updated vendor
This commit is contained in:
-25
@@ -1,25 +0,0 @@
|
||||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:protobuf-gen=package
|
||||
// +k8s:openapi-gen=false
|
||||
// +k8s:prerelease-lifecycle-gen=true
|
||||
// +k8s:openapi-model-package=io.k8s.api.admission.v1
|
||||
|
||||
// +groupName=admission.k8s.io
|
||||
|
||||
package v1
|
||||
-1619
File diff suppressed because it is too large
Load Diff
-168
@@ -1,168 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
||||
|
||||
syntax = "proto2";
|
||||
|
||||
package k8s.io.api.admission.v1;
|
||||
|
||||
import "k8s.io/api/authentication/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/api/admission/v1";
|
||||
|
||||
// AdmissionRequest describes the admission.Attributes for the admission request.
|
||||
message AdmissionRequest {
|
||||
// uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
optional string uid = 1;
|
||||
|
||||
// kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;
|
||||
|
||||
// resource is the fully-qualified resource being requested (for example, v1.pods)
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;
|
||||
|
||||
// subResource is the subresource being requested, if any (for example, "status" or "scale")
|
||||
// +optional
|
||||
optional string subResource = 4;
|
||||
|
||||
// requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
// If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
// and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind requestKind = 13;
|
||||
|
||||
// requestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
// If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource requestResource = 14;
|
||||
|
||||
// requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
// If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
optional string requestSubResource = 15;
|
||||
|
||||
// name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
// rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
// +optional
|
||||
optional string name = 5;
|
||||
|
||||
// namespace is the namespace associated with the request (if any).
|
||||
// +optional
|
||||
optional string namespace = 6;
|
||||
|
||||
// operation is the operation being performed. This may be different than the operation
|
||||
// requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
optional string operation = 7;
|
||||
|
||||
// userInfo is information about the requesting user
|
||||
optional .k8s.io.api.authentication.v1.UserInfo userInfo = 8;
|
||||
|
||||
// object is the object from the incoming request.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;
|
||||
|
||||
// oldObject is the existing object. Only populated for DELETE and UPDATE requests.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;
|
||||
|
||||
// dryRun indicates that modifications will definitely not be persisted for this request.
|
||||
// Defaults to false.
|
||||
// +optional
|
||||
optional bool dryRun = 11;
|
||||
|
||||
// options is the operation option structure of the operation being performed.
|
||||
// e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
// different than the options the caller provided. e.g. for a patch request the performed
|
||||
// Operation might be a CREATE, in which case the Options will a
|
||||
// `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension options = 12;
|
||||
}
|
||||
|
||||
// AdmissionResponse describes an admission response.
|
||||
message AdmissionResponse {
|
||||
// uid is an identifier for the individual request/response.
|
||||
// This must be copied over from the corresponding AdmissionRequest.
|
||||
optional string uid = 1;
|
||||
|
||||
// allowed indicates whether or not the admission request was permitted.
|
||||
optional bool allowed = 2;
|
||||
|
||||
// status is the result contains extra details into why an admission request was denied.
|
||||
// This field IS NOT consulted in any way if "Allowed" is "true".
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;
|
||||
|
||||
// patch is the patch body. Currently we only support "JSONPatch" which implements RFC 6902.
|
||||
// +optional
|
||||
optional bytes patch = 4;
|
||||
|
||||
// patchType is the type of Patch. Currently we only allow "JSONPatch".
|
||||
// +optional
|
||||
optional string patchType = 5;
|
||||
|
||||
// auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
|
||||
// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
|
||||
// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
|
||||
// the admission webhook to add additional context to the audit log for this request.
|
||||
// +optional
|
||||
map<string, string> auditAnnotations = 6;
|
||||
|
||||
// warnings is a list of warning messages to return to the requesting API client.
|
||||
// Warning messages describe a problem the client making the API request should correct or be aware of.
|
||||
// Limit warnings to 120 characters if possible.
|
||||
// Warnings over 256 characters and large numbers of warnings may be truncated.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string warnings = 7;
|
||||
}
|
||||
|
||||
// AdmissionReview describes an admission review request/response.
|
||||
message AdmissionReview {
|
||||
// request describes the attributes for the admission request.
|
||||
// +optional
|
||||
optional AdmissionRequest request = 1;
|
||||
|
||||
// response describes the attributes for the admission response.
|
||||
// +optional
|
||||
optional AdmissionResponse response = 2;
|
||||
}
|
||||
|
||||
-28
@@ -1,28 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
func (*AdmissionRequest) ProtoMessage() {}
|
||||
|
||||
func (*AdmissionResponse) ProtoMessage() {}
|
||||
|
||||
func (*AdmissionReview) ProtoMessage() {}
|
||||
-53
@@ -1,53 +0,0 @@
|
||||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name for this API.
|
||||
const GroupName = "admission.k8s.io"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
|
||||
// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
|
||||
var (
|
||||
// SchemeBuilder points to a list of functions added to Scheme.
|
||||
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
// AddToScheme is a common registration function for mapping packaged scoped group & version keys to a scheme.
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
// Adds the list of known types to the given scheme.
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&AdmissionReview{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
}
|
||||
-171
@@ -1,171 +0,0 @@
|
||||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
authenticationv1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
)
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.19
|
||||
|
||||
// AdmissionReview describes an admission review request/response.
|
||||
type AdmissionReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// request describes the attributes for the admission request.
|
||||
// +optional
|
||||
Request *AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`
|
||||
// response describes the attributes for the admission response.
|
||||
// +optional
|
||||
Response *AdmissionResponse `json:"response,omitempty" protobuf:"bytes,2,opt,name=response"`
|
||||
}
|
||||
|
||||
// AdmissionRequest describes the admission.Attributes for the admission request.
|
||||
type AdmissionRequest struct {
|
||||
// uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
|
||||
// kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
Kind metav1.GroupVersionKind `json:"kind" protobuf:"bytes,2,opt,name=kind"`
|
||||
// resource is the fully-qualified resource being requested (for example, v1.pods)
|
||||
Resource metav1.GroupVersionResource `json:"resource" protobuf:"bytes,3,opt,name=resource"`
|
||||
// subResource is the subresource being requested, if any (for example, "status" or "scale")
|
||||
// +optional
|
||||
SubResource string `json:"subResource,omitempty" protobuf:"bytes,4,opt,name=subResource"`
|
||||
|
||||
// requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
// If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
// and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
// +optional
|
||||
RequestKind *metav1.GroupVersionKind `json:"requestKind,omitempty" protobuf:"bytes,13,opt,name=requestKind"`
|
||||
// requestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
// If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
RequestResource *metav1.GroupVersionResource `json:"requestResource,omitempty" protobuf:"bytes,14,opt,name=requestResource"`
|
||||
// requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
// If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
RequestSubResource string `json:"requestSubResource,omitempty" protobuf:"bytes,15,opt,name=requestSubResource"`
|
||||
|
||||
// name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
// rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
// +optional
|
||||
Name string `json:"name,omitempty" protobuf:"bytes,5,opt,name=name"`
|
||||
// namespace is the namespace associated with the request (if any).
|
||||
// +optional
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,6,opt,name=namespace"`
|
||||
// operation is the operation being performed. This may be different than the operation
|
||||
// requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
Operation Operation `json:"operation" protobuf:"bytes,7,opt,name=operation"`
|
||||
// userInfo is information about the requesting user
|
||||
UserInfo authenticationv1.UserInfo `json:"userInfo" protobuf:"bytes,8,opt,name=userInfo"`
|
||||
// object is the object from the incoming request.
|
||||
// +optional
|
||||
Object runtime.RawExtension `json:"object,omitempty" protobuf:"bytes,9,opt,name=object"`
|
||||
// oldObject is the existing object. Only populated for DELETE and UPDATE requests.
|
||||
// +optional
|
||||
OldObject runtime.RawExtension `json:"oldObject,omitempty" protobuf:"bytes,10,opt,name=oldObject"`
|
||||
// dryRun indicates that modifications will definitely not be persisted for this request.
|
||||
// Defaults to false.
|
||||
// +optional
|
||||
DryRun *bool `json:"dryRun,omitempty" protobuf:"varint,11,opt,name=dryRun"`
|
||||
// options is the operation option structure of the operation being performed.
|
||||
// e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
// different than the options the caller provided. e.g. for a patch request the performed
|
||||
// Operation might be a CREATE, in which case the Options will a
|
||||
// `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
// +optional
|
||||
Options runtime.RawExtension `json:"options,omitempty" protobuf:"bytes,12,opt,name=options"`
|
||||
}
|
||||
|
||||
// AdmissionResponse describes an admission response.
|
||||
type AdmissionResponse struct {
|
||||
// uid is an identifier for the individual request/response.
|
||||
// This must be copied over from the corresponding AdmissionRequest.
|
||||
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
|
||||
|
||||
// allowed indicates whether or not the admission request was permitted.
|
||||
Allowed bool `json:"allowed" protobuf:"varint,2,opt,name=allowed"`
|
||||
|
||||
// status is the result contains extra details into why an admission request was denied.
|
||||
// This field IS NOT consulted in any way if "Allowed" is "true".
|
||||
// +optional
|
||||
Result *metav1.Status `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
|
||||
// patch is the patch body. Currently we only support "JSONPatch" which implements RFC 6902.
|
||||
// +optional
|
||||
Patch []byte `json:"patch,omitempty" protobuf:"bytes,4,opt,name=patch"`
|
||||
|
||||
// patchType is the type of Patch. Currently we only allow "JSONPatch".
|
||||
// +optional
|
||||
PatchType *PatchType `json:"patchType,omitempty" protobuf:"bytes,5,opt,name=patchType"`
|
||||
|
||||
// auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
|
||||
// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
|
||||
// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
|
||||
// the admission webhook to add additional context to the audit log for this request.
|
||||
// +optional
|
||||
AuditAnnotations map[string]string `json:"auditAnnotations,omitempty" protobuf:"bytes,6,opt,name=auditAnnotations"`
|
||||
|
||||
// warnings is a list of warning messages to return to the requesting API client.
|
||||
// Warning messages describe a problem the client making the API request should correct or be aware of.
|
||||
// Limit warnings to 120 characters if possible.
|
||||
// Warnings over 256 characters and large numbers of warnings may be truncated.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Warnings []string `json:"warnings,omitempty" protobuf:"bytes,7,rep,name=warnings"`
|
||||
}
|
||||
|
||||
// PatchType is the type of patch being used to represent the mutated object
|
||||
type PatchType string
|
||||
|
||||
// PatchType constants.
|
||||
const (
|
||||
PatchTypeJSONPatch PatchType = "JSONPatch"
|
||||
)
|
||||
|
||||
// Operation is the type of resource operation being checked for admission control
|
||||
type Operation string
|
||||
|
||||
// Operation constants
|
||||
const (
|
||||
Create Operation = "CREATE"
|
||||
Update Operation = "UPDATE"
|
||||
Delete Operation = "DELETE"
|
||||
Connect Operation = "CONNECT"
|
||||
)
|
||||
-78
@@ -1,78 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
// This file contains a collection of methods that can be used from go-restful to
|
||||
// generate Swagger API documentation for its models. Please read this PR for more
|
||||
// information on the implementation: https://github.com/emicklei/go-restful/pull/215
|
||||
//
|
||||
// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
|
||||
// they are on one line! For multiple line or blocks that you want to ignore use ---.
|
||||
// Any context after a --- is ignored.
|
||||
//
|
||||
// Those methods can be generated by using hack/update-codegen.sh
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_AdmissionRequest = map[string]string{
|
||||
"": "AdmissionRequest describes the admission.Attributes for the admission request.",
|
||||
"uid": "uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.",
|
||||
"kind": "kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)",
|
||||
"resource": "resource is the fully-qualified resource being requested (for example, v1.pods)",
|
||||
"subResource": "subResource is the subresource being requested, if any (for example, \"status\" or \"scale\")",
|
||||
"requestKind": "requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in \"kind\", an equivalent match and conversion was performed.\n\nFor example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]` and `matchPolicy: Equivalent`, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with `kind: {group:\"apps\", version:\"v1\", kind:\"Deployment\"}` (matching the rule the webhook registered for), and `requestKind: {group:\"apps\", version:\"v1beta1\", kind:\"Deployment\"}` (indicating the kind of the original API request).\n\nSee documentation for the \"matchPolicy\" field in the webhook configuration type for more details.",
|
||||
"requestResource": "requestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in \"resource\", an equivalent match and conversion was performed.\n\nFor example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]` and `matchPolicy: Equivalent`, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with `resource: {group:\"apps\", version:\"v1\", resource:\"deployments\"}` (matching the resource the webhook registered for), and `requestResource: {group:\"apps\", version:\"v1beta1\", resource:\"deployments\"}` (indicating the resource of the original API request).\n\nSee documentation for the \"matchPolicy\" field in the webhook configuration type.",
|
||||
"requestSubResource": "requestSubResource is the name of the subresource of the original API request, if any (for example, \"status\" or \"scale\") If this is specified and differs from the value in \"subResource\", an equivalent match and conversion was performed. See documentation for the \"matchPolicy\" field in the webhook configuration type.",
|
||||
"name": "name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and rely on the server to generate the name. If that is the case, this field will contain an empty string.",
|
||||
"namespace": "namespace is the namespace associated with the request (if any).",
|
||||
"operation": "operation is the operation being performed. This may be different than the operation requested. e.g. a patch can result in either a CREATE or UPDATE Operation.",
|
||||
"userInfo": "userInfo is information about the requesting user",
|
||||
"object": "object is the object from the incoming request.",
|
||||
"oldObject": "oldObject is the existing object. Only populated for DELETE and UPDATE requests.",
|
||||
"dryRun": "dryRun indicates that modifications will definitely not be persisted for this request. Defaults to false.",
|
||||
"options": "options is the operation option structure of the operation being performed. e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be different than the options the caller provided. e.g. for a patch request the performed Operation might be a CREATE, in which case the Options will a `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.",
|
||||
}
|
||||
|
||||
func (AdmissionRequest) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionRequest
|
||||
}
|
||||
|
||||
var map_AdmissionResponse = map[string]string{
|
||||
"": "AdmissionResponse describes an admission response.",
|
||||
"uid": "uid is an identifier for the individual request/response. This must be copied over from the corresponding AdmissionRequest.",
|
||||
"allowed": "allowed indicates whether or not the admission request was permitted.",
|
||||
"status": "status is the result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\".",
|
||||
"patch": "patch is the patch body. Currently we only support \"JSONPatch\" which implements RFC 6902.",
|
||||
"patchType": "patchType is the type of Patch. Currently we only allow \"JSONPatch\".",
|
||||
"auditAnnotations": "auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted). MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by the admission webhook to add additional context to the audit log for this request.",
|
||||
"warnings": "warnings is a list of warning messages to return to the requesting API client. Warning messages describe a problem the client making the API request should correct or be aware of. Limit warnings to 120 characters if possible. Warnings over 256 characters and large numbers of warnings may be truncated.",
|
||||
}
|
||||
|
||||
func (AdmissionResponse) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionResponse
|
||||
}
|
||||
|
||||
var map_AdmissionReview = map[string]string{
|
||||
"": "AdmissionReview describes an admission review request/response.",
|
||||
"request": "request describes the attributes for the admission request.",
|
||||
"response": "response describes the attributes for the admission response.",
|
||||
}
|
||||
|
||||
func (AdmissionReview) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionReview
|
||||
}
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS END HERE
|
||||
-142
@@ -1,142 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionRequest) DeepCopyInto(out *AdmissionRequest) {
|
||||
*out = *in
|
||||
out.Kind = in.Kind
|
||||
out.Resource = in.Resource
|
||||
if in.RequestKind != nil {
|
||||
in, out := &in.RequestKind, &out.RequestKind
|
||||
*out = new(metav1.GroupVersionKind)
|
||||
**out = **in
|
||||
}
|
||||
if in.RequestResource != nil {
|
||||
in, out := &in.RequestResource, &out.RequestResource
|
||||
*out = new(metav1.GroupVersionResource)
|
||||
**out = **in
|
||||
}
|
||||
in.UserInfo.DeepCopyInto(&out.UserInfo)
|
||||
in.Object.DeepCopyInto(&out.Object)
|
||||
in.OldObject.DeepCopyInto(&out.OldObject)
|
||||
if in.DryRun != nil {
|
||||
in, out := &in.DryRun, &out.DryRun
|
||||
*out = new(bool)
|
||||
**out = **in
|
||||
}
|
||||
in.Options.DeepCopyInto(&out.Options)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionRequest.
|
||||
func (in *AdmissionRequest) DeepCopy() *AdmissionRequest {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionRequest)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionResponse) DeepCopyInto(out *AdmissionResponse) {
|
||||
*out = *in
|
||||
if in.Result != nil {
|
||||
in, out := &in.Result, &out.Result
|
||||
*out = new(metav1.Status)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Patch != nil {
|
||||
in, out := &in.Patch, &out.Patch
|
||||
*out = make([]byte, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.PatchType != nil {
|
||||
in, out := &in.PatchType, &out.PatchType
|
||||
*out = new(PatchType)
|
||||
**out = **in
|
||||
}
|
||||
if in.AuditAnnotations != nil {
|
||||
in, out := &in.AuditAnnotations, &out.AuditAnnotations
|
||||
*out = make(map[string]string, len(*in))
|
||||
for key, val := range *in {
|
||||
(*out)[key] = val
|
||||
}
|
||||
}
|
||||
if in.Warnings != nil {
|
||||
in, out := &in.Warnings, &out.Warnings
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionResponse.
|
||||
func (in *AdmissionResponse) DeepCopy() *AdmissionResponse {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionResponse)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionReview) DeepCopyInto(out *AdmissionReview) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
if in.Request != nil {
|
||||
in, out := &in.Request, &out.Request
|
||||
*out = new(AdmissionRequest)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Response != nil {
|
||||
in, out := &in.Response, &out.Response
|
||||
*out = new(AdmissionResponse)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReview.
|
||||
func (in *AdmissionReview) DeepCopy() *AdmissionReview {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionReview)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *AdmissionReview) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
-37
@@ -1,37 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by openapi-gen. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionRequest) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1.AdmissionRequest"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionResponse) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1.AdmissionResponse"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionReview) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1.AdmissionReview"
|
||||
}
|
||||
-28
@@ -1,28 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *AdmissionReview) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 19
|
||||
}
|
||||
-25
@@ -1,25 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:protobuf-gen=package
|
||||
// +k8s:openapi-gen=false
|
||||
// +k8s:prerelease-lifecycle-gen=true
|
||||
// +k8s:openapi-model-package=io.k8s.api.admission.v1beta1
|
||||
|
||||
// +groupName=admission.k8s.io
|
||||
|
||||
package v1beta1
|
||||
-1619
File diff suppressed because it is too large
Load Diff
-168
@@ -1,168 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
||||
|
||||
syntax = "proto2";
|
||||
|
||||
package k8s.io.api.admission.v1beta1;
|
||||
|
||||
import "k8s.io/api/authentication/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/api/admission/v1beta1";
|
||||
|
||||
// AdmissionRequest describes the admission.Attributes for the admission request.
|
||||
message AdmissionRequest {
|
||||
// uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
optional string uid = 1;
|
||||
|
||||
// kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;
|
||||
|
||||
// resource is the fully-qualified resource being requested (for example, v1.pods)
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;
|
||||
|
||||
// subResource is the subresource being requested, if any (for example, "status" or "scale")
|
||||
// +optional
|
||||
optional string subResource = 4;
|
||||
|
||||
// requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
// If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
// and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind requestKind = 13;
|
||||
|
||||
// requestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
// If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource requestResource = 14;
|
||||
|
||||
// requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
// If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
optional string requestSubResource = 15;
|
||||
|
||||
// name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
// rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
// +optional
|
||||
optional string name = 5;
|
||||
|
||||
// namespace is the namespace associated with the request (if any).
|
||||
// +optional
|
||||
optional string namespace = 6;
|
||||
|
||||
// operation is the operation being performed. This may be different than the operation
|
||||
// requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
optional string operation = 7;
|
||||
|
||||
// userInfo is information about the requesting user
|
||||
optional .k8s.io.api.authentication.v1.UserInfo userInfo = 8;
|
||||
|
||||
// object is the object from the incoming request.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;
|
||||
|
||||
// oldObject is the existing object. Only populated for DELETE and UPDATE requests.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;
|
||||
|
||||
// dryRun indicates that modifications will definitely not be persisted for this request.
|
||||
// Defaults to false.
|
||||
// +optional
|
||||
optional bool dryRun = 11;
|
||||
|
||||
// options is the operation option structure of the operation being performed.
|
||||
// e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
// different than the options the caller provided. e.g. for a patch request the performed
|
||||
// Operation might be a CREATE, in which case the Options will a
|
||||
// `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.runtime.RawExtension options = 12;
|
||||
}
|
||||
|
||||
// AdmissionResponse describes an admission response.
|
||||
message AdmissionResponse {
|
||||
// uid is an identifier for the individual request/response.
|
||||
// This should be copied over from the corresponding AdmissionRequest.
|
||||
optional string uid = 1;
|
||||
|
||||
// allowed indicates whether or not the admission request was permitted.
|
||||
optional bool allowed = 2;
|
||||
|
||||
// status is the result contains extra details into why an admission request was denied.
|
||||
// This field IS NOT consulted in any way if "Allowed" is "true".
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;
|
||||
|
||||
// patch is the patch body. Currently we only support "JSONPatch" which implements RFC 6902.
|
||||
// +optional
|
||||
optional bytes patch = 4;
|
||||
|
||||
// patchType is the type of Patch. Currently we only allow "JSONPatch".
|
||||
// +optional
|
||||
optional string patchType = 5;
|
||||
|
||||
// auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
|
||||
// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
|
||||
// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
|
||||
// the admission webhook to add additional context to the audit log for this request.
|
||||
// +optional
|
||||
map<string, string> auditAnnotations = 6;
|
||||
|
||||
// warnings is a list of warning messages to return to the requesting API client.
|
||||
// Warning messages describe a problem the client making the API request should correct or be aware of.
|
||||
// Limit warnings to 120 characters if possible.
|
||||
// Warnings over 256 characters and large numbers of warnings may be truncated.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string warnings = 7;
|
||||
}
|
||||
|
||||
// AdmissionReview describes an admission review request/response.
|
||||
message AdmissionReview {
|
||||
// request describes the attributes for the admission request.
|
||||
// +optional
|
||||
optional AdmissionRequest request = 1;
|
||||
|
||||
// response describes the attributes for the admission response.
|
||||
// +optional
|
||||
optional AdmissionResponse response = 2;
|
||||
}
|
||||
|
||||
-28
@@ -1,28 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
func (*AdmissionRequest) ProtoMessage() {}
|
||||
|
||||
func (*AdmissionResponse) ProtoMessage() {}
|
||||
|
||||
func (*AdmissionReview) ProtoMessage() {}
|
||||
-53
@@ -1,53 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name for this API.
|
||||
const GroupName = "admission.k8s.io"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1beta1"}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
|
||||
// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
|
||||
var (
|
||||
// SchemeBuilder points to a list of functions added to Scheme.
|
||||
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
// AddToScheme is a common registration function for mapping packaged scoped group & version keys to a scheme.
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
// Adds the list of known types to the given scheme.
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&AdmissionReview{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
}
|
||||
-175
@@ -1,175 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
authenticationv1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
)
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.9
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.19
|
||||
// This API is never server served. It is used for outbound requests from apiservers. This will ensure it never gets served accidentally
|
||||
// and having the generator against this group will protect future APIs which may be served.
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=admission.k8s.io,v1,AdmissionReview
|
||||
|
||||
// AdmissionReview describes an admission review request/response.
|
||||
type AdmissionReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// request describes the attributes for the admission request.
|
||||
// +optional
|
||||
Request *AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`
|
||||
// response describes the attributes for the admission response.
|
||||
// +optional
|
||||
Response *AdmissionResponse `json:"response,omitempty" protobuf:"bytes,2,opt,name=response"`
|
||||
}
|
||||
|
||||
// AdmissionRequest describes the admission.Attributes for the admission request.
|
||||
type AdmissionRequest struct {
|
||||
// uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
|
||||
// kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
Kind metav1.GroupVersionKind `json:"kind" protobuf:"bytes,2,opt,name=kind"`
|
||||
// resource is the fully-qualified resource being requested (for example, v1.pods)
|
||||
Resource metav1.GroupVersionResource `json:"resource" protobuf:"bytes,3,opt,name=resource"`
|
||||
// subResource is the subresource being requested, if any (for example, "status" or "scale")
|
||||
// +optional
|
||||
SubResource string `json:"subResource,omitempty" protobuf:"bytes,4,opt,name=subResource"`
|
||||
|
||||
// requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
// If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
// and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
// +optional
|
||||
RequestKind *metav1.GroupVersionKind `json:"requestKind,omitempty" protobuf:"bytes,13,opt,name=requestKind"`
|
||||
// requestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
// If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
//
|
||||
// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
// an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
//
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
RequestResource *metav1.GroupVersionResource `json:"requestResource,omitempty" protobuf:"bytes,14,opt,name=requestResource"`
|
||||
// requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
// If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
// See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
// +optional
|
||||
RequestSubResource string `json:"requestSubResource,omitempty" protobuf:"bytes,15,opt,name=requestSubResource"`
|
||||
|
||||
// name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
// rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
// +optional
|
||||
Name string `json:"name,omitempty" protobuf:"bytes,5,opt,name=name"`
|
||||
// namespace is the namespace associated with the request (if any).
|
||||
// +optional
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,6,opt,name=namespace"`
|
||||
// operation is the operation being performed. This may be different than the operation
|
||||
// requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
Operation Operation `json:"operation" protobuf:"bytes,7,opt,name=operation"`
|
||||
// userInfo is information about the requesting user
|
||||
UserInfo authenticationv1.UserInfo `json:"userInfo" protobuf:"bytes,8,opt,name=userInfo"`
|
||||
// object is the object from the incoming request.
|
||||
// +optional
|
||||
Object runtime.RawExtension `json:"object,omitempty" protobuf:"bytes,9,opt,name=object"`
|
||||
// oldObject is the existing object. Only populated for DELETE and UPDATE requests.
|
||||
// +optional
|
||||
OldObject runtime.RawExtension `json:"oldObject,omitempty" protobuf:"bytes,10,opt,name=oldObject"`
|
||||
// dryRun indicates that modifications will definitely not be persisted for this request.
|
||||
// Defaults to false.
|
||||
// +optional
|
||||
DryRun *bool `json:"dryRun,omitempty" protobuf:"varint,11,opt,name=dryRun"`
|
||||
// options is the operation option structure of the operation being performed.
|
||||
// e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
// different than the options the caller provided. e.g. for a patch request the performed
|
||||
// Operation might be a CREATE, in which case the Options will a
|
||||
// `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
// +optional
|
||||
Options runtime.RawExtension `json:"options,omitempty" protobuf:"bytes,12,opt,name=options"`
|
||||
}
|
||||
|
||||
// AdmissionResponse describes an admission response.
|
||||
type AdmissionResponse struct {
|
||||
// uid is an identifier for the individual request/response.
|
||||
// This should be copied over from the corresponding AdmissionRequest.
|
||||
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
|
||||
|
||||
// allowed indicates whether or not the admission request was permitted.
|
||||
Allowed bool `json:"allowed" protobuf:"varint,2,opt,name=allowed"`
|
||||
|
||||
// status is the result contains extra details into why an admission request was denied.
|
||||
// This field IS NOT consulted in any way if "Allowed" is "true".
|
||||
// +optional
|
||||
Result *metav1.Status `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
|
||||
// patch is the patch body. Currently we only support "JSONPatch" which implements RFC 6902.
|
||||
// +optional
|
||||
Patch []byte `json:"patch,omitempty" protobuf:"bytes,4,opt,name=patch"`
|
||||
|
||||
// patchType is the type of Patch. Currently we only allow "JSONPatch".
|
||||
// +optional
|
||||
PatchType *PatchType `json:"patchType,omitempty" protobuf:"bytes,5,opt,name=patchType"`
|
||||
|
||||
// auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
|
||||
// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
|
||||
// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
|
||||
// the admission webhook to add additional context to the audit log for this request.
|
||||
// +optional
|
||||
AuditAnnotations map[string]string `json:"auditAnnotations,omitempty" protobuf:"bytes,6,opt,name=auditAnnotations"`
|
||||
|
||||
// warnings is a list of warning messages to return to the requesting API client.
|
||||
// Warning messages describe a problem the client making the API request should correct or be aware of.
|
||||
// Limit warnings to 120 characters if possible.
|
||||
// Warnings over 256 characters and large numbers of warnings may be truncated.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Warnings []string `json:"warnings,omitempty" protobuf:"bytes,7,rep,name=warnings"`
|
||||
}
|
||||
|
||||
// PatchType is the type of patch being used to represent the mutated object
|
||||
type PatchType string
|
||||
|
||||
// PatchType constants.
|
||||
const (
|
||||
PatchTypeJSONPatch PatchType = "JSONPatch"
|
||||
)
|
||||
|
||||
// Operation is the type of resource operation being checked for admission control
|
||||
type Operation string
|
||||
|
||||
// Operation constants
|
||||
const (
|
||||
Create Operation = "CREATE"
|
||||
Update Operation = "UPDATE"
|
||||
Delete Operation = "DELETE"
|
||||
Connect Operation = "CONNECT"
|
||||
)
|
||||
-78
@@ -1,78 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
// This file contains a collection of methods that can be used from go-restful to
|
||||
// generate Swagger API documentation for its models. Please read this PR for more
|
||||
// information on the implementation: https://github.com/emicklei/go-restful/pull/215
|
||||
//
|
||||
// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
|
||||
// they are on one line! For multiple line or blocks that you want to ignore use ---.
|
||||
// Any context after a --- is ignored.
|
||||
//
|
||||
// Those methods can be generated by using hack/update-codegen.sh
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_AdmissionRequest = map[string]string{
|
||||
"": "AdmissionRequest describes the admission.Attributes for the admission request.",
|
||||
"uid": "uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.",
|
||||
"kind": "kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)",
|
||||
"resource": "resource is the fully-qualified resource being requested (for example, v1.pods)",
|
||||
"subResource": "subResource is the subresource being requested, if any (for example, \"status\" or \"scale\")",
|
||||
"requestKind": "requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in \"kind\", an equivalent match and conversion was performed.\n\nFor example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]` and `matchPolicy: Equivalent`, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with `kind: {group:\"apps\", version:\"v1\", kind:\"Deployment\"}` (matching the rule the webhook registered for), and `requestKind: {group:\"apps\", version:\"v1beta1\", kind:\"Deployment\"}` (indicating the kind of the original API request).\n\nSee documentation for the \"matchPolicy\" field in the webhook configuration type for more details.",
|
||||
"requestResource": "requestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in \"resource\", an equivalent match and conversion was performed.\n\nFor example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]` and `matchPolicy: Equivalent`, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with `resource: {group:\"apps\", version:\"v1\", resource:\"deployments\"}` (matching the resource the webhook registered for), and `requestResource: {group:\"apps\", version:\"v1beta1\", resource:\"deployments\"}` (indicating the resource of the original API request).\n\nSee documentation for the \"matchPolicy\" field in the webhook configuration type.",
|
||||
"requestSubResource": "requestSubResource is the name of the subresource of the original API request, if any (for example, \"status\" or \"scale\") If this is specified and differs from the value in \"subResource\", an equivalent match and conversion was performed. See documentation for the \"matchPolicy\" field in the webhook configuration type.",
|
||||
"name": "name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and rely on the server to generate the name. If that is the case, this field will contain an empty string.",
|
||||
"namespace": "namespace is the namespace associated with the request (if any).",
|
||||
"operation": "operation is the operation being performed. This may be different than the operation requested. e.g. a patch can result in either a CREATE or UPDATE Operation.",
|
||||
"userInfo": "userInfo is information about the requesting user",
|
||||
"object": "object is the object from the incoming request.",
|
||||
"oldObject": "oldObject is the existing object. Only populated for DELETE and UPDATE requests.",
|
||||
"dryRun": "dryRun indicates that modifications will definitely not be persisted for this request. Defaults to false.",
|
||||
"options": "options is the operation option structure of the operation being performed. e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be different than the options the caller provided. e.g. for a patch request the performed Operation might be a CREATE, in which case the Options will a `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.",
|
||||
}
|
||||
|
||||
func (AdmissionRequest) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionRequest
|
||||
}
|
||||
|
||||
var map_AdmissionResponse = map[string]string{
|
||||
"": "AdmissionResponse describes an admission response.",
|
||||
"uid": "uid is an identifier for the individual request/response. This should be copied over from the corresponding AdmissionRequest.",
|
||||
"allowed": "allowed indicates whether or not the admission request was permitted.",
|
||||
"status": "status is the result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\".",
|
||||
"patch": "patch is the patch body. Currently we only support \"JSONPatch\" which implements RFC 6902.",
|
||||
"patchType": "patchType is the type of Patch. Currently we only allow \"JSONPatch\".",
|
||||
"auditAnnotations": "auditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted). MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by the admission webhook to add additional context to the audit log for this request.",
|
||||
"warnings": "warnings is a list of warning messages to return to the requesting API client. Warning messages describe a problem the client making the API request should correct or be aware of. Limit warnings to 120 characters if possible. Warnings over 256 characters and large numbers of warnings may be truncated.",
|
||||
}
|
||||
|
||||
func (AdmissionResponse) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionResponse
|
||||
}
|
||||
|
||||
var map_AdmissionReview = map[string]string{
|
||||
"": "AdmissionReview describes an admission review request/response.",
|
||||
"request": "request describes the attributes for the admission request.",
|
||||
"response": "response describes the attributes for the admission response.",
|
||||
}
|
||||
|
||||
func (AdmissionReview) SwaggerDoc() map[string]string {
|
||||
return map_AdmissionReview
|
||||
}
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS END HERE
|
||||
-142
@@ -1,142 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionRequest) DeepCopyInto(out *AdmissionRequest) {
|
||||
*out = *in
|
||||
out.Kind = in.Kind
|
||||
out.Resource = in.Resource
|
||||
if in.RequestKind != nil {
|
||||
in, out := &in.RequestKind, &out.RequestKind
|
||||
*out = new(v1.GroupVersionKind)
|
||||
**out = **in
|
||||
}
|
||||
if in.RequestResource != nil {
|
||||
in, out := &in.RequestResource, &out.RequestResource
|
||||
*out = new(v1.GroupVersionResource)
|
||||
**out = **in
|
||||
}
|
||||
in.UserInfo.DeepCopyInto(&out.UserInfo)
|
||||
in.Object.DeepCopyInto(&out.Object)
|
||||
in.OldObject.DeepCopyInto(&out.OldObject)
|
||||
if in.DryRun != nil {
|
||||
in, out := &in.DryRun, &out.DryRun
|
||||
*out = new(bool)
|
||||
**out = **in
|
||||
}
|
||||
in.Options.DeepCopyInto(&out.Options)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionRequest.
|
||||
func (in *AdmissionRequest) DeepCopy() *AdmissionRequest {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionRequest)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionResponse) DeepCopyInto(out *AdmissionResponse) {
|
||||
*out = *in
|
||||
if in.Result != nil {
|
||||
in, out := &in.Result, &out.Result
|
||||
*out = new(v1.Status)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Patch != nil {
|
||||
in, out := &in.Patch, &out.Patch
|
||||
*out = make([]byte, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.PatchType != nil {
|
||||
in, out := &in.PatchType, &out.PatchType
|
||||
*out = new(PatchType)
|
||||
**out = **in
|
||||
}
|
||||
if in.AuditAnnotations != nil {
|
||||
in, out := &in.AuditAnnotations, &out.AuditAnnotations
|
||||
*out = make(map[string]string, len(*in))
|
||||
for key, val := range *in {
|
||||
(*out)[key] = val
|
||||
}
|
||||
}
|
||||
if in.Warnings != nil {
|
||||
in, out := &in.Warnings, &out.Warnings
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionResponse.
|
||||
func (in *AdmissionResponse) DeepCopy() *AdmissionResponse {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionResponse)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AdmissionReview) DeepCopyInto(out *AdmissionReview) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
if in.Request != nil {
|
||||
in, out := &in.Request, &out.Request
|
||||
*out = new(AdmissionRequest)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Response != nil {
|
||||
in, out := &in.Response, &out.Response
|
||||
*out = new(AdmissionResponse)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReview.
|
||||
func (in *AdmissionReview) DeepCopy() *AdmissionReview {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AdmissionReview)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *AdmissionReview) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
-37
@@ -1,37 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by openapi-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionRequest) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1beta1.AdmissionRequest"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionResponse) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1beta1.AdmissionResponse"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AdmissionReview) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admission.v1beta1.AdmissionReview"
|
||||
}
|
||||
-50
@@ -1,50 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *AdmissionReview) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 9
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *AdmissionReview) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 19
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *AdmissionReview) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "admission.k8s.io", Version: "v1", Kind: "AdmissionReview"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *AdmissionReview) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 22
|
||||
}
|
||||
+1976
File diff suppressed because it is too large
Load Diff
+378
-72
@@ -28,6 +28,51 @@ import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/api/admissionregistration/v1";
|
||||
|
||||
// ApplyConfiguration defines the desired configuration values of an object.
|
||||
message ApplyConfiguration {
|
||||
// expression will be evaluated by CEL to create an apply configuration.
|
||||
// ref: https://github.com/google/cel-spec
|
||||
//
|
||||
// Apply configurations are declared in CEL using object initialization. For example, this CEL expression
|
||||
// returns an apply configuration to set a single field:
|
||||
//
|
||||
// Object{
|
||||
// spec: Object.spec{
|
||||
// serviceAccountName: "example"
|
||||
// }
|
||||
// }
|
||||
//
|
||||
// Apply configurations may not modify atomic structs, maps or arrays due to the risk of accidental deletion of
|
||||
// values not included in the apply configuration.
|
||||
//
|
||||
// CEL expressions have access to the object types needed to create apply configurations:
|
||||
//
|
||||
// - 'Object' - CEL type of the resource object.
|
||||
// - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec')
|
||||
// - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')
|
||||
//
|
||||
// CEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
// - 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
// - 'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
// - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
|
||||
// - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
|
||||
// - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.
|
||||
// - 'variables' - Map of composited variables, from its name to its lazily evaluated value.
|
||||
// For example, a variable named 'foo' can be accessed as 'variables.foo'.
|
||||
// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
// See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
// request resource.
|
||||
//
|
||||
// The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the
|
||||
// object. No other metadata properties are accessible.
|
||||
//
|
||||
// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
|
||||
// Required.
|
||||
optional string expression = 1;
|
||||
}
|
||||
|
||||
// AuditAnnotation describes how to produce an audit annotation for an API request.
|
||||
message AuditAnnotation {
|
||||
// key specifies the audit annotation key. The audit annotation keys of
|
||||
@@ -67,20 +112,89 @@ message AuditAnnotation {
|
||||
|
||||
// ExpressionWarning is a warning information that targets a specific expression.
|
||||
message ExpressionWarning {
|
||||
// The path to the field that refers the expression.
|
||||
// fieldRef is the path to the field that refers to the expression.
|
||||
// For example, the reference to the expression of the first item of
|
||||
// validations is "spec.validations[0].expression"
|
||||
optional string fieldRef = 2;
|
||||
|
||||
// The content of type checking information in a human-readable form.
|
||||
// warning contains the content of type checking information in a human-readable form.
|
||||
// Each line of the warning contains the type that the expression is checked
|
||||
// against, followed by the type check error from the compiler.
|
||||
optional string warning = 3;
|
||||
}
|
||||
|
||||
// JSONPatch defines a JSON Patch.
|
||||
message JSONPatch {
|
||||
// expression will be evaluated by CEL to create a [JSON patch](https://jsonpatch.com/).
|
||||
// ref: https://github.com/google/cel-spec
|
||||
//
|
||||
// expression must return an array of JSONPatch values.
|
||||
//
|
||||
// For example, this CEL expression returns a JSON patch to conditionally modify a value:
|
||||
//
|
||||
// [
|
||||
// JSONPatch{op: "test", path: "/spec/example", value: "Red"},
|
||||
// JSONPatch{op: "replace", path: "/spec/example", value: "Green"}
|
||||
// ]
|
||||
//
|
||||
// To define an object for the patch value, use Object types. For example:
|
||||
//
|
||||
// [
|
||||
// JSONPatch{
|
||||
// op: "add",
|
||||
// path: "/spec/selector",
|
||||
// value: Object.spec.selector{matchLabels: {"environment": "test"}}
|
||||
// }
|
||||
// ]
|
||||
//
|
||||
// To use strings containing '/' and '~' as JSONPatch path keys, use "jsonpatch.escapeKey". For example:
|
||||
//
|
||||
// [
|
||||
// JSONPatch{
|
||||
// op: "add",
|
||||
// path: "/metadata/labels/" + jsonpatch.escapeKey("example.com/environment"),
|
||||
// value: "test"
|
||||
// },
|
||||
// ]
|
||||
//
|
||||
// CEL expressions have access to the types needed to create JSON patches and objects:
|
||||
//
|
||||
// - 'JSONPatch' - CEL type of JSON Patch operations. JSONPatch has the fields 'op', 'from', 'path' and 'value'.
|
||||
// See [JSON patch](https://jsonpatch.com/) for more details. The 'value' field may be set to any of: string,
|
||||
// integer, array, map or object. If set, the 'path' and 'from' fields must be set to a
|
||||
// [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) string, where the 'jsonpatch.escapeKey()' CEL
|
||||
// function may be used to escape path keys containing '/' and '~'.
|
||||
// - 'Object' - CEL type of the resource object.
|
||||
// - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec')
|
||||
// - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')
|
||||
//
|
||||
// CEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
// - 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
// - 'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
// - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
|
||||
// - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
|
||||
// - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.
|
||||
// - 'variables' - Map of composited variables, from its name to its lazily evaluated value.
|
||||
// For example, a variable named 'foo' can be accessed as 'variables.foo'.
|
||||
// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
// See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
// request resource.
|
||||
//
|
||||
// CEL expressions have access to [Kubernetes CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)
|
||||
// as well as:
|
||||
//
|
||||
// - 'jsonpatch.escapeKey' - Performs JSONPatch key escaping. '~' and '/' are escaped as '~0' and `~1' respectively).
|
||||
//
|
||||
// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
|
||||
// Required.
|
||||
optional string expression = 1;
|
||||
}
|
||||
|
||||
// MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.
|
||||
message MatchCondition {
|
||||
// Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
// the associated expression.
|
||||
// Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
@@ -91,7 +205,7 @@ message MatchCondition {
|
||||
// Required.
|
||||
optional string name = 1;
|
||||
|
||||
// Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
//
|
||||
// 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
@@ -112,7 +226,7 @@ message MatchCondition {
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +structType=atomic
|
||||
message MatchResources {
|
||||
// NamespaceSelector decides whether to run the admission control policy on an object based
|
||||
// namespaceSelector decides whether to run the admission control policy on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -158,7 +272,7 @@ message MatchResources {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 1;
|
||||
|
||||
// ObjectSelector decides whether to run the validation based on if the
|
||||
// objectSelector decides whether to run the validation based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the cel validation, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -172,13 +286,13 @@ message MatchResources {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 2;
|
||||
|
||||
// ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
|
||||
// resourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
|
||||
// The policy cares about an operation if it matches _any_ Rule.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
repeated NamedRuleWithOperations resourceRules = 3;
|
||||
|
||||
// ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
|
||||
// excludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
@@ -202,20 +316,187 @@ message MatchResources {
|
||||
optional string matchPolicy = 7;
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
|
||||
message MutatingAdmissionPolicy {
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicy.
|
||||
optional MutatingAdmissionPolicySpec spec = 2;
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources.
|
||||
// MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators
|
||||
// configure policies for clusters.
|
||||
//
|
||||
// For a given admission request, each binding will cause its policy to be
|
||||
// evaluated N times, where N is 1 for policies/bindings that don't use
|
||||
// params, otherwise N is the number of parameters selected by the binding.
|
||||
// Each evaluation is constrained by a [runtime cost budget](https://kubernetes.io/docs/reference/using-api/cel/#runtime-cost-budget).
|
||||
//
|
||||
// Adding/removing policies, bindings, or params can not affect whether a
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
message MutatingAdmissionPolicyBinding {
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
optional MutatingAdmissionPolicyBindingSpec spec = 2;
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.
|
||||
message MutatingAdmissionPolicyBindingList {
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
|
||||
// List of PolicyBinding.
|
||||
repeated MutatingAdmissionPolicyBinding items = 2;
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicyBindingSpec defines the specification of the MutatingAdmissionPolicyBinding.
|
||||
message MutatingAdmissionPolicyBindingSpec {
|
||||
// policyName references a MutatingAdmissionPolicy name which the MutatingAdmissionPolicyBinding binds to.
|
||||
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
|
||||
// Required.
|
||||
optional string policyName = 1;
|
||||
|
||||
// paramRef specifies the parameter resource used to configure the admission control policy.
|
||||
// It should point to a resource of the type specified in spec.ParamKind of the bound MutatingAdmissionPolicy.
|
||||
// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the MutatingAdmissionPolicy applied.
|
||||
// If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
|
||||
// +optional
|
||||
optional ParamRef paramRef = 2;
|
||||
|
||||
// matchResources limits what resources match this binding and may be mutated by it.
|
||||
// Note that if matchResources matches a resource, the resource must also match a policy's matchConstraints and
|
||||
// matchConditions before the resource may be mutated.
|
||||
// When matchResources is unset, it does not constrain resource matching, and only the policy's matchConstraints
|
||||
// and matchConditions must match for the resource to be mutated.
|
||||
// Additionally, matchResources.resourceRules are optional and do not constraint matching when unset.
|
||||
// Note that this is differs from MutatingAdmissionPolicy matchConstraints, where resourceRules are required.
|
||||
// The CREATE, UPDATE and CONNECT operations are allowed. The DELETE operation may not be matched.
|
||||
// '*' matches CREATE, UPDATE and CONNECT.
|
||||
// +optional
|
||||
optional MatchResources matchResources = 3;
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.
|
||||
message MutatingAdmissionPolicyList {
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
|
||||
// List of ValidatingAdmissionPolicy.
|
||||
repeated MutatingAdmissionPolicy items = 2;
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicySpec defines the desired behavior of the admission policy.
|
||||
message MutatingAdmissionPolicySpec {
|
||||
// paramKind specifies the kind of resources used to parameterize this policy.
|
||||
// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
|
||||
// If paramKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
|
||||
// If paramKind is specified but paramRef is unset in MutatingAdmissionPolicyBinding, the params variable will be null.
|
||||
// +optional
|
||||
optional ParamKind paramKind = 1;
|
||||
|
||||
// matchConstraints specifies what resources this policy is designed to validate.
|
||||
// The MutatingAdmissionPolicy cares about a request if it matches _all_ Constraints.
|
||||
// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
|
||||
// MutatingAdmissionPolicy cannot match MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding.
|
||||
// The CREATE, UPDATE and CONNECT operations are allowed. The DELETE operation may not be matched.
|
||||
// '*' matches CREATE, UPDATE and CONNECT.
|
||||
// Required.
|
||||
optional MatchResources matchConstraints = 2;
|
||||
|
||||
// variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// Each variable is defined as a named CEL expression.
|
||||
// The variables defined here will be available under `variables` in other expressions of the policy
|
||||
// except matchConditions because matchConditions are evaluated before the rest of the policy.
|
||||
//
|
||||
// The expression of a variable can refer to other variables defined earlier in the list but not those after.
|
||||
// Thus, variables must be sorted by the order of first appearance and acyclic.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
repeated Variable variables = 3;
|
||||
|
||||
// mutations contain operations to perform on matching objects.
|
||||
// mutations may not be empty; a minimum of one mutation is required.
|
||||
// mutations are evaluated in order, and are reinvoked according to
|
||||
// the reinvocationPolicy.
|
||||
// The mutations of a policy are invoked for each binding of this policy
|
||||
// and reinvocation of mutations occurs on a per binding basis.
|
||||
//
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
repeated Mutation mutations = 4;
|
||||
|
||||
// failurePolicy defines how to handle failures for the admission policy. Failures can
|
||||
// occur from CEL expression parse errors, type check errors, runtime errors and invalid
|
||||
// or mis-configured policy definitions or bindings.
|
||||
//
|
||||
// A policy is invalid if paramKind refers to a non-existent Kind.
|
||||
// A binding is invalid if paramRef.name refers to a non-existent resource.
|
||||
//
|
||||
// failurePolicy does not define how validations that evaluate to false are handled.
|
||||
//
|
||||
// Allowed values are Ignore or Fail. Defaults to Fail.
|
||||
// +optional
|
||||
optional string failurePolicy = 5;
|
||||
|
||||
// matchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// Match conditions filter requests that have already been matched by the matchConstraints.
|
||||
// An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
//
|
||||
// If a parameter object is provided, it can be accessed via the `params` handle in the same
|
||||
// manner as validation expressions.
|
||||
//
|
||||
// The exact matching logic is (in order):
|
||||
// 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
|
||||
// 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
|
||||
// 3. If any matchCondition evaluates to an error (but none are FALSE):
|
||||
// - If failurePolicy=Fail, reject the request
|
||||
// - If failurePolicy=Ignore, the policy is skipped
|
||||
//
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
// +listType=map
|
||||
// +listMapKey=name
|
||||
// +optional
|
||||
repeated MatchCondition matchConditions = 6;
|
||||
|
||||
// reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding
|
||||
// as part of a single admission evaluation.
|
||||
// Allowed values are "Never" and "IfNeeded".
|
||||
//
|
||||
// Never: These mutations will not be called more than once per binding in a single admission evaluation.
|
||||
//
|
||||
// IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of
|
||||
// order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only
|
||||
// reinvoked when mutations change the object after this mutation is invoked.
|
||||
// Required.
|
||||
optional string reinvocationPolicy = 7;
|
||||
}
|
||||
|
||||
// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
|
||||
message MutatingWebhook {
|
||||
// The name of the admission webhook.
|
||||
// name is the name of the admission webhook.
|
||||
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
||||
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
||||
// of the organization.
|
||||
// Required.
|
||||
optional string name = 1;
|
||||
|
||||
// ClientConfig defines how to communicate with the hook.
|
||||
// clientConfig defines how to communicate with the hook.
|
||||
// Required
|
||||
optional WebhookClientConfig clientConfig = 2;
|
||||
|
||||
// Rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// The webhook cares about an operation if it matches _any_ Rule.
|
||||
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
||||
// from putting the cluster in a state which cannot be recovered from without completely
|
||||
@@ -224,7 +505,7 @@ message MutatingWebhook {
|
||||
// +listType=atomic
|
||||
repeated RuleWithOperations rules = 3;
|
||||
|
||||
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// allowed values are Ignore or Fail. Defaults to Fail.
|
||||
// +optional
|
||||
optional string failurePolicy = 4;
|
||||
@@ -246,7 +527,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional string matchPolicy = 9;
|
||||
|
||||
// NamespaceSelector decides whether to run the webhook on an object based
|
||||
// namespaceSelector decides whether to run the webhook on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -292,7 +573,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 5;
|
||||
|
||||
// ObjectSelector decides whether to run the webhook based on if the
|
||||
// objectSelector decides whether to run the webhook based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the webhook, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -306,7 +587,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 11;
|
||||
|
||||
// SideEffects states whether this webhook has side effects.
|
||||
// sideEffects states whether this webhook has side effects.
|
||||
// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
|
||||
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
||||
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
||||
@@ -314,7 +595,7 @@ message MutatingWebhook {
|
||||
// sideEffects == Unknown or Some.
|
||||
optional string sideEffects = 6;
|
||||
|
||||
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// the webhook call will be ignored or the API call will fail based on the
|
||||
// failure policy.
|
||||
// The timeout value must be between 1 and 30 seconds.
|
||||
@@ -322,7 +603,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional int32 timeoutSeconds = 7;
|
||||
|
||||
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// versions the Webhook expects. API server will try to use first version in
|
||||
// the list which it supports. If none of the versions specified in this list
|
||||
// supported by API server, validation will fail for this object.
|
||||
@@ -350,7 +631,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional string reinvocationPolicy = 10;
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// matchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// webhook. Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -372,11 +653,11 @@ message MutatingWebhook {
|
||||
|
||||
// MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
|
||||
message MutatingWebhookConfiguration {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Webhooks is a list of webhooks and the affected resources and operations.
|
||||
// webhooks is a list of webhooks and the affected resources and operations.
|
||||
// +optional
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
@@ -387,7 +668,7 @@ message MutatingWebhookConfiguration {
|
||||
|
||||
// MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
|
||||
message MutatingWebhookConfigurationList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -396,10 +677,30 @@ message MutatingWebhookConfigurationList {
|
||||
repeated MutatingWebhookConfiguration items = 2;
|
||||
}
|
||||
|
||||
// Mutation specifies the CEL expression which is used to apply the Mutation.
|
||||
message Mutation {
|
||||
// patchType indicates the patch strategy used.
|
||||
// Allowed values are "ApplyConfiguration" and "JSONPatch".
|
||||
// Required.
|
||||
//
|
||||
// +unionDiscriminator
|
||||
optional string patchType = 2;
|
||||
|
||||
// applyConfiguration defines the desired configuration values of an object.
|
||||
// The configuration is applied to the admission object using
|
||||
// [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff).
|
||||
// A CEL expression is used to create apply configuration.
|
||||
optional ApplyConfiguration applyConfiguration = 3;
|
||||
|
||||
// jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object.
|
||||
// A CEL expression is used to create the JSON patch.
|
||||
optional JSONPatch jsonPatch = 4;
|
||||
}
|
||||
|
||||
// NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
|
||||
// +structType=atomic
|
||||
message NamedRuleWithOperations {
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
repeated string resourceNames = 1;
|
||||
@@ -411,12 +712,12 @@ message NamedRuleWithOperations {
|
||||
// ParamKind is a tuple of Group Kind and Version.
|
||||
// +structType=atomic
|
||||
message ParamKind {
|
||||
// APIVersion is the API group version the resources belong to.
|
||||
// apiVersion is the API group version the resources belong to.
|
||||
// In format of "group/version".
|
||||
// Required.
|
||||
optional string apiVersion = 1;
|
||||
|
||||
// Kind is the API kind the resources belong to.
|
||||
// kind is the API kind the resources belong to.
|
||||
// Required.
|
||||
optional string kind = 2;
|
||||
}
|
||||
@@ -465,7 +766,7 @@ message ParamRef {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 3;
|
||||
|
||||
// `parameterNotFoundAction` controls the behavior of the binding when the resource
|
||||
// parameterNotFoundAction controls the behavior of the binding when the resource
|
||||
// exists, and name or selector is valid, but there are no parameters
|
||||
// matched by the binding. If the value is set to `Allow`, then no
|
||||
// matched parameters will be treated as successful validation by the binding.
|
||||
@@ -481,19 +782,19 @@ message ParamRef {
|
||||
// Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended
|
||||
// to make sure that all the tuple expansions are valid.
|
||||
message Rule {
|
||||
// APIGroups is the API groups the resources belong to. '*' is all groups.
|
||||
// apiGroups is the API groups the resources belong to. '*' is all groups.
|
||||
// If '*' is present, the length of the slice must be one.
|
||||
// Required.
|
||||
// +listType=atomic
|
||||
repeated string apiGroups = 1;
|
||||
|
||||
// APIVersions is the API versions the resources belong to. '*' is all versions.
|
||||
// apiVersions is the API versions the resources belong to. '*' is all versions.
|
||||
// If '*' is present, the length of the slice must be one.
|
||||
// Required.
|
||||
// +listType=atomic
|
||||
repeated string apiVersions = 2;
|
||||
|
||||
// Resources is a list of resources this rule applies to.
|
||||
// resources is a list of resources this rule applies to.
|
||||
//
|
||||
// For example:
|
||||
// 'pods' means pods.
|
||||
@@ -527,7 +828,7 @@ message Rule {
|
||||
// RuleWithOperations is a tuple of Operations and Resources. It is recommended to make
|
||||
// sure that all the tuple expansions are valid.
|
||||
message RuleWithOperations {
|
||||
// Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
|
||||
// operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
|
||||
// for all of those operations and any future admission operations that are added.
|
||||
// If '*' is present, the length of the slice must be one.
|
||||
// Required.
|
||||
@@ -541,20 +842,20 @@ message RuleWithOperations {
|
||||
|
||||
// ServiceReference holds a reference to Service.legacy.k8s.io
|
||||
message ServiceReference {
|
||||
// `namespace` is the namespace of the service.
|
||||
// namespace is the namespace of the service.
|
||||
// Required
|
||||
optional string namespace = 1;
|
||||
|
||||
// `name` is the name of the service.
|
||||
// name is the name of the service.
|
||||
// Required
|
||||
optional string name = 2;
|
||||
|
||||
// `path` is an optional URL path which will be sent in any request to
|
||||
// path is an optional URL path which will be sent in any request to
|
||||
// this service.
|
||||
// +optional
|
||||
optional string path = 3;
|
||||
|
||||
// If specified, the port on the service that hosting webhook.
|
||||
// port is the port on the service that hosts the webhook.
|
||||
// Default to 443 for backward compatibility.
|
||||
// `port` should be a valid port number (1-65535, inclusive).
|
||||
// +optional
|
||||
@@ -564,7 +865,7 @@ message ServiceReference {
|
||||
// TypeChecking contains results of type checking the expressions in the
|
||||
// ValidatingAdmissionPolicy
|
||||
message TypeChecking {
|
||||
// The type checking warnings for each expression.
|
||||
// expressionWarnings contains the type checking warnings for each expression.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated ExpressionWarning expressionWarnings = 1;
|
||||
@@ -572,14 +873,14 @@ message TypeChecking {
|
||||
|
||||
// ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
|
||||
message ValidatingAdmissionPolicy {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicy.
|
||||
optional ValidatingAdmissionPolicySpec spec = 2;
|
||||
|
||||
// The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// behaves in the expected way.
|
||||
// Populated by the system.
|
||||
// Read-only.
|
||||
@@ -599,17 +900,18 @@ message ValidatingAdmissionPolicy {
|
||||
// Adding/removing policies, bindings, or params can not affect whether a
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
message ValidatingAdmissionPolicyBinding {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// +required
|
||||
optional ValidatingAdmissionPolicyBindingSpec spec = 2;
|
||||
}
|
||||
|
||||
// ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.
|
||||
message ValidatingAdmissionPolicyBindingList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -620,9 +922,11 @@ message ValidatingAdmissionPolicyBindingList {
|
||||
|
||||
// ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
|
||||
message ValidatingAdmissionPolicyBindingSpec {
|
||||
// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
|
||||
// Required.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
optional string policyName = 1;
|
||||
|
||||
// paramRef specifies the parameter resource used to configure the admission control policy.
|
||||
@@ -632,7 +936,7 @@ message ValidatingAdmissionPolicyBindingSpec {
|
||||
// +optional
|
||||
optional ParamRef paramRef = 2;
|
||||
|
||||
// MatchResources declares what resources match this binding and will be validated by it.
|
||||
// matchResources declares what resources match this binding and will be validated by it.
|
||||
// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
|
||||
// If this is unset, all resources matched by the policy are validated by this binding
|
||||
// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
|
||||
@@ -680,12 +984,14 @@ message ValidatingAdmissionPolicyBindingSpec {
|
||||
//
|
||||
// Required.
|
||||
// +listType=set
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
repeated string validationActions = 4;
|
||||
}
|
||||
|
||||
// ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.
|
||||
message ValidatingAdmissionPolicyList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -696,21 +1002,21 @@ message ValidatingAdmissionPolicyList {
|
||||
|
||||
// ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
|
||||
message ValidatingAdmissionPolicySpec {
|
||||
// ParamKind specifies the kind of resources used to parameterize this policy.
|
||||
// paramKind specifies the kind of resources used to parameterize this policy.
|
||||
// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
|
||||
// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
|
||||
// If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
|
||||
// +optional
|
||||
optional ParamKind paramKind = 1;
|
||||
|
||||
// MatchConstraints specifies what resources this policy is designed to validate.
|
||||
// matchConstraints specifies what resources this policy is designed to validate.
|
||||
// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
|
||||
// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
|
||||
// ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
|
||||
// Required.
|
||||
optional MatchResources matchConstraints = 2;
|
||||
|
||||
// Validations contain CEL expressions which is used to apply the validation.
|
||||
// validations contain CEL expressions which is used to apply the validation.
|
||||
// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
|
||||
// required.
|
||||
// +listType=atomic
|
||||
@@ -741,7 +1047,7 @@ message ValidatingAdmissionPolicySpec {
|
||||
// +optional
|
||||
repeated AuditAnnotation auditAnnotations = 5;
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// matchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -763,7 +1069,7 @@ message ValidatingAdmissionPolicySpec {
|
||||
// +optional
|
||||
repeated MatchCondition matchConditions = 6;
|
||||
|
||||
// Variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// Each variable is defined as a named CEL expression.
|
||||
// The variables defined here will be available under `variables` in other expressions of the policy
|
||||
// except MatchConditions because MatchConditions are evaluated before the rest of the policy.
|
||||
@@ -780,16 +1086,16 @@ message ValidatingAdmissionPolicySpec {
|
||||
|
||||
// ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.
|
||||
message ValidatingAdmissionPolicyStatus {
|
||||
// The generation observed by the controller.
|
||||
// observedGeneration is the generation observed by the controller.
|
||||
// +optional
|
||||
optional int64 observedGeneration = 1;
|
||||
|
||||
// The results of type checking for each expression.
|
||||
// typeChecking contains the results of type checking for each expression.
|
||||
// Presence of this field indicates the completion of the type checking.
|
||||
// +optional
|
||||
optional TypeChecking typeChecking = 2;
|
||||
|
||||
// The conditions represent the latest available observations of a policy's current state.
|
||||
// conditions represent the latest available observations of a policy's current state.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=type
|
||||
@@ -798,18 +1104,18 @@ message ValidatingAdmissionPolicyStatus {
|
||||
|
||||
// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
|
||||
message ValidatingWebhook {
|
||||
// The name of the admission webhook.
|
||||
// name is the name of the admission webhook.
|
||||
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
||||
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
||||
// of the organization.
|
||||
// Required.
|
||||
optional string name = 1;
|
||||
|
||||
// ClientConfig defines how to communicate with the hook.
|
||||
// clientConfig defines how to communicate with the hook.
|
||||
// Required
|
||||
optional WebhookClientConfig clientConfig = 2;
|
||||
|
||||
// Rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// The webhook cares about an operation if it matches _any_ Rule.
