Documentation
¶
Overview ¶
Package admissionregistration is the internal version of the API. AdmissionConfiguration and AdmissionPluginConfiguration are legacy static admission plugin configuration InitializerConfiguration, ValidatingWebhookConfiguration, and MutatingWebhookConfiguration are for the new dynamic admission controller configuration.
Index ¶
- Constants
- Variables
- func Kind(kind string) schema.GroupKind
- func Resource(resource string) schema.GroupResource
- type FailurePolicyType
- type Initializer
- type InitializerConfiguration
- type InitializerConfigurationList
- type MutatingWebhookConfiguration
- type MutatingWebhookConfigurationList
- type OperationType
- type Rule
- type RuleWithOperations
- type ServiceReference
- type SideEffectClass
- type ValidatingWebhookConfiguration
- type ValidatingWebhookConfigurationList
- type Webhook
- type WebhookClientConfig
Constants ¶
const GroupName = "admissionregistration.k8s.io"
Variables ¶
var ( SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) AddToScheme = SchemeBuilder.AddToScheme )
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
SchemeGroupVersion is group version used to register these objects
Functions ¶
func Resource ¶
func Resource(resource string) schema.GroupResource
Resource takes an unqualified resource and returns back a Group qualified GroupResource
Types ¶
type FailurePolicyType ¶
type FailurePolicyType string
const ( // Ignore means that an error calling the webhook is ignored. Ignore FailurePolicyType = "Ignore" // Fail means that an error calling the webhook causes the admission to fail. Fail FailurePolicyType = "Fail" )
type Initializer ¶
type Initializer struct { // Name is the identifier of the initializer. It will be added to the // object that needs to be initialized. // Name should be fully qualified, e.g., alwayspullimages.kubernetes.io, where // "alwayspullimages" is the name of the webhook, and kubernetes.io is the name // of the organization. // Required Name string // Rules describes what resources/subresources the initializer cares about. // The initializer cares about an operation if it matches _any_ Rule. // Rule.Resources must not include subresources. Rules []Rule }
Initializer describes the name and the failure policy of an initializer, and what resources it applies to.
func (*Initializer) DeepCopy ¶ added in v1.8.0
func (in *Initializer) DeepCopy() *Initializer
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Initializer.
func (*Initializer) DeepCopyInto ¶ added in v1.8.0
func (in *Initializer) DeepCopyInto(out *Initializer)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type InitializerConfiguration ¶
type InitializerConfiguration struct { metav1.TypeMeta // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. // +optional metav1.ObjectMeta // Initializers is a list of resources and their default initializers // Order-sensitive. // When merging multiple InitializerConfigurations, we sort the initializers // from different InitializerConfigurations by the name of the // InitializerConfigurations; the order of the initializers from the same // InitializerConfiguration is preserved. // +optional Initializers []Initializer }
InitializerConfiguration describes the configuration of initializers.
func (*InitializerConfiguration) DeepCopy ¶ added in v1.8.0
func (in *InitializerConfiguration) DeepCopy() *InitializerConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InitializerConfiguration.
func (*InitializerConfiguration) DeepCopyInto ¶ added in v1.8.0
func (in *InitializerConfiguration) DeepCopyInto(out *InitializerConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*InitializerConfiguration) DeepCopyObject ¶ added in v1.8.0
func (in *InitializerConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type InitializerConfigurationList ¶
type InitializerConfigurationList struct { metav1.TypeMeta // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds // +optional metav1.ListMeta // List of InitializerConfiguration. Items []InitializerConfiguration }
InitializerConfigurationList is a list of InitializerConfiguration.
func (*InitializerConfigurationList) DeepCopy ¶ added in v1.8.0
func (in *InitializerConfigurationList) DeepCopy() *InitializerConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InitializerConfigurationList.
func (*InitializerConfigurationList) DeepCopyInto ¶ added in v1.8.0
func (in *InitializerConfigurationList) DeepCopyInto(out *InitializerConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*InitializerConfigurationList) DeepCopyObject ¶ added in v1.8.0
func (in *InitializerConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type MutatingWebhookConfiguration ¶ added in v1.9.1
type MutatingWebhookConfiguration struct { metav1.TypeMeta // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. // +optional metav1.ObjectMeta // Webhooks is a list of webhooks and the affected resources and operations. // +optional Webhooks []Webhook }
MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
func (*MutatingWebhookConfiguration) DeepCopy ¶ added in v1.9.1
func (in *MutatingWebhookConfiguration) DeepCopy() *MutatingWebhookConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingWebhookConfiguration.
