v1alpha1

package
v0.26.15 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 14, 2024 License: Apache-2.0 Imports: 11 Imported by: 622

Documentation

Overview

Package v1alpha1 is the v1alpha1 version of the API.

Index

Constants

View Source 
const GroupName = "admissionregistration.k8s.io"

GroupName is the group name for this API.

Variables

View Source 
var (
	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
)
View Source 
var (
	// SchemeBuilder points to a list of functions added to Scheme.
	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)

	// AddToScheme is a common registration function for mapping packaged scoped group & version keys to a scheme.
	AddToScheme = localSchemeBuilder.AddToScheme
)

TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api. localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.

View Source 
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}

SchemeGroupVersion is group version used to register these objects

Functions

func Resource 

func Resource(resource string) schema.GroupResource

Resource takes an unqualified resource and returns a Group qualified GroupResource

Types

type FailurePolicyType 

type FailurePolicyType string

FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. +enum 

const (
	// Ignore means that an error calling the webhook is ignored.
	Ignore FailurePolicyType = "Ignore"
	// Fail means that an error calling the webhook causes the admission to fail.
	Fail FailurePolicyType = "Fail"
)

type MatchPolicyType 

type MatchPolicyType string

MatchPolicyType specifies the type of match policy. +enum 

const (
	// Exact means requests should only be sent to the webhook if they exactly match a given rule.
	Exact MatchPolicyType = "Exact"
	// Equivalent means requests should be sent to the webhook if they modify a resource listed in rules via another API group or version.
	Equivalent MatchPolicyType = "Equivalent"
)

type MatchResources 

type MatchResources struct {
	// NamespaceSelector decides whether to run the admission control policy on an object based
	// on whether the namespace for that object matches the selector. If the
	// object itself is a namespace, the matching is performed on
	// object.metadata.labels. If the object is another cluster scoped resource,
	// it never skips the policy.
	//
	// For example, to run the webhook on any objects whose namespace is not
	// associated with "runlevel" of "0" or "1";  you will set the selector as
	// follows:
	// "namespaceSelector": {
	//   "matchExpressions": [
	//     {
	//       "key": "runlevel",
	//       "operator": "NotIn",
	//       "values": [
	//         "0",
	//         "1"
	//       ]
	//     }
	//   ]
	// }
	//
	// If instead you want to only run the policy on any objects whose
	// namespace is associated with the "environment" of "prod" or "staging";
	// you will set the selector as follows:
	// "namespaceSelector": {
	//   "matchExpressions": [
	//     {
	//       "key": "environment",
	//       "operator": "In",
	//       "values": [
	//         "prod",
	//         "staging"
	//       ]
	//     }
	//   ]
	// }
	//
	// See
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
	// for more examples of label selectors.
	//
	// Default to the empty LabelSelector, which matches everything.
	// +optional
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,1,opt,name=namespaceSelector"`
	// ObjectSelector decides whether to run the validation based on if the
	// object has matching labels. objectSelector is evaluated against both
	// the oldObject and newObject that would be sent to the cel validation, and
	// is considered to match if either object matches the selector. A null
	// object (oldObject in the case of create, or newObject in the case of
	// delete) or an object that cannot have labels (like a
	// DeploymentRollback or a PodProxyOptions object) is not considered to
	// match.
	// Use the object selector only if the webhook is opt-in, because end
	// users may skip the admission webhook by setting the labels.
	// Default to the empty LabelSelector, which matches everything.
	// +optional
	ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,2,opt,name=objectSelector"`
	// ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
	// The policy cares about an operation if it matches _any_ Rule.
	// +listType=atomic
	// +optional
	ResourceRules []NamedRuleWithOperations `json:"resourceRules,omitempty" protobuf:"bytes,3,rep,name=resourceRules"`
	// ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
	// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
	// +listType=atomic
	// +optional
	ExcludeResourceRules []NamedRuleWithOperations `json:"excludeResourceRules,omitempty" protobuf:"bytes,4,rep,name=excludeResourceRules"`
	// matchPolicy defines how the "MatchResources" list is used to match incoming requests.
	// Allowed values are "Exact" or "Equivalent".
	//
	// - Exact: match a request only if it exactly matches a specified rule.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
	//
	// - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
	//
	// Defaults to "Equivalent"
	// +optional
	MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,7,opt,name=matchPolicy,casttype=MatchPolicyType"`
}

MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded) +structType=atomic

func (*MatchResources) DeepCopy 

func (in *MatchResources) DeepCopy() *MatchResources

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MatchResources.

func (*MatchResources) DeepCopyInto 

func (in *MatchResources) DeepCopyInto(out *MatchResources)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*MatchResources) Descriptor 

func (*MatchResources) Descriptor() ([]byte, []int)

func (*MatchResources) Marshal 

func (m *MatchResources) Marshal() (dAtA []byte, err error)

func (*MatchResources) MarshalTo 

func (m *MatchResources) MarshalTo(dAtA []byte) (int, error)

func (*MatchResources) MarshalToSizedBuffer 

func (m *MatchResources) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*MatchResources) ProtoMessage 

func (*MatchResources) ProtoMessage()

func (*MatchResources) Reset 

func (m *MatchResources) Reset()

func (*MatchResources) Size 

func (m *MatchResources) Size() (n int)

func (*MatchResources) String 

func (this *MatchResources) String() string

func (MatchResources) SwaggerDoc 

func (MatchResources) SwaggerDoc() map[string]string

func (*MatchResources) Unmarshal 

func (m *MatchResources) Unmarshal(dAtA []byte) error

func (*MatchResources) XXX_DiscardUnknown 

func (m *MatchResources) XXX_DiscardUnknown()

func (*MatchResources) XXX_Marshal 

func (m *MatchResources) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*MatchResources) XXX_Merge 

func (m *MatchResources) XXX_Merge(src proto.Message)

func (*MatchResources) XXX_Size 

func (m *MatchResources) XXX_Size() int

func (*MatchResources) XXX_Unmarshal 

func (m *MatchResources) XXX_Unmarshal(b []byte) error

type NamedRuleWithOperations 

type NamedRuleWithOperations struct {
	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
	// +listType=atomic
	// +optional
	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,1,rep,name=resourceNames"`
	// RuleWithOperations is a tuple of Operations and Resources.
	RuleWithOperations `json:",inline" protobuf:"bytes,2,opt,name=ruleWithOperations"`
}

NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames. +structType=atomic

func (*NamedRuleWithOperations) DeepCopy 

func (in *NamedRuleWithOperations) DeepCopy() *NamedRuleWithOperations

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamedRuleWithOperations.

func (*NamedRuleWithOperations) DeepCopyInto 

func (in *NamedRuleWithOperations) DeepCopyInto(out *NamedRuleWithOperations)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*NamedRuleWithOperations) Descriptor 

func (*NamedRuleWithOperations) Descriptor() ([]byte, []int)

func (*NamedRuleWithOperations) Marshal 

func (m *NamedRuleWithOperations) Marshal() (dAtA []byte, err error)

func (*NamedRuleWithOperations) MarshalTo 

func (m *NamedRuleWithOperations) MarshalTo(dAtA []byte) (int, error)

func (*NamedRuleWithOperations) MarshalToSizedBuffer 

func (m *NamedRuleWithOperations) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*NamedRuleWithOperations) ProtoMessage 

func (*NamedRuleWithOperations) ProtoMessage()

func (*NamedRuleWithOperations) Reset 

func (m *NamedRuleWithOperations) Reset()

func (*NamedRuleWithOperations) Size 

func (m *NamedRuleWithOperations) Size() (n int)

func (*NamedRuleWithOperations) String 

func (this *NamedRuleWithOperations) String() string

func (NamedRuleWithOperations) SwaggerDoc 

func (NamedRuleWithOperations) SwaggerDoc() map[string]string

func (*NamedRuleWithOperations) Unmarshal 

func (m *NamedRuleWithOperations) Unmarshal(dAtA []byte) error

func (*NamedRuleWithOperations) XXX_DiscardUnknown 

func (m *NamedRuleWithOperations) XXX_DiscardUnknown()

