working commit
This commit is contained in:
+25
@@ -0,0 +1,25 @@
|
||||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:protobuf-gen=package
|
||||
// +k8s:openapi-gen=false
|
||||
// +k8s:prerelease-lifecycle-gen=true
|
||||
// +k8s:openapi-model-package=io.k8s.api.admission.v1
|
||||
|
||||
// +groupName=admission.k8s.io
|
||||
|
||||
package v1
|
||||
+1619
File diff suppressed because it is too large
Load Diff
+168
@@ -0,0 +1,168 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
||||
|
||||
syntax = "proto2";
|
||||
|
||||
package k8s.io.api.admission.v1;
|
||||
|
||||
import "k8s.io/api/authentication/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/api/admission/v1";
|
||||
|
||||
// AdmissionRequest describes the admission.Attributes for the admission request.
|
||||
message AdmissionRequest {
|
||||
// uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
optional string uid = 1;
|
||||
|
||||
// kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;
|
||||
|
||||
// resource is the fully-qualified resource being requested (for example, v1.pods)
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;
|
||||
|
||||
// subResource is the subresource being requested, if any (for example, "status" or "scale")
|
||||
// +optional
|
||||
optional string subResource = 4;
|
||||
|
||||
// requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
// If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
// and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind requestKind = 13;
|
||||
|
||||
// requestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
// If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource requestResource = 14;
|
||||
|
||||
// requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
// If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
optional string requestSubResource = 15;
|
||||
|
||||
// name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
// rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
// +optional
|
||||
optional string name = 5;
|
||||
|
||||
// namespace is the namespace associated with the request (if any).
|
||||
// +optional
|
||||
optional string namespace = 6;
|
||||
|
||||
// operation is the operation being performed. This may be different than the operation
|
||||
// requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
optional string operation = 7;
|
||||
|
||||
// userInfo is information about the requesting user
|
||||
optional .k8s.io.api.authentication.v1.UserInfo userInfo = 8;
|
||||
|
||||
// object is the object from the incoming request.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;
|
||||
|
||||
// oldObject is the existing object. Only populated for DELETE and UPDATE requests.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;
|
||||
|
||||
// dryRun indicates that modifications will definitely not be persisted for this request.
|
||||
// Defaults to false.
|
||||
// +optional
|
||||
optional bool dryRun = 11;
|
||||
|
||||
// options is the operation option structure of the operation being performed.
|
||||
// e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
// different than the options the caller provided. e.g. for a patch request the performed
|
||||
// Operation might be a CREATE, in which case the Options will a
|
||||
// `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension options = 12;
|
||||
}
|
||||
|
||||
// AdmissionResponse describes an admission response.
|
||||
message AdmissionResponse {
|
||||
// uid is an identifier for the individual request/response.
|
||||
// This must be copied over from the corresponding AdmissionRequest.
|
||||
optional string uid = 1;
|
||||
|
||||
// allowed indicates whether or not the admission request was permitted.
|
||||
optional bool allowed = 2;
|
||||
|
||||
// status is the result contains extra details into why an admission request was denied.
|
||||
// This field IS NOT consulted in any way if "Allowed" is "true".
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;
|
||||
|
||||
// patch is the patch body. Currently we only support "JSONPatch" which implements RFC 6902.
|
||||
// +optional
|
||||
optional bytes patch = 4;
|
||||
|
||||
// patchType is the type of Patch. Currently we only allow "JSONPatch".
|
||||
// +optional
|
||||
optional string patchType = 5;
|
||||
|
||||
// auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
|
||||
// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
|
||||
// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
|
||||
// the admission webhook to add additional context to the audit log for this request.
|
||||
// +optional
|
||||
map<string, string> auditAnnotations = 6;
|
||||
|
||||
// warnings is a list of warning messages to return to the requesting API client.
|
||||
// Warning messages describe a problem the client making the API request should correct or be aware of.
|
||||
// Limit warnings to 120 characters if possible.
|
||||
// Warnings over 256 characters and large numbers of warnings may be truncated.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string warnings = 7;
|
||||
}
|
||||
|
||||
// AdmissionReview describes an admission review request/response.
|
||||
message AdmissionReview {
|
||||
// request describes the attributes for the admission request.
|
||||
// +optional
|
||||
optional AdmissionRequest request = 1;
|
||||
|
||||
// response describes the attributes for the admission response.
|
||||
// +optional
|
||||
optional AdmissionResponse response = 2;
|
||||
}
|
||||
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
func (*AdmissionRequest) ProtoMessage() {}
|
||||
|
||||
func (*AdmissionResponse) ProtoMessage() {}
|
||||
|
||||
func (*AdmissionReview) ProtoMessage() {}
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name for this API.
|
||||
const GroupName = "admission.k8s.io"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
|
||||
// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
|
||||
var (
|
||||
// SchemeBuilder points to a list of functions added to Scheme.
|
||||
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
// AddToScheme is a common registration function for mapping packaged scoped group & version keys to a scheme.
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
// Adds the list of known types to the given scheme.
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&AdmissionReview{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
}
|
||||
+171
@@ -0,0 +1,171 @@
|
||||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
authenticationv1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
)
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.19
|
||||
|
||||
// AdmissionReview describes an admission review request/response.
|
||||
type AdmissionReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// request describes the attributes for the admission request.
|
||||
// +optional
|
||||
Request *AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`
|
||||
// response describes the attributes for the admission response.
|
||||
// +optional
|
||||
Response *AdmissionResponse `json:"response,omitempty" protobuf:"bytes,2,opt,name=response"`
|
||||
}
|
||||
|
||||
// AdmissionRequest describes the admission.Attributes for the admission request.