func (*MutatingWebhookConfiguration) DeepCopyInto ¶ added in v1.9.1
func (in *MutatingWebhookConfiguration) DeepCopyInto(out *MutatingWebhookConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*MutatingWebhookConfiguration) DeepCopyObject ¶ added in v1.9.1
func (in *MutatingWebhookConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type MutatingWebhookConfigurationList ¶ added in v1.9.1
type MutatingWebhookConfigurationList struct { metav1.TypeMeta // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds // +optional metav1.ListMeta // List of MutatingWebhookConfiguration. Items []MutatingWebhookConfiguration }
MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
func (*MutatingWebhookConfigurationList) DeepCopy ¶ added in v1.9.1
func (in *MutatingWebhookConfigurationList) DeepCopy() *MutatingWebhookConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingWebhookConfigurationList.
func (*MutatingWebhookConfigurationList) DeepCopyInto ¶ added in v1.9.1
func (in *MutatingWebhookConfigurationList) DeepCopyInto(out *MutatingWebhookConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*MutatingWebhookConfigurationList) DeepCopyObject ¶ added in v1.9.1
func (in *MutatingWebhookConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type OperationType ¶
type OperationType string
const ( OperationAll OperationType = "*" Create OperationType = "CREATE" Update OperationType = "UPDATE" Delete OperationType = "DELETE" Connect OperationType = "CONNECT" )
The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go.
type Rule ¶
type Rule struct { // APIGroups is the API groups the resources belong to. '*' is all groups. // If '*' is present, the length of the slice must be one. // Required. APIGroups []string // APIVersions is the API versions the resources belong to. '*' is all versions. // If '*' is present, the length of the slice must be one. // Required. APIVersions []string // Resources is a list of resources this rule applies to. // // For example: // 'pods' means pods. // 'pods/log' means the log subresource of pods. // '*' means all resources, but not subresources. // 'pods/*' means all subresources of pods. // '*/scale' means all scale subresources. // '*/*' means all resources and their subresources. // // If wildcard is present, the validation rule will ensure resources do not // overlap with each other. // // Depending on the enclosing object, subresources might not be allowed. // Required. Resources []string }
Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended to make sure that all the tuple expansions are valid.
func (*Rule) DeepCopy ¶ added in v1.8.0
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rule.
func (*Rule) DeepCopyInto ¶ added in v1.8.0
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type RuleWithOperations ¶
type RuleWithOperations struct { // Operations is the operations the admission hook cares about - CREATE, UPDATE, or * // for all operations. // If '*' is present, the length of the slice must be one. // Required. Operations []OperationType // Rule is embedded, it describes other criteria of the rule, like // APIGroups, APIVersions, Resources, etc. Rule }
RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.
func (*RuleWithOperations) DeepCopy ¶ added in v1.8.0
func (in *RuleWithOperations) DeepCopy() *RuleWithOperations
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuleWithOperations.
func (*RuleWithOperations) DeepCopyInto ¶ added in v1.8.0
func (in *RuleWithOperations) DeepCopyInto(out *RuleWithOperations)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ServiceReference ¶
type ServiceReference struct { // `namespace` is the namespace of the service. // Required Namespace string // `name` is the name of the service. // Required Name string // `path` is an optional URL path which will be sent in any request to // this service. // +optional Path *string }
ServiceReference holds a reference to Service.legacy.k8s.io
func (*ServiceReference) DeepCopy ¶ added in v1.8.0
func (in *ServiceReference) DeepCopy() *ServiceReference
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceReference.
func (*ServiceReference) DeepCopyInto ¶ added in v1.8.0
func (in *ServiceReference) DeepCopyInto(out *ServiceReference)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SideEffectClass ¶ added in v1.12.0
type SideEffectClass string
const ( // SideEffectClassUnknown means that no information is known about the side effects of calling the webhook. // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail. SideEffectClassUnknown SideEffectClass = "Unknown" // SideEffectClassNone means that calling the webhook will have no side effects. SideEffectClassNone SideEffectClass = "None" // SideEffectClassSome means that calling the webhook will possibly have side effects. // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail. SideEffectClassSome SideEffectClass = "Some" // SideEffectClassNoneOnDryRun means that calling the webhook will possibly have side effects, but if the // request being reviewed has the dry-run attribute, the side effects will be suppressed. SideEffectClassNoneOnDryRun SideEffectClass = "NoneOnDryRun" )
type ValidatingWebhookConfiguration ¶ added in v1.9.1
type ValidatingWebhookConfiguration struct { metav1.TypeMeta // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. // +optional metav1.ObjectMeta // Webhooks is a list of webhooks and the affected resources and operations. // +optional Webhooks []Webhook }
ValidatingWebhookConfiguration describes the configuration of an admission webhook that accepts or rejects and object without changing it.
func (*ValidatingWebhookConfiguration) DeepCopy ¶ added in v1.9.1
func (in *ValidatingWebhookConfiguration) DeepCopy() *ValidatingWebhookConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingWebhookConfiguration.
