v1alpha1

package
v0.28.0-beta.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 21, 2023 License: Apache-2.0 Imports: 11 Imported by: 622

Documentation

Overview

Package v1alpha1 is the v1alpha1 version of the API.

Index

Constants

View Source 
const GroupName = "admissionregistration.k8s.io"

GroupName is the group name for this API.

Variables

View Source 
var (
	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
)
View Source 
var (
	// SchemeBuilder points to a list of functions added to Scheme.
	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)

	// AddToScheme is a common registration function for mapping packaged scoped group & version keys to a scheme.
	AddToScheme = localSchemeBuilder.AddToScheme
)

TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api. localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.

View Source 
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}

SchemeGroupVersion is group version used to register these objects

Functions

func Resource 

func Resource(resource string) schema.GroupResource

Resource takes an unqualified resource and returns a Group qualified GroupResource

Types

type AuditAnnotation added in v0.27.0 

type AuditAnnotation struct {
	// key specifies the audit annotation key. The audit annotation keys of
	// a ValidatingAdmissionPolicy must be unique. The key must be a qualified
	// name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
	//
	// The key is combined with the resource name of the
	// ValidatingAdmissionPolicy to construct an audit annotation key:
	// "{ValidatingAdmissionPolicy name}/{key}".
	//
	// If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy
	// and the same audit annotation key, the annotation key will be identical.
	// In this case, the first annotation written with the key will be included
	// in the audit event and all subsequent annotations with the same key
	// will be discarded.
	//
	// Required.
	Key string `json:"key" protobuf:"bytes,1,opt,name=key"`

	// valueExpression represents the expression which is evaluated by CEL to
	// produce an audit annotation value. The expression must evaluate to either
	// a string or null value. If the expression evaluates to a string, the
	// audit annotation is included with the string value. If the expression
	// evaluates to null or empty string the audit annotation will be omitted.
	// The valueExpression may be no longer than 5kb in length.
	// If the result of the valueExpression is more than 10kb in length, it
	// will be truncated to 10kb.
	//
	// If multiple ValidatingAdmissionPolicyBinding resources match an
	// API request, then the valueExpression will be evaluated for
	// each binding. All unique values produced by the valueExpressions
	// will be joined together in a comma-separated list.
	//
	// Required.
	ValueExpression string `json:"valueExpression" protobuf:"bytes,2,opt,name=valueExpression"`
}

AuditAnnotation describes how to produce an audit annotation for an API request.

func (*AuditAnnotation) DeepCopy added in v0.27.0 

func (in *AuditAnnotation) DeepCopy() *AuditAnnotation

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuditAnnotation.

func (*AuditAnnotation) DeepCopyInto added in v0.27.0 

func (in *AuditAnnotation) DeepCopyInto(out *AuditAnnotation)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AuditAnnotation) Descriptor added in v0.27.0 

func (*AuditAnnotation) Descriptor() ([]byte, []int)

func (*AuditAnnotation) Marshal added in v0.27.0 

func (m *AuditAnnotation) Marshal() (dAtA []byte, err error)

func (*AuditAnnotation) MarshalTo added in v0.27.0 

func (m *AuditAnnotation) MarshalTo(dAtA []byte) (int, error)

func (*AuditAnnotation) MarshalToSizedBuffer added in v0.27.0 

func (m *AuditAnnotation) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*AuditAnnotation) ProtoMessage added in v0.27.0 

func (*AuditAnnotation) ProtoMessage()

func (*AuditAnnotation) Reset added in v0.27.0 

func (m *AuditAnnotation) Reset()

func (*AuditAnnotation) Size added in v0.27.0 

func (m *AuditAnnotation) Size() (n int)

func (*AuditAnnotation) String added in v0.27.0 

func (this *AuditAnnotation) String() string

func (AuditAnnotation) SwaggerDoc added in v0.27.0 

func (AuditAnnotation) SwaggerDoc() map[string]string

func (*AuditAnnotation) Unmarshal added in v0.27.0 

func (m *AuditAnnotation) Unmarshal(dAtA []byte) error

func (*AuditAnnotation) XXX_DiscardUnknown added in v0.27.0 

func (m *AuditAnnotation) XXX_DiscardUnknown()

func (*AuditAnnotation) XXX_Marshal added in v0.27.0 

func (m *AuditAnnotation) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*AuditAnnotation) XXX_Merge added in v0.27.0 

func (m *AuditAnnotation) XXX_Merge(src proto.Message)

func (*AuditAnnotation) XXX_Size added in v0.27.0 

func (m *AuditAnnotation) XXX_Size() int

func (*AuditAnnotation) XXX_Unmarshal added in v0.27.0 

func (m *AuditAnnotation) XXX_Unmarshal(b []byte) error

type ExpressionWarning added in v0.27.0 

type ExpressionWarning struct {
	// The path to the field that refers the expression.
	// For example, the reference to the expression of the first item of
	// validations is "spec.validations[0].expression"
	FieldRef string `json:"fieldRef" protobuf:"bytes,2,opt,name=fieldRef"`
	// The content of type checking information in a human-readable form.
	// Each line of the warning contains the type that the expression is checked
	// against, followed by the type check error from the compiler.
	Warning string `json:"warning" protobuf:"bytes,3,opt,name=warning"`
}

ExpressionWarning is a warning information that targets a specific expression.

func (*ExpressionWarning) DeepCopy added in v0.27.0 

func (in *ExpressionWarning) DeepCopy() *ExpressionWarning

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExpressionWarning.

func (*ExpressionWarning) DeepCopyInto added in v0.27.0 

func (in *ExpressionWarning) DeepCopyInto(out *ExpressionWarning)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ExpressionWarning) Descriptor added in v0.27.0 

func (*ExpressionWarning) Descriptor() ([]byte, []int)

func (*ExpressionWarning) Marshal added in v0.27.0 

func (m *ExpressionWarning) Marshal() (dAtA []byte, err error)

func (*ExpressionWarning) MarshalTo added in v0.27.0 

func (m *ExpressionWarning) MarshalTo(dAtA []byte) (int, error)

func (*ExpressionWarning) MarshalToSizedBuffer added in v0.27.0 

func (m *ExpressionWarning) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ExpressionWarning) ProtoMessage added in v0.27.0 

func (*ExpressionWarning) ProtoMessage()

func (*ExpressionWarning) Reset added in v0.27.0 

func (m *ExpressionWarning) Reset()

func (*ExpressionWarning) Size added in v0.27.0 

func (m *ExpressionWarning) Size() (n int)

func (*ExpressionWarning) String added in v0.27.0 

func (this *ExpressionWarning) String() string

func (ExpressionWarning) SwaggerDoc added in v0.27.0 

func (ExpressionWarning) SwaggerDoc() map[string]string

func (*ExpressionWarning) Unmarshal added in v0.27.0 

func (m *ExpressionWarning) Unmarshal(dAtA []byte) error

func (*ExpressionWarning) XXX_DiscardUnknown added in v0.27.0 

func (m *ExpressionWarning) XXX_DiscardUnknown()