|
||||
type AdmissionRequest struct {
|
||||
// uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
|
||||
// kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
Kind metav1.GroupVersionKind `json:"kind" protobuf:"bytes,2,opt,name=kind"`
|
||||
// resource is the fully-qualified resource being requested (for example, v1.pods)
|
||||
Resource metav1.GroupVersionResource `json:"resource" protobuf:"bytes,3,opt,name=resource"`
|
||||
// subResource is the subresource being requested, if any (for example, "status" or "scale")
|
||||
// +optional
|
||||
SubResource string `json:"subResource,omitempty" protobuf:"bytes,4,opt,name=subResource"`
|
||||
|
||||
// requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
// If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
// and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
// +optional
|
||||
RequestKind *metav1.GroupVersionKind `json:"requestKind,omitempty" protobuf:"bytes,13,opt,name=requestKind"`
|
||||
// requestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
// If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
RequestResource *metav1.GroupVersionResource `json:"requestResource,omitempty" protobuf:"bytes,14,opt,name=requestResource"`
|
||||
// requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
// If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
RequestSubResource string `json:"requestSubResource,omitempty" protobuf:"bytes,15,opt,name=requestSubResource"`
|
||||
|
||||
// name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
// rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
// +optional
|
||||
Name string `json:"name,omitempty" protobuf:"bytes,5,opt,name=name"`
|
||||
// namespace is the namespace associated with the request (if any).
|
||||
// +optional
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,6,opt,name=namespace"`
|
||||
// operation is the operation being performed. This may be different than the operation
|
||||
// requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
Operation Operation `json:"operation" protobuf:"bytes,7,opt,name=operation"`
|
||||
// userInfo is information about the requesting user
|
||||
UserInfo authenticationv1.UserInfo `json:"userInfo" protobuf:"bytes,8,opt,name=userInfo"`
|
||||
// object is the object from the incoming request.
|
||||
// +optional
|
||||
Object runtime.RawExtension `json:"object,omitempty" protobuf:"bytes,9,opt,name=object"`
|
||||
// oldObject is the existing object. Only populated for DELETE and UPDATE requests.
|
||||
// +optional
|
||||
OldObject runtime.RawExtension `json:"oldObject,omitempty" protobuf:"bytes,10,opt,name=oldObject"`
|
||||
// dryRun indicates that modifications will definitely not be persisted for this request.
|
||||
// Defaults to false.
|
||||
// +optional
|
||||
DryRun *bool `json:"dryRun,omitempty" protobuf:"varint,11,opt,name=dryRun"`
|
||||
// options is the operation option structure of the operation being performed.
|
||||
// e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
// different than the options the caller provided. e.g. for a patch request the performed
|
||||
// Operation might be a CREATE, in which case the Options will a
|
||||
// `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
// +optional
|
||||
Options runtime.RawExtension `json:"options,omitempty" protobuf:"bytes,12,opt,name=options"`
|
||||
}
|
||||
|
||||
// AdmissionResponse describes an admission response.
|
||||
type AdmissionResponse struct {
|
||||
// uid is an identifier for the individual request/response.
|
||||
// This must be copied over from the corresponding AdmissionRequest.
|
||||
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
|
||||
|
||||
// allowed indicates whether or not the admission request was permitted.
|
||||
Allowed bool `json:"allowed" protobuf:"varint,2,opt,name=allowed"`
|
||||
|
||||
// status is the result contains extra details into why an admission request was denied.
|
||||
// This field IS NOT consulted in any way if "Allowed" is "true".
|
||||
// +optional
|
||||
Result *metav1.Status `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
|
||||
// patch is the patch body. Currently we only support "JSONPatch" which implements RFC 6902.
|
||||
// +optional
|
||||
Patch []byte `json:"patch,omitempty" protobuf:"bytes,4,opt,name=patch"`
|
||||
|
||||
// patchType is the type of Patch. Currently we only allow "JSONPatch".
|
||||
// +optional
|
||||
PatchType *PatchType `json:"patchType,omitempty" protobuf:"bytes,5,opt,name=patchType"`
|
||||
|
||||
// auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
|
||||
// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
|
||||
// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
|
||||
// the admission webhook to add additional context to the audit log for this request.
|
||||
// +optional
|
||||
AuditAnnotations map[string]string `json:"auditAnnotations,omitempty" protobuf:"bytes,6,opt,name=auditAnnotations"`
|
||||
|
||||
// warnings is a list of warning messages to return to the requesting API client.
|
||||
// Warning messages describe a problem the client making the API request should correct or be aware of.
|
||||
// Limit warnings to 120 characters if possible.
|
||||
// Warnings over 256 characters and large numbers of warnings may be truncated.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Warnings []string `json:"warnings,omitempty" protobuf:"bytes,7,rep,name=warnings"`
|
||||
}
|
||||
|
||||
// PatchType is the type of patch being used to represent the mutated object
|
||||
type PatchType string
|
||||
|
||||
// PatchType constants.
|
||||
const (
|
||||
PatchTypeJSONPatch PatchType = "JSONPatch"
|
||||
)
|
||||
|
||||
// Operation is the type of resource operation being checked for admission control
|
||||
type Operation string
|
||||
|
||||
// Operation constants
|
||||
const (
|
||||
Create Operation = "CREATE"
|
||||
Update Operation = "UPDATE"
|
||||
Delete Operation = "DELETE"
|
||||
Connect Operation = "CONNECT"
|
||||
)
|
||||
+78
@@ -0,0 +1,78 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
// This file contains a collection of methods that can be used from go-restful to
|
||||
// generate Swagger API documentation for its models. Please read this PR for more
|
||||
// information on the implementation: https://github.com/emicklei/go-restful/pull/215
|
||||
//
|
||||
// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
|
||||
// they are on one line! For multiple line or blocks that you want to ignore use ---.
|
||||
// Any context after a --- is ignored.