func (*NamedRuleWithOperations) XXX_Marshal 

func (m *NamedRuleWithOperations) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*NamedRuleWithOperations) XXX_Merge 

func (m *NamedRuleWithOperations) XXX_Merge(src proto.Message)

func (*NamedRuleWithOperations) XXX_Size 

func (m *NamedRuleWithOperations) XXX_Size() int

func (*NamedRuleWithOperations) XXX_Unmarshal 

func (m *NamedRuleWithOperations) XXX_Unmarshal(b []byte) error

type OperationType 

type OperationType = v1.OperationType

OperationType specifies an operation for a request. +enum 

const (
	OperationAll OperationType = v1.OperationAll
	Create       OperationType = v1.Create
	Update       OperationType = v1.Update
	Delete       OperationType = v1.Delete
	Connect      OperationType = v1.Connect
)

The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go.

type ParamKind 

type ParamKind struct {
	// APIVersion is the API group version the resources belong to.
	// In format of "group/version".
	// Required.
	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,1,rep,name=apiVersion"`

	// Kind is the API kind the resources belong to.
	// Required.
	Kind string `json:"kind,omitempty" protobuf:"bytes,2,rep,name=kind"`
}

ParamKind is a tuple of Group Kind and Version. +structType=atomic

func (*ParamKind) DeepCopy 

func (in *ParamKind) DeepCopy() *ParamKind

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ParamKind.

func (*ParamKind) DeepCopyInto 

func (in *ParamKind) DeepCopyInto(out *ParamKind)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ParamKind) Descriptor 

func (*ParamKind) Descriptor() ([]byte, []int)

func (*ParamKind) Marshal 

func (m *ParamKind) Marshal() (dAtA []byte, err error)

func (*ParamKind) MarshalTo 

func (m *ParamKind) MarshalTo(dAtA []byte) (int, error)

func (*ParamKind) MarshalToSizedBuffer 

func (m *ParamKind) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ParamKind) ProtoMessage 

func (*ParamKind) ProtoMessage()

func (*ParamKind) Reset 

func (m *ParamKind) Reset()

func (*ParamKind) Size 

func (m *ParamKind) Size() (n int)

func (*ParamKind) String 

func (this *ParamKind) String() string

func (ParamKind) SwaggerDoc 

func (ParamKind) SwaggerDoc() map[string]string

func (*ParamKind) Unmarshal 

func (m *ParamKind) Unmarshal(dAtA []byte) error

func (*ParamKind) XXX_DiscardUnknown 

func (m *ParamKind) XXX_DiscardUnknown()

func (*ParamKind) XXX_Marshal 

func (m *ParamKind) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ParamKind) XXX_Merge 

func (m *ParamKind) XXX_Merge(src proto.Message)

func (*ParamKind) XXX_Size 

func (m *ParamKind) XXX_Size() int

func (*ParamKind) XXX_Unmarshal 

func (m *ParamKind) XXX_Unmarshal(b []byte) error

type ParamRef 

type ParamRef struct {
	// Name of the resource being referenced.
	Name string `json:"name,omitempty" protobuf:"bytes,1,rep,name=name"`
	// Namespace of the referenced resource.
	// Should be empty for the cluster-scoped resources
	// +optional
	Namespace string `json:"namespace,omitempty" protobuf:"bytes,2,rep,name=namespace"`
}

ParamRef references a parameter resource +structType=atomic

func (*ParamRef) DeepCopy 

func (in *ParamRef) DeepCopy() *ParamRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ParamRef.

