Documentation ¶
Overview ¶
Package apiserver is the internal version of the API.
Index ¶
- Constants
- Variables
- type AESConfiguration
- type AdmissionConfiguration
- type AdmissionPluginConfiguration
- type AnonymousAuthCondition
- type AnonymousAuthConfig
- type AudienceMatchPolicyType
- type AuthenticationConfiguration
- type AuthorizationConfiguration
- type AuthorizerConfiguration
- type AuthorizerType
- type ClaimMappings
- type ClaimOrExpression
- type ClaimValidationRule
- type Connection
- type EgressSelection
- type EgressSelectorConfiguration
- type EncryptionConfiguration
- type ExtraMapping
- type IdentityConfiguration
- type Issuer
- type JWTAuthenticator
- type KMSConfiguration
- type Key
- type PrefixedClaimOrExpression
- type ProtocolType
- type ProviderConfiguration
- type ResourceConfiguration
- type SecretboxConfiguration
- type TCPTransport
- type TLSConfig
- type TracingConfiguration
- type Transport
- type UDSTransport
- type UserValidationRule
- type WebhookConfiguration
- type WebhookConnectionInfo
- type WebhookMatchCondition
Constants ¶
const ( TypeWebhook AuthorizerType = "Webhook" FailurePolicyNoOpinion string = "NoOpinion" FailurePolicyDeny string = "Deny" AuthorizationWebhookConnectionInfoTypeKubeConfigFile string = "KubeConfigFile" AuthorizationWebhookConnectionInfoTypeInCluster string = "InClusterConfig" )
const GroupName = "apiserver.config.k8s.io"
const LegacyGroupName = "apiserver.k8s.io"
Variables ¶
var ( SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) AddToScheme = SchemeBuilder.AddToScheme )
var LegacySchemeGroupVersion = schema.GroupVersion{Group: LegacyGroupName, Version: runtime.APIVersionInternal}
LegacySchemeGroupVersion is group version used to register these objects
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
SchemeGroupVersion is group version used to register these objects
Functions ¶
This section is empty.
Types ¶
type AESConfiguration ¶ added in v0.30.0
type AESConfiguration struct { // keys is a list of keys to be used for creating the AES transformer. // Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM. Keys []Key }
AESConfiguration contains the API configuration for an AES transformer.
func (*AESConfiguration) DeepCopy ¶ added in v0.30.0
func (in *AESConfiguration) DeepCopy() *AESConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AESConfiguration.
func (*AESConfiguration) DeepCopyInto ¶ added in v0.30.0
func (in *AESConfiguration) DeepCopyInto(out *AESConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AdmissionConfiguration ¶
type AdmissionConfiguration struct { metav1.TypeMeta // Plugins allows specifying a configuration per admission control plugin. // +optional Plugins []AdmissionPluginConfiguration }
AdmissionConfiguration provides versioned configuration for admission controllers.
func (*AdmissionConfiguration) DeepCopy ¶
func (in *AdmissionConfiguration) DeepCopy() *AdmissionConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionConfiguration.
func (*AdmissionConfiguration) DeepCopyInto ¶
func (in *AdmissionConfiguration) DeepCopyInto(out *AdmissionConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*AdmissionConfiguration) DeepCopyObject ¶
func (in *AdmissionConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type AdmissionPluginConfiguration ¶
type AdmissionPluginConfiguration struct { // Name is the name of the admission controller. // It must match the registered admission plugin name. Name string // Path is the path to a configuration file that contains the plugin's // configuration // +optional Path string // Configuration is an embedded configuration object to be used as the plugin's // configuration. If present, it will be used instead of the path to the configuration file. // +optional Configuration *runtime.Unknown }
AdmissionPluginConfiguration provides the configuration for a single plug-in.
func (*AdmissionPluginConfiguration) DeepCopy ¶
func (in *AdmissionPluginConfiguration) DeepCopy() *AdmissionPluginConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionPluginConfiguration.
