties:  | 
 | 172 | +        id:  | 
 | 173 | +          type: integer  | 
 | 174 | +          description: Lock configuration ID  | 
 | 175 | +        allowed:  | 
 | 176 | +          type: boolean  | 
 | 177 | +          description: If true, only paths in 'config' can be modified (allowlist). If false, paths in 'config' cannot be modified (denylist).  | 
 | 178 | +        config:  | 
 | 179 | +          type: array  | 
 | 180 | +          items:  | 
 | 181 | +            type: string  | 
 | 182 | +          description: List of JSON paths that are locked or allowed  | 
 | 183 | +          example:  | 
 | 184 | +            - "spec.replicas"  | 
 | 185 | +            - "spec.template.spec.containers[0].resources"  | 
 | 186 | +    LockValidateErrorResponse:  | 
 | 187 | +      type: object  | 
 | 188 | +      description: Response when lock configuration validation fails  | 
 | 189 | +      properties:  | 
 | 190 | +        isLockConfigError:  | 
 | 191 | +          type: boolean  | 
 | 192 | +          description: Indicates if the error is due to lock configuration violation  | 
 | 193 | +        changedPaths:  | 
 | 194 | +          type: array  | 
 | 195 | +          items:  | 
 | 196 | +            type: string  | 
 | 197 | +          description: List of paths that were changed but are locked  | 
 | 198 | +    Error:  | 
 | 199 | +      required:  | 
 | 200 | +        - code  | 
 | 201 | +        - message  | 
 | 202 | +      properties:  | 
 | 203 | +        code:  | 
 | 204 | +          type: integer  | 
 | 205 | +          description: Error code  | 
 | 206 | +        message:  | 
 | 207 | +          type: string  | 
 | 208 | +          description: Error message  | 
 | 209 | + | 
0 commit comments