func (*ParamRef) DeepCopyInto 

func (in *ParamRef) DeepCopyInto(out *ParamRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ParamRef) Descriptor 

func (*ParamRef) Descriptor() ([]byte, []int)

func (*ParamRef) Marshal 

func (m *ParamRef) Marshal() (dAtA []byte, err error)

func (*ParamRef) MarshalTo 

func (m *ParamRef) MarshalTo(dAtA []byte) (int, error)

func (*ParamRef) MarshalToSizedBuffer 

func (m *ParamRef) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ParamRef) ProtoMessage 

func (*ParamRef) ProtoMessage()

func (*ParamRef) Reset 

func (m *ParamRef) Reset()

func (*ParamRef) Size 

func (m *ParamRef) Size() (n int)

func (*ParamRef) String 

func (this *ParamRef) String() string

func (ParamRef) SwaggerDoc 

func (ParamRef) SwaggerDoc() map[string]string

func (*ParamRef) Unmarshal 

func (m *ParamRef) Unmarshal(dAtA []byte) error

func (*ParamRef) XXX_DiscardUnknown 

func (m *ParamRef) XXX_DiscardUnknown()

func (*ParamRef) XXX_Marshal 

func (m *ParamRef) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ParamRef) XXX_Merge 

func (m *ParamRef) XXX_Merge(src proto.Message)

func (*ParamRef) XXX_Size 

func (m *ParamRef) XXX_Size() int

func (*ParamRef) XXX_Unmarshal 

func (m *ParamRef) XXX_Unmarshal(b []byte) error

type Rule 

type Rule = v1.Rule

Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended to make sure that all the tuple expansions are valid.

type RuleWithOperations 

type RuleWithOperations = v1.RuleWithOperations

RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.

type ScopeType 

type ScopeType = v1.ScopeType

ScopeType specifies a scope for a Rule. +enum 

const (
	// ClusterScope means that scope is limited to cluster-scoped objects.
	// Namespace objects are cluster-scoped.
	ClusterScope ScopeType = v1.ClusterScope
	// NamespacedScope means that scope is limited to namespaced objects.
	NamespacedScope ScopeType = v1.NamespacedScope
	// AllScopes means that all scopes are included.
	AllScopes ScopeType = v1.AllScopes
)

type ValidatingAdmissionPolicy 

type ValidatingAdmissionPolicy struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	// Specification of the desired behavior of the ValidatingAdmissionPolicy.
	Spec ValidatingAdmissionPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.

func (*ValidatingAdmissionPolicy) DeepCopy 

func (in *ValidatingAdmissionPolicy) DeepCopy() *ValidatingAdmissionPolicy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicy.

func (*ValidatingAdmissionPolicy) DeepCopyInto 

func (in *ValidatingAdmissionPolicy) DeepCopyInto(out *ValidatingAdmissionPolicy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicy) DeepCopyObject 

func (in *ValidatingAdmissionPolicy) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ValidatingAdmissionPolicy) Descriptor 

func (*ValidatingAdmissionPolicy) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicy) Marshal 

func (m *ValidatingAdmissionPolicy) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicy) MarshalTo 

func (m *ValidatingAdmissionPolicy) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicy) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicy) ProtoMessage 

func (*ValidatingAdmissionPolicy) ProtoMessage()

func (*ValidatingAdmissionPolicy) Reset 

func (m *ValidatingAdmissionPolicy) Reset()

func (*ValidatingAdmissionPolicy) Size 

func (m *ValidatingAdmissionPolicy) Size() (n int)

func (*ValidatingAdmissionPolicy) String 

func (this *ValidatingAdmissionPolicy) String() string

func (ValidatingAdmissionPolicy) SwaggerDoc 

func (ValidatingAdmissionPolicy) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicy) Unmarshal 

func (m *ValidatingAdmissionPolicy) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicy) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicy) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicy) XXX_Marshal 

func (m *ValidatingAdmissionPolicy) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicy) XXX_Merge 

func (m *ValidatingAdmissionPolicy) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicy) XXX_Size 

func (m *ValidatingAdmissionPolicy) XXX_Size() int

func (*ValidatingAdmissionPolicy) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicy) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicyBinding 

type ValidatingAdmissionPolicyBinding struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	// Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
	Spec ValidatingAdmissionPolicyBindingSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.