func (*AdmissionPluginConfiguration) DeepCopyInto ¶
func (in *AdmissionPluginConfiguration) DeepCopyInto(out *AdmissionPluginConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AnonymousAuthCondition ¶ added in v0.31.0
type AnonymousAuthCondition struct { // Path for which anonymous auth is enabled. Path string }
AnonymousAuthCondition describes the condition under which anonymous auth should be enabled.
func (*AnonymousAuthCondition) DeepCopy ¶ added in v0.31.0
func (in *AnonymousAuthCondition) DeepCopy() *AnonymousAuthCondition
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AnonymousAuthCondition.
func (*AnonymousAuthCondition) DeepCopyInto ¶ added in v0.31.0
func (in *AnonymousAuthCondition) DeepCopyInto(out *AnonymousAuthCondition)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AnonymousAuthConfig ¶ added in v0.31.0
type AnonymousAuthConfig struct { Enabled bool // If set, anonymous auth is only allowed if the request meets one of the // conditions. Conditions []AnonymousAuthCondition }
AnonymousAuthConfig provides the configuration for the anonymous authenticator.
func (*AnonymousAuthConfig) DeepCopy ¶ added in v0.31.0
func (in *AnonymousAuthConfig) DeepCopy() *AnonymousAuthConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AnonymousAuthConfig.
func (*AnonymousAuthConfig) DeepCopyInto ¶ added in v0.31.0
func (in *AnonymousAuthConfig) DeepCopyInto(out *AnonymousAuthConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AudienceMatchPolicyType ¶ added in v0.30.0
type AudienceMatchPolicyType string
AudienceMatchPolicyType is a set of valid values for Issuer.AudienceMatchPolicy
const (
AudienceMatchPolicyMatchAny AudienceMatchPolicyType = "MatchAny"
)
Valid types for AudienceMatchPolicyType
type AuthenticationConfiguration ¶ added in v0.29.0
type AuthenticationConfiguration struct { metav1.TypeMeta JWT []JWTAuthenticator // If present --anonymous-auth must not be set Anonymous *AnonymousAuthConfig }
AuthenticationConfiguration provides versioned configuration for authentication.
func (*AuthenticationConfiguration) DeepCopy ¶ added in v0.29.0
func (in *AuthenticationConfiguration) DeepCopy() *AuthenticationConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationConfiguration.
func (*AuthenticationConfiguration) DeepCopyInto ¶ added in v0.29.0
func (in *AuthenticationConfiguration) DeepCopyInto(out *AuthenticationConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*AuthenticationConfiguration) DeepCopyObject ¶ added in v0.29.0
func (in *AuthenticationConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type AuthorizationConfiguration ¶ added in v0.29.0
type AuthorizationConfiguration struct { metav1.TypeMeta // Authorizers is an ordered list of authorizers to // authorize requests against. // This is similar to the --authorization-modes kube-apiserver flag // Must be at least one. Authorizers []AuthorizerConfiguration `json:"authorizers"` }
func (*AuthorizationConfiguration) DeepCopy ¶ added in v0.29.0
func (in *AuthorizationConfiguration) DeepCopy() *AuthorizationConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationConfiguration.
func (*AuthorizationConfiguration) DeepCopyInto ¶ added in v0.29.0
func (in *AuthorizationConfiguration) DeepCopyInto(out *AuthorizationConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*AuthorizationConfiguration) DeepCopyObject ¶ added in v0.29.0
func (in *AuthorizationConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type AuthorizerConfiguration ¶ added in v0.29.0
type AuthorizerConfiguration struct { // Type refers to the type of the authorizer // "Webhook" is supported in the generic API server // Other API servers may support additional authorizer // types like Node, RBAC, ABAC, etc. Type AuthorizerType // Name used to describe the webhook // This is explicitly used in monitoring machinery for metrics // Note: Names must be DNS1123 labels like `myauthorizername` or // subdomains like `myauthorizer.example.domain` // Required, with no default Name string // Webhook defines the configuration for a Webhook authorizer // Must be defined when Type=Webhook Webhook *WebhookConfiguration }
func (*AuthorizerConfiguration) DeepCopy ¶ added in v0.29.0
func (in *AuthorizerConfiguration) DeepCopy() *AuthorizerConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizerConfiguration.