|
||||
//
|
||||
// Those methods can be generated by using hack/update-codegen.sh
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_AdmissionRequest = map[string]string{
|
||||
"": "AdmissionRequest describes the admission.Attributes for the admission request.",
|
||||
"uid": "uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.",
|
||||
"kind": "kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)",
|
||||
"resource": "resource is the fully-qualified resource being requested (for example, v1.pods)",
|
||||
"subResource": "subResource is the subresource being requested, if any (for example, \"status\" or \"scale\")",
|
||||
"requestKind": "requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in \"kind\", an equivalent match and conversion was performed.\n\nFor example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]` and `matchPolicy: Equivalent`, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with `kind: {group:\"apps\", version:\"v1\", kind:\"Deployment\"}` (matching the rule the webhook registered for), and `requestKind: {group:\"apps\", version:\"v1beta1\", kind:\"Deployment\"}` (indicating the kind of the original API request).\n\nSee documentation for the \"matchPolicy\" field in the webhook configuration type for more details.",
|
||||
"requestResource": "requestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in \"resource\", an equivalent match and conversion was performed.\n\nFor example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]` and `matchPolicy: Equivalent`, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with `resource: {group:\"apps\", version:\"v1\", resource:\"deployments\"}` (matching the resource the webhook registered for), and `requestResource: {group:\"apps\", version:\"v1beta1\", resource:\"deployments\"}` (indicating the resource of the original API request).\n\nSee documentation for the \"matchPolicy\" field in the webhook configuration type.",
|
||||
"requestSubResource": "requestSubResource is the name of the subresource of the original API request, if any (for example, \"status\" or \"scale\") If this is specified and differs from the value in \"subResource\", an equivalent match and conversion was performed. See documentation for the \"matchPolicy\" field in the webhook configuration type.",
|
||||
"name": "name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and rely on the server to generate the name. If that is the case, this field will contain an empty string.",
|
||||
"namespace": "namespace is the namespace associated with the request (if any).",
|
||||
"operation": "operation is the operation being performed. This may be different than the operation requested. e.g. a patch can result in either a CREATE or UPDATE Operation.",
|
||||
"userInfo": "userInfo is information about the requesting user",
|
||||
"object": "object is the object from the incoming request.",
|
||||
"oldObject": "oldObject is the existing object. Only populated for DELETE and UPDATE requests.",
|
||||
"dryRun": "dryRun indicates that modifications will definitely not be persisted for this request. Defaults to false.",
|
||||
"options": "options is the operation option structure of the operation being performed. e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be different than the options the caller provided. e.g. for a patch request the performed Operation might be a CREATE, in which case the Options will a `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.",
|
||||
}
|
||||
|
||||
func (AdmissionRequest) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionRequest
|
||||
}
|
||||
|
||||
var map_AdmissionResponse = map[string]string{
|
||||
"": "AdmissionResponse describes an admission response.",
|
||||
"uid": "uid is an identifier for the individual request/response. This must be copied over from the corresponding AdmissionRequest.",
|
||||
"allowed": "allowed indicates whether or not the admission request was permitted.",
|
||||
"status": "status is the result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\".",
|
||||
"patch": "patch is the patch body. Currently we only support \"JSONPatch\" which implements RFC 6902.",
|
||||
"patchType": "patchType is the type of Patch. Currently we only allow \"JSONPatch\".",
|
||||
"auditAnnotations": "auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted). MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by the admission webhook to add additional context to the audit log for this request.",
|
||||
"warnings": "warnings is a list of warning messages to return to the requesting API client. Warning messages describe a problem the client making the API request should correct or be aware of. Limit warnings to 120 characters if possible. Warnings over 256 characters and large numbers of warnings may be truncated.",
|
||||
}
|
||||
|
||||
func (AdmissionResponse) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionResponse
|
||||
}
|
||||
|
||||
var map_AdmissionReview = map[string]string{
|
||||
"": "AdmissionReview describes an admission review request/response.",
|
||||
"request": "request describes the attributes for the admission request.",
|
||||
"response": "response describes the attributes for the admission response.",
|
||||
}
|
||||
|
||||
func (AdmissionReview) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionReview
|
||||
}
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS END HERE
|
||||
+142
@@ -0,0 +1,142 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionRequest) DeepCopyInto(out *AdmissionRequest) {
|
||||
*out = *in
|
||||
out.Kind = in.Kind
|
||||
out.Resource = in.Resource
|
||||
if in.RequestKind != nil {
|
||||
in, out := &in.RequestKind, &out.RequestKind
|
||||
*out = new(metav1.GroupVersionKind)
|
||||
**out = **in
|
||||
}
|
||||
if in.RequestResource != nil {
|
||||
in, out := &in.RequestResource, &out.RequestResource
|
||||
*out = new(metav1.GroupVersionResource)
|
||||
**out = **in
|
||||
}
|
||||
in.UserInfo.DeepCopyInto(&out.UserInfo)
|
||||
in.Object.DeepCopyInto(&out.Object)
|
||||
in.OldObject.DeepCopyInto(&out.OldObject)
|
||||
if in.DryRun != nil {
|
||||
in, out := &in.DryRun, &out.DryRun
|
||||
*out = new(bool)
|
||||
**out = **in
|
||||
}
|
||||
in.Options.DeepCopyInto(&out.Options)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionRequest.
|
||||
func (in *AdmissionRequest) DeepCopy() *AdmissionRequest {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionRequest)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionResponse) DeepCopyInto(out *AdmissionResponse) {
|
||||
*out = *in
|
||||
if in.Result != nil {
|
||||
in, out := &in.Result, &out.Result
|
||||
*out = new(metav1.Status)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Patch != nil {
|
||||
in, out := &in.Patch, &out.Patch
|
||||
*out = make([]byte, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.PatchType != nil {
|
||||
in, out := &in.PatchType, &out.PatchType
|
||||
*out = new(PatchType)
|
||||
**out = **in
|
||||
}
|
||||
if in.AuditAnnotations != nil {
|
||||
in, out := &in.AuditAnnotations, &out.AuditAnnotations
|
||||
*out = make(map[string]string, len(*in))
|
||||
for key, val := range *in {
|
||||
(*out)[key] = val
|
||||
}
|
||||
}
|
||||
if in.Warnings != nil {
|
||||
in, out := &in.Warnings, &out.Warnings
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionResponse.
|
||||
func (in *AdmissionResponse) DeepCopy() *AdmissionResponse {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionResponse)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionReview) DeepCopyInto(out *AdmissionReview) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
if in.Request != nil {
|
||||
in, out := &in.Request, &out.Request
|
||||
*out = new(AdmissionRequest)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Response != nil {
|
||||
in, out := &in.Response, &out.Response
|
||||
*out = new(AdmissionResponse)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReview.