|
||||
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
||||
// from putting the cluster in a state which cannot be recovered from without completely
|
||||
@@ -818,7 +1124,7 @@ message ValidatingWebhook {
|
||||
// +listType=atomic
|
||||
repeated RuleWithOperations rules = 3;
|
||||
|
||||
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// allowed values are Ignore or Fail. Defaults to Fail.
|
||||
// +optional
|
||||
optional string failurePolicy = 4;
|
||||
@@ -840,7 +1146,7 @@ message ValidatingWebhook {
|
||||
// +optional
|
||||
optional string matchPolicy = 9;
|
||||
|
||||
// NamespaceSelector decides whether to run the webhook on an object based
|
||||
// namespaceSelector decides whether to run the webhook on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -886,7 +1192,7 @@ message ValidatingWebhook {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 5;
|
||||
|
||||
// ObjectSelector decides whether to run the webhook based on if the
|
||||
// objectSelector decides whether to run the webhook based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the webhook, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -900,7 +1206,7 @@ message ValidatingWebhook {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 10;
|
||||
|
||||
// SideEffects states whether this webhook has side effects.
|
||||
// sideEffects states whether this webhook has side effects.
|
||||
// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
|
||||
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
||||
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
||||
@@ -908,7 +1214,7 @@ message ValidatingWebhook {
|
||||
// sideEffects == Unknown or Some.
|
||||
optional string sideEffects = 6;
|
||||
|
||||
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// the webhook call will be ignored or the API call will fail based on the
|
||||
// failure policy.
|
||||
// The timeout value must be between 1 and 30 seconds.
|
||||
@@ -916,7 +1222,7 @@ message ValidatingWebhook {
|
||||
// +optional
|
||||
optional int32 timeoutSeconds = 7;
|
||||
|
||||
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// versions the Webhook expects. API server will try to use first version in
|
||||
// the list which it supports. If none of the versions specified in this list
|
||||
// supported by API server, validation will fail for this object.
|
||||
@@ -926,7 +1232,7 @@ message ValidatingWebhook {
|
||||
// +listType=atomic
|
||||
repeated string admissionReviewVersions = 8;
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// matchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// webhook. Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -948,11 +1254,11 @@ message ValidatingWebhook {
|
||||
|
||||
// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
|
||||
message ValidatingWebhookConfiguration {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Webhooks is a list of webhooks and the affected resources and operations.
|
||||
// webhooks is a list of webhooks and the affected resources and operations.
|
||||
// +optional
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
@@ -963,7 +1269,7 @@ message ValidatingWebhookConfiguration {
|
||||
|
||||
// ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
|
||||
message ValidatingWebhookConfigurationList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -974,7 +1280,7 @@ message ValidatingWebhookConfigurationList {
|
||||
|
||||
// Validation specifies the CEL expression which is used to apply the validation.
|
||||
message Validation {
|
||||
// Expression represents the expression which will be evaluated by CEL.
|
||||
// expression represents the expression which will be evaluated by CEL.
|
||||
// ref: https://github.com/google/cel-spec
|
||||
// CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
@@ -1017,7 +1323,7 @@ message Validation {
|
||||
// Required.
|
||||
optional string Expression = 1;
|
||||
|
||||
// Message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// line breaks. The message must not contain line breaks.
|
||||
// If unset, the message is "failed rule: {Rule}".
|
||||
// e.g. "must be a URL with the host matching spec.host"
|
||||
@@ -1027,7 +1333,7 @@ message Validation {
|
||||
// +optional
|
||||
optional string message = 2;
|
||||
|
||||
// Reason represents a machine-readable description of why this validation failed.
|
||||
// reason represents a machine-readable description of why this validation failed.
|
||||
// If this is the first validation in the list to fail, this reason, as well as the
|
||||
// corresponding HTTP response code, are used in the
|
||||
// HTTP response to the client.
|
||||
@@ -1053,12 +1359,12 @@ message Validation {
|
||||
// Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.
|
||||
// +structType=atomic
|
||||
message Variable {
|
||||
// Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// The variable can be accessed in other expressions through `variables`
|
||||
// For example, if name is "foo", the variable will be available as `variables.foo`
|
||||
optional string Name = 1;
|
||||
|
||||
// Expression is the expression that will be evaluated as the value of the variable.
|
||||
// expression is the expression that will be evaluated as the value of the variable.
|
||||
// The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
||||
optional string Expression = 2;
|
||||
}
|
||||
@@ -1066,7 +1372,7 @@ message Variable {
|
||||
// WebhookClientConfig contains the information to make a TLS
|
||||
// connection with the webhook
|
||||
message WebhookClientConfig {
|
||||
// `url` gives the location of the webhook, in standard URL form
|
||||
// url gives the location of the webhook, in standard URL form
|
||||
// (`scheme://host:port/path`). Exactly one of `url` or `service`
|
||||
// must be specified.
|
||||
//
|
||||
@@ -1095,7 +1401,7 @@ message WebhookClientConfig {
|
||||
// +optional
|
||||
optional string url = 3;
|
||||
|
||||
// `service` is a reference to the service for this webhook. Either
|
||||
// service is a reference to the service for this webhook. Either
|
||||
// `service` or `url` must be specified.
|
||||
//
|
||||
// If the webhook is running within the cluster, then you should use `service`.
|
||||
@@ -1103,7 +1409,7 @@ message WebhookClientConfig {
|
||||
// +optional
|
||||
optional ServiceReference service = 1;
|
||||
|
||||
// `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
|
||||
// caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
|
||||
// If unspecified, system trust roots on the apiserver are used.
|
||||
// +optional
|
||||
optional bytes caBundle = 2;
|
||||
|
||||
-76
@@ -1,76 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
func (*AuditAnnotation) ProtoMessage() {}
|
||||
|
||||
func (*ExpressionWarning) ProtoMessage() {}
|
||||
|
||||
func (*MatchCondition) ProtoMessage() {}
|
||||
|
||||
func (*MatchResources) ProtoMessage() {}
|
||||
|
||||
func (*MutatingWebhook) ProtoMessage() {}
|
||||
|
||||
func (*MutatingWebhookConfiguration) ProtoMessage() {}
|
||||
|
||||
func (*MutatingWebhookConfigurationList) ProtoMessage() {}
|
||||
|
||||
func (*NamedRuleWithOperations) ProtoMessage() {}
|
||||
|
||||
func (*ParamKind) ProtoMessage() {}
|
||||
|
||||
func (*ParamRef) ProtoMessage() {}
|
||||
|
||||
func (*Rule) ProtoMessage() {}
|
||||
|
||||
func (*RuleWithOperations) ProtoMessage() {}
|
||||
|
||||
func (*ServiceReference) ProtoMessage() {}
|
||||
|
||||
func (*TypeChecking) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicy) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyBinding) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyBindingList) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyBindingSpec) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyList) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicySpec) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyStatus) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingWebhook) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingWebhookConfiguration) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingWebhookConfigurationList) ProtoMessage() {}
|
||||
|
||||
func (*Validation) ProtoMessage() {}
|
||||
|
||||
func (*Variable) ProtoMessage() {}
|
||||
|
||||
func (*WebhookClientConfig) ProtoMessage() {}
|
||||
+4
@@ -54,6 +54,10 @@ func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
&ValidatingAdmissionPolicyList{},
|
||||
&ValidatingAdmissionPolicyBinding{},
|
||||
&ValidatingAdmissionPolicyBindingList{},
|
||||
&MutatingAdmissionPolicy{},
|
||||
&MutatingAdmissionPolicyList{},
|
||||
&MutatingAdmissionPolicyBinding{},
|
||||
&MutatingAdmissionPolicyBindingList{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
|
||||
+406
-72
@@ -23,19 +23,19 @@ import (
|
||||
// Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended
|
||||
// to make sure that all the tuple expansions are valid.
|
||||
type Rule struct {
|
||||
// APIGroups is the API groups the resources belong to. '*' is all groups.
|
||||
// apiGroups is the API groups the resources belong to. '*' is all groups.
|
||||
// If '*' is present, the length of the slice must be one.
|
||||
// Required.
|
||||
// +listType=atomic
|
||||
APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,1,rep,name=apiGroups"`
|
||||
|
||||
// APIVersions is the API versions the resources belong to. '*' is all versions.
|
||||
// apiVersions is the API versions the resources belong to. '*' is all versions.
|
||||
// If '*' is present, the length of the slice must be one.
|
||||
// Required.
|
||||
// +listType=atomic
|
||||
APIVersions []string `json:"apiVersions,omitempty" protobuf:"bytes,2,rep,name=apiVersions"`
|
||||
|
||||
// Resources is a list of resources this rule applies to.
|
||||
// resources is a list of resources this rule applies to.
|
||||
//
|
||||
// For example:
|
||||
// 'pods' means pods.
|
||||
@@ -141,12 +141,12 @@ const (
|
||||
// ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
|
||||
type ValidatingAdmissionPolicy struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicy.
|
||||
Spec ValidatingAdmissionPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
// The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// behaves in the expected way.
|
||||
// Populated by the system.
|
||||
// Read-only.
|
||||
@@ -156,14 +156,14 @@ type ValidatingAdmissionPolicy struct {
|
||||
|
||||
// ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.
|
||||
type ValidatingAdmissionPolicyStatus struct {
|
||||
// The generation observed by the controller.
|
||||
// observedGeneration is the generation observed by the controller.
|
||||
// +optional
|
||||
ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,1,opt,name=observedGeneration"`
|
||||
// The results of type checking for each expression.
|
||||
// typeChecking contains the results of type checking for each expression.
|
||||
// Presence of this field indicates the completion of the type checking.
|
||||
// +optional
|
||||
TypeChecking *TypeChecking `json:"typeChecking,omitempty" protobuf:"bytes,2,opt,name=typeChecking"`
|
||||
// The conditions represent the latest available observations of a policy's current state.
|
||||
// conditions represent the latest available observations of a policy's current state.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=type
|
||||
@@ -176,7 +176,7 @@ type ValidatingAdmissionPolicyConditionType string
|
||||
// TypeChecking contains results of type checking the expressions in the
|
||||
// ValidatingAdmissionPolicy
|
||||
type TypeChecking struct {
|
||||
// The type checking warnings for each expression.
|
||||
// expressionWarnings contains the type checking warnings for each expression.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
ExpressionWarnings []ExpressionWarning `json:"expressionWarnings,omitempty" protobuf:"bytes,1,rep,name=expressionWarnings"`
|
||||
@@ -184,11 +184,11 @@ type TypeChecking struct {
|
||||
|
||||
// ExpressionWarning is a warning information that targets a specific expression.
|
||||
type ExpressionWarning struct {
|
||||
// The path to the field that refers the expression.
|
||||
// fieldRef is the path to the field that refers to the expression.
|
||||
// For example, the reference to the expression of the first item of
|
||||
// validations is "spec.validations[0].expression"
|
||||
FieldRef string `json:"fieldRef" protobuf:"bytes,2,opt,name=fieldRef"`
|
||||
// The content of type checking information in a human-readable form.
|
||||
// warning contains the content of type checking information in a human-readable form.
|
||||
// Each line of the warning contains the type that the expression is checked
|
||||
// against, followed by the type check error from the compiler.
|
||||
Warning string `json:"warning" protobuf:"bytes,3,opt,name=warning"`
|
||||
@@ -200,7 +200,7 @@ type ExpressionWarning struct {
|
||||
// ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.
|
||||
type ValidatingAdmissionPolicyList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -210,21 +210,21 @@ type ValidatingAdmissionPolicyList struct {
|
||||
|
||||
// ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
|
||||
type ValidatingAdmissionPolicySpec struct {
|
||||
// ParamKind specifies the kind of resources used to parameterize this policy.
|
||||
// paramKind specifies the kind of resources used to parameterize this policy.
|
||||
// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
|
||||
// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
|
||||
// If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
|
||||
// +optional
|
||||
ParamKind *ParamKind `json:"paramKind,omitempty" protobuf:"bytes,1,rep,name=paramKind"`
|
||||
|
||||
// MatchConstraints specifies what resources this policy is designed to validate.
|
||||
// matchConstraints specifies what resources this policy is designed to validate.
|
||||
// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
|
||||
// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
|
||||
// ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
|
||||
// Required.
|
||||
MatchConstraints *MatchResources `json:"matchConstraints,omitempty" protobuf:"bytes,2,rep,name=matchConstraints"`
|
||||
|
||||
// Validations contain CEL expressions which is used to apply the validation.
|
||||
// validations contain CEL expressions which is used to apply the validation.
|
||||
// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
|
||||
// required.
|
||||
// +listType=atomic
|
||||
@@ -255,7 +255,7 @@ type ValidatingAdmissionPolicySpec struct {
|
||||
// +optional
|
||||
AuditAnnotations []AuditAnnotation `json:"auditAnnotations,omitempty" protobuf:"bytes,5,rep,name=auditAnnotations"`
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// matchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -277,7 +277,7 @@ type ValidatingAdmissionPolicySpec struct {
|
||||
// +optional
|
||||
MatchConditions []MatchCondition `json:"matchConditions,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,6,rep,name=matchConditions"`
|
||||
|
||||
// Variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// Each variable is defined as a named CEL expression.
|
||||
// The variables defined here will be available under `variables` in other expressions of the policy
|
||||
// except MatchConditions because MatchConditions are evaluated before the rest of the policy.
|
||||
@@ -295,19 +295,19 @@ type ValidatingAdmissionPolicySpec struct {
|
||||
// ParamKind is a tuple of Group Kind and Version.
|
||||
// +structType=atomic
|
||||
type ParamKind struct {
|
||||
// APIVersion is the API group version the resources belong to.
|
||||
// apiVersion is the API group version the resources belong to.
|
||||
// In format of "group/version".
|
||||
// Required.
|
||||
APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,1,rep,name=apiVersion"`
|
||||
|
||||
// Kind is the API kind the resources belong to.
|
||||
// kind is the API kind the resources belong to.
|
||||
// Required.
|
||||
Kind string `json:"kind,omitempty" protobuf:"bytes,2,rep,name=kind"`
|
||||
}
|
||||
|
||||
// Validation specifies the CEL expression which is used to apply the validation.
|
||||
type Validation struct {
|
||||
// Expression represents the expression which will be evaluated by CEL.
|
||||
// expression represents the expression which will be evaluated by CEL.
|
||||
// ref: https://github.com/google/cel-spec
|
||||
// CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
@@ -349,7 +349,7 @@ type Validation struct {
|
||||
// non-intersecting keys are appended, retaining their partial order.
|
||||
// Required.
|
||||
Expression string `json:"expression" protobuf:"bytes,1,opt,name=Expression"`
|
||||
// Message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// line breaks. The message must not contain line breaks.
|
||||
// If unset, the message is "failed rule: {Rule}".
|
||||
// e.g. "must be a URL with the host matching spec.host"
|
||||
@@ -358,7 +358,7 @@ type Validation struct {
|
||||
// If unset, the message is "failed Expression: {Expression}".
|
||||
// +optional
|
||||
Message string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"`
|
||||
// Reason represents a machine-readable description of why this validation failed.
|
||||
// reason represents a machine-readable description of why this validation failed.
|
||||
// If this is the first validation in the list to fail, this reason, as well as the
|
||||
// corresponding HTTP response code, are used in the
|
||||
// HTTP response to the client.
|
||||
@@ -383,12 +383,12 @@ type Validation struct {
|
||||
// Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.
|
||||
// +structType=atomic
|
||||
type Variable struct {
|
||||
// Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// The variable can be accessed in other expressions through `variables`
|
||||
// For example, if name is "foo", the variable will be available as `variables.foo`
|
||||
Name string `json:"name" protobuf:"bytes,1,opt,name=Name"`
|
||||
|
||||
// Expression is the expression that will be evaluated as the value of the variable.
|
||||
// expression is the expression that will be evaluated as the value of the variable.
|
||||
// The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
||||
Expression string `json:"expression" protobuf:"bytes,2,opt,name=Expression"`
|
||||
}
|
||||
@@ -448,10 +448,11 @@ type AuditAnnotation struct {
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
type ValidatingAdmissionPolicyBinding struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// +required
|
||||
Spec ValidatingAdmissionPolicyBindingSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
}
|
||||
|
||||
@@ -461,7 +462,7 @@ type ValidatingAdmissionPolicyBinding struct {
|
||||
// ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.
|
||||
type ValidatingAdmissionPolicyBindingList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -471,9 +472,11 @@ type ValidatingAdmissionPolicyBindingList struct {
|
||||
|
||||
// ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
|
||||
type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
|
||||
// Required.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
PolicyName string `json:"policyName,omitempty" protobuf:"bytes,1,rep,name=policyName"`
|
||||
|
||||
// paramRef specifies the parameter resource used to configure the admission control policy.
|
||||
@@ -483,7 +486,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
// +optional
|
||||
ParamRef *ParamRef `json:"paramRef,omitempty" protobuf:"bytes,2,rep,name=paramRef"`
|
||||
|
||||
// MatchResources declares what resources match this binding and will be validated by it.
|
||||
// matchResources declares what resources match this binding and will be validated by it.
|
||||
// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
|
||||
// If this is unset, all resources matched by the policy are validated by this binding
|
||||
// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
|
||||
@@ -531,6 +534,8 @@ type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
//
|
||||
// Required.
|
||||
// +listType=set
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
ValidationActions []ValidationAction `json:"validationActions,omitempty" protobuf:"bytes,4,rep,name=validationActions"`
|
||||
}
|
||||
|
||||
@@ -579,7 +584,7 @@ type ParamRef struct {
|
||||
// +optional
|
||||
Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,3,rep,name=selector"`
|
||||
|
||||
// `parameterNotFoundAction` controls the behavior of the binding when the resource
|
||||
// parameterNotFoundAction controls the behavior of the binding when the resource
|
||||
// exists, and name or selector is valid, but there are no parameters
|
||||
// matched by the binding. If the value is set to `Allow`, then no
|
||||
// matched parameters will be treated as successful validation by the binding.
|
||||
@@ -597,7 +602,7 @@ type ParamRef struct {
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +structType=atomic
|
||||
type MatchResources struct {
|
||||
// NamespaceSelector decides whether to run the admission control policy on an object based
|
||||
// namespaceSelector decides whether to run the admission control policy on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -642,7 +647,7 @@ type MatchResources struct {
|
||||
// Default to the empty LabelSelector, which matches everything.
|
||||
// +optional
|
||||
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,1,opt,name=namespaceSelector"`
|
||||
// ObjectSelector decides whether to run the validation based on if the
|
||||
// objectSelector decides whether to run the validation based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the cel validation, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -655,12 +660,12 @@ type MatchResources struct {
|
||||
// Default to the empty LabelSelector, which matches everything.
|
||||
// +optional
|
||||
ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,2,opt,name=objectSelector"`
|
||||
// ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
|
||||
// resourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
|
||||
// The policy cares about an operation if it matches _any_ Rule.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
ResourceRules []NamedRuleWithOperations `json:"resourceRules,omitempty" protobuf:"bytes,3,rep,name=resourceRules"`
|
||||
// ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
|
||||
// excludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
@@ -704,7 +709,7 @@ const (
|
||||
// NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
|
||||
// +structType=atomic
|
||||
type NamedRuleWithOperations struct {
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,1,rep,name=resourceNames"`
|
||||
@@ -720,10 +725,10 @@ type NamedRuleWithOperations struct {
|
||||
// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
|
||||
type ValidatingWebhookConfiguration struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Webhooks is a list of webhooks and the affected resources and operations.
|
||||
// webhooks is a list of webhooks and the affected resources and operations.
|
||||
// +optional
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
@@ -738,7 +743,7 @@ type ValidatingWebhookConfiguration struct {
|
||||
// ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
|
||||
type ValidatingWebhookConfigurationList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -754,10 +759,10 @@ type ValidatingWebhookConfigurationList struct {
|
||||
// MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
|
||||
type MutatingWebhookConfiguration struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Webhooks is a list of webhooks and the affected resources and operations.
|
||||
// webhooks is a list of webhooks and the affected resources and operations.
|
||||
// +optional
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
@@ -772,7 +777,7 @@ type MutatingWebhookConfiguration struct {
|
||||
// MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
|
||||
type MutatingWebhookConfigurationList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -782,18 +787,18 @@ type MutatingWebhookConfigurationList struct {
|
||||
|
||||
// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
|
||||
type ValidatingWebhook struct {
|
||||
// The name of the admission webhook.
|
||||
// name is the name of the admission webhook.
|
||||
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
||||
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
||||
// of the organization.
|
||||
// Required.
|
||||
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
|
||||
|
||||
// ClientConfig defines how to communicate with the hook.
|
||||
// clientConfig defines how to communicate with the hook.
|
||||
// Required
|
||||
ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`
|
||||
|
||||
// Rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// The webhook cares about an operation if it matches _any_ Rule.
|
||||
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
||||
// from putting the cluster in a state which cannot be recovered from without completely
|
||||
@@ -802,7 +807,7 @@ type ValidatingWebhook struct {
|
||||
// +listType=atomic
|
||||
Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
|
||||
|
||||
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// allowed values are Ignore or Fail. Defaults to Fail.
|
||||
// +optional
|
||||
FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`
|
||||
@@ -824,7 +829,7 @@ type ValidatingWebhook struct {
|
||||
// +optional
|
||||
MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`
|
||||
|
||||
// NamespaceSelector decides whether to run the webhook on an object based
|
||||
// namespaceSelector decides whether to run the webhook on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -870,7 +875,7 @@ type ValidatingWebhook struct {
|
||||
// +optional
|
||||
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`
|
||||
|
||||
// ObjectSelector decides whether to run the webhook based on if the
|
||||
// objectSelector decides whether to run the webhook based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the webhook, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -884,7 +889,7 @@ type ValidatingWebhook struct {
|
||||
// +optional
|
||||
ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,10,opt,name=objectSelector"`
|
||||
|
||||
// SideEffects states whether this webhook has side effects.
|
||||
// sideEffects states whether this webhook has side effects.
|
||||
// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
|
||||
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
||||
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
||||
@@ -892,7 +897,7 @@ type ValidatingWebhook struct {
|
||||
// sideEffects == Unknown or Some.
|
||||
SideEffects *SideEffectClass `json:"sideEffects" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`
|
||||
|
||||
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// the webhook call will be ignored or the API call will fail based on the
|
||||
// failure policy.
|
||||
// The timeout value must be between 1 and 30 seconds.
|
||||
@@ -900,7 +905,7 @@ type ValidatingWebhook struct {
|
||||
// +optional
|
||||
TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`
|
||||
|
||||
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// versions the Webhook expects. API server will try to use first version in
|
||||
// the list which it supports. If none of the versions specified in this list
|
||||
// supported by API server, validation will fail for this object.
|
||||
@@ -910,7 +915,7 @@ type ValidatingWebhook struct {
|
||||
// +listType=atomic
|
||||
AdmissionReviewVersions []string `json:"admissionReviewVersions" protobuf:"bytes,8,rep,name=admissionReviewVersions"`
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// matchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// webhook. Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -932,18 +937,18 @@ type ValidatingWebhook struct {
|
||||
|
||||
// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
|
||||
type MutatingWebhook struct {
|
||||
// The name of the admission webhook.
|
||||
// name is the name of the admission webhook.
|
||||
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
||||
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
||||
// of the organization.
|
||||
// Required.
|
||||
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
|
||||
|
||||
// ClientConfig defines how to communicate with the hook.
|
||||
// clientConfig defines how to communicate with the hook.
|
||||
// Required
|
||||
ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`
|
||||
|
||||
// Rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// The webhook cares about an operation if it matches _any_ Rule.
|
||||
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
||||
// from putting the cluster in a state which cannot be recovered from without completely
|
||||
@@ -952,7 +957,7 @@ type MutatingWebhook struct {
|
||||
// +listType=atomic
|
||||
Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
|
||||
|
||||
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// allowed values are Ignore or Fail. Defaults to Fail.
|
||||
// +optional
|
||||
FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`
|
||||
@@ -974,7 +979,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`
|
||||
|
||||
// NamespaceSelector decides whether to run the webhook on an object based
|
||||
// namespaceSelector decides whether to run the webhook on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -1020,7 +1025,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`
|
||||
|
||||
// ObjectSelector decides whether to run the webhook based on if the
|
||||
// objectSelector decides whether to run the webhook based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the webhook, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -1034,7 +1039,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,11,opt,name=objectSelector"`
|
||||
|
||||
// SideEffects states whether this webhook has side effects.
|
||||
// sideEffects states whether this webhook has side effects.
|
||||
// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
|
||||
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
||||
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
||||
@@ -1042,7 +1047,7 @@ type MutatingWebhook struct {
|
||||
// sideEffects == Unknown or Some.
|
||||
SideEffects *SideEffectClass `json:"sideEffects" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`
|
||||
|
||||
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// the webhook call will be ignored or the API call will fail based on the
|
||||
// failure policy.
|
||||
// The timeout value must be between 1 and 30 seconds.
|
||||
@@ -1050,7 +1055,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`
|
||||
|
||||
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// versions the Webhook expects. API server will try to use first version in
|
||||
// the list which it supports. If none of the versions specified in this list
|
||||
// supported by API server, validation will fail for this object.
|
||||
@@ -1078,7 +1083,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
ReinvocationPolicy *ReinvocationPolicyType `json:"reinvocationPolicy,omitempty" protobuf:"bytes,10,opt,name=reinvocationPolicy,casttype=ReinvocationPolicyType"`
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// matchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// webhook. Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -1098,6 +1103,335 @@ type MutatingWebhook struct {
|
||||
MatchConditions []MatchCondition `json:"matchConditions,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,12,opt,name=matchConditions"`
|
||||
}
|
||||
|
||||
// +genclient
|
||||
// +genclient:nonNamespaced
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.36
|
||||
|
||||
// MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
|
||||
type MutatingAdmissionPolicy struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicy.
|
||||
Spec MutatingAdmissionPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.36
|
||||
|
||||
// MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.
|
||||
type MutatingAdmissionPolicyList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// List of ValidatingAdmissionPolicy.
|
||||
Items []MutatingAdmissionPolicy `json:"items" protobuf:"bytes,2,rep,name=items"`
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicySpec defines the desired behavior of the admission policy.
|
||||
type MutatingAdmissionPolicySpec struct {
|
||||
// paramKind specifies the kind of resources used to parameterize this policy.
|
||||
// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
|
||||
// If paramKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
|
||||
// If paramKind is specified but paramRef is unset in MutatingAdmissionPolicyBinding, the params variable will be null.
|
||||
// +optional
|
||||
ParamKind *ParamKind `json:"paramKind,omitempty" protobuf:"bytes,1,rep,name=paramKind"`
|
||||
|
||||
// matchConstraints specifies what resources this policy is designed to validate.
|
||||
// The MutatingAdmissionPolicy cares about a request if it matches _all_ Constraints.
|
||||
// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
|
||||
// MutatingAdmissionPolicy cannot match MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding.
|
||||
// The CREATE, UPDATE and CONNECT operations are allowed. The DELETE operation may not be matched.
|
||||
// '*' matches CREATE, UPDATE and CONNECT.
|
||||
// Required.
|
||||
MatchConstraints *MatchResources `json:"matchConstraints,omitempty" protobuf:"bytes,2,rep,name=matchConstraints"`
|
||||
|
||||
// variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// Each variable is defined as a named CEL expression.
|
||||
// The variables defined here will be available under `variables` in other expressions of the policy
|
||||
// except matchConditions because matchConditions are evaluated before the rest of the policy.
|
||||
//
|
||||
// The expression of a variable can refer to other variables defined earlier in the list but not those after.
|
||||
// Thus, variables must be sorted by the order of first appearance and acyclic.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
Variables []Variable `json:"variables,omitempty" protobuf:"bytes,3,rep,name=variables"`
|
||||
|
||||
// mutations contain operations to perform on matching objects.
|
||||
// mutations may not be empty; a minimum of one mutation is required.
|
||||
// mutations are evaluated in order, and are reinvoked according to
|
||||
// the reinvocationPolicy.
|
||||
// The mutations of a policy are invoked for each binding of this policy
|
||||
// and reinvocation of mutations occurs on a per binding basis.
|
||||
//
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
Mutations []Mutation `json:"mutations,omitempty" protobuf:"bytes,4,rep,name=mutations"`
|
||||
|
||||
// failurePolicy defines how to handle failures for the admission policy. Failures can
|
||||
// occur from CEL expression parse errors, type check errors, runtime errors and invalid
|
||||
// or mis-configured policy definitions or bindings.
|
||||
//
|
||||
// A policy is invalid if paramKind refers to a non-existent Kind.
|
||||
// A binding is invalid if paramRef.name refers to a non-existent resource.
|
||||
//
|
||||
// failurePolicy does not define how validations that evaluate to false are handled.
|
||||
//
|
||||
// Allowed values are Ignore or Fail. Defaults to Fail.
|
||||
// +optional
|
||||
FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,5,opt,name=failurePolicy,casttype=FailurePolicyType"`
|
||||
|
||||
// matchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// Match conditions filter requests that have already been matched by the matchConstraints.
|
||||
// An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
//
|
||||
// If a parameter object is provided, it can be accessed via the `params` handle in the same
|
||||
// manner as validation expressions.
|
||||
//
|
||||
// The exact matching logic is (in order):
|
||||
// 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
|
||||
// 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
|
||||
// 3. If any matchCondition evaluates to an error (but none are FALSE):
|
||||
// - If failurePolicy=Fail, reject the request
|
||||
// - If failurePolicy=Ignore, the policy is skipped
|
||||
//
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
// +listType=map
|
||||
// +listMapKey=name
|
||||
// +optional
|
||||
MatchConditions []MatchCondition `json:"matchConditions,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,6,rep,name=matchConditions"`
|
||||
|
||||
// reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding
|
||||
// as part of a single admission evaluation.
|
||||
// Allowed values are "Never" and "IfNeeded".
|
||||
//
|
||||
// Never: These mutations will not be called more than once per binding in a single admission evaluation.
|
||||
//
|
||||
// IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of
|
||||
// order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only
|
||||
// reinvoked when mutations change the object after this mutation is invoked.
|
||||
// Required.
|
||||
ReinvocationPolicy ReinvocationPolicyType `json:"reinvocationPolicy,omitempty" protobuf:"bytes,7,opt,name=reinvocationPolicy,casttype=ReinvocationPolicyType"`
|
||||
}
|
||||
|
||||
// Mutation specifies the CEL expression which is used to apply the Mutation.
|
||||
type Mutation struct {
|
||||
// patchType indicates the patch strategy used.
|
||||
// Allowed values are "ApplyConfiguration" and "JSONPatch".
|
||||
// Required.
|
||||
//
|
||||
// +unionDiscriminator
|
||||
PatchType PatchType `json:"patchType" protobuf:"bytes,2,opt,name=patchType,casttype=PatchType"`
|
||||
|
||||
// applyConfiguration defines the desired configuration values of an object.
|
||||
// The configuration is applied to the admission object using
|
||||
// [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff).
|
||||
// A CEL expression is used to create apply configuration.
|
||||
ApplyConfiguration *ApplyConfiguration `json:"applyConfiguration,omitempty" protobuf:"bytes,3,opt,name=applyConfiguration"`
|
||||
|
||||
// jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object.
|
||||
// A CEL expression is used to create the JSON patch.
|
||||
JSONPatch *JSONPatch `json:"jsonPatch,omitempty" protobuf:"bytes,4,opt,name=jsonPatch"`
|
||||
}
|
||||
|
||||
// PatchType specifies the type of patch operation for a mutation.
|
||||
// +enum
|
||||
type PatchType string
|
||||
|
||||
const (
|
||||
// ApplyConfiguration indicates that the mutation is using apply configuration to mutate the object.
|
||||
PatchTypeApplyConfiguration PatchType = "ApplyConfiguration"
|
||||
// JSONPatch indicates that the object is mutated through JSON Patch.
|
||||
PatchTypeJSONPatch PatchType = "JSONPatch"
|
||||
)
|
||||
|
||||
// ApplyConfiguration defines the desired configuration values of an object.
|
||||
type ApplyConfiguration struct {
|
||||
// expression will be evaluated by CEL to create an apply configuration.
|
||||
// ref: https://github.com/google/cel-spec
|
||||
//
|
||||
// Apply configurations are declared in CEL using object initialization. For example, this CEL expression
|
||||
// returns an apply configuration to set a single field:
|
||||
//
|
||||
// Object{
|
||||
// spec: Object.spec{
|
||||
// serviceAccountName: "example"
|
||||
// }
|
||||
// }
|
||||
//
|
||||
// Apply configurations may not modify atomic structs, maps or arrays due to the risk of accidental deletion of
|
||||
// values not included in the apply configuration.
|
||||
//
|
||||
// CEL expressions have access to the object types needed to create apply configurations:
|
||||
//
|
||||
// - 'Object' - CEL type of the resource object.
|
||||
// - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec')
|
||||
// - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')
|
||||
//
|
||||
// CEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
// - 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
// - 'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
// - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
|
||||
// - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
|
||||
// - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.
|
||||
// - 'variables' - Map of composited variables, from its name to its lazily evaluated value.
|
||||
// For example, a variable named 'foo' can be accessed as 'variables.foo'.
|
||||
// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
// See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
// request resource.
|
||||
//
|
||||
// The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the
|
||||
// object. No other metadata properties are accessible.
|
||||
//
|
||||
// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
|
||||
// Required.
|
||||
Expression string `json:"expression,omitempty" protobuf:"bytes,1,opt,name=expression"`
|
||||
}
|
||||
|
||||
// JSONPatch defines a JSON Patch.
|
||||
type JSONPatch struct {
|
||||
// expression will be evaluated by CEL to create a [JSON patch](https://jsonpatch.com/).
|
||||
// ref: https://github.com/google/cel-spec
|
||||
//
|
||||
// expression must return an array of JSONPatch values.
|
||||
//
|
||||
// For example, this CEL expression returns a JSON patch to conditionally modify a value:
|
||||
//
|
||||
// [
|
||||
// JSONPatch{op: "test", path: "/spec/example", value: "Red"},
|
||||
// JSONPatch{op: "replace", path: "/spec/example", value: "Green"}
|
||||
// ]
|
||||
//
|
||||
// To define an object for the patch value, use Object types. For example:
|
||||
//
|
||||
// [
|
||||
// JSONPatch{
|
||||
// op: "add",
|
||||
// path: "/spec/selector",
|
||||
// value: Object.spec.selector{matchLabels: {"environment": "test"}}
|
||||
// }
|
||||
// ]
|
||||
//
|
||||
// To use strings containing '/' and '~' as JSONPatch path keys, use "jsonpatch.escapeKey". For example:
|
||||
//
|
||||
// [
|
||||
// JSONPatch{
|
||||
// op: "add",
|
||||
// path: "/metadata/labels/" + jsonpatch.escapeKey("example.com/environment"),
|
||||
// value: "test"
|
||||
// },
|
||||
// ]
|
||||
//
|
||||
// CEL expressions have access to the types needed to create JSON patches and objects:
|
||||
//
|
||||
// - 'JSONPatch' - CEL type of JSON Patch operations. JSONPatch has the fields 'op', 'from', 'path' and 'value'.
|
||||
// See [JSON patch](https://jsonpatch.com/) for more details. The 'value' field may be set to any of: string,
|
||||
// integer, array, map or object. If set, the 'path' and 'from' fields must be set to a
|
||||
// [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) string, where the 'jsonpatch.escapeKey()' CEL
|
||||
// function may be used to escape path keys containing '/' and '~'.
|
||||
// - 'Object' - CEL type of the resource object.
|
||||
// - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec')
|
||||
// - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')
|
||||
//
|
||||
// CEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
// - 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
// - 'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
// - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
|
||||
// - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
|
||||
// - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.
|
||||
// - 'variables' - Map of composited variables, from its name to its lazily evaluated value.
|
||||
// For example, a variable named 'foo' can be accessed as 'variables.foo'.
|
||||
// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
// See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
// request resource.
|
||||
//
|
||||
// CEL expressions have access to [Kubernetes CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)
|
||||
// as well as:
|
||||
//
|
||||
// - 'jsonpatch.escapeKey' - Performs JSONPatch key escaping. '~' and '/' are escaped as '~0' and `~1' respectively).
|
||||
//
|
||||
//
|
||||
// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
|
||||
// Required.
|
||||
Expression string `json:"expression,omitempty" protobuf:"bytes,1,opt,name=expression"`
|
||||
}
|
||||
|
||||
// +genclient
|
||||
// +genclient:nonNamespaced
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.36
|
||||
|
||||
// MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources.
|
||||
// MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators
|
||||
// configure policies for clusters.
|
||||
//
|
||||
// For a given admission request, each binding will cause its policy to be
|
||||
// evaluated N times, where N is 1 for policies/bindings that don't use
|
||||
// params, otherwise N is the number of parameters selected by the binding.
|
||||
// Each evaluation is constrained by a [runtime cost budget](https://kubernetes.io/docs/reference/using-api/cel/#runtime-cost-budget).
|
||||
//
|
||||
// Adding/removing policies, bindings, or params can not affect whether a
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
type MutatingAdmissionPolicyBinding struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
Spec MutatingAdmissionPolicyBindingSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.36
|
||||
|
||||
// MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.
|
||||
type MutatingAdmissionPolicyBindingList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// List of PolicyBinding.
|
||||
Items []MutatingAdmissionPolicyBinding `json:"items" protobuf:"bytes,2,rep,name=items"`
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicyBindingSpec defines the specification of the MutatingAdmissionPolicyBinding.
|
||||
type MutatingAdmissionPolicyBindingSpec struct {
|
||||
// policyName references a MutatingAdmissionPolicy name which the MutatingAdmissionPolicyBinding binds to.
|
||||
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
|
||||
// Required.
|
||||
PolicyName string `json:"policyName,omitempty" protobuf:"bytes,1,rep,name=policyName"`
|
||||
|
||||
// paramRef specifies the parameter resource used to configure the admission control policy.
|
||||
// It should point to a resource of the type specified in spec.ParamKind of the bound MutatingAdmissionPolicy.
|
||||
// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the MutatingAdmissionPolicy applied.
|
||||
// If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
|
||||
// +optional
|
||||
ParamRef *ParamRef `json:"paramRef,omitempty" protobuf:"bytes,2,rep,name=paramRef"`
|
||||
|
||||
// matchResources limits what resources match this binding and may be mutated by it.
|
||||
// Note that if matchResources matches a resource, the resource must also match a policy's matchConstraints and
|
||||
// matchConditions before the resource may be mutated.
|
||||
// When matchResources is unset, it does not constrain resource matching, and only the policy's matchConstraints
|
||||
// and matchConditions must match for the resource to be mutated.
|
||||
// Additionally, matchResources.resourceRules are optional and do not constraint matching when unset.
|
||||
// Note that this is differs from MutatingAdmissionPolicy matchConstraints, where resourceRules are required.
|
||||
// The CREATE, UPDATE and CONNECT operations are allowed. The DELETE operation may not be matched.
|
||||
// '*' matches CREATE, UPDATE and CONNECT.
|
||||
// +optional
|
||||
MatchResources *MatchResources `json:"matchResources,omitempty" protobuf:"bytes,3,rep,name=matchResources"`
|
||||
}
|
||||
|
||||
// ReinvocationPolicyType specifies what type of policy is used when other admission plugins also perform
|
||||
// modifications.
|
||||
// +enum
|
||||
@@ -1116,7 +1450,7 @@ const (
|
||||
// RuleWithOperations is a tuple of Operations and Resources. It is recommended to make
|
||||
// sure that all the tuple expansions are valid.
|
||||
type RuleWithOperations struct {
|
||||
// Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
|
||||
// operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
|
||||
// for all of those operations and any future admission operations that are added.
|
||||
// If '*' is present, the length of the slice must be one.
|
||||
// Required.
|
||||
@@ -1143,7 +1477,7 @@ const (
|
||||
// WebhookClientConfig contains the information to make a TLS
|
||||
// connection with the webhook
|
||||
type WebhookClientConfig struct {
|
||||
// `url` gives the location of the webhook, in standard URL form
|
||||
// url gives the location of the webhook, in standard URL form
|
||||
// (`scheme://host:port/path`). Exactly one of `url` or `service`
|
||||
// must be specified.
|
||||
//
|
||||
@@ -1172,7 +1506,7 @@ type WebhookClientConfig struct {
|
||||
// +optional
|
||||
URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"`
|
||||
|
||||
// `service` is a reference to the service for this webhook. Either
|
||||
// service is a reference to the service for this webhook. Either
|
||||
// `service` or `url` must be specified.
|
||||
//
|
||||
// If the webhook is running within the cluster, then you should use `service`.
|
||||
@@ -1180,7 +1514,7 @@ type WebhookClientConfig struct {
|
||||
// +optional
|
||||
Service *ServiceReference `json:"service,omitempty" protobuf:"bytes,1,opt,name=service"`
|
||||
|
||||
// `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
|
||||
// caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
|
||||
// If unspecified, system trust roots on the apiserver are used.
|
||||
// +optional
|
||||
CABundle []byte `json:"caBundle,omitempty" protobuf:"bytes,2,opt,name=caBundle"`
|
||||
@@ -1188,19 +1522,19 @@ type WebhookClientConfig struct {
|
||||
|
||||
// ServiceReference holds a reference to Service.legacy.k8s.io
|
||||
type ServiceReference struct {
|
||||
// `namespace` is the namespace of the service.
|
||||
// namespace is the namespace of the service.
|
||||
// Required
|
||||
Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
|
||||
// `name` is the name of the service.
|
||||
// name is the name of the service.
|
||||
// Required
|
||||
Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
|
||||
|
||||
// `path` is an optional URL path which will be sent in any request to
|
||||
// path is an optional URL path which will be sent in any request to
|
||||
// this service.
|
||||
// +optional
|
||||
Path *string `json:"path,omitempty" protobuf:"bytes,3,opt,name=path"`
|
||||
|
||||
// If specified, the port on the service that hosting webhook.
|
||||
// port is the port on the service that hosts the webhook.
|
||||
// Default to 443 for backward compatibility.
|
||||
// `port` should be a valid port number (1-65535, inclusive).
|
||||
// +optional
|
||||
@@ -1209,7 +1543,7 @@ type ServiceReference struct {
|
||||
|
||||
// MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.
|
||||
type MatchCondition struct {
|
||||
// Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
// the associated expression.
|
||||
// Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
@@ -1220,7 +1554,7 @@ type MatchCondition struct {
|
||||
// Required.
|
||||
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
|
||||
|
||||
// Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
//
|
||||
// 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
|
||||
+167
-72
@@ -27,6 +27,15 @@ package v1
|
||||
// Those methods can be generated by using hack/update-codegen.sh
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_ApplyConfiguration = map[string]string{
|
||||
"": "ApplyConfiguration defines the desired configuration values of an object.",
|
||||
"expression": "expression will be evaluated by CEL to create an apply configuration. ref: https://github.com/google/cel-spec\n\nApply configurations are declared in CEL using object initialization. For example, this CEL expression returns an apply configuration to set a single field:\n\n\tObject{\n\t spec: Object.spec{\n\t serviceAccountName: \"example\"\n\t }\n\t}\n\nApply configurations may not modify atomic structs, maps or arrays due to the risk of accidental deletion of values not included in the apply configuration.\n\nCEL expressions have access to the object types needed to create apply configurations:\n\n- 'Object' - CEL type of the resource object. - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec') - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Required.",
|
||||
}
|
||||
|
||||
func (ApplyConfiguration) SwaggerDoc() map[string]string {
|
||||
return map_ApplyConfiguration
|
||||
}
|
||||
|
||||
var map_AuditAnnotation = map[string]string{
|
||||
"": "AuditAnnotation describes how to produce an audit annotation for an API request.",
|
||||
"key": "key specifies the audit annotation key. The audit annotation keys of a ValidatingAdmissionPolicy must be unique. The key must be a qualified name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.\n\nThe key is combined with the resource name of the ValidatingAdmissionPolicy to construct an audit annotation key: \"{ValidatingAdmissionPolicy name}/{key}\".\n\nIf an admission webhook uses the same resource name as this ValidatingAdmissionPolicy and the same audit annotation key, the annotation key will be identical. In this case, the first annotation written with the key will be included in the audit event and all subsequent annotations with the same key will be discarded.\n\nRequired.",
|
||||
@@ -39,18 +48,27 @@ func (AuditAnnotation) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ExpressionWarning = map[string]string{
|
||||
"": "ExpressionWarning is a warning information that targets a specific expression.",
|
||||
"fieldRef": "The path to the field that refers the expression. For example, the reference to the expression of the first item of validations is \"spec.validations[0].expression\"",
|
||||
"warning": "The content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.",
|
||||
"fieldRef": "fieldRef is the path to the field that refers to the expression. For example, the reference to the expression of the first item of validations is \"spec.validations[0].expression\"",
|
||||
"warning": "warning contains the content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.",
|
||||
}
|
||||
|
||||
func (ExpressionWarning) SwaggerDoc() map[string]string {
|
||||
return map_ExpressionWarning
|
||||
}
|
||||
|
||||
var map_JSONPatch = map[string]string{
|
||||
"": "JSONPatch defines a JSON Patch.",
|
||||
"expression": "expression will be evaluated by CEL to create a [JSON patch](https://jsonpatch.com/). ref: https://github.com/google/cel-spec\n\nexpression must return an array of JSONPatch values.\n\nFor example, this CEL expression returns a JSON patch to conditionally modify a value:\n\n\t [\n\t JSONPatch{op: \"test\", path: \"/spec/example\", value: \"Red\"},\n\t JSONPatch{op: \"replace\", path: \"/spec/example\", value: \"Green\"}\n\t ]\n\nTo define an object for the patch value, use Object types. For example:\n\n\t [\n\t JSONPatch{\n\t op: \"add\",\n\t path: \"/spec/selector\",\n\t value: Object.spec.selector{matchLabels: {\"environment\": \"test\"}}\n\t }\n\t ]\n\nTo use strings containing '/' and '~' as JSONPatch path keys, use \"jsonpatch.escapeKey\". For example:\n\n\t [\n\t JSONPatch{\n\t op: \"add\",\n\t path: \"/metadata/labels/\" + jsonpatch.escapeKey(\"example.com/environment\"),\n\t value: \"test\"\n\t },\n\t ]\n\nCEL expressions have access to the types needed to create JSON patches and objects:\n\n- 'JSONPatch' - CEL type of JSON Patch operations. JSONPatch has the fields 'op', 'from', 'path' and 'value'.\n See [JSON patch](https://jsonpatch.com/) for more details. The 'value' field may be set to any of: string,\n integer, array, map or object. If set, the 'path' and 'from' fields must be set to a\n [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) string, where the 'jsonpatch.escapeKey()' CEL\n function may be used to escape path keys containing '/' and '~'.\n- 'Object' - CEL type of the resource object. - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec') - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nCEL expressions have access to [Kubernetes CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries) as well as:\n\n- 'jsonpatch.escapeKey' - Performs JSONPatch key escaping. '~' and '/' are escaped as '~0' and `~1' respectively).\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Required.",
|
||||
}
|
||||
|
||||
func (JSONPatch) SwaggerDoc() map[string]string {
|
||||
return map_JSONPatch
|
||||
}
|
||||
|
||||
var map_MatchCondition = map[string]string{
|
||||
"": "MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.",
|
||||
"name": "Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')\n\nRequired.",
|
||||
"expression": "Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:\n\n'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\nDocumentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/\n\nRequired.",
|
||||
"name": "name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')\n\nRequired.",
|
||||
"expression": "expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:\n\n'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\nDocumentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/\n\nRequired.",
|
||||
}
|
||||
|
||||
func (MatchCondition) SwaggerDoc() map[string]string {
|
||||
@@ -59,10 +77,10 @@ func (MatchCondition) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MatchResources = map[string]string{
|
||||
"": "MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",
|
||||
"namespaceSelector": "NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the policy on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"resourceRules": "ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.",
|
||||
"excludeResourceRules": "ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",
|
||||
"namespaceSelector": "namespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the policy on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "objectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"resourceRules": "resourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.",
|
||||
"excludeResourceRules": "excludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",
|
||||
"matchPolicy": "matchPolicy defines how the \"MatchResources\" list is used to match incoming requests. Allowed values are \"Exact\" or \"Equivalent\".\n\n- Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.\n\n- Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.\n\nDefaults to \"Equivalent\"",
|
||||
}
|
||||
|
||||
@@ -70,20 +88,86 @@ func (MatchResources) SwaggerDoc() map[string]string {
|
||||
return map_MatchResources
|
||||
}
|
||||
|
||||
var map_MutatingAdmissionPolicy = map[string]string{
|
||||
"": "MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the MutatingAdmissionPolicy.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
return map_MutatingAdmissionPolicy
|
||||
}
|
||||
|
||||
var map_MutatingAdmissionPolicyBinding = map[string]string{
|
||||
"": "MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.\n\nFor a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding. Each evaluation is constrained by a [runtime cost budget](https://kubernetes.io/docs/reference/using-api/cel/#runtime-cost-budget).\n\nAdding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the MutatingAdmissionPolicyBinding.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
return map_MutatingAdmissionPolicyBinding
|
||||
}
|
||||
|
||||
var map_MutatingAdmissionPolicyBindingList = map[string]string{
|
||||
"": "MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of PolicyBinding.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicyBindingList) SwaggerDoc() map[string]string {
|
||||
return map_MutatingAdmissionPolicyBindingList
|
||||
}
|
||||
|
||||
var map_MutatingAdmissionPolicyBindingSpec = map[string]string{
|
||||
"": "MutatingAdmissionPolicyBindingSpec defines the specification of the MutatingAdmissionPolicyBinding.",
|
||||
"policyName": "policyName references a MutatingAdmissionPolicy name which the MutatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.",
|
||||
"paramRef": "paramRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in spec.ParamKind of the bound MutatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the MutatingAdmissionPolicy applied. If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.",
|
||||
"matchResources": "matchResources limits what resources match this binding and may be mutated by it. Note that if matchResources matches a resource, the resource must also match a policy's matchConstraints and matchConditions before the resource may be mutated. When matchResources is unset, it does not constrain resource matching, and only the policy's matchConstraints and matchConditions must match for the resource to be mutated. Additionally, matchResources.resourceRules are optional and do not constraint matching when unset. Note that this is differs from MutatingAdmissionPolicy matchConstraints, where resourceRules are required. The CREATE, UPDATE and CONNECT operations are allowed. The DELETE operation may not be matched. '*' matches CREATE, UPDATE and CONNECT.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicyBindingSpec) SwaggerDoc() map[string]string {
|
||||
return map_MutatingAdmissionPolicyBindingSpec
|
||||
}
|
||||
|
||||
var map_MutatingAdmissionPolicyList = map[string]string{
|
||||
"": "MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of ValidatingAdmissionPolicy.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicyList) SwaggerDoc() map[string]string {
|
||||
return map_MutatingAdmissionPolicyList
|
||||
}
|
||||
|
||||
var map_MutatingAdmissionPolicySpec = map[string]string{
|
||||
"": "MutatingAdmissionPolicySpec defines the desired behavior of the admission policy.",
|
||||
"paramKind": "paramKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If paramKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in MutatingAdmissionPolicyBinding, the params variable will be null.",
|
||||
"matchConstraints": "matchConstraints specifies what resources this policy is designed to validate. The MutatingAdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API MutatingAdmissionPolicy cannot match MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding. The CREATE, UPDATE and CONNECT operations are allowed. The DELETE operation may not be matched. '*' matches CREATE, UPDATE and CONNECT. Required.",
|
||||
"variables": "variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except matchConditions because matchConditions are evaluated before the rest of the policy.\n\nThe expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, variables must be sorted by the order of first appearance and acyclic.",
|
||||
"mutations": "mutations contain operations to perform on matching objects. mutations may not be empty; a minimum of one mutation is required. mutations are evaluated in order, and are reinvoked according to the reinvocationPolicy. The mutations of a policy are invoked for each binding of this policy and reinvocation of mutations occurs on a per binding basis.",
|
||||
"failurePolicy": "failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.\n\nA policy is invalid if paramKind refers to a non-existent Kind. A binding is invalid if paramRef.name refers to a non-existent resource.\n\nfailurePolicy does not define how validations that evaluate to false are handled.\n\nAllowed values are Ignore or Fail. Defaults to Fail.",
|
||||
"matchConditions": "matchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the matchConstraints. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the policy is skipped",
|
||||
"reinvocationPolicy": "reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding as part of a single admission evaluation. Allowed values are \"Never\" and \"IfNeeded\".\n\nNever: These mutations will not be called more than once per binding in a single admission evaluation.\n\nIfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only reinvoked when mutations change the object after this mutation is invoked. Required.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicySpec) SwaggerDoc() map[string]string {
|
||||
return map_MutatingAdmissionPolicySpec
|
||||
}
|
||||
|
||||
var map_MutatingWebhook = map[string]string{
|
||||
"": "MutatingWebhook describes an admission webhook and the resources and operations it applies to.",
|
||||
"name": "The name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where \"imagepolicy\" is the name of the webhook, and kubernetes.io is the name of the organization. Required.",
|
||||
"clientConfig": "ClientConfig defines how to communicate with the hook. Required",
|
||||
"rules": "Rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.",
|
||||
"failurePolicy": "FailurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Fail.",
|
||||
"name": "name is the name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where \"imagepolicy\" is the name of the webhook, and kubernetes.io is the name of the organization. Required.",
|
||||
"clientConfig": "clientConfig defines how to communicate with the hook. Required",
|
||||
"rules": "rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.",
|
||||
"failurePolicy": "failurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Fail.",
|
||||
"matchPolicy": "matchPolicy defines how the \"rules\" list is used to match incoming requests. Allowed values are \"Exact\" or \"Equivalent\".\n\n- Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.\n\n- Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.\n\nDefaults to \"Equivalent\"",
|
||||
"namespaceSelector": "NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the webhook on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "ObjectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"sideEffects": "SideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.",
|
||||
"timeoutSeconds": "TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 10 seconds.",
|
||||
"admissionReviewVersions": "AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy.",
|
||||
"namespaceSelector": "namespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the webhook on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "objectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"sideEffects": "sideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.",
|
||||
"timeoutSeconds": "timeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 10 seconds.",
|
||||
"admissionReviewVersions": "admissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy.",
|
||||
"reinvocationPolicy": "reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation. Allowed values are \"Never\" and \"IfNeeded\".\n\nNever: the webhook will not be called more than once in a single admission evaluation.\n\nIfNeeded: the webhook will be called at least one additional time as part of the admission evaluation if the object being admitted is modified by other admission plugins after the initial webhook call. Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted. Note: * the number of additional invocations is not guaranteed to be exactly one. * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again. * webhooks that use this option may be reordered to minimize the number of additional invocations. * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.\n\nDefaults to \"Never\".",
|
||||
"matchConditions": "MatchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the webhook is called.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the error is ignored and the webhook is skipped",
|
||||
"matchConditions": "matchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the webhook is called.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the error is ignored and the webhook is skipped",
|
||||
}
|
||||
|
||||
func (MutatingWebhook) SwaggerDoc() map[string]string {
|
||||
@@ -92,8 +176,8 @@ func (MutatingWebhook) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingWebhookConfiguration = map[string]string{
|
||||
"": "MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"webhooks": "Webhooks is a list of webhooks and the affected resources and operations.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"webhooks": "webhooks is a list of webhooks and the affected resources and operations.",
|
||||
}
|
||||
|
||||
func (MutatingWebhookConfiguration) SwaggerDoc() map[string]string {
|
||||
@@ -102,7 +186,7 @@ func (MutatingWebhookConfiguration) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingWebhookConfigurationList = map[string]string{
|
||||
"": "MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of MutatingWebhookConfiguration.",
|
||||
}
|
||||
|
||||
@@ -110,9 +194,20 @@ func (MutatingWebhookConfigurationList) SwaggerDoc() map[string]string {
|
||||
return map_MutatingWebhookConfigurationList
|
||||
}
|
||||
|
||||
var map_Mutation = map[string]string{
|
||||
"": "Mutation specifies the CEL expression which is used to apply the Mutation.",
|
||||
"patchType": "patchType indicates the patch strategy used. Allowed values are \"ApplyConfiguration\" and \"JSONPatch\". Required.",
|
||||
"applyConfiguration": "applyConfiguration defines the desired configuration values of an object. The configuration is applied to the admission object using [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). A CEL expression is used to create apply configuration.",
|
||||
"jsonPatch": "jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. A CEL expression is used to create the JSON patch.",
|
||||
}
|
||||
|
||||
func (Mutation) SwaggerDoc() map[string]string {
|
||||
return map_Mutation
|
||||
}
|
||||
|
||||
var map_NamedRuleWithOperations = map[string]string{
|
||||
"": "NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.",
|
||||
"resourceNames": "ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.",
|
||||
"resourceNames": "resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.",
|
||||
}
|
||||
|
||||
func (NamedRuleWithOperations) SwaggerDoc() map[string]string {
|
||||
@@ -121,8 +216,8 @@ func (NamedRuleWithOperations) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ParamKind = map[string]string{
|
||||
"": "ParamKind is a tuple of Group Kind and Version.",
|
||||
"apiVersion": "APIVersion is the API group version the resources belong to. In format of \"group/version\". Required.",
|
||||
"kind": "Kind is the API kind the resources belong to. Required.",
|
||||
"apiVersion": "apiVersion is the API group version the resources belong to. In format of \"group/version\". Required.",
|
||||
"kind": "kind is the API kind the resources belong to. Required.",
|
||||
}
|
||||
|
||||
func (ParamKind) SwaggerDoc() map[string]string {
|
||||
@@ -134,7 +229,7 @@ var map_ParamRef = map[string]string{
|
||||
"name": "name is the name of the resource being referenced.\n\nOne of `name` or `selector` must be set, but `name` and `selector` are mutually exclusive properties. If one is set, the other must be unset.\n\nA single parameter used for all admission requests can be configured by setting the `name` field, leaving `selector` blank, and setting namespace if `paramKind` is namespace-scoped.",
|
||||
"namespace": "namespace is the namespace of the referenced resource. Allows limiting the search for params to a specific namespace. Applies to both `name` and `selector` fields.\n\nA per-namespace parameter may be used by specifying a namespace-scoped `paramKind` in the policy and leaving this field empty.\n\n- If `paramKind` is cluster-scoped, this field MUST be unset. Setting this field results in a configuration error.\n\n- If `paramKind` is namespace-scoped, the namespace of the object being evaluated for admission will be used when this field is left unset. Take care that if this is left empty the binding must not match any cluster-scoped resources, which will result in an error.",
|
||||
"selector": "selector can be used to match multiple param objects based on their labels. Supply selector: {} to match all resources of the ParamKind.\n\nIf multiple params are found, they are all evaluated with the policy expressions and the results are ANDed together.\n\nOne of `name` or `selector` must be set, but `name` and `selector` are mutually exclusive properties. If one is set, the other must be unset.",
|
||||
"parameterNotFoundAction": "`parameterNotFoundAction` controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. If set to `Deny`, then no matched parameters will be subject to the `failurePolicy` of the policy.\n\nAllowed values are `Allow` or `Deny`\n\nRequired",
|
||||
"parameterNotFoundAction": "parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. If set to `Deny`, then no matched parameters will be subject to the `failurePolicy` of the policy.\n\nAllowed values are `Allow` or `Deny`\n\nRequired",
|
||||
}
|
||||
|
||||
func (ParamRef) SwaggerDoc() map[string]string {
|
||||
@@ -143,9 +238,9 @@ func (ParamRef) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_Rule = map[string]string{
|
||||
"": "Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended to make sure that all the tuple expansions are valid.",
|
||||
"apiGroups": "APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required.",
|
||||
"apiVersions": "APIVersions is the API versions the resources belong to. '*' is all versions. If '*' is present, the length of the slice must be one. Required.",
|
||||
"resources": "Resources is a list of resources this rule applies to.\n\nFor example: 'pods' means pods. 'pods/log' means the log subresource of pods. '*' means all resources, but not subresources. 'pods/*' means all subresources of pods. '*/scale' means all scale subresources. '*/*' means all resources and their subresources.\n\nIf wildcard is present, the validation rule will ensure resources do not overlap with each other.\n\nDepending on the enclosing object, subresources might not be allowed. Required.",
|
||||
"apiGroups": "apiGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required.",
|
||||
"apiVersions": "apiVersions is the API versions the resources belong to. '*' is all versions. If '*' is present, the length of the slice must be one. Required.",
|
||||
"resources": "resources is a list of resources this rule applies to.\n\nFor example: 'pods' means pods. 'pods/log' means the log subresource of pods. '*' means all resources, but not subresources. 'pods/*' means all subresources of pods. '*/scale' means all scale subresources. '*/*' means all resources and their subresources.\n\nIf wildcard is present, the validation rule will ensure resources do not overlap with each other.\n\nDepending on the enclosing object, subresources might not be allowed. Required.",
|
||||
"scope": "scope specifies the scope of this rule. Valid values are \"Cluster\", \"Namespaced\", and \"*\" \"Cluster\" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. \"Namespaced\" means that only namespaced resources will match this rule. \"*\" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is \"*\".",
|
||||
}
|
||||
|
||||
@@ -155,7 +250,7 @@ func (Rule) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_RuleWithOperations = map[string]string{
|
||||
"": "RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.",
|
||||
"operations": "Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.",
|
||||
"operations": "operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.",
|
||||
}
|
||||
|
||||
func (RuleWithOperations) SwaggerDoc() map[string]string {
|
||||
@@ -164,10 +259,10 @@ func (RuleWithOperations) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ServiceReference = map[string]string{
|
||||
"": "ServiceReference holds a reference to Service.legacy.k8s.io",
|
||||
"namespace": "`namespace` is the namespace of the service. Required",
|
||||
"name": "`name` is the name of the service. Required",
|
||||
"path": "`path` is an optional URL path which will be sent in any request to this service.",
|
||||
"port": "If specified, the port on the service that hosting webhook. Default to 443 for backward compatibility. `port` should be a valid port number (1-65535, inclusive).",
|
||||
"namespace": "namespace is the namespace of the service. Required",
|
||||
"name": "name is the name of the service. Required",
|
||||
"path": "path is an optional URL path which will be sent in any request to this service.",
|
||||
"port": "port is the port on the service that hosts the webhook. Default to 443 for backward compatibility. `port` should be a valid port number (1-65535, inclusive).",
|
||||
}
|
||||
|
||||
func (ServiceReference) SwaggerDoc() map[string]string {
|
||||
@@ -176,7 +271,7 @@ func (ServiceReference) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TypeChecking = map[string]string{
|
||||
"": "TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy",
|
||||
"expressionWarnings": "The type checking warnings for each expression.",
|
||||
"expressionWarnings": "expressionWarnings contains the type checking warnings for each expression.",
|
||||
}
|
||||
|
||||
func (TypeChecking) SwaggerDoc() map[string]string {
|
||||
@@ -185,9 +280,9 @@ func (TypeChecking) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicy = map[string]string{
|
||||
"": "ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the ValidatingAdmissionPolicy.",
|
||||
"status": "The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the ValidatingAdmissionPolicy.",
|
||||
"status": "status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
@@ -196,8 +291,8 @@ func (ValidatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyBinding = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.\n\nFor a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding.\n\nThe CEL expressions of a policy must have a computed CEL cost below the maximum CEL budget. Each evaluation of the policy is given an independent CEL cost budget. Adding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
@@ -206,7 +301,7 @@ func (ValidatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyBindingList = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of PolicyBinding.",
|
||||
}
|
||||
|
||||
@@ -216,9 +311,9 @@ func (ValidatingAdmissionPolicyBindingList) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyBindingSpec = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.",
|
||||
"policyName": "PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.",
|
||||
"policyName": "policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.",
|
||||
"paramRef": "paramRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied. If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.",
|
||||
"matchResources": "MatchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.",
|
||||
"matchResources": "matchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.",
|
||||
"validationActions": "validationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced. If a validation evaluates to false it is always enforced according to these actions.\n\nFailures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according to these actions only if the FailurePolicy is set to Fail, otherwise the failures are ignored. This includes compilation errors, runtime errors and misconfigurations of the policy.\n\nvalidationActions is declared as a set of action values. Order does not matter. validationActions may not contain duplicates of the same action.\n\nThe supported actions values are:\n\n\"Deny\" specifies that a validation failure results in a denied request.\n\n\"Warn\" specifies that a validation failure is reported to the request client in HTTP Warning headers, with a warning code of 299. Warnings can be sent both for allowed or denied admission responses.\n\n\"Audit\" specifies that a validation failure is included in the published audit event for the request. The audit event will contain a `validation.policy.admission.k8s.io/validation_failure` audit annotation with a value containing the details of the validation failures, formatted as a JSON list of objects, each with the following fields: - message: The validation failure message string - policy: The resource name of the ValidatingAdmissionPolicy - binding: The resource name of the ValidatingAdmissionPolicyBinding - expressionIndex: The index of the failed validations in the ValidatingAdmissionPolicy - validationActions: The enforcement actions enacted for the validation failure Example audit annotation: `\"validation.policy.admission.k8s.io/validation_failure\": \"[{\"message\": \"Invalid value\", {\"policy\": \"policy.example.com\", {\"binding\": \"policybinding.example.com\", {\"expressionIndex\": \"1\", {\"validationActions\": [\"Audit\"]}]\"`\n\nClients should expect to handle additional values by ignoring any values not recognized.\n\n\"Deny\" and \"Warn\" may not be used together since this combination needlessly duplicates the validation failure both in the API response body and the HTTP warning headers.\n\nRequired.",
|
||||
}
|
||||
|
||||
@@ -228,7 +323,7 @@ func (ValidatingAdmissionPolicyBindingSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyList = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of ValidatingAdmissionPolicy.",
|
||||
}
|
||||
|
||||
@@ -238,13 +333,13 @@ func (ValidatingAdmissionPolicyList) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicySpec = map[string]string{
|
||||
"": "ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.",
|
||||
"paramKind": "ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.",
|
||||
"matchConstraints": "MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.",
|
||||
"validations": "Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.",
|
||||
"paramKind": "paramKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.",
|
||||
"matchConstraints": "matchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.",
|
||||
"validations": "validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.",
|
||||
"failurePolicy": "failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.\n\nA policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.\n\nfailurePolicy does not define how validations that evaluate to false are handled.\n\nWhen failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.\n\nAllowed values are Ignore or Fail. Defaults to Fail.",
|
||||
"auditAnnotations": "auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.",
|
||||
"matchConditions": "MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the policy is skipped",
|
||||
"variables": "Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.\n\nThe expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.",
|
||||
"matchConditions": "matchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the policy is skipped",
|
||||
"variables": "variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.\n\nThe expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicySpec) SwaggerDoc() map[string]string {
|
||||
@@ -253,9 +348,9 @@ func (ValidatingAdmissionPolicySpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyStatus = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.",
|
||||
"observedGeneration": "The generation observed by the controller.",
|
||||
"typeChecking": "The results of type checking for each expression. Presence of this field indicates the completion of the type checking.",
|
||||
"conditions": "The conditions represent the latest available observations of a policy's current state.",
|
||||
"observedGeneration": "observedGeneration is the generation observed by the controller.",
|
||||
"typeChecking": "typeChecking contains the results of type checking for each expression. Presence of this field indicates the completion of the type checking.",
|
||||
"conditions": "conditions represent the latest available observations of a policy's current state.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicyStatus) SwaggerDoc() map[string]string {
|
||||
@@ -264,17 +359,17 @@ func (ValidatingAdmissionPolicyStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingWebhook = map[string]string{
|
||||
"": "ValidatingWebhook describes an admission webhook and the resources and operations it applies to.",
|
||||
"name": "The name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where \"imagepolicy\" is the name of the webhook, and kubernetes.io is the name of the organization. Required.",
|
||||
"clientConfig": "ClientConfig defines how to communicate with the hook. Required",
|
||||
"rules": "Rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.",
|
||||
"failurePolicy": "FailurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Fail.",
|
||||
"name": "name is the name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where \"imagepolicy\" is the name of the webhook, and kubernetes.io is the name of the organization. Required.",
|
||||
"clientConfig": "clientConfig defines how to communicate with the hook. Required",
|
||||
"rules": "rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.",
|
||||
"failurePolicy": "failurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Fail.",
|
||||
"matchPolicy": "matchPolicy defines how the \"rules\" list is used to match incoming requests. Allowed values are \"Exact\" or \"Equivalent\".\n\n- Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.\n\n- Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.\n\nDefaults to \"Equivalent\"",
|
||||
"namespaceSelector": "NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the webhook on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "ObjectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"sideEffects": "SideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.",
|
||||
"timeoutSeconds": "TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 10 seconds.",
|
||||
"admissionReviewVersions": "AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy.",
|
||||
"matchConditions": "MatchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the webhook is called.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the error is ignored and the webhook is skipped",
|
||||
"namespaceSelector": "namespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the webhook on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "objectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"sideEffects": "sideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.",
|
||||
"timeoutSeconds": "timeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 10 seconds.",
|
||||
"admissionReviewVersions": "admissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy.",
|
||||
"matchConditions": "matchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the webhook is called.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the error is ignored and the webhook is skipped",
|
||||
}
|
||||
|
||||
func (ValidatingWebhook) SwaggerDoc() map[string]string {
|
||||
@@ -283,8 +378,8 @@ func (ValidatingWebhook) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingWebhookConfiguration = map[string]string{
|
||||
"": "ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"webhooks": "Webhooks is a list of webhooks and the affected resources and operations.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"webhooks": "webhooks is a list of webhooks and the affected resources and operations.",
|
||||
}
|
||||
|
||||
func (ValidatingWebhookConfiguration) SwaggerDoc() map[string]string {
|
||||
@@ -293,7 +388,7 @@ func (ValidatingWebhookConfiguration) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingWebhookConfigurationList = map[string]string{
|
||||
"": "ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of ValidatingWebhookConfiguration.",
|
||||
}
|
||||
|
||||
@@ -303,9 +398,9 @@ func (ValidatingWebhookConfigurationList) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_Validation = map[string]string{
|
||||
"": "Validation specifies the CEL expression which is used to apply the validation.",
|
||||
"expression": "Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired.",
|
||||
"message": "Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is \"failed rule: {Rule}\". e.g. \"must be a URL with the host matching spec.host\" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is \"failed Expression: {Expression}\".",
|
||||
"reason": "Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: \"Unauthorized\", \"Forbidden\", \"Invalid\", \"RequestEntityTooLarge\". If not set, StatusReasonInvalid is used in the response to the client.",
|
||||
"expression": "expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired.",
|
||||
"message": "message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is \"failed rule: {Rule}\". e.g. \"must be a URL with the host matching spec.host\" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is \"failed Expression: {Expression}\".",
|
||||
"reason": "reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: \"Unauthorized\", \"Forbidden\", \"Invalid\", \"RequestEntityTooLarge\". If not set, StatusReasonInvalid is used in the response to the client.",
|
||||
"messageExpression": "messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. Example: \"object.x must be less than max (\"+string(params.max)+\")\"",
|
||||
}
|
||||
|
||||
@@ -315,8 +410,8 @@ func (Validation) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_Variable = map[string]string{
|
||||
"": "Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.",
|
||||
"name": "Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is \"foo\", the variable will be available as `variables.foo`",
|
||||
"expression": "Expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.",
|
||||
"name": "name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is \"foo\", the variable will be available as `variables.foo`",
|
||||
"expression": "expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.",
|
||||
}
|
||||
|
||||
func (Variable) SwaggerDoc() map[string]string {
|
||||
@@ -325,9 +420,9 @@ func (Variable) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_WebhookClientConfig = map[string]string{
|
||||
"": "WebhookClientConfig contains the information to make a TLS connection with the webhook",
|
||||
"url": "`url` gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nThe scheme must be \"https\"; the URL must begin with \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.\n\nAttempting to use a user or basic auth e.g. \"user:password@\" is not allowed. Fragments (\"#...\") and query parameters (\"?...\") are not allowed, either.",
|
||||
"service": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.",
|
||||
"caBundle": "`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. If unspecified, system trust roots on the apiserver are used.",
|
||||
"url": "url gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nThe scheme must be \"https\"; the URL must begin with \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.\n\nAttempting to use a user or basic auth e.g. \"user:password@\" is not allowed. Fragments (\"#...\") and query parameters (\"?...\") are not allowed, either.",
|
||||
"service": "service is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.",
|
||||
"caBundle": "caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. If unspecified, system trust roots on the apiserver are used.",
|
||||
}
|
||||
|
||||
func (WebhookClientConfig) SwaggerDoc() map[string]string {
|
||||
|
||||
+252
@@ -26,6 +26,22 @@ import (
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ApplyConfiguration) DeepCopyInto(out *ApplyConfiguration) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplyConfiguration.