func (*AuthorizerConfiguration) DeepCopyInto ¶ added in v0.29.0
func (in *AuthorizerConfiguration) DeepCopyInto(out *AuthorizerConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuthorizerType ¶ added in v0.29.0
type AuthorizerType string
type ClaimMappings ¶ added in v0.29.0
type ClaimMappings struct { Username PrefixedClaimOrExpression Groups PrefixedClaimOrExpression UID ClaimOrExpression Extra []ExtraMapping }
ClaimMappings provides the configuration for claim mapping
func (*ClaimMappings) DeepCopy ¶ added in v0.29.0
func (in *ClaimMappings) DeepCopy() *ClaimMappings
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimMappings.
func (*ClaimMappings) DeepCopyInto ¶ added in v0.29.0
func (in *ClaimMappings) DeepCopyInto(out *ClaimMappings)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ClaimOrExpression ¶ added in v0.29.0
ClaimOrExpression provides the configuration for a single claim or expression.
func (*ClaimOrExpression) DeepCopy ¶ added in v0.29.0
func (in *ClaimOrExpression) DeepCopy() *ClaimOrExpression
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimOrExpression.
func (*ClaimOrExpression) DeepCopyInto ¶ added in v0.29.0
func (in *ClaimOrExpression) DeepCopyInto(out *ClaimOrExpression)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ClaimValidationRule ¶ added in v0.29.0
type ClaimValidationRule struct { Claim string RequiredValue string Expression string Message string }
ClaimValidationRule provides the configuration for a single claim validation rule.
func (*ClaimValidationRule) DeepCopy ¶ added in v0.29.0
func (in *ClaimValidationRule) DeepCopy() *ClaimValidationRule
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimValidationRule.
func (*ClaimValidationRule) DeepCopyInto ¶ added in v0.29.0
func (in *ClaimValidationRule) DeepCopyInto(out *ClaimValidationRule)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Connection ¶ added in v0.16.4
type Connection struct { // Protocol is the protocol used to connect from client to the konnectivity server. ProxyProtocol ProtocolType // Transport defines the transport configurations we use to dial to the konnectivity server. // This is required if ProxyProtocol is HTTPConnect or GRPC. // +optional Transport *Transport }
Connection provides the configuration for a single egress selection client.
func (*Connection) DeepCopy ¶ added in v0.16.4
func (in *Connection) DeepCopy() *Connection
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Connection.
func (*Connection) DeepCopyInto ¶ added in v0.16.4
func (in *Connection) DeepCopyInto(out *Connection)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EgressSelection ¶ added in v0.16.4
type EgressSelection struct { // Name is the name of the egress selection. // Currently supported values are "controlplane", "etcd" and "cluster" Name string // Connection is the exact information used to configure the egress selection Connection Connection }
EgressSelection provides the configuration for a single egress selection client.
func (*EgressSelection) DeepCopy ¶ added in v0.16.4
func (in *EgressSelection) DeepCopy() *EgressSelection
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressSelection.
func (*EgressSelection) DeepCopyInto ¶ added in v0.16.4
func (in *EgressSelection) DeepCopyInto(out *EgressSelection)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EgressSelectorConfiguration ¶ added in v0.16.4
type EgressSelectorConfiguration struct { metav1.TypeMeta // EgressSelections contains a list of egress selection client configurations EgressSelections []EgressSelection }
EgressSelectorConfiguration provides versioned configuration for egress selector clients.
func (*EgressSelectorConfiguration) DeepCopy ¶ added in v0.16.4
func (in *EgressSelectorConfiguration) DeepCopy() *EgressSelectorConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressSelectorConfiguration.