|
||||
func (in *AdmissionReview) DeepCopy() *AdmissionReview {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionReview)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *AdmissionReview) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by openapi-gen. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionRequest) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1.AdmissionRequest"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionResponse) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1.AdmissionResponse"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionReview) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1.AdmissionReview"
|
||||
}
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *AdmissionReview) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 19
|
||||
}
|
||||
+25
@@ -0,0 +1,25 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:protobuf-gen=package
|
||||
// +k8s:openapi-gen=false
|
||||
// +k8s:prerelease-lifecycle-gen=true
|
||||
// +k8s:openapi-model-package=io.k8s.api.admission.v1beta1
|
||||
|
||||
// +groupName=admission.k8s.io
|
||||
|
||||
package v1beta1
|
||||
+1619
File diff suppressed because it is too large
Load Diff
+168
@@ -0,0 +1,168 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
||||
|
||||
syntax = "proto2";
|
||||
|
||||
package k8s.io.api.admission.v1beta1;
|
||||
|
||||
import "k8s.io/api/authentication/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/api/admission/v1beta1";
|
||||
|
||||
// AdmissionRequest describes the admission.Attributes for the admission request.
|
||||
message AdmissionRequest {
|
||||
// uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
optional string uid = 1;
|
||||
|
||||
// kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;
|
||||
|
||||
// resource is the fully-qualified resource being requested (for example, v1.pods)
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;
|
||||
|
||||
// subResource is the subresource being requested, if any (for example, "status" or "scale")
|
||||
// +optional
|
||||
optional string subResource = 4;
|
||||
|
||||
// requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
// If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
// and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind requestKind = 13;
|
||||
|
||||
// requestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
// If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource requestResource = 14;
|
||||
|
||||
// requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
// If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
optional string requestSubResource = 15;
|
||||
|
||||
// name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
// rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
// +optional
|
||||
optional string name = 5;
|
||||
|
||||
// namespace is the namespace associated with the request (if any).
|
||||
// +optional
|
||||
optional string namespace = 6;
|
||||
|
||||
// operation is the operation being performed. This may be different than the operation
|
||||
// requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
optional string operation = 7;
|
||||
|
||||
// userInfo is information about the requesting user
|
||||
optional .k8s.io.api.authentication.v1.UserInfo userInfo = 8;
|
||||
|
||||
// object is the object from the incoming request.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;
|
||||
|
||||
// oldObject is the existing object. Only populated for DELETE and UPDATE requests.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;
|
||||
|
||||
// dryRun indicates that modifications will definitely not be persisted for this request.
|
||||
// Defaults to false.
|
||||
// +optional
|
||||
optional bool dryRun = 11;
|
||||
|
||||
// options is the operation option structure of the operation being performed.
|
||||
// e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
// different than the options the caller provided. e.g. for a patch request the performed
|
||||
// Operation might be a CREATE, in which case the Options will a
|
||||
// `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension options = 12;
|
||||
}
|
||||
|
||||
// AdmissionResponse describes an admission response.
|
||||
message AdmissionResponse {
|
||||
// uid is an identifier for the individual request/response.
|
||||
// This should be copied over from the corresponding AdmissionRequest.
|
||||
optional string uid = 1;
|
||||
|
||||
// allowed indicates whether or not the admission request was permitted.
|
||||
optional bool allowed = 2;
|
||||
|
||||
// status is the result contains extra details into why an admission request was denied.
|
||||
// This field IS NOT consulted in any way if "Allowed" is "true".
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;
|
||||
|
||||
// patch is the patch body. Currently we only support "JSONPatch" which implements RFC 6902.
|
||||
// +optional
|
||||
optional bytes patch = 4;
|
||||
|
||||
// patchType is the type of Patch. Currently we only allow "JSONPatch".
|
||||
// +optional
|
||||
optional string patchType = 5;
|
||||
|
||||
// auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
|
||||
// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
|
||||
// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
|
||||
// the admission webhook to add additional context to the audit log for this request.
|
||||
// +optional
|
||||
map<string, string> auditAnnotations = 6;
|
||||
|
||||
// warnings is a list of warning messages to return to the requesting API client.
|
||||
// Warning messages describe a problem the client making the API request should correct or be aware of.
|
||||
// Limit warnings to 120 characters if possible.
|
||||
// Warnings over 256 characters and large numbers of warnings may be truncated.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string warnings = 7;
|
||||
}
|
||||
|
||||
// AdmissionReview describes an admission review request/response.
|
||||
message AdmissionReview {
|
||||
// request describes the attributes for the admission request.
|
||||
// +optional
|
||||
optional AdmissionRequest request = 1;
|
||||
|
||||
// response describes the attributes for the admission response.
|
||||
// +optional
|
||||
optional AdmissionResponse response = 2;
|
||||
}
|
||||
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
func (*AdmissionRequest) ProtoMessage() {}
|
||||
|
||||
func (*AdmissionResponse) ProtoMessage() {}
|
||||
|
||||
func (*AdmissionReview) ProtoMessage() {}
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name for this API.
|
||||
const GroupName = "admission.k8s.io"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1beta1"}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
|
||||
// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
|
||||
var (
|
||||
// SchemeBuilder points to a list of functions added to Scheme.
|
||||
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
// AddToScheme is a common registration function for mapping packaged scoped group & version keys to a scheme.
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
// Adds the list of known types to the given scheme.
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&AdmissionReview{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
}
|
||||
+175
@@ -0,0 +1,175 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
authenticationv1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
)
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.9
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.19
|
||||
// This API is never server served. It is used for outbound requests from apiservers. This will ensure it never gets served accidentally
|
||||
// and having the generator against this group will protect future APIs which may be served.