|
||||
func (in *ApplyConfiguration) DeepCopy() *ApplyConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ApplyConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AuditAnnotation) DeepCopyInto(out *AuditAnnotation) {
|
||||
*out = *in
|
||||
@@ -58,6 +74,22 @@ func (in *ExpressionWarning) DeepCopy() *ExpressionWarning {
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *JSONPatch) DeepCopyInto(out *JSONPatch) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JSONPatch.
|
||||
func (in *JSONPatch) DeepCopy() *JSONPatch {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(JSONPatch)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MatchCondition) DeepCopyInto(out *MatchCondition) {
|
||||
*out = *in
|
||||
@@ -119,6 +151,200 @@ func (in *MatchResources) DeepCopy() *MatchResources {
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MutatingAdmissionPolicy) DeepCopyInto(out *MutatingAdmissionPolicy) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
in.Spec.DeepCopyInto(&out.Spec)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingAdmissionPolicy.
|
||||
func (in *MutatingAdmissionPolicy) DeepCopy() *MutatingAdmissionPolicy {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MutatingAdmissionPolicy)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *MutatingAdmissionPolicy) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MutatingAdmissionPolicyBinding) DeepCopyInto(out *MutatingAdmissionPolicyBinding) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
in.Spec.DeepCopyInto(&out.Spec)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingAdmissionPolicyBinding.
|
||||
func (in *MutatingAdmissionPolicyBinding) DeepCopy() *MutatingAdmissionPolicyBinding {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MutatingAdmissionPolicyBinding)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *MutatingAdmissionPolicyBinding) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MutatingAdmissionPolicyBindingList) DeepCopyInto(out *MutatingAdmissionPolicyBindingList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]MutatingAdmissionPolicyBinding, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingAdmissionPolicyBindingList.
|
||||
func (in *MutatingAdmissionPolicyBindingList) DeepCopy() *MutatingAdmissionPolicyBindingList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MutatingAdmissionPolicyBindingList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *MutatingAdmissionPolicyBindingList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MutatingAdmissionPolicyBindingSpec) DeepCopyInto(out *MutatingAdmissionPolicyBindingSpec) {
|
||||
*out = *in
|
||||
if in.ParamRef != nil {
|
||||
in, out := &in.ParamRef, &out.ParamRef
|
||||
*out = new(ParamRef)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.MatchResources != nil {
|
||||
in, out := &in.MatchResources, &out.MatchResources
|
||||
*out = new(MatchResources)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingAdmissionPolicyBindingSpec.
|
||||
func (in *MutatingAdmissionPolicyBindingSpec) DeepCopy() *MutatingAdmissionPolicyBindingSpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MutatingAdmissionPolicyBindingSpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MutatingAdmissionPolicyList) DeepCopyInto(out *MutatingAdmissionPolicyList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]MutatingAdmissionPolicy, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingAdmissionPolicyList.
|
||||
func (in *MutatingAdmissionPolicyList) DeepCopy() *MutatingAdmissionPolicyList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MutatingAdmissionPolicyList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *MutatingAdmissionPolicyList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MutatingAdmissionPolicySpec) DeepCopyInto(out *MutatingAdmissionPolicySpec) {
|
||||
*out = *in
|
||||
if in.ParamKind != nil {
|
||||
in, out := &in.ParamKind, &out.ParamKind
|
||||
*out = new(ParamKind)
|
||||
**out = **in
|
||||
}
|
||||
if in.MatchConstraints != nil {
|
||||
in, out := &in.MatchConstraints, &out.MatchConstraints
|
||||
*out = new(MatchResources)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Variables != nil {
|
||||
in, out := &in.Variables, &out.Variables
|
||||
*out = make([]Variable, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.Mutations != nil {
|
||||
in, out := &in.Mutations, &out.Mutations
|
||||
*out = make([]Mutation, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
if in.FailurePolicy != nil {
|
||||
in, out := &in.FailurePolicy, &out.FailurePolicy
|
||||
*out = new(FailurePolicyType)
|
||||
**out = **in
|
||||
}
|
||||
if in.MatchConditions != nil {
|
||||
in, out := &in.MatchConditions, &out.MatchConditions
|
||||
*out = make([]MatchCondition, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MutatingAdmissionPolicySpec.
|
||||
func (in *MutatingAdmissionPolicySpec) DeepCopy() *MutatingAdmissionPolicySpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MutatingAdmissionPolicySpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MutatingWebhook) DeepCopyInto(out *MutatingWebhook) {
|
||||
*out = *in
|
||||
@@ -254,6 +480,32 @@ func (in *MutatingWebhookConfigurationList) DeepCopyObject() runtime.Object {
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *Mutation) DeepCopyInto(out *Mutation) {
|
||||
*out = *in
|
||||
if in.ApplyConfiguration != nil {
|
||||
in, out := &in.ApplyConfiguration, &out.ApplyConfiguration
|
||||
*out = new(ApplyConfiguration)
|
||||
**out = **in
|
||||
}
|
||||
if in.JSONPatch != nil {
|
||||
in, out := &in.JSONPatch, &out.JSONPatch
|
||||
*out = new(JSONPatch)
|
||||
**out = **in
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Mutation.
|
||||
func (in *Mutation) DeepCopy() *Mutation {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(Mutation)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *NamedRuleWithOperations) DeepCopyInto(out *NamedRuleWithOperations) {
|
||||
*out = *in
|
||||
|
||||
+45
@@ -21,6 +21,11 @@ limitations under the License.
|
||||
|
||||
package v1
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ApplyConfiguration) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.ApplyConfiguration"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in AuditAnnotation) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.AuditAnnotation"
|
||||
@@ -31,6 +36,11 @@ func (in ExpressionWarning) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.ExpressionWarning"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in JSONPatch) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.JSONPatch"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MatchCondition) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MatchCondition"
|
||||
@@ -41,6 +51,36 @@ func (in MatchResources) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MatchResources"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MutatingAdmissionPolicy) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MutatingAdmissionPolicy"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MutatingAdmissionPolicyBinding) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MutatingAdmissionPolicyBinding"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MutatingAdmissionPolicyBindingList) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MutatingAdmissionPolicyBindingList"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MutatingAdmissionPolicyBindingSpec) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MutatingAdmissionPolicyBindingSpec"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MutatingAdmissionPolicyList) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MutatingAdmissionPolicyList"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MutatingAdmissionPolicySpec) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MutatingAdmissionPolicySpec"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MutatingWebhook) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MutatingWebhook"
|
||||
@@ -56,6 +96,11 @@ func (in MutatingWebhookConfigurationList) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.MutatingWebhookConfigurationList"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in Mutation) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.Mutation"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in NamedRuleWithOperations) OpenAPIModelName() string {
|
||||
return "io.k8s.api.admissionregistration.v1.NamedRuleWithOperations"
|
||||
|
||||
+24
@@ -21,6 +21,30 @@ limitations under the License.
|
||||
|
||||
package v1
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *MutatingAdmissionPolicy) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 36
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *MutatingAdmissionPolicyBinding) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 36
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *MutatingAdmissionPolicyBindingList) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 36
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *MutatingAdmissionPolicyList) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 36
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *MutatingWebhookConfiguration) APILifecycleIntroduced() (major, minor int) {
|
||||
|
||||
+47
-42
@@ -113,12 +113,12 @@ message AuditAnnotation {
|
||||
|
||||
// ExpressionWarning is a warning information that targets a specific expression.
|
||||
message ExpressionWarning {
|
||||
// The path to the field that refers the expression.
|
||||
// fieldRef is the path to the field that refers to the expression.
|
||||
// For example, the reference to the expression of the first item of
|
||||
// validations is "spec.validations[0].expression"
|
||||
optional string fieldRef = 2;
|
||||
|
||||
// The content of type checking information in a human-readable form.
|
||||
// warning contains the content of type checking information in a human-readable form.
|
||||
// Each line of the warning contains the type that the expression is checked
|
||||
// against, followed by the type check error from the compiler.
|
||||
optional string warning = 3;
|
||||
@@ -194,7 +194,7 @@ message JSONPatch {
|
||||
}
|
||||
|
||||
message MatchCondition {
|
||||
// Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
// the associated expression.
|
||||
// Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
@@ -205,7 +205,7 @@ message MatchCondition {
|
||||
// Required.
|
||||
optional string name = 1;
|
||||
|
||||
// Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
//
|
||||
// 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
@@ -226,7 +226,7 @@ message MatchCondition {
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +structType=atomic
|
||||
message MatchResources {
|
||||
// NamespaceSelector decides whether to run the admission control policy on an object based
|
||||
// namespaceSelector decides whether to run the admission control policy on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -272,7 +272,7 @@ message MatchResources {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 1;
|
||||
|
||||
// ObjectSelector decides whether to run the policy based on if the
|
||||
// objectSelector decides whether to run the policy based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the policy's expression (CEL), and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -286,13 +286,13 @@ message MatchResources {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 2;
|
||||
|
||||
// ResourceRules describes what operations on what resources/subresources the admission policy matches.
|
||||
// resourceRules describes what operations on what resources/subresources the admission policy matches.
|
||||
// The policy cares about an operation if it matches _any_ Rule.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
repeated NamedRuleWithOperations resourceRules = 3;
|
||||
|
||||
// ExcludeResourceRules describes what operations on what resources/subresources the policy should not care about.
|
||||
// excludeResourceRules describes what operations on what resources/subresources the policy should not care about.
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
@@ -319,11 +319,11 @@ message MatchResources {
|
||||
|
||||
// MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
|
||||
message MutatingAdmissionPolicy {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the MutatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicy.
|
||||
optional MutatingAdmissionPolicySpec spec = 2;
|
||||
}
|
||||
|
||||
@@ -339,17 +339,17 @@ message MutatingAdmissionPolicy {
|
||||
// Adding/removing policies, bindings, or params can not affect whether a
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
message MutatingAdmissionPolicyBinding {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
optional MutatingAdmissionPolicyBindingSpec spec = 2;
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.
|
||||
message MutatingAdmissionPolicyBindingList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -387,7 +387,7 @@ message MutatingAdmissionPolicyBindingSpec {
|
||||
|
||||
// MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.
|
||||
message MutatingAdmissionPolicyList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -507,7 +507,7 @@ message Mutation {
|
||||
// NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
|
||||
// +structType=atomic
|
||||
message NamedRuleWithOperations {
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
repeated string resourceNames = 1;
|
||||
@@ -519,12 +519,12 @@ message NamedRuleWithOperations {
|
||||
// ParamKind is a tuple of Group Kind and Version.
|
||||
// +structType=atomic
|
||||
message ParamKind {
|
||||
// APIVersion is the API group version the resources belong to.
|
||||
// apiVersion is the API group version the resources belong to.
|
||||
// In format of "group/version".
|
||||
// Required.
|
||||
optional string apiVersion = 1;
|
||||
|
||||
// Kind is the API kind the resources belong to.
|
||||
// kind is the API kind the resources belong to.
|
||||
// Required.
|
||||
optional string kind = 2;
|
||||
}
|
||||
@@ -533,7 +533,7 @@ message ParamKind {
|
||||
// expressions of rules applied by a policy binding.
|
||||
// +structType=atomic
|
||||
message ParamRef {
|
||||
// `name` is the name of the resource being referenced.
|
||||
// name is the name of the resource being referenced.
|
||||
//
|
||||
// `name` and `selector` are mutually exclusive properties. If one is set,
|
||||
// the other must be unset.
|
||||
@@ -571,7 +571,7 @@ message ParamRef {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 3;
|
||||
|
||||
// `parameterNotFoundAction` controls the behavior of the binding when the resource
|
||||
// parameterNotFoundAction controls the behavior of the binding when the resource
|
||||
// exists, and name or selector is valid, but there are no parameters
|
||||
// matched by the binding. If the value is set to `Allow`, then no
|
||||
// matched parameters will be treated as successful validation by the binding.
|
||||
@@ -587,7 +587,7 @@ message ParamRef {
|
||||
// TypeChecking contains results of type checking the expressions in the
|
||||
// ValidatingAdmissionPolicy
|
||||
message TypeChecking {
|
||||
// The type checking warnings for each expression.
|
||||
// expressionWarnings contains the type checking warnings for each expression.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated ExpressionWarning expressionWarnings = 1;
|
||||
@@ -595,14 +595,14 @@ message TypeChecking {
|
||||
|
||||
// ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
|
||||
message ValidatingAdmissionPolicy {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicy.
|
||||
optional ValidatingAdmissionPolicySpec spec = 2;
|
||||
|
||||
// The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// behaves in the expected way.
|
||||
// Populated by the system.
|
||||
// Read-only.
|
||||
@@ -622,17 +622,18 @@ message ValidatingAdmissionPolicy {
|
||||
// Adding/removing policies, bindings, or params can not affect whether a
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
message ValidatingAdmissionPolicyBinding {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// +required
|
||||
optional ValidatingAdmissionPolicyBindingSpec spec = 2;
|
||||
}
|
||||
|
||||
// ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.
|
||||
message ValidatingAdmissionPolicyBindingList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -643,9 +644,11 @@ message ValidatingAdmissionPolicyBindingList {
|
||||
|
||||
// ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
|
||||
message ValidatingAdmissionPolicyBindingSpec {
|
||||
// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
|
||||
// Required.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
optional string policyName = 1;
|
||||
|
||||
// paramRef specifies the parameter resource used to configure the admission control policy.
|
||||
@@ -655,7 +658,7 @@ message ValidatingAdmissionPolicyBindingSpec {
|
||||
// +optional
|
||||
optional ParamRef paramRef = 2;
|
||||
|
||||
// MatchResources declares what resources match this binding and will be validated by it.
|
||||
// matchResources declares what resources match this binding and will be validated by it.
|
||||
// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
|
||||
// If this is unset, all resources matched by the policy are validated by this binding
|
||||
// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
|
||||
@@ -703,12 +706,14 @@ message ValidatingAdmissionPolicyBindingSpec {
|
||||
//
|
||||
// Required.
|
||||
// +listType=set
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
repeated string validationActions = 4;
|
||||
}
|
||||
|
||||
// ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.
|
||||
message ValidatingAdmissionPolicyList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -719,21 +724,21 @@ message ValidatingAdmissionPolicyList {
|
||||
|
||||
// ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
|
||||
message ValidatingAdmissionPolicySpec {
|
||||
// ParamKind specifies the kind of resources used to parameterize this policy.
|
||||
// paramKind specifies the kind of resources used to parameterize this policy.
|
||||
// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
|
||||
// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
|
||||
// If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
|
||||
// +optional
|
||||
optional ParamKind paramKind = 1;
|
||||
|
||||
// MatchConstraints specifies what resources this policy is designed to validate.
|
||||
// matchConstraints specifies what resources this policy is designed to validate.
|
||||
// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
|
||||
// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
|
||||
// ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
|
||||
// Required.
|
||||
optional MatchResources matchConstraints = 2;
|
||||
|
||||
// Validations contain CEL expressions which is used to apply the validation.
|
||||
// validations contain CEL expressions which is used to apply the validation.
|
||||
// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
|
||||
// required.
|
||||
// +listType=atomic
|
||||
@@ -764,7 +769,7 @@ message ValidatingAdmissionPolicySpec {
|
||||
// +optional
|
||||
repeated AuditAnnotation auditAnnotations = 5;
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// matchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -786,7 +791,7 @@ message ValidatingAdmissionPolicySpec {
|
||||
// +optional
|
||||
repeated MatchCondition matchConditions = 6;
|
||||
|
||||
// Variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// Each variable is defined as a named CEL expression.
|
||||
// The variables defined here will be available under `variables` in other expressions of the policy
|
||||
// except MatchConditions because MatchConditions are evaluated before the rest of the policy.
|
||||
@@ -803,16 +808,16 @@ message ValidatingAdmissionPolicySpec {
|
||||
|
||||
// ValidatingAdmissionPolicyStatus represents the status of a ValidatingAdmissionPolicy.
|
||||
message ValidatingAdmissionPolicyStatus {
|
||||
// The generation observed by the controller.
|
||||
// observedGeneration is the generation observed by the controller.
|
||||
// +optional
|
||||
optional int64 observedGeneration = 1;
|
||||
|
||||
// The results of type checking for each expression.
|
||||
// typeChecking contains the results of type checking for each expression.
|
||||
// Presence of this field indicates the completion of the type checking.
|
||||
// +optional
|
||||
optional TypeChecking typeChecking = 2;
|
||||
|
||||
// The conditions represent the latest available observations of a policy's current state.
|
||||
// conditions represent the latest available observations of a policy's current state.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=type
|
||||
@@ -821,7 +826,7 @@ message ValidatingAdmissionPolicyStatus {
|
||||
|
||||
// Validation specifies the CEL expression which is used to apply the validation.
|
||||
message Validation {
|
||||
// Expression represents the expression which will be evaluated by CEL.
|
||||
// expression represents the expression which will be evaluated by CEL.
|
||||
// ref: https://github.com/google/cel-spec
|
||||
// CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
@@ -864,7 +869,7 @@ message Validation {
|
||||
// Required.
|
||||
optional string Expression = 1;
|
||||
|
||||
// Message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// line breaks. The message must not contain line breaks.
|
||||
// If unset, the message is "failed rule: {Rule}".
|
||||
// e.g. "must be a URL with the host matching spec.host"
|
||||
@@ -874,7 +879,7 @@ message Validation {
|
||||
// +optional
|
||||
optional string message = 2;
|
||||
|
||||
// Reason represents a machine-readable description of why this validation failed.
|
||||
// reason represents a machine-readable description of why this validation failed.
|
||||
// If this is the first validation in the list to fail, this reason, as well as the
|
||||
// corresponding HTTP response code, are used in the
|
||||
// HTTP response to the client.
|
||||
@@ -899,12 +904,12 @@ message Validation {
|
||||
|
||||
// Variable is the definition of a variable that is used for composition.
|
||||
message Variable {
|
||||
// Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// The variable can be accessed in other expressions through `variables`
|
||||
// For example, if name is "foo", the variable will be available as `variables.foo`
|
||||
optional string Name = 1;
|
||||
|
||||
// Expression is the expression that will be evaluated as the value of the variable.
|
||||
// expression is the expression that will be evaluated as the value of the variable.
|
||||
// The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
||||
optional string Expression = 2;
|
||||
}
|
||||
|
||||
-74
@@ -1,74 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
func (*ApplyConfiguration) ProtoMessage() {}
|
||||
|
||||
func (*AuditAnnotation) ProtoMessage() {}
|
||||
|
||||
func (*ExpressionWarning) ProtoMessage() {}
|
||||
|
||||
func (*JSONPatch) ProtoMessage() {}
|
||||
|
||||
func (*MatchCondition) ProtoMessage() {}
|
||||
|
||||
func (*MatchResources) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicy) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicyBinding) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicyBindingList) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicyBindingSpec) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicyList) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicySpec) ProtoMessage() {}
|
||||
|
||||
func (*Mutation) ProtoMessage() {}
|
||||
|
||||
func (*NamedRuleWithOperations) ProtoMessage() {}
|
||||
|
||||
func (*ParamKind) ProtoMessage() {}
|
||||
|
||||
func (*ParamRef) ProtoMessage() {}
|
||||
|
||||
func (*TypeChecking) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicy) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyBinding) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyBindingList) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyBindingSpec) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyList) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicySpec) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyStatus) ProtoMessage() {}
|
||||
|
||||
func (*Validation) ProtoMessage() {}
|
||||
|
||||
func (*Variable) ProtoMessage() {}
|
||||
+45
-40
@@ -83,12 +83,12 @@ const (
|
||||
// ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
|
||||
type ValidatingAdmissionPolicy struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicy.
|
||||
Spec ValidatingAdmissionPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
// The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// behaves in the expected way.
|
||||
// Populated by the system.
|
||||
// Read-only.
|
||||
@@ -98,14 +98,14 @@ type ValidatingAdmissionPolicy struct {
|
||||
|
||||
// ValidatingAdmissionPolicyStatus represents the status of a ValidatingAdmissionPolicy.
|
||||
type ValidatingAdmissionPolicyStatus struct {
|
||||
// The generation observed by the controller.
|
||||
// observedGeneration is the generation observed by the controller.
|
||||
// +optional
|
||||
ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,1,opt,name=observedGeneration"`
|
||||
// The results of type checking for each expression.
|
||||
// typeChecking contains the results of type checking for each expression.
|
||||
// Presence of this field indicates the completion of the type checking.
|
||||
// +optional
|
||||
TypeChecking *TypeChecking `json:"typeChecking,omitempty" protobuf:"bytes,2,opt,name=typeChecking"`
|
||||
// The conditions represent the latest available observations of a policy's current state.
|
||||
// conditions represent the latest available observations of a policy's current state.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=type
|
||||
@@ -115,7 +115,7 @@ type ValidatingAdmissionPolicyStatus struct {
|
||||
// TypeChecking contains results of type checking the expressions in the
|
||||
// ValidatingAdmissionPolicy
|
||||
type TypeChecking struct {
|
||||
// The type checking warnings for each expression.
|
||||
// expressionWarnings contains the type checking warnings for each expression.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
ExpressionWarnings []ExpressionWarning `json:"expressionWarnings,omitempty" protobuf:"bytes,1,rep,name=expressionWarnings"`
|
||||
@@ -123,11 +123,11 @@ type TypeChecking struct {
|
||||
|
||||
// ExpressionWarning is a warning information that targets a specific expression.
|
||||
type ExpressionWarning struct {
|
||||
// The path to the field that refers the expression.
|
||||
// fieldRef is the path to the field that refers to the expression.
|
||||
// For example, the reference to the expression of the first item of
|
||||
// validations is "spec.validations[0].expression"
|
||||
FieldRef string `json:"fieldRef" protobuf:"bytes,2,opt,name=fieldRef"`
|
||||
// The content of type checking information in a human-readable form.
|
||||
// warning contains the content of type checking information in a human-readable form.
|
||||
// Each line of the warning contains the type that the expression is checked
|
||||
// against, followed by the type check error from the compiler.
|
||||
Warning string `json:"warning" protobuf:"bytes,3,opt,name=warning"`
|
||||
@@ -139,7 +139,7 @@ type ExpressionWarning struct {
|
||||
// ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.
|
||||
type ValidatingAdmissionPolicyList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -149,21 +149,21 @@ type ValidatingAdmissionPolicyList struct {
|
||||
|
||||
// ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
|
||||
type ValidatingAdmissionPolicySpec struct {
|
||||
// ParamKind specifies the kind of resources used to parameterize this policy.
|
||||
// paramKind specifies the kind of resources used to parameterize this policy.
|
||||
// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
|
||||
// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
|
||||
// If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
|
||||
// +optional
|
||||
ParamKind *ParamKind `json:"paramKind,omitempty" protobuf:"bytes,1,rep,name=paramKind"`
|
||||
|
||||
// MatchConstraints specifies what resources this policy is designed to validate.
|
||||
// matchConstraints specifies what resources this policy is designed to validate.
|
||||
// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
|
||||
// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
|
||||
// ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
|
||||
// Required.
|
||||
MatchConstraints *MatchResources `json:"matchConstraints,omitempty" protobuf:"bytes,2,rep,name=matchConstraints"`
|
||||
|
||||
// Validations contain CEL expressions which is used to apply the validation.
|
||||
// validations contain CEL expressions which is used to apply the validation.
|
||||
// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
|
||||
// required.
|
||||
// +listType=atomic
|
||||
@@ -194,7 +194,7 @@ type ValidatingAdmissionPolicySpec struct {
|
||||
// +optional
|
||||
AuditAnnotations []AuditAnnotation `json:"auditAnnotations,omitempty" protobuf:"bytes,5,rep,name=auditAnnotations"`
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// matchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -216,7 +216,7 @@ type ValidatingAdmissionPolicySpec struct {
|
||||
// +optional
|
||||
MatchConditions []MatchCondition `json:"matchConditions,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,6,rep,name=matchConditions"`
|
||||
|
||||
// Variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// Each variable is defined as a named CEL expression.
|
||||
// The variables defined here will be available under `variables` in other expressions of the policy
|
||||
// except MatchConditions because MatchConditions are evaluated before the rest of the policy.
|
||||
@@ -236,19 +236,19 @@ type MatchCondition v1.MatchCondition
|
||||
// ParamKind is a tuple of Group Kind and Version.
|
||||
// +structType=atomic
|
||||
type ParamKind struct {
|
||||
// APIVersion is the API group version the resources belong to.
|
||||
// apiVersion is the API group version the resources belong to.
|
||||
// In format of "group/version".
|
||||
// Required.
|
||||
APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,1,rep,name=apiVersion"`
|
||||
|
||||
// Kind is the API kind the resources belong to.
|
||||
// kind is the API kind the resources belong to.
|
||||
// Required.
|
||||
Kind string `json:"kind,omitempty" protobuf:"bytes,2,rep,name=kind"`
|
||||
}
|
||||
|
||||
// Validation specifies the CEL expression which is used to apply the validation.
|
||||
type Validation struct {
|
||||
// Expression represents the expression which will be evaluated by CEL.
|
||||
// expression represents the expression which will be evaluated by CEL.
|
||||
// ref: https://github.com/google/cel-spec
|
||||
// CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
@@ -290,7 +290,7 @@ type Validation struct {
|
||||
// non-intersecting keys are appended, retaining their partial order.
|
||||
// Required.
|
||||
Expression string `json:"expression" protobuf:"bytes,1,opt,name=Expression"`
|
||||
// Message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// line breaks. The message must not contain line breaks.
|
||||
// If unset, the message is "failed rule: {Rule}".
|
||||
// e.g. "must be a URL with the host matching spec.host"
|
||||
@@ -299,7 +299,7 @@ type Validation struct {
|
||||
// If unset, the message is "failed Expression: {Expression}".
|
||||
// +optional
|
||||
Message string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"`
|
||||
// Reason represents a machine-readable description of why this validation failed.
|
||||
// reason represents a machine-readable description of why this validation failed.
|
||||
// If this is the first validation in the list to fail, this reason, as well as the
|
||||
// corresponding HTTP response code, are used in the
|
||||
// HTTP response to the client.
|
||||
@@ -323,12 +323,12 @@ type Validation struct {
|
||||
|
||||
// Variable is the definition of a variable that is used for composition.
|
||||
type Variable struct {
|
||||
// Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// The variable can be accessed in other expressions through `variables`
|
||||
// For example, if name is "foo", the variable will be available as `variables.foo`
|
||||
Name string `json:"name" protobuf:"bytes,1,opt,name=Name"`
|
||||
|
||||
// Expression is the expression that will be evaluated as the value of the variable.
|
||||
// expression is the expression that will be evaluated as the value of the variable.
|
||||
// The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
||||
Expression string `json:"expression" protobuf:"bytes,2,opt,name=Expression"`
|
||||
}
|
||||
@@ -388,10 +388,11 @@ type AuditAnnotation struct {
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
type ValidatingAdmissionPolicyBinding struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// +required
|
||||
Spec ValidatingAdmissionPolicyBindingSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
}
|
||||
|
||||
@@ -401,7 +402,7 @@ type ValidatingAdmissionPolicyBinding struct {
|
||||
// ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.
|
||||
type ValidatingAdmissionPolicyBindingList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -411,9 +412,11 @@ type ValidatingAdmissionPolicyBindingList struct {
|
||||
|
||||
// ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
|
||||
type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
|
||||
// Required.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
PolicyName string `json:"policyName,omitempty" protobuf:"bytes,1,rep,name=policyName"`
|
||||
|
||||
// paramRef specifies the parameter resource used to configure the admission control policy.
|
||||
@@ -423,7 +426,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
// +optional
|
||||
ParamRef *ParamRef `json:"paramRef,omitempty" protobuf:"bytes,2,rep,name=paramRef"`
|
||||
|
||||
// MatchResources declares what resources match this binding and will be validated by it.
|
||||
// matchResources declares what resources match this binding and will be validated by it.
|
||||
// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
|
||||
// If this is unset, all resources matched by the policy are validated by this binding
|
||||
// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
|
||||
@@ -471,6 +474,8 @@ type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
//
|
||||
// Required.
|
||||
// +listType=set
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
ValidationActions []ValidationAction `json:"validationActions,omitempty" protobuf:"bytes,4,rep,name=validationActions"`
|
||||
}
|
||||
|
||||
@@ -478,7 +483,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
// expressions of rules applied by a policy binding.
|
||||
// +structType=atomic
|
||||
type ParamRef struct {
|
||||
// `name` is the name of the resource being referenced.
|
||||
// name is the name of the resource being referenced.
|
||||
//
|
||||
// `name` and `selector` are mutually exclusive properties. If one is set,
|
||||
// the other must be unset.
|
||||
@@ -516,7 +521,7 @@ type ParamRef struct {
|
||||
// +optional
|
||||
Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,3,rep,name=selector"`
|
||||
|
||||
// `parameterNotFoundAction` controls the behavior of the binding when the resource
|
||||
// parameterNotFoundAction controls the behavior of the binding when the resource
|
||||
// exists, and name or selector is valid, but there are no parameters
|
||||
// matched by the binding. If the value is set to `Allow`, then no
|
||||
// matched parameters will be treated as successful validation by the binding.
|
||||
@@ -534,7 +539,7 @@ type ParamRef struct {
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +structType=atomic
|
||||
type MatchResources struct {
|
||||
// NamespaceSelector decides whether to run the admission control policy on an object based
|
||||
// namespaceSelector decides whether to run the admission control policy on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -579,7 +584,7 @@ type MatchResources struct {
|
||||
// Default to the empty LabelSelector, which matches everything.
|
||||
// +optional
|
||||
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,1,opt,name=namespaceSelector"`
|
||||
// ObjectSelector decides whether to run the policy based on if the
|
||||
// objectSelector decides whether to run the policy based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the policy's expression (CEL), and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -592,12 +597,12 @@ type MatchResources struct {
|
||||
// Default to the empty LabelSelector, which matches everything.
|
||||
// +optional
|
||||
ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,2,opt,name=objectSelector"`
|
||||
// ResourceRules describes what operations on what resources/subresources the admission policy matches.
|
||||
// resourceRules describes what operations on what resources/subresources the admission policy matches.
|
||||
// The policy cares about an operation if it matches _any_ Rule.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
ResourceRules []NamedRuleWithOperations `json:"resourceRules,omitempty" protobuf:"bytes,3,rep,name=resourceRules"`
|
||||
// ExcludeResourceRules describes what operations on what resources/subresources the policy should not care about.
|
||||
// excludeResourceRules describes what operations on what resources/subresources the policy should not care about.
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
@@ -642,7 +647,7 @@ const (
|
||||
// NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
|
||||
// +structType=atomic
|
||||
type NamedRuleWithOperations struct {
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,1,rep,name=resourceNames"`
|
||||
@@ -675,10 +680,10 @@ const (
|
||||
// MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
|
||||
type MutatingAdmissionPolicy struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the MutatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicy.
|
||||
Spec MutatingAdmissionPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
}
|
||||
|
||||
@@ -688,7 +693,7 @@ type MutatingAdmissionPolicy struct {
|
||||
// MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.
|
||||
type MutatingAdmissionPolicyList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -963,10 +968,10 @@ const (
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
type MutatingAdmissionPolicyBinding struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
Spec MutatingAdmissionPolicyBindingSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
}
|
||||
|
||||
@@ -976,7 +981,7 @@ type MutatingAdmissionPolicyBinding struct {
|
||||
// MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.
|
||||
type MutatingAdmissionPolicyBindingList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
+40
-40
@@ -48,8 +48,8 @@ func (AuditAnnotation) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ExpressionWarning = map[string]string{
|
||||
"": "ExpressionWarning is a warning information that targets a specific expression.",
|
||||
"fieldRef": "The path to the field that refers the expression. For example, the reference to the expression of the first item of validations is \"spec.validations[0].expression\"",
|
||||
"warning": "The content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.",
|
||||
"fieldRef": "fieldRef is the path to the field that refers to the expression. For example, the reference to the expression of the first item of validations is \"spec.validations[0].expression\"",
|
||||
"warning": "warning contains the content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.",
|
||||
}
|
||||
|
||||
func (ExpressionWarning) SwaggerDoc() map[string]string {
|
||||
@@ -67,10 +67,10 @@ func (JSONPatch) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MatchResources = map[string]string{
|
||||
"": "MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",
|
||||
"namespaceSelector": "NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the policy on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "ObjectSelector decides whether to run the policy based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the policy's expression (CEL), and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"resourceRules": "ResourceRules describes what operations on what resources/subresources the admission policy matches. The policy cares about an operation if it matches _any_ Rule.",
|
||||
"excludeResourceRules": "ExcludeResourceRules describes what operations on what resources/subresources the policy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",
|
||||
"namespaceSelector": "namespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the policy on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "objectSelector decides whether to run the policy based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the policy's expression (CEL), and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"resourceRules": "resourceRules describes what operations on what resources/subresources the admission policy matches. The policy cares about an operation if it matches _any_ Rule.",
|
||||
"excludeResourceRules": "excludeResourceRules describes what operations on what resources/subresources the policy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",
|
||||
"matchPolicy": "matchPolicy defines how the \"MatchResources\" list is used to match incoming requests. Allowed values are \"Exact\" or \"Equivalent\".\n\n- Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, the admission policy does not consider requests to apps/v1beta1 or extensions/v1beta1 API groups.\n\n- Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, the admission policy **does** consider requests made to apps/v1beta1 or extensions/v1beta1 API groups. The API server translates the request to a matched resource API if necessary.\n\nDefaults to \"Equivalent\"",
|
||||
}
|
||||
|
||||
@@ -80,8 +80,8 @@ func (MatchResources) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingAdmissionPolicy = map[string]string{
|
||||
"": "MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the MutatingAdmissionPolicy.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the MutatingAdmissionPolicy.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
@@ -90,8 +90,8 @@ func (MutatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingAdmissionPolicyBinding = map[string]string{
|
||||
"": "MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.\n\nFor a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding. Each evaluation is constrained by a [runtime cost budget](https://kubernetes.io/docs/reference/using-api/cel/#runtime-cost-budget).\n\nAdding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the MutatingAdmissionPolicyBinding.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the MutatingAdmissionPolicyBinding.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
@@ -100,7 +100,7 @@ func (MutatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingAdmissionPolicyBindingList = map[string]string{
|
||||
"": "MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of PolicyBinding.",
|
||||
}
|
||||
|
||||
@@ -121,7 +121,7 @@ func (MutatingAdmissionPolicyBindingSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingAdmissionPolicyList = map[string]string{
|
||||
"": "MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of ValidatingAdmissionPolicy.",
|
||||
}
|
||||
|
||||
@@ -157,7 +157,7 @@ func (Mutation) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_NamedRuleWithOperations = map[string]string{
|
||||
"": "NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.",
|
||||
"resourceNames": "ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.",
|
||||
"resourceNames": "resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.",
|
||||
}
|
||||
|
||||
func (NamedRuleWithOperations) SwaggerDoc() map[string]string {
|
||||
@@ -166,8 +166,8 @@ func (NamedRuleWithOperations) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ParamKind = map[string]string{
|
||||
"": "ParamKind is a tuple of Group Kind and Version.",
|
||||
"apiVersion": "APIVersion is the API group version the resources belong to. In format of \"group/version\". Required.",
|
||||
"kind": "Kind is the API kind the resources belong to. Required.",
|
||||
"apiVersion": "apiVersion is the API group version the resources belong to. In format of \"group/version\". Required.",
|
||||
"kind": "kind is the API kind the resources belong to. Required.",
|
||||
}
|
||||
|
||||
func (ParamKind) SwaggerDoc() map[string]string {
|
||||
@@ -176,10 +176,10 @@ func (ParamKind) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ParamRef = map[string]string{
|
||||
"": "ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.",
|
||||
"name": "`name` is the name of the resource being referenced.\n\n`name` and `selector` are mutually exclusive properties. If one is set, the other must be unset.",
|
||||
"name": "name is the name of the resource being referenced.\n\n`name` and `selector` are mutually exclusive properties. If one is set, the other must be unset.",
|
||||
"namespace": "namespace is the namespace of the referenced resource. Allows limiting the search for params to a specific namespace. Applies to both `name` and `selector` fields.\n\nA per-namespace parameter may be used by specifying a namespace-scoped `paramKind` in the policy and leaving this field empty.\n\n- If `paramKind` is cluster-scoped, this field MUST be unset. Setting this field results in a configuration error.\n\n- If `paramKind` is namespace-scoped, the namespace of the object being evaluated for admission will be used when this field is left unset. Take care that if this is left empty the binding must not match any cluster-scoped resources, which will result in an error.",
|
||||
"selector": "selector can be used to match multiple param objects based on their labels. Supply selector: {} to match all resources of the ParamKind.\n\nIf multiple params are found, they are all evaluated with the policy expressions and the results are ANDed together.\n\nOne of `name` or `selector` must be set, but `name` and `selector` are mutually exclusive properties. If one is set, the other must be unset.",
|
||||
"parameterNotFoundAction": "`parameterNotFoundAction` controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. If set to `Deny`, then no matched parameters will be subject to the `failurePolicy` of the policy.\n\nAllowed values are `Allow` or `Deny` Default to `Deny`",
|
||||
"parameterNotFoundAction": "parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. If set to `Deny`, then no matched parameters will be subject to the `failurePolicy` of the policy.\n\nAllowed values are `Allow` or `Deny` Default to `Deny`",
|
||||
}
|
||||
|
||||
func (ParamRef) SwaggerDoc() map[string]string {
|
||||
@@ -188,7 +188,7 @@ func (ParamRef) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TypeChecking = map[string]string{
|
||||
"": "TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy",
|
||||
"expressionWarnings": "The type checking warnings for each expression.",
|
||||
"expressionWarnings": "expressionWarnings contains the type checking warnings for each expression.",
|
||||
}
|
||||
|
||||
func (TypeChecking) SwaggerDoc() map[string]string {
|
||||
@@ -197,9 +197,9 @@ func (TypeChecking) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicy = map[string]string{
|
||||
"": "ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the ValidatingAdmissionPolicy.",
|
||||
"status": "The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the ValidatingAdmissionPolicy.",
|
||||
"status": "status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
@@ -208,8 +208,8 @@ func (ValidatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyBinding = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.\n\nFor a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding.\n\nThe CEL expressions of a policy must have a computed CEL cost below the maximum CEL budget. Each evaluation of the policy is given an independent CEL cost budget. Adding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
@@ -218,7 +218,7 @@ func (ValidatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyBindingList = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of PolicyBinding.",
|
||||
}
|
||||
|
||||
@@ -228,9 +228,9 @@ func (ValidatingAdmissionPolicyBindingList) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyBindingSpec = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.",
|
||||
"policyName": "PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.",
|
||||
"policyName": "policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.",
|
||||
"paramRef": "paramRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied. If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.",
|
||||
"matchResources": "MatchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.",
|
||||
"matchResources": "matchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.",
|
||||
"validationActions": "validationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced. If a validation evaluates to false it is always enforced according to these actions.\n\nFailures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according to these actions only if the FailurePolicy is set to Fail, otherwise the failures are ignored. This includes compilation errors, runtime errors and misconfigurations of the policy.\n\nvalidationActions is declared as a set of action values. Order does not matter. validationActions may not contain duplicates of the same action.\n\nThe supported actions values are:\n\n\"Deny\" specifies that a validation failure results in a denied request.\n\n\"Warn\" specifies that a validation failure is reported to the request client in HTTP Warning headers, with a warning code of 299. Warnings can be sent both for allowed or denied admission responses.\n\n\"Audit\" specifies that a validation failure is included in the published audit event for the request. The audit event will contain a `validation.policy.admission.k8s.io/validation_failure` audit annotation with a value containing the details of the validation failures, formatted as a JSON list of objects, each with the following fields: - message: The validation failure message string - policy: The resource name of the ValidatingAdmissionPolicy - binding: The resource name of the ValidatingAdmissionPolicyBinding - expressionIndex: The index of the failed validations in the ValidatingAdmissionPolicy - validationActions: The enforcement actions enacted for the validation failure Example audit annotation: `\"validation.policy.admission.k8s.io/validation_failure\": \"[{\"message\": \"Invalid value\", {\"policy\": \"policy.example.com\", {\"binding\": \"policybinding.example.com\", {\"expressionIndex\": \"1\", {\"validationActions\": [\"Audit\"]}]\"`\n\nClients should expect to handle additional values by ignoring any values not recognized.\n\n\"Deny\" and \"Warn\" may not be used together since this combination needlessly duplicates the validation failure both in the API response body and the HTTP warning headers.\n\nRequired.",
|
||||
}
|
||||
|
||||
@@ -240,7 +240,7 @@ func (ValidatingAdmissionPolicyBindingSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyList = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of ValidatingAdmissionPolicy.",
|
||||
}
|
||||
|
||||
@@ -250,13 +250,13 @@ func (ValidatingAdmissionPolicyList) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicySpec = map[string]string{
|
||||
"": "ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.",
|
||||
"paramKind": "ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.",
|
||||
"matchConstraints": "MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.",
|
||||
"validations": "Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.",
|
||||
"paramKind": "paramKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.",
|
||||
"matchConstraints": "matchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.",
|
||||
"validations": "validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.",
|
||||
"failurePolicy": "failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.\n\nA policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.\n\nfailurePolicy does not define how validations that evaluate to false are handled.\n\nWhen failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.\n\nAllowed values are Ignore or Fail. Defaults to Fail.",
|
||||
"auditAnnotations": "auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.",
|
||||
"matchConditions": "MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the policy is skipped",
|
||||
"variables": "Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.\n\nThe expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.",
|
||||
"matchConditions": "matchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the policy is skipped",
|
||||
"variables": "variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.\n\nThe expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicySpec) SwaggerDoc() map[string]string {
|
||||
@@ -265,9 +265,9 @@ func (ValidatingAdmissionPolicySpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyStatus = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyStatus represents the status of a ValidatingAdmissionPolicy.",
|
||||
"observedGeneration": "The generation observed by the controller.",
|
||||
"typeChecking": "The results of type checking for each expression. Presence of this field indicates the completion of the type checking.",
|
||||
"conditions": "The conditions represent the latest available observations of a policy's current state.",
|
||||
"observedGeneration": "observedGeneration is the generation observed by the controller.",
|
||||
"typeChecking": "typeChecking contains the results of type checking for each expression. Presence of this field indicates the completion of the type checking.",
|
||||
"conditions": "conditions represent the latest available observations of a policy's current state.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicyStatus) SwaggerDoc() map[string]string {
|
||||
@@ -276,9 +276,9 @@ func (ValidatingAdmissionPolicyStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_Validation = map[string]string{
|
||||
"": "Validation specifies the CEL expression which is used to apply the validation.",
|
||||
"expression": "Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired.",
|
||||
"message": "Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is \"failed rule: {Rule}\". e.g. \"must be a URL with the host matching spec.host\" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is \"failed Expression: {Expression}\".",
|
||||
"reason": "Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: \"Unauthorized\", \"Forbidden\", \"Invalid\", \"RequestEntityTooLarge\". If not set, StatusReasonInvalid is used in the response to the client.",
|
||||
"expression": "expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired.",
|
||||
"message": "message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is \"failed rule: {Rule}\". e.g. \"must be a URL with the host matching spec.host\" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is \"failed Expression: {Expression}\".",
|
||||
"reason": "reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: \"Unauthorized\", \"Forbidden\", \"Invalid\", \"RequestEntityTooLarge\". If not set, StatusReasonInvalid is used in the response to the client.",
|
||||
"messageExpression": "messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. Example: \"object.x must be less than max (\"+string(params.max)+\")\"",
|
||||
}
|
||||
|
||||
@@ -288,8 +288,8 @@ func (Validation) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_Variable = map[string]string{
|
||||
"": "Variable is the definition of a variable that is used for composition.",
|
||||
"name": "Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is \"foo\", the variable will be available as `variables.foo`",
|
||||
"expression": "Expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.",
|
||||
"name": "name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is \"foo\", the variable will be available as `variables.foo`",
|
||||
"expression": "expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.",
|
||||
}
|
||||
|
||||
func (Variable) SwaggerDoc() map[string]string {
|
||||
|
||||
+80
-75
@@ -113,12 +113,12 @@ message AuditAnnotation {
|
||||
|
||||
// ExpressionWarning is a warning information that targets a specific expression.
|
||||
message ExpressionWarning {
|
||||
// The path to the field that refers the expression.
|
||||
// fieldRef is the path to the field that refers to the expression.
|
||||
// For example, the reference to the expression of the first item of
|
||||
// validations is "spec.validations[0].expression"
|
||||
optional string fieldRef = 2;
|
||||
|
||||
// The content of type checking information in a human-readable form.
|
||||
// warning contains the content of type checking information in a human-readable form.
|
||||
// Each line of the warning contains the type that the expression is checked
|
||||
// against, followed by the type check error from the compiler.
|
||||
optional string warning = 3;
|
||||
@@ -195,7 +195,7 @@ message JSONPatch {
|
||||
|
||||
// MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.
|
||||
message MatchCondition {
|
||||
// Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
// the associated expression.
|
||||
// Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
@@ -206,7 +206,7 @@ message MatchCondition {
|
||||
// Required.
|
||||
optional string name = 1;
|
||||
|
||||
// Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
//
|
||||
// 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
@@ -227,7 +227,7 @@ message MatchCondition {
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +structType=atomic
|
||||
message MatchResources {
|
||||
// NamespaceSelector decides whether to run the admission control policy on an object based
|
||||
// namespaceSelector decides whether to run the admission control policy on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -273,7 +273,7 @@ message MatchResources {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 1;
|
||||
|
||||
// ObjectSelector decides whether to run the validation based on if the
|
||||
// objectSelector decides whether to run the validation based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the cel validation, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -287,13 +287,13 @@ message MatchResources {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 2;
|
||||
|
||||
// ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
|
||||
// resourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
|
||||
// The policy cares about an operation if it matches _any_ Rule.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
repeated NamedRuleWithOperations resourceRules = 3;
|
||||
|
||||
// ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
|
||||
// excludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
@@ -319,11 +319,11 @@ message MatchResources {
|
||||
|
||||
// MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
|
||||
message MutatingAdmissionPolicy {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the MutatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicy.
|
||||
optional MutatingAdmissionPolicySpec spec = 2;
|
||||
}
|
||||
|
||||
@@ -339,17 +339,17 @@ message MutatingAdmissionPolicy {
|
||||
// Adding/removing policies, bindings, or params can not affect whether a
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
message MutatingAdmissionPolicyBinding {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
optional MutatingAdmissionPolicyBindingSpec spec = 2;
|
||||
}
|
||||
|
||||
// MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.
|
||||
message MutatingAdmissionPolicyBindingList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -387,7 +387,7 @@ message MutatingAdmissionPolicyBindingSpec {
|
||||
|
||||
// MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.
|
||||
message MutatingAdmissionPolicyList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -486,18 +486,18 @@ message MutatingAdmissionPolicySpec {
|
||||
|
||||
// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
|
||||
message MutatingWebhook {
|
||||
// The name of the admission webhook.
|
||||
// name is the name of the admission webhook.
|
||||
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
||||
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
||||
// of the organization.
|
||||
// Required.
|
||||
optional string name = 1;
|
||||
|
||||
// ClientConfig defines how to communicate with the hook.
|
||||
// clientConfig defines how to communicate with the hook.
|
||||
// Required
|
||||
optional WebhookClientConfig clientConfig = 2;
|
||||
|
||||
// Rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// The webhook cares about an operation if it matches _any_ Rule.
|
||||
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
||||
// from putting the cluster in a state which cannot be recovered from without completely
|
||||
@@ -506,7 +506,7 @@ message MutatingWebhook {
|
||||
// +listType=atomic
|
||||
repeated .k8s.io.api.admissionregistration.v1.RuleWithOperations rules = 3;
|
||||
|
||||
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// allowed values are Ignore or Fail. Defaults to Ignore.
|
||||
// +optional
|
||||
optional string failurePolicy = 4;
|
||||
@@ -528,7 +528,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional string matchPolicy = 9;
|
||||
|
||||
// NamespaceSelector decides whether to run the webhook on an object based
|
||||
// namespaceSelector decides whether to run the webhook on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -574,7 +574,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 5;
|
||||
|
||||
// ObjectSelector decides whether to run the webhook based on if the
|
||||
// objectSelector decides whether to run the webhook based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the webhook, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -588,7 +588,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 11;
|
||||
|
||||
// SideEffects states whether this webhook has side effects.
|
||||
// sideEffects states whether this webhook has side effects.
|
||||
// Acceptable values are: Unknown, None, Some, NoneOnDryRun
|
||||
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
||||
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
||||
@@ -597,7 +597,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional string sideEffects = 6;
|
||||
|
||||
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// the webhook call will be ignored or the API call will fail based on the
|
||||
// failure policy.
|
||||
// The timeout value must be between 1 and 30 seconds.
|
||||
@@ -605,7 +605,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional int32 timeoutSeconds = 7;
|
||||
|
||||
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// versions the Webhook expects. API server will try to use first version in
|
||||
// the list which it supports. If none of the versions specified in this list
|
||||
// supported by API server, validation will fail for this object.
|
||||
@@ -635,7 +635,7 @@ message MutatingWebhook {
|
||||
// +optional
|
||||
optional string reinvocationPolicy = 10;
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// matchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// webhook. Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -658,11 +658,11 @@ message MutatingWebhook {
|
||||
// MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
|
||||
// Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 MutatingWebhookConfiguration instead.
|
||||
message MutatingWebhookConfiguration {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Webhooks is a list of webhooks and the affected resources and operations.
|
||||
// webhooks is a list of webhooks and the affected resources and operations.
|
||||
// +optional
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
@@ -673,7 +673,7 @@ message MutatingWebhookConfiguration {
|
||||
|
||||
// MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
|
||||
message MutatingWebhookConfigurationList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -705,7 +705,7 @@ message Mutation {
|
||||
// NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
|
||||
// +structType=atomic
|
||||
message NamedRuleWithOperations {
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
repeated string resourceNames = 1;
|
||||
@@ -717,12 +717,12 @@ message NamedRuleWithOperations {
|
||||
// ParamKind is a tuple of Group Kind and Version.
|
||||
// +structType=atomic
|
||||
message ParamKind {
|
||||
// APIVersion is the API group version the resources belong to.
|
||||
// apiVersion is the API group version the resources belong to.
|
||||
// In format of "group/version".
|
||||
// Required.
|
||||
optional string apiVersion = 1;
|
||||
|
||||
// Kind is the API kind the resources belong to.
|
||||
// kind is the API kind the resources belong to.
|
||||
// Required.
|
||||
optional string kind = 2;
|
||||
}
|
||||
@@ -771,7 +771,7 @@ message ParamRef {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 3;
|
||||
|
||||
// `parameterNotFoundAction` controls the behavior of the binding when the resource
|
||||
// parameterNotFoundAction controls the behavior of the binding when the resource
|
||||
// exists, and name or selector is valid, but there are no parameters
|
||||
// matched by the binding. If the value is set to `Allow`, then no
|
||||
// matched parameters will be treated as successful validation by the binding.
|
||||
@@ -786,22 +786,22 @@ message ParamRef {
|
||||
|
||||
// ServiceReference holds a reference to Service.legacy.k8s.io
|
||||
message ServiceReference {
|
||||
// `namespace` is the namespace of the service.
|
||||
// namespace is the namespace of the service.
|
||||
// Required
|
||||
optional string namespace = 1;
|
||||
|
||||
// `name` is the name of the service.
|
||||
// name is the name of the service.
|
||||
// Required
|
||||
optional string name = 2;
|
||||
|
||||
// `path` is an optional URL path which will be sent in any request to
|
||||
// path is an optional URL path which will be sent in any request to
|
||||
// this service.
|
||||
// +optional
|
||||
optional string path = 3;
|
||||
|
||||
// If specified, the port on the service that hosting webhook.
|
||||
// port is the port on the service that hosts the webhook.
|
||||
// Default to 443 for backward compatibility.
|
||||
// `port` should be a valid port number (1-65535, inclusive).
|
||||
// port should be a valid port number (1-65535, inclusive).
|
||||
// +optional
|
||||
optional int32 port = 4;
|
||||
}
|
||||
@@ -809,7 +809,7 @@ message ServiceReference {
|
||||
// TypeChecking contains results of type checking the expressions in the
|
||||
// ValidatingAdmissionPolicy
|
||||
message TypeChecking {
|
||||
// The type checking warnings for each expression.
|
||||
// expressionWarnings contains the type checking warnings for each expression.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated ExpressionWarning expressionWarnings = 1;
|
||||
@@ -821,14 +821,14 @@ message TypeChecking {
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.28
|
||||
// ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
|
||||
message ValidatingAdmissionPolicy {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicy.