func (*EgressSelectorConfiguration) DeepCopyInto ¶ added in v0.16.4
func (in *EgressSelectorConfiguration) DeepCopyInto(out *EgressSelectorConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*EgressSelectorConfiguration) DeepCopyObject ¶ added in v0.16.4
func (in *EgressSelectorConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type EncryptionConfiguration ¶ added in v0.30.0
type EncryptionConfiguration struct { metav1.TypeMeta // resources is a list containing resources, and their corresponding encryption providers. Resources []ResourceConfiguration }
EncryptionConfiguration stores the complete configuration for encryption providers. It also allows the use of wildcards to specify the resources that should be encrypted. Use '*.<group>' to encrypt all resources within a group or '*.*' to encrypt all resources. '*.' can be used to encrypt all resource in the core group. '*.*' will encrypt all resources, even custom resources that are added after API server start. Use of wildcards that overlap within the same resource list or across multiple entries are not allowed since part of the configuration would be ineffective. Resource lists are processed in order, with earlier lists taking precedence.
Example:
kind: EncryptionConfiguration apiVersion: apiserver.config.k8s.io/v1 resources: - resources: - events providers: - identity: {} # do not encrypt events even though *.* is specified below - resources: - secrets - configmaps - pandas.awesome.bears.example providers: - aescbc: keys: - name: key1 secret: c2VjcmV0IGlzIHNlY3VyZQ== - resources: - '*.apps' providers: - aescbc: keys: - name: key2 secret: c2VjcmV0IGlzIHNlY3VyZSwgb3IgaXMgaXQ/Cg== - resources: - '*.*' providers: - aescbc: keys: - name: key3 secret: c2VjcmV0IGlzIHNlY3VyZSwgSSB0aGluaw==
func (*EncryptionConfiguration) DeepCopy ¶ added in v0.30.0
func (in *EncryptionConfiguration) DeepCopy() *EncryptionConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionConfiguration.
func (*EncryptionConfiguration) DeepCopyInto ¶ added in v0.30.0
func (in *EncryptionConfiguration) DeepCopyInto(out *EncryptionConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*EncryptionConfiguration) DeepCopyObject ¶ added in v0.30.0
func (in *EncryptionConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ExtraMapping ¶ added in v0.29.0
ExtraMapping provides the configuration for a single extra mapping.
func (*ExtraMapping) DeepCopy ¶ added in v0.29.0
func (in *ExtraMapping) DeepCopy() *ExtraMapping
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtraMapping.
func (*ExtraMapping) DeepCopyInto ¶ added in v0.29.0
func (in *ExtraMapping) DeepCopyInto(out *ExtraMapping)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type IdentityConfiguration ¶ added in v0.30.0
type IdentityConfiguration struct{}
IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.
func (*IdentityConfiguration) DeepCopy ¶ added in v0.30.0
func (in *IdentityConfiguration) DeepCopy() *IdentityConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IdentityConfiguration.
func (*IdentityConfiguration) DeepCopyInto ¶ added in v0.30.0
func (in *IdentityConfiguration) DeepCopyInto(out *IdentityConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Issuer ¶ added in v0.29.0
type Issuer struct { // url points to the issuer URL in a format https://url or https://url/path. // This must match the "iss" claim in the presented JWT, and the issuer returned from discovery. // Same value as the --oidc-issuer-url flag. // Discovery information is fetched from "{url}/.well-known/openid-configuration" unless overridden by discoveryURL. // Required to be unique across all JWT authenticators. // Note that egress selection configuration is not used for this network connection. // +required URL string // discoveryURL, if specified, overrides the URL used to fetch discovery // information instead of using "{url}/.well-known/openid-configuration". // The exact value specified is used, so "/.well-known/openid-configuration" // must be included in discoveryURL if needed. // // The "issuer" field in the fetched discovery information must match the "issuer.url" field // in the AuthenticationConfiguration and will be used to validate the "iss" claim in the presented JWT. // This is for scenarios where the well-known and jwks endpoints are hosted at a different // location than the issuer (such as locally in the cluster). // // Example: // A discovery url that is exposed using kubernetes service 'oidc' in namespace 'oidc-namespace' // and discovery information is available at '/.well-known/openid-configuration'. // discoveryURL: "https://oidc.oidc-namespace/.well-known/openid-configuration" // certificateAuthority is used to verify the TLS connection and the hostname on the leaf certificate // must be set to 'oidc.oidc-namespace'. // // curl https://oidc.oidc-namespace/.well-known/openid-configuration (.discoveryURL field) // { // issuer: "https://oidc.example.com" (.url field) // } // // discoveryURL must be different from url. // Required to be unique across all JWT authenticators. // Note that egress selection configuration is not used for this network connection. // +optional DiscoveryURL string CertificateAuthority string Audiences []string AudienceMatchPolicy AudienceMatchPolicyType }
Issuer provides the configuration for an external provider's specific settings.