func (*ValidatingAdmissionPolicyBinding) DeepCopy 

func (in *ValidatingAdmissionPolicyBinding) DeepCopy() *ValidatingAdmissionPolicyBinding

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicyBinding.

func (*ValidatingAdmissionPolicyBinding) DeepCopyInto 

func (in *ValidatingAdmissionPolicyBinding) DeepCopyInto(out *ValidatingAdmissionPolicyBinding)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicyBinding) DeepCopyObject 

func (in *ValidatingAdmissionPolicyBinding) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ValidatingAdmissionPolicyBinding) Descriptor 

func (*ValidatingAdmissionPolicyBinding) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicyBinding) Marshal 

func (m *ValidatingAdmissionPolicyBinding) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicyBinding) MarshalTo 

func (m *ValidatingAdmissionPolicyBinding) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBinding) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicyBinding) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBinding) ProtoMessage 

func (*ValidatingAdmissionPolicyBinding) ProtoMessage()

func (*ValidatingAdmissionPolicyBinding) Reset 

func (m *ValidatingAdmissionPolicyBinding) Reset()

func (*ValidatingAdmissionPolicyBinding) Size 

func (m *ValidatingAdmissionPolicyBinding) Size() (n int)

func (*ValidatingAdmissionPolicyBinding) String 

func (this *ValidatingAdmissionPolicyBinding) String() string

func (ValidatingAdmissionPolicyBinding) SwaggerDoc 

func (ValidatingAdmissionPolicyBinding) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicyBinding) Unmarshal 

func (m *ValidatingAdmissionPolicyBinding) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicyBinding) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicyBinding) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicyBinding) XXX_Marshal 

func (m *ValidatingAdmissionPolicyBinding) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicyBinding) XXX_Merge 

func (m *ValidatingAdmissionPolicyBinding) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicyBinding) XXX_Size 

func (m *ValidatingAdmissionPolicyBinding) XXX_Size() int

func (*ValidatingAdmissionPolicyBinding) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicyBinding) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicyBindingList 

type ValidatingAdmissionPolicyBindingList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard list metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	// List of PolicyBinding.
	Items []ValidatingAdmissionPolicyBinding `json:"items,omitempty" protobuf:"bytes,2,rep,name=items"`
}

ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.

func (*ValidatingAdmissionPolicyBindingList) DeepCopy 

func (in *ValidatingAdmissionPolicyBindingList) DeepCopy() *ValidatingAdmissionPolicyBindingList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicyBindingList.

func (*ValidatingAdmissionPolicyBindingList) DeepCopyInto 

func (in *ValidatingAdmissionPolicyBindingList) DeepCopyInto(out *ValidatingAdmissionPolicyBindingList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicyBindingList) DeepCopyObject 

func (in *ValidatingAdmissionPolicyBindingList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ValidatingAdmissionPolicyBindingList) Descriptor 

func (*ValidatingAdmissionPolicyBindingList) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicyBindingList) Marshal 

func (m *ValidatingAdmissionPolicyBindingList) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicyBindingList) MarshalTo 

func (m *ValidatingAdmissionPolicyBindingList) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBindingList) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicyBindingList) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBindingList) ProtoMessage 

func (*ValidatingAdmissionPolicyBindingList) ProtoMessage()

func (*ValidatingAdmissionPolicyBindingList) Reset 

func (m *ValidatingAdmissionPolicyBindingList) Reset()

func (*ValidatingAdmissionPolicyBindingList) Size 

func (m *ValidatingAdmissionPolicyBindingList) Size() (n int)

func (*ValidatingAdmissionPolicyBindingList) String 

func (this *ValidatingAdmissionPolicyBindingList) String() string

func (ValidatingAdmissionPolicyBindingList) SwaggerDoc 

func (ValidatingAdmissionPolicyBindingList) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicyBindingList) Unmarshal 

func (m *ValidatingAdmissionPolicyBindingList) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicyBindingList) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicyBindingList) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicyBindingList) XXX_Marshal 