func (*ExpressionWarning) XXX_Marshal added in v0.27.0 

func (m *ExpressionWarning) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ExpressionWarning) XXX_Merge added in v0.27.0 

func (m *ExpressionWarning) XXX_Merge(src proto.Message)

func (*ExpressionWarning) XXX_Size added in v0.27.0 

func (m *ExpressionWarning) XXX_Size() int

func (*ExpressionWarning) XXX_Unmarshal added in v0.27.0 

func (m *ExpressionWarning) XXX_Unmarshal(b []byte) error

type FailurePolicyType 

type FailurePolicyType string

FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. +enum 

const (
	// Ignore means that an error calling the webhook is ignored.
	Ignore FailurePolicyType = "Ignore"
	// Fail means that an error calling the webhook causes the admission to fail.
	Fail FailurePolicyType = "Fail"
)

type MatchCondition added in v0.27.0 

type MatchCondition v1.MatchCondition

func (*MatchCondition) DeepCopy added in v0.27.0 

func (in *MatchCondition) DeepCopy() *MatchCondition

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MatchCondition.

func (*MatchCondition) DeepCopyInto added in v0.27.0 

func (in *MatchCondition) DeepCopyInto(out *MatchCondition)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*MatchCondition) Descriptor added in v0.27.0 

func (*MatchCondition) Descriptor() ([]byte, []int)

func (*MatchCondition) Marshal added in v0.27.0 

func (m *MatchCondition) Marshal() (dAtA []byte, err error)

func (*MatchCondition) MarshalTo added in v0.27.0 

func (m *MatchCondition) MarshalTo(dAtA []byte) (int, error)

func (*MatchCondition) MarshalToSizedBuffer added in v0.27.0 

func (m *MatchCondition) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*MatchCondition) ProtoMessage added in v0.27.0 

func (*MatchCondition) ProtoMessage()

func (*MatchCondition) Reset added in v0.27.0 

func (m *MatchCondition) Reset()

func (*MatchCondition) Size added in v0.27.0 

func (m *MatchCondition) Size() (n int)

func (*MatchCondition) String added in v0.27.0 

func (this *MatchCondition) String() string

func (*MatchCondition) Unmarshal added in v0.27.0 

func (m *MatchCondition) Unmarshal(dAtA []byte) error

func (*MatchCondition) XXX_DiscardUnknown added in v0.27.0 

func (m *MatchCondition) XXX_DiscardUnknown()

func (*MatchCondition) XXX_Marshal added in v0.27.0 

func (m *MatchCondition) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*MatchCondition) XXX_Merge added in v0.27.0 

func (m *MatchCondition) XXX_Merge(src proto.Message)

func (*MatchCondition) XXX_Size added in v0.27.0 

func (m *MatchCondition) XXX_Size() int

func (*MatchCondition) XXX_Unmarshal added in v0.27.0 

func (m *MatchCondition) XXX_Unmarshal(b []byte) error

type MatchPolicyType 

type MatchPolicyType string

MatchPolicyType specifies the type of match policy. +enum 

const (
	// Exact means requests should only be sent to the webhook if they exactly match a given rule.
	Exact MatchPolicyType = "Exact"
	// Equivalent means requests should be sent to the webhook if they modify a resource listed in rules via another API group or version.
	Equivalent MatchPolicyType = "Equivalent"
)

type MatchResources 

type MatchResources struct {
	// NamespaceSelector decides whether to run the admission control policy on an object based
	// on whether the namespace for that object matches the selector. If the
	// object itself is a namespace, the matching is performed on
	// object.metadata.labels. If the object is another cluster scoped resource,
	// it never skips the policy.
	//
	// For example, to run the webhook on any objects whose namespace is not
	// associated with "runlevel" of "0" or "1";  you will set the selector as
	// follows:
	// "namespaceSelector": {
	//   "matchExpressions": [
	//     {
	//       "key": "runlevel",
	//       "operator": "NotIn",
	//       "values": [
	//         "0",
	//         "1"
	//       ]
	//     }
	//   ]
	// }
	//
	// If instead you want to only run the policy on any objects whose
	// namespace is associated with the "environment" of "prod" or "staging";
	// you will set the selector as follows:
	// "namespaceSelector": {
	//   "matchExpressions": [
	//     {
	//       "key": "environment",
	//       "operator": "In",
	//       "values": [
	//         "prod",
	//         "staging"
	//       ]
	//     }
	//   ]
	// }
	//
	// See
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
	// for more examples of label selectors.
	//
	// Default to the empty LabelSelector, which matches everything.
	// +optional
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,1,opt,name=namespaceSelector"`
	// ObjectSelector decides whether to run the validation based on if the
	// object has matching labels. objectSelector is evaluated against both
	// the oldObject and newObject that would be sent to the cel validation, and
	// is considered to match if either object matches the selector. A null
	// object (oldObject in the case of create, or newObject in the case of
	// delete) or an object that cannot have labels (like a
	// DeploymentRollback or a PodProxyOptions object) is not considered to
	// match.
	// Use the object selector only if the webhook is opt-in, because end
	// users may skip the admission webhook by setting the labels.
	// Default to the empty LabelSelector, which matches everything.
	// +optional
	ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,2,opt,name=objectSelector"`
	// ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
	// The policy cares about an operation if it matches _any_ Rule.
	// +listType=atomic
	// +optional
	ResourceRules []NamedRuleWithOperations `json:"resourceRules,omitempty" protobuf:"bytes,3,rep,name=resourceRules"`
	// ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
	// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
	// +listType=atomic
	// +optional
	ExcludeResourceRules []NamedRuleWithOperations `json:"excludeResourceRules,omitempty" protobuf:"bytes,4,rep,name=excludeResourceRules"`
	// matchPolicy defines how the "MatchResources" list is used to match incoming requests.
	// Allowed values are "Exact" or "Equivalent".
	//
	// - Exact: match a request only if it exactly matches a specified rule.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
	//
	// - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
	//
	// Defaults to "Equivalent"
	// +optional
	MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,7,opt,name=matchPolicy,casttype=MatchPolicyType"`
}

MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded) +structType=atomic

func (*MatchResources) DeepCopy 

func (in *MatchResources) DeepCopy() *MatchResources

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MatchResources.