func (*Issuer) DeepCopy ¶ added in v0.29.0
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Issuer.
func (*Issuer) DeepCopyInto ¶ added in v0.29.0
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type JWTAuthenticator ¶ added in v0.29.0
type JWTAuthenticator struct { Issuer Issuer ClaimValidationRules []ClaimValidationRule ClaimMappings ClaimMappings UserValidationRules []UserValidationRule }
JWTAuthenticator provides the configuration for a single JWT authenticator.
func (*JWTAuthenticator) DeepCopy ¶ added in v0.29.0
func (in *JWTAuthenticator) DeepCopy() *JWTAuthenticator
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticator.
func (*JWTAuthenticator) DeepCopyInto ¶ added in v0.29.0
func (in *JWTAuthenticator) DeepCopyInto(out *JWTAuthenticator)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type KMSConfiguration ¶ added in v0.30.0
type KMSConfiguration struct { // apiVersion of KeyManagementService // +optional APIVersion string // name is the name of the KMS plugin to be used. Name string // cachesize is the maximum number of secrets which are cached in memory. The default value is 1000. // Set to a negative value to disable caching. This field is only allowed for KMS v1 providers. // +optional CacheSize *int32 // endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock". Endpoint string // timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds. // +optional Timeout *metav1.Duration }
KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.
func (*KMSConfiguration) DeepCopy ¶ added in v0.30.0
func (in *KMSConfiguration) DeepCopy() *KMSConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSConfiguration.
func (*KMSConfiguration) DeepCopyInto ¶ added in v0.30.0
func (in *KMSConfiguration) DeepCopyInto(out *KMSConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Key ¶ added in v0.30.0
type Key struct { // name is the name of the key to be used while storing data to disk. Name string // secret is the actual key, encoded in base64. Secret string }
Key contains name and secret of the provided key for a transformer.
func (*Key) DeepCopy ¶ added in v0.30.0
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Key.
func (*Key) DeepCopyInto ¶ added in v0.30.0
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PrefixedClaimOrExpression ¶ added in v0.29.0
PrefixedClaimOrExpression provides the configuration for a single prefixed claim or expression.
func (*PrefixedClaimOrExpression) DeepCopy ¶ added in v0.29.0
func (in *PrefixedClaimOrExpression) DeepCopy() *PrefixedClaimOrExpression
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrefixedClaimOrExpression.
func (*PrefixedClaimOrExpression) DeepCopyInto ¶ added in v0.29.0
func (in *PrefixedClaimOrExpression) DeepCopyInto(out *PrefixedClaimOrExpression)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ProtocolType ¶ added in v0.18.0
type ProtocolType string
ProtocolType is a set of valid values for Connection.ProtocolType
const ( // Use HTTPConnect to connect to konnectivity server ProtocolHTTPConnect ProtocolType = "HTTPConnect" // Use grpc to connect to konnectivity server ProtocolGRPC ProtocolType = "GRPC" // Connect directly (skip konnectivity server) ProtocolDirect ProtocolType = "Direct" )
Valid types for ProtocolType for konnectivity server
type ProviderConfiguration ¶ added in v0.30.0
type ProviderConfiguration struct { // aesgcm is the configuration for the AES-GCM transformer. AESGCM *AESConfiguration // aescbc is the configuration for the AES-CBC transformer. AESCBC *AESConfiguration // secretbox is the configuration for the Secretbox based transformer. Secretbox *SecretboxConfiguration // identity is the (empty) configuration for the identity transformer. Identity *IdentityConfiguration // kms contains the name, cache size and path to configuration file for a KMS based envelope transformer. KMS *KMSConfiguration }
ProviderConfiguration stores the provided configuration for an encryption provider.