func (m *ValidatingAdmissionPolicyBindingList) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicyBindingList) XXX_Merge 

func (m *ValidatingAdmissionPolicyBindingList) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicyBindingList) XXX_Size 

func (m *ValidatingAdmissionPolicyBindingList) XXX_Size() int

func (*ValidatingAdmissionPolicyBindingList) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicyBindingList) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicyBindingSpec 

type ValidatingAdmissionPolicyBindingSpec struct {
	// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
	// If the referenced resource does not exist, this binding is considered invalid and will be ignored
	// Required.
	PolicyName string `json:"policyName,omitempty" protobuf:"bytes,1,rep,name=policyName"`

	// ParamRef specifies the parameter resource used to configure the admission control policy.
	// It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy.
	// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
	// +optional
	ParamRef *ParamRef `json:"paramRef,omitempty" protobuf:"bytes,2,rep,name=paramRef"`

	// MatchResources declares what resources match this binding and will be validated by it.
	// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
	// If this is unset, all resources matched by the policy are validated by this binding
	// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
	// Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
	// +optional
	MatchResources *MatchResources `json:"matchResources,omitempty" protobuf:"bytes,3,rep,name=matchResources"`
}

ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.

func (*ValidatingAdmissionPolicyBindingSpec) DeepCopy 

func (in *ValidatingAdmissionPolicyBindingSpec) DeepCopy() *ValidatingAdmissionPolicyBindingSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicyBindingSpec.

func (*ValidatingAdmissionPolicyBindingSpec) DeepCopyInto 

func (in *ValidatingAdmissionPolicyBindingSpec) DeepCopyInto(out *ValidatingAdmissionPolicyBindingSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicyBindingSpec) Descriptor 

func (*ValidatingAdmissionPolicyBindingSpec) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicyBindingSpec) Marshal 

func (m *ValidatingAdmissionPolicyBindingSpec) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicyBindingSpec) MarshalTo 

func (m *ValidatingAdmissionPolicyBindingSpec) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBindingSpec) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicyBindingSpec) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBindingSpec) ProtoMessage 

func (*ValidatingAdmissionPolicyBindingSpec) ProtoMessage()

func (*ValidatingAdmissionPolicyBindingSpec) Reset 

func (m *ValidatingAdmissionPolicyBindingSpec) Reset()

func (*ValidatingAdmissionPolicyBindingSpec) Size 

func (m *ValidatingAdmissionPolicyBindingSpec) Size() (n int)

func (*ValidatingAdmissionPolicyBindingSpec) String 

func (this *ValidatingAdmissionPolicyBindingSpec) String() string

func (ValidatingAdmissionPolicyBindingSpec) SwaggerDoc 

func (ValidatingAdmissionPolicyBindingSpec) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicyBindingSpec) Unmarshal 

func (m *ValidatingAdmissionPolicyBindingSpec) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicyBindingSpec) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicyBindingSpec) XXX_Marshal 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicyBindingSpec) XXX_Merge 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicyBindingSpec) XXX_Size 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_Size() int

func (*ValidatingAdmissionPolicyBindingSpec) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicyList 

type ValidatingAdmissionPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard list metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	// List of ValidatingAdmissionPolicy.
	Items []ValidatingAdmissionPolicy `json:"items,omitempty" protobuf:"bytes,2,rep,name=items"`
}

ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.

func (*ValidatingAdmissionPolicyList) DeepCopy 

func (in *ValidatingAdmissionPolicyList) DeepCopy() *ValidatingAdmissionPolicyList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicyList.