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=admission.k8s.io,v1,AdmissionReview
|
||||
|
||||
// AdmissionReview describes an admission review request/response.
|
||||
type AdmissionReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// request describes the attributes for the admission request.
|
||||
// +optional
|
||||
Request *AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`
|
||||
// response describes the attributes for the admission response.
|
||||
// +optional
|
||||
Response *AdmissionResponse `json:"response,omitempty" protobuf:"bytes,2,opt,name=response"`
|
||||
}
|
||||
|
||||
// AdmissionRequest describes the admission.Attributes for the admission request.
|
||||
type AdmissionRequest struct {
|
||||
// uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
|
||||
// kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
Kind metav1.GroupVersionKind `json:"kind" protobuf:"bytes,2,opt,name=kind"`
|
||||
// resource is the fully-qualified resource being requested (for example, v1.pods)
|
||||
Resource metav1.GroupVersionResource `json:"resource" protobuf:"bytes,3,opt,name=resource"`
|
||||
// subResource is the subresource being requested, if any (for example, "status" or "scale")
|
||||
// +optional
|
||||
SubResource string `json:"subResource,omitempty" protobuf:"bytes,4,opt,name=subResource"`
|
||||
|
||||
// requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
// If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
// and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
// +optional
|
||||
RequestKind *metav1.GroupVersionKind `json:"requestKind,omitempty" protobuf:"bytes,13,opt,name=requestKind"`
|
||||
// requestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
// If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
RequestResource *metav1.GroupVersionResource `json:"requestResource,omitempty" protobuf:"bytes,14,opt,name=requestResource"`
|
||||
// requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
// If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
RequestSubResource string `json:"requestSubResource,omitempty" protobuf:"bytes,15,opt,name=requestSubResource"`
|
||||
|
||||
// name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
// rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
// +optional
|
||||
Name string `json:"name,omitempty" protobuf:"bytes,5,opt,name=name"`
|
||||
// namespace is the namespace associated with the request (if any).
|
||||
// +optional
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,6,opt,name=namespace"`
|
||||
// operation is the operation being performed. This may be different than the operation
|
||||
// requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
Operation Operation `json:"operation" protobuf:"bytes,7,opt,name=operation"`
|
||||
// userInfo is information about the requesting user
|
||||
UserInfo authenticationv1.UserInfo `json:"userInfo" protobuf:"bytes,8,opt,name=userInfo"`
|
||||
// object is the object from the incoming request.
|
||||
// +optional
|
||||
Object runtime.RawExtension `json:"object,omitempty" protobuf:"bytes,9,opt,name=object"`
|
||||
// oldObject is the existing object. Only populated for DELETE and UPDATE requests.
|
||||
// +optional
|
||||
OldObject runtime.RawExtension `json:"oldObject,omitempty" protobuf:"bytes,10,opt,name=oldObject"`
|
||||
// dryRun indicates that modifications will definitely not be persisted for this request.
|
||||
// Defaults to false.
|
||||
// +optional
|
||||
DryRun *bool `json:"dryRun,omitempty" protobuf:"varint,11,opt,name=dryRun"`
|
||||
// options is the operation option structure of the operation being performed.
|
||||
// e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
// different than the options the caller provided. e.g. for a patch request the performed
|
||||
// Operation might be a CREATE, in which case the Options will a
|
||||
// `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
// +optional
|
||||
Options runtime.RawExtension `json:"options,omitempty" protobuf:"bytes,12,opt,name=options"`
|
||||
}
|
||||
|
||||
// AdmissionResponse describes an admission response.
|
||||
type AdmissionResponse struct {
|
||||
// uid is an identifier for the individual request/response.
|
||||
// This should be copied over from the corresponding AdmissionRequest.
|
||||
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
|
||||
|
||||
// allowed indicates whether or not the admission request was permitted.
|
||||
Allowed bool `json:"allowed" protobuf:"varint,2,opt,name=allowed"`
|
||||
|
||||
// status is the result contains extra details into why an admission request was denied.
|
||||
// This field IS NOT consulted in any way if "Allowed" is "true".
|
||||
// +optional
|
||||
Result *metav1.Status `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
|
||||
// patch is the patch body. Currently we only support "JSONPatch" which implements RFC 6902.
|
||||
// +optional
|
||||
Patch []byte `json:"patch,omitempty" protobuf:"bytes,4,opt,name=patch"`
|
||||
|
||||
// patchType is the type of Patch. Currently we only allow "JSONPatch".
|
||||
// +optional
|
||||
PatchType *PatchType `json:"patchType,omitempty" protobuf:"bytes,5,opt,name=patchType"`
|
||||
|
||||
// auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
|
||||
// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
|
||||
// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
|
||||
// the admission webhook to add additional context to the audit log for this request.
|
||||
// +optional
|
||||
AuditAnnotations map[string]string `json:"auditAnnotations,omitempty" protobuf:"bytes,6,opt,name=auditAnnotations"`
|
||||
|
||||
// warnings is a list of warning messages to return to the requesting API client.
|
||||
// Warning messages describe a problem the client making the API request should correct or be aware of.
|
||||
// Limit warnings to 120 characters if possible.
|
||||
// Warnings over 256 characters and large numbers of warnings may be truncated.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Warnings []string `json:"warnings,omitempty" protobuf:"bytes,7,rep,name=warnings"`
|
||||
}
|
||||
|
||||
// PatchType is the type of patch being used to represent the mutated object
|
||||
type PatchType string
|
||||
|
||||
// PatchType constants.
|
||||
const (
|
||||
PatchTypeJSONPatch PatchType = "JSONPatch"
|
||||
)
|
||||
|
||||
// Operation is the type of resource operation being checked for admission control
|
||||
type Operation string
|
||||
|
||||
// Operation constants
|
||||
const (
|
||||
Create Operation = "CREATE"
|
||||
Update Operation = "UPDATE"
|
||||
Delete Operation = "DELETE"
|
||||
Connect Operation = "CONNECT"
|
||||
)
|
||||
+78
@@ -0,0 +1,78 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
// This file contains a collection of methods that can be used from go-restful to
|
||||
// generate Swagger API documentation for its models. Please read this PR for more
|
||||
// information on the implementation: https://github.com/emicklei/go-restful/pull/215
|
||||
//
|
||||
// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
|
||||
// they are on one line! For multiple line or blocks that you want to ignore use ---.
|
||||
// Any context after a --- is ignored.