func (*ProviderConfiguration) DeepCopy ¶ added in v0.30.0
func (in *ProviderConfiguration) DeepCopy() *ProviderConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfiguration.
func (*ProviderConfiguration) DeepCopyInto ¶ added in v0.30.0
func (in *ProviderConfiguration) DeepCopyInto(out *ProviderConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ResourceConfiguration ¶ added in v0.30.0
type ResourceConfiguration struct { // resources is a list of kubernetes resources which have to be encrypted. The resource names are derived from `resource` or `resource.group` of the group/version/resource. // eg: pandas.awesome.bears.example is a custom resource with 'group': awesome.bears.example, 'resource': pandas. // Use '*.*' to encrypt all resources and '*.<group>' to encrypt all resources in a specific group. // eg: '*.awesome.bears.example' will encrypt all resources in the group 'awesome.bears.example'. // eg: '*.' will encrypt all resources in the core group (such as pods, configmaps, etc). Resources []string // providers is a list of transformers to be used for reading and writing the resources to disk. // eg: aesgcm, aescbc, secretbox, identity, kms. Providers []ProviderConfiguration }
ResourceConfiguration stores per resource configuration.
func (*ResourceConfiguration) DeepCopy ¶ added in v0.30.0
func (in *ResourceConfiguration) DeepCopy() *ResourceConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceConfiguration.
func (*ResourceConfiguration) DeepCopyInto ¶ added in v0.30.0
func (in *ResourceConfiguration) DeepCopyInto(out *ResourceConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SecretboxConfiguration ¶ added in v0.30.0
type SecretboxConfiguration struct { // keys is a list of keys to be used for creating the Secretbox transformer. // Each key has to be 32 bytes long. Keys []Key }
SecretboxConfiguration contains the API configuration for an Secretbox transformer.
func (*SecretboxConfiguration) DeepCopy ¶ added in v0.30.0
func (in *SecretboxConfiguration) DeepCopy() *SecretboxConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretboxConfiguration.
func (*SecretboxConfiguration) DeepCopyInto ¶ added in v0.30.0
func (in *SecretboxConfiguration) DeepCopyInto(out *SecretboxConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type TCPTransport ¶ added in v0.18.0
type TCPTransport struct { // URL is the location of the konnectivity server to connect to. // As an example it might be "https://127.0.0.1:8131" URL string // TLSConfig is the config needed to use TLS when connecting to konnectivity server // +optional TLSConfig *TLSConfig }
TCPTransport provides the information to connect to konnectivity server via TCP
func (*TCPTransport) DeepCopy ¶ added in v0.18.0
func (in *TCPTransport) DeepCopy() *TCPTransport
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPTransport.
func (*TCPTransport) DeepCopyInto ¶ added in v0.18.0
func (in *TCPTransport) DeepCopyInto(out *TCPTransport)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type TLSConfig ¶ added in v0.18.0
type TLSConfig struct { // caBundle is the file location of the CA to be used to determine trust with the konnectivity server. // Must be absent/empty if TCPTransport.URL is prefixed with http:// // If absent while TCPTransport.URL is prefixed with https://, default to system trust roots. // +optional CABundle string // clientKey is the file location of the client key to authenticate with the konnectivity server // Must be absent/empty if TCPTransport.URL is prefixed with http:// // Must be configured if TCPTransport.URL is prefixed with https:// // +optional ClientKey string // clientCert is the file location of the client certificate to authenticate with the konnectivity server // Must be absent/empty if TCPTransport.URL is prefixed with http:// // Must be configured if TCPTransport.URL is prefixed with https:// // +optional ClientCert string }
TLSConfig provides the authentication information to connect to konnectivity server Only used with TCPTransport
func (*TLSConfig) DeepCopy ¶ added in v0.18.0
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
func (*TLSConfig) DeepCopyInto ¶ added in v0.18.0
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type TracingConfiguration ¶ added in v0.22.0
type TracingConfiguration struct { metav1.TypeMeta // Embed the component config tracing configuration struct tracingapi.TracingConfiguration }
TracingConfiguration provides versioned configuration for tracing clients.