func (*MatchResources) DeepCopyInto 

func (in *MatchResources) DeepCopyInto(out *MatchResources)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*MatchResources) Descriptor 

func (*MatchResources) Descriptor() ([]byte, []int)

func (*MatchResources) Marshal 

func (m *MatchResources) Marshal() (dAtA []byte, err error)

func (*MatchResources) MarshalTo 

func (m *MatchResources) MarshalTo(dAtA []byte) (int, error)

func (*MatchResources) MarshalToSizedBuffer 

func (m *MatchResources) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*MatchResources) ProtoMessage 

func (*MatchResources) ProtoMessage()

func (*MatchResources) Reset 

func (m *MatchResources) Reset()

func (*MatchResources) Size 

func (m *MatchResources) Size() (n int)

func (*MatchResources) String 

func (this *MatchResources) String() string

func (MatchResources) SwaggerDoc 

func (MatchResources) SwaggerDoc() map[string]string

func (*MatchResources) Unmarshal 

func (m *MatchResources) Unmarshal(dAtA []byte) error

func (*MatchResources) XXX_DiscardUnknown 

func (m *MatchResources) XXX_DiscardUnknown()

func (*MatchResources) XXX_Marshal 

func (m *MatchResources) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*MatchResources) XXX_Merge 

func (m *MatchResources) XXX_Merge(src proto.Message)

func (*MatchResources) XXX_Size 

func (m *MatchResources) XXX_Size() int

func (*MatchResources) XXX_Unmarshal 

func (m *MatchResources) XXX_Unmarshal(b []byte) error

type NamedRuleWithOperations 

type NamedRuleWithOperations struct {
	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
	// +listType=atomic
	// +optional
	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,1,rep,name=resourceNames"`
	// RuleWithOperations is a tuple of Operations and Resources.
	RuleWithOperations `json:",inline" protobuf:"bytes,2,opt,name=ruleWithOperations"`
}

NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames. +structType=atomic

func (*NamedRuleWithOperations) DeepCopy 

func (in *NamedRuleWithOperations) DeepCopy() *NamedRuleWithOperations

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamedRuleWithOperations.

func (*NamedRuleWithOperations) DeepCopyInto 

func (in *NamedRuleWithOperations) DeepCopyInto(out *NamedRuleWithOperations)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*NamedRuleWithOperations) Descriptor 

func (*NamedRuleWithOperations) Descriptor() ([]byte, []int)

func (*NamedRuleWithOperations) Marshal 

func (m *NamedRuleWithOperations) Marshal() (dAtA []byte, err error)

func (*NamedRuleWithOperations) MarshalTo 

func (m *NamedRuleWithOperations) MarshalTo(dAtA []byte) (int, error)

func (*NamedRuleWithOperations) MarshalToSizedBuffer 

func (m *NamedRuleWithOperations) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*NamedRuleWithOperations) ProtoMessage 

func (*NamedRuleWithOperations) ProtoMessage()

func (*NamedRuleWithOperations) Reset 

func (m *NamedRuleWithOperations) Reset()

func (*NamedRuleWithOperations) Size 

func (m *NamedRuleWithOperations) Size() (n int)

func (*NamedRuleWithOperations) String 

func (this *NamedRuleWithOperations) String() string

func (NamedRuleWithOperations) SwaggerDoc 

func (NamedRuleWithOperations) SwaggerDoc() map[string]string

func (*NamedRuleWithOperations) Unmarshal 

func (m *NamedRuleWithOperations) Unmarshal(dAtA []byte) error

func (*NamedRuleWithOperations) XXX_DiscardUnknown 

func (m *NamedRuleWithOperations) XXX_DiscardUnknown()

func (*NamedRuleWithOperations) XXX_Marshal 

func (m *NamedRuleWithOperations) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*NamedRuleWithOperations) XXX_Merge 

func (m *NamedRuleWithOperations) XXX_Merge(src proto.Message)

func (*NamedRuleWithOperations) XXX_Size 

func (m *NamedRuleWithOperations) XXX_Size() int

func (*NamedRuleWithOperations) XXX_Unmarshal 

func (m *NamedRuleWithOperations) XXX_Unmarshal(b []byte) error

type OperationType 

type OperationType = v1.OperationType

OperationType specifies an operation for a request. +enum 

const (
	OperationAll OperationType = v1.OperationAll
	Create       OperationType = v1.Create
	Update       OperationType = v1.Update
	Delete       OperationType = v1.Delete
	Connect      OperationType = v1.Connect
)

The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go.

type ParamKind 

type ParamKind struct {
	// APIVersion is the API group version the resources belong to.
	// In format of "group/version".
	// Required.
	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,1,rep,name=apiVersion"`

	// Kind is the API kind the resources belong to.
	// Required.
	Kind string `json:"kind,omitempty" protobuf:"bytes,2,rep,name=kind"`
}

ParamKind is a tuple of Group Kind and Version. +structType=atomic

func (*ParamKind) DeepCopy 

func (in *ParamKind) DeepCopy() *ParamKind

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ParamKind.

func (*ParamKind) DeepCopyInto 

func (in *ParamKind) DeepCopyInto(out *ParamKind)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ParamKind) Descriptor 

func (*ParamKind) Descriptor() ([]byte, []int)

func (*ParamKind) Marshal 

func (m *ParamKind) Marshal() (dAtA []byte, err error)

func (*ParamKind) MarshalTo 

func (m *ParamKind) MarshalTo(dAtA []byte) (int, error)

func (*ParamKind) MarshalToSizedBuffer 

func (m *ParamKind) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ParamKind) ProtoMessage 

func (*ParamKind) ProtoMessage()

func (*ParamKind) Reset 

func (m *ParamKind) Reset()

func (*ParamKind) Size 

func (m *ParamKind) Size() (n int)

func (*ParamKind) String 

func (this *ParamKind) String() string

func (ParamKind) SwaggerDoc 

func (ParamKind) SwaggerDoc() map[string]string

func (*ParamKind) Unmarshal 

func (m *ParamKind) Unmarshal(dAtA []byte) error

func (*ParamKind) XXX_DiscardUnknown 

func (m *ParamKind) XXX_DiscardUnknown()

func (*ParamKind) XXX_Marshal 

func (m *ParamKind) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ParamKind) XXX_Merge 

func (m *ParamKind) XXX_Merge(src proto.Message)

func (*ParamKind) XXX_Size 

func (m *ParamKind) XXX_Size() int

func (*ParamKind) XXX_Unmarshal 

func (m *ParamKind) XXX_Unmarshal(b []byte) error

type ParamRef 

type ParamRef struct {
	// `name` is the name of the resource being referenced.
	//
	// `name` and `selector` are mutually exclusive properties. If one is set,
	// the other must be unset.
	//
	// +optional
	Name string `json:"name,omitempty" protobuf:"bytes,1,rep,name=name"`

	// namespace is the namespace of the referenced resource. Allows limiting
	// the search for params to a specific namespace. Applies to both `name` and
	// `selector` fields.
	//
	// A per-namespace parameter may be used by specifying a namespace-scoped
	// `paramKind` in the policy and leaving this field empty.
	//
	// - If `paramKind` is cluster-scoped, this field MUST be unset. Setting this
	// field results in a configuration error.
	//
	// - If `paramKind` is namespace-scoped, the namespace of the object being
	// evaluated for admission will be used when this field is left unset. Take
	// care that if this is left empty the binding must not match any cluster-scoped
	// resources, which will result in an error.
	//
	// +optional
	Namespace string `json:"namespace,omitempty" protobuf:"bytes,2,rep,name=namespace"`

