v1

package
v0.32.0-rc.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 3, 2024 License: Apache-2.0 Imports: 8 Imported by: 45

Documentation

Overview

Package v1 is the v1 version of the API.

Index

Constants

View Source 
const (
	TypeWebhook                                          AuthorizerType = "Webhook"
	FailurePolicyNoOpinion                               string         = "NoOpinion"
	FailurePolicyDeny                                    string         = "Deny"
	AuthorizationWebhookConnectionInfoTypeKubeConfigFile string         = "KubeConfigFile"
	AuthorizationWebhookConnectionInfoTypeInCluster      string         = "InClusterConfig"
)
View Source 
const GroupName = "apiserver.config.k8s.io"

Variables

View Source 
var (
	// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
	SchemeBuilder runtime.SchemeBuilder

	AddToScheme = localSchemeBuilder.AddToScheme
)
View Source 
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}

SchemeGroupVersion is group version used to register these objects

Functions

func Convert_apiserver_AESConfiguration_To_v1_AESConfiguration added in v0.30.0 

func Convert_apiserver_AESConfiguration_To_v1_AESConfiguration(in *apiserver.AESConfiguration, out *AESConfiguration, s conversion.Scope) error

Convert_apiserver_AESConfiguration_To_v1_AESConfiguration is an autogenerated conversion function.

func Convert_apiserver_AdmissionConfiguration_To_v1_AdmissionConfiguration 

func Convert_apiserver_AdmissionConfiguration_To_v1_AdmissionConfiguration(in *apiserver.AdmissionConfiguration, out *AdmissionConfiguration, s conversion.Scope) error

Convert_apiserver_AdmissionConfiguration_To_v1_AdmissionConfiguration is an autogenerated conversion function.

func Convert_apiserver_AdmissionPluginConfiguration_To_v1_AdmissionPluginConfiguration 

func Convert_apiserver_AdmissionPluginConfiguration_To_v1_AdmissionPluginConfiguration(in *apiserver.AdmissionPluginConfiguration, out *AdmissionPluginConfiguration, s conversion.Scope) error

Convert_apiserver_AdmissionPluginConfiguration_To_v1_AdmissionPluginConfiguration is an autogenerated conversion function.

func Convert_apiserver_AuthorizationConfiguration_To_v1_AuthorizationConfiguration added in v0.32.0 

func Convert_apiserver_AuthorizationConfiguration_To_v1_AuthorizationConfiguration(in *apiserver.AuthorizationConfiguration, out *AuthorizationConfiguration, s conversion.Scope) error

Convert_apiserver_AuthorizationConfiguration_To_v1_AuthorizationConfiguration is an autogenerated conversion function.

func Convert_apiserver_AuthorizerConfiguration_To_v1_AuthorizerConfiguration added in v0.32.0 

func Convert_apiserver_AuthorizerConfiguration_To_v1_AuthorizerConfiguration(in *apiserver.AuthorizerConfiguration, out *AuthorizerConfiguration, s conversion.Scope) error

Convert_apiserver_AuthorizerConfiguration_To_v1_AuthorizerConfiguration is an autogenerated conversion function.

func Convert_apiserver_EncryptionConfiguration_To_v1_EncryptionConfiguration added in v0.30.0 

func Convert_apiserver_EncryptionConfiguration_To_v1_EncryptionConfiguration(in *apiserver.EncryptionConfiguration, out *EncryptionConfiguration, s conversion.Scope) error

Convert_apiserver_EncryptionConfiguration_To_v1_EncryptionConfiguration is an autogenerated conversion function.

func Convert_apiserver_IdentityConfiguration_To_v1_IdentityConfiguration added in v0.30.0 

func Convert_apiserver_IdentityConfiguration_To_v1_IdentityConfiguration(in *apiserver.IdentityConfiguration, out *IdentityConfiguration, s conversion.Scope) error

Convert_apiserver_IdentityConfiguration_To_v1_IdentityConfiguration is an autogenerated conversion function.