|
||||
optional ValidatingAdmissionPolicySpec spec = 2;
|
||||
|
||||
// The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// behaves in the expected way.
|
||||
// Populated by the system.
|
||||
// Read-only.
|
||||
@@ -848,17 +848,18 @@ message ValidatingAdmissionPolicy {
|
||||
// Adding/removing policies, bindings, or params can not affect whether a
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
message ValidatingAdmissionPolicyBinding {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// +required
|
||||
optional ValidatingAdmissionPolicyBindingSpec spec = 2;
|
||||
}
|
||||
|
||||
// ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.
|
||||
message ValidatingAdmissionPolicyBindingList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -869,9 +870,11 @@ message ValidatingAdmissionPolicyBindingList {
|
||||
|
||||
// ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
|
||||
message ValidatingAdmissionPolicyBindingSpec {
|
||||
// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
|
||||
// Required.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
optional string policyName = 1;
|
||||
|
||||
// paramRef specifies the parameter resource used to configure the admission control policy.
|
||||
@@ -881,7 +884,7 @@ message ValidatingAdmissionPolicyBindingSpec {
|
||||
// +optional
|
||||
optional ParamRef paramRef = 2;
|
||||
|
||||
// MatchResources declares what resources match this binding and will be validated by it.
|
||||
// matchResources declares what resources match this binding and will be validated by it.
|
||||
// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
|
||||
// If this is unset, all resources matched by the policy are validated by this binding
|
||||
// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
|
||||
@@ -929,6 +932,8 @@ message ValidatingAdmissionPolicyBindingSpec {
|
||||
//
|
||||
// Required.
|
||||
// +listType=set
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
repeated string validationActions = 4;
|
||||
}
|
||||
|
||||
@@ -936,7 +941,7 @@ message ValidatingAdmissionPolicyBindingSpec {
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.28
|
||||
// ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.
|
||||
message ValidatingAdmissionPolicyList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -947,21 +952,21 @@ message ValidatingAdmissionPolicyList {
|
||||
|
||||
// ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
|
||||
message ValidatingAdmissionPolicySpec {
|
||||
// ParamKind specifies the kind of resources used to parameterize this policy.
|
||||
// paramKind specifies the kind of resources used to parameterize this policy.
|
||||
// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
|
||||
// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
|
||||
// If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
|
||||
// +optional
|
||||
optional ParamKind paramKind = 1;
|
||||
|
||||
// MatchConstraints specifies what resources this policy is designed to validate.
|
||||
// matchConstraints specifies what resources this policy is designed to validate.
|
||||
// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
|
||||
// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
|
||||
// ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
|
||||
// Required.
|
||||
optional MatchResources matchConstraints = 2;
|
||||
|
||||
// Validations contain CEL expressions which is used to apply the validation.
|
||||
// validations contain CEL expressions which is used to apply the validation.
|
||||
// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
|
||||
// required.
|
||||
// +listType=atomic
|
||||
@@ -992,7 +997,7 @@ message ValidatingAdmissionPolicySpec {
|
||||
// +optional
|
||||
repeated AuditAnnotation auditAnnotations = 5;
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// matchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -1014,7 +1019,7 @@ message ValidatingAdmissionPolicySpec {
|
||||
// +optional
|
||||
repeated MatchCondition matchConditions = 6;
|
||||
|
||||
// Variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// Each variable is defined as a named CEL expression.
|
||||
// The variables defined here will be available under `variables` in other expressions of the policy
|
||||
// except MatchConditions because MatchConditions are evaluated before the rest of the policy.
|
||||
@@ -1031,16 +1036,16 @@ message ValidatingAdmissionPolicySpec {
|
||||
|
||||
// ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.
|
||||
message ValidatingAdmissionPolicyStatus {
|
||||
// The generation observed by the controller.
|
||||
// observedGeneration is the generation observed by the controller.
|
||||
// +optional
|
||||
optional int64 observedGeneration = 1;
|
||||
|
||||
// The results of type checking for each expression.
|
||||
// typeChecking contains the results of type checking for each expression.
|
||||
// Presence of this field indicates the completion of the type checking.
|
||||
// +optional
|
||||
optional TypeChecking typeChecking = 2;
|
||||
|
||||
// The conditions represent the latest available observations of a policy's current state.
|
||||
// conditions represent the latest available observations of a policy's current state.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=type
|
||||
@@ -1049,18 +1054,18 @@ message ValidatingAdmissionPolicyStatus {
|
||||
|
||||
// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
|
||||
message ValidatingWebhook {
|
||||
// The name of the admission webhook.
|
||||
// name is the name of the admission webhook.
|
||||
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
||||
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
||||
// of the organization.
|
||||
// Required.
|
||||
optional string name = 1;
|
||||
|
||||
// ClientConfig defines how to communicate with the hook.
|
||||
// clientConfig defines how to communicate with the hook.
|
||||
// Required
|
||||
optional WebhookClientConfig clientConfig = 2;
|
||||
|
||||
// Rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// The webhook cares about an operation if it matches _any_ Rule.
|
||||
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
||||
// from putting the cluster in a state which cannot be recovered from without completely
|
||||
@@ -1069,7 +1074,7 @@ message ValidatingWebhook {
|
||||
// +listType=atomic
|
||||
repeated .k8s.io.api.admissionregistration.v1.RuleWithOperations rules = 3;
|
||||
|
||||
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// allowed values are Ignore or Fail. Defaults to Ignore.
|
||||
// +optional
|
||||
optional string failurePolicy = 4;
|
||||
@@ -1091,7 +1096,7 @@ message ValidatingWebhook {
|
||||
// +optional
|
||||
optional string matchPolicy = 9;
|
||||
|
||||
// NamespaceSelector decides whether to run the webhook on an object based
|
||||
// namespaceSelector decides whether to run the webhook on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -1137,7 +1142,7 @@ message ValidatingWebhook {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 5;
|
||||
|
||||
// ObjectSelector decides whether to run the webhook based on if the
|
||||
// objectSelector decides whether to run the webhook based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the webhook, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -1151,7 +1156,7 @@ message ValidatingWebhook {
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 10;
|
||||
|
||||
// SideEffects states whether this webhook has side effects.
|
||||
// sideEffects states whether this webhook has side effects.
|
||||
// Acceptable values are: Unknown, None, Some, NoneOnDryRun
|
||||
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
||||
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
||||
@@ -1161,7 +1166,7 @@ message ValidatingWebhook {
|
||||
// +listType=atomic
|
||||
optional string sideEffects = 6;
|
||||
|
||||
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// the webhook call will be ignored or the API call will fail based on the
|
||||
// failure policy.
|
||||
// The timeout value must be between 1 and 30 seconds.
|
||||
@@ -1169,7 +1174,7 @@ message ValidatingWebhook {
|
||||
// +optional
|
||||
optional int32 timeoutSeconds = 7;
|
||||
|
||||
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// versions the Webhook expects. API server will try to use first version in
|
||||
// the list which it supports. If none of the versions specified in this list
|
||||
// supported by API server, validation will fail for this object.
|
||||
@@ -1181,7 +1186,7 @@ message ValidatingWebhook {
|
||||
// +listType=atomic
|
||||
repeated string admissionReviewVersions = 8;
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// matchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// webhook. Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -1204,11 +1209,11 @@ message ValidatingWebhook {
|
||||
// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
|
||||
// Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 ValidatingWebhookConfiguration instead.
|
||||
message ValidatingWebhookConfiguration {
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Webhooks is a list of webhooks and the affected resources and operations.
|
||||
// webhooks is a list of webhooks and the affected resources and operations.
|
||||
// +optional
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
@@ -1219,7 +1224,7 @@ message ValidatingWebhookConfiguration {
|
||||
|
||||
// ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
|
||||
message ValidatingWebhookConfigurationList {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
@@ -1230,7 +1235,7 @@ message ValidatingWebhookConfigurationList {
|
||||
|
||||
// Validation specifies the CEL expression which is used to apply the validation.
|
||||
message Validation {
|
||||
// Expression represents the expression which will be evaluated by CEL.
|
||||
// expression represents the expression which will be evaluated by CEL.
|
||||
// ref: https://github.com/google/cel-spec
|
||||
// CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
@@ -1273,7 +1278,7 @@ message Validation {
|
||||
// Required.
|
||||
optional string Expression = 1;
|
||||
|
||||
// Message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// line breaks. The message must not contain line breaks.
|
||||
// If unset, the message is "failed rule: {Rule}".
|
||||
// e.g. "must be a URL with the host matching spec.host"
|
||||
@@ -1283,7 +1288,7 @@ message Validation {
|
||||
// +optional
|
||||
optional string message = 2;
|
||||
|
||||
// Reason represents a machine-readable description of why this validation failed.
|
||||
// reason represents a machine-readable description of why this validation failed.
|
||||
// If this is the first validation in the list to fail, this reason, as well as the
|
||||
// corresponding HTTP response code, are used in the
|
||||
// HTTP response to the client.
|
||||
@@ -1309,12 +1314,12 @@ message Validation {
|
||||
// Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.
|
||||
// +structType=atomic
|
||||
message Variable {
|
||||
// Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// The variable can be accessed in other expressions through `variables`
|
||||
// For example, if name is "foo", the variable will be available as `variables.foo`
|
||||
optional string Name = 1;
|
||||
|
||||
// Expression is the expression that will be evaluated as the value of the variable.
|
||||
// expression is the expression that will be evaluated as the value of the variable.
|
||||
// The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
||||
optional string Expression = 2;
|
||||
}
|
||||
@@ -1322,7 +1327,7 @@ message Variable {
|
||||
// WebhookClientConfig contains the information to make a TLS
|
||||
// connection with the webhook
|
||||
message WebhookClientConfig {
|
||||
// `url` gives the location of the webhook, in standard URL form
|
||||
// url gives the location of the webhook, in standard URL form
|
||||
// (`scheme://host:port/path`). Exactly one of `url` or `service`
|
||||
// must be specified.
|
||||
//
|
||||
@@ -1351,7 +1356,7 @@ message WebhookClientConfig {
|
||||
// +optional
|
||||
optional string url = 3;
|
||||
|
||||
// `service` is a reference to the service for this webhook. Either
|
||||
// service is a reference to the service for this webhook. Either
|
||||
// `service` or `url` must be specified.
|
||||
//
|
||||
// If the webhook is running within the cluster, then you should use `service`.
|
||||
@@ -1359,7 +1364,7 @@ message WebhookClientConfig {
|
||||
// +optional
|
||||
optional ServiceReference service = 1;
|
||||
|
||||
// `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
|
||||
// caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
|
||||
// If unspecified, system trust roots on the apiserver are used.
|
||||
// +optional
|
||||
optional bytes caBundle = 2;
|
||||
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
func (*ApplyConfiguration) ProtoMessage() {}
|
||||
|
||||
func (*AuditAnnotation) ProtoMessage() {}
|
||||
|
||||
func (*ExpressionWarning) ProtoMessage() {}
|
||||
|
||||
func (*JSONPatch) ProtoMessage() {}
|
||||
|
||||
func (*MatchCondition) ProtoMessage() {}
|
||||
|
||||
func (*MatchResources) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicy) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicyBinding) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicyBindingList) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicyBindingSpec) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicyList) ProtoMessage() {}
|
||||
|
||||
func (*MutatingAdmissionPolicySpec) ProtoMessage() {}
|
||||
|
||||
func (*MutatingWebhook) ProtoMessage() {}
|
||||
|
||||
func (*MutatingWebhookConfiguration) ProtoMessage() {}
|
||||
|
||||
func (*MutatingWebhookConfigurationList) ProtoMessage() {}
|
||||
|
||||
func (*Mutation) ProtoMessage() {}
|
||||
|
||||
func (*NamedRuleWithOperations) ProtoMessage() {}
|
||||
|
||||
func (*ParamKind) ProtoMessage() {}
|
||||
|
||||
func (*ParamRef) ProtoMessage() {}
|
||||
|
||||
func (*ServiceReference) ProtoMessage() {}
|
||||
|
||||
func (*TypeChecking) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicy) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyBinding) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyBindingList) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyBindingSpec) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyList) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicySpec) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingAdmissionPolicyStatus) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingWebhook) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingWebhookConfiguration) ProtoMessage() {}
|
||||
|
||||
func (*ValidatingWebhookConfigurationList) ProtoMessage() {}
|
||||
|
||||
func (*Validation) ProtoMessage() {}
|
||||
|
||||
func (*Variable) ProtoMessage() {}
|
||||
|
||||
func (*WebhookClientConfig) ProtoMessage() {}
|
||||
+84
-75
@@ -95,12 +95,12 @@ const (
|
||||
// ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
|
||||
type ValidatingAdmissionPolicy struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicy.
|
||||
Spec ValidatingAdmissionPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
// The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
|
||||
// behaves in the expected way.
|
||||
// Populated by the system.
|
||||
// Read-only.
|
||||
@@ -110,14 +110,14 @@ type ValidatingAdmissionPolicy struct {
|
||||
|
||||
// ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.
|
||||
type ValidatingAdmissionPolicyStatus struct {
|
||||
// The generation observed by the controller.
|
||||
// observedGeneration is the generation observed by the controller.
|
||||
// +optional
|
||||
ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,1,opt,name=observedGeneration"`
|
||||
// The results of type checking for each expression.
|
||||
// typeChecking contains the results of type checking for each expression.
|
||||
// Presence of this field indicates the completion of the type checking.
|
||||
// +optional
|
||||
TypeChecking *TypeChecking `json:"typeChecking,omitempty" protobuf:"bytes,2,opt,name=typeChecking"`
|
||||
// The conditions represent the latest available observations of a policy's current state.
|
||||
// conditions represent the latest available observations of a policy's current state.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=type
|
||||
@@ -130,7 +130,7 @@ type ValidatingAdmissionPolicyConditionType string
|
||||
// TypeChecking contains results of type checking the expressions in the
|
||||
// ValidatingAdmissionPolicy
|
||||
type TypeChecking struct {
|
||||
// The type checking warnings for each expression.
|
||||
// expressionWarnings contains the type checking warnings for each expression.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
ExpressionWarnings []ExpressionWarning `json:"expressionWarnings,omitempty" protobuf:"bytes,1,rep,name=expressionWarnings"`
|
||||
@@ -138,11 +138,11 @@ type TypeChecking struct {
|
||||
|
||||
// ExpressionWarning is a warning information that targets a specific expression.
|
||||
type ExpressionWarning struct {
|
||||
// The path to the field that refers the expression.
|
||||
// fieldRef is the path to the field that refers to the expression.
|
||||
// For example, the reference to the expression of the first item of
|
||||
// validations is "spec.validations[0].expression"
|
||||
FieldRef string `json:"fieldRef" protobuf:"bytes,2,opt,name=fieldRef"`
|
||||
// The content of type checking information in a human-readable form.
|
||||
// warning contains the content of type checking information in a human-readable form.
|
||||
// Each line of the warning contains the type that the expression is checked
|
||||
// against, followed by the type check error from the compiler.
|
||||
Warning string `json:"warning" protobuf:"bytes,3,opt,name=warning"`
|
||||
@@ -153,7 +153,7 @@ type ExpressionWarning struct {
|
||||
// ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.
|
||||
type ValidatingAdmissionPolicyList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -163,21 +163,21 @@ type ValidatingAdmissionPolicyList struct {
|
||||
|
||||
// ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
|
||||
type ValidatingAdmissionPolicySpec struct {
|
||||
// ParamKind specifies the kind of resources used to parameterize this policy.
|
||||
// paramKind specifies the kind of resources used to parameterize this policy.
|
||||
// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
|
||||
// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
|
||||
// If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
|
||||
// +optional
|
||||
ParamKind *ParamKind `json:"paramKind,omitempty" protobuf:"bytes,1,rep,name=paramKind"`
|
||||
|
||||
// MatchConstraints specifies what resources this policy is designed to validate.
|
||||
// matchConstraints specifies what resources this policy is designed to validate.
|
||||
// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
|
||||
// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
|
||||
// ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
|
||||
// Required.
|
||||
MatchConstraints *MatchResources `json:"matchConstraints,omitempty" protobuf:"bytes,2,rep,name=matchConstraints"`
|
||||
|
||||
// Validations contain CEL expressions which is used to apply the validation.
|
||||
// validations contain CEL expressions which is used to apply the validation.
|
||||
// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
|
||||
// required.
|
||||
// +listType=atomic
|
||||
@@ -208,7 +208,7 @@ type ValidatingAdmissionPolicySpec struct {
|
||||
// +optional
|
||||
AuditAnnotations []AuditAnnotation `json:"auditAnnotations,omitempty" protobuf:"bytes,5,rep,name=auditAnnotations"`
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// matchConditions is a list of conditions that must be met for a request to be validated.
|
||||
// Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -230,7 +230,7 @@ type ValidatingAdmissionPolicySpec struct {
|
||||
// +optional
|
||||
MatchConditions []MatchCondition `json:"matchConditions,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,6,rep,name=matchConditions"`
|
||||
|
||||
// Variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// variables contain definitions of variables that can be used in composition of other expressions.
|
||||
// Each variable is defined as a named CEL expression.
|
||||
// The variables defined here will be available under `variables` in other expressions of the policy
|
||||
// except MatchConditions because MatchConditions are evaluated before the rest of the policy.
|
||||
@@ -248,19 +248,19 @@ type ValidatingAdmissionPolicySpec struct {
|
||||
// ParamKind is a tuple of Group Kind and Version.
|
||||
// +structType=atomic
|
||||
type ParamKind struct {
|
||||
// APIVersion is the API group version the resources belong to.
|
||||
// apiVersion is the API group version the resources belong to.
|
||||
// In format of "group/version".
|
||||
// Required.
|
||||
APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,1,rep,name=apiVersion"`
|
||||
|
||||
// Kind is the API kind the resources belong to.
|
||||
// kind is the API kind the resources belong to.
|
||||
// Required.
|
||||
Kind string `json:"kind,omitempty" protobuf:"bytes,2,rep,name=kind"`
|
||||
}
|
||||
|
||||
// Validation specifies the CEL expression which is used to apply the validation.
|
||||
type Validation struct {
|
||||
// Expression represents the expression which will be evaluated by CEL.
|
||||
// expression represents the expression which will be evaluated by CEL.
|
||||
// ref: https://github.com/google/cel-spec
|
||||
// CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:
|
||||
//
|
||||
@@ -302,7 +302,7 @@ type Validation struct {
|
||||
// non-intersecting keys are appended, retaining their partial order.
|
||||
// Required.
|
||||
Expression string `json:"expression" protobuf:"bytes,1,opt,name=Expression"`
|
||||
// Message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// message represents the message displayed when validation fails. The message is required if the Expression contains
|
||||
// line breaks. The message must not contain line breaks.
|
||||
// If unset, the message is "failed rule: {Rule}".
|
||||
// e.g. "must be a URL with the host matching spec.host"
|
||||
@@ -311,7 +311,7 @@ type Validation struct {
|
||||
// If unset, the message is "failed Expression: {Expression}".
|
||||
// +optional
|
||||
Message string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"`
|
||||
// Reason represents a machine-readable description of why this validation failed.
|
||||
// reason represents a machine-readable description of why this validation failed.
|
||||
// If this is the first validation in the list to fail, this reason, as well as the
|
||||
// corresponding HTTP response code, are used in the
|
||||
// HTTP response to the client.
|
||||
@@ -336,12 +336,12 @@ type Validation struct {
|
||||
// Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.
|
||||
// +structType=atomic
|
||||
type Variable struct {
|
||||
// Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
// The variable can be accessed in other expressions through `variables`
|
||||
// For example, if name is "foo", the variable will be available as `variables.foo`
|
||||
Name string `json:"name" protobuf:"bytes,1,opt,name=Name"`
|
||||
|
||||
// Expression is the expression that will be evaluated as the value of the variable.
|
||||
// expression is the expression that will be evaluated as the value of the variable.
|
||||
// The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
||||
Expression string `json:"expression" protobuf:"bytes,2,opt,name=Expression"`
|
||||
}
|
||||
@@ -401,10 +401,11 @@ type AuditAnnotation struct {
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
type ValidatingAdmissionPolicyBinding struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
|
||||
// +required
|
||||
Spec ValidatingAdmissionPolicyBindingSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
}
|
||||
|
||||
@@ -414,7 +415,7 @@ type ValidatingAdmissionPolicyBinding struct {
|
||||
// ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.
|
||||
type ValidatingAdmissionPolicyBindingList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -424,9 +425,11 @@ type ValidatingAdmissionPolicyBindingList struct {
|
||||
|
||||
// ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
|
||||
type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
|
||||
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
|
||||
// Required.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
PolicyName string `json:"policyName,omitempty" protobuf:"bytes,1,rep,name=policyName"`
|
||||
|
||||
// paramRef specifies the parameter resource used to configure the admission control policy.
|
||||
@@ -436,7 +439,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
// +optional
|
||||
ParamRef *ParamRef `json:"paramRef,omitempty" protobuf:"bytes,2,rep,name=paramRef"`
|
||||
|
||||
// MatchResources declares what resources match this binding and will be validated by it.
|
||||
// matchResources declares what resources match this binding and will be validated by it.
|
||||
// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
|
||||
// If this is unset, all resources matched by the policy are validated by this binding
|
||||
// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
|
||||
@@ -484,6 +487,8 @@ type ValidatingAdmissionPolicyBindingSpec struct {
|
||||
//
|
||||
// Required.
|
||||
// +listType=set
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
ValidationActions []ValidationAction `json:"validationActions,omitempty" protobuf:"bytes,4,rep,name=validationActions"`
|
||||
}
|
||||
|
||||
@@ -532,7 +537,7 @@ type ParamRef struct {
|
||||
// +optional
|
||||
Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,3,rep,name=selector"`
|
||||
|
||||
// `parameterNotFoundAction` controls the behavior of the binding when the resource
|
||||
// parameterNotFoundAction controls the behavior of the binding when the resource
|
||||
// exists, and name or selector is valid, but there are no parameters
|
||||
// matched by the binding. If the value is set to `Allow`, then no
|
||||
// matched parameters will be treated as successful validation by the binding.
|
||||
@@ -550,7 +555,7 @@ type ParamRef struct {
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +structType=atomic
|
||||
type MatchResources struct {
|
||||
// NamespaceSelector decides whether to run the admission control policy on an object based
|
||||
// namespaceSelector decides whether to run the admission control policy on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -595,7 +600,7 @@ type MatchResources struct {
|
||||
// Default to the empty LabelSelector, which matches everything.
|
||||
// +optional
|
||||
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,1,opt,name=namespaceSelector"`
|
||||
// ObjectSelector decides whether to run the validation based on if the
|
||||
// objectSelector decides whether to run the validation based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the cel validation, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -608,12 +613,12 @@ type MatchResources struct {
|
||||
// Default to the empty LabelSelector, which matches everything.
|
||||
// +optional
|
||||
ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,2,opt,name=objectSelector"`
|
||||
// ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
|
||||
// resourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
|
||||
// The policy cares about an operation if it matches _any_ Rule.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
ResourceRules []NamedRuleWithOperations `json:"resourceRules,omitempty" protobuf:"bytes,3,rep,name=resourceRules"`
|
||||
// ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
|
||||
// excludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
|
||||
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
@@ -657,7 +662,7 @@ const (
|
||||
// NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
|
||||
// +structType=atomic
|
||||
type NamedRuleWithOperations struct {
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
|
||||
// +listType=atomic
|
||||
// +optional
|
||||
ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,1,rep,name=resourceNames"`
|
||||
@@ -677,10 +682,10 @@ type NamedRuleWithOperations struct {
|
||||
// Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 ValidatingWebhookConfiguration instead.
|
||||
type ValidatingWebhookConfiguration struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Webhooks is a list of webhooks and the affected resources and operations.
|
||||
// webhooks is a list of webhooks and the affected resources and operations.
|
||||
// +optional
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
@@ -698,7 +703,7 @@ type ValidatingWebhookConfiguration struct {
|
||||
// ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
|
||||
type ValidatingWebhookConfigurationList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -718,10 +723,10 @@ type ValidatingWebhookConfigurationList struct {
|
||||
// Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 MutatingWebhookConfiguration instead.
|
||||
type MutatingWebhookConfiguration struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Webhooks is a list of webhooks and the affected resources and operations.
|
||||
// webhooks is a list of webhooks and the affected resources and operations.
|
||||
// +optional
|
||||
// +patchMergeKey=name
|
||||
// +patchStrategy=merge
|
||||
@@ -739,7 +744,7 @@ type MutatingWebhookConfiguration struct {
|
||||
// MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
|
||||
type MutatingWebhookConfigurationList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -749,18 +754,18 @@ type MutatingWebhookConfigurationList struct {
|
||||
|
||||
// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
|
||||
type ValidatingWebhook struct {
|
||||
// The name of the admission webhook.
|
||||
// name is the name of the admission webhook.
|
||||
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
||||
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
||||
// of the organization.
|
||||
// Required.
|
||||
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
|
||||
|
||||
// ClientConfig defines how to communicate with the hook.
|
||||
// clientConfig defines how to communicate with the hook.
|
||||
// Required
|
||||
ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`
|
||||
|
||||
// Rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// The webhook cares about an operation if it matches _any_ Rule.
|
||||
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
||||
// from putting the cluster in a state which cannot be recovered from without completely
|
||||
@@ -769,7 +774,7 @@ type ValidatingWebhook struct {
|
||||
// +listType=atomic
|
||||
Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
|
||||
|
||||
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// allowed values are Ignore or Fail. Defaults to Ignore.
|
||||
// +optional
|
||||
FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`
|
||||
@@ -791,7 +796,7 @@ type ValidatingWebhook struct {
|
||||
// +optional
|
||||
MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`
|
||||
|
||||
// NamespaceSelector decides whether to run the webhook on an object based
|
||||
// namespaceSelector decides whether to run the webhook on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -837,7 +842,7 @@ type ValidatingWebhook struct {
|
||||
// +optional
|
||||
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`
|
||||
|
||||
// ObjectSelector decides whether to run the webhook based on if the
|
||||
// objectSelector decides whether to run the webhook based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the webhook, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -851,7 +856,7 @@ type ValidatingWebhook struct {
|
||||
// +optional
|
||||
ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,10,opt,name=objectSelector"`
|
||||
|
||||
// SideEffects states whether this webhook has side effects.
|
||||
// sideEffects states whether this webhook has side effects.
|
||||
// Acceptable values are: Unknown, None, Some, NoneOnDryRun
|
||||
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
||||
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
||||
@@ -861,7 +866,7 @@ type ValidatingWebhook struct {
|
||||
// +listType=atomic
|
||||
SideEffects *SideEffectClass `json:"sideEffects,omitempty" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`
|
||||
|
||||
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// the webhook call will be ignored or the API call will fail based on the
|
||||
// failure policy.
|
||||
// The timeout value must be between 1 and 30 seconds.
|
||||
@@ -869,7 +874,7 @@ type ValidatingWebhook struct {
|
||||
// +optional
|
||||
TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`
|
||||
|
||||
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// versions the Webhook expects. API server will try to use first version in
|
||||
// the list which it supports. If none of the versions specified in this list
|
||||
// supported by API server, validation will fail for this object.
|
||||
@@ -881,7 +886,7 @@ type ValidatingWebhook struct {
|
||||
// +listType=atomic
|
||||
AdmissionReviewVersions []string `json:"admissionReviewVersions,omitempty" protobuf:"bytes,8,rep,name=admissionReviewVersions"`
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// matchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// webhook. Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -903,18 +908,18 @@ type ValidatingWebhook struct {
|
||||
|
||||
// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
|
||||
type MutatingWebhook struct {
|
||||
// The name of the admission webhook.
|
||||
// name is the name of the admission webhook.
|
||||
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
||||
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
||||
// of the organization.
|
||||
// Required.
|
||||
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
|
||||
|
||||
// ClientConfig defines how to communicate with the hook.
|
||||
// clientConfig defines how to communicate with the hook.
|
||||
// Required
|
||||
ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`
|
||||
|
||||
// Rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// rules describes what operations on what resources/subresources the webhook cares about.
|
||||
// The webhook cares about an operation if it matches _any_ Rule.
|
||||
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
||||
// from putting the cluster in a state which cannot be recovered from without completely
|
||||
@@ -923,7 +928,7 @@ type MutatingWebhook struct {
|
||||
// +listType=atomic
|
||||
Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
|
||||
|
||||
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
||||
// allowed values are Ignore or Fail. Defaults to Ignore.
|
||||
// +optional
|
||||
FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`
|
||||
@@ -945,7 +950,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`
|
||||
|
||||
// NamespaceSelector decides whether to run the webhook on an object based
|
||||
// namespaceSelector decides whether to run the webhook on an object based
|
||||
// on whether the namespace for that object matches the selector. If the
|
||||
// object itself is a namespace, the matching is performed on
|
||||
// object.metadata.labels. If the object is another cluster scoped resource,
|
||||
@@ -991,7 +996,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`
|
||||
|
||||
// ObjectSelector decides whether to run the webhook based on if the
|
||||
// objectSelector decides whether to run the webhook based on if the
|
||||
// object has matching labels. objectSelector is evaluated against both
|
||||
// the oldObject and newObject that would be sent to the webhook, and
|
||||
// is considered to match if either object matches the selector. A null
|
||||
@@ -1005,7 +1010,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,11,opt,name=objectSelector"`
|
||||
|
||||
// SideEffects states whether this webhook has side effects.
|
||||
// sideEffects states whether this webhook has side effects.
|
||||
// Acceptable values are: Unknown, None, Some, NoneOnDryRun
|
||||
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
||||
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
||||
@@ -1014,7 +1019,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
SideEffects *SideEffectClass `json:"sideEffects,omitempty" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`
|
||||
|
||||
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
||||
// the webhook call will be ignored or the API call will fail based on the
|
||||
// failure policy.
|
||||
// The timeout value must be between 1 and 30 seconds.
|
||||
@@ -1022,7 +1027,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`
|
||||
|
||||
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
||||
// versions the Webhook expects. API server will try to use first version in
|
||||
// the list which it supports. If none of the versions specified in this list
|
||||
// supported by API server, validation will fail for this object.
|
||||
@@ -1052,7 +1057,7 @@ type MutatingWebhook struct {
|
||||
// +optional
|
||||
ReinvocationPolicy *ReinvocationPolicyType `json:"reinvocationPolicy,omitempty" protobuf:"bytes,10,opt,name=reinvocationPolicy,casttype=ReinvocationPolicyType"`
|
||||
|
||||
// MatchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// matchConditions is a list of conditions that must be met for a request to be sent to this
|
||||
// webhook. Match conditions filter requests that have already been matched by the rules,
|
||||
// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
|
||||
// There are a maximum of 64 match conditions allowed.
|
||||
@@ -1107,7 +1112,7 @@ const (
|
||||
// WebhookClientConfig contains the information to make a TLS
|
||||
// connection with the webhook
|
||||
type WebhookClientConfig struct {
|
||||
// `url` gives the location of the webhook, in standard URL form
|
||||
// url gives the location of the webhook, in standard URL form
|
||||
// (`scheme://host:port/path`). Exactly one of `url` or `service`
|
||||
// must be specified.
|
||||
//
|
||||
@@ -1136,7 +1141,7 @@ type WebhookClientConfig struct {
|
||||
// +optional
|
||||
URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"`
|
||||
|
||||
// `service` is a reference to the service for this webhook. Either
|
||||
// service is a reference to the service for this webhook. Either
|
||||
// `service` or `url` must be specified.
|
||||
//
|
||||
// If the webhook is running within the cluster, then you should use `service`.
|
||||
@@ -1144,7 +1149,7 @@ type WebhookClientConfig struct {
|
||||
// +optional
|
||||
Service *ServiceReference `json:"service,omitempty" protobuf:"bytes,1,opt,name=service"`
|
||||
|
||||
// `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
|
||||
// caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
|
||||
// If unspecified, system trust roots on the apiserver are used.
|
||||
// +optional
|
||||
CABundle []byte `json:"caBundle,omitempty" protobuf:"bytes,2,opt,name=caBundle"`
|
||||
@@ -1152,28 +1157,28 @@ type WebhookClientConfig struct {
|
||||
|
||||
// ServiceReference holds a reference to Service.legacy.k8s.io
|
||||
type ServiceReference struct {
|
||||
// `namespace` is the namespace of the service.
|
||||
// namespace is the namespace of the service.
|
||||
// Required
|
||||
Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
|
||||
// `name` is the name of the service.
|
||||
// name is the name of the service.
|
||||
// Required
|
||||
Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
|
||||
|
||||
// `path` is an optional URL path which will be sent in any request to
|
||||
// path is an optional URL path which will be sent in any request to
|
||||
// this service.
|
||||
// +optional
|
||||
Path *string `json:"path,omitempty" protobuf:"bytes,3,opt,name=path"`
|
||||
|
||||
// If specified, the port on the service that hosting webhook.
|
||||
// port is the port on the service that hosts the webhook.
|
||||
// Default to 443 for backward compatibility.
|
||||
// `port` should be a valid port number (1-65535, inclusive).
|
||||
// port should be a valid port number (1-65535, inclusive).
|
||||
// +optional
|
||||
Port *int32 `json:"port,omitempty" protobuf:"varint,4,opt,name=port"`
|
||||
}
|
||||
|
||||
// MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.
|
||||
type MatchCondition struct {
|
||||
// Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
// as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
// the associated expression.
|
||||
// Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
@@ -1184,7 +1189,7 @@ type MatchCondition struct {
|
||||
// Required.
|
||||
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
|
||||
|
||||
// Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
// CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
//
|
||||
// 'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
@@ -1204,24 +1209,26 @@ type MatchCondition struct {
|
||||
// +genclient:nonNamespaced
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.34
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=admissionregistration.k8s.io,v1,MutatingAdmissionPolicy
|
||||
|
||||
// MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
|
||||
type MutatingAdmissionPolicy struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the MutatingAdmissionPolicy.
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicy.
|
||||
Spec MutatingAdmissionPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.34
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=admissionregistration.k8s.io,v1,MutatingAdmissionPolicyList
|
||||
|
||||
// MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.
|
||||
type MutatingAdmissionPolicyList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
@@ -1467,6 +1474,7 @@ type JSONPatch struct {
|
||||
// +genclient:nonNamespaced
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.34
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=admissionregistration.k8s.io,v1,MutatingAdmissionPolicyBinding
|
||||
|
||||
// MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources.
|
||||
// MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators
|
||||
@@ -1481,20 +1489,21 @@ type JSONPatch struct {
|
||||
// given (policy, binding, param) combination is within its own CEL budget.
|
||||
type MutatingAdmissionPolicyBinding struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Specification of the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
|
||||
Spec MutatingAdmissionPolicyBindingSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.34
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=admissionregistration.k8s.io,v1,MutatingAdmissionPolicyBindingList
|
||||
|
||||
// MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.
|
||||
type MutatingAdmissionPolicyBindingList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
+74
-74
@@ -48,8 +48,8 @@ func (AuditAnnotation) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ExpressionWarning = map[string]string{
|
||||
"": "ExpressionWarning is a warning information that targets a specific expression.",
|
||||
"fieldRef": "The path to the field that refers the expression. For example, the reference to the expression of the first item of validations is \"spec.validations[0].expression\"",
|
||||
"warning": "The content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.",
|
||||
"fieldRef": "fieldRef is the path to the field that refers to the expression. For example, the reference to the expression of the first item of validations is \"spec.validations[0].expression\"",
|
||||
"warning": "warning contains the content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.",
|
||||
}
|
||||
|
||||
func (ExpressionWarning) SwaggerDoc() map[string]string {
|
||||
@@ -67,8 +67,8 @@ func (JSONPatch) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MatchCondition = map[string]string{
|
||||
"": "MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.",
|
||||
"name": "Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')\n\nRequired.",
|
||||
"expression": "Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:\n\n'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\nDocumentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/\n\nRequired.",
|
||||
"name": "name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')\n\nRequired.",
|
||||
"expression": "expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:\n\n'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\nDocumentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/\n\nRequired.",
|
||||
}
|
||||
|
||||
func (MatchCondition) SwaggerDoc() map[string]string {
|
||||
@@ -77,10 +77,10 @@ func (MatchCondition) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MatchResources = map[string]string{
|
||||
"": "MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",
|
||||
"namespaceSelector": "NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the policy on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"resourceRules": "ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.",
|
||||
"excludeResourceRules": "ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",
|
||||
"namespaceSelector": "namespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the policy on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "objectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"resourceRules": "resourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.",
|
||||
"excludeResourceRules": "excludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)",
|
||||
"matchPolicy": "matchPolicy defines how the \"MatchResources\" list is used to match incoming requests. Allowed values are \"Exact\" or \"Equivalent\".\n\n- Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.\n\n- Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.\n\nDefaults to \"Equivalent\"",
|
||||
}
|
||||
|
||||
@@ -90,8 +90,8 @@ func (MatchResources) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingAdmissionPolicy = map[string]string{
|
||||
"": "MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the MutatingAdmissionPolicy.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the MutatingAdmissionPolicy.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
@@ -100,8 +100,8 @@ func (MutatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingAdmissionPolicyBinding = map[string]string{
|
||||
"": "MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.\n\nFor a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding. Each evaluation is constrained by a [runtime cost budget](https://kubernetes.io/docs/reference/using-api/cel/#runtime-cost-budget).\n\nAdding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the MutatingAdmissionPolicyBinding.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the MutatingAdmissionPolicyBinding.",
|
||||
}
|
||||
|
||||
func (MutatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
@@ -110,7 +110,7 @@ func (MutatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingAdmissionPolicyBindingList = map[string]string{
|
||||
"": "MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of PolicyBinding.",
|
||||
}
|
||||
|
||||
@@ -131,7 +131,7 @@ func (MutatingAdmissionPolicyBindingSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingAdmissionPolicyList = map[string]string{
|
||||
"": "MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of ValidatingAdmissionPolicy.",
|
||||
}
|
||||
|
||||
@@ -156,18 +156,18 @@ func (MutatingAdmissionPolicySpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingWebhook = map[string]string{
|
||||
"": "MutatingWebhook describes an admission webhook and the resources and operations it applies to.",
|
||||
"name": "The name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where \"imagepolicy\" is the name of the webhook, and kubernetes.io is the name of the organization. Required.",
|
||||
"clientConfig": "ClientConfig defines how to communicate with the hook. Required",
|
||||
"rules": "Rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.",
|
||||
"failurePolicy": "FailurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Ignore.",
|
||||
"name": "name is the name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where \"imagepolicy\" is the name of the webhook, and kubernetes.io is the name of the organization. Required.",
|
||||
"clientConfig": "clientConfig defines how to communicate with the hook. Required",
|
||||
"rules": "rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.",
|
||||
"failurePolicy": "failurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Ignore.",
|
||||
"matchPolicy": "matchPolicy defines how the \"rules\" list is used to match incoming requests. Allowed values are \"Exact\" or \"Equivalent\".\n\n- Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.\n\n- Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.\n\nDefaults to \"Exact\"",
|
||||
"namespaceSelector": "NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the webhook on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "ObjectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"sideEffects": "SideEffects states whether this webhook has side effects. Acceptable values are: Unknown, None, Some, NoneOnDryRun Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some. Defaults to Unknown.",
|
||||
"timeoutSeconds": "TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 30 seconds.",
|
||||
"admissionReviewVersions": "AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy. Default to `['v1beta1']`.",
|
||||
"namespaceSelector": "namespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the webhook on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "objectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"sideEffects": "sideEffects states whether this webhook has side effects. Acceptable values are: Unknown, None, Some, NoneOnDryRun Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some. Defaults to Unknown.",
|
||||
"timeoutSeconds": "timeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 30 seconds.",
|
||||
"admissionReviewVersions": "admissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy. Default to `['v1beta1']`.",
|
||||
"reinvocationPolicy": "reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation. Allowed values are \"Never\" and \"IfNeeded\".\n\nNever: the webhook will not be called more than once in a single admission evaluation.\n\nIfNeeded: the webhook will be called at least one additional time as part of the admission evaluation if the object being admitted is modified by other admission plugins after the initial webhook call. Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted. Note: * the number of additional invocations is not guaranteed to be exactly one. * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again. * webhooks that use this option may be reordered to minimize the number of additional invocations. * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.\n\nDefaults to \"Never\".",
|
||||
"matchConditions": "MatchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the webhook is called.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the error is ignored and the webhook is skipped",
|
||||
"matchConditions": "matchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the webhook is called.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the error is ignored and the webhook is skipped",
|
||||
}
|
||||
|
||||
func (MutatingWebhook) SwaggerDoc() map[string]string {
|
||||
@@ -176,8 +176,8 @@ func (MutatingWebhook) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingWebhookConfiguration = map[string]string{
|
||||
"": "MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object. Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 MutatingWebhookConfiguration instead.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"webhooks": "Webhooks is a list of webhooks and the affected resources and operations.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"webhooks": "webhooks is a list of webhooks and the affected resources and operations.",
|
||||
}
|
||||
|
||||
func (MutatingWebhookConfiguration) SwaggerDoc() map[string]string {
|
||||
@@ -186,7 +186,7 @@ func (MutatingWebhookConfiguration) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_MutatingWebhookConfigurationList = map[string]string{
|
||||
"": "MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of MutatingWebhookConfiguration.",
|
||||
}
|
||||
|
||||
@@ -207,7 +207,7 @@ func (Mutation) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_NamedRuleWithOperations = map[string]string{
|
||||
"": "NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.",
|
||||
"resourceNames": "ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.",
|
||||
"resourceNames": "resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.",
|
||||
}
|
||||
|
||||
func (NamedRuleWithOperations) SwaggerDoc() map[string]string {
|
||||
@@ -216,8 +216,8 @@ func (NamedRuleWithOperations) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ParamKind = map[string]string{
|
||||
"": "ParamKind is a tuple of Group Kind and Version.",
|
||||
"apiVersion": "APIVersion is the API group version the resources belong to. In format of \"group/version\". Required.",
|
||||
"kind": "Kind is the API kind the resources belong to. Required.",
|
||||
"apiVersion": "apiVersion is the API group version the resources belong to. In format of \"group/version\". Required.",
|
||||
"kind": "kind is the API kind the resources belong to. Required.",
|
||||
}
|
||||
|
||||
func (ParamKind) SwaggerDoc() map[string]string {
|
||||
@@ -229,7 +229,7 @@ var map_ParamRef = map[string]string{
|
||||
"name": "name is the name of the resource being referenced.\n\nOne of `name` or `selector` must be set, but `name` and `selector` are mutually exclusive properties. If one is set, the other must be unset.\n\nA single parameter used for all admission requests can be configured by setting the `name` field, leaving `selector` blank, and setting namespace if `paramKind` is namespace-scoped.",
|
||||
"namespace": "namespace is the namespace of the referenced resource. Allows limiting the search for params to a specific namespace. Applies to both `name` and `selector` fields.\n\nA per-namespace parameter may be used by specifying a namespace-scoped `paramKind` in the policy and leaving this field empty.\n\n- If `paramKind` is cluster-scoped, this field MUST be unset. Setting this field results in a configuration error.\n\n- If `paramKind` is namespace-scoped, the namespace of the object being evaluated for admission will be used when this field is left unset. Take care that if this is left empty the binding must not match any cluster-scoped resources, which will result in an error.",
|
||||
"selector": "selector can be used to match multiple param objects based on their labels. Supply selector: {} to match all resources of the ParamKind.\n\nIf multiple params are found, they are all evaluated with the policy expressions and the results are ANDed together.\n\nOne of `name` or `selector` must be set, but `name` and `selector` are mutually exclusive properties. If one is set, the other must be unset.",
|
||||
"parameterNotFoundAction": "`parameterNotFoundAction` controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. If set to `Deny`, then no matched parameters will be subject to the `failurePolicy` of the policy.\n\nAllowed values are `Allow` or `Deny`\n\nRequired",
|
||||
"parameterNotFoundAction": "parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. If set to `Deny`, then no matched parameters will be subject to the `failurePolicy` of the policy.\n\nAllowed values are `Allow` or `Deny`\n\nRequired",
|
||||
}
|
||||
|
||||
func (ParamRef) SwaggerDoc() map[string]string {
|
||||
@@ -238,10 +238,10 @@ func (ParamRef) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ServiceReference = map[string]string{
|
||||
"": "ServiceReference holds a reference to Service.legacy.k8s.io",
|
||||
"namespace": "`namespace` is the namespace of the service. Required",
|
||||
"name": "`name` is the name of the service. Required",
|
||||
"path": "`path` is an optional URL path which will be sent in any request to this service.",
|
||||
"port": "If specified, the port on the service that hosting webhook. Default to 443 for backward compatibility. `port` should be a valid port number (1-65535, inclusive).",
|
||||
"namespace": "namespace is the namespace of the service. Required",
|
||||
"name": "name is the name of the service. Required",
|
||||
"path": "path is an optional URL path which will be sent in any request to this service.",
|
||||
"port": "port is the port on the service that hosts the webhook. Default to 443 for backward compatibility. port should be a valid port number (1-65535, inclusive).",
|
||||
}
|
||||
|
||||
func (ServiceReference) SwaggerDoc() map[string]string {
|
||||
@@ -250,7 +250,7 @@ func (ServiceReference) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TypeChecking = map[string]string{
|
||||
"": "TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy",
|
||||
"expressionWarnings": "The type checking warnings for each expression.",
|
||||
"expressionWarnings": "expressionWarnings contains the type checking warnings for each expression.",
|
||||
}
|
||||
|
||||
func (TypeChecking) SwaggerDoc() map[string]string {
|
||||
@@ -259,9 +259,9 @@ func (TypeChecking) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicy = map[string]string{
|
||||
"": "ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the ValidatingAdmissionPolicy.",
|
||||
"status": "The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the ValidatingAdmissionPolicy.",
|
||||
"status": "status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
@@ -270,8 +270,8 @@ func (ValidatingAdmissionPolicy) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyBinding = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.\n\nFor a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding.\n\nThe CEL expressions of a policy must have a computed CEL cost below the maximum CEL budget. Each evaluation of the policy is given an independent CEL cost budget. Adding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"spec": "spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
@@ -280,7 +280,7 @@ func (ValidatingAdmissionPolicyBinding) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyBindingList = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of PolicyBinding.",
|
||||
}
|
||||
|
||||
@@ -290,9 +290,9 @@ func (ValidatingAdmissionPolicyBindingList) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyBindingSpec = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.",
|
||||
"policyName": "PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.",
|
||||
"policyName": "policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.",
|
||||
"paramRef": "paramRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied. If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.",
|
||||
"matchResources": "MatchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.",
|
||||
"matchResources": "matchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.",
|
||||
"validationActions": "validationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced. If a validation evaluates to false it is always enforced according to these actions.\n\nFailures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according to these actions only if the FailurePolicy is set to Fail, otherwise the failures are ignored. This includes compilation errors, runtime errors and misconfigurations of the policy.\n\nvalidationActions is declared as a set of action values. Order does not matter. validationActions may not contain duplicates of the same action.\n\nThe supported actions values are:\n\n\"Deny\" specifies that a validation failure results in a denied request.\n\n\"Warn\" specifies that a validation failure is reported to the request client in HTTP Warning headers, with a warning code of 299. Warnings can be sent both for allowed or denied admission responses.\n\n\"Audit\" specifies that a validation failure is included in the published audit event for the request. The audit event will contain a `validation.policy.admission.k8s.io/validation_failure` audit annotation with a value containing the details of the validation failures, formatted as a JSON list of objects, each with the following fields: - message: The validation failure message string - policy: The resource name of the ValidatingAdmissionPolicy - binding: The resource name of the ValidatingAdmissionPolicyBinding - expressionIndex: The index of the failed validations in the ValidatingAdmissionPolicy - validationActions: The enforcement actions enacted for the validation failure Example audit annotation: `\"validation.policy.admission.k8s.io/validation_failure\": \"[{\"message\": \"Invalid value\", {\"policy\": \"policy.example.com\", {\"binding\": \"policybinding.example.com\", {\"expressionIndex\": \"1\", {\"validationActions\": [\"Audit\"]}]\"`\n\nClients should expect to handle additional values by ignoring any values not recognized.\n\n\"Deny\" and \"Warn\" may not be used together since this combination needlessly duplicates the validation failure both in the API response body and the HTTP warning headers.\n\nRequired.",
|
||||
}
|
||||
|
||||
@@ -302,7 +302,7 @@ func (ValidatingAdmissionPolicyBindingSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyList = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of ValidatingAdmissionPolicy.",
|
||||
}
|
||||
|
||||
@@ -312,13 +312,13 @@ func (ValidatingAdmissionPolicyList) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicySpec = map[string]string{
|
||||
"": "ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.",
|
||||
"paramKind": "ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.",
|
||||
"matchConstraints": "MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.",
|
||||
"validations": "Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.",
|
||||
"paramKind": "paramKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.",
|
||||
"matchConstraints": "matchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.",
|
||||
"validations": "validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.",
|
||||
"failurePolicy": "failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.\n\nA policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.\n\nfailurePolicy does not define how validations that evaluate to false are handled.\n\nWhen failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.\n\nAllowed values are Ignore or Fail. Defaults to Fail.",
|
||||
"auditAnnotations": "auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.",
|
||||
"matchConditions": "MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the policy is skipped",
|
||||
"variables": "Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.\n\nThe expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.",
|
||||
"matchConditions": "matchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the policy is skipped",
|
||||
"variables": "variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.\n\nThe expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicySpec) SwaggerDoc() map[string]string {
|
||||
@@ -327,9 +327,9 @@ func (ValidatingAdmissionPolicySpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingAdmissionPolicyStatus = map[string]string{
|
||||
"": "ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.",
|
||||
"observedGeneration": "The generation observed by the controller.",
|
||||
"typeChecking": "The results of type checking for each expression. Presence of this field indicates the completion of the type checking.",
|
||||
"conditions": "The conditions represent the latest available observations of a policy's current state.",
|
||||
"observedGeneration": "observedGeneration is the generation observed by the controller.",
|
||||
"typeChecking": "typeChecking contains the results of type checking for each expression. Presence of this field indicates the completion of the type checking.",
|
||||
"conditions": "conditions represent the latest available observations of a policy's current state.",
|
||||
}
|
||||
|
||||
func (ValidatingAdmissionPolicyStatus) SwaggerDoc() map[string]string {
|
||||
@@ -338,17 +338,17 @@ func (ValidatingAdmissionPolicyStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingWebhook = map[string]string{
|
||||
"": "ValidatingWebhook describes an admission webhook and the resources and operations it applies to.",
|
||||
"name": "The name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where \"imagepolicy\" is the name of the webhook, and kubernetes.io is the name of the organization. Required.",
|
||||
"clientConfig": "ClientConfig defines how to communicate with the hook. Required",
|
||||
"rules": "Rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.",
|
||||
"failurePolicy": "FailurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Ignore.",
|
||||
"name": "name is the name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where \"imagepolicy\" is the name of the webhook, and kubernetes.io is the name of the organization. Required.",
|
||||
"clientConfig": "clientConfig defines how to communicate with the hook. Required",
|
||||
"rules": "rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.",
|
||||
"failurePolicy": "failurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Ignore.",
|
||||
"matchPolicy": "matchPolicy defines how the \"rules\" list is used to match incoming requests. Allowed values are \"Exact\" or \"Equivalent\".\n\n- Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.\n\n- Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and \"rules\" only included `apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources: [\"deployments\"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.\n\nDefaults to \"Exact\"",
|
||||
"namespaceSelector": "NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the webhook on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "ObjectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"sideEffects": "SideEffects states whether this webhook has side effects. Acceptable values are: Unknown, None, Some, NoneOnDryRun Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some. Defaults to Unknown.",
|
||||
"timeoutSeconds": "TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 30 seconds.",
|
||||
"admissionReviewVersions": "AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy. Default to `['v1beta1']`.",
|
||||
"matchConditions": "MatchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the webhook is called.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the error is ignored and the webhook is skipped",
|
||||
"namespaceSelector": "namespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.\n\nFor example, to run the webhook on any objects whose namespace is not associated with \"runlevel\" of \"0\" or \"1\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"runlevel\",\n \"operator\": \"NotIn\",\n \"values\": [\n \"0\",\n \"1\"\n ]\n }\n ]\n}\n\nIf instead you want to only run the webhook on any objects whose namespace is associated with the \"environment\" of \"prod\" or \"staging\"; you will set the selector as follows: \"namespaceSelector\": {\n \"matchExpressions\": [\n {\n \"key\": \"environment\",\n \"operator\": \"In\",\n \"values\": [\n \"prod\",\n \"staging\"\n ]\n }\n ]\n}\n\nSee https://kubernetes.io/docs/concepts/overview/working-with-objects/labels for more examples of label selectors.\n\nDefault to the empty LabelSelector, which matches everything.",
|
||||
"objectSelector": "objectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.",
|
||||
"sideEffects": "sideEffects states whether this webhook has side effects. Acceptable values are: Unknown, None, Some, NoneOnDryRun Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some. Defaults to Unknown.",
|
||||
"timeoutSeconds": "timeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 30 seconds.",
|
||||
"admissionReviewVersions": "admissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy. Default to `['v1beta1']`.",
|
||||
"matchConditions": "matchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.\n 2. If ALL matchConditions evaluate to TRUE, the webhook is called.\n 3. If any matchCondition evaluates to an error (but none are FALSE):\n - If failurePolicy=Fail, reject the request\n - If failurePolicy=Ignore, the error is ignored and the webhook is skipped",
|
||||
}
|
||||
|
||||
func (ValidatingWebhook) SwaggerDoc() map[string]string {
|
||||
@@ -357,8 +357,8 @@ func (ValidatingWebhook) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingWebhookConfiguration = map[string]string{
|
||||
"": "ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it. Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 ValidatingWebhookConfiguration instead.",
|
||||
"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"webhooks": "Webhooks is a list of webhooks and the affected resources and operations.",
|
||||
"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
|
||||
"webhooks": "webhooks is a list of webhooks and the affected resources and operations.",
|
||||
}
|
||||
|
||||
func (ValidatingWebhookConfiguration) SwaggerDoc() map[string]string {
|
||||
@@ -367,7 +367,7 @@ func (ValidatingWebhookConfiguration) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ValidatingWebhookConfigurationList = map[string]string{
|
||||
"": "ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"items": "List of ValidatingWebhookConfiguration.",
|
||||
}
|
||||
|
||||
@@ -377,9 +377,9 @@ func (ValidatingWebhookConfigurationList) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_Validation = map[string]string{
|
||||
"": "Validation specifies the CEL expression which is used to apply the validation.",
|
||||
"expression": "Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired.",
|
||||
"message": "Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is \"failed rule: {Rule}\". e.g. \"must be a URL with the host matching spec.host\" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is \"failed Expression: {Expression}\".",
|
||||
"reason": "Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: \"Unauthorized\", \"Forbidden\", \"Invalid\", \"RequestEntityTooLarge\". If not set, StatusReasonInvalid is used in the response to the client.",
|
||||
"expression": "expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired.",
|
||||
"message": "message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is \"failed rule: {Rule}\". e.g. \"must be a URL with the host matching spec.host\" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is \"failed Expression: {Expression}\".",
|
||||
"reason": "reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: \"Unauthorized\", \"Forbidden\", \"Invalid\", \"RequestEntityTooLarge\". If not set, StatusReasonInvalid is used in the response to the client.",
|
||||
"messageExpression": "messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. Example: \"object.x must be less than max (\"+string(params.max)+\")\"",
|
||||
}
|
||||
|
||||
@@ -389,8 +389,8 @@ func (Validation) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_Variable = map[string]string{
|
||||
"": "Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.",
|
||||
"name": "Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is \"foo\", the variable will be available as `variables.foo`",
|
||||
"expression": "Expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.",
|
||||
"name": "name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is \"foo\", the variable will be available as `variables.foo`",
|
||||
"expression": "expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.",
|
||||
}
|
||||
|
||||
func (Variable) SwaggerDoc() map[string]string {
|
||||
@@ -399,9 +399,9 @@ func (Variable) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_WebhookClientConfig = map[string]string{
|
||||
"": "WebhookClientConfig contains the information to make a TLS connection with the webhook",
|
||||
"url": "`url` gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nThe scheme must be \"https\"; the URL must begin with \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.\n\nAttempting to use a user or basic auth e.g. \"user:password@\" is not allowed. Fragments (\"#...\") and query parameters (\"?...\") are not allowed, either.",
|
||||
"service": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.",
|
||||
"caBundle": "`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. If unspecified, system trust roots on the apiserver are used.",
|
||||
"url": "url gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nThe scheme must be \"https\"; the URL must begin with \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.\n\nAttempting to use a user or basic auth e.g. \"user:password@\" is not allowed. Fragments (\"#...\") and query parameters (\"?...\") are not allowed, either.",
|
||||
"service": "service is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.",
|
||||
"caBundle": "caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. If unspecified, system trust roots on the apiserver are used.",
|
||||
}
|
||||
|
||||
func (WebhookClientConfig) SwaggerDoc() map[string]string {
|
||||
|
||||
Generated
Vendored
+24
@@ -37,6 +37,12 @@ func (in *MutatingAdmissionPolicy) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 37
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *MutatingAdmissionPolicy) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1", Kind: "MutatingAdmissionPolicy"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *MutatingAdmissionPolicy) APILifecycleRemoved() (major, minor int) {
|
||||
@@ -55,6 +61,12 @@ func (in *MutatingAdmissionPolicyBinding) APILifecycleDeprecated() (major, minor
|
||||
return 1, 37
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *MutatingAdmissionPolicyBinding) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1", Kind: "MutatingAdmissionPolicyBinding"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *MutatingAdmissionPolicyBinding) APILifecycleRemoved() (major, minor int) {
|
||||
@@ -73,6 +85,12 @@ func (in *MutatingAdmissionPolicyBindingList) APILifecycleDeprecated() (major, m
|
||||
return 1, 37
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *MutatingAdmissionPolicyBindingList) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1", Kind: "MutatingAdmissionPolicyBindingList"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *MutatingAdmissionPolicyBindingList) APILifecycleRemoved() (major, minor int) {
|
||||
@@ -91,6 +109,12 @@ func (in *MutatingAdmissionPolicyList) APILifecycleDeprecated() (major, minor in
|
||||
return 1, 37
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *MutatingAdmissionPolicyList) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1", Kind: "MutatingAdmissionPolicyList"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *MutatingAdmissionPolicyList) APILifecycleRemoved() (major, minor int) {
|
||||
|
||||
+1
-1
@@ -32,7 +32,7 @@ option go_package = "k8s.io/api/apidiscovery/v2";
|
||||
// It contains a list of APIVersionDiscovery that holds a list of APIResourceDiscovery types served for a version.
|
||||
// Versions are in descending order of preference, with the first version being the preferred entry.
|
||||
message APIGroupDiscovery {
|
||||
// Standard object's metadata.
|
||||
// metadata is standard object's metadata.
|
||||
// The only field completed will be name. For instance, resourceVersion will be empty.
|
||||
// name is the name of the API group whose discovery information is presented here.
|
||||
// name is allowed to be "" to represent the legacy, ungroupified resources.
|
||||
|
||||
-32
@@ -1,32 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v2
|
||||
|
||||
func (*APIGroupDiscovery) ProtoMessage() {}
|
||||
|
||||
func (*APIGroupDiscoveryList) ProtoMessage() {}
|
||||
|
||||
func (*APIResourceDiscovery) ProtoMessage() {}
|
||||
|
||||
func (*APISubresourceDiscovery) ProtoMessage() {}
|
||||
|
||||
func (*APIVersionDiscovery) ProtoMessage() {}
|
||||
+1
-1
@@ -45,7 +45,7 @@ type APIGroupDiscoveryList struct {
|
||||
// Versions are in descending order of preference, with the first version being the preferred entry.
|
||||
type APIGroupDiscovery struct {
|
||||
v1.TypeMeta `json:",inline"`
|
||||
// Standard object's metadata.
|
||||
// metadata is standard object's metadata.
|
||||
// The only field completed will be name. For instance, resourceVersion will be empty.
|
||||
// name is the name of the API group whose discovery information is presented here.
|
||||
// name is allowed to be "" to represent the legacy, ungroupified resources.
|
||||
|
||||
+1
-1
@@ -32,7 +32,7 @@ option go_package = "k8s.io/api/apidiscovery/v2beta1";
|
||||
// It contains a list of APIVersionDiscovery that holds a list of APIResourceDiscovery types served for a version.
|
||||
// Versions are in descending order of preference, with the first version being the preferred entry.
|
||||
message APIGroupDiscovery {
|
||||
// Standard object's metadata.
|
||||
// metadata is standard object's metadata.
|
||||
// The only field completed will be name. For instance, resourceVersion will be empty.
|
||||
// name is the name of the API group whose discovery information is presented here.
|
||||
// name is allowed to be "" to represent the legacy, ungroupified resources.
|
||||
|
||||
-32
@@ -1,32 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v2beta1
|
||||
|
||||
func (*APIGroupDiscovery) ProtoMessage() {}
|
||||
|
||||
func (*APIGroupDiscoveryList) ProtoMessage() {}
|
||||
|
||||
func (*APIResourceDiscovery) ProtoMessage() {}
|
||||
|
||||
func (*APISubresourceDiscovery) ProtoMessage() {}
|
||||
|
||||
func (*APIVersionDiscovery) ProtoMessage() {}
|
||||
+1
-1
@@ -51,7 +51,7 @@ type APIGroupDiscoveryList struct {
|
||||
// Versions are in descending order of preference, with the first version being the preferred entry.
|
||||
type APIGroupDiscovery struct {
|
||||
v1.TypeMeta `json:",inline"`
|
||||
// Standard object's metadata.
|
||||
// metadata is standard object's metadata.
|
||||
// The only field completed will be name. For instance, resourceVersion will be empty.
|
||||
// name is the name of the API group whose discovery information is presented here.
|
||||
// name is allowed to be "" to represent the legacy, ungroupified resources.
|
||||
|
||||
+26
-15
@@ -31,59 +31,69 @@ option go_package = "k8s.io/api/apiserverinternal/v1alpha1";
|
||||
// An API server instance reports the version it can decode and the version it
|
||||
// encodes objects to when persisting objects in the backend.
|
||||
message ServerStorageVersion {
|
||||
// The ID of the reporting API server.
|
||||
// apiServerID is the ID of the reporting API server.
|
||||
// +required
|
||||
optional string apiServerID = 1;
|
||||
|
||||
// The API server encodes the object to this version when persisting it in
|
||||
// encodingVersion the API server encodes the object to when persisting it in
|
||||
// the backend (e.g., etcd).
|
||||
// +required
|
||||
optional string encodingVersion = 2;
|
||||
|
||||
// decodableVersions are the encoding versions the API server can handle to decode.
|
||||
// The API server can decode objects encoded in these versions.