func (*TracingConfiguration) DeepCopy ¶ added in v0.22.0
func (in *TracingConfiguration) DeepCopy() *TracingConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TracingConfiguration.
func (*TracingConfiguration) DeepCopyInto ¶ added in v0.22.0
func (in *TracingConfiguration) DeepCopyInto(out *TracingConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*TracingConfiguration) DeepCopyObject ¶ added in v0.22.0
func (in *TracingConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type Transport ¶ added in v0.18.0
type Transport struct { // TCP is the TCP configuration for communicating with the konnectivity server via TCP // ProxyProtocol of GRPC is not supported with TCP transport at the moment // Requires at least one of TCP or UDS to be set // +optional TCP *TCPTransport // UDS is the UDS configuration for communicating with the konnectivity server via UDS // Requires at least one of TCP or UDS to be set // +optional UDS *UDSTransport }
Transport defines the transport configurations we use to dial to the konnectivity server
func (*Transport) DeepCopy ¶ added in v0.18.0
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Transport.
func (*Transport) DeepCopyInto ¶ added in v0.18.0
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type UDSTransport ¶ added in v0.18.0
type UDSTransport struct { // UDSName is the name of the unix domain socket to connect to konnectivity server // This does not use a unix:// prefix. (Eg: /etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket) UDSName string }
UDSTransport provides the information to connect to konnectivity server via UDS
func (*UDSTransport) DeepCopy ¶ added in v0.18.0
func (in *UDSTransport) DeepCopy() *UDSTransport
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UDSTransport.
func (*UDSTransport) DeepCopyInto ¶ added in v0.18.0
func (in *UDSTransport) DeepCopyInto(out *UDSTransport)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type UserValidationRule ¶ added in v0.29.0
UserValidationRule provides the configuration for a single user validation rule.
func (*UserValidationRule) DeepCopy ¶ added in v0.29.0
func (in *UserValidationRule) DeepCopy() *UserValidationRule
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserValidationRule.
func (*UserValidationRule) DeepCopyInto ¶ added in v0.29.0
func (in *UserValidationRule) DeepCopyInto(out *UserValidationRule)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type WebhookConfiguration ¶ added in v0.29.0
type WebhookConfiguration struct { // The duration to cache 'authorized' responses from the webhook // authorizer. // Same as setting `--authorization-webhook-cache-authorized-ttl` flag // Default: 5m0s AuthorizedTTL metav1.Duration // authorizer. // Same as setting `--authorization-webhook-cache-unauthorized-ttl` flag // Default: 30s UnauthorizedTTL metav1.Duration // Timeout for the webhook request // Maximum allowed value is 30s. // Required, no default value. Timeout metav1.Duration // The API version of the authorization.k8s.io SubjectAccessReview to // send to and expect from the webhook. // Same as setting `--authorization-webhook-version` flag // Valid values: v1beta1, v1 // Required, no default value SubjectAccessReviewVersion string // MatchConditionSubjectAccessReviewVersion specifies the SubjectAccessReview // version the CEL expressions are evaluated against // Valid values: v1 // Required, no default value MatchConditionSubjectAccessReviewVersion string // Controls the authorization decision when a webhook request fails to // complete or returns a malformed response or errors evaluating // matchConditions. // Valid values: // - NoOpinion: continue to subsequent authorizers to see if one of // them allows the request // - Deny: reject the request without consulting subsequent authorizers // Required, with no default. FailurePolicy string // ConnectionInfo defines how we talk to the webhook ConnectionInfo WebhookConnectionInfo // matchConditions is a list of conditions that must be met for a request to be sent to this // webhook. An empty list of matchConditions matches all requests. // There are a maximum of 64 match conditions allowed. // // The exact matching logic is (in order): // 1. If at least one matchCondition evaluates to FALSE, then the webhook is skipped. // 2. If ALL matchConditions evaluate to TRUE, then the webhook is called. // 3. If at least one matchCondition evaluates to an error (but none are FALSE): // - If failurePolicy=Deny, then the webhook rejects the request // - If failurePolicy=NoOpinion, then the error is ignored and the webhook is skipped MatchConditions []WebhookMatchCondition }
func (*WebhookConfiguration) DeepCopy ¶ added in v0.29.0
func (in *WebhookConfiguration) DeepCopy() *WebhookConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookConfiguration.