|
||||
//
|
||||
// Those methods can be generated by using hack/update-codegen.sh
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_AdmissionRequest = map[string]string{
|
||||
"": "AdmissionRequest describes the admission.Attributes for the admission request.",
|
||||
"uid": "uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.",
|
||||
"kind": "kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)",
|
||||
"resource": "resource is the fully-qualified resource being requested (for example, v1.pods)",
|
||||
"subResource": "subResource is the subresource being requested, if any (for example, \"status\" or \"scale\")",
|
||||
"requestKind": "requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in \"kind\", an equivalent match and conversion was performed.\n\nFor example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]` and `matchPolicy: Equivalent`, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with `kind: {group:\"apps\", version:\"v1\", kind:\"Deployment\"}` (matching the rule the webhook registered for), and `requestKind: {group:\"apps\", version:\"v1beta1\", kind:\"Deployment\"}` (indicating the kind of the original API request).\n\nSee documentation for the \"matchPolicy\" field in the webhook configuration type for more details.",
|
||||
"requestResource": "requestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in \"resource\", an equivalent match and conversion was performed.\n\nFor example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]` and `matchPolicy: Equivalent`, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with `resource: {group:\"apps\", version:\"v1\", resource:\"deployments\"}` (matching the resource the webhook registered for), and `requestResource: {group:\"apps\", version:\"v1beta1\", resource:\"deployments\"}` (indicating the resource of the original API request).\n\nSee documentation for the \"matchPolicy\" field in the webhook configuration type.",
|
||||
"requestSubResource": "requestSubResource is the name of the subresource of the original API request, if any (for example, \"status\" or \"scale\") If this is specified and differs from the value in \"subResource\", an equivalent match and conversion was performed. See documentation for the \"matchPolicy\" field in the webhook configuration type.",
|
||||
"name": "name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and rely on the server to generate the name. If that is the case, this field will contain an empty string.",
|
||||
"namespace": "namespace is the namespace associated with the request (if any).",
|
||||
"operation": "operation is the operation being performed. This may be different than the operation requested. e.g. a patch can result in either a CREATE or UPDATE Operation.",
|
||||
"userInfo": "userInfo is information about the requesting user",
|
||||
"object": "object is the object from the incoming request.",
|
||||
"oldObject": "oldObject is the existing object. Only populated for DELETE and UPDATE requests.",
|
||||
"dryRun": "dryRun indicates that modifications will definitely not be persisted for this request. Defaults to false.",
|
||||
"options": "options is the operation option structure of the operation being performed. e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be different than the options the caller provided. e.g. for a patch request the performed Operation might be a CREATE, in which case the Options will a `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.",
|
||||
}
|
||||
|
||||
func (AdmissionRequest) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionRequest
|
||||
}
|
||||
|
||||
var map_AdmissionResponse = map[string]string{
|
||||
"": "AdmissionResponse describes an admission response.",
|
||||
"uid": "uid is an identifier for the individual request/response. This should be copied over from the corresponding AdmissionRequest.",
|
||||
"allowed": "allowed indicates whether or not the admission request was permitted.",
|
||||
"status": "status is the result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\".",
|
||||
"patch": "patch is the patch body. Currently we only support \"JSONPatch\" which implements RFC 6902.",
|
||||
"patchType": "patchType is the type of Patch. Currently we only allow \"JSONPatch\".",
|
||||
"auditAnnotations": "auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted). MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by the admission webhook to add additional context to the audit log for this request.",
|
||||
"warnings": "warnings is a list of warning messages to return to the requesting API client. Warning messages describe a problem the client making the API request should correct or be aware of. Limit warnings to 120 characters if possible. Warnings over 256 characters and large numbers of warnings may be truncated.",
|
||||
}
|
||||
|
||||
func (AdmissionResponse) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionResponse
|
||||
}
|
||||
|
||||
var map_AdmissionReview = map[string]string{
|
||||
"": "AdmissionReview describes an admission review request/response.",
|
||||
"request": "request describes the attributes for the admission request.",
|
||||
"response": "response describes the attributes for the admission response.",
|
||||
}
|
||||
|
||||
func (AdmissionReview) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionReview
|
||||
}
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS END HERE
|
||||
+142
@@ -0,0 +1,142 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionRequest) DeepCopyInto(out *AdmissionRequest) {
|
||||
*out = *in
|
||||
out.Kind = in.Kind
|
||||
out.Resource = in.Resource
|
||||
if in.RequestKind != nil {
|
||||
in, out := &in.RequestKind, &out.RequestKind
|
||||
*out = new(v1.GroupVersionKind)
|
||||
**out = **in
|
||||
}
|
||||
if in.RequestResource != nil {
|
||||
in, out := &in.RequestResource, &out.RequestResource
|
||||
*out = new(v1.GroupVersionResource)
|
||||
**out = **in
|
||||
}
|
||||
in.UserInfo.DeepCopyInto(&out.UserInfo)
|
||||
in.Object.DeepCopyInto(&out.Object)
|
||||
in.OldObject.DeepCopyInto(&out.OldObject)
|
||||
if in.DryRun != nil {
|
||||
in, out := &in.DryRun, &out.DryRun
|
||||
*out = new(bool)
|
||||
**out = **in
|
||||
}
|
||||
in.Options.DeepCopyInto(&out.Options)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionRequest.
|
||||
func (in *AdmissionRequest) DeepCopy() *AdmissionRequest {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionRequest)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionResponse) DeepCopyInto(out *AdmissionResponse) {
|
||||
*out = *in
|
||||
if in.Result != nil {
|
||||
in, out := &in.Result, &out.Result
|
||||
*out = new(v1.Status)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Patch != nil {
|
||||
in, out := &in.Patch, &out.Patch
|
||||
*out = make([]byte, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.PatchType != nil {
|
||||
in, out := &in.PatchType, &out.PatchType
|
||||
*out = new(PatchType)
|
||||
**out = **in
|
||||
}
|
||||
if in.AuditAnnotations != nil {
|
||||
in, out := &in.AuditAnnotations, &out.AuditAnnotations
|
||||
*out = make(map[string]string, len(*in))
|
||||
for key, val := range *in {
|
||||
(*out)[key] = val
|
||||
}
|
||||
}
|
||||
if in.Warnings != nil {
|
||||
in, out := &in.Warnings, &out.Warnings
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionResponse.
