Documentation ¶
Overview ¶
Package admissionregistration is the internal version of the API. AdmissionConfiguration and AdmissionPluginConfiguration are legacy static admission plugin configuration InitializerConfiguration, ValidatingWebhookConfiguration, and MutatingWebhookConfiguration are for the new dynamic admission controller configuration. +groupName=admissionregistration.k8s.io
Index ¶
- Constants
- Variables
- func Kind(kind string) schema.GroupKind
- func Resource(resource string) schema.GroupResource
- type FailurePolicyType
- type Initializer
- type InitializerConfiguration
- type InitializerConfigurationList
- type MutatingWebhookConfiguration
- type MutatingWebhookConfigurationList
- type OperationType
- type Rule
- type RuleWithOperations
- type ServiceReference
- type SideEffectClass
- type ValidatingWebhookConfiguration
- type ValidatingWebhookConfigurationList
- type Webhook
- type WebhookClientConfig
Constants ¶
const GroupName = "admissionregistration.k8s.io"
Variables ¶
var ( SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) AddToScheme = SchemeBuilder.AddToScheme )
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
SchemeGroupVersion is group version used to register these objects
Functions ¶
func Resource ¶
func Resource(resource string) schema.GroupResource
Resource takes an unqualified resource and returns back a Group qualified GroupResource
Types ¶
type FailurePolicyType ¶
type FailurePolicyType string
const ( // Ignore means that an error calling the webhook is ignored. Ignore FailurePolicyType = "Ignore" // Fail means that an error calling the webhook causes the admission to fail. Fail FailurePolicyType = "Fail" )
type Initializer ¶
type Initializer struct { // Name is the identifier of the initializer. It will be added to the // object that needs to be initialized. // Name should be fully qualified, e.g., alwayspullimages.kubernetes.io, where // "alwayspullimages" is the name of the webhook, and kubernetes.io is the name // of the organization. // Required Name string // Rules describes what resources/subresources the initializer cares about. // The initializer cares about an operation if it matches _any_ Rule. // Rule.Resources must not include subresources. Rules []Rule }
Initializer describes the name and the failure policy of an initializer, and what resources it applies to.
func (*Initializer) DeepCopy ¶ added in v1.8.0
func (in *Initializer) DeepCopy() *Initializer
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Initializer.
func (*Initializer) DeepCopyInto ¶ added in v1.8.0
func (in *Initializer) DeepCopyInto(out *Initializer)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type InitializerConfiguration ¶
type InitializerConfiguration struct { metav1.TypeMeta // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. // +optional metav1.ObjectMeta // Initializers is a list of resources and their default initializers // Order-sensitive. // When merging multiple InitializerConfigurations, we sort the initializers // from different InitializerConfigurations by the name of the // InitializerConfigurations; the order of the initializers from the same // InitializerConfiguration is preserved. // +optional Initializers []Initializer }
InitializerConfiguration describes the configuration of initializers.
func (*InitializerConfiguration) DeepCopy ¶ added in v1.8.0
func (in *InitializerConfiguration) DeepCopy() *InitializerConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InitializerConfiguration.
func (*InitializerConfiguration) DeepCopyInto ¶ added in v1.8.0
func (in *InitializerConfiguration) DeepCopyInto(out *InitializerConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*InitializerConfiguration) DeepCopyObject ¶ added in v1.8.0
func (in *InitializerConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type InitializerConfigurationList ¶
type InitializerConfigurationList struct { metav1.TypeMeta // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds // +optional metav1.ListMeta // List of InitializerConfiguration. Items []InitializerConfiguration }
InitializerConfigurationList is a list of InitializerConfiguration.
func (*InitializerConfigurationList) DeepCopy ¶ added in v1.8.0
func (in *InitializerConfigurationList) DeepCopy() *InitializerConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InitializerConfigurationList.
func (*InitializerConfigurationList) DeepCopyInto ¶ added in v1.8.0
func (in *InitializerConfigurationList) DeepCopyInto(out *InitializerConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*InitializerConfigurationList) DeepCopyObject ¶ added in v1.8.0
func (in *InitializerConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type MutatingWebhookConfiguration ¶ added in v1.9.1
type MutatingWebhookConfiguration struct { metav1.TypeMeta // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. // +optional metav1.ObjectMeta // Webhooks is a list of webhooks and the affected resources and operations. // +optional Webhooks []Webhook }
MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
func (*MutatingWebhookConfiguration) DeepCopy ¶ added in v1.9.1
func (in *MutatingWebhookConfiguration) DeepCopy() *MutatingWebhookConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingWebhookConfiguration.