func (*ValidatingAdmissionPolicyList) DeepCopyInto 

func (in *ValidatingAdmissionPolicyList) DeepCopyInto(out *ValidatingAdmissionPolicyList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicyList) DeepCopyObject 

func (in *ValidatingAdmissionPolicyList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ValidatingAdmissionPolicyList) Descriptor 

func (*ValidatingAdmissionPolicyList) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicyList) Marshal 

func (m *ValidatingAdmissionPolicyList) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicyList) MarshalTo 

func (m *ValidatingAdmissionPolicyList) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyList) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicyList) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyList) ProtoMessage 

func (*ValidatingAdmissionPolicyList) ProtoMessage()

func (*ValidatingAdmissionPolicyList) Reset 

func (m *ValidatingAdmissionPolicyList) Reset()

func (*ValidatingAdmissionPolicyList) Size 

func (m *ValidatingAdmissionPolicyList) Size() (n int)

func (*ValidatingAdmissionPolicyList) String 

func (this *ValidatingAdmissionPolicyList) String() string

func (ValidatingAdmissionPolicyList) SwaggerDoc 

func (ValidatingAdmissionPolicyList) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicyList) Unmarshal 

func (m *ValidatingAdmissionPolicyList) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicyList) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicyList) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicyList) XXX_Marshal 

func (m *ValidatingAdmissionPolicyList) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicyList) XXX_Merge 

func (m *ValidatingAdmissionPolicyList) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicyList) XXX_Size 

func (m *ValidatingAdmissionPolicyList) XXX_Size() int

func (*ValidatingAdmissionPolicyList) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicyList) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicySpec 

type ValidatingAdmissionPolicySpec struct {
	// ParamKind specifies the kind of resources used to parameterize this policy.
	// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
	// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
	// If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
	// +optional
	ParamKind *ParamKind `json:"paramKind,omitempty" protobuf:"bytes,1,rep,name=paramKind"`

	// MatchConstraints specifies what resources this policy is designed to validate.
	// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
	// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
	// ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
	// Required.
	MatchConstraints *MatchResources `json:"matchConstraints,omitempty" protobuf:"bytes,2,rep,name=matchConstraints"`

	// Validations contain CEL expressions which is used to apply the validation.
	// A minimum of one validation is required for a policy definition.
	// +listType=atomic
	// Required.
	Validations []Validation `json:"validations" protobuf:"bytes,3,rep,name=validations"`

	// FailurePolicy defines how to handle failures for the admission policy.
	// Failures can occur from invalid or mis-configured policy definitions or bindings.
	// A policy is invalid if spec.paramKind refers to a non-existent Kind.
	// A binding is invalid if spec.paramRef.name refers to a non-existent resource.
	// Allowed values are Ignore or Fail. Defaults to Fail.
	// +optional
	FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`
}

ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.

func (*ValidatingAdmissionPolicySpec) DeepCopy 

func (in *ValidatingAdmissionPolicySpec) DeepCopy() *ValidatingAdmissionPolicySpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicySpec.

func (*ValidatingAdmissionPolicySpec) DeepCopyInto 

func (in *ValidatingAdmissionPolicySpec) DeepCopyInto(out *ValidatingAdmissionPolicySpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicySpec) Descriptor 

func (*ValidatingAdmissionPolicySpec) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicySpec) Marshal 

func (m *ValidatingAdmissionPolicySpec) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicySpec) MarshalTo 

func (m *ValidatingAdmissionPolicySpec) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicySpec) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicySpec) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicySpec) ProtoMessage 

func (*ValidatingAdmissionPolicySpec) ProtoMessage()

func (*ValidatingAdmissionPolicySpec) Reset 

func (m *ValidatingAdmissionPolicySpec) Reset()

func (*ValidatingAdmissionPolicySpec) Size 

func (m *ValidatingAdmissionPolicySpec) Size() (n int)

func (*ValidatingAdmissionPolicySpec) String 

func (this *ValidatingAdmissionPolicySpec) String() string

func (ValidatingAdmissionPolicySpec) SwaggerDoc 

func (ValidatingAdmissionPolicySpec) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicySpec) Unmarshal 

func (m *ValidatingAdmissionPolicySpec) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicySpec) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicySpec) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicySpec) XXX_Marshal 

func (m *ValidatingAdmissionPolicySpec) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicySpec) XXX_Merge 