	// selector can be used to match multiple param objects based on their labels.
	// Supply selector: {} to match all resources of the ParamKind.
	//
	// If multiple params are found, they are all evaluated with the policy expressions
	// and the results are ANDed together.
	//
	// One of `name` or `selector` must be set, but `name` and `selector` are
	// mutually exclusive properties. If one is set, the other must be unset.
	//
	// +optional
	Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,3,rep,name=selector"`

	// `parameterNotFoundAction` controls the behavior of the binding when the resource
	// exists, and name or selector is valid, but there are no parameters
	// matched by the binding. If the value is set to `Allow`, then no
	// matched parameters will be treated as successful validation by the binding.
	// If set to `Deny`, then no matched parameters will be subject to the
	// `failurePolicy` of the policy.
	//
	// Allowed values are `Allow` or `Deny`
	// Default to `Deny`
	// +optional
	ParameterNotFoundAction *ParameterNotFoundActionType `json:"parameterNotFoundAction,omitempty" protobuf:"bytes,4,rep,name=parameterNotFoundAction"`
}

ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding. +structType=atomic

func (*ParamRef) DeepCopy 

func (in *ParamRef) DeepCopy() *ParamRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ParamRef.

func (*ParamRef) DeepCopyInto 

func (in *ParamRef) DeepCopyInto(out *ParamRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ParamRef) Descriptor 

func (*ParamRef) Descriptor() ([]byte, []int)

func (*ParamRef) Marshal 

func (m *ParamRef) Marshal() (dAtA []byte, err error)

func (*ParamRef) MarshalTo 

func (m *ParamRef) MarshalTo(dAtA []byte) (int, error)

func (*ParamRef) MarshalToSizedBuffer 

func (m *ParamRef) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ParamRef) ProtoMessage 

func (*ParamRef) ProtoMessage()

func (*ParamRef) Reset 

func (m *ParamRef) Reset()

func (*ParamRef) Size 

func (m *ParamRef) Size() (n int)

func (*ParamRef) String 

func (this *ParamRef) String() string

func (ParamRef) SwaggerDoc 

func (ParamRef) SwaggerDoc() map[string]string

func (*ParamRef) Unmarshal 

func (m *ParamRef) Unmarshal(dAtA []byte) error

func (*ParamRef) XXX_DiscardUnknown 

func (m *ParamRef) XXX_DiscardUnknown()

func (*ParamRef) XXX_Marshal 

func (m *ParamRef) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ParamRef) XXX_Merge 

func (m *ParamRef) XXX_Merge(src proto.Message)

func (*ParamRef) XXX_Size 

func (m *ParamRef) XXX_Size() int

func (*ParamRef) XXX_Unmarshal 

func (m *ParamRef) XXX_Unmarshal(b []byte) error

type ParameterNotFoundActionType added in v0.28.0 

type ParameterNotFoundActionType string

ParameterNotFoundActionType specifies a failure policy that defines how a binding is evaluated when the param referred by its perNamespaceParamRef is not found. +enum 

const (
	// Ignore means that an error finding params for a binding is ignored
	AllowAction ParameterNotFoundActionType = "Allow"
	// Fail means that an error finding params for a binding is ignored
	DenyAction ParameterNotFoundActionType = "Deny"
)

type Rule 

type Rule = v1.Rule

Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended to make sure that all the tuple expansions are valid.

type RuleWithOperations 

type RuleWithOperations = v1.RuleWithOperations

RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.

type ScopeType 

type ScopeType = v1.ScopeType

ScopeType specifies a scope for a Rule. +enum 

const (
	// ClusterScope means that scope is limited to cluster-scoped objects.
	// Namespace objects are cluster-scoped.
	ClusterScope ScopeType = v1.ClusterScope
	// NamespacedScope means that scope is limited to namespaced objects.
	NamespacedScope ScopeType = v1.NamespacedScope
	// AllScopes means that all scopes are included.
	AllScopes ScopeType = v1.AllScopes
)

type TypeChecking added in v0.27.0 

type TypeChecking struct {
	// The type checking warnings for each expression.
	// +optional
	// +listType=atomic
	ExpressionWarnings []ExpressionWarning `json:"expressionWarnings,omitempty" protobuf:"bytes,1,rep,name=expressionWarnings"`
}

TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy

func (*TypeChecking) DeepCopy added in v0.27.0 

func (in *TypeChecking) DeepCopy() *TypeChecking

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TypeChecking.

func (*TypeChecking) DeepCopyInto added in v0.27.0 

func (in *TypeChecking) DeepCopyInto(out *TypeChecking)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*TypeChecking) Descriptor added in v0.27.0 

func (*TypeChecking) Descriptor() ([]byte, []int)

func (*TypeChecking) Marshal added in v0.27.0 

func (m *TypeChecking) Marshal() (dAtA []byte, err error)

func (*TypeChecking) MarshalTo added in v0.27.0 

func (m *TypeChecking) MarshalTo(dAtA []byte) (int, error)

func (*TypeChecking) MarshalToSizedBuffer added in v0.27.0 

func (m *TypeChecking) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*TypeChecking) ProtoMessage added in v0.27.0 

func (*TypeChecking) ProtoMessage()

func (*TypeChecking) Reset added in v0.27.0 

func (m *TypeChecking) Reset()

func (*TypeChecking) Size added in v0.27.0 

func (m *TypeChecking) Size() (n int)

func (*TypeChecking) String added in v0.27.0 

func (this *TypeChecking) String() string

func (TypeChecking) SwaggerDoc added in v0.27.0 

func (TypeChecking) SwaggerDoc() map[string]string

func (*TypeChecking) Unmarshal added in v0.27.0 

func (m *TypeChecking) Unmarshal(dAtA []byte) error

func (*TypeChecking) XXX_DiscardUnknown added in v0.27.0 

func (m *TypeChecking) XXX_DiscardUnknown()

func (*TypeChecking) XXX_Marshal added in v0.27.0 

func (m *TypeChecking) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*TypeChecking) XXX_Merge added in v0.27.0 

func (m *TypeChecking) XXX_Merge(src proto.Message)

func (*TypeChecking) XXX_Size added in v0.27.0 

func (m *TypeChecking) XXX_Size() int

func (*TypeChecking) XXX_Unmarshal added in v0.27.0 

func (m *TypeChecking) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicy 

type ValidatingAdmissionPolicy struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	// Specification of the desired behavior of the ValidatingAdmissionPolicy.
	Spec ValidatingAdmissionPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
	// The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
	// behaves in the expected way.
	// Populated by the system.
	// Read-only.
	// +optional
	Status ValidatingAdmissionPolicyStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.

func (*ValidatingAdmissionPolicy) DeepCopy 

func (in *ValidatingAdmissionPolicy) DeepCopy() *ValidatingAdmissionPolicy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicy.