func Convert_apiserver_KMSConfiguration_To_v1_KMSConfiguration added in v0.30.0 

func Convert_apiserver_KMSConfiguration_To_v1_KMSConfiguration(in *apiserver.KMSConfiguration, out *KMSConfiguration, s conversion.Scope) error

Convert_apiserver_KMSConfiguration_To_v1_KMSConfiguration is an autogenerated conversion function.

func Convert_apiserver_Key_To_v1_Key added in v0.30.0 

func Convert_apiserver_Key_To_v1_Key(in *apiserver.Key, out *Key, s conversion.Scope) error

Convert_apiserver_Key_To_v1_Key is an autogenerated conversion function.

func Convert_apiserver_ProviderConfiguration_To_v1_ProviderConfiguration added in v0.30.0 

func Convert_apiserver_ProviderConfiguration_To_v1_ProviderConfiguration(in *apiserver.ProviderConfiguration, out *ProviderConfiguration, s conversion.Scope) error

Convert_apiserver_ProviderConfiguration_To_v1_ProviderConfiguration is an autogenerated conversion function.

func Convert_apiserver_ResourceConfiguration_To_v1_ResourceConfiguration added in v0.30.0 

func Convert_apiserver_ResourceConfiguration_To_v1_ResourceConfiguration(in *apiserver.ResourceConfiguration, out *ResourceConfiguration, s conversion.Scope) error

Convert_apiserver_ResourceConfiguration_To_v1_ResourceConfiguration is an autogenerated conversion function.

func Convert_apiserver_SecretboxConfiguration_To_v1_SecretboxConfiguration added in v0.30.0 

func Convert_apiserver_SecretboxConfiguration_To_v1_SecretboxConfiguration(in *apiserver.SecretboxConfiguration, out *SecretboxConfiguration, s conversion.Scope) error

Convert_apiserver_SecretboxConfiguration_To_v1_SecretboxConfiguration is an autogenerated conversion function.

func Convert_apiserver_WebhookConfiguration_To_v1_WebhookConfiguration added in v0.32.0 

func Convert_apiserver_WebhookConfiguration_To_v1_WebhookConfiguration(in *apiserver.WebhookConfiguration, out *WebhookConfiguration, s conversion.Scope) error

Convert_apiserver_WebhookConfiguration_To_v1_WebhookConfiguration is an autogenerated conversion function.

func Convert_apiserver_WebhookConnectionInfo_To_v1_WebhookConnectionInfo added in v0.32.0 

func Convert_apiserver_WebhookConnectionInfo_To_v1_WebhookConnectionInfo(in *apiserver.WebhookConnectionInfo, out *WebhookConnectionInfo, s conversion.Scope) error

Convert_apiserver_WebhookConnectionInfo_To_v1_WebhookConnectionInfo is an autogenerated conversion function.

func Convert_apiserver_WebhookMatchCondition_To_v1_WebhookMatchCondition added in v0.32.0 

func Convert_apiserver_WebhookMatchCondition_To_v1_WebhookMatchCondition(in *apiserver.WebhookMatchCondition, out *WebhookMatchCondition, s conversion.Scope) error

Convert_apiserver_WebhookMatchCondition_To_v1_WebhookMatchCondition is an autogenerated conversion function.

func Convert_v1_AESConfiguration_To_apiserver_AESConfiguration added in v0.30.0 

func Convert_v1_AESConfiguration_To_apiserver_AESConfiguration(in *AESConfiguration, out *apiserver.AESConfiguration, s conversion.Scope) error

Convert_v1_AESConfiguration_To_apiserver_AESConfiguration is an autogenerated conversion function.

func Convert_v1_AdmissionConfiguration_To_apiserver_AdmissionConfiguration 

func Convert_v1_AdmissionConfiguration_To_apiserver_AdmissionConfiguration(in *AdmissionConfiguration, out *apiserver.AdmissionConfiguration, s conversion.Scope) error