func (*WebhookConfiguration) DeepCopyInto ¶ added in v0.29.0
func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type WebhookConnectionInfo ¶ added in v0.29.0
type WebhookConnectionInfo struct { // Controls how the webhook should communicate with the server. // Valid values: // - KubeConfigFile: use the file specified in kubeConfigFile to locate the // server. // - InClusterConfig: use the in-cluster configuration to call the // SubjectAccessReview API hosted by kube-apiserver. This mode is not // allowed for kube-apiserver. Type string // Path to KubeConfigFile for connection info // Required, if connectionInfo.Type is KubeConfig KubeConfigFile *string }
func (*WebhookConnectionInfo) DeepCopy ¶ added in v0.29.0
func (in *WebhookConnectionInfo) DeepCopy() *WebhookConnectionInfo
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookConnectionInfo.
func (*WebhookConnectionInfo) DeepCopyInto ¶ added in v0.29.0
func (in *WebhookConnectionInfo) DeepCopyInto(out *WebhookConnectionInfo)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type WebhookMatchCondition ¶ added in v0.29.0
type WebhookMatchCondition struct { // expression represents the expression which will be evaluated by CEL. Must evaluate to bool. // CEL expressions have access to the contents of the SubjectAccessReview in v1 version. // If version specified by subjectAccessReviewVersion in the request variable is v1beta1, // the contents would be converted to the v1 version before evaluating the CEL expression. // // - 'resourceAttributes' describes information for a resource access request and is unset for non-resource requests. e.g. has(request.resourceAttributes) && request.resourceAttributes.namespace == 'default' // - 'nonResourceAttributes' describes information for a non-resource access request and is unset for resource requests. e.g. has(request.nonResourceAttributes) && request.nonResourceAttributes.path == '/healthz'. // - 'user' is the user to test for. e.g. request.user == 'alice' // - 'groups' is the groups to test for. e.g. ('group1' in request.groups) // - 'extra' corresponds to the user.Info.GetExtra() method from the authenticator. // - 'uid' is the information about the requesting user. e.g. request.uid == '1' // // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ Expression string }
func (*WebhookMatchCondition) DeepCopy ¶ added in v0.29.0
func (in *WebhookMatchCondition) DeepCopy() *WebhookMatchCondition
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookMatchCondition.
func (*WebhookMatchCondition) DeepCopyInto ¶ added in v0.29.0
func (in *WebhookMatchCondition) DeepCopyInto(out *WebhookMatchCondition)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
Source Files ¶
Directories ¶
Path | Synopsis |
---|---|
Package v1 is the v1 version of the API.
|
Package v1 is the v1 version of the API. |
Package v1alpha1 is the v1alpha1 version of the API.
|
Package v1alpha1 is the v1alpha1 version of the API. |
Package v1beta1 is the v1beta1 version of the API.
|
Package v1beta1 is the v1beta1 version of the API. |
Package validation validates EncryptionConfiguration.
|
Package validation validates EncryptionConfiguration. |