func (m *ValidatingAdmissionPolicySpec) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicySpec) XXX_Size 

func (m *ValidatingAdmissionPolicySpec) XXX_Size() int

func (*ValidatingAdmissionPolicySpec) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicySpec) XXX_Unmarshal(b []byte) error

type Validation 

type Validation struct {
	// Expression represents the expression which will be evaluated by CEL.
	// ref: https://github.com/google/cel-spec
	// CEL expressions have access to the contents of the Admission request/response, organized into CEL variables as well as some other useful variables:
	//
	//'object' - The object from the incoming request. The value is null for DELETE requests.
	//'oldObject' - The existing object. The value is null for CREATE requests.
	//'request' - Attributes of the admission request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
	//'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
	//
	// The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the
	// object. No other metadata properties are accessible.
	//
	// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
	// Accessible property names are escaped according to the following rules when accessed in the expression:
	// - '__' escapes to '__underscores__'
	// - '.' escapes to '__dot__'
	// - '-' escapes to '__dash__'
	// - '/' escapes to '__slash__'
	// - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:
	//	  "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if",
	//	  "import", "let", "loop", "package", "namespace", "return".
	// Examples:
	//   - Expression accessing a property named "namespace": {"Expression": "object.__namespace__ > 0"}
	//   - Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
	//   - Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}
	//
	// Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].
	// Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:
	//   - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and
	//     non-intersecting elements in `Y` are appended, retaining their partial order.
	//   - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values
	//     are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with
	//     non-intersecting keys are appended, retaining their partial order.
	// Required.
	Expression string `json:"expression" protobuf:"bytes,1,opt,name=Expression"`
	// Message represents the message displayed when validation fails. The message is required if the Expression contains
	// line breaks. The message must not contain line breaks.
	// If unset, the message is "failed rule: {Rule}".
	// e.g. "must be a URL with the host matching spec.host"
	// If the Expression contains line breaks. Message is required.
	// The message must not contain line breaks.
	// If unset, the message is "failed Expression: {Expression}".
	// +optional
	Message string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"`
	// Reason represents a machine-readable description of why this validation failed.
	// If this is the first validation in the list to fail, this reason, as well as the
	// corresponding HTTP response code, are used in the
	// HTTP response to the client.
	// The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge".
	// If not set, StatusReasonInvalid is used in the response to the client.
	// +optional
	Reason *metav1.StatusReason `json:"reason,omitempty" protobuf:"bytes,3,opt,name=reason"`
}

Validation specifies the CEL expression which is used to apply the validation.

func (*Validation) DeepCopy 

func (in *Validation) DeepCopy() *Validation

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Validation.

func (*Validation) DeepCopyInto 

func (in *Validation) DeepCopyInto(out *Validation)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Validation) Descriptor 

func (*Validation) Descriptor() ([]byte, []int)

func (*Validation) Marshal 

func (m *Validation) Marshal() (dAtA []byte, err error)

func (*Validation) MarshalTo 

func (m *Validation) MarshalTo(dAtA []byte) (int, error)

func (*Validation) MarshalToSizedBuffer 

func (m *Validation) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*Validation) ProtoMessage 

func (*Validation) ProtoMessage()

func (*Validation) Reset 

func (m *Validation) Reset()

func (*Validation) Size 

func (m *Validation) Size() (n int)

func (*Validation) String 

func (this *Validation) String() string

func (Validation) SwaggerDoc 

func (Validation) SwaggerDoc() map[string]string

func (*Validation) Unmarshal 

func (m *Validation) Unmarshal(dAtA []byte) error

func (*Validation) XXX_DiscardUnknown 

func (m *Validation) XXX_DiscardUnknown()

func (*Validation) XXX_Marshal 

func (m *Validation) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*Validation) XXX_Merge 

func (m *Validation) XXX_Merge(src proto.Message)

func (*Validation) XXX_Size 

func (m *Validation) XXX_Size() int

func (*Validation) XXX_Unmarshal 

func (m *Validation) XXX_Unmarshal(b []byte) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.