Convert_v1_AdmissionConfiguration_To_apiserver_AdmissionConfiguration is an autogenerated conversion function.

func Convert_v1_AdmissionPluginConfiguration_To_apiserver_AdmissionPluginConfiguration 

func Convert_v1_AdmissionPluginConfiguration_To_apiserver_AdmissionPluginConfiguration(in *AdmissionPluginConfiguration, out *apiserver.AdmissionPluginConfiguration, s conversion.Scope) error

Convert_v1_AdmissionPluginConfiguration_To_apiserver_AdmissionPluginConfiguration is an autogenerated conversion function.

func Convert_v1_AuthorizationConfiguration_To_apiserver_AuthorizationConfiguration added in v0.32.0 

func Convert_v1_AuthorizationConfiguration_To_apiserver_AuthorizationConfiguration(in *AuthorizationConfiguration, out *apiserver.AuthorizationConfiguration, s conversion.Scope) error

Convert_v1_AuthorizationConfiguration_To_apiserver_AuthorizationConfiguration is an autogenerated conversion function.

func Convert_v1_AuthorizerConfiguration_To_apiserver_AuthorizerConfiguration added in v0.32.0 

func Convert_v1_AuthorizerConfiguration_To_apiserver_AuthorizerConfiguration(in *AuthorizerConfiguration, out *apiserver.AuthorizerConfiguration, s conversion.Scope) error

Convert_v1_AuthorizerConfiguration_To_apiserver_AuthorizerConfiguration is an autogenerated conversion function.

func Convert_v1_EncryptionConfiguration_To_apiserver_EncryptionConfiguration added in v0.30.0 

func Convert_v1_EncryptionConfiguration_To_apiserver_EncryptionConfiguration(in *EncryptionConfiguration, out *apiserver.EncryptionConfiguration, s conversion.Scope) error

Convert_v1_EncryptionConfiguration_To_apiserver_EncryptionConfiguration is an autogenerated conversion function.

func Convert_v1_IdentityConfiguration_To_apiserver_IdentityConfiguration added in v0.30.0 

func Convert_v1_IdentityConfiguration_To_apiserver_IdentityConfiguration(in *IdentityConfiguration, out *apiserver.IdentityConfiguration, s conversion.Scope) error

Convert_v1_IdentityConfiguration_To_apiserver_IdentityConfiguration is an autogenerated conversion function.

func Convert_v1_KMSConfiguration_To_apiserver_KMSConfiguration added in v0.30.0 

func Convert_v1_KMSConfiguration_To_apiserver_KMSConfiguration(in *KMSConfiguration, out *apiserver.KMSConfiguration, s conversion.Scope) error

Convert_v1_KMSConfiguration_To_apiserver_KMSConfiguration is an autogenerated conversion function.

func Convert_v1_Key_To_apiserver_Key added in v0.30.0 

func Convert_v1_Key_To_apiserver_Key(in *Key, out *apiserver.Key, s conversion.Scope) error

Convert_v1_Key_To_apiserver_Key is an autogenerated conversion function.

func Convert_v1_ProviderConfiguration_To_apiserver_ProviderConfiguration added in v0.30.0 

func Convert_v1_ProviderConfiguration_To_apiserver_ProviderConfiguration(in *ProviderConfiguration, out *apiserver.ProviderConfiguration, s conversion.Scope) error

Convert_v1_ProviderConfiguration_To_apiserver_ProviderConfiguration is an autogenerated conversion function.

func Convert_v1_ResourceConfiguration_To_apiserver_ResourceConfiguration added in v0.30.0 

func Convert_v1_ResourceConfiguration_To_apiserver_ResourceConfiguration(in *ResourceConfiguration, out *apiserver.ResourceConfiguration, s conversion.Scope) error

Convert_v1_ResourceConfiguration_To_apiserver_ResourceConfiguration is an autogenerated conversion function.