|
||||
func (in *AdmissionResponse) DeepCopy() *AdmissionResponse {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionResponse)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionReview) DeepCopyInto(out *AdmissionReview) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
if in.Request != nil {
|
||||
in, out := &in.Request, &out.Request
|
||||
*out = new(AdmissionRequest)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Response != nil {
|
||||
in, out := &in.Response, &out.Response
|
||||
*out = new(AdmissionResponse)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReview.
|
||||
func (in *AdmissionReview) DeepCopy() *AdmissionReview {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionReview)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *AdmissionReview) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by openapi-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionRequest) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1beta1.AdmissionRequest"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionResponse) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1beta1.AdmissionResponse"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionReview) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1beta1.AdmissionReview"
|
||||
}
|
||||
+50
@@ -0,0 +1,50 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *AdmissionReview) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 9
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *AdmissionReview) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 19
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *AdmissionReview) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "admission.k8s.io", Version: "v1", Kind: "AdmissionReview"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *AdmissionReview) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 22
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
/*
|
||||
Copyright 2016 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:protobuf-gen=package
|
||||
// +k8s:openapi-gen=true
|
||||
// +k8s:openapi-model-package=io.k8s.api.imagepolicy.v1alpha1
|
||||
|
||||
// +groupName=imagepolicy.k8s.io
|
||||
|
||||
package v1alpha1
|
||||
+1201
File diff suppressed because it is too large
Load Diff
+89
@@ -0,0 +1,89 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
||||
|
||||
syntax = "proto2";
|
||||
|
||||
package k8s.io.api.imagepolicy.v1alpha1;
|
||||
|
||||
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/api/imagepolicy/v1alpha1";
|
||||
|
||||
// ImageReview checks if the set of images in a pod are allowed.
|
||||
message ImageReview {
|
||||
// Standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the pod being evaluated
|
||||
optional ImageReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the backend and indicates whether the pod should be allowed.
|
||||
// +optional
|
||||
optional ImageReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// ImageReviewContainerSpec is a description of a container within the pod creation request.
|
||||
message ImageReviewContainerSpec {
|
||||
// This can be in the form image:tag or image@SHA:012345679abcdef.
|
||||
// +optional
|
||||
optional string image = 1;
|
||||
}
|
||||
|
||||
// ImageReviewSpec is a description of the pod creation request.
|
||||
message ImageReviewSpec {
|
||||
// Containers is a list of a subset of the information in each container of the Pod being created.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated ImageReviewContainerSpec containers = 1;
|
||||
|
||||
// Annotations is a list of key-value pairs extracted from the Pod's annotations.
|
||||
// It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
|
||||
// It is up to each webhook backend to determine how to interpret these annotations, if at all.
|
||||
// +optional
|
||||
map<string, string> annotations = 2;
|
||||
|
||||
// Namespace is the namespace the pod is being created in.
|
||||
// +optional
|
||||
optional string namespace = 3;
|
||||
}
|
||||
|
||||
// ImageReviewStatus is the result of the review for the pod creation request.
|
||||
message ImageReviewStatus {
|
||||
// Allowed indicates that all images were allowed to be run.
|
||||
optional bool allowed = 1;
|
||||
|
||||
// Reason should be empty unless Allowed is false in which case it
|
||||
// may contain a short description of what is wrong. Kubernetes
|
||||
// may truncate excessively long errors when displaying to the user.
|
||||
// +optional
|
||||
optional string reason = 2;
|
||||
|
||||
// AuditAnnotations will be added to the attributes object of the
|
||||
// admission controller request using 'AddAnnotation'. The keys should
|
||||
// be prefix-less (i.e., the admission controller will add an
|
||||
// appropriate prefix).
|
||||
// +optional
|
||||
map<string, string> auditAnnotations = 3;
|
||||
}
|
||||
|
||||
+30
@@ -0,0 +1,30 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
func (*ImageReview) ProtoMessage() {}
|
||||
|
||||
func (*ImageReviewContainerSpec) ProtoMessage() {}
|
||||
|
||||
func (*ImageReviewSpec) ProtoMessage() {}
|
||||
|
||||
func (*ImageReviewStatus) ProtoMessage() {}
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
/*
|
||||
Copyright 2016 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name for this API.
|
||||
const GroupName = "imagepolicy.k8s.io"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
var (
|
||||
// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
|
||||
// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
|
||||
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
// Adds the list of known types to the given scheme.
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&ImageReview{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
}
|
||||
+83
@@ -0,0 +1,83 @@
|
||||
/*
|
||||
Copyright 2016 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
// +genclient
|
||||
// +genclient:nonNamespaced
|
||||
// +genclient:noVerbs
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
|
||||
// ImageReview checks if the set of images in a pod are allowed.
|
||||
type ImageReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the pod being evaluated
|
||||
Spec ImageReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the backend and indicates whether the pod should be allowed.
|
||||
// +optional
|
||||
Status ImageReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// ImageReviewSpec is a description of the pod creation request.
|
||||
type ImageReviewSpec struct {
|
||||
// Containers is a list of a subset of the information in each container of the Pod being created.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Containers []ImageReviewContainerSpec `json:"containers,omitempty" protobuf:"bytes,1,rep,name=containers"`
|
||||
// Annotations is a list of key-value pairs extracted from the Pod's annotations.
|
||||
// It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
|
||||
// It is up to each webhook backend to determine how to interpret these annotations, if at all.
|
||||
// +optional
|
||||
Annotations map[string]string `json:"annotations,omitempty" protobuf:"bytes,2,rep,name=annotations"`
|
||||
// Namespace is the namespace the pod is being created in.
|
||||
// +optional
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,3,opt,name=namespace"`
|
||||
}
|
||||
|
||||
// ImageReviewContainerSpec is a description of a container within the pod creation request.
|
||||
type ImageReviewContainerSpec struct {
|
||||
// This can be in the form image:tag or image@SHA:012345679abcdef.
|
||||
// +optional
|
||||
Image string `json:"image,omitempty" protobuf:"bytes,1,opt,name=image"`
|
||||
// In future, we may add command line overrides, exec health check command lines, and so on.
|
||||
}
|
||||
|
||||
// ImageReviewStatus is the result of the review for the pod creation request.
|
||||
type ImageReviewStatus struct {
|
||||
// Allowed indicates that all images were allowed to be run.