|
||||
// The encodingVersion must be included in the decodableVersions.
|
||||
// +listType=set
|
||||
// +required
|
||||
repeated string decodableVersions = 3;
|
||||
|
||||
// The API server can serve these versions.
|
||||
// servedVersions lists all versions the API server can serve.
|
||||
// DecodableVersions must include all ServedVersions.
|
||||
// +listType=set
|
||||
// +optional
|
||||
repeated string servedVersions = 4;
|
||||
}
|
||||
|
||||
// Storage version of a specific resource.
|
||||
message StorageVersion {
|
||||
// metadata is the standard object metadata.
|
||||
// The name is <group>.<resource>.
|
||||
// +required
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec is an empty spec. It is here to comply with Kubernetes API style.
|
||||
// spec is an empty spec. It is here to comply with Kubernetes API style.
|
||||
// +optional
|
||||
optional StorageVersionSpec spec = 2;
|
||||
|
||||
// API server instances report the version they can decode and the version they
|
||||
// status on the version the API server instance can decode from and
|
||||
// encode objects to when persisting objects in the backend.
|
||||
// +optional
|
||||
optional StorageVersionStatus status = 3;
|
||||
}
|
||||
|
||||
// Describes the state of the storageVersion at a certain point.
|
||||
message StorageVersionCondition {
|
||||
// Type of the condition.
|
||||
// type of the condition.
|
||||
// +required
|
||||
optional string type = 1;
|
||||
|
||||
// Status of the condition, one of True, False, Unknown.
|
||||
// status of the condition, one of True, False, Unknown.
|
||||
// +required
|
||||
optional string status = 2;
|
||||
|
||||
// If set, this represents the .metadata.generation that the condition was set based upon.
|
||||
// observedGeneration represents the .metadata.generation that the condition was set based upon, if field is set.
|
||||
// +optional
|
||||
optional int64 observedGeneration = 3;
|
||||
|
||||
// Last time the condition transitioned from one status to another.
|
||||
// lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 4;
|
||||
|
||||
// The reason for the condition's last transition.
|
||||
// reason for the condition's last transition.
|
||||
// +required
|
||||
optional string reason = 5;
|
||||
|
||||
// A human readable message indicating details about the transition.
|
||||
// message is a human readable string indicating details about the transition.
|
||||
// +required
|
||||
optional string message = 6;
|
||||
}
|
||||
@@ -106,20 +116,21 @@ message StorageVersionSpec {
|
||||
// API server instances report the versions they can decode and the version they
|
||||
// encode objects to when persisting objects in the backend.
|
||||
message StorageVersionStatus {
|
||||
// The reported versions per API server instance.
|
||||
// storageVersions lists the reported versions per API server instance.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=apiServerID
|
||||
repeated ServerStorageVersion storageVersions = 1;
|
||||
|
||||
// If all API server instances agree on the same encoding storage version,
|
||||
// then this field is set to that version. Otherwise this field is left empty.
|
||||
// commonEncodingVersion is set to an encoding storage version if all API server
|
||||
// instances share that same version. If they don't share one storage version, this
|
||||
// field is left empty.
|
||||
// API servers should finish updating its storageVersionStatus entry before
|
||||
// serving write operations, so that this field will be in sync with the reality.
|
||||
// +optional
|
||||
optional string commonEncodingVersion = 2;
|
||||
|
||||
// The latest available observations of the storageVersion's state.
|
||||
// conditions lists the latest available observations of the storageVersion's state.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=type
|
||||
|
||||
-34
@@ -1,34 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
func (*ServerStorageVersion) ProtoMessage() {}
|
||||
|
||||
func (*StorageVersion) ProtoMessage() {}
|
||||
|
||||
func (*StorageVersionCondition) ProtoMessage() {}
|
||||
|
||||
func (*StorageVersionList) ProtoMessage() {}
|
||||
|
||||
func (*StorageVersionSpec) ProtoMessage() {}
|
||||
|
||||
func (*StorageVersionStatus) ProtoMessage() {}
|
||||
+26
-15
@@ -27,14 +27,18 @@ import (
|
||||
// Storage version of a specific resource.
|
||||
type StorageVersion struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// metadata is the standard object metadata.
|
||||
// The name is <group>.<resource>.
|
||||
// +required
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec is an empty spec. It is here to comply with Kubernetes API style.
|
||||
// spec is an empty spec. It is here to comply with Kubernetes API style.
|
||||
// +optional
|
||||
Spec StorageVersionSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// API server instances report the version they can decode and the version they
|
||||
// status on the version the API server instance can decode from and
|
||||
// encode objects to when persisting objects in the backend.
|
||||
// +optional
|
||||
Status StorageVersionStatus `json:"status" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
@@ -44,19 +48,20 @@ type StorageVersionSpec struct{}
|
||||
// API server instances report the versions they can decode and the version they
|
||||
// encode objects to when persisting objects in the backend.
|
||||
type StorageVersionStatus struct {
|
||||
// The reported versions per API server instance.
|
||||
// storageVersions lists the reported versions per API server instance.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=apiServerID
|
||||
StorageVersions []ServerStorageVersion `json:"storageVersions,omitempty" protobuf:"bytes,1,opt,name=storageVersions"`
|
||||
// If all API server instances agree on the same encoding storage version,
|
||||
// then this field is set to that version. Otherwise this field is left empty.
|
||||
// commonEncodingVersion is set to an encoding storage version if all API server
|
||||
// instances share that same version. If they don't share one storage version, this
|
||||
// field is left empty.
|
||||
// API servers should finish updating its storageVersionStatus entry before
|
||||
// serving write operations, so that this field will be in sync with the reality.
|
||||
// +optional
|
||||
CommonEncodingVersion *string `json:"commonEncodingVersion,omitempty" protobuf:"bytes,2,opt,name=commonEncodingVersion"`
|
||||
|
||||
// The latest available observations of the storageVersion's state.
|
||||
// conditions lists the latest available observations of the storageVersion's state.
|
||||
// +optional
|
||||
// +listType=map
|
||||
// +listMapKey=type
|
||||
@@ -66,21 +71,26 @@ type StorageVersionStatus struct {
|
||||
// An API server instance reports the version it can decode and the version it
|
||||
// encodes objects to when persisting objects in the backend.
|
||||
type ServerStorageVersion struct {
|
||||
// The ID of the reporting API server.
|
||||
// apiServerID is the ID of the reporting API server.
|
||||
// +required
|
||||
APIServerID string `json:"apiServerID,omitempty" protobuf:"bytes,1,opt,name=apiServerID"`
|
||||
|
||||
// The API server encodes the object to this version when persisting it in
|
||||
// encodingVersion the API server encodes the object to when persisting it in
|
||||
// the backend (e.g., etcd).
|
||||
// +required
|
||||
EncodingVersion string `json:"encodingVersion,omitempty" protobuf:"bytes,2,opt,name=encodingVersion"`
|
||||
|
||||
// decodableVersions are the encoding versions the API server can handle to decode.
|
||||
// The API server can decode objects encoded in these versions.
|
||||
// The encodingVersion must be included in the decodableVersions.
|
||||
// +listType=set
|
||||
// +required
|
||||
DecodableVersions []string `json:"decodableVersions,omitempty" protobuf:"bytes,3,opt,name=decodableVersions"`
|
||||
|
||||
// The API server can serve these versions.
|
||||
// servedVersions lists all versions the API server can serve.
|
||||
// DecodableVersions must include all ServedVersions.
|
||||
// +listType=set
|
||||
// +optional
|
||||
ServedVersions []string `json:"servedVersions,omitempty" protobuf:"bytes,4,opt,name=servedVersions"`
|
||||
}
|
||||
|
||||
@@ -101,21 +111,22 @@ const (
|
||||
|
||||
// Describes the state of the storageVersion at a certain point.
|
||||
type StorageVersionCondition struct {
|
||||
// Type of the condition.
|
||||
// type of the condition.
|
||||
// +required
|
||||
Type StorageVersionConditionType `json:"type" protobuf:"bytes,1,opt,name=type"`
|
||||
// Status of the condition, one of True, False, Unknown.
|
||||
// status of the condition, one of True, False, Unknown.
|
||||
// +required
|
||||
Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status"`
|
||||
// If set, this represents the .metadata.generation that the condition was set based upon.
|
||||
// observedGeneration represents the .metadata.generation that the condition was set based upon, if field is set.
|
||||
// +optional
|
||||
ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,3,opt,name=observedGeneration"`
|
||||
// Last time the condition transitioned from one status to another.
|
||||
// lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
// +optional
|
||||
LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,4,opt,name=lastTransitionTime"`
|
||||
// The reason for the condition's last transition.
|
||||
// reason for the condition's last transition.
|
||||
// +required
|
||||
Reason string `json:"reason" protobuf:"bytes,5,opt,name=reason"`
|
||||
// A human readable message indicating details about the transition.
|
||||
// message is a human readable string indicating details about the transition.
|
||||
// +required
|
||||
Message string `json:"message,omitempty" protobuf:"bytes,6,opt,name=message"`
|
||||
}
|
||||
|
||||
+16
-16
@@ -29,10 +29,10 @@ package v1alpha1
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_ServerStorageVersion = map[string]string{
|
||||
"": "An API server instance reports the version it can decode and the version it encodes objects to when persisting objects in the backend.",
|
||||
"apiServerID": "The ID of the reporting API server.",
|
||||
"encodingVersion": "The API server encodes the object to this version when persisting it in the backend (e.g., etcd).",
|
||||
"decodableVersions": "The API server can decode objects encoded in these versions. The encodingVersion must be included in the decodableVersions.",
|
||||
"servedVersions": "The API server can serve these versions. DecodableVersions must include all ServedVersions.",
|
||||
"apiServerID": "apiServerID is the ID of the reporting API server.",
|
||||
"encodingVersion": "encodingVersion the API server encodes the object to when persisting it in the backend (e.g., etcd).",
|
||||
"decodableVersions": "decodableVersions are the encoding versions the API server can handle to decode. The API server can decode objects encoded in these versions. The encodingVersion must be included in the decodableVersions.",
|
||||
"servedVersions": "servedVersions lists all versions the API server can serve. DecodableVersions must include all ServedVersions.",
|
||||
}
|
||||
|
||||
func (ServerStorageVersion) SwaggerDoc() map[string]string {
|
||||
@@ -41,9 +41,9 @@ func (ServerStorageVersion) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_StorageVersion = map[string]string{
|
||||
"": "Storage version of a specific resource.",
|
||||
"metadata": "The name is <group>.<resource>.",
|
||||
"spec": "Spec is an empty spec. It is here to comply with Kubernetes API style.",
|
||||
"status": "API server instances report the version they can decode and the version they encode objects to when persisting objects in the backend.",
|
||||
"metadata": "metadata is the standard object metadata. The name is <group>.<resource>.",
|
||||
"spec": "spec is an empty spec. It is here to comply with Kubernetes API style.",
|
||||
"status": "status on the version the API server instance can decode from and encode objects to when persisting objects in the backend.",
|
||||
}
|
||||
|
||||
func (StorageVersion) SwaggerDoc() map[string]string {
|
||||
@@ -52,12 +52,12 @@ func (StorageVersion) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_StorageVersionCondition = map[string]string{
|
||||
"": "Describes the state of the storageVersion at a certain point.",
|
||||
"type": "Type of the condition.",
|
||||
"status": "Status of the condition, one of True, False, Unknown.",
|
||||
"observedGeneration": "If set, this represents the .metadata.generation that the condition was set based upon.",
|
||||
"lastTransitionTime": "Last time the condition transitioned from one status to another.",
|
||||
"reason": "The reason for the condition's last transition.",
|
||||
"message": "A human readable message indicating details about the transition.",
|
||||
"type": "type of the condition.",
|
||||
"status": "status of the condition, one of True, False, Unknown.",
|
||||
"observedGeneration": "observedGeneration represents the .metadata.generation that the condition was set based upon, if field is set.",
|
||||
"lastTransitionTime": "lastTransitionTime is the last time the condition transitioned from one status to another.",
|
||||
"reason": "reason for the condition's last transition.",
|
||||
"message": "message is a human readable string indicating details about the transition.",
|
||||
}
|
||||
|
||||
func (StorageVersionCondition) SwaggerDoc() map[string]string {
|
||||
@@ -84,9 +84,9 @@ func (StorageVersionSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_StorageVersionStatus = map[string]string{
|
||||
"": "API server instances report the versions they can decode and the version they encode objects to when persisting objects in the backend.",
|
||||
"storageVersions": "The reported versions per API server instance.",
|
||||
"commonEncodingVersion": "If all API server instances agree on the same encoding storage version, then this field is set to that version. Otherwise this field is left empty. API servers should finish updating its storageVersionStatus entry before serving write operations, so that this field will be in sync with the reality.",
|
||||
"conditions": "The latest available observations of the storageVersion's state.",
|
||||
"storageVersions": "storageVersions lists the reported versions per API server instance.",
|
||||
"commonEncodingVersion": "commonEncodingVersion is set to an encoding storage version if all API server instances share that same version. If they don't share one storage version, this field is left empty. API servers should finish updating its storageVersionStatus entry before serving write operations, so that this field will be in sync with the reality.",
|
||||
"conditions": "conditions lists the latest available observations of the storageVersion's state.",
|
||||
}
|
||||
|
||||
func (StorageVersionStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
-82
@@ -1,82 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
func (*ControllerRevision) ProtoMessage() {}
|
||||
|
||||
func (*ControllerRevisionList) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSet) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetCondition) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetList) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetSpec) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetStatus) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetUpdateStrategy) ProtoMessage() {}
|
||||
|
||||
func (*Deployment) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentCondition) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentList) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentSpec) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentStatus) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentStrategy) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSet) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSetCondition) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSetList) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSetSpec) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSetStatus) ProtoMessage() {}
|
||||
|
||||
func (*RollingUpdateDaemonSet) ProtoMessage() {}
|
||||
|
||||
func (*RollingUpdateDeployment) ProtoMessage() {}
|
||||
|
||||
func (*RollingUpdateStatefulSetStrategy) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSet) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetCondition) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetList) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetOrdinals) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetPersistentVolumeClaimRetentionPolicy) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetSpec) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetStatus) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetUpdateStrategy) ProtoMessage() {}
|
||||
+2
-2
@@ -318,9 +318,9 @@ message Scale {
|
||||
message ScaleSpec {
|
||||
// replicas is the number of observed instances of the scaled object.
|
||||
// +optional
|
||||
// +k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +default=0
|
||||
// +k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=0
|
||||
optional int32 replicas = 1;
|
||||
}
|
||||
|
||||
|
||||
-68
@@ -1,68 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
func (*ControllerRevision) ProtoMessage() {}
|
||||
|
||||
func (*ControllerRevisionList) ProtoMessage() {}
|
||||
|
||||
func (*Deployment) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentCondition) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentList) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentRollback) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentSpec) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentStatus) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentStrategy) ProtoMessage() {}
|
||||
|
||||
func (*RollbackConfig) ProtoMessage() {}
|
||||
|
||||
func (*RollingUpdateDeployment) ProtoMessage() {}
|
||||
|
||||
func (*RollingUpdateStatefulSetStrategy) ProtoMessage() {}
|
||||
|
||||
func (*Scale) ProtoMessage() {}
|
||||
|
||||
func (*ScaleSpec) ProtoMessage() {}
|
||||
|
||||
func (*ScaleStatus) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSet) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetCondition) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetList) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetOrdinals) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetPersistentVolumeClaimRetentionPolicy) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetSpec) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetStatus) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetUpdateStrategy) ProtoMessage() {}
|
||||
+3
-3
@@ -33,9 +33,9 @@ const (
|
||||
type ScaleSpec struct {
|
||||
// replicas is the number of observed instances of the scaled object.
|
||||
// +optional
|
||||
// +k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +default=0
|
||||
// +k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=0
|
||||
Replicas int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`
|
||||
}
|
||||
|
||||
@@ -63,7 +63,7 @@ type ScaleStatus struct {
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.8
|
||||
// +k8s:prerelease-lifecycle-gen:removed=1.16
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=autoscaling,v1,Scale
|
||||
// +k8s:isSubresource=/scale
|
||||
// +k8s:isSubresource="/scale"
|
||||
|
||||
// Scale represents a scaling request for a resource.
|
||||
type Scale struct {
|
||||
|
||||
+2
-2
@@ -616,9 +616,9 @@ message Scale {
|
||||
message ScaleSpec {
|
||||
// desired number of instances for the scaled object.
|
||||
// +optional
|
||||
// +k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +default=0
|
||||
// +k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=0
|
||||
optional int32 replicas = 1;
|
||||
}
|
||||
|
||||
|
||||
-88
@@ -1,88 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1beta2
|
||||
|
||||
func (*ControllerRevision) ProtoMessage() {}
|
||||
|
||||
func (*ControllerRevisionList) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSet) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetCondition) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetList) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetSpec) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetStatus) ProtoMessage() {}
|
||||
|
||||
func (*DaemonSetUpdateStrategy) ProtoMessage() {}
|
||||
|
||||
func (*Deployment) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentCondition) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentList) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentSpec) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentStatus) ProtoMessage() {}
|
||||
|
||||
func (*DeploymentStrategy) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSet) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSetCondition) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSetList) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSetSpec) ProtoMessage() {}
|
||||
|
||||
func (*ReplicaSetStatus) ProtoMessage() {}
|
||||
|
||||
func (*RollingUpdateDaemonSet) ProtoMessage() {}
|
||||
|
||||
func (*RollingUpdateDeployment) ProtoMessage() {}
|
||||
|
||||
func (*RollingUpdateStatefulSetStrategy) ProtoMessage() {}
|
||||
|
||||
func (*Scale) ProtoMessage() {}
|
||||
|
||||
func (*ScaleSpec) ProtoMessage() {}
|
||||
|
||||
func (*ScaleStatus) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSet) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetCondition) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetList) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetOrdinals) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetPersistentVolumeClaimRetentionPolicy) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetSpec) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetStatus) ProtoMessage() {}
|
||||
|
||||
func (*StatefulSetUpdateStrategy) ProtoMessage() {}
|
||||
+3
-3
@@ -35,9 +35,9 @@ const (
|
||||
type ScaleSpec struct {
|
||||
// desired number of instances for the scaled object.
|
||||
// +optional
|
||||
// +k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +default=0
|
||||
// +k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=0
|
||||
Replicas int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`
|
||||
}
|
||||
|
||||
@@ -66,7 +66,7 @@ type ScaleStatus struct {
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.9
|
||||
// +k8s:prerelease-lifecycle-gen:removed=1.16
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=autoscaling,v1,Scale
|
||||
// +k8s:isSubresource=/scale
|
||||
// +k8s:isSubresource="/scale"
|
||||
|
||||
// Scale represents a scaling request for a resource.
|
||||
type Scale struct {
|
||||
|
||||
+35
-29
@@ -30,19 +30,19 @@ option go_package = "k8s.io/api/authentication/v1";
|
||||
|
||||
// BoundObjectReference is a reference to an object that a token is bound to.
|
||||
message BoundObjectReference {
|
||||
// Kind of the referent. Valid kinds are 'Pod' and 'Secret'.
|
||||
// kind of the referent. Valid kinds are 'Pod' and 'Secret'.
|
||||
// +optional
|
||||
optional string kind = 1;
|
||||
|
||||
// API version of the referent.
|
||||
// apiVersion is API version of the referent.
|
||||
// +optional
|
||||
optional string apiVersion = 2;
|
||||
|
||||
// Name of the referent.
|
||||
// name of the referent.
|
||||
// +optional
|
||||
optional string name = 3;
|
||||
|
||||
// UID of the referent.
|
||||
// uid of the referent.
|
||||
// +optional
|
||||
optional string uID = 4;
|
||||
}
|
||||
@@ -60,55 +60,58 @@ message ExtraValue {
|
||||
// When using impersonation, users will receive the user info of the user being impersonated. If impersonation or
|
||||
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
|
||||
message SelfSubjectReview {
|
||||
// Standard object's metadata.
|
||||
// metadata is standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Status is filled in by the server with the user attributes.
|
||||
// status is filled in by the server with the user attributes.
|
||||
// +optional
|
||||
optional SelfSubjectReviewStatus status = 2;
|
||||
}
|
||||
|
||||
// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
|
||||
message SelfSubjectReviewStatus {
|
||||
// User attributes of the user making this request.
|
||||
// userInfo is a set of attributes belonging to the user making this request.
|
||||
// +optional
|
||||
optional UserInfo userInfo = 1;
|
||||
}
|
||||
|
||||
// TokenRequest requests a token for a given service account.
|
||||
message TokenRequest {
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
// +optional
|
||||
optional TokenRequestSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates whether the token can be authenticated.
|
||||
// status is filled in by the server and indicates whether the token can be authenticated.
|
||||
// +optional
|
||||
optional TokenRequestStatus status = 3;
|
||||
}
|
||||
|
||||
// TokenRequestSpec contains client provided parameters of a token request.
|
||||
message TokenRequestSpec {
|
||||
// Audiences are the intendend audiences of the token. A recipient of a
|
||||
// audiences are the intendend audiences of the token. A recipient of a
|
||||
// token must identify themself with an identifier in the list of
|
||||
// audiences of the token, and otherwise should reject the token. A
|
||||
// token issued for multiple audiences may be used to authenticate
|
||||
// against any of the audiences listed but implies a high degree of
|
||||
// trust between the target audiences.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string audiences = 1;
|
||||
|
||||
// ExpirationSeconds is the requested duration of validity of the request. The
|
||||
// expirationSeconds is the requested duration of validity of the request. The
|
||||
// token issuer may return a token with a different validity duration so a
|
||||
// client needs to check the 'expiration' field in a response.
|
||||
// +optional
|
||||
optional int64 expirationSeconds = 4;
|
||||
|
||||
// BoundObjectRef is a reference to an object that the token will be bound to.
|
||||
// boundObjectRef is a reference to an object that the token will be bound to.
|
||||
// The token will only be valid for as long as the bound object exists.
|
||||
// NOTE: The API server's TokenReview endpoint will validate the
|
||||
// BoundObjectRef, but other audiences may not. Keep ExpirationSeconds
|
||||
@@ -119,10 +122,12 @@ message TokenRequestSpec {
|
||||
|
||||
// TokenRequestStatus is the result of a token request.
|
||||
message TokenRequestStatus {
|
||||
// Token is the opaque bearer token.
|
||||
// token is the opaque bearer token.
|
||||
// +optional
|
||||
optional string token = 1;
|
||||
|
||||
// ExpirationTimestamp is the time of expiration of the returned token.
|
||||
// expirationTimestamp is the time of expiration of the returned token.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time expirationTimestamp = 2;
|
||||
}
|
||||
|
||||
@@ -130,26 +135,27 @@ message TokenRequestStatus {
|
||||
// Note: TokenReview requests may be cached by the webhook token authenticator
|
||||
// plugin in the kube-apiserver.
|
||||
message TokenReview {
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
// +required
|
||||
optional TokenReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates whether the request can be authenticated.
|
||||
// status is filled in by the server and indicates whether the request can be authenticated.
|
||||
// +optional
|
||||
optional TokenReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// TokenReviewSpec is a description of the token authentication request.
|
||||
message TokenReviewSpec {
|
||||
// Token is the opaque bearer token.
|
||||
// +optional
|
||||
// token is the opaque bearer token.
|
||||
// +required
|
||||
optional string token = 1;
|
||||
|
||||
// Audiences is a list of the identifiers that the resource server presented
|
||||
// audiences is a list of the identifiers that the resource server presented
|
||||
// with the token identifies as. Audience-aware token authenticators will
|
||||
// verify that the token was intended for at least one of the audiences in
|
||||
// this list. If no audiences are provided, the audience will default to the
|
||||
@@ -161,15 +167,15 @@ message TokenReviewSpec {
|
||||
|
||||
// TokenReviewStatus is the result of the token authentication request.
|
||||
message TokenReviewStatus {
|
||||
// Authenticated indicates that the token was associated with a known user.
|
||||
// authenticated indicates that the token was associated with a known user.
|
||||
// +optional
|
||||
optional bool authenticated = 1;
|
||||
|
||||
// User is the UserInfo associated with the provided token.
|
||||
// user is the UserInfo associated with the provided token.
|
||||
// +optional
|
||||
optional UserInfo user = 2;
|
||||
|
||||
// Audiences are audience identifiers chosen by the authenticator that are
|
||||
// audiences are audience identifiers chosen by the authenticator that are
|
||||
// compatible with both the TokenReview and token. An identifier is any
|
||||
// identifier in the intersection of the TokenReviewSpec audiences and the
|
||||
// token's audiences. A client of the TokenReview API that sets the
|
||||
@@ -182,7 +188,7 @@ message TokenReviewStatus {
|
||||
// +listType=atomic
|
||||
repeated string audiences = 4;
|
||||
|
||||
// Error indicates that the token couldn't be checked
|
||||
// error indicates that the token couldn't be checked
|
||||
// +optional
|
||||
optional string error = 3;
|
||||
}
|
||||
@@ -190,22 +196,22 @@ message TokenReviewStatus {
|
||||
// UserInfo holds the information about the user needed to implement the
|
||||
// user.Info interface.
|
||||
message UserInfo {
|
||||
// The name that uniquely identifies this user among all active users.
|
||||
// username is the name that uniquely identifies this user among all active users.
|
||||
// +optional
|
||||
optional string username = 1;
|
||||
|
||||
// A unique value that identifies this user across time. If this user is
|
||||
// uid is a unique value that identifies this user across time. If this user is
|
||||
// deleted and another user by the same name is added, they will have
|
||||
// different UIDs.
|
||||
// +optional
|
||||
optional string uid = 2;
|
||||
|
||||
// The names of groups this user is a part of.
|
||||
// groups is the names of groups this user is a part of.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string groups = 3;
|
||||
|
||||
// Any additional information provided by the authenticator.
|
||||
// extra is any additional information provided by the authenticator.
|
||||
// +optional
|
||||
map<string, ExtraValue> extra = 4;
|
||||
}
|
||||
|
||||
-44
@@ -1,44 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
func (*BoundObjectReference) ProtoMessage() {}
|
||||
|
||||
func (*ExtraValue) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectReview) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectReviewStatus) ProtoMessage() {}
|
||||
|
||||
func (*TokenRequest) ProtoMessage() {}
|
||||
|
||||
func (*TokenRequestSpec) ProtoMessage() {}
|
||||
|
||||
func (*TokenRequestStatus) ProtoMessage() {}
|
||||
|
||||
func (*TokenReview) ProtoMessage() {}
|
||||
|
||||
func (*TokenReviewSpec) ProtoMessage() {}
|
||||
|
||||
func (*TokenReviewStatus) ProtoMessage() {}
|
||||
|
||||
func (*UserInfo) ProtoMessage() {}
|
||||
+35
-29
@@ -52,25 +52,26 @@ const (
|
||||
// plugin in the kube-apiserver.
|
||||
type TokenReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
// +required
|
||||
Spec TokenReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates whether the request can be authenticated.
|
||||
// status is filled in by the server and indicates whether the request can be authenticated.
|
||||
// +optional
|
||||
Status TokenReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// TokenReviewSpec is a description of the token authentication request.
|
||||
type TokenReviewSpec struct {
|
||||
// Token is the opaque bearer token.
|
||||
// +optional
|
||||
// token is the opaque bearer token.
|
||||
// +required
|
||||
Token string `json:"token,omitempty" protobuf:"bytes,1,opt,name=token"`
|
||||
// Audiences is a list of the identifiers that the resource server presented
|
||||
// audiences is a list of the identifiers that the resource server presented
|
||||
// with the token identifies as. Audience-aware token authenticators will
|
||||
// verify that the token was intended for at least one of the audiences in
|
||||
// this list. If no audiences are provided, the audience will default to the
|
||||
@@ -82,13 +83,13 @@ type TokenReviewSpec struct {
|
||||
|
||||
// TokenReviewStatus is the result of the token authentication request.
|
||||
type TokenReviewStatus struct {
|
||||
// Authenticated indicates that the token was associated with a known user.
|
||||
// authenticated indicates that the token was associated with a known user.
|
||||
// +optional
|
||||
Authenticated bool `json:"authenticated,omitempty" protobuf:"varint,1,opt,name=authenticated"`
|
||||
// User is the UserInfo associated with the provided token.
|
||||
// user is the UserInfo associated with the provided token.
|
||||
// +optional
|
||||
User UserInfo `json:"user,omitempty" protobuf:"bytes,2,opt,name=user"`
|
||||
// Audiences are audience identifiers chosen by the authenticator that are
|
||||
// audiences are audience identifiers chosen by the authenticator that are
|
||||
// compatible with both the TokenReview and token. An identifier is any
|
||||
// identifier in the intersection of the TokenReviewSpec audiences and the
|
||||
// token's audiences. A client of the TokenReview API that sets the
|
||||
@@ -100,7 +101,7 @@ type TokenReviewStatus struct {
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Audiences []string `json:"audiences,omitempty" protobuf:"bytes,4,rep,name=audiences"`
|
||||
// Error indicates that the token couldn't be checked
|
||||
// error indicates that the token couldn't be checked
|
||||
// +optional
|
||||
Error string `json:"error,omitempty" protobuf:"bytes,3,opt,name=error"`
|
||||
}
|
||||
@@ -108,19 +109,19 @@ type TokenReviewStatus struct {
|
||||
// UserInfo holds the information about the user needed to implement the
|
||||
// user.Info interface.
|
||||
type UserInfo struct {
|
||||
// The name that uniquely identifies this user among all active users.
|
||||
// username is the name that uniquely identifies this user among all active users.
|
||||
// +optional
|
||||
Username string `json:"username,omitempty" protobuf:"bytes,1,opt,name=username"`
|
||||
// A unique value that identifies this user across time. If this user is
|
||||
// uid is a unique value that identifies this user across time. If this user is
|
||||
// deleted and another user by the same name is added, they will have
|
||||
// different UIDs.
|
||||
// +optional
|
||||
UID string `json:"uid,omitempty" protobuf:"bytes,2,opt,name=uid"`
|
||||
// The names of groups this user is a part of.
|
||||
// groups is the names of groups this user is a part of.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Groups []string `json:"groups,omitempty" protobuf:"bytes,3,rep,name=groups"`
|
||||
// Any additional information provided by the authenticator.
|
||||
// extra is any additional information provided by the authenticator.
|
||||
// +optional
|
||||
Extra map[string]ExtraValue `json:"extra,omitempty" protobuf:"bytes,4,rep,name=extra"`
|
||||
}
|
||||
@@ -140,37 +141,39 @@ func (t ExtraValue) String() string {
|
||||
// TokenRequest requests a token for a given service account.
|
||||
type TokenRequest struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
// +optional
|
||||
Spec TokenRequestSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates whether the token can be authenticated.
|
||||
// status is filled in by the server and indicates whether the token can be authenticated.
|
||||
// +optional
|
||||
Status TokenRequestStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// TokenRequestSpec contains client provided parameters of a token request.
|
||||
type TokenRequestSpec struct {
|
||||
// Audiences are the intendend audiences of the token. A recipient of a
|
||||
// audiences are the intendend audiences of the token. A recipient of a
|
||||
// token must identify themself with an identifier in the list of
|
||||
// audiences of the token, and otherwise should reject the token. A
|
||||
// token issued for multiple audiences may be used to authenticate
|
||||
// against any of the audiences listed but implies a high degree of
|
||||
// trust between the target audiences.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Audiences []string `json:"audiences" protobuf:"bytes,1,rep,name=audiences"`
|
||||
|
||||
// ExpirationSeconds is the requested duration of validity of the request. The
|
||||
// expirationSeconds is the requested duration of validity of the request. The
|
||||
// token issuer may return a token with a different validity duration so a
|
||||
// client needs to check the 'expiration' field in a response.
|
||||
// +optional
|
||||
ExpirationSeconds *int64 `json:"expirationSeconds" protobuf:"varint,4,opt,name=expirationSeconds"`
|
||||
|
||||
// BoundObjectRef is a reference to an object that the token will be bound to.
|
||||
// boundObjectRef is a reference to an object that the token will be bound to.
|
||||
// The token will only be valid for as long as the bound object exists.
|
||||
// NOTE: The API server's TokenReview endpoint will validate the
|
||||
// BoundObjectRef, but other audiences may not. Keep ExpirationSeconds
|
||||
@@ -181,25 +184,27 @@ type TokenRequestSpec struct {
|
||||
|
||||
// TokenRequestStatus is the result of a token request.
|
||||
type TokenRequestStatus struct {
|
||||
// Token is the opaque bearer token.
|
||||
// token is the opaque bearer token.
|
||||
// +optional
|
||||
Token string `json:"token" protobuf:"bytes,1,opt,name=token"`
|
||||
// ExpirationTimestamp is the time of expiration of the returned token.
|
||||
// expirationTimestamp is the time of expiration of the returned token.
|
||||
// +optional
|
||||
ExpirationTimestamp metav1.Time `json:"expirationTimestamp" protobuf:"bytes,2,opt,name=expirationTimestamp"`
|
||||
}
|
||||
|
||||
// BoundObjectReference is a reference to an object that a token is bound to.
|
||||
type BoundObjectReference struct {
|
||||
// Kind of the referent. Valid kinds are 'Pod' and 'Secret'.
|
||||
// kind of the referent. Valid kinds are 'Pod' and 'Secret'.
|
||||
// +optional
|
||||
Kind string `json:"kind,omitempty" protobuf:"bytes,1,opt,name=kind"`
|
||||
// API version of the referent.
|
||||
// apiVersion is API version of the referent.
|
||||
// +optional
|
||||
APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,2,opt,name=apiVersion"`
|
||||
|
||||
// Name of the referent.
|
||||
// name of the referent.
|
||||
// +optional
|
||||
Name string `json:"name,omitempty" protobuf:"bytes,3,opt,name=name"`
|
||||
// UID of the referent.
|
||||
// uid of the referent.
|
||||
// +optional
|
||||
UID types.UID `json:"uid,omitempty" protobuf:"bytes,4,opt,name=uID,casttype=k8s.io/apimachinery/pkg/types.UID"`
|
||||
}
|
||||
@@ -215,17 +220,18 @@ type BoundObjectReference struct {
|
||||
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
|
||||
type SelfSubjectReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object's metadata.
|
||||
// metadata is standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Status is filled in by the server with the user attributes.
|
||||
// status is filled in by the server with the user attributes.
|
||||
// +optional
|
||||
Status SelfSubjectReviewStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
|
||||
}
|
||||
|
||||
// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
|
||||
type SelfSubjectReviewStatus struct {
|
||||
// User attributes of the user making this request.
|
||||
// userInfo is a set of attributes belonging to the user making this request.
|
||||
// +optional
|
||||
UserInfo UserInfo `json:"userInfo,omitempty" protobuf:"bytes,1,opt,name=userInfo"`
|
||||
}
|
||||
|
||||
+28
-28
@@ -29,10 +29,10 @@ package v1
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_BoundObjectReference = map[string]string{
|
||||
"": "BoundObjectReference is a reference to an object that a token is bound to.",
|
||||
"kind": "Kind of the referent. Valid kinds are 'Pod' and 'Secret'.",
|
||||
"apiVersion": "API version of the referent.",
|
||||
"name": "Name of the referent.",
|
||||
"uid": "UID of the referent.",
|
||||
"kind": "kind of the referent. Valid kinds are 'Pod' and 'Secret'.",
|
||||
"apiVersion": "apiVersion is API version of the referent.",
|
||||
"name": "name of the referent.",
|
||||
"uid": "uid of the referent.",
|
||||
}
|
||||
|
||||
func (BoundObjectReference) SwaggerDoc() map[string]string {
|
||||
@@ -41,8 +41,8 @@ func (BoundObjectReference) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectReview = map[string]string{
|
||||
"": "SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.",
|
||||
"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"status": "Status is filled in by the server with the user attributes.",
|
||||
"metadata": "metadata is standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"status": "status is filled in by the server with the user attributes.",
|
||||
}
|
||||
|
||||
func (SelfSubjectReview) SwaggerDoc() map[string]string {
|
||||
@@ -51,7 +51,7 @@ func (SelfSubjectReview) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectReviewStatus = map[string]string{
|
||||
"": "SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.",
|
||||
"userInfo": "User attributes of the user making this request.",
|
||||
"userInfo": "userInfo is a set of attributes belonging to the user making this request.",
|
||||
}
|
||||
|
||||
func (SelfSubjectReviewStatus) SwaggerDoc() map[string]string {
|
||||
@@ -60,9 +60,9 @@ func (SelfSubjectReviewStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TokenRequest = map[string]string{
|
||||
"": "TokenRequest requests a token for a given service account.",
|
||||
"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated",
|
||||
"status": "Status is filled in by the server and indicates whether the token can be authenticated.",
|
||||
"metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated",
|
||||
"status": "status is filled in by the server and indicates whether the token can be authenticated.",
|
||||
}
|
||||
|
||||
func (TokenRequest) SwaggerDoc() map[string]string {
|
||||
@@ -71,9 +71,9 @@ func (TokenRequest) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TokenRequestSpec = map[string]string{
|
||||
"": "TokenRequestSpec contains client provided parameters of a token request.",
|
||||
"audiences": "Audiences are the intendend audiences of the token. A recipient of a token must identify themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.",
|
||||
"expirationSeconds": "ExpirationSeconds is the requested duration of validity of the request. The token issuer may return a token with a different validity duration so a client needs to check the 'expiration' field in a response.",
|
||||
"boundObjectRef": "BoundObjectRef is a reference to an object that the token will be bound to. The token will only be valid for as long as the bound object exists. NOTE: The API server's TokenReview endpoint will validate the BoundObjectRef, but other audiences may not. Keep ExpirationSeconds small if you want prompt revocation.",
|
||||
"audiences": "audiences are the intendend audiences of the token. A recipient of a token must identify themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.",
|
||||
"expirationSeconds": "expirationSeconds is the requested duration of validity of the request. The token issuer may return a token with a different validity duration so a client needs to check the 'expiration' field in a response.",
|
||||
"boundObjectRef": "boundObjectRef is a reference to an object that the token will be bound to. The token will only be valid for as long as the bound object exists. NOTE: The API server's TokenReview endpoint will validate the BoundObjectRef, but other audiences may not. Keep ExpirationSeconds small if you want prompt revocation.",
|
||||
}
|
||||
|
||||
func (TokenRequestSpec) SwaggerDoc() map[string]string {
|
||||
@@ -82,8 +82,8 @@ func (TokenRequestSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TokenRequestStatus = map[string]string{
|
||||
"": "TokenRequestStatus is the result of a token request.",
|
||||
"token": "Token is the opaque bearer token.",
|
||||
"expirationTimestamp": "ExpirationTimestamp is the time of expiration of the returned token.",
|
||||
"token": "token is the opaque bearer token.",
|
||||
"expirationTimestamp": "expirationTimestamp is the time of expiration of the returned token.",
|
||||
}
|
||||
|
||||
func (TokenRequestStatus) SwaggerDoc() map[string]string {
|
||||
@@ -92,9 +92,9 @@ func (TokenRequestStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TokenReview = map[string]string{
|
||||
"": "TokenReview attempts to authenticate a token to a known user. Note: TokenReview requests may be cached by the webhook token authenticator plugin in the kube-apiserver.",
|
||||
"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated",
|
||||
"status": "Status is filled in by the server and indicates whether the request can be authenticated.",
|
||||
"metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated",
|
||||
"status": "status is filled in by the server and indicates whether the request can be authenticated.",
|
||||
}
|
||||
|
||||
func (TokenReview) SwaggerDoc() map[string]string {
|
||||
@@ -103,8 +103,8 @@ func (TokenReview) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TokenReviewSpec = map[string]string{
|
||||
"": "TokenReviewSpec is a description of the token authentication request.",
|
||||
"token": "Token is the opaque bearer token.",
|
||||
"audiences": "Audiences is a list of the identifiers that the resource server presented with the token identifies as. Audience-aware token authenticators will verify that the token was intended for at least one of the audiences in this list. If no audiences are provided, the audience will default to the audience of the Kubernetes apiserver.",
|
||||
"token": "token is the opaque bearer token.",
|
||||
"audiences": "audiences is a list of the identifiers that the resource server presented with the token identifies as. Audience-aware token authenticators will verify that the token was intended for at least one of the audiences in this list. If no audiences are provided, the audience will default to the audience of the Kubernetes apiserver.",
|
||||
}
|
||||
|
||||
func (TokenReviewSpec) SwaggerDoc() map[string]string {
|
||||
@@ -113,10 +113,10 @@ func (TokenReviewSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TokenReviewStatus = map[string]string{
|
||||
"": "TokenReviewStatus is the result of the token authentication request.",
|
||||
"authenticated": "Authenticated indicates that the token was associated with a known user.",
|
||||
"user": "User is the UserInfo associated with the provided token.",
|
||||
"audiences": "Audiences are audience identifiers chosen by the authenticator that are compatible with both the TokenReview and token. An identifier is any identifier in the intersection of the TokenReviewSpec audiences and the token's audiences. A client of the TokenReview API that sets the spec.audiences field should validate that a compatible audience identifier is returned in the status.audiences field to ensure that the TokenReview server is audience aware. If a TokenReview returns an empty status.audience field where status.authenticated is \"true\", the token is valid against the audience of the Kubernetes API server.",
|
||||
"error": "Error indicates that the token couldn't be checked",
|
||||
"authenticated": "authenticated indicates that the token was associated with a known user.",
|
||||
"user": "user is the UserInfo associated with the provided token.",
|
||||
"audiences": "audiences are audience identifiers chosen by the authenticator that are compatible with both the TokenReview and token. An identifier is any identifier in the intersection of the TokenReviewSpec audiences and the token's audiences. A client of the TokenReview API that sets the spec.audiences field should validate that a compatible audience identifier is returned in the status.audiences field to ensure that the TokenReview server is audience aware. If a TokenReview returns an empty status.audience field where status.authenticated is \"true\", the token is valid against the audience of the Kubernetes API server.",
|
||||
"error": "error indicates that the token couldn't be checked",
|
||||
}
|
||||
|
||||
func (TokenReviewStatus) SwaggerDoc() map[string]string {
|
||||
@@ -125,10 +125,10 @@ func (TokenReviewStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_UserInfo = map[string]string{
|
||||
"": "UserInfo holds the information about the user needed to implement the user.Info interface.",
|
||||
"username": "The name that uniquely identifies this user among all active users.",
|
||||
"uid": "A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.",
|
||||
"groups": "The names of groups this user is a part of.",
|
||||
"extra": "Any additional information provided by the authenticator.",
|
||||
"username": "username is the name that uniquely identifies this user among all active users.",
|
||||
"uid": "uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.",
|
||||
"groups": "groups is the names of groups this user is a part of.",
|
||||
"extra": "extra is any additional information provided by the authenticator.",
|
||||
}
|
||||
|
||||
func (UserInfo) SwaggerDoc() map[string]string {
|
||||
|
||||
+4
-3
@@ -33,18 +33,19 @@ option go_package = "k8s.io/api/authentication/v1alpha1";
|
||||
// When using impersonation, users will receive the user info of the user being impersonated. If impersonation or
|
||||
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
|
||||
message SelfSubjectReview {
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Status is filled in by the server with the user attributes.
|
||||
// status is filled in by the server with the user attributes.
|
||||
// +optional
|
||||
optional SelfSubjectReviewStatus status = 2;
|
||||
}
|
||||
|
||||
// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
|
||||
message SelfSubjectReviewStatus {
|
||||
// User attributes of the user making this request.
|
||||
// userInfo is a set of attributes belonging to the user making this request.
|
||||
// +optional
|
||||
optional .k8s.io.api.authentication.v1.UserInfo userInfo = 1;
|
||||
}
|
||||
|
||||
-26
@@ -1,26 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
func (*SelfSubjectReview) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectReviewStatus) ProtoMessage() {}
|
||||
+4
-3
@@ -32,17 +32,18 @@ import (
|
||||
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
|
||||
type SelfSubjectReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Status is filled in by the server with the user attributes.
|
||||
// status is filled in by the server with the user attributes.
|
||||
// +optional
|
||||
Status SelfSubjectReviewStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
|
||||
}
|
||||
|
||||
// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
|
||||
type SelfSubjectReviewStatus struct {
|
||||
// User attributes of the user making this request.
|
||||
// userInfo is a set of attributes belonging to the user making this request.
|
||||
// +optional
|
||||
UserInfo v1.UserInfo `json:"userInfo,omitempty" protobuf:"bytes,1,opt,name=userInfo"`
|
||||
}
|
||||
|
||||
+3
-3
@@ -29,8 +29,8 @@ package v1alpha1
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_SelfSubjectReview = map[string]string{
|
||||
"": "SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.",
|
||||
"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"status": "Status is filled in by the server with the user attributes.",
|
||||
"metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"status": "status is filled in by the server with the user attributes.",
|
||||
}
|
||||
|
||||
func (SelfSubjectReview) SwaggerDoc() map[string]string {
|
||||
@@ -39,7 +39,7 @@ func (SelfSubjectReview) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectReviewStatus = map[string]string{
|
||||
"": "SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.",
|
||||
"userInfo": "User attributes of the user making this request.",
|
||||
"userInfo": "userInfo is a set of attributes belonging to the user making this request.",
|
||||
}
|
||||
|
||||
func (SelfSubjectReviewStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
+19
-17
@@ -42,18 +42,19 @@ message ExtraValue {
|
||||
// When using impersonation, users will receive the user info of the user being impersonated. If impersonation or
|
||||
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
|
||||
message SelfSubjectReview {
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Status is filled in by the server with the user attributes.
|
||||
// status is filled in by the server with the user attributes.
|
||||
// +optional
|
||||
optional SelfSubjectReviewStatus status = 2;
|
||||
}
|
||||
|
||||
// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
|
||||
message SelfSubjectReviewStatus {
|
||||
// User attributes of the user making this request.
|
||||
// userInfo is a set of attributes belonging to the user making this request.
|
||||
// +optional
|
||||
optional .k8s.io.api.authentication.v1.UserInfo userInfo = 1;
|
||||
}
|
||||
@@ -62,26 +63,27 @@ message SelfSubjectReviewStatus {
|
||||
// Note: TokenReview requests may be cached by the webhook token authenticator
|
||||
// plugin in the kube-apiserver.
|
||||
message TokenReview {
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
// +required
|
||||
optional TokenReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates whether the token can be authenticated.
|
||||
// status is filled in by the server and indicates whether the token can be authenticated.
|
||||
// +optional
|
||||
optional TokenReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// TokenReviewSpec is a description of the token authentication request.
|
||||
message TokenReviewSpec {
|
||||
// Token is the opaque bearer token.
|
||||
// +optional
|
||||
// token is the opaque bearer token.
|
||||
// +required
|
||||
optional string token = 1;
|
||||
|
||||
// Audiences is a list of the identifiers that the resource server presented
|
||||
// audiences is a list of the identifiers that the resource server presented
|
||||
// with the token identifies as. Audience-aware token authenticators will
|
||||
// verify that the token was intended for at least one of the audiences in
|
||||
// this list. If no audiences are provided, the audience will default to the
|
||||
@@ -93,15 +95,15 @@ message TokenReviewSpec {
|
||||
|
||||
// TokenReviewStatus is the result of the token authentication request.
|
||||
message TokenReviewStatus {
|
||||
// Authenticated indicates that the token was associated with a known user.
|
||||
// authenticated indicates that the token was associated with a known user.
|
||||
// +optional
|
||||
optional bool authenticated = 1;
|
||||
|
||||
// User is the UserInfo associated with the provided token.
|
||||
// user is the UserInfo associated with the provided token.
|
||||
// +optional
|
||||
optional UserInfo user = 2;
|
||||
|
||||
// Audiences are audience identifiers chosen by the authenticator that are
|
||||
// audiences are audience identifiers chosen by the authenticator that are
|
||||
// compatible with both the TokenReview and token. An identifier is any
|
||||
// identifier in the intersection of the TokenReviewSpec audiences and the
|
||||
// token's audiences. A client of the TokenReview API that sets the
|
||||
@@ -114,7 +116,7 @@ message TokenReviewStatus {
|
||||
// +listType=atomic
|
||||
repeated string audiences = 4;
|
||||
|
||||
// Error indicates that the token couldn't be checked
|
||||
// error indicates that the token couldn't be checked
|
||||
// +optional
|
||||
optional string error = 3;
|
||||
}
|
||||
@@ -122,22 +124,22 @@ message TokenReviewStatus {
|
||||
// UserInfo holds the information about the user needed to implement the
|
||||
// user.Info interface.
|
||||
message UserInfo {
|
||||
// The name that uniquely identifies this user among all active users.
|
||||
// username is the name that uniquely identifies this user among all active users.
|
||||
// +optional
|
||||
optional string username = 1;
|
||||
|
||||
// A unique value that identifies this user across time. If this user is
|
||||
// uid is a unique value that identifies this user across time. If this user is
|
||||
// deleted and another user by the same name is added, they will have
|
||||
// different UIDs.
|
||||
// +optional
|
||||
optional string uid = 2;
|
||||
|
||||
// The names of groups this user is a part of.
|
||||
// groups is the names of groups this user is a part of.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string groups = 3;
|
||||
|
||||
// Any additional information provided by the authenticator.
|
||||
// extra is any additional information provided by the authenticator.
|
||||
// +optional
|
||||
map<string, ExtraValue> extra = 4;
|
||||
}
|
||||
|
||||
-36
@@ -1,36 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
func (*ExtraValue) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectReview) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectReviewStatus) ProtoMessage() {}
|
||||
|
||||
func (*TokenReview) ProtoMessage() {}
|
||||
|
||||
func (*TokenReviewSpec) ProtoMessage() {}
|
||||
|
||||
func (*TokenReviewStatus) ProtoMessage() {}
|
||||
|
||||
func (*UserInfo) ProtoMessage() {}
|
||||
+19
-17
@@ -36,25 +36,26 @@ import (
|
||||
// plugin in the kube-apiserver.
|
||||
type TokenReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
// +required
|
||||
Spec TokenReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates whether the token can be authenticated.
|
||||
// status is filled in by the server and indicates whether the token can be authenticated.
|
||||
// +optional
|
||||
Status TokenReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// TokenReviewSpec is a description of the token authentication request.
|
||||
type TokenReviewSpec struct {
|
||||
// Token is the opaque bearer token.
|
||||
// +optional
|
||||
// token is the opaque bearer token.
|
||||
// +required
|
||||
Token string `json:"token,omitempty" protobuf:"bytes,1,opt,name=token"`
|
||||
// Audiences is a list of the identifiers that the resource server presented
|
||||
// audiences is a list of the identifiers that the resource server presented
|
||||
// with the token identifies as. Audience-aware token authenticators will
|
||||
// verify that the token was intended for at least one of the audiences in
|
||||
// this list. If no audiences are provided, the audience will default to the
|
||||
@@ -66,13 +67,13 @@ type TokenReviewSpec struct {
|
||||
|
||||
// TokenReviewStatus is the result of the token authentication request.
|
||||
type TokenReviewStatus struct {
|
||||
// Authenticated indicates that the token was associated with a known user.
|
||||
// authenticated indicates that the token was associated with a known user.
|
||||
// +optional
|
||||
Authenticated bool `json:"authenticated,omitempty" protobuf:"varint,1,opt,name=authenticated"`
|
||||
// User is the UserInfo associated with the provided token.
|
||||
// user is the UserInfo associated with the provided token.
|
||||
// +optional
|
||||
User UserInfo `json:"user,omitempty" protobuf:"bytes,2,opt,name=user"`
|
||||
// Audiences are audience identifiers chosen by the authenticator that are
|
||||
// audiences are audience identifiers chosen by the authenticator that are
|
||||
// compatible with both the TokenReview and token. An identifier is any
|
||||
// identifier in the intersection of the TokenReviewSpec audiences and the
|
||||
// token's audiences. A client of the TokenReview API that sets the
|
||||
@@ -84,7 +85,7 @@ type TokenReviewStatus struct {
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Audiences []string `json:"audiences,omitempty" protobuf:"bytes,4,rep,name=audiences"`
|
||||
// Error indicates that the token couldn't be checked
|
||||
// error indicates that the token couldn't be checked
|
||||
// +optional
|
||||
Error string `json:"error,omitempty" protobuf:"bytes,3,opt,name=error"`
|
||||
}
|
||||
@@ -92,19 +93,19 @@ type TokenReviewStatus struct {
|
||||
// UserInfo holds the information about the user needed to implement the
|
||||
// user.Info interface.
|
||||
type UserInfo struct {
|
||||
// The name that uniquely identifies this user among all active users.
|
||||
// username is the name that uniquely identifies this user among all active users.
|
||||
// +optional
|
||||
Username string `json:"username,omitempty" protobuf:"bytes,1,opt,name=username"`
|
||||
// A unique value that identifies this user across time. If this user is
|
||||
// uid is a unique value that identifies this user across time. If this user is
|
||||
// deleted and another user by the same name is added, they will have
|
||||
// different UIDs.
|
||||
// +optional
|
||||
UID string `json:"uid,omitempty" protobuf:"bytes,2,opt,name=uid"`
|
||||
// The names of groups this user is a part of.
|
||||
// groups is the names of groups this user is a part of.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Groups []string `json:"groups,omitempty" protobuf:"bytes,3,rep,name=groups"`
|
||||
// Any additional information provided by the authenticator.
|
||||
// extra is any additional information provided by the authenticator.
|
||||
// +optional
|
||||
Extra map[string]ExtraValue `json:"extra,omitempty" protobuf:"bytes,4,rep,name=extra"`
|
||||
}
|
||||
@@ -129,17 +130,18 @@ func (t ExtraValue) String() string {
|
||||
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
|
||||
type SelfSubjectReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard object's metadata.
|
||||
// metadata is the standard object's metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
// Status is filled in by the server with the user attributes.
|
||||
// status is filled in by the server with the user attributes.
|
||||
// +optional
|
||||
Status SelfSubjectReviewStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
|
||||
}
|
||||
|
||||
// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
|
||||
type SelfSubjectReviewStatus struct {
|
||||
// User attributes of the user making this request.
|
||||
// userInfo is a set of attributes belonging to the user making this request.
|
||||
// +optional
|
||||
UserInfo v1.UserInfo `json:"userInfo,omitempty" protobuf:"bytes,1,opt,name=userInfo"`
|
||||
}
|
||||
|
||||
+16
-16
@@ -29,8 +29,8 @@ package v1beta1
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_SelfSubjectReview = map[string]string{
|
||||
"": "SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.",
|
||||
"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"status": "Status is filled in by the server with the user attributes.",
|
||||
"metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"status": "status is filled in by the server with the user attributes.",
|
||||
}
|
||||
|
||||
func (SelfSubjectReview) SwaggerDoc() map[string]string {
|
||||
@@ -39,7 +39,7 @@ func (SelfSubjectReview) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectReviewStatus = map[string]string{
|
||||
"": "SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.",
|
||||
"userInfo": "User attributes of the user making this request.",
|
||||
"userInfo": "userInfo is a set of attributes belonging to the user making this request.",
|
||||
}
|
||||
|
||||
func (SelfSubjectReviewStatus) SwaggerDoc() map[string]string {
|
||||
@@ -48,9 +48,9 @@ func (SelfSubjectReviewStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TokenReview = map[string]string{
|
||||
"": "TokenReview attempts to authenticate a token to a known user. Note: TokenReview requests may be cached by the webhook token authenticator plugin in the kube-apiserver.",
|
||||
"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated",
|
||||
"status": "Status is filled in by the server and indicates whether the token can be authenticated.",
|
||||
"metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated",
|
||||
"status": "status is filled in by the server and indicates whether the token can be authenticated.",
|
||||
}
|
||||
|
||||
func (TokenReview) SwaggerDoc() map[string]string {
|
||||
@@ -59,8 +59,8 @@ func (TokenReview) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TokenReviewSpec = map[string]string{
|
||||
"": "TokenReviewSpec is a description of the token authentication request.",
|
||||
"token": "Token is the opaque bearer token.",
|
||||
"audiences": "Audiences is a list of the identifiers that the resource server presented with the token identifies as. Audience-aware token authenticators will verify that the token was intended for at least one of the audiences in this list. If no audiences are provided, the audience will default to the audience of the Kubernetes apiserver.",
|
||||
"token": "token is the opaque bearer token.",
|
||||
"audiences": "audiences is a list of the identifiers that the resource server presented with the token identifies as. Audience-aware token authenticators will verify that the token was intended for at least one of the audiences in this list. If no audiences are provided, the audience will default to the audience of the Kubernetes apiserver.",
|
||||
}
|
||||
|
||||
func (TokenReviewSpec) SwaggerDoc() map[string]string {
|
||||
@@ -69,10 +69,10 @@ func (TokenReviewSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_TokenReviewStatus = map[string]string{
|
||||
"": "TokenReviewStatus is the result of the token authentication request.",
|
||||
"authenticated": "Authenticated indicates that the token was associated with a known user.",
|
||||
"user": "User is the UserInfo associated with the provided token.",
|
||||
"audiences": "Audiences are audience identifiers chosen by the authenticator that are compatible with both the TokenReview and token. An identifier is any identifier in the intersection of the TokenReviewSpec audiences and the token's audiences. A client of the TokenReview API that sets the spec.audiences field should validate that a compatible audience identifier is returned in the status.audiences field to ensure that the TokenReview server is audience aware. If a TokenReview returns an empty status.audience field where status.authenticated is \"true\", the token is valid against the audience of the Kubernetes API server.",
|
||||
"error": "Error indicates that the token couldn't be checked",
|
||||
"authenticated": "authenticated indicates that the token was associated with a known user.",
|
||||
"user": "user is the UserInfo associated with the provided token.",
|
||||
"audiences": "audiences are audience identifiers chosen by the authenticator that are compatible with both the TokenReview and token. An identifier is any identifier in the intersection of the TokenReviewSpec audiences and the token's audiences. A client of the TokenReview API that sets the spec.audiences field should validate that a compatible audience identifier is returned in the status.audiences field to ensure that the TokenReview server is audience aware. If a TokenReview returns an empty status.audience field where status.authenticated is \"true\", the token is valid against the audience of the Kubernetes API server.",
|
||||
"error": "error indicates that the token couldn't be checked",
|
||||
}
|
||||
|
||||
func (TokenReviewStatus) SwaggerDoc() map[string]string {
|
||||
@@ -81,10 +81,10 @@ func (TokenReviewStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_UserInfo = map[string]string{
|
||||
"": "UserInfo holds the information about the user needed to implement the user.Info interface.",
|
||||
"username": "The name that uniquely identifies this user among all active users.",
|
||||
"uid": "A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.",
|
||||
"groups": "The names of groups this user is a part of.",
|
||||
"extra": "Any additional information provided by the authenticator.",
|
||||
"username": "username is the name that uniquely identifies this user among all active users.",
|
||||
"uid": "uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.",
|
||||
"groups": "groups is the names of groups this user is a part of.",
|
||||
"extra": "extra is any additional information provided by the authenticator.",
|
||||
}
|
||||
|
||||
func (UserInfo) SwaggerDoc() map[string]string {
|
||||
|
||||
+48
-48
@@ -95,38 +95,38 @@ message LabelSelectorAttributes {
|
||||
// Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
|
||||
// checking.
|
||||
message LocalSubjectAccessReview {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated. spec.namespace must be equal to the namespace
|
||||
// spec holds information about the request being evaluated. spec.namespace must be equal to the namespace
|
||||
// you made the request against. If empty, it is defaulted.
|
||||
optional SubjectAccessReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
optional SubjectAccessReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
|
||||
message NonResourceAttributes {
|
||||
// Path is the URL path of the request
|
||||
// path is the URL path of the request
|
||||
// +optional
|
||||
optional string path = 1;
|
||||
|
||||
// Verb is the standard HTTP verb
|
||||
// verb is the standard HTTP verb
|
||||
// +optional
|
||||
optional string verb = 2;
|
||||
}
|
||||
|
||||
// NonResourceRule holds information that describes a rule for the non-resource
|
||||
message NonResourceRule {
|
||||
// Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all.
|
||||
// verbs is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all.
|
||||
// +listType=atomic
|
||||
repeated string verbs = 1;
|
||||
|
||||
// NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full,
|
||||
// nonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full,
|
||||
// final step in the path. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
@@ -135,34 +135,34 @@ message NonResourceRule {
|
||||
|
||||
// ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
|
||||
message ResourceAttributes {
|
||||
// Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
|
||||
// namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
|
||||
// "" (empty) is defaulted for LocalSubjectAccessReviews
|
||||
// "" (empty) is empty for cluster-scoped resources
|
||||
// "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
|
||||
// +optional
|
||||
optional string namespace = 1;
|
||||
|
||||
// Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// +optional
|
||||
optional string verb = 2;
|
||||
|
||||
// Group is the API Group of the Resource. "*" means all.
|
||||
// group is the API Group of the Resource. "*" means all.
|
||||
// +optional
|
||||
optional string group = 3;
|
||||
|
||||
// Version is the API Version of the Resource. "*" means all.
|
||||
// version is the API Version of the Resource. "*" means all.
|
||||
// +optional
|
||||
optional string version = 4;
|
||||
|
||||
// Resource is one of the existing resource types. "*" means all.
|
||||
// resource is one of the existing resource types. "*" means all.
|
||||
// +optional
|
||||
optional string resource = 5;
|
||||
|
||||
// Subresource is one of the existing resource types. "" means none.
|
||||
// subresource is one of the existing resource types. "" means none.
|
||||
// +optional
|
||||
optional string subresource = 6;
|
||||
|
||||
// Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
|
||||
// name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
|
||||
// +optional
|
||||
optional string name = 7;
|
||||
|
||||
@@ -178,23 +178,23 @@ message ResourceAttributes {
|
||||
// ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant,
|
||||
// may contain duplicates, and possibly be incomplete.
|
||||
message ResourceRule {
|
||||
// Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// verbs is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// +listType=atomic
|
||||
repeated string verbs = 1;
|
||||
|
||||
// APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
// apiGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
// the enumerated resources in any API group will be allowed. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string apiGroups = 2;
|
||||
|
||||
// Resources is a list of resources this rule applies to. "*" means all in the specified apiGroups.
|
||||
// resources is a list of resources this rule applies to. "*" means all in the specified apiGroups.