func Convert_v1_SecretboxConfiguration_To_apiserver_SecretboxConfiguration added in v0.30.0 

func Convert_v1_SecretboxConfiguration_To_apiserver_SecretboxConfiguration(in *SecretboxConfiguration, out *apiserver.SecretboxConfiguration, s conversion.Scope) error

Convert_v1_SecretboxConfiguration_To_apiserver_SecretboxConfiguration is an autogenerated conversion function.

func Convert_v1_WebhookConfiguration_To_apiserver_WebhookConfiguration added in v0.32.0 

func Convert_v1_WebhookConfiguration_To_apiserver_WebhookConfiguration(in *WebhookConfiguration, out *apiserver.WebhookConfiguration, s conversion.Scope) error

Convert_v1_WebhookConfiguration_To_apiserver_WebhookConfiguration is an autogenerated conversion function.

func Convert_v1_WebhookConnectionInfo_To_apiserver_WebhookConnectionInfo added in v0.32.0 

func Convert_v1_WebhookConnectionInfo_To_apiserver_WebhookConnectionInfo(in *WebhookConnectionInfo, out *apiserver.WebhookConnectionInfo, s conversion.Scope) error

Convert_v1_WebhookConnectionInfo_To_apiserver_WebhookConnectionInfo is an autogenerated conversion function.

func Convert_v1_WebhookMatchCondition_To_apiserver_WebhookMatchCondition added in v0.32.0 

func Convert_v1_WebhookMatchCondition_To_apiserver_WebhookMatchCondition(in *WebhookMatchCondition, out *apiserver.WebhookMatchCondition, s conversion.Scope) error

Convert_v1_WebhookMatchCondition_To_apiserver_WebhookMatchCondition is an autogenerated conversion function.

func RegisterConversions 

func RegisterConversions(s *runtime.Scheme) error

RegisterConversions adds conversion functions to the given scheme. Public to allow building arbitrary schemes.

func RegisterDefaults 

func RegisterDefaults(scheme *runtime.Scheme) error

RegisterDefaults adds defaulters functions to the given scheme. Public to allow building arbitrary schemes. All generated defaulters are covering - they call all nested defaulters.

func SetDefaults_KMSConfiguration added in v0.30.0 

func SetDefaults_KMSConfiguration(obj *KMSConfiguration)

SetDefaults_KMSConfiguration applies defaults to KMSConfiguration.

func SetDefaults_WebhookConfiguration added in v0.32.0 

func SetDefaults_WebhookConfiguration(obj *WebhookConfiguration)

func SetObjectDefaults_AuthorizationConfiguration added in v0.32.0 

func SetObjectDefaults_AuthorizationConfiguration(in *AuthorizationConfiguration)

func SetObjectDefaults_EncryptionConfiguration added in v0.30.0 

func SetObjectDefaults_EncryptionConfiguration(in *EncryptionConfiguration)

Types

type AESConfiguration added in v0.30.0 

type AESConfiguration struct {
	// keys is a list of keys to be used for creating the AES transformer.
	// Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.
	Keys []Key `json:"keys"`
}

AESConfiguration contains the API configuration for an AES transformer.

func (*AESConfiguration) DeepCopy added in v0.30.0 

func (in *AESConfiguration) DeepCopy() *AESConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AESConfiguration.

func (*AESConfiguration) DeepCopyInto added in v0.30.0 

func (in *AESConfiguration) DeepCopyInto(out *AESConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AdmissionConfiguration 

type AdmissionConfiguration struct {
	metav1.TypeMeta `json:",inline"`

	// Plugins allows specifying a configuration per admission control plugin.
	// +optional
	Plugins []AdmissionPluginConfiguration `json:"plugins"`
}

AdmissionConfiguration provides versioned configuration for admission controllers.

func (*AdmissionConfiguration) DeepCopy 

func (in *AdmissionConfiguration) DeepCopy() *AdmissionConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionConfiguration.

