{
  "description": "SecurityProfileOCI references a security profile stored as an artifact in an OCI registry, with an optional base profile.",
  "properties": {
    "baseProfile": {
      "description": "SecurityProfileOCIBase specifies the base profile of an OCI security profile.",
      "properties": {
        "localhostProfile": {
          "description": "localhostProfile indicates a base profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a non-empty descending path, relative to the kubelet's configured seccomp profile location, of at most 4096 characters. Must be set if type is \"Localhost\". Must NOT be set for any other type.",
          "type": [
            "string",
            "null"
          ]
        },
        "type": {
          "description": "type indicates which kind of base profile will be applied. Valid options are:\n\nLocalhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used.",
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": [
        "object",
        "null"
      ],
      "x-kubernetes-unions": [
        {
          "discriminator": "type",
          "fields-to-discriminateBy": {
            "localhostProfile": "LocalhostProfile"
          }
        }
      ]
    },
    "ref": {
      "description": "ref is the OCI reference of the profile. It must be a digest-pinned reference in canonical form, registry/repository@<algorithm>:<digest>, with the registry spelled out (for example docker.io/library/profile, not profile or docker.io/profile). Tags are rejected. The digest algorithm must be sha256, sha384, or sha512. The maximum length is 1024 characters. Pull secrets are assembled in the same way as for the container image by looking up node credentials, service account image pull secrets, and pod spec image pull secrets.",
      "type": [
        "string",
        "null"
      ]
    }
  },
  "required": [
    "ref"
  ],
  "type": "object",
  "$schema": "http://json-schema.org/schema#"
}