func (*MutatingWebhookConfiguration) DeepCopyInto ¶ added in v1.9.1
func (in *MutatingWebhookConfiguration) DeepCopyInto(out *MutatingWebhookConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*MutatingWebhookConfiguration) DeepCopyObject ¶ added in v1.9.1
func (in *MutatingWebhookConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type MutatingWebhookConfigurationList ¶ added in v1.9.1
type MutatingWebhookConfigurationList struct { metav1.TypeMeta // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds // +optional metav1.ListMeta // List of MutatingWebhookConfiguration. Items []MutatingWebhookConfiguration }
MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
func (*MutatingWebhookConfigurationList) DeepCopy ¶ added in v1.9.1
func (in *MutatingWebhookConfigurationList) DeepCopy() *MutatingWebhookConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingWebhookConfigurationList.
func (*MutatingWebhookConfigurationList) DeepCopyInto ¶ added in v1.9.1
func (in *MutatingWebhookConfigurationList) DeepCopyInto(out *MutatingWebhookConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*MutatingWebhookConfigurationList) DeepCopyObject ¶ added in v1.9.1
func (in *MutatingWebhookConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type OperationType ¶
type OperationType string
const ( OperationAll OperationType = "*" Create OperationType = "CREATE" Update OperationType = "UPDATE" Delete OperationType = "DELETE" Connect OperationType = "CONNECT" )
The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go.
type Rule ¶
type Rule struct { // APIGroups is the API groups the resources belong to. '*' is all groups. // If '*' is present, the length of the slice must be one. // Required. APIGroups []string // APIVersions is the API versions the resources belong to. '*' is all versions. // If '*' is present, the length of the slice must be one. // Required. APIVersions []string // Resources is a list of resources this rule applies to. // // For example: // 'pods' means pods. // 'pods/log' means the log subresource of pods. // '*' means all resources, but not subresources. // 'pods/*' means all subresources of pods. // '*/scale' means all scale subresources. // '*/*' means all resources and their subresources. // // If wildcard is present, the validation rule will ensure resources do not // overlap with each other. // // Depending on the enclosing object, subresources might not be allowed. // Required. Resources []string }
Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended to make sure that all the tuple expansions are valid.
func (*Rule) DeepCopy ¶ added in v1.8.0
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rule.
func (*Rule) DeepCopyInto ¶ added in v1.8.0
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type RuleWithOperations ¶
type RuleWithOperations struct { // Operations is the operations the admission hook cares about - CREATE, UPDATE, or * // for all operations. // If '*' is present, the length of the slice must be one. // Required. Operations []OperationType // Rule is embedded, it describes other criteria of the rule, like // APIGroups, APIVersions, Resources, etc. Rule }
RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.
func (*RuleWithOperations) DeepCopy ¶ added in v1.8.0
func (in *RuleWithOperations) DeepCopy() *RuleWithOperations
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuleWithOperations.
func (*RuleWithOperations) DeepCopyInto ¶ added in v1.8.0
func (in *RuleWithOperations) DeepCopyInto(out *RuleWithOperations)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ServiceReference ¶
type ServiceReference struct { // `namespace` is the namespace of the service. // Required Namespace string // `name` is the name of the service. // Required Name string // `path` is an optional URL path which will be sent in any request to // this service. // +optional Path *string }
ServiceReference holds a reference to Service.legacy.k8s.io
func (*ServiceReference) DeepCopy ¶ added in v1.8.0
func (in *ServiceReference) DeepCopy() *ServiceReference
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceReference.
func (*ServiceReference) DeepCopyInto ¶ added in v1.8.0
func (in *ServiceReference) DeepCopyInto(out *ServiceReference)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SideEffectClass ¶ added in v1.12.0
type SideEffectClass string
const ( // SideEffectClassUnknown means that no information is known about the side effects of calling the webhook. // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail. SideEffectClassUnknown SideEffectClass = "Unknown" // SideEffectClassNone means that calling the webhook will have no side effects. SideEffectClassNone SideEffectClass = "None" // SideEffectClassSome means that calling the webhook will possibly have side effects. // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail. SideEffectClassSome SideEffectClass = "Some" // SideEffectClassNoneOnDryRun means that calling the webhook will possibly have side effects, but if the // request being reviewed has the dry-run attribute, the side effects will be suppressed. SideEffectClassNoneOnDryRun SideEffectClass = "NoneOnDryRun" )
type ValidatingWebhookConfiguration ¶ added in v1.9.1
type ValidatingWebhookConfiguration struct { metav1.TypeMeta // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. // +optional metav1.ObjectMeta // Webhooks is a list of webhooks and the affected resources and operations. // +optional Webhooks []Webhook }
ValidatingWebhookConfiguration describes the configuration of an admission webhook that accepts or rejects and object without changing it.
func (*ValidatingWebhookConfiguration) DeepCopy ¶ added in v1.9.1
func (in *ValidatingWebhookConfiguration) DeepCopy() *ValidatingWebhookConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingWebhookConfiguration.