func (*AdmissionConfiguration) DeepCopyInto 

func (in *AdmissionConfiguration) DeepCopyInto(out *AdmissionConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AdmissionConfiguration) DeepCopyObject 

func (in *AdmissionConfiguration) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type AdmissionPluginConfiguration 

type AdmissionPluginConfiguration struct {
	// Name is the name of the admission controller.
	// It must match the registered admission plugin name.
	Name string `json:"name"`

	// Path is the path to a configuration file that contains the plugin's
	// configuration
	// +optional
	Path string `json:"path"`

	// Configuration is an embedded configuration object to be used as the plugin's
	// configuration. If present, it will be used instead of the path to the configuration file.
	// +optional
	Configuration *runtime.Unknown `json:"configuration"`
}

AdmissionPluginConfiguration provides the configuration for a single plug-in.

func (*AdmissionPluginConfiguration) DeepCopy 

func (in *AdmissionPluginConfiguration) DeepCopy() *AdmissionPluginConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionPluginConfiguration.

func (*AdmissionPluginConfiguration) DeepCopyInto 

func (in *AdmissionPluginConfiguration) DeepCopyInto(out *AdmissionPluginConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AuthorizationConfiguration added in v0.32.0 

type AuthorizationConfiguration struct {
	metav1.TypeMeta

	// Authorizers is an ordered list of authorizers to
	// authorize requests against.
	// This is similar to the --authorization-modes kube-apiserver flag
	// Must be at least one.
	Authorizers []AuthorizerConfiguration `json:"authorizers"`
}

func (*AuthorizationConfiguration) DeepCopy added in v0.32.0 

func (in *AuthorizationConfiguration) DeepCopy() *AuthorizationConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationConfiguration.

func (*AuthorizationConfiguration) DeepCopyInto added in v0.32.0 

func (in *AuthorizationConfiguration) DeepCopyInto(out *AuthorizationConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AuthorizationConfiguration) DeepCopyObject added in v0.32.0 

func (in *AuthorizationConfiguration) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type AuthorizerConfiguration added in v0.32.0 

type AuthorizerConfiguration struct {
	// Type refers to the type of the authorizer
	// "Webhook" is supported in the generic API server
	// Other API servers may support additional authorizer
	// types like Node, RBAC, ABAC, etc.
	Type string `json:"type"`

	// Name used to describe the webhook
	// This is explicitly used in monitoring machinery for metrics
	// Note: Names must be DNS1123 labels like `myauthorizername` or
	//		 subdomains like `myauthorizer.example.domain`
	// Required, with no default
	Name string `json:"name"`

	// Webhook defines the configuration for a Webhook authorizer
	// Must be defined when Type=Webhook
	// Must not be defined when Type!=Webhook
	Webhook *WebhookConfiguration `json:"webhook,omitempty"`
}

func (*AuthorizerConfiguration) DeepCopy added in v0.32.0 

func (in *AuthorizerConfiguration) DeepCopy() *AuthorizerConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizerConfiguration.

func (*AuthorizerConfiguration) DeepCopyInto added in v0.32.0 

func (in *AuthorizerConfiguration) DeepCopyInto(out *AuthorizerConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AuthorizerType added in v0.32.0 

type AuthorizerType string

type EncryptionConfiguration added in v0.30.0 

type EncryptionConfiguration struct {
	metav1.TypeMeta
	// resources is a list containing resources, and their corresponding encryption providers.
	Resources []ResourceConfiguration `json:"resources"`
}

EncryptionConfiguration stores the complete configuration for encryption providers. It also allows the use of wildcards to specify the resources that should be encrypted. Use '*.<group>' to encrypt all resources within a group or '*.*' to encrypt all resources. '*.' can be used to encrypt all resource in the core group. '*.*' will encrypt all resources, even custom resources that are added after API server start. Use of wildcards that overlap within the same resource list or across multiple entries are not allowed since part of the configuration would be ineffective. Resource lists are processed in order, with earlier lists taking precedence.