func (*ValidatingWebhookConfiguration) DeepCopyInto ¶ added in v1.9.1
func (in *ValidatingWebhookConfiguration) DeepCopyInto(out *ValidatingWebhookConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ValidatingWebhookConfiguration) DeepCopyObject ¶ added in v1.9.1
func (in *ValidatingWebhookConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ValidatingWebhookConfigurationList ¶ added in v1.9.1
type ValidatingWebhookConfigurationList struct { metav1.TypeMeta // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds // +optional metav1.ListMeta // List of ValidatingWebhookConfigurations. Items []ValidatingWebhookConfiguration }
ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
func (*ValidatingWebhookConfigurationList) DeepCopy ¶ added in v1.9.1
func (in *ValidatingWebhookConfigurationList) DeepCopy() *ValidatingWebhookConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingWebhookConfigurationList.
func (*ValidatingWebhookConfigurationList) DeepCopyInto ¶ added in v1.9.1
func (in *ValidatingWebhookConfigurationList) DeepCopyInto(out *ValidatingWebhookConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ValidatingWebhookConfigurationList) DeepCopyObject ¶ added in v1.9.1
func (in *ValidatingWebhookConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type Webhook ¶ added in v1.9.1
type Webhook struct { // The name of the admission webhook. // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where // "imagepolicy" is the name of the webhook, and kubernetes.io is the name // of the organization. // Required. Name string // ClientConfig defines how to communicate with the hook. // Required ClientConfig WebhookClientConfig // Rules describes what operations on what resources/subresources the webhook cares about. // The webhook cares about an operation if it matches _any_ Rule. Rules []RuleWithOperations // FailurePolicy defines how unrecognized errors from the admission endpoint are handled - // allowed values are Ignore or Fail. Defaults to Ignore. // +optional FailurePolicy *FailurePolicyType // NamespaceSelector decides whether to run the webhook on an object based // on whether the namespace for that object matches the selector. If the // object itself is a namespace, the matching is performed on // object.metadata.labels. If the object is another cluster scoped resource, // it never skips the webhook. // // For example, to run the webhook on any objects whose namespace is not // associated with "runlevel" of "0" or "1"; you will set the selector as // follows: // "namespaceSelector": { // "matchExpressions": [ // { // "key": "runlevel", // "operator": "NotIn", // "values": [ // "0", // "1" // ] // } // ] // } // // If instead you want to only run the webhook on any objects whose // namespace is associated with the "environment" of "prod" or "staging"; // you will set the selector as follows: // "namespaceSelector": { // "matchExpressions": [ // { // "key": "environment", // "operator": "In", // "values": [ // "prod", // "staging" // ] // } // ] // } // // See // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ // for more examples of label selectors. // // Default to the empty LabelSelector, which matches everything. // +optional NamespaceSelector *metav1.LabelSelector // SideEffects states whether this webhookk has side effects. // Acceptable values are: Unknown, None, Some, NoneOnDryRun // Webhooks with side effects MUST implement a reconciliation system, since a request may be // rejected by a future step in the admission change and the side effects therefore need to be undone. // Requests with the dryRun attribute will be auto-rejected if they match a webhook with // sideEffects == Unknown or Some. Defaults to Unknown. // +optional SideEffects *SideEffectClass }
Webhook describes an admission webhook and the resources and operations it applies to.
func (*Webhook) DeepCopy ¶ added in v1.9.1
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Webhook.
func (*Webhook) DeepCopyInto ¶ added in v1.9.1
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type WebhookClientConfig ¶ added in v1.9.1
type WebhookClientConfig struct { // `url` gives the location of the webhook, in standard URL form // (`[scheme://]host:port/path`). Exactly one of `url` or `service` // must be specified. // // The `host` should not refer to a service running in the cluster; use // the `service` field instead. The host might be resolved via external // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve // in-cluster DNS as that would be a layering violation). `host` may // also be an IP address. // // Please note that using `localhost` or `127.0.0.1` as a `host` is // risky unless you take great care to run this webhook on all hosts // which run an apiserver which might need to make calls to this // webhook. Such installs are likely to be non-portable, i.e., not easy // to turn up in a new cluster. // // The scheme must be "https"; the URL must begin with "https://". // // A path is optional, and if present may be any string permissible in // a URL. You may use the path to pass an arbitrary string to the // webhook, for example, a cluster identifier. // // Attempting to use a user or basic auth e.g. "user:password@" is not // allowed. Fragments ("#...") and query parameters ("?...") are not // allowed, either. // // +optional URL *string // `service` is a reference to the service for this webhook. Either // `service` or `url` must be specified. // // If the webhook is running within the cluster, then you should use `service`. // // Port 443 will be used if it is open, otherwise it is an error. // // +optional Service *ServiceReference // `caBundle` is a PEM encoded CA bundle which will be used to validate // the webhook's server certificate. // Required. CABundle []byte }
WebhookClientConfig contains the information to make a TLS connection with the webhook
func (*WebhookClientConfig) DeepCopy ¶ added in v1.9.1
func (in *WebhookClientConfig) DeepCopy() *WebhookClientConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookClientConfig.
func (*WebhookClientConfig) DeepCopyInto ¶ added in v1.9.1
func (in *WebhookClientConfig) DeepCopyInto(out *WebhookClientConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.