func (*ValidatingWebhookConfiguration) DeepCopyInto ¶ added in v1.9.1
func (in *ValidatingWebhookConfiguration) DeepCopyInto(out *ValidatingWebhookConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ValidatingWebhookConfiguration) DeepCopyObject ¶ added in v1.9.1
func (in *ValidatingWebhookConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ValidatingWebhookConfigurationList ¶ added in v1.9.1
type ValidatingWebhookConfigurationList struct { metav1.TypeMeta // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds // +optional metav1.ListMeta // List of ValidatingWebhookConfigurations. Items []ValidatingWebhookConfiguration }
ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
func (*ValidatingWebhookConfigurationList) DeepCopy ¶ added in v1.9.1
func (in *ValidatingWebhookConfigurationList) DeepCopy() *ValidatingWebhookConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingWebhookConfigurationList.
func (*ValidatingWebhookConfigurationList) DeepCopyInto ¶ added in v1.9.1
func (in *ValidatingWebhookConfigurationList) DeepCopyInto(out *ValidatingWebhookConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ValidatingWebhookConfigurationList) DeepCopyObject ¶ added in v1.9.1
func (in *ValidatingWebhookConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type Webhook ¶ added in v1.9.1
type Webhook struct { // The name of the admission webhook. // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where // "imagepolicy" is the name of the webhook, and kubernetes.io is the name // of the organization. // Required. Name string // ClientConfig defines how to communicate with the hook. // Required ClientConfig WebhookClientConfig // Rules describes what operations on what resources/subresources the webhook cares about. // The webhook cares about an operation if it matches _any_ Rule. Rules []RuleWithOperations // FailurePolicy defines how unrecognized errors from the admission endpoint are handled - // allowed values are Ignore or Fail. Defaults to Ignore. // +optional FailurePolicy *FailurePolicyType // NamespaceSelector decides whether to run the webhook on an object based // on whether the namespace for that object matches the selector. If the // object itself is a namespace, the matching is performed on // object.metadata.labels. If the object is another cluster scoped resource, // it never skips the webhook. // // For example, to run the webhook on any objects whose namespace is not // associated with "runlevel" of "0" or "1"; you will set the selector as // follows: // "namespaceSelector": { // "matchExpressions": [ // { // "key": "runlevel", // "operator": "NotIn", // "values": [ // "0", // "1" // ] // } // ] // } // // If instead you want to only run the webhook on any objects whose // namespace is associated with the "environment" of "prod" or "staging"; // you will set the selector as follows: // "namespaceSelector": { // "matchExpressions": [ // { // "key": "environment", // "operator": "In", // "values": [ // "prod", // "staging" // ] // } // ] // } // // See // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ // for more examples of label selectors. // // Default to the empty LabelSelector, which matches everything. // +optional NamespaceSelector *metav1.LabelSelector // SideEffects states whether this webhookk has side effects. // Acceptable values are: Unknown, None, Some, NoneOnDryRun // Webhooks with side effects MUST implement a reconciliation system, since a request may be // rejected by a future step in the admission change and the side effects therefore need to be undone. // Requests with the dryRun attribute will be auto-rejected if they match a webhook with // sideEffects == Unknown or Some. Defaults to Unknown. // +optional SideEffects *SideEffectClass }
Webhook describes an admission webhook and the resources and operations it applies to.
func (*Webhook) DeepCopy ¶ added in v1.9.1
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Webhook.
func (*Webhook) DeepCopyInto ¶ added in v1.9.1
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type WebhookClientConfig ¶ added in v1.9.1
type WebhookClientConfig struct { // `url` gives the location of the webhook, in standard URL form // (`[scheme://]host:port/path`). Exactly one of `url` or `service` // must be specified. // // The `host` should not refer to a service running in the cluster; use // the `service` field instead. The host might be resolved via external // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve // in-cluster DNS as that would be a layering violation). `host` may // also be an IP address. // // Please note that using `localhost` or `127.0.0.1` as a `host` is // risky unless you take great care to run this webhook on all hosts // which run an apiserver which might need to make calls to this // webhook. Such installs are likely to be non-portable, i.e., not easy // to turn up in a new cluster. // // The scheme must be "https"; the URL must begin with "https://". // // A path is optional, and if present may be any string permissible in // a URL. You may use the path to pass an arbitrary string to the // webhook, for example, a cluster identifier. // // Attempting to use a user or basic auth e.g. "user:password@" is not // allowed. Fragments ("#...") and query parameters ("?...") are not // allowed, either. // // +optional URL *string // `service` is a reference to the service for this webhook. Either // `service` or `url` must be specified. // // If the webhook is running within the cluster, then you should use `service`. // // Port 443 will be used if it is open, otherwise it is an error. // // +optional Service *ServiceReference // `caBundle` is a PEM encoded CA bundle which will be used to validate // the webhook's server certificate. // Required. CABundle []byte }
WebhookClientConfig contains the information to make a TLS connection with the webhook
func (*WebhookClientConfig) DeepCopy ¶ added in v1.9.1
func (in *WebhookClientConfig) DeepCopy() *WebhookClientConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookClientConfig.
func (*WebhookClientConfig) DeepCopyInto ¶ added in v1.9.1
func (in *WebhookClientConfig) DeepCopyInto(out *WebhookClientConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.