Example: 

kind: EncryptionConfiguration
apiVersion: apiserver.config.k8s.io/v1
resources:
- resources:
  - events
  providers:
  - identity: {}  # do not encrypt events even though *.* is specified below
- resources:
  - secrets
  - configmaps
  - pandas.awesome.bears.example
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: c2VjcmV0IGlzIHNlY3VyZQ==
- resources:
  - '*.apps'
  providers:
  - aescbc:
      keys:
      - name: key2
        secret: c2VjcmV0IGlzIHNlY3VyZSwgb3IgaXMgaXQ/Cg==
- resources:
  - '*.*'
  providers:
  - aescbc:
      keys:
      - name: key3
        secret: c2VjcmV0IGlzIHNlY3VyZSwgSSB0aGluaw==

func (*EncryptionConfiguration) DeepCopy added in v0.30.0 

func (in *EncryptionConfiguration) DeepCopy() *EncryptionConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionConfiguration.

func (*EncryptionConfiguration) DeepCopyInto added in v0.30.0 

func (in *EncryptionConfiguration) DeepCopyInto(out *EncryptionConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EncryptionConfiguration) DeepCopyObject added in v0.30.0 

func (in *EncryptionConfiguration) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type IdentityConfiguration added in v0.30.0 

type IdentityConfiguration struct{}

IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.

func (*IdentityConfiguration) DeepCopy added in v0.30.0 

func (in *IdentityConfiguration) DeepCopy() *IdentityConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IdentityConfiguration.

func (*IdentityConfiguration) DeepCopyInto added in v0.30.0 

func (in *IdentityConfiguration) DeepCopyInto(out *IdentityConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type KMSConfiguration added in v0.30.0 

type KMSConfiguration struct {
	// apiVersion of KeyManagementService
	// +optional
	APIVersion string `json:"apiVersion"`
	// name is the name of the KMS plugin to be used.
	Name string `json:"name"`
	// cachesize is the maximum number of secrets which are cached in memory. The default value is 1000.
	// Set to a negative value to disable caching. This field is only allowed for KMS v1 providers.
	// +optional
	CacheSize *int32 `json:"cachesize,omitempty"`
	// endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".
	Endpoint string `json:"endpoint"`
	// timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.
	// +optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`
}

KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.

func (*KMSConfiguration) DeepCopy added in v0.30.0 

func (in *KMSConfiguration) DeepCopy() *KMSConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSConfiguration.

func (*KMSConfiguration) DeepCopyInto added in v0.30.0 

func (in *KMSConfiguration) DeepCopyInto(out *KMSConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Key added in v0.30.0 

type Key struct {
	// name is the name of the key to be used while storing data to disk.
	Name string `json:"name"`
	// secret is the actual key, encoded in base64.
	Secret string `json:"secret"`
}

Key contains name and secret of the provided key for a transformer.

func (*Key) DeepCopy added in v0.30.0 

func (in *Key) DeepCopy() *Key

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Key.

func (*Key) DeepCopyInto added in v0.30.0 

func (in *Key) DeepCopyInto(out *Key)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (Key) String added in v0.30.0 

func (k Key) String() string

String implements Stringer interface in a log safe way.

type ProviderConfiguration added in v0.30.0 

type ProviderConfiguration struct {
	// aesgcm is the configuration for the AES-GCM transformer.
	AESGCM *AESConfiguration `json:"aesgcm,omitempty"`
	// aescbc is the configuration for the AES-CBC transformer.
	AESCBC *AESConfiguration `json:"aescbc,omitempty"`
	// secretbox is the configuration for the Secretbox based transformer.
	Secretbox *SecretboxConfiguration `json:"secretbox,omitempty"`
	// identity is the (empty) configuration for the identity transformer.
	Identity *IdentityConfiguration `json:"identity,omitempty"`
	// kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.
	KMS *KMSConfiguration `json:"kms,omitempty"`
}