|
||||
// "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string resources = 3;
|
||||
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string resourceNames = 4;
|
||||
@@ -204,27 +204,27 @@ message ResourceRule {
|
||||
// spec.namespace means "in all namespaces". Self is a special case, because users should always be able
|
||||
// to check whether they can perform an action
|
||||
message SelfSubjectAccessReview {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated. user and groups must be empty
|
||||
// spec holds information about the request being evaluated. user and groups must be empty
|
||||
optional SelfSubjectAccessReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
optional SubjectAccessReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes
|
||||
// and NonResourceAuthorizationAttributes must be set
|
||||
// SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes
|
||||
// and nonResourceAttributes must be set
|
||||
message SelfSubjectAccessReviewSpec {
|
||||
// ResourceAuthorizationAttributes describes information for a resource access request
|
||||
// resourceAttributes describes information for a resource access request
|
||||
// +optional
|
||||
optional ResourceAttributes resourceAttributes = 1;
|
||||
|
||||
// NonResourceAttributes describes information for a non-resource access request
|
||||
// nonResourceAttributes describes information for a non-resource access request
|
||||
// +optional
|
||||
optional NonResourceAttributes nonResourceAttributes = 2;
|
||||
}
|
||||
@@ -236,88 +236,88 @@ message SelfSubjectAccessReviewSpec {
|
||||
// drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns.
|
||||
// SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
|
||||
message SelfSubjectRulesReview {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated.
|
||||
// spec holds information about the request being evaluated.
|
||||
optional SelfSubjectRulesReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates the set of actions a user can perform.
|
||||
// status is filled in by the server and indicates the set of actions a user can perform.
|
||||
// +optional
|
||||
optional SubjectRulesReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.
|
||||
message SelfSubjectRulesReviewSpec {
|
||||
// Namespace to evaluate rules for. Required.
|
||||
// namespace to evaluate rules for. Required.
|
||||
optional string namespace = 1;
|
||||
}
|
||||
|
||||
// SubjectAccessReview checks whether or not a user or group can perform an action.
|
||||
message SubjectAccessReview {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
optional SubjectAccessReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
optional SubjectAccessReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes
|
||||
// and NonResourceAuthorizationAttributes must be set
|
||||
// SubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes
|
||||
// and nonResourceAttributes must be set
|
||||
message SubjectAccessReviewSpec {
|
||||
// ResourceAuthorizationAttributes describes information for a resource access request
|
||||
// resourceAttributes describes information for a resource access request
|
||||
// +optional
|
||||
optional ResourceAttributes resourceAttributes = 1;
|
||||
|
||||
// NonResourceAttributes describes information for a non-resource access request
|
||||
// nonResourceAttributes describes information for a non-resource access request
|
||||
// +optional
|
||||
optional NonResourceAttributes nonResourceAttributes = 2;
|
||||
|
||||
// User is the user you're testing for.
|
||||
// user is the user you're testing for.
|
||||
// If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups
|
||||
// +optional
|
||||
optional string user = 3;
|
||||
|
||||
// Groups is the groups you're testing for.
|
||||
// groups is the groups you're testing for.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string groups = 4;
|
||||
|
||||
// Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer
|
||||
// extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer
|
||||
// it needs a reflection here.
|
||||
// +optional
|
||||
map<string, ExtraValue> extra = 5;
|
||||
|
||||
// UID information about the requesting user.
|
||||
// uid information about the requesting user.
|
||||
// +optional
|
||||
optional string uid = 6;
|
||||
}
|
||||
|
||||
// SubjectAccessReviewStatus
|
||||
message SubjectAccessReviewStatus {
|
||||
// Allowed is required. True if the action would be allowed, false otherwise.
|
||||
// allowed is required. True if the action would be allowed, false otherwise.
|
||||
optional bool allowed = 1;
|
||||
|
||||
// Denied is optional. True if the action would be denied, otherwise
|
||||
// denied is optional. True if the action would be denied, otherwise
|
||||
// false. If both allowed is false and denied is false, then the
|
||||
// authorizer has no opinion on whether to authorize the action. Denied
|
||||
// may not be true if Allowed is true.
|
||||
// +optional
|
||||
optional bool denied = 4;
|
||||
|
||||
// Reason is optional. It indicates why a request was allowed or denied.
|
||||
// reason is optional. It indicates why a request was allowed or denied.
|
||||
// +optional
|
||||
optional string reason = 2;
|
||||
|
||||
// EvaluationError is an indication that some error occurred during the authorization check.
|
||||
// evaluationError is an indication that some error occurred during the authorization check.
|
||||
// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
|
||||
// For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
|
||||
// +optional
|
||||
@@ -329,21 +329,21 @@ message SubjectAccessReviewStatus {
|
||||
// Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission,
|
||||
// even if that list is incomplete.
|
||||
message SubjectRulesReviewStatus {
|
||||
// ResourceRules is the list of actions the subject is allowed to perform on resources.
|
||||
// resourceRules is the list of actions the subject is allowed to perform on resources.
|
||||
// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
|
||||
// +listType=atomic
|
||||
repeated ResourceRule resourceRules = 1;
|
||||
|
||||
// NonResourceRules is the list of actions the subject is allowed to perform on non-resources.
|
||||
// nonResourceRules is the list of actions the subject is allowed to perform on non-resources.
|
||||
// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
|
||||
// +listType=atomic
|
||||
repeated NonResourceRule nonResourceRules = 2;
|
||||
|
||||
// Incomplete is true when the rules returned by this call are incomplete. This is most commonly
|
||||
// incomplete is true when the rules returned by this call are incomplete. This is most commonly
|
||||
// encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.
|
||||
optional bool incomplete = 3;
|
||||
|
||||
// EvaluationError can appear in combination with Rules. It indicates an error occurred during
|
||||
// evaluationError can appear in combination with Rules. It indicates an error occurred during
|
||||
// rule evaluation, such as an authorizer that doesn't support rule evaluation, and that
|
||||
// ResourceRules and/or NonResourceRules may be incomplete.
|
||||
// +optional
|
||||
|
||||
-54
@@ -1,54 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
func (*ExtraValue) ProtoMessage() {}
|
||||
|
||||
func (*FieldSelectorAttributes) ProtoMessage() {}
|
||||
|
||||
func (*LabelSelectorAttributes) ProtoMessage() {}
|
||||
|
||||
func (*LocalSubjectAccessReview) ProtoMessage() {}
|
||||
|
||||
func (*NonResourceAttributes) ProtoMessage() {}
|
||||
|
||||
func (*NonResourceRule) ProtoMessage() {}
|
||||
|
||||
func (*ResourceAttributes) ProtoMessage() {}
|
||||
|
||||
func (*ResourceRule) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectAccessReview) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectAccessReviewSpec) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectRulesReview) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectRulesReviewSpec) ProtoMessage() {}
|
||||
|
||||
func (*SubjectAccessReview) ProtoMessage() {}
|
||||
|
||||
func (*SubjectAccessReviewSpec) ProtoMessage() {}
|
||||
|
||||
func (*SubjectAccessReviewStatus) ProtoMessage() {}
|
||||
|
||||
func (*SubjectRulesReviewStatus) ProtoMessage() {}
|
||||
+48
-48
@@ -31,15 +31,15 @@ import (
|
||||
// SubjectAccessReview checks whether or not a user or group can perform an action.
|
||||
type SubjectAccessReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
Spec SubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
@@ -55,15 +55,15 @@ type SubjectAccessReview struct {
|
||||
// to check whether they can perform an action
|
||||
type SelfSubjectAccessReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated. user and groups must be empty
|
||||
// spec holds information about the request being evaluated. user and groups must be empty
|
||||
Spec SelfSubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
@@ -78,44 +78,44 @@ type SelfSubjectAccessReview struct {
|
||||
// checking.
|
||||
type LocalSubjectAccessReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated. spec.namespace must be equal to the namespace
|
||||
// spec holds information about the request being evaluated. spec.namespace must be equal to the namespace
|
||||
// you made the request against. If empty, it is defaulted.
|
||||
Spec SubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
|
||||
type ResourceAttributes struct {
|
||||
// Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
|
||||
// namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
|
||||
// "" (empty) is defaulted for LocalSubjectAccessReviews
|
||||
// "" (empty) is empty for cluster-scoped resources
|
||||
// "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
|
||||
// +optional
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"`
|
||||
// Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// +optional
|
||||
Verb string `json:"verb,omitempty" protobuf:"bytes,2,opt,name=verb"`
|
||||
// Group is the API Group of the Resource. "*" means all.
|
||||
// group is the API Group of the Resource. "*" means all.
|
||||
// +optional
|
||||
Group string `json:"group,omitempty" protobuf:"bytes,3,opt,name=group"`
|
||||
// Version is the API Version of the Resource. "*" means all.
|
||||
// version is the API Version of the Resource. "*" means all.
|
||||
// +optional
|
||||
Version string `json:"version,omitempty" protobuf:"bytes,4,opt,name=version"`
|
||||
// Resource is one of the existing resource types. "*" means all.
|
||||
// resource is one of the existing resource types. "*" means all.
|
||||
// +optional
|
||||
Resource string `json:"resource,omitempty" protobuf:"bytes,5,opt,name=resource"`
|
||||
// Subresource is one of the existing resource types. "" means none.
|
||||
// subresource is one of the existing resource types. "" means none.
|
||||
// +optional
|
||||
Subresource string `json:"subresource,omitempty" protobuf:"bytes,6,opt,name=subresource"`
|
||||
// Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
|
||||
// name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
|
||||
// +optional
|
||||
Name string `json:"name,omitempty" protobuf:"bytes,7,opt,name=name"`
|
||||
// fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.
|
||||
@@ -182,37 +182,37 @@ type FieldSelectorAttributes struct {
|
||||
|
||||
// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
|
||||
type NonResourceAttributes struct {
|
||||
// Path is the URL path of the request
|
||||
// path is the URL path of the request
|
||||
// +optional
|
||||
Path string `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"`
|
||||
// Verb is the standard HTTP verb
|
||||
// verb is the standard HTTP verb
|
||||
// +optional
|
||||
Verb string `json:"verb,omitempty" protobuf:"bytes,2,opt,name=verb"`
|
||||
}
|
||||
|
||||
// SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes
|
||||
// and NonResourceAuthorizationAttributes must be set
|
||||
// SubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes
|
||||
// and nonResourceAttributes must be set
|
||||
type SubjectAccessReviewSpec struct {
|
||||
// ResourceAuthorizationAttributes describes information for a resource access request
|
||||
// resourceAttributes describes information for a resource access request
|
||||
// +optional
|
||||
ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
|
||||
// NonResourceAttributes describes information for a non-resource access request
|
||||
// nonResourceAttributes describes information for a non-resource access request
|
||||
// +optional
|
||||
NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
|
||||
|
||||
// User is the user you're testing for.
|
||||
// user is the user you're testing for.
|
||||
// If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups
|
||||
// +optional
|
||||
User string `json:"user,omitempty" protobuf:"bytes,3,opt,name=user"`
|
||||
// Groups is the groups you're testing for.
|
||||
// groups is the groups you're testing for.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Groups []string `json:"groups,omitempty" protobuf:"bytes,4,rep,name=groups"`
|
||||
// Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer
|
||||
// extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer
|
||||
// it needs a reflection here.
|
||||
// +optional
|
||||
Extra map[string]ExtraValue `json:"extra,omitempty" protobuf:"bytes,5,rep,name=extra"`
|
||||
// UID information about the requesting user.
|
||||
// uid information about the requesting user.
|
||||
// +optional
|
||||
UID string `json:"uid,omitempty" protobuf:"bytes,6,opt,name=uid"`
|
||||
}
|
||||
@@ -226,31 +226,31 @@ func (t ExtraValue) String() string {
|
||||
return fmt.Sprintf("%v", []string(t))
|
||||
}
|
||||
|
||||
// SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes
|
||||
// and NonResourceAuthorizationAttributes must be set
|
||||
// SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes
|
||||
// and nonResourceAttributes must be set
|
||||
type SelfSubjectAccessReviewSpec struct {
|
||||
// ResourceAuthorizationAttributes describes information for a resource access request
|
||||
// resourceAttributes describes information for a resource access request
|
||||
// +optional
|
||||
ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
|
||||
// NonResourceAttributes describes information for a non-resource access request
|
||||
// nonResourceAttributes describes information for a non-resource access request
|
||||
// +optional
|
||||
NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
|
||||
}
|
||||
|
||||
// SubjectAccessReviewStatus
|
||||
type SubjectAccessReviewStatus struct {
|
||||
// Allowed is required. True if the action would be allowed, false otherwise.
|
||||
// allowed is required. True if the action would be allowed, false otherwise.
|
||||
Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"`
|
||||
// Denied is optional. True if the action would be denied, otherwise
|
||||
// denied is optional. True if the action would be denied, otherwise
|
||||
// false. If both allowed is false and denied is false, then the
|
||||
// authorizer has no opinion on whether to authorize the action. Denied
|
||||
// may not be true if Allowed is true.
|
||||
// +optional
|
||||
Denied bool `json:"denied,omitempty" protobuf:"varint,4,opt,name=denied"`
|
||||
// Reason is optional. It indicates why a request was allowed or denied.
|
||||
// reason is optional. It indicates why a request was allowed or denied.
|
||||
// +optional
|
||||
Reason string `json:"reason,omitempty" protobuf:"bytes,2,opt,name=reason"`
|
||||
// EvaluationError is an indication that some error occurred during the authorization check.
|
||||
// evaluationError is an indication that some error occurred during the authorization check.
|
||||
// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
|
||||
// For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
|
||||
// +optional
|
||||
@@ -271,22 +271,22 @@ type SubjectAccessReviewStatus struct {
|
||||
// SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
|
||||
type SelfSubjectRulesReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated.
|
||||
// spec holds information about the request being evaluated.
|
||||
Spec SelfSubjectRulesReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates the set of actions a user can perform.
|
||||
// status is filled in by the server and indicates the set of actions a user can perform.
|
||||
// +optional
|
||||
Status SubjectRulesReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.
|
||||
type SelfSubjectRulesReviewSpec struct {
|
||||
// Namespace to evaluate rules for. Required.
|
||||
// namespace to evaluate rules for. Required.
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"`
|
||||
}
|
||||
|
||||
@@ -295,18 +295,18 @@ type SelfSubjectRulesReviewSpec struct {
|
||||
// Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission,
|
||||
// even if that list is incomplete.
|
||||
type SubjectRulesReviewStatus struct {
|
||||
// ResourceRules is the list of actions the subject is allowed to perform on resources.
|
||||
// resourceRules is the list of actions the subject is allowed to perform on resources.
|
||||
// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
|
||||
// +listType=atomic
|
||||
ResourceRules []ResourceRule `json:"resourceRules" protobuf:"bytes,1,rep,name=resourceRules"`
|
||||
// NonResourceRules is the list of actions the subject is allowed to perform on non-resources.
|
||||
// nonResourceRules is the list of actions the subject is allowed to perform on non-resources.
|
||||
// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
|
||||
// +listType=atomic
|
||||
NonResourceRules []NonResourceRule `json:"nonResourceRules" protobuf:"bytes,2,rep,name=nonResourceRules"`
|
||||
// Incomplete is true when the rules returned by this call are incomplete. This is most commonly
|
||||
// incomplete is true when the rules returned by this call are incomplete. This is most commonly
|
||||
// encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.
|
||||
Incomplete bool `json:"incomplete" protobuf:"bytes,3,rep,name=incomplete"`
|
||||
// EvaluationError can appear in combination with Rules. It indicates an error occurred during
|
||||
// evaluationError can appear in combination with Rules. It indicates an error occurred during
|
||||
// rule evaluation, such as an authorizer that doesn't support rule evaluation, and that
|
||||
// ResourceRules and/or NonResourceRules may be incomplete.
|
||||
// +optional
|
||||
@@ -316,21 +316,21 @@ type SubjectRulesReviewStatus struct {
|
||||
// ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant,
|
||||
// may contain duplicates, and possibly be incomplete.
|
||||
type ResourceRule struct {
|
||||
// Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// verbs is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// +listType=atomic
|
||||
Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
|
||||
|
||||
// APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
// apiGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
// the enumerated resources in any API group will be allowed. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,2,rep,name=apiGroups"`
|
||||
// Resources is a list of resources this rule applies to. "*" means all in the specified apiGroups.
|
||||
// resources is a list of resources this rule applies to. "*" means all in the specified apiGroups.
|
||||
// "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"`
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,4,rep,name=resourceNames"`
|
||||
@@ -338,11 +338,11 @@ type ResourceRule struct {
|
||||
|
||||
// NonResourceRule holds information that describes a rule for the non-resource
|
||||
type NonResourceRule struct {
|
||||
// Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all.
|
||||
// verbs is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all.
|
||||
// +listType=atomic
|
||||
Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
|
||||
|
||||
// NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full,
|
||||
// nonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full,
|
||||
// final step in the path. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
|
||||
+46
-46
@@ -49,9 +49,9 @@ func (LabelSelectorAttributes) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_LocalSubjectAccessReview = map[string]string{
|
||||
"": "LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace. Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions checking.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated. spec.namespace must be equal to the namespace you made the request against. If empty, it is defaulted.",
|
||||
"status": "Status is filled in by the server and indicates whether the request is allowed or not",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated. spec.namespace must be equal to the namespace you made the request against. If empty, it is defaulted.",
|
||||
"status": "status is filled in by the server and indicates whether the request is allowed or not",
|
||||
}
|
||||
|
||||
func (LocalSubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
@@ -60,8 +60,8 @@ func (LocalSubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_NonResourceAttributes = map[string]string{
|
||||
"": "NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface",
|
||||
"path": "Path is the URL path of the request",
|
||||
"verb": "Verb is the standard HTTP verb",
|
||||
"path": "path is the URL path of the request",
|
||||
"verb": "verb is the standard HTTP verb",
|
||||
}
|
||||
|
||||
func (NonResourceAttributes) SwaggerDoc() map[string]string {
|
||||
@@ -70,8 +70,8 @@ func (NonResourceAttributes) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_NonResourceRule = map[string]string{
|
||||
"": "NonResourceRule holds information that describes a rule for the non-resource",
|
||||
"verbs": "Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. \"*\" means all.",
|
||||
"nonResourceURLs": "NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path. \"*\" means all.",
|
||||
"verbs": "verbs is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. \"*\" means all.",
|
||||
"nonResourceURLs": "nonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path. \"*\" means all.",
|
||||
}
|
||||
|
||||
func (NonResourceRule) SwaggerDoc() map[string]string {
|
||||
@@ -80,13 +80,13 @@ func (NonResourceRule) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ResourceAttributes = map[string]string{
|
||||
"": "ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface",
|
||||
"namespace": "Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces \"\" (empty) is defaulted for LocalSubjectAccessReviews \"\" (empty) is empty for cluster-scoped resources \"\" (empty) means \"all\" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview",
|
||||
"verb": "Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. \"*\" means all.",
|
||||
"group": "Group is the API Group of the Resource. \"*\" means all.",
|
||||
"version": "Version is the API Version of the Resource. \"*\" means all.",
|
||||
"resource": "Resource is one of the existing resource types. \"*\" means all.",
|
||||
"subresource": "Subresource is one of the existing resource types. \"\" means none.",
|
||||
"name": "Name is the name of the resource being requested for a \"get\" or deleted for a \"delete\". \"\" (empty) means all.",
|
||||
"namespace": "namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces \"\" (empty) is defaulted for LocalSubjectAccessReviews \"\" (empty) is empty for cluster-scoped resources \"\" (empty) means \"all\" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview",
|
||||
"verb": "verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. \"*\" means all.",
|
||||
"group": "group is the API Group of the Resource. \"*\" means all.",
|
||||
"version": "version is the API Version of the Resource. \"*\" means all.",
|
||||
"resource": "resource is one of the existing resource types. \"*\" means all.",
|
||||
"subresource": "subresource is one of the existing resource types. \"\" means none.",
|
||||
"name": "name is the name of the resource being requested for a \"get\" or deleted for a \"delete\". \"\" (empty) means all.",
|
||||
"fieldSelector": "fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.",
|
||||
"labelSelector": "labelSelector describes the limitation on access based on labels. It can only limit access, not broaden it.",
|
||||
}
|
||||
@@ -97,10 +97,10 @@ func (ResourceAttributes) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ResourceRule = map[string]string{
|
||||
"": "ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"verbs": "Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. \"*\" means all.",
|
||||
"apiGroups": "APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"*\" means all.",
|
||||
"resources": "Resources is a list of resources this rule applies to. \"*\" means all in the specified apiGroups.\n \"*/foo\" represents the subresource 'foo' for all resources in the specified apiGroups.",
|
||||
"resourceNames": "ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. \"*\" means all.",
|
||||
"verbs": "verbs is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. \"*\" means all.",
|
||||
"apiGroups": "apiGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"*\" means all.",
|
||||
"resources": "resources is a list of resources this rule applies to. \"*\" means all in the specified apiGroups.\n \"*/foo\" represents the subresource 'foo' for all resources in the specified apiGroups.",
|
||||
"resourceNames": "resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. \"*\" means all.",
|
||||
}
|
||||
|
||||
func (ResourceRule) SwaggerDoc() map[string]string {
|
||||
@@ -109,9 +109,9 @@ func (ResourceRule) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectAccessReview = map[string]string{
|
||||
"": "SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means \"in all namespaces\". Self is a special case, because users should always be able to check whether they can perform an action",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated. user and groups must be empty",
|
||||
"status": "Status is filled in by the server and indicates whether the request is allowed or not",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated. user and groups must be empty",
|
||||
"status": "status is filled in by the server and indicates whether the request is allowed or not",
|
||||
}
|
||||
|
||||
func (SelfSubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
@@ -119,9 +119,9 @@ func (SelfSubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
}
|
||||
|
||||
var map_SelfSubjectAccessReviewSpec = map[string]string{
|
||||
"": "SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set",
|
||||
"resourceAttributes": "ResourceAuthorizationAttributes describes information for a resource access request",
|
||||
"nonResourceAttributes": "NonResourceAttributes describes information for a non-resource access request",
|
||||
"": "SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes and nonResourceAttributes must be set",
|
||||
"resourceAttributes": "resourceAttributes describes information for a resource access request",
|
||||
"nonResourceAttributes": "nonResourceAttributes describes information for a non-resource access request",
|
||||
}
|
||||
|
||||
func (SelfSubjectAccessReviewSpec) SwaggerDoc() map[string]string {
|
||||
@@ -130,9 +130,9 @@ func (SelfSubjectAccessReviewSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectRulesReview = map[string]string{
|
||||
"": "SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace. The returned list of actions may be incomplete depending on the server's authorization mode, and any errors experienced during the evaluation. SelfSubjectRulesReview should be used by UIs to show/hide actions, or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns. SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated.",
|
||||
"status": "Status is filled in by the server and indicates the set of actions a user can perform.",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated.",
|
||||
"status": "status is filled in by the server and indicates the set of actions a user can perform.",
|
||||
}
|
||||
|
||||
func (SelfSubjectRulesReview) SwaggerDoc() map[string]string {
|
||||
@@ -141,7 +141,7 @@ func (SelfSubjectRulesReview) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectRulesReviewSpec = map[string]string{
|
||||
"": "SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.",
|
||||
"namespace": "Namespace to evaluate rules for. Required.",
|
||||
"namespace": "namespace to evaluate rules for. Required.",
|
||||
}
|
||||
|
||||
func (SelfSubjectRulesReviewSpec) SwaggerDoc() map[string]string {
|
||||
@@ -150,9 +150,9 @@ func (SelfSubjectRulesReviewSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SubjectAccessReview = map[string]string{
|
||||
"": "SubjectAccessReview checks whether or not a user or group can perform an action.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated",
|
||||
"status": "Status is filled in by the server and indicates whether the request is allowed or not",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated",
|
||||
"status": "status is filled in by the server and indicates whether the request is allowed or not",
|
||||
}
|
||||
|
||||
func (SubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
@@ -160,13 +160,13 @@ func (SubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
}
|
||||
|
||||
var map_SubjectAccessReviewSpec = map[string]string{
|
||||
"": "SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set",
|
||||
"resourceAttributes": "ResourceAuthorizationAttributes describes information for a resource access request",
|
||||
"nonResourceAttributes": "NonResourceAttributes describes information for a non-resource access request",
|
||||
"user": "User is the user you're testing for. If you specify \"User\" but not \"Groups\", then is it interpreted as \"What if User were not a member of any groups",
|
||||
"groups": "Groups is the groups you're testing for.",
|
||||
"extra": "Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.",
|
||||
"uid": "UID information about the requesting user.",
|
||||
"": "SubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes and nonResourceAttributes must be set",
|
||||
"resourceAttributes": "resourceAttributes describes information for a resource access request",
|
||||
"nonResourceAttributes": "nonResourceAttributes describes information for a non-resource access request",
|
||||
"user": "user is the user you're testing for. If you specify \"User\" but not \"Groups\", then is it interpreted as \"What if User were not a member of any groups",
|
||||
"groups": "groups is the groups you're testing for.",
|
||||
"extra": "extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.",
|
||||
"uid": "uid information about the requesting user.",
|
||||
}
|
||||
|
||||
func (SubjectAccessReviewSpec) SwaggerDoc() map[string]string {
|
||||
@@ -175,10 +175,10 @@ func (SubjectAccessReviewSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SubjectAccessReviewStatus = map[string]string{
|
||||
"": "SubjectAccessReviewStatus",
|
||||
"allowed": "Allowed is required. True if the action would be allowed, false otherwise.",
|
||||
"denied": "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",
|
||||
"reason": "Reason is optional. It indicates why a request was allowed or denied.",
|
||||
"evaluationError": "EvaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.",
|
||||
"allowed": "allowed is required. True if the action would be allowed, false otherwise.",
|
||||
"denied": "denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",
|
||||
"reason": "reason is optional. It indicates why a request was allowed or denied.",
|
||||
"evaluationError": "evaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.",
|
||||
}
|
||||
|
||||
func (SubjectAccessReviewStatus) SwaggerDoc() map[string]string {
|
||||
@@ -187,10 +187,10 @@ func (SubjectAccessReviewStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SubjectRulesReviewStatus = map[string]string{
|
||||
"": "SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on the set of authorizers the server is configured with and any errors experienced during evaluation. Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission, even if that list is incomplete.",
|
||||
"resourceRules": "ResourceRules is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"nonResourceRules": "NonResourceRules is the list of actions the subject is allowed to perform on non-resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"incomplete": "Incomplete is true when the rules returned by this call are incomplete. This is most commonly encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.",
|
||||
"evaluationError": "EvaluationError can appear in combination with Rules. It indicates an error occurred during rule evaluation, such as an authorizer that doesn't support rule evaluation, and that ResourceRules and/or NonResourceRules may be incomplete.",
|
||||
"resourceRules": "resourceRules is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"nonResourceRules": "nonResourceRules is the list of actions the subject is allowed to perform on non-resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"incomplete": "incomplete is true when the rules returned by this call are incomplete. This is most commonly encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.",
|
||||
"evaluationError": "evaluationError can appear in combination with Rules. It indicates an error occurred during rule evaluation, such as an authorizer that doesn't support rule evaluation, and that ResourceRules and/or NonResourceRules may be incomplete.",
|
||||
}
|
||||
|
||||
func (SubjectRulesReviewStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
+48
-48
@@ -42,38 +42,38 @@ message ExtraValue {
|
||||
// Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
|
||||
// checking.
|
||||
message LocalSubjectAccessReview {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated. spec.namespace must be equal to the namespace
|
||||
// spec holds information about the request being evaluated. spec.namespace must be equal to the namespace
|
||||
// you made the request against. If empty, it is defaulted.
|
||||
optional SubjectAccessReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
optional SubjectAccessReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
|
||||
message NonResourceAttributes {
|
||||
// Path is the URL path of the request
|
||||
// path is the URL path of the request
|
||||
// +optional
|
||||
optional string path = 1;
|
||||
|
||||
// Verb is the standard HTTP verb
|
||||
// verb is the standard HTTP verb
|
||||
// +optional
|
||||
optional string verb = 2;
|
||||
}
|
||||
|
||||
// NonResourceRule holds information that describes a rule for the non-resource
|
||||
message NonResourceRule {
|
||||
// Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all.
|
||||
// verbs is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all.
|
||||
// +listType=atomic
|
||||
repeated string verbs = 1;
|
||||
|
||||
// NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full,
|
||||
// nonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full,
|
||||
// final step in the path. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
@@ -82,34 +82,34 @@ message NonResourceRule {
|
||||
|
||||
// ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
|
||||
message ResourceAttributes {
|
||||
// Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
|
||||
// namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
|
||||
// "" (empty) is defaulted for LocalSubjectAccessReviews
|
||||
// "" (empty) is empty for cluster-scoped resources
|
||||
// "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
|
||||
// +optional
|
||||
optional string namespace = 1;
|
||||
|
||||
// Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// +optional
|
||||
optional string verb = 2;
|
||||
|
||||
// Group is the API Group of the Resource. "*" means all.
|
||||
// group is the API Group of the Resource. "*" means all.
|
||||
// +optional
|
||||
optional string group = 3;
|
||||
|
||||
// Version is the API Version of the Resource. "*" means all.
|
||||
// version is the API Version of the Resource. "*" means all.
|
||||
// +optional
|
||||
optional string version = 4;
|
||||
|
||||
// Resource is one of the existing resource types. "*" means all.
|
||||
// resource is one of the existing resource types. "*" means all.
|
||||
// +optional
|
||||
optional string resource = 5;
|
||||
|
||||
// Subresource is one of the existing resource types. "" means none.
|
||||
// subresource is one of the existing resource types. "" means none.
|
||||
// +optional
|
||||
optional string subresource = 6;
|
||||
|
||||
// Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
|
||||
// name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
|
||||
// +optional
|
||||
optional string name = 7;
|
||||
|
||||
@@ -125,23 +125,23 @@ message ResourceAttributes {
|
||||
// ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant,
|
||||
// may contain duplicates, and possibly be incomplete.
|
||||
message ResourceRule {
|
||||
// Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// verbs is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// +listType=atomic
|
||||
repeated string verbs = 1;
|
||||
|
||||
// APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
// apiGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
// the enumerated resources in any API group will be allowed. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string apiGroups = 2;
|
||||
|
||||
// Resources is a list of resources this rule applies to. "*" means all in the specified apiGroups.
|
||||
// resources is a list of resources this rule applies to. "*" means all in the specified apiGroups.
|
||||
// "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string resources = 3;
|
||||
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string resourceNames = 4;
|
||||
@@ -151,27 +151,27 @@ message ResourceRule {
|
||||
// spec.namespace means "in all namespaces". Self is a special case, because users should always be able
|
||||
// to check whether they can perform an action
|
||||
message SelfSubjectAccessReview {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated. user and groups must be empty
|
||||
// spec holds information about the request being evaluated. user and groups must be empty
|
||||
optional SelfSubjectAccessReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
optional SubjectAccessReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes
|
||||
// and NonResourceAuthorizationAttributes must be set
|
||||
// SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes
|
||||
// and nonResourceAttributes must be set
|
||||
message SelfSubjectAccessReviewSpec {
|
||||
// ResourceAuthorizationAttributes describes information for a resource access request
|
||||
// resourceAttributes describes information for a resource access request
|
||||
// +optional
|
||||
optional ResourceAttributes resourceAttributes = 1;
|
||||
|
||||
// NonResourceAttributes describes information for a non-resource access request
|
||||
// nonResourceAttributes describes information for a non-resource access request
|
||||
// +optional
|
||||
optional NonResourceAttributes nonResourceAttributes = 2;
|
||||
}
|
||||
@@ -183,88 +183,88 @@ message SelfSubjectAccessReviewSpec {
|
||||
// drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns.
|
||||
// SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
|
||||
message SelfSubjectRulesReview {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated.
|
||||
// spec holds information about the request being evaluated.
|
||||
optional SelfSubjectRulesReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates the set of actions a user can perform.
|
||||
// status is filled in by the server and indicates the set of actions a user can perform.
|
||||
// +optional
|
||||
optional SubjectRulesReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.
|
||||
message SelfSubjectRulesReviewSpec {
|
||||
// Namespace to evaluate rules for. Required.
|
||||
// namespace to evaluate rules for. Required.
|
||||
optional string namespace = 1;
|
||||
}
|
||||
|
||||
// SubjectAccessReview checks whether or not a user or group can perform an action.
|
||||
message SubjectAccessReview {
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
optional SubjectAccessReviewSpec spec = 2;
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
optional SubjectAccessReviewStatus status = 3;
|
||||
}
|
||||
|
||||
// SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes
|
||||
// and NonResourceAuthorizationAttributes must be set
|
||||
// SubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes
|
||||
// and nonResourceAttributes must be set
|
||||
message SubjectAccessReviewSpec {
|
||||
// ResourceAuthorizationAttributes describes information for a resource access request
|
||||
// resourceAttributes describes information for a resource access request
|
||||
// +optional
|
||||
optional ResourceAttributes resourceAttributes = 1;
|
||||
|
||||
// NonResourceAttributes describes information for a non-resource access request
|
||||
// nonResourceAttributes describes information for a non-resource access request
|
||||
// +optional
|
||||
optional NonResourceAttributes nonResourceAttributes = 2;
|
||||
|
||||
// User is the user you're testing for.
|
||||
// user is the user you're testing for.
|
||||
// If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
|
||||
// +optional
|
||||
optional string user = 3;
|
||||
|
||||
// Groups is the groups you're testing for.
|
||||
// group is the groups you're testing for.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated string group = 4;
|
||||
|
||||
// Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer
|
||||
// extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer
|
||||
// it needs a reflection here.
|
||||
// +optional
|
||||
map<string, ExtraValue> extra = 5;
|
||||
|
||||
// UID information about the requesting user.
|
||||
// uid information about the requesting user.
|
||||
// +optional
|
||||
optional string uid = 6;
|
||||
}
|
||||
|
||||
// SubjectAccessReviewStatus
|
||||
message SubjectAccessReviewStatus {
|
||||
// Allowed is required. True if the action would be allowed, false otherwise.
|
||||
// allowed is required. True if the action would be allowed, false otherwise.
|
||||
optional bool allowed = 1;
|
||||
|
||||
// Denied is optional. True if the action would be denied, otherwise
|
||||
// denied is optional. True if the action would be denied, otherwise
|
||||
// false. If both allowed is false and denied is false, then the
|
||||
// authorizer has no opinion on whether to authorize the action. Denied
|
||||
// may not be true if Allowed is true.
|
||||
// +optional
|
||||
optional bool denied = 4;
|
||||
|
||||
// Reason is optional. It indicates why a request was allowed or denied.
|
||||
// reason is optional. It indicates why a request was allowed or denied.
|
||||
// +optional
|
||||
optional string reason = 2;
|
||||
|
||||
// EvaluationError is an indication that some error occurred during the authorization check.
|
||||
// evaluationError is an indication that some error occurred during the authorization check.
|
||||
// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
|
||||
// For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
|
||||
// +optional
|
||||
@@ -276,21 +276,21 @@ message SubjectAccessReviewStatus {
|
||||
// Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission,
|
||||
// even if that list is incomplete.
|
||||
message SubjectRulesReviewStatus {
|
||||
// ResourceRules is the list of actions the subject is allowed to perform on resources.
|
||||
// resourceRules is the list of actions the subject is allowed to perform on resources.
|
||||
// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
|
||||
// +listType=atomic
|
||||
repeated ResourceRule resourceRules = 1;
|
||||
|
||||
// NonResourceRules is the list of actions the subject is allowed to perform on non-resources.
|
||||
// nonResourceRules is the list of actions the subject is allowed to perform on non-resources.
|
||||
// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
|
||||
// +listType=atomic
|
||||
repeated NonResourceRule nonResourceRules = 2;
|
||||
|
||||
// Incomplete is true when the rules returned by this call are incomplete. This is most commonly
|
||||
// incomplete is true when the rules returned by this call are incomplete. This is most commonly
|
||||
// encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.
|
||||
optional bool incomplete = 3;
|
||||
|
||||
// EvaluationError can appear in combination with Rules. It indicates an error occurred during
|
||||
// evaluationError can appear in combination with Rules. It indicates an error occurred during
|
||||
// rule evaluation, such as an authorizer that doesn't support rule evaluation, and that
|
||||
// ResourceRules and/or NonResourceRules may be incomplete.
|
||||
// +optional
|
||||
|
||||
-50
@@ -1,50 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
func (*ExtraValue) ProtoMessage() {}
|
||||
|
||||
func (*LocalSubjectAccessReview) ProtoMessage() {}
|
||||
|
||||
func (*NonResourceAttributes) ProtoMessage() {}
|
||||
|
||||
func (*NonResourceRule) ProtoMessage() {}
|
||||
|
||||
func (*ResourceAttributes) ProtoMessage() {}
|
||||
|
||||
func (*ResourceRule) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectAccessReview) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectAccessReviewSpec) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectRulesReview) ProtoMessage() {}
|
||||
|
||||
func (*SelfSubjectRulesReviewSpec) ProtoMessage() {}
|
||||
|
||||
func (*SubjectAccessReview) ProtoMessage() {}
|
||||
|
||||
func (*SubjectAccessReviewSpec) ProtoMessage() {}
|
||||
|
||||
func (*SubjectAccessReviewStatus) ProtoMessage() {}
|
||||
|
||||
func (*SubjectRulesReviewStatus) ProtoMessage() {}
|
||||
+48
-48
@@ -34,15 +34,15 @@ import (
|
||||
// SubjectAccessReview checks whether or not a user or group can perform an action.
|
||||
type SubjectAccessReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated
|
||||
// spec holds information about the request being evaluated
|
||||
Spec SubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
@@ -60,15 +60,15 @@ type SubjectAccessReview struct {
|
||||
// to check whether they can perform an action
|
||||
type SelfSubjectAccessReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated. user and groups must be empty
|
||||
// spec holds information about the request being evaluated. user and groups must be empty
|
||||
Spec SelfSubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
@@ -85,44 +85,44 @@ type SelfSubjectAccessReview struct {
|
||||
// checking.
|
||||
type LocalSubjectAccessReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated. spec.namespace must be equal to the namespace
|
||||
// spec holds information about the request being evaluated. spec.namespace must be equal to the namespace
|
||||
// you made the request against. If empty, it is defaulted.
|
||||
Spec SubjectAccessReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates whether the request is allowed or not
|
||||
// status is filled in by the server and indicates whether the request is allowed or not
|
||||
// +optional
|
||||
Status SubjectAccessReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
|
||||
type ResourceAttributes struct {
|
||||
// Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
|
||||
// namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
|
||||
// "" (empty) is defaulted for LocalSubjectAccessReviews
|
||||
// "" (empty) is empty for cluster-scoped resources
|
||||
// "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
|
||||
// +optional
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"`
|
||||
// Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// +optional
|
||||
Verb string `json:"verb,omitempty" protobuf:"bytes,2,opt,name=verb"`
|
||||
// Group is the API Group of the Resource. "*" means all.
|
||||
// group is the API Group of the Resource. "*" means all.
|
||||
// +optional
|
||||
Group string `json:"group,omitempty" protobuf:"bytes,3,opt,name=group"`
|
||||
// Version is the API Version of the Resource. "*" means all.
|
||||
// version is the API Version of the Resource. "*" means all.
|
||||
// +optional
|
||||
Version string `json:"version,omitempty" protobuf:"bytes,4,opt,name=version"`
|
||||
// Resource is one of the existing resource types. "*" means all.
|
||||
// resource is one of the existing resource types. "*" means all.
|
||||
// +optional
|
||||
Resource string `json:"resource,omitempty" protobuf:"bytes,5,opt,name=resource"`
|
||||
// Subresource is one of the existing resource types. "" means none.
|
||||
// subresource is one of the existing resource types. "" means none.
|
||||
// +optional
|
||||
Subresource string `json:"subresource,omitempty" protobuf:"bytes,6,opt,name=subresource"`
|
||||
// Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
|
||||
// name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
|
||||
// +optional
|
||||
Name string `json:"name,omitempty" protobuf:"bytes,7,opt,name=name"`
|
||||
// fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.
|
||||
@@ -135,37 +135,37 @@ type ResourceAttributes struct {
|
||||
|
||||
// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
|
||||
type NonResourceAttributes struct {
|
||||
// Path is the URL path of the request
|
||||
// path is the URL path of the request
|
||||
// +optional
|
||||
Path string `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"`
|
||||
// Verb is the standard HTTP verb
|
||||
// verb is the standard HTTP verb
|
||||
// +optional
|
||||
Verb string `json:"verb,omitempty" protobuf:"bytes,2,opt,name=verb"`
|
||||
}
|
||||
|
||||
// SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes
|
||||
// and NonResourceAuthorizationAttributes must be set
|
||||
// SubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes
|
||||
// and nonResourceAttributes must be set
|
||||
type SubjectAccessReviewSpec struct {
|
||||
// ResourceAuthorizationAttributes describes information for a resource access request
|
||||
// resourceAttributes describes information for a resource access request
|
||||
// +optional
|
||||
ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
|
||||
// NonResourceAttributes describes information for a non-resource access request
|
||||
// nonResourceAttributes describes information for a non-resource access request
|
||||
// +optional
|
||||
NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
|
||||
|
||||
// User is the user you're testing for.
|
||||
// user is the user you're testing for.
|
||||
// If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
|
||||
// +optional
|
||||
User string `json:"user,omitempty" protobuf:"bytes,3,opt,name=user"`
|
||||
// Groups is the groups you're testing for.
|
||||
// group is the groups you're testing for.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Groups []string `json:"group,omitempty" protobuf:"bytes,4,rep,name=group"`
|
||||
// Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer
|
||||
// extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer
|
||||
// it needs a reflection here.
|
||||
// +optional
|
||||
Extra map[string]ExtraValue `json:"extra,omitempty" protobuf:"bytes,5,rep,name=extra"`
|
||||
// UID information about the requesting user.
|
||||
// uid information about the requesting user.
|
||||
// +optional
|
||||
UID string `json:"uid,omitempty" protobuf:"bytes,6,opt,name=uid"`
|
||||
}
|
||||
@@ -179,31 +179,31 @@ func (t ExtraValue) String() string {
|
||||
return fmt.Sprintf("%v", []string(t))
|
||||
}
|
||||
|
||||
// SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes
|
||||
// and NonResourceAuthorizationAttributes must be set
|
||||
// SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes
|
||||
// and nonResourceAttributes must be set
|
||||
type SelfSubjectAccessReviewSpec struct {
|
||||
// ResourceAuthorizationAttributes describes information for a resource access request
|
||||
// resourceAttributes describes information for a resource access request
|
||||
// +optional
|
||||
ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
|
||||
// NonResourceAttributes describes information for a non-resource access request
|
||||
// nonResourceAttributes describes information for a non-resource access request
|
||||
// +optional
|
||||
NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
|
||||
}
|
||||
|
||||
// SubjectAccessReviewStatus
|
||||
type SubjectAccessReviewStatus struct {
|
||||
// Allowed is required. True if the action would be allowed, false otherwise.
|
||||
// allowed is required. True if the action would be allowed, false otherwise.
|
||||
Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"`
|
||||
// Denied is optional. True if the action would be denied, otherwise
|
||||
// denied is optional. True if the action would be denied, otherwise
|
||||
// false. If both allowed is false and denied is false, then the
|
||||
// authorizer has no opinion on whether to authorize the action. Denied
|
||||
// may not be true if Allowed is true.
|
||||
// +optional
|
||||
Denied bool `json:"denied,omitempty" protobuf:"varint,4,opt,name=denied"`
|
||||
// Reason is optional. It indicates why a request was allowed or denied.
|
||||
// reason is optional. It indicates why a request was allowed or denied.
|
||||
// +optional
|
||||
Reason string `json:"reason,omitempty" protobuf:"bytes,2,opt,name=reason"`
|
||||
// EvaluationError is an indication that some error occurred during the authorization check.
|
||||
// evaluationError is an indication that some error occurred during the authorization check.
|
||||
// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
|
||||
// For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
|
||||
// +optional
|
||||
@@ -226,22 +226,22 @@ type SubjectAccessReviewStatus struct {
|
||||
// SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
|
||||
type SelfSubjectRulesReview struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// Standard list metadata.
|
||||
// metadata is the standard list metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Spec holds information about the request being evaluated.
|
||||
// spec holds information about the request being evaluated.
|
||||
Spec SelfSubjectRulesReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// Status is filled in by the server and indicates the set of actions a user can perform.
|
||||
// status is filled in by the server and indicates the set of actions a user can perform.
|
||||
// +optional
|
||||
Status SubjectRulesReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.
|
||||
type SelfSubjectRulesReviewSpec struct {
|
||||
// Namespace to evaluate rules for. Required.
|
||||
// namespace to evaluate rules for. Required.
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,1,opt,name=namespace"`
|
||||
}
|
||||
|
||||
@@ -250,18 +250,18 @@ type SelfSubjectRulesReviewSpec struct {
|
||||
// Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission,
|
||||
// even if that list is incomplete.
|
||||
type SubjectRulesReviewStatus struct {
|
||||
// ResourceRules is the list of actions the subject is allowed to perform on resources.
|
||||
// resourceRules is the list of actions the subject is allowed to perform on resources.
|
||||
// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
|
||||
// +listType=atomic
|
||||
ResourceRules []ResourceRule `json:"resourceRules" protobuf:"bytes,1,rep,name=resourceRules"`
|
||||
// NonResourceRules is the list of actions the subject is allowed to perform on non-resources.
|
||||
// nonResourceRules is the list of actions the subject is allowed to perform on non-resources.
|
||||
// The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
|
||||
// +listType=atomic
|
||||
NonResourceRules []NonResourceRule `json:"nonResourceRules" protobuf:"bytes,2,rep,name=nonResourceRules"`
|
||||
// Incomplete is true when the rules returned by this call are incomplete. This is most commonly
|
||||
// incomplete is true when the rules returned by this call are incomplete. This is most commonly
|
||||
// encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.
|
||||
Incomplete bool `json:"incomplete" protobuf:"bytes,3,rep,name=incomplete"`
|
||||
// EvaluationError can appear in combination with Rules. It indicates an error occurred during
|
||||
// evaluationError can appear in combination with Rules. It indicates an error occurred during
|
||||
// rule evaluation, such as an authorizer that doesn't support rule evaluation, and that
|
||||
// ResourceRules and/or NonResourceRules may be incomplete.
|
||||
// +optional
|
||||
@@ -271,21 +271,21 @@ type SubjectRulesReviewStatus struct {
|
||||
// ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant,
|
||||
// may contain duplicates, and possibly be incomplete.
|
||||
type ResourceRule struct {
|
||||
// Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// verbs is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all.
|
||||
// +listType=atomic
|
||||
Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
|
||||
|
||||
// APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
// apiGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
// the enumerated resources in any API group will be allowed. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,2,rep,name=apiGroups"`
|
||||
// Resources is a list of resources this rule applies to. "*" means all in the specified apiGroups.
|
||||
// resources is a list of resources this rule applies to. "*" means all in the specified apiGroups.
|
||||
// "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"`
|
||||
// ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all.
|
||||
// resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,4,rep,name=resourceNames"`
|
||||
@@ -293,11 +293,11 @@ type ResourceRule struct {
|
||||
|
||||
// NonResourceRule holds information that describes a rule for the non-resource
|
||||
type NonResourceRule struct {
|
||||
// Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all.
|
||||
// verbs is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all.
|
||||
// +listType=atomic
|
||||
Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
|
||||
|
||||
// NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full,
|
||||
// nonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full,
|
||||
// final step in the path. "*" means all.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
|
||||
+46
-46
@@ -29,9 +29,9 @@ package v1beta1
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_LocalSubjectAccessReview = map[string]string{
|
||||
"": "LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace. Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions checking.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated. spec.namespace must be equal to the namespace you made the request against. If empty, it is defaulted.",
|
||||
"status": "Status is filled in by the server and indicates whether the request is allowed or not",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated. spec.namespace must be equal to the namespace you made the request against. If empty, it is defaulted.",
|
||||
"status": "status is filled in by the server and indicates whether the request is allowed or not",
|
||||
}
|
||||
|
||||
func (LocalSubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
@@ -40,8 +40,8 @@ func (LocalSubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_NonResourceAttributes = map[string]string{
|
||||
"": "NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface",
|
||||
"path": "Path is the URL path of the request",
|
||||
"verb": "Verb is the standard HTTP verb",
|
||||
"path": "path is the URL path of the request",
|
||||
"verb": "verb is the standard HTTP verb",
|
||||
}
|
||||
|
||||
func (NonResourceAttributes) SwaggerDoc() map[string]string {
|
||||
@@ -50,8 +50,8 @@ func (NonResourceAttributes) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_NonResourceRule = map[string]string{
|
||||
"": "NonResourceRule holds information that describes a rule for the non-resource",
|
||||
"verbs": "Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. \"*\" means all.",
|
||||
"nonResourceURLs": "NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path. \"*\" means all.",
|
||||
"verbs": "verbs is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. \"*\" means all.",
|
||||
"nonResourceURLs": "nonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path. \"*\" means all.",
|
||||
}
|
||||
|
||||
func (NonResourceRule) SwaggerDoc() map[string]string {
|
||||
@@ -60,13 +60,13 @@ func (NonResourceRule) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ResourceAttributes = map[string]string{
|
||||
"": "ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface",
|
||||
"namespace": "Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces \"\" (empty) is defaulted for LocalSubjectAccessReviews \"\" (empty) is empty for cluster-scoped resources \"\" (empty) means \"all\" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview",
|
||||
"verb": "Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. \"*\" means all.",
|
||||
"group": "Group is the API Group of the Resource. \"*\" means all.",
|
||||
"version": "Version is the API Version of the Resource. \"*\" means all.",
|
||||
"resource": "Resource is one of the existing resource types. \"*\" means all.",
|
||||
"subresource": "Subresource is one of the existing resource types. \"\" means none.",
|
||||
"name": "Name is the name of the resource being requested for a \"get\" or deleted for a \"delete\". \"\" (empty) means all.",
|
||||
"namespace": "namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces \"\" (empty) is defaulted for LocalSubjectAccessReviews \"\" (empty) is empty for cluster-scoped resources \"\" (empty) means \"all\" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview",
|
||||
"verb": "verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. \"*\" means all.",
|
||||
"group": "group is the API Group of the Resource. \"*\" means all.",
|
||||
"version": "version is the API Version of the Resource. \"*\" means all.",
|
||||
"resource": "resource is one of the existing resource types. \"*\" means all.",
|
||||
"subresource": "subresource is one of the existing resource types. \"\" means none.",
|
||||
"name": "name is the name of the resource being requested for a \"get\" or deleted for a \"delete\". \"\" (empty) means all.",
|
||||
"fieldSelector": "fieldSelector describes the limitation on access based on field. It can only limit access, not broaden it.",
|
||||
"labelSelector": "labelSelector describes the limitation on access based on labels. It can only limit access, not broaden it.",
|
||||
}
|
||||
@@ -77,10 +77,10 @@ func (ResourceAttributes) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_ResourceRule = map[string]string{
|
||||
"": "ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"verbs": "Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. \"*\" means all.",
|
||||
"apiGroups": "APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"*\" means all.",
|
||||
"resources": "Resources is a list of resources this rule applies to. \"*\" means all in the specified apiGroups.\n \"*/foo\" represents the subresource 'foo' for all resources in the specified apiGroups.",
|
||||
"resourceNames": "ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. \"*\" means all.",
|
||||
"verbs": "verbs is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. \"*\" means all.",
|
||||
"apiGroups": "apiGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"*\" means all.",
|
||||
"resources": "resources is a list of resources this rule applies to. \"*\" means all in the specified apiGroups.\n \"*/foo\" represents the subresource 'foo' for all resources in the specified apiGroups.",
|
||||
"resourceNames": "resourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. \"*\" means all.",
|
||||
}
|
||||
|
||||
func (ResourceRule) SwaggerDoc() map[string]string {
|
||||
@@ -89,9 +89,9 @@ func (ResourceRule) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectAccessReview = map[string]string{
|
||||
"": "SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means \"in all namespaces\". Self is a special case, because users should always be able to check whether they can perform an action",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated. user and groups must be empty",
|
||||
"status": "Status is filled in by the server and indicates whether the request is allowed or not",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated. user and groups must be empty",
|
||||
"status": "status is filled in by the server and indicates whether the request is allowed or not",
|
||||
}
|
||||
|
||||
func (SelfSubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
@@ -99,9 +99,9 @@ func (SelfSubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
}
|
||||
|
||||
var map_SelfSubjectAccessReviewSpec = map[string]string{
|
||||
"": "SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set",
|
||||
"resourceAttributes": "ResourceAuthorizationAttributes describes information for a resource access request",
|
||||
"nonResourceAttributes": "NonResourceAttributes describes information for a non-resource access request",
|
||||
"": "SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes and nonResourceAttributes must be set",
|
||||
"resourceAttributes": "resourceAttributes describes information for a resource access request",
|
||||
"nonResourceAttributes": "nonResourceAttributes describes information for a non-resource access request",
|
||||
}
|
||||
|
||||
func (SelfSubjectAccessReviewSpec) SwaggerDoc() map[string]string {
|
||||
@@ -110,9 +110,9 @@ func (SelfSubjectAccessReviewSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectRulesReview = map[string]string{
|
||||
"": "SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace. The returned list of actions may be incomplete depending on the server's authorization mode, and any errors experienced during the evaluation. SelfSubjectRulesReview should be used by UIs to show/hide actions, or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns. SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated.",
|
||||
"status": "Status is filled in by the server and indicates the set of actions a user can perform.",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated.",
|
||||
"status": "status is filled in by the server and indicates the set of actions a user can perform.",
|
||||
}
|
||||
|
||||
func (SelfSubjectRulesReview) SwaggerDoc() map[string]string {
|
||||
@@ -121,7 +121,7 @@ func (SelfSubjectRulesReview) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SelfSubjectRulesReviewSpec = map[string]string{
|
||||
"": "SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.",
|
||||
"namespace": "Namespace to evaluate rules for. Required.",
|
||||
"namespace": "namespace to evaluate rules for. Required.",
|
||||
}
|
||||
|
||||
func (SelfSubjectRulesReviewSpec) SwaggerDoc() map[string]string {
|
||||
@@ -130,9 +130,9 @@ func (SelfSubjectRulesReviewSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SubjectAccessReview = map[string]string{
|
||||
"": "SubjectAccessReview checks whether or not a user or group can perform an action.",
|
||||
"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "Spec holds information about the request being evaluated",
|
||||
"status": "Status is filled in by the server and indicates whether the request is allowed or not",
|
||||
"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec holds information about the request being evaluated",
|
||||
"status": "status is filled in by the server and indicates whether the request is allowed or not",
|
||||
}
|
||||
|
||||
func (SubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
@@ -140,13 +140,13 @@ func (SubjectAccessReview) SwaggerDoc() map[string]string {
|
||||
}
|
||||
|
||||
var map_SubjectAccessReviewSpec = map[string]string{
|
||||
"": "SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set",
|
||||
"resourceAttributes": "ResourceAuthorizationAttributes describes information for a resource access request",
|
||||
"nonResourceAttributes": "NonResourceAttributes describes information for a non-resource access request",
|
||||
"user": "User is the user you're testing for. If you specify \"User\" but not \"Group\", then is it interpreted as \"What if User were not a member of any groups",
|
||||
"group": "Groups is the groups you're testing for.",
|
||||
"extra": "Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.",
|
||||
"uid": "UID information about the requesting user.",
|
||||
"": "SubjectAccessReviewSpec is a description of the access request. Exactly one of resourceAttributes and nonResourceAttributes must be set",
|
||||
"resourceAttributes": "resourceAttributes describes information for a resource access request",
|
||||
"nonResourceAttributes": "nonResourceAttributes describes information for a non-resource access request",
|
||||
"user": "user is the user you're testing for. If you specify \"User\" but not \"Group\", then is it interpreted as \"What if User were not a member of any groups",
|
||||
"group": "group is the groups you're testing for.",
|
||||
"extra": "extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.",
|
||||
"uid": "uid information about the requesting user.",
|
||||
}
|
||||
|
||||
func (SubjectAccessReviewSpec) SwaggerDoc() map[string]string {
|
||||
@@ -155,10 +155,10 @@ func (SubjectAccessReviewSpec) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SubjectAccessReviewStatus = map[string]string{
|
||||
"": "SubjectAccessReviewStatus",
|
||||
"allowed": "Allowed is required. True if the action would be allowed, false otherwise.",
|
||||
"denied": "Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",
|
||||
"reason": "Reason is optional. It indicates why a request was allowed or denied.",
|
||||
"evaluationError": "EvaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.",
|
||||
"allowed": "allowed is required. True if the action would be allowed, false otherwise.",
|
||||
"denied": "denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.",
|
||||
"reason": "reason is optional. It indicates why a request was allowed or denied.",
|
||||
"evaluationError": "evaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.",
|
||||
}
|
||||
|
||||
func (SubjectAccessReviewStatus) SwaggerDoc() map[string]string {
|
||||
@@ -167,10 +167,10 @@ func (SubjectAccessReviewStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
var map_SubjectRulesReviewStatus = map[string]string{
|
||||
"": "SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on the set of authorizers the server is configured with and any errors experienced during evaluation. Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission, even if that list is incomplete.",
|
||||
"resourceRules": "ResourceRules is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"nonResourceRules": "NonResourceRules is the list of actions the subject is allowed to perform on non-resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"incomplete": "Incomplete is true when the rules returned by this call are incomplete. This is most commonly encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.",
|
||||
"evaluationError": "EvaluationError can appear in combination with Rules. It indicates an error occurred during rule evaluation, such as an authorizer that doesn't support rule evaluation, and that ResourceRules and/or NonResourceRules may be incomplete.",
|
||||
"resourceRules": "resourceRules is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"nonResourceRules": "nonResourceRules is the list of actions the subject is allowed to perform on non-resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.",
|
||||
"incomplete": "incomplete is true when the rules returned by this call are incomplete. This is most commonly encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.",
|
||||
"evaluationError": "evaluationError can appear in combination with Rules. It indicates an error occurred during rule evaluation, such as an authorizer that doesn't support rule evaluation, and that ResourceRules and/or NonResourceRules may be incomplete.",
|
||||
}
|
||||
|
||||
func (SubjectRulesReviewStatus) SwaggerDoc() map[string]string {
|
||||
|
||||
+9
-3
@@ -148,7 +148,7 @@ message HorizontalPodAutoscaler {
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// spec defines the behaviour of autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
|
||||
// +optional
|
||||
// +required
|
||||
optional HorizontalPodAutoscalerSpec spec = 2;
|
||||
|
||||
// status is the current information about the autoscaler.
|
||||
@@ -202,9 +202,15 @@ message HorizontalPodAutoscalerSpec {
|
||||
// metric is configured. Scaling is active as long as at least one metric value is
|
||||
// available.
|
||||
// +optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
|
||||
optional int32 minReplicas = 2;
|
||||
|
||||
// maxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=1
|
||||
optional int32 maxReplicas = 3;
|
||||
|
||||
// targetCPUUtilizationPercentage is the target average CPU utilization (represented as a percentage of requested CPU) over all the pods;
|
||||
@@ -472,9 +478,9 @@ message Scale {
|
||||
message ScaleSpec {
|
||||
// replicas is the desired number of instances for the scaled object.
|
||||
// +optional
|
||||
// +k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +default=0
|
||||
// +k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=0
|
||||
optional int32 replicas = 1;
|
||||
}
|
||||
|
||||
|
||||
-64
@@ -1,64 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
func (*ContainerResourceMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ContainerResourceMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*CrossVersionObjectReference) ProtoMessage() {}
|
||||
|
||||
func (*ExternalMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ExternalMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscaler) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerCondition) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerList) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerSpec) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerStatus) ProtoMessage() {}
|
||||
|
||||
func (*MetricSpec) ProtoMessage() {}
|
||||
|
||||
func (*MetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*ObjectMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ObjectMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*PodsMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*PodsMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*ResourceMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ResourceMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*Scale) ProtoMessage() {}
|
||||
|
||||
func (*ScaleSpec) ProtoMessage() {}
|
||||
|
||||
func (*ScaleStatus) ProtoMessage() {}
|
||||
+12
-4
@@ -47,9 +47,15 @@ type HorizontalPodAutoscalerSpec struct {
|
||||
// metric is configured. Scaling is active as long as at least one metric value is
|
||||
// available.
|
||||
// +optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
|
||||
MinReplicas *int32 `json:"minReplicas,omitempty" protobuf:"varint,2,opt,name=minReplicas"`
|
||||
|
||||
// maxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=1
|
||||
MaxReplicas int32 `json:"maxReplicas" protobuf:"varint,3,opt,name=maxReplicas"`
|
||||
|
||||
// targetCPUUtilizationPercentage is the target average CPU utilization (represented as a percentage of requested CPU) over all the pods;
|
||||
@@ -93,7 +99,7 @@ type HorizontalPodAutoscaler struct {
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// spec defines the behaviour of autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
|
||||
// +optional
|
||||
// +required
|
||||
Spec HorizontalPodAutoscalerSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// status is the current information about the autoscaler.
|
||||
@@ -117,7 +123,7 @@ type HorizontalPodAutoscalerList struct {
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.2
|
||||
// +k8s:isSubresource=/scale
|
||||
// +k8s:isSubresource="/scale"
|
||||
|
||||
// Scale represents a scaling request for a resource.
|
||||
type Scale struct {
|
||||
@@ -139,9 +145,9 @@ type Scale struct {
|
||||
type ScaleSpec struct {
|
||||
// replicas is the desired number of instances for the scaled object.
|
||||
// +optional
|
||||
// +k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +default=0
|
||||
// +k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=0
|
||||
Replicas int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`
|
||||
}
|
||||
|
||||
@@ -408,6 +414,8 @@ const (
|
||||
// ScalingLimited indicates that the calculated scale based on metrics would be above or
|
||||
// below the range for the HPA, and has thus been capped.
|
||||
ScalingLimited HorizontalPodAutoscalerConditionType = "ScalingLimited"
|
||||
// ScaledToZero indicates that the HPA controller scaled the workload to zero.
|
||||
ScaledToZero HorizontalPodAutoscalerConditionType = "ScaledToZero"
|
||||
)
|
||||
|
||||
// HorizontalPodAutoscalerCondition describes the state of
|
||||
|
||||
+7
-1
@@ -175,7 +175,7 @@ message HorizontalPodAutoscaler {
|
||||
|
||||
// spec is the specification for the behaviour of the autoscaler.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
|
||||
// +optional
|
||||
// +required
|
||||
optional HorizontalPodAutoscalerSpec spec = 2;
|
||||
|
||||
// status is the current information about the autoscaler.
|
||||
@@ -248,10 +248,16 @@ message HorizontalPodAutoscalerSpec {
|
||||
// metric is configured. Scaling is active as long as at least one metric value is
|
||||
// available.
|
||||
// +optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
|
||||
optional int32 minReplicas = 2;
|
||||
|
||||
// maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
|
||||
// It cannot be less that minReplicas.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=1
|
||||
optional int32 maxReplicas = 3;
|
||||
|
||||
// metrics contains the specifications for which to use to calculate the
|
||||
|
||||
-70
@@ -1,70 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v2
|
||||
|
||||
func (*ContainerResourceMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ContainerResourceMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*CrossVersionObjectReference) ProtoMessage() {}
|
||||
|
||||
func (*ExternalMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ExternalMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*HPAScalingPolicy) ProtoMessage() {}
|
||||
|
||||
func (*HPAScalingRules) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscaler) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerBehavior) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerCondition) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerList) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerSpec) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerStatus) ProtoMessage() {}
|
||||
|
||||
func (*MetricIdentifier) ProtoMessage() {}
|
||||
|
||||
func (*MetricSpec) ProtoMessage() {}
|
||||
|
||||
func (*MetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*MetricTarget) ProtoMessage() {}
|
||||
|
||||
func (*MetricValueStatus) ProtoMessage() {}
|
||||
|
||||
func (*ObjectMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ObjectMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*PodsMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*PodsMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*ResourceMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ResourceMetricStatus) ProtoMessage() {}
|
||||
+9
-1
@@ -40,7 +40,7 @@ type HorizontalPodAutoscaler struct {
|
||||
|
||||
// spec is the specification for the behaviour of the autoscaler.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
|
||||
// +optional
|
||||
// +required
|
||||
Spec HorizontalPodAutoscalerSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// status is the current information about the autoscaler.
|
||||
@@ -59,10 +59,16 @@ type HorizontalPodAutoscalerSpec struct {
|
||||
// metric is configured. Scaling is active as long as at least one metric value is
|
||||
// available.
|
||||
// +optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:optional
|
||||
// +k8s:alpha(since: "1.36")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
|
||||
// +k8s:alpha(since: "1.36")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
|
||||
MinReplicas *int32 `json:"minReplicas,omitempty" protobuf:"varint,2,opt,name=minReplicas"`
|
||||
|
||||
// maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
|
||||
// It cannot be less that minReplicas.
|
||||
// +required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:required
|
||||
// +k8s:alpha(since: "1.36")=+k8s:minimum=1
|
||||
MaxReplicas int32 `json:"maxReplicas" protobuf:"varint,3,opt,name=maxReplicas"`
|
||||
|
||||
// metrics contains the specifications for which to use to calculate the
|
||||
@@ -444,6 +450,8 @@ const (
|
||||
// ScalingLimited indicates that the calculated scale based on metrics would be above or
|
||||
// below the range for the HPA, and has thus been capped.
|
||||
ScalingLimited HorizontalPodAutoscalerConditionType = "ScalingLimited"
|
||||
// ScaledToZero indicates that the HPA controller scaled the workload to zero.
|
||||
ScaledToZero HorizontalPodAutoscalerConditionType = "ScaledToZero"
|
||||
)
|
||||
|
||||
// HorizontalPodAutoscalerCondition describes the state of
|
||||
|
||||
-23
@@ -1,23 +0,0 @@
|
||||
/*
|
||||
Copyright 2016 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:protobuf-gen=package
|
||||
// +k8s:openapi-gen=true
|
||||
// +k8s:prerelease-lifecycle-gen=true
|
||||
// +k8s:openapi-model-package=io.k8s.api.autoscaling.v2beta1
|
||||
|
||||
package v2beta1
|
||||
-5106
File diff suppressed because it is too large
Load Diff
-474
@@ -1,474 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
||||
|
||||
syntax = "proto2";
|
||||
|
||||
package k8s.io.api.autoscaling.v2beta1;
|
||||
|
||||
import "k8s.io/api/core/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/api/resource/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/api/autoscaling/v2beta1";
|
||||
|
||||
// ContainerResourceMetricSource indicates how to scale on a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). The values will be averaged
|
||||
// together before being compared to the target. Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source. Only one "target" type
|
||||
// should be set.
|
||||
message ContainerResourceMetricSource {
|
||||
// name is the name of the resource in question.
|
||||
optional string name = 1;
|
||||
|
||||
// targetAverageUtilization is the target value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods.
|
||||
// +optional
|
||||
optional int32 targetAverageUtilization = 2;
|
||||
|
||||
// targetAverageValue is the target value of the average of the
|
||||
// resource metric across all relevant pods, as a raw value (instead of as
|
||||
// a percentage of the request), similar to the "pods" metric source type.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity targetAverageValue = 3;
|
||||
|
||||
// container is the name of the container in the pods of the scaling target
|
||||
optional string container = 4;
|
||||
}
|
||||
|
||||
// ContainerResourceMetricStatus indicates the current value of a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing a single container in each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source.
|
||||
message ContainerResourceMetricStatus {
|
||||
// name is the name of the resource in question.
|
||||
optional string name = 1;
|
||||
|
||||
// currentAverageUtilization is the current value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods. It will only be
|
||||
// present if `targetAverageValue` was set in the corresponding metric
|
||||
// specification.
|
||||
// +optional
|
||||
optional int32 currentAverageUtilization = 2;
|
||||
|
||||
// currentAverageValue is the current value of the average of the
|
||||
// resource metric across all relevant pods, as a raw value (instead of as
|
||||
// a percentage of the request), similar to the "pods" metric source type.
|
||||
// It will always be set, regardless of the corresponding metric specification.