func (*ValidatingAdmissionPolicy) DeepCopyInto 

func (in *ValidatingAdmissionPolicy) DeepCopyInto(out *ValidatingAdmissionPolicy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicy) DeepCopyObject 

func (in *ValidatingAdmissionPolicy) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ValidatingAdmissionPolicy) Descriptor 

func (*ValidatingAdmissionPolicy) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicy) Marshal 

func (m *ValidatingAdmissionPolicy) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicy) MarshalTo 

func (m *ValidatingAdmissionPolicy) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicy) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicy) ProtoMessage 

func (*ValidatingAdmissionPolicy) ProtoMessage()

func (*ValidatingAdmissionPolicy) Reset 

func (m *ValidatingAdmissionPolicy) Reset()

func (*ValidatingAdmissionPolicy) Size 

func (m *ValidatingAdmissionPolicy) Size() (n int)

func (*ValidatingAdmissionPolicy) String 

func (this *ValidatingAdmissionPolicy) String() string

func (ValidatingAdmissionPolicy) SwaggerDoc 

func (ValidatingAdmissionPolicy) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicy) Unmarshal 

func (m *ValidatingAdmissionPolicy) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicy) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicy) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicy) XXX_Marshal 

func (m *ValidatingAdmissionPolicy) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicy) XXX_Merge 

func (m *ValidatingAdmissionPolicy) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicy) XXX_Size 

func (m *ValidatingAdmissionPolicy) XXX_Size() int

func (*ValidatingAdmissionPolicy) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicy) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicyBinding 

type ValidatingAdmissionPolicyBinding struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	// Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
	Spec ValidatingAdmissionPolicyBindingSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.

For a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding.

The CEL expressions of a policy must have a computed CEL cost below the maximum CEL budget. Each evaluation of the policy is given an independent CEL cost budget. Adding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.

func (*ValidatingAdmissionPolicyBinding) DeepCopy 

func (in *ValidatingAdmissionPolicyBinding) DeepCopy() *ValidatingAdmissionPolicyBinding

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicyBinding.

func (*ValidatingAdmissionPolicyBinding) DeepCopyInto 

func (in *ValidatingAdmissionPolicyBinding) DeepCopyInto(out *ValidatingAdmissionPolicyBinding)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicyBinding) DeepCopyObject 

func (in *ValidatingAdmissionPolicyBinding) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ValidatingAdmissionPolicyBinding) Descriptor 

func (*ValidatingAdmissionPolicyBinding) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicyBinding) Marshal 

func (m *ValidatingAdmissionPolicyBinding) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicyBinding) MarshalTo 

func (m *ValidatingAdmissionPolicyBinding) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBinding) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicyBinding) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBinding) ProtoMessage 

func (*ValidatingAdmissionPolicyBinding) ProtoMessage()

func (*ValidatingAdmissionPolicyBinding) Reset 

func (m *ValidatingAdmissionPolicyBinding) Reset()

func (*ValidatingAdmissionPolicyBinding) Size 

func (m *ValidatingAdmissionPolicyBinding) Size() (n int)

func (*ValidatingAdmissionPolicyBinding) String 

func (this *ValidatingAdmissionPolicyBinding) String() string

func (ValidatingAdmissionPolicyBinding) SwaggerDoc 

func (ValidatingAdmissionPolicyBinding) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicyBinding) Unmarshal 

func (m *ValidatingAdmissionPolicyBinding) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicyBinding) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicyBinding) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicyBinding) XXX_Marshal 

func (m *ValidatingAdmissionPolicyBinding) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicyBinding) XXX_Merge 

func (m *ValidatingAdmissionPolicyBinding) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicyBinding) XXX_Size 

func (m *ValidatingAdmissionPolicyBinding) XXX_Size() int

func (*ValidatingAdmissionPolicyBinding) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicyBinding) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicyBindingList 

type ValidatingAdmissionPolicyBindingList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard list metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	// List of PolicyBinding.
	Items []ValidatingAdmissionPolicyBinding `json:"items,omitempty" protobuf:"bytes,2,rep,name=items"`
}

ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.

func (*ValidatingAdmissionPolicyBindingList) DeepCopy 

func (in *ValidatingAdmissionPolicyBindingList) DeepCopy() *ValidatingAdmissionPolicyBindingList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicyBindingList.

func (*ValidatingAdmissionPolicyBindingList) DeepCopyInto 

func (in *ValidatingAdmissionPolicyBindingList) DeepCopyInto(out *ValidatingAdmissionPolicyBindingList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicyBindingList) DeepCopyObject 

func (in *ValidatingAdmissionPolicyBindingList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ValidatingAdmissionPolicyBindingList) Descriptor 

func (*ValidatingAdmissionPolicyBindingList) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicyBindingList) Marshal 

func (m *ValidatingAdmissionPolicyBindingList) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicyBindingList) MarshalTo 

func (m *ValidatingAdmissionPolicyBindingList) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBindingList) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicyBindingList) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBindingList) ProtoMessage 

func (*ValidatingAdmissionPolicyBindingList) ProtoMessage()

func (*ValidatingAdmissionPolicyBindingList) Reset 

func (m *ValidatingAdmissionPolicyBindingList) Reset()

func (*ValidatingAdmissionPolicyBindingList) Size 

func (m *ValidatingAdmissionPolicyBindingList) Size() (n int)

func (*ValidatingAdmissionPolicyBindingList) String 

func (this *ValidatingAdmissionPolicyBindingList) String() string

func (ValidatingAdmissionPolicyBindingList) SwaggerDoc 

func (ValidatingAdmissionPolicyBindingList) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicyBindingList) Unmarshal 

func (m *ValidatingAdmissionPolicyBindingList) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicyBindingList) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicyBindingList) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicyBindingList) XXX_Marshal 

func (m *ValidatingAdmissionPolicyBindingList) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicyBindingList) XXX_Merge 

func (m *ValidatingAdmissionPolicyBindingList) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicyBindingList) XXX_Size 

func (m *ValidatingAdmissionPolicyBindingList) XXX_Size() int

func (*ValidatingAdmissionPolicyBindingList) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicyBindingList) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicyBindingSpec 

type ValidatingAdmissionPolicyBindingSpec struct {
	// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
	// If the referenced resource does not exist, this binding is considered invalid and will be ignored
	// Required.
	PolicyName string `json:"policyName,omitempty" protobuf:"bytes,1,rep,name=policyName"`

	// paramRef specifies the parameter resource used to configure the admission control policy.
	// It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy.
	// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
	// If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
	// +optional
	ParamRef *ParamRef `json:"paramRef,omitempty" protobuf:"bytes,2,rep,name=paramRef"`

	// MatchResources declares what resources match this binding and will be validated by it.
	// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
	// If this is unset, all resources matched by the policy are validated by this binding
	// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
	// Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
	// +optional
	MatchResources *MatchResources `json:"matchResources,omitempty" protobuf:"bytes,3,rep,name=matchResources"`

	// validationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced.
	// If a validation evaluates to false it is always enforced according to these actions.
	//
	// Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according
	// to these actions only if the FailurePolicy is set to Fail, otherwise the failures are
	// ignored. This includes compilation errors, runtime errors and misconfigurations of the policy.
	//
	// validationActions is declared as a set of action values. Order does
	// not matter. validationActions may not contain duplicates of the same action.
	//
	// The supported actions values are:
	//
	// "Deny" specifies that a validation failure results in a denied request.
	//
	// "Warn" specifies that a validation failure is reported to the request client
	// in HTTP Warning headers, with a warning code of 299. Warnings can be sent
	// both for allowed or denied admission responses.
	//
	// "Audit" specifies that a validation failure is included in the published
	// audit event for the request. The audit event will contain a
	// `validation.policy.admission.k8s.io/validation_failure` audit annotation
	// with a value containing the details of the validation failures, formatted as
	// a JSON list of objects, each with the following fields:
	// - message: The validation failure message string
	// - policy: The resource name of the ValidatingAdmissionPolicy
	// - binding: The resource name of the ValidatingAdmissionPolicyBinding
	// - expressionIndex: The index of the failed validations in the ValidatingAdmissionPolicy
	// - validationActions: The enforcement actions enacted for the validation failure
	// Example audit annotation:
	// `"validation.policy.admission.k8s.io/validation_failure": "[{\"message\": \"Invalid value\", {\"policy\": \"policy.example.com\", {\"binding\": \"policybinding.example.com\", {\"expressionIndex\": \"1\", {\"validationActions\": [\"Audit\"]}]"`
	//
	// Clients should expect to handle additional values by ignoring
	// any values not recognized.
	//
	// "Deny" and "Warn" may not be used together since this combination
	// needlessly duplicates the validation failure both in the
	// API response body and the HTTP warning headers.
	//
	// Required.
	// +listType=set
	ValidationActions []ValidationAction `json:"validationActions,omitempty" protobuf:"bytes,4,rep,name=validationActions"`
}

ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.

func (*ValidatingAdmissionPolicyBindingSpec) DeepCopy 

func (in *ValidatingAdmissionPolicyBindingSpec) DeepCopy() *ValidatingAdmissionPolicyBindingSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicyBindingSpec.

func (*ValidatingAdmissionPolicyBindingSpec) DeepCopyInto 

func (in *ValidatingAdmissionPolicyBindingSpec) DeepCopyInto(out *ValidatingAdmissionPolicyBindingSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicyBindingSpec) Descriptor 

func (*ValidatingAdmissionPolicyBindingSpec) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicyBindingSpec) Marshal 

func (m *ValidatingAdmissionPolicyBindingSpec) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicyBindingSpec) MarshalTo 

func (m *ValidatingAdmissionPolicyBindingSpec) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBindingSpec) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicyBindingSpec) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyBindingSpec) ProtoMessage 

func (*ValidatingAdmissionPolicyBindingSpec) ProtoMessage()

func (*ValidatingAdmissionPolicyBindingSpec) Reset 

func (m *ValidatingAdmissionPolicyBindingSpec) Reset()

func (*ValidatingAdmissionPolicyBindingSpec) Size 

func (m *ValidatingAdmissionPolicyBindingSpec) Size() (n int)

func (*ValidatingAdmissionPolicyBindingSpec) String 

func (this *ValidatingAdmissionPolicyBindingSpec) String() string

func (ValidatingAdmissionPolicyBindingSpec) SwaggerDoc 

func (ValidatingAdmissionPolicyBindingSpec) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicyBindingSpec) Unmarshal 

func (m *ValidatingAdmissionPolicyBindingSpec) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicyBindingSpec) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicyBindingSpec) XXX_Marshal 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicyBindingSpec) XXX_Merge 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicyBindingSpec) XXX_Size 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_Size() int

func (*ValidatingAdmissionPolicyBindingSpec) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicyBindingSpec) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicyList 

type ValidatingAdmissionPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard list metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	// List of ValidatingAdmissionPolicy.
	Items []ValidatingAdmissionPolicy `json:"items,omitempty" protobuf:"bytes,2,rep,name=items"`
}

ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.

func (*ValidatingAdmissionPolicyList) DeepCopy 

func (in *ValidatingAdmissionPolicyList) DeepCopy() *ValidatingAdmissionPolicyList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicyList.

func (*ValidatingAdmissionPolicyList) DeepCopyInto 

func (in *ValidatingAdmissionPolicyList) DeepCopyInto(out *ValidatingAdmissionPolicyList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicyList) DeepCopyObject 

func (in *ValidatingAdmissionPolicyList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ValidatingAdmissionPolicyList) Descriptor 

func (*ValidatingAdmissionPolicyList) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicyList) Marshal 

func (m *ValidatingAdmissionPolicyList) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicyList) MarshalTo 

func (m *ValidatingAdmissionPolicyList) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyList) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicyList) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyList) ProtoMessage 

func (*ValidatingAdmissionPolicyList) ProtoMessage()

func (*ValidatingAdmissionPolicyList) Reset 

func (m *ValidatingAdmissionPolicyList) Reset()

func (*ValidatingAdmissionPolicyList) Size 

func (m *ValidatingAdmissionPolicyList) Size() (n int)

func (*ValidatingAdmissionPolicyList) String 

func (this *ValidatingAdmissionPolicyList) String() string

func (ValidatingAdmissionPolicyList) SwaggerDoc 

func (ValidatingAdmissionPolicyList) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicyList) Unmarshal 

func (m *ValidatingAdmissionPolicyList) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicyList) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicyList) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicyList) XXX_Marshal 

func (m *ValidatingAdmissionPolicyList) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicyList) XXX_Merge 

func (m *ValidatingAdmissionPolicyList) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicyList) XXX_Size 

func (m *ValidatingAdmissionPolicyList) XXX_Size() int

func (*ValidatingAdmissionPolicyList) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicyList) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicySpec 

type ValidatingAdmissionPolicySpec struct {
	// ParamKind specifies the kind of resources used to parameterize this policy.
	// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
	// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
	// If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
	// +optional
	ParamKind *ParamKind `json:"paramKind,omitempty" protobuf:"bytes,1,rep,name=paramKind"`

	// MatchConstraints specifies what resources this policy is designed to validate.
	// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
	// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
	// ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
	// Required.
	MatchConstraints *MatchResources `json:"matchConstraints,omitempty" protobuf:"bytes,2,rep,name=matchConstraints"`

	// Validations contain CEL expressions which is used to apply the validation.
	// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
	// required.
	// +listType=atomic
	// +optional
	Validations []Validation `json:"validations,omitempty" protobuf:"bytes,3,rep,name=validations"`

	// failurePolicy defines how to handle failures for the admission policy. Failures can
	// occur from CEL expression parse errors, type check errors, runtime errors and invalid
	// or mis-configured policy definitions or bindings.
	//
	// A policy is invalid if spec.paramKind refers to a non-existent Kind.
	// A binding is invalid if spec.paramRef.name refers to a non-existent resource.
	//
	// failurePolicy does not define how validations that evaluate to false are handled.
	//
	// When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions
	// define how failures are enforced.
	//
	// Allowed values are Ignore or Fail. Defaults to Fail.
	// +optional
	FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`