ProviderConfiguration stores the provided configuration for an encryption provider.

func (*ProviderConfiguration) DeepCopy added in v0.30.0 

func (in *ProviderConfiguration) DeepCopy() *ProviderConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfiguration.

func (*ProviderConfiguration) DeepCopyInto added in v0.30.0 

func (in *ProviderConfiguration) DeepCopyInto(out *ProviderConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ResourceConfiguration added in v0.30.0 

type ResourceConfiguration struct {
	// resources is a list of kubernetes resources which have to be encrypted. The resource names are derived from `resource` or `resource.group` of the group/version/resource.
	// eg: pandas.awesome.bears.example is a custom resource with 'group': awesome.bears.example, 'resource': pandas.
	// Use '*.*' to encrypt all resources and '*.<group>' to encrypt all resources in a specific group.
	// eg: '*.awesome.bears.example' will encrypt all resources in the group 'awesome.bears.example'.
	// eg: '*.' will encrypt all resources in the core group (such as pods, configmaps, etc).
	Resources []string `json:"resources"`
	// providers is a list of transformers to be used for reading and writing the resources to disk.
	// eg: aesgcm, aescbc, secretbox, identity, kms.
	Providers []ProviderConfiguration `json:"providers"`
}

ResourceConfiguration stores per resource configuration.

func (*ResourceConfiguration) DeepCopy added in v0.30.0 

func (in *ResourceConfiguration) DeepCopy() *ResourceConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceConfiguration.

func (*ResourceConfiguration) DeepCopyInto added in v0.30.0 

func (in *ResourceConfiguration) DeepCopyInto(out *ResourceConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SecretboxConfiguration added in v0.30.0 

type SecretboxConfiguration struct {
	// keys is a list of keys to be used for creating the Secretbox transformer.
	// Each key has to be 32 bytes long.
	Keys []Key `json:"keys"`
}

SecretboxConfiguration contains the API configuration for an Secretbox transformer.

func (*SecretboxConfiguration) DeepCopy added in v0.30.0 

func (in *SecretboxConfiguration) DeepCopy() *SecretboxConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretboxConfiguration.

func (*SecretboxConfiguration) DeepCopyInto added in v0.30.0 

func (in *SecretboxConfiguration) DeepCopyInto(out *SecretboxConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type WebhookConfiguration added in v0.32.0 

type WebhookConfiguration struct {
	// The duration to cache 'authorized' responses from the webhook
	// authorizer.
	// Same as setting `--authorization-webhook-cache-authorized-ttl` flag
	// Default: 5m0s
	AuthorizedTTL metav1.Duration `json:"authorizedTTL"`
	// The duration to cache 'unauthorized' responses from the webhook
	// authorizer.
	// Same as setting `--authorization-webhook-cache-unauthorized-ttl` flag
	// Default: 30s
	UnauthorizedTTL metav1.Duration `json:"unauthorizedTTL"`
	// Timeout for the webhook request
	// Maximum allowed value is 30s.
	// Required, no default value.
	Timeout metav1.Duration `json:"timeout"`
	// The API version of the authorization.k8s.io SubjectAccessReview to
	// send to and expect from the webhook.
	// Same as setting `--authorization-webhook-version` flag
	// Valid values: v1beta1, v1
	// Required, no default value
	SubjectAccessReviewVersion string `json:"subjectAccessReviewVersion"`
	// MatchConditionSubjectAccessReviewVersion specifies the SubjectAccessReview
	// version the CEL expressions are evaluated against
	// Valid values: v1
	// Required, no default value
	MatchConditionSubjectAccessReviewVersion string `json:"matchConditionSubjectAccessReviewVersion"`
	// Controls the authorization decision when a webhook request fails to
	// complete or returns a malformed response or errors evaluating
	// matchConditions.
	// Valid values:
	//   - NoOpinion: continue to subsequent authorizers to see if one of
	//     them allows the request
	//   - Deny: reject the request without consulting subsequent authorizers
	// Required, with no default.
	FailurePolicy string `json:"failurePolicy"`