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity currentAverageValue = 3;
|
||||
|
||||
// container is the name of the container in the pods of the scaling target
|
||||
optional string container = 4;
|
||||
}
|
||||
|
||||
// CrossVersionObjectReference contains enough information to let you identify the referred resource.
|
||||
message CrossVersionObjectReference {
|
||||
// Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
optional string kind = 1;
|
||||
|
||||
// Name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
optional string name = 2;
|
||||
|
||||
// API version of the referent
|
||||
// +optional
|
||||
optional string apiVersion = 3;
|
||||
}
|
||||
|
||||
// ExternalMetricSource indicates how to scale on a metric not associated with
|
||||
// any Kubernetes object (for example length of queue in cloud
|
||||
// messaging service, or QPS from loadbalancer running outside of cluster).
|
||||
// Exactly one "target" type should be set.
|
||||
message ExternalMetricSource {
|
||||
// metricName is the name of the metric in question.
|
||||
optional string metricName = 1;
|
||||
|
||||
// metricSelector is used to identify a specific time series
|
||||
// within a given metric.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector metricSelector = 2;
|
||||
|
||||
// targetValue is the target value of the metric (as a quantity).
|
||||
// Mutually exclusive with TargetAverageValue.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity targetValue = 3;
|
||||
|
||||
// targetAverageValue is the target per-pod value of global metric (as a quantity).
|
||||
// Mutually exclusive with TargetValue.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity targetAverageValue = 4;
|
||||
}
|
||||
|
||||
// ExternalMetricStatus indicates the current value of a global metric
|
||||
// not associated with any Kubernetes object.
|
||||
message ExternalMetricStatus {
|
||||
// metricName is the name of a metric used for autoscaling in
|
||||
// metric system.
|
||||
optional string metricName = 1;
|
||||
|
||||
// metricSelector is used to identify a specific time series
|
||||
// within a given metric.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector metricSelector = 2;
|
||||
|
||||
// currentValue is the current value of the metric (as a quantity)
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity currentValue = 3;
|
||||
|
||||
// currentAverageValue is the current value of metric averaged over autoscaled pods.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity currentAverageValue = 4;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscaler is the configuration for a horizontal pod
|
||||
// autoscaler, which automatically manages the replica count of any resource
|
||||
// implementing the scale subresource based on the metrics specified.
|
||||
message HorizontalPodAutoscaler {
|
||||
// metadata is the standard object metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// spec is the specification for the behaviour of the autoscaler.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
|
||||
// +optional
|
||||
optional HorizontalPodAutoscalerSpec spec = 2;
|
||||
|
||||
// status is the current information about the autoscaler.
|
||||
// +optional
|
||||
optional HorizontalPodAutoscalerStatus status = 3;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerCondition describes the state of
|
||||
// a HorizontalPodAutoscaler at a certain point.
|
||||
message HorizontalPodAutoscalerCondition {
|
||||
// type describes the current condition
|
||||
optional string type = 1;
|
||||
|
||||
// status is the status of the condition (True, False, Unknown)
|
||||
optional string status = 2;
|
||||
|
||||
// lastTransitionTime is the last time the condition transitioned from
|
||||
// one status to another
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
|
||||
|
||||
// reason is the reason for the condition's last transition.
|
||||
// +optional
|
||||
optional string reason = 4;
|
||||
|
||||
// message is a human-readable explanation containing details about
|
||||
// the transition
|
||||
// +optional
|
||||
optional string message = 5;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscaler is a list of horizontal pod autoscaler objects.
|
||||
message HorizontalPodAutoscalerList {
|
||||
// metadata is the standard list metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
|
||||
// items is the list of horizontal pod autoscaler objects.
|
||||
repeated HorizontalPodAutoscaler items = 2;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.
|
||||
message HorizontalPodAutoscalerSpec {
|
||||
// scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
|
||||
// should be collected, as well as to actually change the replica count.
|
||||
optional CrossVersionObjectReference scaleTargetRef = 1;
|
||||
|
||||
// minReplicas is the lower limit for the number of replicas to which the autoscaler
|
||||
// can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the
|
||||
// alpha feature gate HPAScaleToZero is enabled and at least one Object or External
|
||||
// metric is configured. Scaling is active as long as at least one metric value is
|
||||
// available.
|
||||
// +optional
|
||||
optional int32 minReplicas = 2;
|
||||
|
||||
// maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
|
||||
// It cannot be less that minReplicas.
|
||||
optional int32 maxReplicas = 3;
|
||||
|
||||
// metrics contains the specifications for which to use to calculate the
|
||||
// desired replica count (the maximum replica count across all metrics will
|
||||
// be used). The desired replica count is calculated multiplying the
|
||||
// ratio between the target value and the current value by the current
|
||||
// number of pods. Ergo, metrics used must decrease as the pod count is
|
||||
// increased, and vice-versa. See the individual metric source types for
|
||||
// more information about how each type of metric must respond.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated MetricSpec metrics = 4;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.
|
||||
message HorizontalPodAutoscalerStatus {
|
||||
// observedGeneration is the most recent generation observed by this autoscaler.
|
||||
// +optional
|
||||
optional int64 observedGeneration = 1;
|
||||
|
||||
// lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods,
|
||||
// used by the autoscaler to control how often the number of pods is changed.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastScaleTime = 2;
|
||||
|
||||
// currentReplicas is current number of replicas of pods managed by this autoscaler,
|
||||
// as last seen by the autoscaler.
|
||||
optional int32 currentReplicas = 3;
|
||||
|
||||
// desiredReplicas is the desired number of replicas of pods managed by this autoscaler,
|
||||
// as last calculated by the autoscaler.
|
||||
optional int32 desiredReplicas = 4;
|
||||
|
||||
// currentMetrics is the last read state of the metrics used by this autoscaler.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated MetricStatus currentMetrics = 5;
|
||||
|
||||
// conditions is the set of conditions required for this autoscaler to scale its target,
|
||||
// and indicates whether or not those conditions are met.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated HorizontalPodAutoscalerCondition conditions = 6;
|
||||
}
|
||||
|
||||
// MetricSpec specifies how to scale based on a single metric
|
||||
// (only `type` and one other matching field should be set at once).
|
||||
message MetricSpec {
|
||||
// type is the type of metric source. It should be one of "ContainerResource",
|
||||
// "External", "Object", "Pods" or "Resource", each mapping to a matching field in the object.
|
||||
optional string type = 1;
|
||||
|
||||
// object refers to a metric describing a single kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
// +optional
|
||||
optional ObjectMetricSource object = 2;
|
||||
|
||||
// pods refers to a metric describing each pod in the current scale target
|
||||
// (for example, transactions-processed-per-second). The values will be
|
||||
// averaged together before being compared to the target value.
|
||||
// +optional
|
||||
optional PodsMetricSource pods = 3;
|
||||
|
||||
// resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
optional ResourceMetricSource resource = 4;
|
||||
|
||||
// container resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing a single container in
|
||||
// each pod of the current scale target (e.g. CPU or memory). Such metrics are
|
||||
// built in to Kubernetes, and have special scaling options on top of those
|
||||
// available to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
optional ContainerResourceMetricSource containerResource = 7;
|
||||
|
||||
// external refers to a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
// +optional
|
||||
optional ExternalMetricSource external = 5;
|
||||
}
|
||||
|
||||
// MetricStatus describes the last-read state of a single metric.
|
||||
message MetricStatus {
|
||||
// type is the type of metric source. It will be one of "ContainerResource",
|
||||
// "External", "Object", "Pods" or "Resource", each corresponds to a matching field in the object.
|
||||
optional string type = 1;
|
||||
|
||||
// object refers to a metric describing a single kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
// +optional
|
||||
optional ObjectMetricStatus object = 2;
|
||||
|
||||
// pods refers to a metric describing each pod in the current scale target
|
||||
// (for example, transactions-processed-per-second). The values will be
|
||||
// averaged together before being compared to the target value.
|
||||
// +optional
|
||||
optional PodsMetricStatus pods = 3;
|
||||
|
||||
// resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
optional ResourceMetricStatus resource = 4;
|
||||
|
||||
// container resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing a single container in each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
optional ContainerResourceMetricStatus containerResource = 7;
|
||||
|
||||
// external refers to a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
// +optional
|
||||
optional ExternalMetricStatus external = 5;
|
||||
}
|
||||
|
||||
// ObjectMetricSource indicates how to scale on a metric describing a
|
||||
// kubernetes object (for example, hits-per-second on an Ingress object).
|
||||
message ObjectMetricSource {
|
||||
// target is the described Kubernetes object.
|
||||
optional CrossVersionObjectReference target = 1;
|
||||
|
||||
// metricName is the name of the metric in question.
|
||||
optional string metricName = 2;
|
||||
|
||||
// targetValue is the target value of the metric (as a quantity).
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity targetValue = 3;
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 4;
|
||||
|
||||
// averageValue is the target value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity averageValue = 5;
|
||||
}
|
||||
|
||||
// ObjectMetricStatus indicates the current value of a metric describing a
|
||||
// kubernetes object (for example, hits-per-second on an Ingress object).
|
||||
message ObjectMetricStatus {
|
||||
// target is the described Kubernetes object.
|
||||
optional CrossVersionObjectReference target = 1;
|
||||
|
||||
// metricName is the name of the metric in question.
|
||||
optional string metricName = 2;
|
||||
|
||||
// currentValue is the current value of the metric (as a quantity).
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity currentValue = 3;
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set in the ObjectMetricSource, it is passed as an additional parameter to the metrics server for more specific metrics scoping.
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 4;
|
||||
|
||||
// averageValue is the current value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity averageValue = 5;
|
||||
}
|
||||
|
||||
// PodsMetricSource indicates how to scale on a metric describing each pod in
|
||||
// the current scale target (for example, transactions-processed-per-second).
|
||||
// The values will be averaged together before being compared to the target
|
||||
// value.
|
||||
message PodsMetricSource {
|
||||
// metricName is the name of the metric in question
|
||||
optional string metricName = 1;
|
||||
|
||||
// targetAverageValue is the target value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity targetAverageValue = 2;
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 3;
|
||||
}
|
||||
|
||||
// PodsMetricStatus indicates the current value of a metric describing each pod in
|
||||
// the current scale target (for example, transactions-processed-per-second).
|
||||
message PodsMetricStatus {
|
||||
// metricName is the name of the metric in question
|
||||
optional string metricName = 1;
|
||||
|
||||
// currentAverageValue is the current value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity currentAverageValue = 2;
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set in the PodsMetricSource, it is passed as an additional parameter to the metrics server for more specific metrics scoping.
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 3;
|
||||
}
|
||||
|
||||
// ResourceMetricSource indicates how to scale on a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). The values will be averaged
|
||||
// together before being compared to the target. Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source. Only one "target" type
|
||||
// should be set.
|
||||
message ResourceMetricSource {
|
||||
// name is the name of the resource in question.
|
||||
optional string name = 1;
|
||||
|
||||
// targetAverageUtilization is the target value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods.
|
||||
// +optional
|
||||
optional int32 targetAverageUtilization = 2;
|
||||
|
||||
// targetAverageValue is the target value of the average of the
|
||||
// resource metric across all relevant pods, as a raw value (instead of as
|
||||
// a percentage of the request), similar to the "pods" metric source type.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity targetAverageValue = 3;
|
||||
}
|
||||
|
||||
// ResourceMetricStatus indicates the current value of a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source.
|
||||
message ResourceMetricStatus {
|
||||
// name is the name of the resource in question.
|
||||
optional string name = 1;
|
||||
|
||||
// currentAverageUtilization is the current value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods. It will only be
|
||||
// present if `targetAverageValue` was set in the corresponding metric
|
||||
// specification.
|
||||
// +optional
|
||||
optional int32 currentAverageUtilization = 2;
|
||||
|
||||
// currentAverageValue is the current value of the average of the
|
||||
// resource metric across all relevant pods, as a raw value (instead of as
|
||||
// a percentage of the request), similar to the "pods" metric source type.
|
||||
// It will always be set, regardless of the corresponding metric specification.
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity currentAverageValue = 3;
|
||||
}
|
||||
|
||||
-58
@@ -1,58 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v2beta1
|
||||
|
||||
func (*ContainerResourceMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ContainerResourceMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*CrossVersionObjectReference) ProtoMessage() {}
|
||||
|
||||
func (*ExternalMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ExternalMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscaler) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerCondition) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerList) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerSpec) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerStatus) ProtoMessage() {}
|
||||
|
||||
func (*MetricSpec) ProtoMessage() {}
|
||||
|
||||
func (*MetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*ObjectMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ObjectMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*PodsMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*PodsMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*ResourceMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ResourceMetricStatus) ProtoMessage() {}
|
||||
-52
@@ -1,52 +0,0 @@
|
||||
/*
|
||||
Copyright 2016 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v2beta1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name use in this package
|
||||
const GroupName = "autoscaling"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v2beta1"}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
var (
|
||||
// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
|
||||
// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
|
||||
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
// Adds the list of known types to the given scheme.
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&HorizontalPodAutoscaler{},
|
||||
&HorizontalPodAutoscalerList{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
}
|
||||
-486
@@ -1,486 +0,0 @@
|
||||
/*
|
||||
Copyright 2016 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v2beta1
|
||||
|
||||
import (
|
||||
v1 "k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/api/resource"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
// CrossVersionObjectReference contains enough information to let you identify the referred resource.
|
||||
type CrossVersionObjectReference struct {
|
||||
// Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
|
||||
// Name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
|
||||
// API version of the referent
|
||||
// +optional
|
||||
APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,3,opt,name=apiVersion"`
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.
|
||||
type HorizontalPodAutoscalerSpec struct {
|
||||
// scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
|
||||
// should be collected, as well as to actually change the replica count.
|
||||
ScaleTargetRef CrossVersionObjectReference `json:"scaleTargetRef" protobuf:"bytes,1,opt,name=scaleTargetRef"`
|
||||
// minReplicas is the lower limit for the number of replicas to which the autoscaler
|
||||
// can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the
|
||||
// alpha feature gate HPAScaleToZero is enabled and at least one Object or External
|
||||
// metric is configured. Scaling is active as long as at least one metric value is
|
||||
// available.
|
||||
// +optional
|
||||
MinReplicas *int32 `json:"minReplicas,omitempty" protobuf:"varint,2,opt,name=minReplicas"`
|
||||
// maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
|
||||
// It cannot be less that minReplicas.
|
||||
MaxReplicas int32 `json:"maxReplicas" protobuf:"varint,3,opt,name=maxReplicas"`
|
||||
// metrics contains the specifications for which to use to calculate the
|
||||
// desired replica count (the maximum replica count across all metrics will
|
||||
// be used). The desired replica count is calculated multiplying the
|
||||
// ratio between the target value and the current value by the current
|
||||
// number of pods. Ergo, metrics used must decrease as the pod count is
|
||||
// increased, and vice-versa. See the individual metric source types for
|
||||
// more information about how each type of metric must respond.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Metrics []MetricSpec `json:"metrics,omitempty" protobuf:"bytes,4,rep,name=metrics"`
|
||||
}
|
||||
|
||||
// MetricSourceType indicates the type of metric.
|
||||
type MetricSourceType string
|
||||
|
||||
const (
|
||||
// ObjectMetricSourceType is a metric describing a kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
ObjectMetricSourceType MetricSourceType = "Object"
|
||||
// PodsMetricSourceType is a metric describing each pod in the current scale
|
||||
// target (for example, transactions-processed-per-second). The values
|
||||
// will be averaged together before being compared to the target value.
|
||||
PodsMetricSourceType MetricSourceType = "Pods"
|
||||
// ResourceMetricSourceType is a resource metric known to Kubernetes, as
|
||||
// specified in requests and limits, describing each pod in the current
|
||||
// scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics (the "pods" source).
|
||||
ResourceMetricSourceType MetricSourceType = "Resource"
|
||||
// ContainerResourceMetricSourceType is a resource metric known to Kubernetes, as
|
||||
// specified in requests and limits, describing a single container in each pod in the current
|
||||
// scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics (the "pods" source).
|
||||
ContainerResourceMetricSourceType MetricSourceType = "ContainerResource"
|
||||
// ExternalMetricSourceType is a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
ExternalMetricSourceType MetricSourceType = "External"
|
||||
)
|
||||
|
||||
// MetricSpec specifies how to scale based on a single metric
|
||||
// (only `type` and one other matching field should be set at once).
|
||||
type MetricSpec struct {
|
||||
// type is the type of metric source. It should be one of "ContainerResource",
|
||||
// "External", "Object", "Pods" or "Resource", each mapping to a matching field in the object.
|
||||
Type MetricSourceType `json:"type" protobuf:"bytes,1,name=type"`
|
||||
|
||||
// object refers to a metric describing a single kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
// +optional
|
||||
Object *ObjectMetricSource `json:"object,omitempty" protobuf:"bytes,2,opt,name=object"`
|
||||
// pods refers to a metric describing each pod in the current scale target
|
||||
// (for example, transactions-processed-per-second). The values will be
|
||||
// averaged together before being compared to the target value.
|
||||
// +optional
|
||||
Pods *PodsMetricSource `json:"pods,omitempty" protobuf:"bytes,3,opt,name=pods"`
|
||||
// resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
Resource *ResourceMetricSource `json:"resource,omitempty" protobuf:"bytes,4,opt,name=resource"`
|
||||
// container resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing a single container in
|
||||
// each pod of the current scale target (e.g. CPU or memory). Such metrics are
|
||||
// built in to Kubernetes, and have special scaling options on top of those
|
||||
// available to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
ContainerResource *ContainerResourceMetricSource `json:"containerResource,omitempty" protobuf:"bytes,7,opt,name=containerResource"`
|
||||
// external refers to a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
// +optional
|
||||
External *ExternalMetricSource `json:"external,omitempty" protobuf:"bytes,5,opt,name=external"`
|
||||
}
|
||||
|
||||
// ObjectMetricSource indicates how to scale on a metric describing a
|
||||
// kubernetes object (for example, hits-per-second on an Ingress object).
|
||||
type ObjectMetricSource struct {
|
||||
// target is the described Kubernetes object.
|
||||
Target CrossVersionObjectReference `json:"target" protobuf:"bytes,1,name=target"`
|
||||
|
||||
// metricName is the name of the metric in question.
|
||||
MetricName string `json:"metricName" protobuf:"bytes,2,name=metricName"`
|
||||
// targetValue is the target value of the metric (as a quantity).
|
||||
TargetValue resource.Quantity `json:"targetValue" protobuf:"bytes,3,name=targetValue"`
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,4,name=selector"`
|
||||
// averageValue is the target value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
// +optional
|
||||
AverageValue *resource.Quantity `json:"averageValue,omitempty" protobuf:"bytes,5,name=averageValue"`
|
||||
}
|
||||
|
||||
// PodsMetricSource indicates how to scale on a metric describing each pod in
|
||||
// the current scale target (for example, transactions-processed-per-second).
|
||||
// The values will be averaged together before being compared to the target
|
||||
// value.
|
||||
type PodsMetricSource struct {
|
||||
// metricName is the name of the metric in question
|
||||
MetricName string `json:"metricName" protobuf:"bytes,1,name=metricName"`
|
||||
// targetAverageValue is the target value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
TargetAverageValue resource.Quantity `json:"targetAverageValue" protobuf:"bytes,2,name=targetAverageValue"`
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,3,name=selector"`
|
||||
}
|
||||
|
||||
// ResourceMetricSource indicates how to scale on a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). The values will be averaged
|
||||
// together before being compared to the target. Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source. Only one "target" type
|
||||
// should be set.
|
||||
type ResourceMetricSource struct {
|
||||
// name is the name of the resource in question.
|
||||
Name v1.ResourceName `json:"name" protobuf:"bytes,1,name=name"`
|
||||
// targetAverageUtilization is the target value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods.
|
||||
// +optional
|
||||
TargetAverageUtilization *int32 `json:"targetAverageUtilization,omitempty" protobuf:"varint,2,opt,name=targetAverageUtilization"`
|
||||
// targetAverageValue is the target value of the average of the
|
||||
// resource metric across all relevant pods, as a raw value (instead of as
|
||||
// a percentage of the request), similar to the "pods" metric source type.
|
||||
// +optional
|
||||
TargetAverageValue *resource.Quantity `json:"targetAverageValue,omitempty" protobuf:"bytes,3,opt,name=targetAverageValue"`
|
||||
}
|
||||
|
||||
// ContainerResourceMetricSource indicates how to scale on a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). The values will be averaged
|
||||
// together before being compared to the target. Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source. Only one "target" type
|
||||
// should be set.
|
||||
type ContainerResourceMetricSource struct {
|
||||
// name is the name of the resource in question.
|
||||
Name v1.ResourceName `json:"name" protobuf:"bytes,1,name=name"`
|
||||
// targetAverageUtilization is the target value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods.
|
||||
// +optional
|
||||
TargetAverageUtilization *int32 `json:"targetAverageUtilization,omitempty" protobuf:"varint,2,opt,name=targetAverageUtilization"`
|
||||
// targetAverageValue is the target value of the average of the
|
||||
// resource metric across all relevant pods, as a raw value (instead of as
|
||||
// a percentage of the request), similar to the "pods" metric source type.
|
||||
// +optional
|
||||
TargetAverageValue *resource.Quantity `json:"targetAverageValue,omitempty" protobuf:"bytes,3,opt,name=targetAverageValue"`
|
||||
// container is the name of the container in the pods of the scaling target
|
||||
Container string `json:"container" protobuf:"bytes,4,opt,name=container"`
|
||||
}
|
||||
|
||||
// ExternalMetricSource indicates how to scale on a metric not associated with
|
||||
// any Kubernetes object (for example length of queue in cloud
|
||||
// messaging service, or QPS from loadbalancer running outside of cluster).
|
||||
// Exactly one "target" type should be set.
|
||||
type ExternalMetricSource struct {
|
||||
// metricName is the name of the metric in question.
|
||||
MetricName string `json:"metricName" protobuf:"bytes,1,name=metricName"`
|
||||
// metricSelector is used to identify a specific time series
|
||||
// within a given metric.
|
||||
// +optional
|
||||
MetricSelector *metav1.LabelSelector `json:"metricSelector,omitempty" protobuf:"bytes,2,opt,name=metricSelector"`
|
||||
// targetValue is the target value of the metric (as a quantity).
|
||||
// Mutually exclusive with TargetAverageValue.
|
||||
// +optional
|
||||
TargetValue *resource.Quantity `json:"targetValue,omitempty" protobuf:"bytes,3,opt,name=targetValue"`
|
||||
// targetAverageValue is the target per-pod value of global metric (as a quantity).
|
||||
// Mutually exclusive with TargetValue.
|
||||
// +optional
|
||||
TargetAverageValue *resource.Quantity `json:"targetAverageValue,omitempty" protobuf:"bytes,4,opt,name=targetAverageValue"`
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.
|
||||
type HorizontalPodAutoscalerStatus struct {
|
||||
// observedGeneration is the most recent generation observed by this autoscaler.
|
||||
// +optional
|
||||
ObservedGeneration *int64 `json:"observedGeneration,omitempty" protobuf:"varint,1,opt,name=observedGeneration"`
|
||||
|
||||
// lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods,
|
||||
// used by the autoscaler to control how often the number of pods is changed.
|
||||
// +optional
|
||||
LastScaleTime *metav1.Time `json:"lastScaleTime,omitempty" protobuf:"bytes,2,opt,name=lastScaleTime"`
|
||||
|
||||
// currentReplicas is current number of replicas of pods managed by this autoscaler,
|
||||
// as last seen by the autoscaler.
|
||||
CurrentReplicas int32 `json:"currentReplicas" protobuf:"varint,3,opt,name=currentReplicas"`
|
||||
|
||||
// desiredReplicas is the desired number of replicas of pods managed by this autoscaler,
|
||||
// as last calculated by the autoscaler.
|
||||
DesiredReplicas int32 `json:"desiredReplicas" protobuf:"varint,4,opt,name=desiredReplicas"`
|
||||
|
||||
// currentMetrics is the last read state of the metrics used by this autoscaler.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
CurrentMetrics []MetricStatus `json:"currentMetrics" protobuf:"bytes,5,rep,name=currentMetrics"`
|
||||
|
||||
// conditions is the set of conditions required for this autoscaler to scale its target,
|
||||
// and indicates whether or not those conditions are met.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Conditions []HorizontalPodAutoscalerCondition `json:"conditions" protobuf:"bytes,6,rep,name=conditions"`
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerConditionType are the valid conditions of
|
||||
// a HorizontalPodAutoscaler.
|
||||
type HorizontalPodAutoscalerConditionType string
|
||||
|
||||
const (
|
||||
// ScalingActive indicates that the HPA controller is able to scale if necessary:
|
||||
// it's correctly configured, can fetch the desired metrics, and isn't disabled.
|
||||
ScalingActive HorizontalPodAutoscalerConditionType = "ScalingActive"
|
||||
// AbleToScale indicates a lack of transient issues which prevent scaling from occurring,
|
||||
// such as being in a backoff window, or being unable to access/update the target scale.
|
||||
AbleToScale HorizontalPodAutoscalerConditionType = "AbleToScale"
|
||||
// ScalingLimited indicates that the calculated scale based on metrics would be above or
|
||||
// below the range for the HPA, and has thus been capped.
|
||||
ScalingLimited HorizontalPodAutoscalerConditionType = "ScalingLimited"
|
||||
)
|
||||
|
||||
// HorizontalPodAutoscalerCondition describes the state of
|
||||
// a HorizontalPodAutoscaler at a certain point.
|
||||
type HorizontalPodAutoscalerCondition struct {
|
||||
// type describes the current condition
|
||||
Type HorizontalPodAutoscalerConditionType `json:"type" protobuf:"bytes,1,name=type"`
|
||||
// status is the status of the condition (True, False, Unknown)
|
||||
Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,name=status"`
|
||||
// lastTransitionTime is the last time the condition transitioned from
|
||||
// one status to another
|
||||
// +optional
|
||||
LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
|
||||
// reason is the reason for the condition's last transition.
|
||||
// +optional
|
||||
Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
|
||||
// message is a human-readable explanation containing details about
|
||||
// the transition
|
||||
// +optional
|
||||
Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
|
||||
}
|
||||
|
||||
// MetricStatus describes the last-read state of a single metric.
|
||||
type MetricStatus struct {
|
||||
// type is the type of metric source. It will be one of "ContainerResource",
|
||||
// "External", "Object", "Pods" or "Resource", each corresponds to a matching field in the object.
|
||||
Type MetricSourceType `json:"type" protobuf:"bytes,1,name=type"`
|
||||
|
||||
// object refers to a metric describing a single kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
// +optional
|
||||
Object *ObjectMetricStatus `json:"object,omitempty" protobuf:"bytes,2,opt,name=object"`
|
||||
// pods refers to a metric describing each pod in the current scale target
|
||||
// (for example, transactions-processed-per-second). The values will be
|
||||
// averaged together before being compared to the target value.
|
||||
// +optional
|
||||
Pods *PodsMetricStatus `json:"pods,omitempty" protobuf:"bytes,3,opt,name=pods"`
|
||||
// resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
Resource *ResourceMetricStatus `json:"resource,omitempty" protobuf:"bytes,4,opt,name=resource"`
|
||||
// container resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing a single container in each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
ContainerResource *ContainerResourceMetricStatus `json:"containerResource,omitempty" protobuf:"bytes,7,opt,name=containerResource"`
|
||||
// external refers to a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
// +optional
|
||||
External *ExternalMetricStatus `json:"external,omitempty" protobuf:"bytes,5,opt,name=external"`
|
||||
}
|
||||
|
||||
// ObjectMetricStatus indicates the current value of a metric describing a
|
||||
// kubernetes object (for example, hits-per-second on an Ingress object).
|
||||
type ObjectMetricStatus struct {
|
||||
// target is the described Kubernetes object.
|
||||
Target CrossVersionObjectReference `json:"target" protobuf:"bytes,1,name=target"`
|
||||
|
||||
// metricName is the name of the metric in question.
|
||||
MetricName string `json:"metricName" protobuf:"bytes,2,name=metricName"`
|
||||
// currentValue is the current value of the metric (as a quantity).
|
||||
CurrentValue resource.Quantity `json:"currentValue" protobuf:"bytes,3,name=currentValue"`
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set in the ObjectMetricSource, it is passed as an additional parameter to the metrics server for more specific metrics scoping.
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,4,name=selector"`
|
||||
// averageValue is the current value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
// +optional
|
||||
AverageValue *resource.Quantity `json:"averageValue,omitempty" protobuf:"bytes,5,name=averageValue"`
|
||||
}
|
||||
|
||||
// PodsMetricStatus indicates the current value of a metric describing each pod in
|
||||
// the current scale target (for example, transactions-processed-per-second).
|
||||
type PodsMetricStatus struct {
|
||||
// metricName is the name of the metric in question
|
||||
MetricName string `json:"metricName" protobuf:"bytes,1,name=metricName"`
|
||||
// currentAverageValue is the current value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
CurrentAverageValue resource.Quantity `json:"currentAverageValue" protobuf:"bytes,2,name=currentAverageValue"`
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set in the PodsMetricSource, it is passed as an additional parameter to the metrics server for more specific metrics scoping.
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,3,name=selector"`
|
||||
}
|
||||
|
||||
// ResourceMetricStatus indicates the current value of a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source.
|
||||
type ResourceMetricStatus struct {
|
||||
// name is the name of the resource in question.
|
||||
Name v1.ResourceName `json:"name" protobuf:"bytes,1,name=name"`
|
||||
// currentAverageUtilization is the current value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods. It will only be
|
||||
// present if `targetAverageValue` was set in the corresponding metric
|
||||
// specification.
|
||||
// +optional
|
||||
CurrentAverageUtilization *int32 `json:"currentAverageUtilization,omitempty" protobuf:"bytes,2,opt,name=currentAverageUtilization"`
|
||||
// currentAverageValue is the current value of the average of the
|
||||
// resource metric across all relevant pods, as a raw value (instead of as
|
||||
// a percentage of the request), similar to the "pods" metric source type.
|
||||
// It will always be set, regardless of the corresponding metric specification.
|
||||
CurrentAverageValue resource.Quantity `json:"currentAverageValue" protobuf:"bytes,3,name=currentAverageValue"`
|
||||
}
|
||||
|
||||
// ContainerResourceMetricStatus indicates the current value of a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing a single container in each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source.
|
||||
type ContainerResourceMetricStatus struct {
|
||||
// name is the name of the resource in question.
|
||||
Name v1.ResourceName `json:"name" protobuf:"bytes,1,name=name"`
|
||||
// currentAverageUtilization is the current value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods. It will only be
|
||||
// present if `targetAverageValue` was set in the corresponding metric
|
||||
// specification.
|
||||
// +optional
|
||||
CurrentAverageUtilization *int32 `json:"currentAverageUtilization,omitempty" protobuf:"bytes,2,opt,name=currentAverageUtilization"`
|
||||
// currentAverageValue is the current value of the average of the
|
||||
// resource metric across all relevant pods, as a raw value (instead of as
|
||||
// a percentage of the request), similar to the "pods" metric source type.
|
||||
// It will always be set, regardless of the corresponding metric specification.
|
||||
CurrentAverageValue resource.Quantity `json:"currentAverageValue" protobuf:"bytes,3,name=currentAverageValue"`
|
||||
// container is the name of the container in the pods of the scaling target
|
||||
Container string `json:"container" protobuf:"bytes,4,opt,name=container"`
|
||||
}
|
||||
|
||||
// ExternalMetricStatus indicates the current value of a global metric
|
||||
// not associated with any Kubernetes object.
|
||||
type ExternalMetricStatus struct {
|
||||
// metricName is the name of a metric used for autoscaling in
|
||||
// metric system.
|
||||
MetricName string `json:"metricName" protobuf:"bytes,1,name=metricName"`
|
||||
// metricSelector is used to identify a specific time series
|
||||
// within a given metric.
|
||||
// +optional
|
||||
MetricSelector *metav1.LabelSelector `json:"metricSelector,omitempty" protobuf:"bytes,2,opt,name=metricSelector"`
|
||||
// currentValue is the current value of the metric (as a quantity)
|
||||
CurrentValue resource.Quantity `json:"currentValue" protobuf:"bytes,3,name=currentValue"`
|
||||
// currentAverageValue is the current value of metric averaged over autoscaled pods.
|
||||
// +optional
|
||||
CurrentAverageValue *resource.Quantity `json:"currentAverageValue,omitempty" protobuf:"bytes,4,opt,name=currentAverageValue"`
|
||||
}
|
||||
|
||||
// +genclient
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.8
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.22
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=autoscaling,v2,HorizontalPodAutoscaler
|
||||
|
||||
// HorizontalPodAutoscaler is the configuration for a horizontal pod
|
||||
// autoscaler, which automatically manages the replica count of any resource
|
||||
// implementing the scale subresource based on the metrics specified.
|
||||
type HorizontalPodAutoscaler struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// metadata is the standard object metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// spec is the specification for the behaviour of the autoscaler.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
|
||||
// +optional
|
||||
Spec HorizontalPodAutoscalerSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// status is the current information about the autoscaler.
|
||||
// +optional
|
||||
Status HorizontalPodAutoscalerStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.8
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.22
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=autoscaling,v2beta2,HorizontalPodAutoscalerList
|
||||
|
||||
// HorizontalPodAutoscaler is a list of horizontal pod autoscaler objects.
|
||||
type HorizontalPodAutoscalerList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// metadata is the standard list metadata.
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// items is the list of horizontal pod autoscaler objects.
|
||||
Items []HorizontalPodAutoscaler `json:"items" protobuf:"bytes,2,rep,name=items"`
|
||||
}
|
||||
-247
@@ -1,247 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v2beta1
|
||||
|
||||
// This file contains a collection of methods that can be used from go-restful to
|
||||
// generate Swagger API documentation for its models. Please read this PR for more
|
||||
// information on the implementation: https://github.com/emicklei/go-restful/pull/215
|
||||
//
|
||||
// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
|
||||
// they are on one line! For multiple line or blocks that you want to ignore use ---.
|
||||
// Any context after a --- is ignored.
|
||||
//
|
||||
// Those methods can be generated by using hack/update-codegen.sh
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_ContainerResourceMetricSource = map[string]string{
|
||||
"": "ContainerResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source. Only one \"target\" type should be set.",
|
||||
"name": "name is the name of the resource in question.",
|
||||
"targetAverageUtilization": "targetAverageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.",
|
||||
"targetAverageValue": "targetAverageValue is the target value of the average of the resource metric across all relevant pods, as a raw value (instead of as a percentage of the request), similar to the \"pods\" metric source type.",
|
||||
"container": "container is the name of the container in the pods of the scaling target",
|
||||
}
|
||||
|
||||
func (ContainerResourceMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_ContainerResourceMetricSource
|
||||
}
|
||||
|
||||
var map_ContainerResourceMetricStatus = map[string]string{
|
||||
"": "ContainerResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"name": "name is the name of the resource in question.",
|
||||
"currentAverageUtilization": "currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. It will only be present if `targetAverageValue` was set in the corresponding metric specification.",
|
||||
"currentAverageValue": "currentAverageValue is the current value of the average of the resource metric across all relevant pods, as a raw value (instead of as a percentage of the request), similar to the \"pods\" metric source type. It will always be set, regardless of the corresponding metric specification.",
|
||||
"container": "container is the name of the container in the pods of the scaling target",
|
||||
}
|
||||
|
||||
func (ContainerResourceMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_ContainerResourceMetricStatus
|
||||
}
|
||||
|
||||
var map_CrossVersionObjectReference = map[string]string{
|
||||
"": "CrossVersionObjectReference contains enough information to let you identify the referred resource.",
|
||||
"kind": "Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"name": "Name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"apiVersion": "API version of the referent",
|
||||
}
|
||||
|
||||
func (CrossVersionObjectReference) SwaggerDoc() map[string]string {
|
||||
return map_CrossVersionObjectReference
|
||||
}
|
||||
|
||||
var map_ExternalMetricSource = map[string]string{
|
||||
"": "ExternalMetricSource indicates how to scale on a metric not associated with any Kubernetes object (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster). Exactly one \"target\" type should be set.",
|
||||
"metricName": "metricName is the name of the metric in question.",
|
||||
"metricSelector": "metricSelector is used to identify a specific time series within a given metric.",
|
||||
"targetValue": "targetValue is the target value of the metric (as a quantity). Mutually exclusive with TargetAverageValue.",
|
||||
"targetAverageValue": "targetAverageValue is the target per-pod value of global metric (as a quantity). Mutually exclusive with TargetValue.",
|
||||
}
|
||||
|
||||
func (ExternalMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_ExternalMetricSource
|
||||
}
|
||||
|
||||
var map_ExternalMetricStatus = map[string]string{
|
||||
"": "ExternalMetricStatus indicates the current value of a global metric not associated with any Kubernetes object.",
|
||||
"metricName": "metricName is the name of a metric used for autoscaling in metric system.",
|
||||
"metricSelector": "metricSelector is used to identify a specific time series within a given metric.",
|
||||
"currentValue": "currentValue is the current value of the metric (as a quantity)",
|
||||
"currentAverageValue": "currentAverageValue is the current value of metric averaged over autoscaled pods.",
|
||||
}
|
||||
|
||||
func (ExternalMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_ExternalMetricStatus
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscaler = map[string]string{
|
||||
"": "HorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified.",
|
||||
"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec is the specification for the behaviour of the autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.",
|
||||
"status": "status is the current information about the autoscaler.",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscaler) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscaler
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscalerCondition = map[string]string{
|
||||
"": "HorizontalPodAutoscalerCondition describes the state of a HorizontalPodAutoscaler at a certain point.",
|
||||
"type": "type describes the current condition",
|
||||
"status": "status is the status of the condition (True, False, Unknown)",
|
||||
"lastTransitionTime": "lastTransitionTime is the last time the condition transitioned from one status to another",
|
||||
"reason": "reason is the reason for the condition's last transition.",
|
||||
"message": "message is a human-readable explanation containing details about the transition",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscalerCondition) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscalerCondition
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscalerList = map[string]string{
|
||||
"": "HorizontalPodAutoscaler is a list of horizontal pod autoscaler objects.",
|
||||
"metadata": "metadata is the standard list metadata.",
|
||||
"items": "items is the list of horizontal pod autoscaler objects.",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscalerList) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscalerList
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscalerSpec = map[string]string{
|
||||
"": "HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.",
|
||||
"scaleTargetRef": "scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics should be collected, as well as to actually change the replica count.",
|
||||
"minReplicas": "minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.",
|
||||
"maxReplicas": "maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up. It cannot be less that minReplicas.",
|
||||
"metrics": "metrics contains the specifications for which to use to calculate the desired replica count (the maximum replica count across all metrics will be used). The desired replica count is calculated multiplying the ratio between the target value and the current value by the current number of pods. Ergo, metrics used must decrease as the pod count is increased, and vice-versa. See the individual metric source types for more information about how each type of metric must respond.",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscalerSpec) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscalerSpec
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscalerStatus = map[string]string{
|
||||
"": "HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.",
|
||||
"observedGeneration": "observedGeneration is the most recent generation observed by this autoscaler.",
|
||||
"lastScaleTime": "lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods, used by the autoscaler to control how often the number of pods is changed.",
|
||||
"currentReplicas": "currentReplicas is current number of replicas of pods managed by this autoscaler, as last seen by the autoscaler.",
|
||||
"desiredReplicas": "desiredReplicas is the desired number of replicas of pods managed by this autoscaler, as last calculated by the autoscaler.",
|
||||
"currentMetrics": "currentMetrics is the last read state of the metrics used by this autoscaler.",
|
||||
"conditions": "conditions is the set of conditions required for this autoscaler to scale its target, and indicates whether or not those conditions are met.",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscalerStatus) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscalerStatus
|
||||
}
|
||||
|
||||
var map_MetricSpec = map[string]string{
|
||||
"": "MetricSpec specifies how to scale based on a single metric (only `type` and one other matching field should be set at once).",
|
||||
"type": "type is the type of metric source. It should be one of \"ContainerResource\", \"External\", \"Object\", \"Pods\" or \"Resource\", each mapping to a matching field in the object.",
|
||||
"object": "object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).",
|
||||
"pods": "pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.",
|
||||
"resource": "resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"containerResource": "container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod of the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"external": "external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).",
|
||||
}
|
||||
|
||||
func (MetricSpec) SwaggerDoc() map[string]string {
|
||||
return map_MetricSpec
|
||||
}
|
||||
|
||||
var map_MetricStatus = map[string]string{
|
||||
"": "MetricStatus describes the last-read state of a single metric.",
|
||||
"type": "type is the type of metric source. It will be one of \"ContainerResource\", \"External\", \"Object\", \"Pods\" or \"Resource\", each corresponds to a matching field in the object.",
|
||||
"object": "object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).",
|
||||
"pods": "pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.",
|
||||
"resource": "resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"containerResource": "container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"external": "external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).",
|
||||
}
|
||||
|
||||
func (MetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_MetricStatus
|
||||
}
|
||||
|
||||
var map_ObjectMetricSource = map[string]string{
|
||||
"": "ObjectMetricSource indicates how to scale on a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).",
|
||||
"target": "target is the described Kubernetes object.",
|
||||
"metricName": "metricName is the name of the metric in question.",
|
||||
"targetValue": "targetValue is the target value of the metric (as a quantity).",
|
||||
"selector": "selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping When unset, just the metricName will be used to gather metrics.",
|
||||
"averageValue": "averageValue is the target value of the average of the metric across all relevant pods (as a quantity)",
|
||||
}
|
||||
|
||||
func (ObjectMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_ObjectMetricSource
|
||||
}
|
||||
|
||||
var map_ObjectMetricStatus = map[string]string{
|
||||
"": "ObjectMetricStatus indicates the current value of a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).",
|
||||
"target": "target is the described Kubernetes object.",
|
||||
"metricName": "metricName is the name of the metric in question.",
|
||||
"currentValue": "currentValue is the current value of the metric (as a quantity).",
|
||||
"selector": "selector is the string-encoded form of a standard kubernetes label selector for the given metric When set in the ObjectMetricSource, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.",
|
||||
"averageValue": "averageValue is the current value of the average of the metric across all relevant pods (as a quantity)",
|
||||
}
|
||||
|
||||
func (ObjectMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_ObjectMetricStatus
|
||||
}
|
||||
|
||||
var map_PodsMetricSource = map[string]string{
|
||||
"": "PodsMetricSource indicates how to scale on a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.",
|
||||
"metricName": "metricName is the name of the metric in question",
|
||||
"targetAverageValue": "targetAverageValue is the target value of the average of the metric across all relevant pods (as a quantity)",
|
||||
"selector": "selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping When unset, just the metricName will be used to gather metrics.",
|
||||
}
|
||||
|
||||
func (PodsMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_PodsMetricSource
|
||||
}
|
||||
|
||||
var map_PodsMetricStatus = map[string]string{
|
||||
"": "PodsMetricStatus indicates the current value of a metric describing each pod in the current scale target (for example, transactions-processed-per-second).",
|
||||
"metricName": "metricName is the name of the metric in question",
|
||||
"currentAverageValue": "currentAverageValue is the current value of the average of the metric across all relevant pods (as a quantity)",
|
||||
"selector": "selector is the string-encoded form of a standard kubernetes label selector for the given metric When set in the PodsMetricSource, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.",
|
||||
}
|
||||
|
||||
func (PodsMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_PodsMetricStatus
|
||||
}
|
||||
|
||||
var map_ResourceMetricSource = map[string]string{
|
||||
"": "ResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source. Only one \"target\" type should be set.",
|
||||
"name": "name is the name of the resource in question.",
|
||||
"targetAverageUtilization": "targetAverageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.",
|
||||
"targetAverageValue": "targetAverageValue is the target value of the average of the resource metric across all relevant pods, as a raw value (instead of as a percentage of the request), similar to the \"pods\" metric source type.",
|
||||
}
|
||||
|
||||
func (ResourceMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_ResourceMetricSource
|
||||
}
|
||||
|
||||
var map_ResourceMetricStatus = map[string]string{
|
||||
"": "ResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"name": "name is the name of the resource in question.",
|
||||
"currentAverageUtilization": "currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. It will only be present if `targetAverageValue` was set in the corresponding metric specification.",
|
||||
"currentAverageValue": "currentAverageValue is the current value of the average of the resource metric across all relevant pods, as a raw value (instead of as a percentage of the request), similar to the \"pods\" metric source type. It will always be set, regardless of the corresponding metric specification.",
|
||||
}
|
||||
|
||||
func (ResourceMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_ResourceMetricStatus
|
||||
}
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS END HERE
|
||||
-525
@@ -1,525 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v2beta1
|
||||
|
||||
import (
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ContainerResourceMetricSource) DeepCopyInto(out *ContainerResourceMetricSource) {
|
||||
*out = *in
|
||||
if in.TargetAverageUtilization != nil {
|
||||
in, out := &in.TargetAverageUtilization, &out.TargetAverageUtilization
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
if in.TargetAverageValue != nil {
|
||||
in, out := &in.TargetAverageValue, &out.TargetAverageValue
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ContainerResourceMetricSource.
|
||||
func (in *ContainerResourceMetricSource) DeepCopy() *ContainerResourceMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ContainerResourceMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ContainerResourceMetricStatus) DeepCopyInto(out *ContainerResourceMetricStatus) {
|
||||
*out = *in
|
||||
if in.CurrentAverageUtilization != nil {
|
||||
in, out := &in.CurrentAverageUtilization, &out.CurrentAverageUtilization
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
out.CurrentAverageValue = in.CurrentAverageValue.DeepCopy()
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ContainerResourceMetricStatus.
|
||||
func (in *ContainerResourceMetricStatus) DeepCopy() *ContainerResourceMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ContainerResourceMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *CrossVersionObjectReference) DeepCopyInto(out *CrossVersionObjectReference) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CrossVersionObjectReference.
|
||||
func (in *CrossVersionObjectReference) DeepCopy() *CrossVersionObjectReference {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(CrossVersionObjectReference)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ExternalMetricSource) DeepCopyInto(out *ExternalMetricSource) {
|
||||
*out = *in
|
||||
if in.MetricSelector != nil {
|
||||
in, out := &in.MetricSelector, &out.MetricSelector
|
||||
*out = new(v1.LabelSelector)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.TargetValue != nil {
|
||||
in, out := &in.TargetValue, &out.TargetValue
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
if in.TargetAverageValue != nil {
|
||||
in, out := &in.TargetAverageValue, &out.TargetAverageValue
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalMetricSource.
|
||||
func (in *ExternalMetricSource) DeepCopy() *ExternalMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ExternalMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ExternalMetricStatus) DeepCopyInto(out *ExternalMetricStatus) {
|
||||
*out = *in
|
||||
if in.MetricSelector != nil {
|
||||
in, out := &in.MetricSelector, &out.MetricSelector
|
||||
*out = new(v1.LabelSelector)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
out.CurrentValue = in.CurrentValue.DeepCopy()
|
||||
if in.CurrentAverageValue != nil {
|
||||
in, out := &in.CurrentAverageValue, &out.CurrentAverageValue
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalMetricStatus.
|
||||
func (in *ExternalMetricStatus) DeepCopy() *ExternalMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ExternalMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscaler) DeepCopyInto(out *HorizontalPodAutoscaler) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
in.Spec.DeepCopyInto(&out.Spec)
|
||||
in.Status.DeepCopyInto(&out.Status)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscaler.
|
||||
func (in *HorizontalPodAutoscaler) DeepCopy() *HorizontalPodAutoscaler {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscaler)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *HorizontalPodAutoscaler) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscalerCondition) DeepCopyInto(out *HorizontalPodAutoscalerCondition) {
|
||||
*out = *in
|
||||
in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscalerCondition.
|
||||
func (in *HorizontalPodAutoscalerCondition) DeepCopy() *HorizontalPodAutoscalerCondition {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscalerCondition)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscalerList) DeepCopyInto(out *HorizontalPodAutoscalerList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]HorizontalPodAutoscaler, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscalerList.
|
||||
func (in *HorizontalPodAutoscalerList) DeepCopy() *HorizontalPodAutoscalerList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscalerList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *HorizontalPodAutoscalerList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscalerSpec) DeepCopyInto(out *HorizontalPodAutoscalerSpec) {
|
||||
*out = *in
|
||||
out.ScaleTargetRef = in.ScaleTargetRef
|
||||
if in.MinReplicas != nil {
|
||||
in, out := &in.MinReplicas, &out.MinReplicas
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
if in.Metrics != nil {
|
||||
in, out := &in.Metrics, &out.Metrics
|
||||
*out = make([]MetricSpec, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscalerSpec.
|
||||
func (in *HorizontalPodAutoscalerSpec) DeepCopy() *HorizontalPodAutoscalerSpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscalerSpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscalerStatus) DeepCopyInto(out *HorizontalPodAutoscalerStatus) {
|
||||
*out = *in
|
||||
if in.ObservedGeneration != nil {
|
||||
in, out := &in.ObservedGeneration, &out.ObservedGeneration
|
||||
*out = new(int64)
|
||||
**out = **in
|
||||
}
|
||||
if in.LastScaleTime != nil {
|
||||
in, out := &in.LastScaleTime, &out.LastScaleTime
|
||||
*out = (*in).DeepCopy()
|
||||
}
|
||||
if in.CurrentMetrics != nil {
|
||||
in, out := &in.CurrentMetrics, &out.CurrentMetrics
|
||||
*out = make([]MetricStatus, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
if in.Conditions != nil {
|
||||
in, out := &in.Conditions, &out.Conditions
|
||||
*out = make([]HorizontalPodAutoscalerCondition, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscalerStatus.
|
||||
func (in *HorizontalPodAutoscalerStatus) DeepCopy() *HorizontalPodAutoscalerStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscalerStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MetricSpec) DeepCopyInto(out *MetricSpec) {
|
||||
*out = *in
|
||||
if in.Object != nil {
|
||||
in, out := &in.Object, &out.Object
|
||||
*out = new(ObjectMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Pods != nil {
|
||||
in, out := &in.Pods, &out.Pods
|
||||
*out = new(PodsMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Resource != nil {
|
||||
in, out := &in.Resource, &out.Resource
|
||||
*out = new(ResourceMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.ContainerResource != nil {
|
||||
in, out := &in.ContainerResource, &out.ContainerResource
|
||||
*out = new(ContainerResourceMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.External != nil {
|
||||
in, out := &in.External, &out.External
|
||||
*out = new(ExternalMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricSpec.
|
||||
func (in *MetricSpec) DeepCopy() *MetricSpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MetricSpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MetricStatus) DeepCopyInto(out *MetricStatus) {
|
||||
*out = *in
|
||||
if in.Object != nil {
|
||||
in, out := &in.Object, &out.Object
|
||||
*out = new(ObjectMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Pods != nil {
|
||||
in, out := &in.Pods, &out.Pods
|
||||
*out = new(PodsMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Resource != nil {
|
||||
in, out := &in.Resource, &out.Resource
|
||||
*out = new(ResourceMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.ContainerResource != nil {
|
||||
in, out := &in.ContainerResource, &out.ContainerResource
|
||||
*out = new(ContainerResourceMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.External != nil {
|
||||
in, out := &in.External, &out.External
|
||||
*out = new(ExternalMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricStatus.
|
||||
func (in *MetricStatus) DeepCopy() *MetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ObjectMetricSource) DeepCopyInto(out *ObjectMetricSource) {
|
||||
*out = *in
|
||||
out.Target = in.Target
|
||||
out.TargetValue = in.TargetValue.DeepCopy()
|
||||
if in.Selector != nil {
|
||||
in, out := &in.Selector, &out.Selector
|
||||
*out = new(v1.LabelSelector)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.AverageValue != nil {
|
||||
in, out := &in.AverageValue, &out.AverageValue
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectMetricSource.
|
||||
func (in *ObjectMetricSource) DeepCopy() *ObjectMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ObjectMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ObjectMetricStatus) DeepCopyInto(out *ObjectMetricStatus) {
|
||||
*out = *in
|
||||
out.Target = in.Target
|
||||
out.CurrentValue = in.CurrentValue.DeepCopy()
|
||||
if in.Selector != nil {
|
||||
in, out := &in.Selector, &out.Selector
|
||||
*out = new(v1.LabelSelector)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.AverageValue != nil {
|
||||
in, out := &in.AverageValue, &out.AverageValue
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectMetricStatus.
|
||||
func (in *ObjectMetricStatus) DeepCopy() *ObjectMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ObjectMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *PodsMetricSource) DeepCopyInto(out *PodsMetricSource) {
|
||||
*out = *in
|
||||
out.TargetAverageValue = in.TargetAverageValue.DeepCopy()
|
||||
if in.Selector != nil {
|
||||
in, out := &in.Selector, &out.Selector
|
||||
*out = new(v1.LabelSelector)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodsMetricSource.
|
||||
func (in *PodsMetricSource) DeepCopy() *PodsMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(PodsMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *PodsMetricStatus) DeepCopyInto(out *PodsMetricStatus) {
|
||||
*out = *in
|
||||
out.CurrentAverageValue = in.CurrentAverageValue.DeepCopy()
|
||||
if in.Selector != nil {
|
||||
in, out := &in.Selector, &out.Selector
|
||||
*out = new(v1.LabelSelector)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodsMetricStatus.
|
||||
func (in *PodsMetricStatus) DeepCopy() *PodsMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(PodsMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ResourceMetricSource) DeepCopyInto(out *ResourceMetricSource) {
|
||||
*out = *in
|
||||
if in.TargetAverageUtilization != nil {
|
||||
in, out := &in.TargetAverageUtilization, &out.TargetAverageUtilization
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
if in.TargetAverageValue != nil {
|
||||
in, out := &in.TargetAverageValue, &out.TargetAverageValue
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceMetricSource.
|
||||
func (in *ResourceMetricSource) DeepCopy() *ResourceMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ResourceMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ResourceMetricStatus) DeepCopyInto(out *ResourceMetricStatus) {
|
||||
*out = *in
|
||||
if in.CurrentAverageUtilization != nil {
|
||||
in, out := &in.CurrentAverageUtilization, &out.CurrentAverageUtilization
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
out.CurrentAverageValue = in.CurrentAverageValue.DeepCopy()
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceMetricStatus.
|
||||
func (in *ResourceMetricStatus) DeepCopy() *ResourceMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ResourceMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
-112
@@ -1,112 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by openapi-gen. DO NOT EDIT.
|
||||
|
||||
package v2beta1
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ContainerResourceMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.ContainerResourceMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ContainerResourceMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.ContainerResourceMetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in CrossVersionObjectReference) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.CrossVersionObjectReference"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ExternalMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.ExternalMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ExternalMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.ExternalMetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscaler) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.HorizontalPodAutoscaler"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscalerCondition) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.HorizontalPodAutoscalerCondition"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscalerList) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.HorizontalPodAutoscalerList"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscalerSpec) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.HorizontalPodAutoscalerSpec"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscalerStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.HorizontalPodAutoscalerStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MetricSpec) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.MetricSpec"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.MetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ObjectMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.ObjectMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ObjectMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.ObjectMetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in PodsMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.PodsMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in PodsMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.PodsMetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ResourceMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.ResourceMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ResourceMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta1.ResourceMetricStatus"
|
||||
}
|
||||
-74
@@ -1,74 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
|
||||
|
||||
package v2beta1
|
||||
|
||||
import (
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *HorizontalPodAutoscaler) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 8
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *HorizontalPodAutoscaler) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 22
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *HorizontalPodAutoscaler) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "autoscaling", Version: "v2", Kind: "HorizontalPodAutoscaler"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *HorizontalPodAutoscaler) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 25
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *HorizontalPodAutoscalerList) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 8
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *HorizontalPodAutoscalerList) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 22
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *HorizontalPodAutoscalerList) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "autoscaling", Version: "v2beta2", Kind: "HorizontalPodAutoscalerList"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *HorizontalPodAutoscalerList) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 25
|
||||
}
|
||||
-23
@@ -1,23 +0,0 @@
|
||||
/*
|
||||
Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:protobuf-gen=package
|
||||
// +k8s:openapi-gen=true
|
||||
// +k8s:prerelease-lifecycle-gen=true
|
||||
// +k8s:openapi-model-package=io.k8s.api.autoscaling.v2beta2
|
||||
|
||||
package v2beta2
|
||||
-5817
File diff suppressed because it is too large
Load Diff
-493
@@ -1,493 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
||||
|
||||
syntax = "proto2";
|
||||
|
||||
package k8s.io.api.autoscaling.v2beta2;
|
||||
|
||||
import "k8s.io/api/core/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/api/resource/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/api/autoscaling/v2beta2";
|
||||
|
||||
// ContainerResourceMetricSource indicates how to scale on a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). The values will be averaged
|
||||
// together before being compared to the target. Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source. Only one "target" type
|
||||
// should be set.
|
||||
message ContainerResourceMetricSource {
|
||||
// name is the name of the resource in question.
|
||||
optional string name = 1;
|
||||
|
||||
// target specifies the target value for the given metric
|
||||
optional MetricTarget target = 2;
|
||||
|
||||
// container is the name of the container in the pods of the scaling target
|
||||
optional string container = 3;
|
||||
}
|
||||
|
||||
// ContainerResourceMetricStatus indicates the current value of a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing a single container in each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source.
|
||||
message ContainerResourceMetricStatus {
|
||||
// name is the name of the resource in question.
|
||||
optional string name = 1;
|
||||
|
||||
// current contains the current value for the given metric
|
||||
optional MetricValueStatus current = 2;
|
||||
|
||||
// container is the name of the container in the pods of the scaling target
|
||||
optional string container = 3;
|
||||
}
|
||||
|
||||
// CrossVersionObjectReference contains enough information to let you identify the referred resource.
|
||||
message CrossVersionObjectReference {
|
||||
// kind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
optional string kind = 1;
|
||||
|
||||
// name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
optional string name = 2;
|
||||
|
||||
// apiVersion is the API version of the referent
|
||||
// +optional
|
||||
optional string apiVersion = 3;
|
||||
}
|
||||
|
||||
// ExternalMetricSource indicates how to scale on a metric not associated with
|
||||
// any Kubernetes object (for example length of queue in cloud
|
||||
// messaging service, or QPS from loadbalancer running outside of cluster).
|
||||
message ExternalMetricSource {
|
||||
// metric identifies the target metric by name and selector
|
||||
optional MetricIdentifier metric = 1;
|
||||
|
||||
// target specifies the target value for the given metric
|
||||
optional MetricTarget target = 2;
|
||||
}
|
||||
|
||||
// ExternalMetricStatus indicates the current value of a global metric
|
||||
// not associated with any Kubernetes object.
|
||||
message ExternalMetricStatus {
|
||||
// metric identifies the target metric by name and selector
|
||||
optional MetricIdentifier metric = 1;
|
||||
|
||||
// current contains the current value for the given metric
|
||||
optional MetricValueStatus current = 2;
|
||||
}
|
||||
|
||||
// HPAScalingPolicy is a single policy which must hold true for a specified past interval.
|
||||
message HPAScalingPolicy {
|
||||
// type is used to specify the scaling policy.
|
||||
optional string type = 1;
|
||||
|
||||
// value contains the amount of change which is permitted by the policy.
|
||||
// It must be greater than zero
|
||||
optional int32 value = 2;
|
||||
|
||||
// periodSeconds specifies the window of time for which the policy should hold true.
|
||||
// PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).
|
||||
optional int32 periodSeconds = 3;
|
||||
}
|
||||
|
||||
// HPAScalingRules configures the scaling behavior for one direction.
|
||||
// These Rules are applied after calculating DesiredReplicas from metrics for the HPA.
|
||||
// They can limit the scaling velocity by specifying scaling policies.
|
||||
// They can prevent flapping by specifying the stabilization window, so that the
|
||||
// number of replicas is not set instantly, instead, the safest value from the stabilization
|
||||
// window is chosen.
|
||||
message HPAScalingRules {
|
||||
// stabilizationWindowSeconds is the number of seconds for which past recommendations should be
|
||||
// considered while scaling up or scaling down.
|
||||
// StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour).
|
||||
// If not set, use the default values:
|
||||
// - For scale up: 0 (i.e. no stabilization is done).
|
||||
// - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
|
||||
// +optional
|
||||
optional int32 stabilizationWindowSeconds = 3;
|
||||
|
||||
// selectPolicy is used to specify which policy should be used.
|
||||
// If not set, the default value MaxPolicySelect is used.
|
||||
// +optional
|
||||
optional string selectPolicy = 1;
|
||||
|
||||
// policies is a list of potential scaling polices which can be used during scaling.
|
||||
// At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated HPAScalingPolicy policies = 2;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscaler is the configuration for a horizontal pod
|
||||
// autoscaler, which automatically manages the replica count of any resource
|
||||
// implementing the scale subresource based on the metrics specified.
|
||||
message HorizontalPodAutoscaler {
|
||||
// metadata is the standard object metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// spec is the specification for the behaviour of the autoscaler.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
|
||||
// +optional
|
||||
optional HorizontalPodAutoscalerSpec spec = 2;
|
||||
|
||||
// status is the current information about the autoscaler.
|
||||
// +optional
|
||||
optional HorizontalPodAutoscalerStatus status = 3;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerBehavior configures the scaling behavior of the target
|
||||
// in both Up and Down directions (scaleUp and scaleDown fields respectively).
|
||||
message HorizontalPodAutoscalerBehavior {
|
||||
// scaleUp is scaling policy for scaling Up.
|
||||
// If not set, the default value is the higher of:
|
||||
// * increase no more than 4 pods per 60 seconds
|
||||
// * double the number of pods per 60 seconds
|
||||
// No stabilization is used.
|
||||
// +optional
|
||||
optional HPAScalingRules scaleUp = 1;
|
||||
|
||||
// scaleDown is scaling policy for scaling Down.
|
||||
// If not set, the default value is to allow to scale down to minReplicas pods, with a
|
||||
// 300 second stabilization window (i.e., the highest recommendation for
|
||||
// the last 300sec is used).
|
||||
// +optional
|
||||
optional HPAScalingRules scaleDown = 2;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerCondition describes the state of
|
||||
// a HorizontalPodAutoscaler at a certain point.
|
||||
message HorizontalPodAutoscalerCondition {
|
||||
// type describes the current condition
|
||||
optional string type = 1;
|
||||
|
||||
// status is the status of the condition (True, False, Unknown)
|
||||
optional string status = 2;
|
||||
|
||||
// lastTransitionTime is the last time the condition transitioned from
|
||||
// one status to another
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
|
||||
|
||||
// reason is the reason for the condition's last transition.
|
||||
// +optional
|
||||
optional string reason = 4;
|
||||
|
||||
// message is a human-readable explanation containing details about
|
||||
// the transition
|
||||
// +optional
|
||||
optional string message = 5;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerList is a list of horizontal pod autoscaler objects.
|
||||
message HorizontalPodAutoscalerList {
|
||||
// metadata is the standard list metadata.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
|
||||
// items is the list of horizontal pod autoscaler objects.
|
||||
repeated HorizontalPodAutoscaler items = 2;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.
|
||||
message HorizontalPodAutoscalerSpec {
|
||||
// scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
|
||||
// should be collected, as well as to actually change the replica count.
|
||||
optional CrossVersionObjectReference scaleTargetRef = 1;
|
||||
|
||||
// minReplicas is the lower limit for the number of replicas to which the autoscaler
|
||||
// can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the
|
||||
// alpha feature gate HPAScaleToZero is enabled and at least one Object or External
|
||||
// metric is configured. Scaling is active as long as at least one metric value is
|
||||
// available.
|
||||
// +optional
|
||||
optional int32 minReplicas = 2;
|
||||
|
||||
// maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
|
||||
// It cannot be less that minReplicas.
|
||||
optional int32 maxReplicas = 3;
|
||||
|
||||
// metrics contains the specifications for which to use to calculate the
|
||||
// desired replica count (the maximum replica count across all metrics will
|
||||
// be used). The desired replica count is calculated multiplying the
|
||||
// ratio between the target value and the current value by the current
|
||||
// number of pods. Ergo, metrics used must decrease as the pod count is
|
||||
// increased, and vice-versa. See the individual metric source types for
|
||||
// more information about how each type of metric must respond.
|
||||
// If not set, the default metric will be set to 80% average CPU utilization.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated MetricSpec metrics = 4;
|
||||
|
||||
// behavior configures the scaling behavior of the target
|
||||
// in both Up and Down directions (scaleUp and scaleDown fields respectively).
|
||||
// If not set, the default HPAScalingRules for scale up and scale down are used.
|
||||
// +optional
|
||||
optional HorizontalPodAutoscalerBehavior behavior = 5;
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.
|
||||
message HorizontalPodAutoscalerStatus {
|
||||
// observedGeneration is the most recent generation observed by this autoscaler.
|
||||
// +optional
|
||||
optional int64 observedGeneration = 1;
|
||||
|
||||
// lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods,
|
||||
// used by the autoscaler to control how often the number of pods is changed.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastScaleTime = 2;
|
||||
|
||||
// currentReplicas is current number of replicas of pods managed by this autoscaler,
|
||||
// as last seen by the autoscaler.
|
||||
optional int32 currentReplicas = 3;
|
||||
|
||||
// desiredReplicas is the desired number of replicas of pods managed by this autoscaler,
|
||||
// as last calculated by the autoscaler.
|
||||
optional int32 desiredReplicas = 4;
|
||||
|
||||
// currentMetrics is the last read state of the metrics used by this autoscaler.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated MetricStatus currentMetrics = 5;
|
||||
|
||||
// conditions is the set of conditions required for this autoscaler to scale its target,
|
||||
// and indicates whether or not those conditions are met.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
repeated HorizontalPodAutoscalerCondition conditions = 6;
|
||||
}
|
||||
|
||||
// MetricIdentifier defines the name and optionally selector for a metric
|
||||
message MetricIdentifier {
|
||||
// name is the name of the given metric
|
||||
optional string name = 1;
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping.
