<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Secure Container Orchestration — API Reference

## agent.js CLI

```bash
# Audit cluster against CIS benchmarks
node scripts/agent.js --action audit --kubeconfig ~/.kube/config

# Generate security policies for namespace
node scripts/agent.js --action policies --namespace production --level restricted

# Scan container images
node scripts/agent.js --action scan --images images.json --output scan-results.json

# Validate policy compliance
node scripts/agent.js --action validate --policies k8s-policies.json --benchmark cis
```

## Image JSON Schema

```json
{
  "name": "registry.example.com/api",
  "tag": "v1.2",
  "digest": "sha256:abc123",
  "vulns_critical": 0,
  "vulns_high": 1,
  "vulns_medium": 3
}
```

## Pod Security Levels

| Level | Risk | Key Controls |
|-------|------|-------------|
| privileged | Critical | None — full host access |
| baseline | Medium | No privileged, no hostPID, no hostNetwork |
| restricted | Low | Non-root, drop ALL caps, readOnlyRootFS, seccomp |

## CIS Benchmark Categories

- `api-server` — API server configuration
- `etcd` — etcd encryption and access
- `rbac` — Role-based access control
- `workload` — Pod and container security
- `network` — Network policies