	// ConnectionInfo defines how we talk to the webhook
	ConnectionInfo WebhookConnectionInfo `json:"connectionInfo"`

	// matchConditions is a list of conditions that must be met for a request to be sent to this
	// webhook. An empty list of matchConditions matches all requests.
	// There are a maximum of 64 match conditions allowed.
	//
	// The exact matching logic is (in order):
	//   1. If at least one matchCondition evaluates to FALSE, then the webhook is skipped.
	//   2. If ALL matchConditions evaluate to TRUE, then the webhook is called.
	//   3. If at least one matchCondition evaluates to an error (but none are FALSE):
	//      - If failurePolicy=Deny, then the webhook rejects the request
	//      - If failurePolicy=NoOpinion, then the error is ignored and the webhook is skipped
	MatchConditions []WebhookMatchCondition `json:"matchConditions"`
}

func (*WebhookConfiguration) DeepCopy added in v0.32.0 

func (in *WebhookConfiguration) DeepCopy() *WebhookConfiguration

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookConfiguration.

func (*WebhookConfiguration) DeepCopyInto added in v0.32.0 

func (in *WebhookConfiguration) DeepCopyInto(out *WebhookConfiguration)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type WebhookConnectionInfo added in v0.32.0 

type WebhookConnectionInfo struct {
	// Controls how the webhook should communicate with the server.
	// Valid values:
	// - KubeConfigFile: use the file specified in kubeConfigFile to locate the
	//   server.
	// - InClusterConfig: use the in-cluster configuration to call the
	//   SubjectAccessReview API hosted by kube-apiserver. This mode is not
	//   allowed for kube-apiserver.
	Type string `json:"type"`

	// Path to KubeConfigFile for connection info
	// Required, if connectionInfo.Type is KubeConfig
	KubeConfigFile *string `json:"kubeConfigFile"`
}

func (*WebhookConnectionInfo) DeepCopy added in v0.32.0 

func (in *WebhookConnectionInfo) DeepCopy() *WebhookConnectionInfo

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookConnectionInfo.

func (*WebhookConnectionInfo) DeepCopyInto added in v0.32.0 

func (in *WebhookConnectionInfo) DeepCopyInto(out *WebhookConnectionInfo)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type WebhookMatchCondition added in v0.32.0 

type WebhookMatchCondition struct {
	// expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
	// CEL expressions have access to the contents of the SubjectAccessReview in v1 version.
	// If version specified by subjectAccessReviewVersion in the request variable is v1beta1,
	// the contents would be converted to the v1 version before evaluating the CEL expression.
	//
	// - 'resourceAttributes' describes information for a resource access request and is unset for non-resource requests. e.g. has(request.resourceAttributes) && request.resourceAttributes.namespace == 'default'
	// - 'nonResourceAttributes' describes information for a non-resource access request and is unset for resource requests. e.g. has(request.nonResourceAttributes) && request.nonResourceAttributes.path == '/healthz'.
	// - 'user' is the user to test for. e.g. request.user == 'alice'
	// - 'groups' is the groups to test for. e.g. ('group1' in request.groups)
	// - 'extra' corresponds to the user.Info.GetExtra() method from the authenticator.
	// - 'uid' is the information about the requesting user. e.g. request.uid == '1'
	//
	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
	Expression string `json:"expression"`
}

func (*WebhookMatchCondition) DeepCopy added in v0.32.0 

func (in *WebhookMatchCondition) DeepCopy() *WebhookMatchCondition

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WebhookMatchCondition.

func (*WebhookMatchCondition) DeepCopyInto added in v0.32.0 

func (in *WebhookMatchCondition) DeepCopyInto(out *WebhookMatchCondition)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.