	// auditAnnotations contains CEL expressions which are used to produce audit
	// annotations for the audit event of the API request.
	// validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is
	// required.
	// +listType=atomic
	// +optional
	AuditAnnotations []AuditAnnotation `json:"auditAnnotations,omitempty" protobuf:"bytes,5,rep,name=auditAnnotations"`

	// MatchConditions is a list of conditions that must be met for a request to be validated.
	// Match conditions filter requests that have already been matched by the rules,
	// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
	// There are a maximum of 64 match conditions allowed.
	//
	// If a parameter object is provided, it can be accessed via the `params` handle in the same
	// manner as validation expressions.
	//
	// The exact matching logic is (in order):
	//   1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
	//   2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
	//   3. If any matchCondition evaluates to an error (but none are FALSE):
	//      - If failurePolicy=Fail, reject the request
	//      - If failurePolicy=Ignore, the policy is skipped
	//
	// +patchMergeKey=name
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=name
	// +optional
	MatchConditions []MatchCondition `json:"matchConditions,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,6,rep,name=matchConditions"`

	// Variables contain definitions of variables that can be used in composition of other expressions.
	// Each variable is defined as a named CEL expression.
	// The variables defined here will be available under `variables` in other expressions of the policy
	// except MatchConditions because MatchConditions are evaluated before the rest of the policy.
	//
	// The expression of a variable can refer to other variables defined earlier in the list but not those after.
	// Thus, Variables must be sorted by the order of first appearance and acyclic.
	// +patchMergeKey=name
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=name
	// +optional
	Variables []Variable `json:"variables" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,7,rep,name=variables"`
}

ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.

func (*ValidatingAdmissionPolicySpec) DeepCopy 

func (in *ValidatingAdmissionPolicySpec) DeepCopy() *ValidatingAdmissionPolicySpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicySpec.

func (*ValidatingAdmissionPolicySpec) DeepCopyInto 

func (in *ValidatingAdmissionPolicySpec) DeepCopyInto(out *ValidatingAdmissionPolicySpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicySpec) Descriptor 

func (*ValidatingAdmissionPolicySpec) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicySpec) Marshal 

func (m *ValidatingAdmissionPolicySpec) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicySpec) MarshalTo 

func (m *ValidatingAdmissionPolicySpec) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicySpec) MarshalToSizedBuffer 

func (m *ValidatingAdmissionPolicySpec) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicySpec) ProtoMessage 

func (*ValidatingAdmissionPolicySpec) ProtoMessage()

func (*ValidatingAdmissionPolicySpec) Reset 

func (m *ValidatingAdmissionPolicySpec) Reset()

func (*ValidatingAdmissionPolicySpec) Size 

func (m *ValidatingAdmissionPolicySpec) Size() (n int)

func (*ValidatingAdmissionPolicySpec) String 

func (this *ValidatingAdmissionPolicySpec) String() string

func (ValidatingAdmissionPolicySpec) SwaggerDoc 

func (ValidatingAdmissionPolicySpec) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicySpec) Unmarshal 

func (m *ValidatingAdmissionPolicySpec) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicySpec) XXX_DiscardUnknown 

func (m *ValidatingAdmissionPolicySpec) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicySpec) XXX_Marshal 

func (m *ValidatingAdmissionPolicySpec) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicySpec) XXX_Merge 

func (m *ValidatingAdmissionPolicySpec) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicySpec) XXX_Size 

func (m *ValidatingAdmissionPolicySpec) XXX_Size() int

func (*ValidatingAdmissionPolicySpec) XXX_Unmarshal 

func (m *ValidatingAdmissionPolicySpec) XXX_Unmarshal(b []byte) error

type ValidatingAdmissionPolicyStatus added in v0.27.0 

type ValidatingAdmissionPolicyStatus struct {
	// The generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,1,opt,name=observedGeneration"`
	// The results of type checking for each expression.
	// Presence of this field indicates the completion of the type checking.
	// +optional
	TypeChecking *TypeChecking `json:"typeChecking,omitempty" protobuf:"bytes,2,opt,name=typeChecking"`
	// The conditions represent the latest available observations of a policy's current state.
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" protobuf:"bytes,3,rep,name=conditions"`
}

ValidatingAdmissionPolicyStatus represents the status of a ValidatingAdmissionPolicy.

func (*ValidatingAdmissionPolicyStatus) DeepCopy added in v0.27.0 

func (in *ValidatingAdmissionPolicyStatus) DeepCopy() *ValidatingAdmissionPolicyStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValidatingAdmissionPolicyStatus.

func (*ValidatingAdmissionPolicyStatus) DeepCopyInto added in v0.27.0 

func (in *ValidatingAdmissionPolicyStatus) DeepCopyInto(out *ValidatingAdmissionPolicyStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ValidatingAdmissionPolicyStatus) Descriptor added in v0.27.0 

func (*ValidatingAdmissionPolicyStatus) Descriptor() ([]byte, []int)

func (*ValidatingAdmissionPolicyStatus) Marshal added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) Marshal() (dAtA []byte, err error)

func (*ValidatingAdmissionPolicyStatus) MarshalTo added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) MarshalTo(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyStatus) MarshalToSizedBuffer added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*ValidatingAdmissionPolicyStatus) ProtoMessage added in v0.27.0 

func (*ValidatingAdmissionPolicyStatus) ProtoMessage()

func (*ValidatingAdmissionPolicyStatus) Reset added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) Reset()

func (*ValidatingAdmissionPolicyStatus) Size added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) Size() (n int)

func (*ValidatingAdmissionPolicyStatus) String added in v0.27.0 

func (this *ValidatingAdmissionPolicyStatus) String() string

func (ValidatingAdmissionPolicyStatus) SwaggerDoc added in v0.27.0 

func (ValidatingAdmissionPolicyStatus) SwaggerDoc() map[string]string

func (*ValidatingAdmissionPolicyStatus) Unmarshal added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) Unmarshal(dAtA []byte) error

func (*ValidatingAdmissionPolicyStatus) XXX_DiscardUnknown added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) XXX_DiscardUnknown()

func (*ValidatingAdmissionPolicyStatus) XXX_Marshal added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*ValidatingAdmissionPolicyStatus) XXX_Merge added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) XXX_Merge(src proto.Message)

func (*ValidatingAdmissionPolicyStatus) XXX_Size added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) XXX_Size() int