|
||||
Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"`
|
||||
// Reason should be empty unless Allowed is false in which case it
|
||||
// may contain a short description of what is wrong. Kubernetes
|
||||
// may truncate excessively long errors when displaying to the user.
|
||||
// +optional
|
||||
Reason string `json:"reason,omitempty" protobuf:"bytes,2,opt,name=reason"`
|
||||
// AuditAnnotations will be added to the attributes object of the
|
||||
// admission controller request using 'AddAnnotation'. The keys should
|
||||
// be prefix-less (i.e., the admission controller will add an
|
||||
// appropriate prefix).
|
||||
// +optional
|
||||
AuditAnnotations map[string]string `json:"auditAnnotations,omitempty" protobuf:"bytes,3,rep,name=auditAnnotations"`
|
||||
}
|
||||
+72
@@ -0,0 +1,72 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1alpha1
|
||||
|
||||
// This file contains a collection of methods that can be used from go-restful to
|
||||
// generate Swagger API documentation for its models. Please read this PR for more
|
||||
// information on the implementation: https://github.com/emicklei/go-restful/pull/215
|
||||
//
|
||||
// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
|
||||
// they are on one line! For multiple line or blocks that you want to ignore use ---.
|
||||
// Any context after a --- is ignored.
|
||||
//
|
||||
// Those methods can be generated by using hack/update-codegen.sh
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_ImageReview = map[string]string{
|
||||
"": "ImageReview checks if the set of images in a pod are allowed.",
|
||||
"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the pod being evaluated",
|
||||
"status": "Status is filled in by the backend and indicates whether the pod should be allowed.",
|
||||
}
|
||||
|
||||
func (ImageReview) SwaggerDoc() map[string]string {
|
||||
return map_ImageReview
|
||||
}
|
||||
|
||||
var map_ImageReviewContainerSpec = map[string]string{
|
||||
"": "ImageReviewContainerSpec is a description of a container within the pod creation request.",
|
||||
"image": "This can be in the form image:tag or image@SHA:012345679abcdef.",
|
||||
}
|
||||
|
||||
func (ImageReviewContainerSpec) SwaggerDoc() map[string]string {
|
||||
return map_ImageReviewContainerSpec
|
||||
}
|
||||
|
||||
var map_ImageReviewSpec = map[string]string{
|
||||
"": "ImageReviewSpec is a description of the pod creation request.",
|
||||
"containers": "Containers is a list of a subset of the information in each container of the Pod being created.",
|
||||
"annotations": "Annotations is a list of key-value pairs extracted from the Pod's annotations. It only includes keys which match the pattern `*.image-policy.k8s.io/*`. It is up to each webhook backend to determine how to interpret these annotations, if at all.",
|
||||
"namespace": "Namespace is the namespace the pod is being created in.",
|
||||
}
|
||||
|
||||
func (ImageReviewSpec) SwaggerDoc() map[string]string {
|
||||
return map_ImageReviewSpec
|
||||
}
|
||||
|
||||
var map_ImageReviewStatus = map[string]string{
|
||||
"": "ImageReviewStatus is the result of the review for the pod creation request.",
|
||||
"allowed": "Allowed indicates that all images were allowed to be run.",
|
||||
"reason": "Reason should be empty unless Allowed is false in which case it may contain a short description of what is wrong. Kubernetes may truncate excessively long errors when displaying to the user.",
|
||||
"auditAnnotations": "AuditAnnotations will be added to the attributes object of the admission controller request using 'AddAnnotation'. The keys should be prefix-less (i.e., the admission controller will add an appropriate prefix).",
|
||||
}
|
||||
|
||||
func (ImageReviewStatus) SwaggerDoc() map[string]string {
|
||||
return map_ImageReviewStatus
|
||||
}
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS END HERE
|
||||
+121
@@ -0,0 +1,121 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ImageReview) DeepCopyInto(out *ImageReview) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
in.Spec.DeepCopyInto(&out.Spec)
|
||||
in.Status.DeepCopyInto(&out.Status)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageReview.
|
||||
func (in *ImageReview) DeepCopy() *ImageReview {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ImageReview)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *ImageReview) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ImageReviewContainerSpec) DeepCopyInto(out *ImageReviewContainerSpec) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageReviewContainerSpec.
|
||||
func (in *ImageReviewContainerSpec) DeepCopy() *ImageReviewContainerSpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ImageReviewContainerSpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ImageReviewSpec) DeepCopyInto(out *ImageReviewSpec) {
|
||||
*out = *in
|
||||
if in.Containers != nil {
|
||||
in, out := &in.Containers, &out.Containers
|
||||
*out = make([]ImageReviewContainerSpec, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.Annotations != nil {
|
||||
in, out := &in.Annotations, &out.Annotations
|
||||
*out = make(map[string]string, len(*in))
|
||||
for key, val := range *in {
|
||||
(*out)[key] = val
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageReviewSpec.
|
||||
func (in *ImageReviewSpec) DeepCopy() *ImageReviewSpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ImageReviewSpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ImageReviewStatus) DeepCopyInto(out *ImageReviewStatus) {
|
||||
*out = *in
|
||||
if in.AuditAnnotations != nil {
|
||||
in, out := &in.AuditAnnotations, &out.AuditAnnotations
|
||||
*out = make(map[string]string, len(*in))
|
||||
for key, val := range *in {
|
||||
(*out)[key] = val
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageReviewStatus.
|
||||
func (in *ImageReviewStatus) DeepCopy() *ImageReviewStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ImageReviewStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
+42
@@ -0,0 +1,42 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by openapi-gen. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ImageReview) OpenAPIModelName() string {
|
||||
return "io.k8s.api.imagepolicy.v1alpha1.ImageReview"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ImageReviewContainerSpec) OpenAPIModelName() string {
|
||||
return "io.k8s.api.imagepolicy.v1alpha1.ImageReviewContainerSpec"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ImageReviewSpec) OpenAPIModelName() string {
|
||||
return "io.k8s.api.imagepolicy.v1alpha1.ImageReviewSpec"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ImageReviewStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.imagepolicy.v1alpha1.ImageReviewStatus"
|
||||
}
|
||||
Reference in New Issue
Block a user