ManifestKind
: string
in package
The entity kinds a §27.6 manifest can declare.
The order of the cases is the order ManagementPlan applies them in, and it is not alphabetical or arbitrary — it is the dependency order §27.6 requires be DERIVED rather than written down by the caller. A role cannot be granted a permission that does not exist yet, and a group cannot be assigned a role that does not exist yet.
Table of Contents
Cases
- Group = 'group'
- A group, plus the roles assigned to it. Depends on roles.
- NetworkPolicy = 'network_policy'
- The tenant's `Session-Timeout` cap (CONTRACT.md §27.6.2, contract 1.62): a singleton, so it has no natural key and a manifest carries at most one. Ordered FIRST of the three `network` kinds, because a profile's timeout is checked against the cap at the write.
- NetworkProfile = 'network_profile'
- A segment's reply profile (§27.6.2): natural key **its segment**. Ordered last, and in the segments' own order, so that a plan is stable.
- NetworkSegment = 'network_segment'
- A network segment (§27.6.2): natural key **site + kind + name**, `kind` being the wire spelling `access` or `quarantine`. Ordered after the policy and before the profiles.
- Permission = 'permission'
- A permission (an action). Depends on nothing.
- Resource = 'resource'
- A hierarchical resource. Ordered first, and among themselves parents before children.
- Role = 'role'
- A role, plus the permission grants it carries. Depends on permissions and resources.
- ServiceAccount = 'service_account'
- A service account, plus the roles bound to it (CONTRACT.md §27.6.1 addition 3, contract 1.51). Depends on roles and resources. Ordered LAST (§27.6 rule 5): a service account's own natural key (its `name`) is not enforced unique by the server, so nothing else in a manifest can reasonably depend on one.
Cases
Resource
A hierarchical resource. Ordered first, and among themselves parents before children.
Permission
A permission (an action). Depends on nothing.
Role
A role, plus the permission grants it carries. Depends on permissions and resources.
Group
A group, plus the roles assigned to it. Depends on roles.
ServiceAccount
A service account, plus the roles bound to it (CONTRACT.md §27.6.1 addition 3, contract 1.51). Depends on roles and resources. Ordered LAST (§27.6 rule 5): a service account's own natural key (its `name`) is not enforced unique by the server, so nothing else in a manifest can reasonably depend on one.
NetworkPolicy
The tenant's `Session-Timeout` cap (CONTRACT.md §27.6.2, contract 1.62): a singleton, so it has no natural key and a manifest carries at most one. Ordered FIRST of the three `network` kinds, because a profile's timeout is checked against the cap at the write.
NetworkSegment
A network segment (§27.6.2): natural key **site + kind + name**, `kind` being the wire spelling `access` or `quarantine`. Ordered after the policy and before the profiles.
NetworkProfile
A segment's reply profile (§27.6.2): natural key **its segment**. Ordered last, and in the segments' own order, so that a plan is stable.