func (*ValidatingAdmissionPolicyStatus) XXX_Unmarshal added in v0.27.0 

func (m *ValidatingAdmissionPolicyStatus) XXX_Unmarshal(b []byte) error

type Validation 

type Validation struct {
	// Expression represents the expression which will be evaluated by CEL.
	// ref: https://github.com/google/cel-spec
	// CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:
	//
	// - 'object' - The object from the incoming request. The value is null for DELETE requests.
	// - 'oldObject' - The existing object. The value is null for CREATE requests.
	// - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
	// - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
	// - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.
	// - 'variables' - Map of composited variables, from its name to its lazily evaluated value.
	//   For example, a variable named 'foo' can be accessed as 'variables.foo'.
	// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
	//   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
	// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
	//   request resource.
	//
	// The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the
	// object. No other metadata properties are accessible.
	//
	// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
	// Accessible property names are escaped according to the following rules when accessed in the expression:
	// - '__' escapes to '__underscores__'
	// - '.' escapes to '__dot__'
	// - '-' escapes to '__dash__'
	// - '/' escapes to '__slash__'
	// - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:
	//	  "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if",
	//	  "import", "let", "loop", "package", "namespace", "return".
	// Examples:
	//   - Expression accessing a property named "namespace": {"Expression": "object.__namespace__ > 0"}
	//   - Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
	//   - Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}
	//
	// Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].
	// Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:
	//   - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and
	//     non-intersecting elements in `Y` are appended, retaining their partial order.
	//   - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values
	//     are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with
	//     non-intersecting keys are appended, retaining their partial order.
	// Required.
	Expression string `json:"expression" protobuf:"bytes,1,opt,name=Expression"`
	// Message represents the message displayed when validation fails. The message is required if the Expression contains
	// line breaks. The message must not contain line breaks.
	// If unset, the message is "failed rule: {Rule}".
	// e.g. "must be a URL with the host matching spec.host"
	// If the Expression contains line breaks. Message is required.
	// The message must not contain line breaks.
	// If unset, the message is "failed Expression: {Expression}".
	// +optional
	Message string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"`
	// Reason represents a machine-readable description of why this validation failed.
	// If this is the first validation in the list to fail, this reason, as well as the
	// corresponding HTTP response code, are used in the
	// HTTP response to the client.
	// The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge".
	// If not set, StatusReasonInvalid is used in the response to the client.
	// +optional
	Reason *metav1.StatusReason `json:"reason,omitempty" protobuf:"bytes,3,opt,name=reason"`
	// messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.
	// Since messageExpression is used as a failure message, it must evaluate to a string.
	// If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails.
	// If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
	// as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string
	// that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and
	// the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged.
	// messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'.
	// Example:
	// "object.x must be less than max ("+string(params.max)+")"
	// +optional
	MessageExpression string `json:"messageExpression,omitempty" protobuf:"bytes,4,opt,name=messageExpression"`
}

Validation specifies the CEL expression which is used to apply the validation.

func (*Validation) DeepCopy 

func (in *Validation) DeepCopy() *Validation

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Validation.

func (*Validation) DeepCopyInto 

func (in *Validation) DeepCopyInto(out *Validation)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Validation) Descriptor 

func (*Validation) Descriptor() ([]byte, []int)

func (*Validation) Marshal 

func (m *Validation) Marshal() (dAtA []byte, err error)

func (*Validation) MarshalTo 

func (m *Validation) MarshalTo(dAtA []byte) (int, error)

func (*Validation) MarshalToSizedBuffer 

func (m *Validation) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*Validation) ProtoMessage 

func (*Validation) ProtoMessage()

func (*Validation) Reset 

func (m *Validation) Reset()

func (*Validation) Size 

func (m *Validation) Size() (n int)

func (*Validation) String 

func (this *Validation) String() string

func (Validation) SwaggerDoc 

func (Validation) SwaggerDoc() map[string]string

func (*Validation) Unmarshal 

func (m *Validation) Unmarshal(dAtA []byte) error

func (*Validation) XXX_DiscardUnknown 

func (m *Validation) XXX_DiscardUnknown()

func (*Validation) XXX_Marshal 

func (m *Validation) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*Validation) XXX_Merge 

func (m *Validation) XXX_Merge(src proto.Message)

func (*Validation) XXX_Size 

func (m *Validation) XXX_Size() int

func (*Validation) XXX_Unmarshal 

func (m *Validation) XXX_Unmarshal(b []byte) error

type ValidationAction added in v0.27.0 

type ValidationAction string

ValidationAction specifies a policy enforcement action. +enum 

const (
	// Deny specifies that a validation failure results in a denied request.
	Deny ValidationAction = "Deny"
	// Warn specifies that a validation failure is reported to the request client
	// in HTTP Warning headers, with a warning code of 299. Warnings can be sent
	// both for allowed or denied admission responses.
	Warn ValidationAction = "Warn"
	// Audit specifies that a validation failure is included in the published
	// audit event for the request. The audit event will contain a
	// `validation.policy.admission.k8s.io/validation_failure` audit annotation
	// with a value containing the details of the validation failure.
	Audit ValidationAction = "Audit"
)

type Variable added in v0.28.0 

type Variable struct {
	// Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
	// The variable can be accessed in other expressions through `variables`
	// For example, if name is "foo", the variable will be available as `variables.foo`
	Name string `json:"name" protobuf:"bytes,1,opt,name=Name"`

	// Expression is the expression that will be evaluated as the value of the variable.
	// The CEL expression has access to the same identifiers as the CEL expressions in Validation.
	Expression string `json:"expression" protobuf:"bytes,2,opt,name=Expression"`
}

Variable is the definition of a variable that is used for composition.

func (*Variable) DeepCopy added in v0.28.0 

func (in *Variable) DeepCopy() *Variable

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Variable.

func (*Variable) DeepCopyInto added in v0.28.0 

func (in *Variable) DeepCopyInto(out *Variable)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Variable) Descriptor added in v0.28.0 

func (*Variable) Descriptor() ([]byte, []int)

func (*Variable) Marshal added in v0.28.0 

func (m *Variable) Marshal() (dAtA []byte, err error)

func (*Variable) MarshalTo added in v0.28.0 

func (m *Variable) MarshalTo(dAtA []byte) (int, error)

func (*Variable) MarshalToSizedBuffer added in v0.28.0 

func (m *Variable) MarshalToSizedBuffer(dAtA []byte) (int, error)

func (*Variable) ProtoMessage added in v0.28.0 

func (*Variable) ProtoMessage()

func (*Variable) Reset added in v0.28.0 

func (m *Variable) Reset()

func (*Variable) Size added in v0.28.0 

func (m *Variable) Size() (n int)

func (*Variable) String added in v0.28.0 

func (this *Variable) String() string

func (Variable) SwaggerDoc added in v0.28.0 

func (Variable) SwaggerDoc() map[string]string

func (*Variable) Unmarshal added in v0.28.0 

func (m *Variable) Unmarshal(dAtA []byte) error

func (*Variable) XXX_DiscardUnknown added in v0.28.0 

func (m *Variable) XXX_DiscardUnknown()

func (*Variable) XXX_Marshal added in v0.28.0 

func (m *Variable) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)

func (*Variable) XXX_Merge added in v0.28.0 

func (m *Variable) XXX_Merge(src proto.Message)

func (*Variable) XXX_Size added in v0.28.0 

func (m *Variable) XXX_Size() int

func (*Variable) XXX_Unmarshal added in v0.28.0 

func (m *Variable) XXX_Unmarshal(b []byte) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.