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
|
||||
}
|
||||
|
||||
// MetricSpec specifies how to scale based on a single metric
|
||||
// (only `type` and one other matching field should be set at once).
|
||||
message MetricSpec {
|
||||
// type is the type of metric source. It should be one of "ContainerResource", "External",
|
||||
// "Object", "Pods" or "Resource", each mapping to a matching field in the object.
|
||||
optional string type = 1;
|
||||
|
||||
// object refers to a metric describing a single kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
// +optional
|
||||
optional ObjectMetricSource object = 2;
|
||||
|
||||
// pods refers to a metric describing each pod in the current scale target
|
||||
// (for example, transactions-processed-per-second). The values will be
|
||||
// averaged together before being compared to the target value.
|
||||
// +optional
|
||||
optional PodsMetricSource pods = 3;
|
||||
|
||||
// resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
optional ResourceMetricSource resource = 4;
|
||||
|
||||
// container resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing a single container in
|
||||
// each pod of the current scale target (e.g. CPU or memory). Such metrics are
|
||||
// built in to Kubernetes, and have special scaling options on top of those
|
||||
// available to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
optional ContainerResourceMetricSource containerResource = 7;
|
||||
|
||||
// external refers to a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
// +optional
|
||||
optional ExternalMetricSource external = 5;
|
||||
}
|
||||
|
||||
// MetricStatus describes the last-read state of a single metric.
|
||||
message MetricStatus {
|
||||
// type is the type of metric source. It will be one of "ContainerResource", "External",
|
||||
// "Object", "Pods" or "Resource", each corresponds to a matching field in the object.
|
||||
optional string type = 1;
|
||||
|
||||
// object refers to a metric describing a single kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
// +optional
|
||||
optional ObjectMetricStatus object = 2;
|
||||
|
||||
// pods refers to a metric describing each pod in the current scale target
|
||||
// (for example, transactions-processed-per-second). The values will be
|
||||
// averaged together before being compared to the target value.
|
||||
// +optional
|
||||
optional PodsMetricStatus pods = 3;
|
||||
|
||||
// resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
optional ResourceMetricStatus resource = 4;
|
||||
|
||||
// containerResource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing a single container in each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
optional ContainerResourceMetricStatus containerResource = 7;
|
||||
|
||||
// external refers to a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
// +optional
|
||||
optional ExternalMetricStatus external = 5;
|
||||
}
|
||||
|
||||
// MetricTarget defines the target value, average value, or average utilization of a specific metric
|
||||
message MetricTarget {
|
||||
// type represents whether the metric type is Utilization, Value, or AverageValue
|
||||
optional string type = 1;
|
||||
|
||||
// value is the target value of the metric (as a quantity).
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity value = 2;
|
||||
|
||||
// averageValue is the target value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity averageValue = 3;
|
||||
|
||||
// averageUtilization is the target value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods.
|
||||
// Currently only valid for Resource metric source type
|
||||
// +optional
|
||||
optional int32 averageUtilization = 4;
|
||||
}
|
||||
|
||||
// MetricValueStatus holds the current value for a metric
|
||||
message MetricValueStatus {
|
||||
// value is the current value of the metric (as a quantity).
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity value = 1;
|
||||
|
||||
// averageValue is the current value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
// +optional
|
||||
optional .k8s.io.apimachinery.pkg.api.resource.Quantity averageValue = 2;
|
||||
|
||||
// averageUtilization is the current value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods.
|
||||
// +optional
|
||||
optional int32 averageUtilization = 3;
|
||||
}
|
||||
|
||||
// ObjectMetricSource indicates how to scale on a metric describing a
|
||||
// kubernetes object (for example, hits-per-second on an Ingress object).
|
||||
message ObjectMetricSource {
|
||||
optional CrossVersionObjectReference describedObject = 1;
|
||||
|
||||
// target specifies the target value for the given metric
|
||||
optional MetricTarget target = 2;
|
||||
|
||||
// metric identifies the target metric by name and selector
|
||||
optional MetricIdentifier metric = 3;
|
||||
}
|
||||
|
||||
// ObjectMetricStatus indicates the current value of a metric describing a
|
||||
// kubernetes object (for example, hits-per-second on an Ingress object).
|
||||
message ObjectMetricStatus {
|
||||
// metric identifies the target metric by name and selector
|
||||
optional MetricIdentifier metric = 1;
|
||||
|
||||
// current contains the current value for the given metric
|
||||
optional MetricValueStatus current = 2;
|
||||
|
||||
optional CrossVersionObjectReference describedObject = 3;
|
||||
}
|
||||
|
||||
// PodsMetricSource indicates how to scale on a metric describing each pod in
|
||||
// the current scale target (for example, transactions-processed-per-second).
|
||||
// The values will be averaged together before being compared to the target
|
||||
// value.
|
||||
message PodsMetricSource {
|
||||
// metric identifies the target metric by name and selector
|
||||
optional MetricIdentifier metric = 1;
|
||||
|
||||
// target specifies the target value for the given metric
|
||||
optional MetricTarget target = 2;
|
||||
}
|
||||
|
||||
// PodsMetricStatus indicates the current value of a metric describing each pod in
|
||||
// the current scale target (for example, transactions-processed-per-second).
|
||||
message PodsMetricStatus {
|
||||
// metric identifies the target metric by name and selector
|
||||
optional MetricIdentifier metric = 1;
|
||||
|
||||
// current contains the current value for the given metric
|
||||
optional MetricValueStatus current = 2;
|
||||
}
|
||||
|
||||
// ResourceMetricSource indicates how to scale on a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). The values will be averaged
|
||||
// together before being compared to the target. Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source. Only one "target" type
|
||||
// should be set.
|
||||
message ResourceMetricSource {
|
||||
// name is the name of the resource in question.
|
||||
optional string name = 1;
|
||||
|
||||
// target specifies the target value for the given metric
|
||||
optional MetricTarget target = 2;
|
||||
}
|
||||
|
||||
// ResourceMetricStatus indicates the current value of a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source.
|
||||
message ResourceMetricStatus {
|
||||
// name is the name of the resource in question.
|
||||
optional string name = 1;
|
||||
|
||||
// current contains the current value for the given metric
|
||||
optional MetricValueStatus current = 2;
|
||||
}
|
||||
|
||||
-70
@@ -1,70 +0,0 @@
|
||||
//go:build kubernetes_protomessage_one_more_release
|
||||
// +build kubernetes_protomessage_one_more_release
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by go-to-protobuf. DO NOT EDIT.
|
||||
|
||||
package v2beta2
|
||||
|
||||
func (*ContainerResourceMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ContainerResourceMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*CrossVersionObjectReference) ProtoMessage() {}
|
||||
|
||||
func (*ExternalMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ExternalMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*HPAScalingPolicy) ProtoMessage() {}
|
||||
|
||||
func (*HPAScalingRules) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscaler) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerBehavior) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerCondition) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerList) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerSpec) ProtoMessage() {}
|
||||
|
||||
func (*HorizontalPodAutoscalerStatus) ProtoMessage() {}
|
||||
|
||||
func (*MetricIdentifier) ProtoMessage() {}
|
||||
|
||||
func (*MetricSpec) ProtoMessage() {}
|
||||
|
||||
func (*MetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*MetricTarget) ProtoMessage() {}
|
||||
|
||||
func (*MetricValueStatus) ProtoMessage() {}
|
||||
|
||||
func (*ObjectMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ObjectMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*PodsMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*PodsMetricStatus) ProtoMessage() {}
|
||||
|
||||
func (*ResourceMetricSource) ProtoMessage() {}
|
||||
|
||||
func (*ResourceMetricStatus) ProtoMessage() {}
|
||||
-50
@@ -1,50 +0,0 @@
|
||||
/*
|
||||
Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v2beta2
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name use in this package
|
||||
const GroupName = "autoscaling"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v2beta2"}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
var (
|
||||
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
// Adds the list of known types to the given scheme.
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&HorizontalPodAutoscaler{},
|
||||
&HorizontalPodAutoscalerList{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
}
|
||||
-578
@@ -1,578 +0,0 @@
|
||||
/*
|
||||
Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:openapi-gen=true
|
||||
|
||||
package v2beta2
|
||||
|
||||
import (
|
||||
v1 "k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/api/resource"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
// +genclient
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.12
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.23
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=autoscaling,v2,HorizontalPodAutoscaler
|
||||
|
||||
// HorizontalPodAutoscaler is the configuration for a horizontal pod
|
||||
// autoscaler, which automatically manages the replica count of any resource
|
||||
// implementing the scale subresource based on the metrics specified.
|
||||
type HorizontalPodAutoscaler struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// metadata is the standard object metadata.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// spec is the specification for the behaviour of the autoscaler.
|
||||
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
|
||||
// +optional
|
||||
Spec HorizontalPodAutoscalerSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
|
||||
|
||||
// status is the current information about the autoscaler.
|
||||
// +optional
|
||||
Status HorizontalPodAutoscalerStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.
|
||||
type HorizontalPodAutoscalerSpec struct {
|
||||
// scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
|
||||
// should be collected, as well as to actually change the replica count.
|
||||
ScaleTargetRef CrossVersionObjectReference `json:"scaleTargetRef" protobuf:"bytes,1,opt,name=scaleTargetRef"`
|
||||
// minReplicas is the lower limit for the number of replicas to which the autoscaler
|
||||
// can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the
|
||||
// alpha feature gate HPAScaleToZero is enabled and at least one Object or External
|
||||
// metric is configured. Scaling is active as long as at least one metric value is
|
||||
// available.
|
||||
// +optional
|
||||
MinReplicas *int32 `json:"minReplicas,omitempty" protobuf:"varint,2,opt,name=minReplicas"`
|
||||
|
||||
// maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
|
||||
// It cannot be less that minReplicas.
|
||||
MaxReplicas int32 `json:"maxReplicas" protobuf:"varint,3,opt,name=maxReplicas"`
|
||||
|
||||
// metrics contains the specifications for which to use to calculate the
|
||||
// desired replica count (the maximum replica count across all metrics will
|
||||
// be used). The desired replica count is calculated multiplying the
|
||||
// ratio between the target value and the current value by the current
|
||||
// number of pods. Ergo, metrics used must decrease as the pod count is
|
||||
// increased, and vice-versa. See the individual metric source types for
|
||||
// more information about how each type of metric must respond.
|
||||
// If not set, the default metric will be set to 80% average CPU utilization.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Metrics []MetricSpec `json:"metrics,omitempty" protobuf:"bytes,4,rep,name=metrics"`
|
||||
|
||||
// behavior configures the scaling behavior of the target
|
||||
// in both Up and Down directions (scaleUp and scaleDown fields respectively).
|
||||
// If not set, the default HPAScalingRules for scale up and scale down are used.
|
||||
// +optional
|
||||
Behavior *HorizontalPodAutoscalerBehavior `json:"behavior,omitempty" protobuf:"bytes,5,opt,name=behavior"`
|
||||
}
|
||||
|
||||
// CrossVersionObjectReference contains enough information to let you identify the referred resource.
|
||||
type CrossVersionObjectReference struct {
|
||||
// kind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
|
||||
|
||||
// name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
|
||||
|
||||
// apiVersion is the API version of the referent
|
||||
// +optional
|
||||
APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,3,opt,name=apiVersion"`
|
||||
}
|
||||
|
||||
// MetricSpec specifies how to scale based on a single metric
|
||||
// (only `type` and one other matching field should be set at once).
|
||||
type MetricSpec struct {
|
||||
// type is the type of metric source. It should be one of "ContainerResource", "External",
|
||||
// "Object", "Pods" or "Resource", each mapping to a matching field in the object.
|
||||
Type MetricSourceType `json:"type" protobuf:"bytes,1,name=type"`
|
||||
|
||||
// object refers to a metric describing a single kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
// +optional
|
||||
Object *ObjectMetricSource `json:"object,omitempty" protobuf:"bytes,2,opt,name=object"`
|
||||
|
||||
// pods refers to a metric describing each pod in the current scale target
|
||||
// (for example, transactions-processed-per-second). The values will be
|
||||
// averaged together before being compared to the target value.
|
||||
// +optional
|
||||
Pods *PodsMetricSource `json:"pods,omitempty" protobuf:"bytes,3,opt,name=pods"`
|
||||
|
||||
// resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
Resource *ResourceMetricSource `json:"resource,omitempty" protobuf:"bytes,4,opt,name=resource"`
|
||||
|
||||
// container resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing a single container in
|
||||
// each pod of the current scale target (e.g. CPU or memory). Such metrics are
|
||||
// built in to Kubernetes, and have special scaling options on top of those
|
||||
// available to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
ContainerResource *ContainerResourceMetricSource `json:"containerResource,omitempty" protobuf:"bytes,7,opt,name=containerResource"`
|
||||
|
||||
// external refers to a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
// +optional
|
||||
External *ExternalMetricSource `json:"external,omitempty" protobuf:"bytes,5,opt,name=external"`
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerBehavior configures the scaling behavior of the target
|
||||
// in both Up and Down directions (scaleUp and scaleDown fields respectively).
|
||||
type HorizontalPodAutoscalerBehavior struct {
|
||||
// scaleUp is scaling policy for scaling Up.
|
||||
// If not set, the default value is the higher of:
|
||||
// * increase no more than 4 pods per 60 seconds
|
||||
// * double the number of pods per 60 seconds
|
||||
// No stabilization is used.
|
||||
// +optional
|
||||
ScaleUp *HPAScalingRules `json:"scaleUp,omitempty" protobuf:"bytes,1,opt,name=scaleUp"`
|
||||
|
||||
// scaleDown is scaling policy for scaling Down.
|
||||
// If not set, the default value is to allow to scale down to minReplicas pods, with a
|
||||
// 300 second stabilization window (i.e., the highest recommendation for
|
||||
// the last 300sec is used).
|
||||
// +optional
|
||||
ScaleDown *HPAScalingRules `json:"scaleDown,omitempty" protobuf:"bytes,2,opt,name=scaleDown"`
|
||||
}
|
||||
|
||||
// ScalingPolicySelect is used to specify which policy should be used while scaling in a certain direction
|
||||
type ScalingPolicySelect string
|
||||
|
||||
const (
|
||||
// MaxPolicySelect selects the policy with the highest possible change.
|
||||
MaxPolicySelect ScalingPolicySelect = "Max"
|
||||
// MinPolicySelect selects the policy with the lowest possible change.
|
||||
MinPolicySelect ScalingPolicySelect = "Min"
|
||||
// DisabledPolicySelect disables the scaling in this direction.
|
||||
DisabledPolicySelect ScalingPolicySelect = "Disabled"
|
||||
)
|
||||
|
||||
// HPAScalingRules configures the scaling behavior for one direction.
|
||||
// These Rules are applied after calculating DesiredReplicas from metrics for the HPA.
|
||||
// They can limit the scaling velocity by specifying scaling policies.
|
||||
// They can prevent flapping by specifying the stabilization window, so that the
|
||||
// number of replicas is not set instantly, instead, the safest value from the stabilization
|
||||
// window is chosen.
|
||||
type HPAScalingRules struct {
|
||||
// stabilizationWindowSeconds is the number of seconds for which past recommendations should be
|
||||
// considered while scaling up or scaling down.
|
||||
// StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour).
|
||||
// If not set, use the default values:
|
||||
// - For scale up: 0 (i.e. no stabilization is done).
|
||||
// - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
|
||||
// +optional
|
||||
StabilizationWindowSeconds *int32 `json:"stabilizationWindowSeconds,omitempty" protobuf:"varint,3,opt,name=stabilizationWindowSeconds"`
|
||||
|
||||
// selectPolicy is used to specify which policy should be used.
|
||||
// If not set, the default value MaxPolicySelect is used.
|
||||
// +optional
|
||||
SelectPolicy *ScalingPolicySelect `json:"selectPolicy,omitempty" protobuf:"bytes,1,opt,name=selectPolicy"`
|
||||
|
||||
// policies is a list of potential scaling polices which can be used during scaling.
|
||||
// At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Policies []HPAScalingPolicy `json:"policies,omitempty" protobuf:"bytes,2,rep,name=policies"`
|
||||
}
|
||||
|
||||
// HPAScalingPolicyType is the type of the policy which could be used while making scaling decisions.
|
||||
type HPAScalingPolicyType string
|
||||
|
||||
const (
|
||||
// PodsScalingPolicy is a policy used to specify a change in absolute number of pods.
|
||||
PodsScalingPolicy HPAScalingPolicyType = "Pods"
|
||||
// PercentScalingPolicy is a policy used to specify a relative amount of change with respect to
|
||||
// the current number of pods.
|
||||
PercentScalingPolicy HPAScalingPolicyType = "Percent"
|
||||
)
|
||||
|
||||
// HPAScalingPolicy is a single policy which must hold true for a specified past interval.
|
||||
type HPAScalingPolicy struct {
|
||||
// type is used to specify the scaling policy.
|
||||
Type HPAScalingPolicyType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=HPAScalingPolicyType"`
|
||||
|
||||
// value contains the amount of change which is permitted by the policy.
|
||||
// It must be greater than zero
|
||||
Value int32 `json:"value" protobuf:"varint,2,opt,name=value"`
|
||||
|
||||
// periodSeconds specifies the window of time for which the policy should hold true.
|
||||
// PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).
|
||||
PeriodSeconds int32 `json:"periodSeconds" protobuf:"varint,3,opt,name=periodSeconds"`
|
||||
}
|
||||
|
||||
// MetricSourceType indicates the type of metric.
|
||||
type MetricSourceType string
|
||||
|
||||
const (
|
||||
// ObjectMetricSourceType is a metric describing a kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
ObjectMetricSourceType MetricSourceType = "Object"
|
||||
// PodsMetricSourceType is a metric describing each pod in the current scale
|
||||
// target (for example, transactions-processed-per-second). The values
|
||||
// will be averaged together before being compared to the target value.
|
||||
PodsMetricSourceType MetricSourceType = "Pods"
|
||||
// ResourceMetricSourceType is a resource metric known to Kubernetes, as
|
||||
// specified in requests and limits, describing each pod in the current
|
||||
// scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics (the "pods" source).
|
||||
ResourceMetricSourceType MetricSourceType = "Resource"
|
||||
// ContainerResourceMetricSourceType is a resource metric known to Kubernetes, as
|
||||
// specified in requests and limits, describing a single container in each pod in the current
|
||||
// scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics (the "pods" source).
|
||||
ContainerResourceMetricSourceType MetricSourceType = "ContainerResource"
|
||||
// ExternalMetricSourceType is a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
ExternalMetricSourceType MetricSourceType = "External"
|
||||
)
|
||||
|
||||
// ObjectMetricSource indicates how to scale on a metric describing a
|
||||
// kubernetes object (for example, hits-per-second on an Ingress object).
|
||||
type ObjectMetricSource struct {
|
||||
DescribedObject CrossVersionObjectReference `json:"describedObject" protobuf:"bytes,1,name=describedObject"`
|
||||
// target specifies the target value for the given metric
|
||||
Target MetricTarget `json:"target" protobuf:"bytes,2,name=target"`
|
||||
|
||||
// metric identifies the target metric by name and selector
|
||||
Metric MetricIdentifier `json:"metric" protobuf:"bytes,3,name=metric"`
|
||||
}
|
||||
|
||||
// PodsMetricSource indicates how to scale on a metric describing each pod in
|
||||
// the current scale target (for example, transactions-processed-per-second).
|
||||
// The values will be averaged together before being compared to the target
|
||||
// value.
|
||||
type PodsMetricSource struct {
|
||||
// metric identifies the target metric by name and selector
|
||||
Metric MetricIdentifier `json:"metric" protobuf:"bytes,1,name=metric"`
|
||||
|
||||
// target specifies the target value for the given metric
|
||||
Target MetricTarget `json:"target" protobuf:"bytes,2,name=target"`
|
||||
}
|
||||
|
||||
// ResourceMetricSource indicates how to scale on a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). The values will be averaged
|
||||
// together before being compared to the target. Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source. Only one "target" type
|
||||
// should be set.
|
||||
type ResourceMetricSource struct {
|
||||
// name is the name of the resource in question.
|
||||
Name v1.ResourceName `json:"name" protobuf:"bytes,1,name=name"`
|
||||
|
||||
// target specifies the target value for the given metric
|
||||
Target MetricTarget `json:"target" protobuf:"bytes,2,name=target"`
|
||||
}
|
||||
|
||||
// ContainerResourceMetricSource indicates how to scale on a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). The values will be averaged
|
||||
// together before being compared to the target. Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source. Only one "target" type
|
||||
// should be set.
|
||||
type ContainerResourceMetricSource struct {
|
||||
// name is the name of the resource in question.
|
||||
Name v1.ResourceName `json:"name" protobuf:"bytes,1,name=name"`
|
||||
|
||||
// target specifies the target value for the given metric
|
||||
Target MetricTarget `json:"target" protobuf:"bytes,2,name=target"`
|
||||
|
||||
// container is the name of the container in the pods of the scaling target
|
||||
Container string `json:"container" protobuf:"bytes,3,opt,name=container"`
|
||||
}
|
||||
|
||||
// ExternalMetricSource indicates how to scale on a metric not associated with
|
||||
// any Kubernetes object (for example length of queue in cloud
|
||||
// messaging service, or QPS from loadbalancer running outside of cluster).
|
||||
type ExternalMetricSource struct {
|
||||
// metric identifies the target metric by name and selector
|
||||
Metric MetricIdentifier `json:"metric" protobuf:"bytes,1,name=metric"`
|
||||
|
||||
// target specifies the target value for the given metric
|
||||
Target MetricTarget `json:"target" protobuf:"bytes,2,name=target"`
|
||||
}
|
||||
|
||||
// MetricIdentifier defines the name and optionally selector for a metric
|
||||
type MetricIdentifier struct {
|
||||
// name is the name of the given metric
|
||||
Name string `json:"name" protobuf:"bytes,1,name=name"`
|
||||
|
||||
// selector is the string-encoded form of a standard kubernetes label selector for the given metric
|
||||
// When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping.
|
||||
// When unset, just the metricName will be used to gather metrics.
|
||||
// +optional
|
||||
Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,2,name=selector"`
|
||||
}
|
||||
|
||||
// MetricTarget defines the target value, average value, or average utilization of a specific metric
|
||||
type MetricTarget struct {
|
||||
// type represents whether the metric type is Utilization, Value, or AverageValue
|
||||
Type MetricTargetType `json:"type" protobuf:"bytes,1,name=type"`
|
||||
|
||||
// value is the target value of the metric (as a quantity).
|
||||
// +optional
|
||||
Value *resource.Quantity `json:"value,omitempty" protobuf:"bytes,2,opt,name=value"`
|
||||
|
||||
// averageValue is the target value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
// +optional
|
||||
AverageValue *resource.Quantity `json:"averageValue,omitempty" protobuf:"bytes,3,opt,name=averageValue"`
|
||||
|
||||
// averageUtilization is the target value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods.
|
||||
// Currently only valid for Resource metric source type
|
||||
// +optional
|
||||
AverageUtilization *int32 `json:"averageUtilization,omitempty" protobuf:"bytes,4,opt,name=averageUtilization"`
|
||||
}
|
||||
|
||||
// MetricTargetType specifies the type of metric being targeted, and should be either
|
||||
// "Value", "AverageValue", or "Utilization"
|
||||
type MetricTargetType string
|
||||
|
||||
const (
|
||||
// UtilizationMetricType declares a MetricTarget is an AverageUtilization value
|
||||
UtilizationMetricType MetricTargetType = "Utilization"
|
||||
// ValueMetricType declares a MetricTarget is a raw value
|
||||
ValueMetricType MetricTargetType = "Value"
|
||||
// AverageValueMetricType declares a MetricTarget is an
|
||||
AverageValueMetricType MetricTargetType = "AverageValue"
|
||||
)
|
||||
|
||||
// HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.
|
||||
type HorizontalPodAutoscalerStatus struct {
|
||||
// observedGeneration is the most recent generation observed by this autoscaler.
|
||||
// +optional
|
||||
ObservedGeneration *int64 `json:"observedGeneration,omitempty" protobuf:"varint,1,opt,name=observedGeneration"`
|
||||
|
||||
// lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods,
|
||||
// used by the autoscaler to control how often the number of pods is changed.
|
||||
// +optional
|
||||
LastScaleTime *metav1.Time `json:"lastScaleTime,omitempty" protobuf:"bytes,2,opt,name=lastScaleTime"`
|
||||
|
||||
// currentReplicas is current number of replicas of pods managed by this autoscaler,
|
||||
// as last seen by the autoscaler.
|
||||
CurrentReplicas int32 `json:"currentReplicas" protobuf:"varint,3,opt,name=currentReplicas"`
|
||||
|
||||
// desiredReplicas is the desired number of replicas of pods managed by this autoscaler,
|
||||
// as last calculated by the autoscaler.
|
||||
DesiredReplicas int32 `json:"desiredReplicas" protobuf:"varint,4,opt,name=desiredReplicas"`
|
||||
|
||||
// currentMetrics is the last read state of the metrics used by this autoscaler.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
CurrentMetrics []MetricStatus `json:"currentMetrics" protobuf:"bytes,5,rep,name=currentMetrics"`
|
||||
|
||||
// conditions is the set of conditions required for this autoscaler to scale its target,
|
||||
// and indicates whether or not those conditions are met.
|
||||
// +optional
|
||||
// +listType=atomic
|
||||
Conditions []HorizontalPodAutoscalerCondition `json:"conditions" protobuf:"bytes,6,rep,name=conditions"`
|
||||
}
|
||||
|
||||
// HorizontalPodAutoscalerConditionType are the valid conditions of
|
||||
// a HorizontalPodAutoscaler.
|
||||
type HorizontalPodAutoscalerConditionType string
|
||||
|
||||
const (
|
||||
// ScalingActive indicates that the HPA controller is able to scale if necessary:
|
||||
// it's correctly configured, can fetch the desired metrics, and isn't disabled.
|
||||
ScalingActive HorizontalPodAutoscalerConditionType = "ScalingActive"
|
||||
// AbleToScale indicates a lack of transient issues which prevent scaling from occurring,
|
||||
// such as being in a backoff window, or being unable to access/update the target scale.
|
||||
AbleToScale HorizontalPodAutoscalerConditionType = "AbleToScale"
|
||||
// ScalingLimited indicates that the calculated scale based on metrics would be above or
|
||||
// below the range for the HPA, and has thus been capped.
|
||||
ScalingLimited HorizontalPodAutoscalerConditionType = "ScalingLimited"
|
||||
)
|
||||
|
||||
// HorizontalPodAutoscalerCondition describes the state of
|
||||
// a HorizontalPodAutoscaler at a certain point.
|
||||
type HorizontalPodAutoscalerCondition struct {
|
||||
// type describes the current condition
|
||||
Type HorizontalPodAutoscalerConditionType `json:"type" protobuf:"bytes,1,name=type"`
|
||||
|
||||
// status is the status of the condition (True, False, Unknown)
|
||||
Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,name=status"`
|
||||
|
||||
// lastTransitionTime is the last time the condition transitioned from
|
||||
// one status to another
|
||||
// +optional
|
||||
LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
|
||||
|
||||
// reason is the reason for the condition's last transition.
|
||||
// +optional
|
||||
Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
|
||||
|
||||
// message is a human-readable explanation containing details about
|
||||
// the transition
|
||||
// +optional
|
||||
Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
|
||||
}
|
||||
|
||||
// MetricStatus describes the last-read state of a single metric.
|
||||
type MetricStatus struct {
|
||||
// type is the type of metric source. It will be one of "ContainerResource", "External",
|
||||
// "Object", "Pods" or "Resource", each corresponds to a matching field in the object.
|
||||
Type MetricSourceType `json:"type" protobuf:"bytes,1,name=type"`
|
||||
|
||||
// object refers to a metric describing a single kubernetes object
|
||||
// (for example, hits-per-second on an Ingress object).
|
||||
// +optional
|
||||
Object *ObjectMetricStatus `json:"object,omitempty" protobuf:"bytes,2,opt,name=object"`
|
||||
|
||||
// pods refers to a metric describing each pod in the current scale target
|
||||
// (for example, transactions-processed-per-second). The values will be
|
||||
// averaged together before being compared to the target value.
|
||||
// +optional
|
||||
Pods *PodsMetricStatus `json:"pods,omitempty" protobuf:"bytes,3,opt,name=pods"`
|
||||
// resource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
Resource *ResourceMetricStatus `json:"resource,omitempty" protobuf:"bytes,4,opt,name=resource"`
|
||||
|
||||
// containerResource refers to a resource metric (such as those specified in
|
||||
// requests and limits) known to Kubernetes describing a single container in each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available
|
||||
// to normal per-pod metrics using the "pods" source.
|
||||
// +optional
|
||||
ContainerResource *ContainerResourceMetricStatus `json:"containerResource,omitempty" protobuf:"bytes,7,opt,name=containerResource"`
|
||||
|
||||
// external refers to a global metric that is not associated
|
||||
// with any Kubernetes object. It allows autoscaling based on information
|
||||
// coming from components running outside of cluster
|
||||
// (for example length of queue in cloud messaging service, or
|
||||
// QPS from loadbalancer running outside of cluster).
|
||||
// +optional
|
||||
External *ExternalMetricStatus `json:"external,omitempty" protobuf:"bytes,5,opt,name=external"`
|
||||
}
|
||||
|
||||
// ObjectMetricStatus indicates the current value of a metric describing a
|
||||
// kubernetes object (for example, hits-per-second on an Ingress object).
|
||||
type ObjectMetricStatus struct {
|
||||
// metric identifies the target metric by name and selector
|
||||
Metric MetricIdentifier `json:"metric" protobuf:"bytes,1,name=metric"`
|
||||
|
||||
// current contains the current value for the given metric
|
||||
Current MetricValueStatus `json:"current" protobuf:"bytes,2,name=current"`
|
||||
|
||||
DescribedObject CrossVersionObjectReference `json:"describedObject" protobuf:"bytes,3,name=describedObject"`
|
||||
}
|
||||
|
||||
// PodsMetricStatus indicates the current value of a metric describing each pod in
|
||||
// the current scale target (for example, transactions-processed-per-second).
|
||||
type PodsMetricStatus struct {
|
||||
// metric identifies the target metric by name and selector
|
||||
Metric MetricIdentifier `json:"metric" protobuf:"bytes,1,name=metric"`
|
||||
|
||||
// current contains the current value for the given metric
|
||||
Current MetricValueStatus `json:"current" protobuf:"bytes,2,name=current"`
|
||||
}
|
||||
|
||||
// ResourceMetricStatus indicates the current value of a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source.
|
||||
type ResourceMetricStatus struct {
|
||||
// name is the name of the resource in question.
|
||||
Name v1.ResourceName `json:"name" protobuf:"bytes,1,name=name"`
|
||||
|
||||
// current contains the current value for the given metric
|
||||
Current MetricValueStatus `json:"current" protobuf:"bytes,2,name=current"`
|
||||
}
|
||||
|
||||
// ContainerResourceMetricStatus indicates the current value of a resource metric known to
|
||||
// Kubernetes, as specified in requests and limits, describing a single container in each pod in the
|
||||
// current scale target (e.g. CPU or memory). Such metrics are built in to
|
||||
// Kubernetes, and have special scaling options on top of those available to
|
||||
// normal per-pod metrics using the "pods" source.
|
||||
type ContainerResourceMetricStatus struct {
|
||||
// name is the name of the resource in question.
|
||||
Name v1.ResourceName `json:"name" protobuf:"bytes,1,name=name"`
|
||||
|
||||
// current contains the current value for the given metric
|
||||
Current MetricValueStatus `json:"current" protobuf:"bytes,2,name=current"`
|
||||
|
||||
// container is the name of the container in the pods of the scaling target
|
||||
Container string `json:"container" protobuf:"bytes,3,opt,name=container"`
|
||||
}
|
||||
|
||||
// ExternalMetricStatus indicates the current value of a global metric
|
||||
// not associated with any Kubernetes object.
|
||||
type ExternalMetricStatus struct {
|
||||
// metric identifies the target metric by name and selector
|
||||
Metric MetricIdentifier `json:"metric" protobuf:"bytes,1,name=metric"`
|
||||
|
||||
// current contains the current value for the given metric
|
||||
Current MetricValueStatus `json:"current" protobuf:"bytes,2,name=current"`
|
||||
}
|
||||
|
||||
// MetricValueStatus holds the current value for a metric
|
||||
type MetricValueStatus struct {
|
||||
// value is the current value of the metric (as a quantity).
|
||||
// +optional
|
||||
Value *resource.Quantity `json:"value,omitempty" protobuf:"bytes,1,opt,name=value"`
|
||||
|
||||
// averageValue is the current value of the average of the
|
||||
// metric across all relevant pods (as a quantity)
|
||||
// +optional
|
||||
AverageValue *resource.Quantity `json:"averageValue,omitempty" protobuf:"bytes,2,opt,name=averageValue"`
|
||||
|
||||
// averageUtilization is the current value of the average of the
|
||||
// resource metric across all relevant pods, represented as a percentage of
|
||||
// the requested value of the resource for the pods.
|
||||
// +optional
|
||||
AverageUtilization *int32 `json:"averageUtilization,omitempty" protobuf:"bytes,3,opt,name=averageUtilization"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.12
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.22
|
||||
|
||||
// HorizontalPodAutoscalerList is a list of horizontal pod autoscaler objects.
|
||||
type HorizontalPodAutoscalerList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// metadata is the standard list metadata.
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// items is the list of horizontal pod autoscaler objects.
|
||||
Items []HorizontalPodAutoscaler `json:"items" protobuf:"bytes,2,rep,name=items"`
|
||||
}
|
||||
-297
@@ -1,297 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v2beta2
|
||||
|
||||
// This file contains a collection of methods that can be used from go-restful to
|
||||
// generate Swagger API documentation for its models. Please read this PR for more
|
||||
// information on the implementation: https://github.com/emicklei/go-restful/pull/215
|
||||
//
|
||||
// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
|
||||
// they are on one line! For multiple line or blocks that you want to ignore use ---.
|
||||
// Any context after a --- is ignored.
|
||||
//
|
||||
// Those methods can be generated by using hack/update-codegen.sh
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
|
||||
var map_ContainerResourceMetricSource = map[string]string{
|
||||
"": "ContainerResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source. Only one \"target\" type should be set.",
|
||||
"name": "name is the name of the resource in question.",
|
||||
"target": "target specifies the target value for the given metric",
|
||||
"container": "container is the name of the container in the pods of the scaling target",
|
||||
}
|
||||
|
||||
func (ContainerResourceMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_ContainerResourceMetricSource
|
||||
}
|
||||
|
||||
var map_ContainerResourceMetricStatus = map[string]string{
|
||||
"": "ContainerResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"name": "name is the name of the resource in question.",
|
||||
"current": "current contains the current value for the given metric",
|
||||
"container": "container is the name of the container in the pods of the scaling target",
|
||||
}
|
||||
|
||||
func (ContainerResourceMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_ContainerResourceMetricStatus
|
||||
}
|
||||
|
||||
var map_CrossVersionObjectReference = map[string]string{
|
||||
"": "CrossVersionObjectReference contains enough information to let you identify the referred resource.",
|
||||
"kind": "kind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"name": "name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
|
||||
"apiVersion": "apiVersion is the API version of the referent",
|
||||
}
|
||||
|
||||
func (CrossVersionObjectReference) SwaggerDoc() map[string]string {
|
||||
return map_CrossVersionObjectReference
|
||||
}
|
||||
|
||||
var map_ExternalMetricSource = map[string]string{
|
||||
"": "ExternalMetricSource indicates how to scale on a metric not associated with any Kubernetes object (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).",
|
||||
"metric": "metric identifies the target metric by name and selector",
|
||||
"target": "target specifies the target value for the given metric",
|
||||
}
|
||||
|
||||
func (ExternalMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_ExternalMetricSource
|
||||
}
|
||||
|
||||
var map_ExternalMetricStatus = map[string]string{
|
||||
"": "ExternalMetricStatus indicates the current value of a global metric not associated with any Kubernetes object.",
|
||||
"metric": "metric identifies the target metric by name and selector",
|
||||
"current": "current contains the current value for the given metric",
|
||||
}
|
||||
|
||||
func (ExternalMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_ExternalMetricStatus
|
||||
}
|
||||
|
||||
var map_HPAScalingPolicy = map[string]string{
|
||||
"": "HPAScalingPolicy is a single policy which must hold true for a specified past interval.",
|
||||
"type": "type is used to specify the scaling policy.",
|
||||
"value": "value contains the amount of change which is permitted by the policy. It must be greater than zero",
|
||||
"periodSeconds": "periodSeconds specifies the window of time for which the policy should hold true. PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).",
|
||||
}
|
||||
|
||||
func (HPAScalingPolicy) SwaggerDoc() map[string]string {
|
||||
return map_HPAScalingPolicy
|
||||
}
|
||||
|
||||
var map_HPAScalingRules = map[string]string{
|
||||
"": "HPAScalingRules configures the scaling behavior for one direction. These Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.",
|
||||
"stabilizationWindowSeconds": "stabilizationWindowSeconds is the number of seconds for which past recommendations should be considered while scaling up or scaling down. StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour). If not set, use the default values: - For scale up: 0 (i.e. no stabilization is done). - For scale down: 300 (i.e. the stabilization window is 300 seconds long).",
|
||||
"selectPolicy": "selectPolicy is used to specify which policy should be used. If not set, the default value MaxPolicySelect is used.",
|
||||
"policies": "policies is a list of potential scaling polices which can be used during scaling. At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid",
|
||||
}
|
||||
|
||||
func (HPAScalingRules) SwaggerDoc() map[string]string {
|
||||
return map_HPAScalingRules
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscaler = map[string]string{
|
||||
"": "HorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified.",
|
||||
"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
|
||||
"spec": "spec is the specification for the behaviour of the autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.",
|
||||
"status": "status is the current information about the autoscaler.",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscaler) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscaler
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscalerBehavior = map[string]string{
|
||||
"": "HorizontalPodAutoscalerBehavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively).",
|
||||
"scaleUp": "scaleUp is scaling policy for scaling Up. If not set, the default value is the higher of:\n * increase no more than 4 pods per 60 seconds\n * double the number of pods per 60 seconds\nNo stabilization is used.",
|
||||
"scaleDown": "scaleDown is scaling policy for scaling Down. If not set, the default value is to allow to scale down to minReplicas pods, with a 300 second stabilization window (i.e., the highest recommendation for the last 300sec is used).",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscalerBehavior) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscalerBehavior
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscalerCondition = map[string]string{
|
||||
"": "HorizontalPodAutoscalerCondition describes the state of a HorizontalPodAutoscaler at a certain point.",
|
||||
"type": "type describes the current condition",
|
||||
"status": "status is the status of the condition (True, False, Unknown)",
|
||||
"lastTransitionTime": "lastTransitionTime is the last time the condition transitioned from one status to another",
|
||||
"reason": "reason is the reason for the condition's last transition.",
|
||||
"message": "message is a human-readable explanation containing details about the transition",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscalerCondition) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscalerCondition
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscalerList = map[string]string{
|
||||
"": "HorizontalPodAutoscalerList is a list of horizontal pod autoscaler objects.",
|
||||
"metadata": "metadata is the standard list metadata.",
|
||||
"items": "items is the list of horizontal pod autoscaler objects.",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscalerList) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscalerList
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscalerSpec = map[string]string{
|
||||
"": "HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.",
|
||||
"scaleTargetRef": "scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics should be collected, as well as to actually change the replica count.",
|
||||
"minReplicas": "minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.",
|
||||
"maxReplicas": "maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up. It cannot be less that minReplicas.",
|
||||
"metrics": "metrics contains the specifications for which to use to calculate the desired replica count (the maximum replica count across all metrics will be used). The desired replica count is calculated multiplying the ratio between the target value and the current value by the current number of pods. Ergo, metrics used must decrease as the pod count is increased, and vice-versa. See the individual metric source types for more information about how each type of metric must respond. If not set, the default metric will be set to 80% average CPU utilization.",
|
||||
"behavior": "behavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively). If not set, the default HPAScalingRules for scale up and scale down are used.",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscalerSpec) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscalerSpec
|
||||
}
|
||||
|
||||
var map_HorizontalPodAutoscalerStatus = map[string]string{
|
||||
"": "HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.",
|
||||
"observedGeneration": "observedGeneration is the most recent generation observed by this autoscaler.",
|
||||
"lastScaleTime": "lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods, used by the autoscaler to control how often the number of pods is changed.",
|
||||
"currentReplicas": "currentReplicas is current number of replicas of pods managed by this autoscaler, as last seen by the autoscaler.",
|
||||
"desiredReplicas": "desiredReplicas is the desired number of replicas of pods managed by this autoscaler, as last calculated by the autoscaler.",
|
||||
"currentMetrics": "currentMetrics is the last read state of the metrics used by this autoscaler.",
|
||||
"conditions": "conditions is the set of conditions required for this autoscaler to scale its target, and indicates whether or not those conditions are met.",
|
||||
}
|
||||
|
||||
func (HorizontalPodAutoscalerStatus) SwaggerDoc() map[string]string {
|
||||
return map_HorizontalPodAutoscalerStatus
|
||||
}
|
||||
|
||||
var map_MetricIdentifier = map[string]string{
|
||||
"": "MetricIdentifier defines the name and optionally selector for a metric",
|
||||
"name": "name is the name of the given metric",
|
||||
"selector": "selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.",
|
||||
}
|
||||
|
||||
func (MetricIdentifier) SwaggerDoc() map[string]string {
|
||||
return map_MetricIdentifier
|
||||
}
|
||||
|
||||
var map_MetricSpec = map[string]string{
|
||||
"": "MetricSpec specifies how to scale based on a single metric (only `type` and one other matching field should be set at once).",
|
||||
"type": "type is the type of metric source. It should be one of \"ContainerResource\", \"External\", \"Object\", \"Pods\" or \"Resource\", each mapping to a matching field in the object.",
|
||||
"object": "object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).",
|
||||
"pods": "pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.",
|
||||
"resource": "resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"containerResource": "container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod of the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"external": "external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).",
|
||||
}
|
||||
|
||||
func (MetricSpec) SwaggerDoc() map[string]string {
|
||||
return map_MetricSpec
|
||||
}
|
||||
|
||||
var map_MetricStatus = map[string]string{
|
||||
"": "MetricStatus describes the last-read state of a single metric.",
|
||||
"type": "type is the type of metric source. It will be one of \"ContainerResource\", \"External\", \"Object\", \"Pods\" or \"Resource\", each corresponds to a matching field in the object.",
|
||||
"object": "object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).",
|
||||
"pods": "pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.",
|
||||
"resource": "resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"containerResource": "containerResource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"external": "external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).",
|
||||
}
|
||||
|
||||
func (MetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_MetricStatus
|
||||
}
|
||||
|
||||
var map_MetricTarget = map[string]string{
|
||||
"": "MetricTarget defines the target value, average value, or average utilization of a specific metric",
|
||||
"type": "type represents whether the metric type is Utilization, Value, or AverageValue",
|
||||
"value": "value is the target value of the metric (as a quantity).",
|
||||
"averageValue": "averageValue is the target value of the average of the metric across all relevant pods (as a quantity)",
|
||||
"averageUtilization": "averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source type",
|
||||
}
|
||||
|
||||
func (MetricTarget) SwaggerDoc() map[string]string {
|
||||
return map_MetricTarget
|
||||
}
|
||||
|
||||
var map_MetricValueStatus = map[string]string{
|
||||
"": "MetricValueStatus holds the current value for a metric",
|
||||
"value": "value is the current value of the metric (as a quantity).",
|
||||
"averageValue": "averageValue is the current value of the average of the metric across all relevant pods (as a quantity)",
|
||||
"averageUtilization": "averageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.",
|
||||
}
|
||||
|
||||
func (MetricValueStatus) SwaggerDoc() map[string]string {
|
||||
return map_MetricValueStatus
|
||||
}
|
||||
|
||||
var map_ObjectMetricSource = map[string]string{
|
||||
"": "ObjectMetricSource indicates how to scale on a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).",
|
||||
"target": "target specifies the target value for the given metric",
|
||||
"metric": "metric identifies the target metric by name and selector",
|
||||
}
|
||||
|
||||
func (ObjectMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_ObjectMetricSource
|
||||
}
|
||||
|
||||
var map_ObjectMetricStatus = map[string]string{
|
||||
"": "ObjectMetricStatus indicates the current value of a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).",
|
||||
"metric": "metric identifies the target metric by name and selector",
|
||||
"current": "current contains the current value for the given metric",
|
||||
}
|
||||
|
||||
func (ObjectMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_ObjectMetricStatus
|
||||
}
|
||||
|
||||
var map_PodsMetricSource = map[string]string{
|
||||
"": "PodsMetricSource indicates how to scale on a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.",
|
||||
"metric": "metric identifies the target metric by name and selector",
|
||||
"target": "target specifies the target value for the given metric",
|
||||
}
|
||||
|
||||
func (PodsMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_PodsMetricSource
|
||||
}
|
||||
|
||||
var map_PodsMetricStatus = map[string]string{
|
||||
"": "PodsMetricStatus indicates the current value of a metric describing each pod in the current scale target (for example, transactions-processed-per-second).",
|
||||
"metric": "metric identifies the target metric by name and selector",
|
||||
"current": "current contains the current value for the given metric",
|
||||
}
|
||||
|
||||
func (PodsMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_PodsMetricStatus
|
||||
}
|
||||
|
||||
var map_ResourceMetricSource = map[string]string{
|
||||
"": "ResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source. Only one \"target\" type should be set.",
|
||||
"name": "name is the name of the resource in question.",
|
||||
"target": "target specifies the target value for the given metric",
|
||||
}
|
||||
|
||||
func (ResourceMetricSource) SwaggerDoc() map[string]string {
|
||||
return map_ResourceMetricSource
|
||||
}
|
||||
|
||||
var map_ResourceMetricStatus = map[string]string{
|
||||
"": "ResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
|
||||
"name": "name is the name of the resource in question.",
|
||||
"current": "current contains the current value for the given metric",
|
||||
}
|
||||
|
||||
func (ResourceMetricStatus) SwaggerDoc() map[string]string {
|
||||
return map_ResourceMetricStatus
|
||||
}
|
||||
|
||||
// AUTO-GENERATED FUNCTIONS END HERE
|
||||
-610
@@ -1,610 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v2beta2
|
||||
|
||||
import (
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ContainerResourceMetricSource) DeepCopyInto(out *ContainerResourceMetricSource) {
|
||||
*out = *in
|
||||
in.Target.DeepCopyInto(&out.Target)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ContainerResourceMetricSource.
|
||||
func (in *ContainerResourceMetricSource) DeepCopy() *ContainerResourceMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ContainerResourceMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ContainerResourceMetricStatus) DeepCopyInto(out *ContainerResourceMetricStatus) {
|
||||
*out = *in
|
||||
in.Current.DeepCopyInto(&out.Current)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ContainerResourceMetricStatus.
|
||||
func (in *ContainerResourceMetricStatus) DeepCopy() *ContainerResourceMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ContainerResourceMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *CrossVersionObjectReference) DeepCopyInto(out *CrossVersionObjectReference) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CrossVersionObjectReference.
|
||||
func (in *CrossVersionObjectReference) DeepCopy() *CrossVersionObjectReference {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(CrossVersionObjectReference)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ExternalMetricSource) DeepCopyInto(out *ExternalMetricSource) {
|
||||
*out = *in
|
||||
in.Metric.DeepCopyInto(&out.Metric)
|
||||
in.Target.DeepCopyInto(&out.Target)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalMetricSource.
|
||||
func (in *ExternalMetricSource) DeepCopy() *ExternalMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ExternalMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ExternalMetricStatus) DeepCopyInto(out *ExternalMetricStatus) {
|
||||
*out = *in
|
||||
in.Metric.DeepCopyInto(&out.Metric)
|
||||
in.Current.DeepCopyInto(&out.Current)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalMetricStatus.
|
||||
func (in *ExternalMetricStatus) DeepCopy() *ExternalMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ExternalMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HPAScalingPolicy) DeepCopyInto(out *HPAScalingPolicy) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HPAScalingPolicy.
|
||||
func (in *HPAScalingPolicy) DeepCopy() *HPAScalingPolicy {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HPAScalingPolicy)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HPAScalingRules) DeepCopyInto(out *HPAScalingRules) {
|
||||
*out = *in
|
||||
if in.StabilizationWindowSeconds != nil {
|
||||
in, out := &in.StabilizationWindowSeconds, &out.StabilizationWindowSeconds
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
if in.SelectPolicy != nil {
|
||||
in, out := &in.SelectPolicy, &out.SelectPolicy
|
||||
*out = new(ScalingPolicySelect)
|
||||
**out = **in
|
||||
}
|
||||
if in.Policies != nil {
|
||||
in, out := &in.Policies, &out.Policies
|
||||
*out = make([]HPAScalingPolicy, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HPAScalingRules.
|
||||
func (in *HPAScalingRules) DeepCopy() *HPAScalingRules {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HPAScalingRules)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscaler) DeepCopyInto(out *HorizontalPodAutoscaler) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
in.Spec.DeepCopyInto(&out.Spec)
|
||||
in.Status.DeepCopyInto(&out.Status)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscaler.
|
||||
func (in *HorizontalPodAutoscaler) DeepCopy() *HorizontalPodAutoscaler {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscaler)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *HorizontalPodAutoscaler) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscalerBehavior) DeepCopyInto(out *HorizontalPodAutoscalerBehavior) {
|
||||
*out = *in
|
||||
if in.ScaleUp != nil {
|
||||
in, out := &in.ScaleUp, &out.ScaleUp
|
||||
*out = new(HPAScalingRules)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.ScaleDown != nil {
|
||||
in, out := &in.ScaleDown, &out.ScaleDown
|
||||
*out = new(HPAScalingRules)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscalerBehavior.
|
||||
func (in *HorizontalPodAutoscalerBehavior) DeepCopy() *HorizontalPodAutoscalerBehavior {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscalerBehavior)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscalerCondition) DeepCopyInto(out *HorizontalPodAutoscalerCondition) {
|
||||
*out = *in
|
||||
in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscalerCondition.
|
||||
func (in *HorizontalPodAutoscalerCondition) DeepCopy() *HorizontalPodAutoscalerCondition {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscalerCondition)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscalerList) DeepCopyInto(out *HorizontalPodAutoscalerList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]HorizontalPodAutoscaler, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscalerList.
|
||||
func (in *HorizontalPodAutoscalerList) DeepCopy() *HorizontalPodAutoscalerList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscalerList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *HorizontalPodAutoscalerList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscalerSpec) DeepCopyInto(out *HorizontalPodAutoscalerSpec) {
|
||||
*out = *in
|
||||
out.ScaleTargetRef = in.ScaleTargetRef
|
||||
if in.MinReplicas != nil {
|
||||
in, out := &in.MinReplicas, &out.MinReplicas
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
if in.Metrics != nil {
|
||||
in, out := &in.Metrics, &out.Metrics
|
||||
*out = make([]MetricSpec, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
if in.Behavior != nil {
|
||||
in, out := &in.Behavior, &out.Behavior
|
||||
*out = new(HorizontalPodAutoscalerBehavior)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscalerSpec.
|
||||
func (in *HorizontalPodAutoscalerSpec) DeepCopy() *HorizontalPodAutoscalerSpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscalerSpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *HorizontalPodAutoscalerStatus) DeepCopyInto(out *HorizontalPodAutoscalerStatus) {
|
||||
*out = *in
|
||||
if in.ObservedGeneration != nil {
|
||||
in, out := &in.ObservedGeneration, &out.ObservedGeneration
|
||||
*out = new(int64)
|
||||
**out = **in
|
||||
}
|
||||
if in.LastScaleTime != nil {
|
||||
in, out := &in.LastScaleTime, &out.LastScaleTime
|
||||
*out = (*in).DeepCopy()
|
||||
}
|
||||
if in.CurrentMetrics != nil {
|
||||
in, out := &in.CurrentMetrics, &out.CurrentMetrics
|
||||
*out = make([]MetricStatus, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
if in.Conditions != nil {
|
||||
in, out := &in.Conditions, &out.Conditions
|
||||
*out = make([]HorizontalPodAutoscalerCondition, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HorizontalPodAutoscalerStatus.
|
||||
func (in *HorizontalPodAutoscalerStatus) DeepCopy() *HorizontalPodAutoscalerStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(HorizontalPodAutoscalerStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MetricIdentifier) DeepCopyInto(out *MetricIdentifier) {
|
||||
*out = *in
|
||||
if in.Selector != nil {
|
||||
in, out := &in.Selector, &out.Selector
|
||||
*out = new(v1.LabelSelector)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricIdentifier.
|
||||
func (in *MetricIdentifier) DeepCopy() *MetricIdentifier {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MetricIdentifier)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MetricSpec) DeepCopyInto(out *MetricSpec) {
|
||||
*out = *in
|
||||
if in.Object != nil {
|
||||
in, out := &in.Object, &out.Object
|
||||
*out = new(ObjectMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Pods != nil {
|
||||
in, out := &in.Pods, &out.Pods
|
||||
*out = new(PodsMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Resource != nil {
|
||||
in, out := &in.Resource, &out.Resource
|
||||
*out = new(ResourceMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.ContainerResource != nil {
|
||||
in, out := &in.ContainerResource, &out.ContainerResource
|
||||
*out = new(ContainerResourceMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.External != nil {
|
||||
in, out := &in.External, &out.External
|
||||
*out = new(ExternalMetricSource)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricSpec.
|
||||
func (in *MetricSpec) DeepCopy() *MetricSpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MetricSpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MetricStatus) DeepCopyInto(out *MetricStatus) {
|
||||
*out = *in
|
||||
if in.Object != nil {
|
||||
in, out := &in.Object, &out.Object
|
||||
*out = new(ObjectMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Pods != nil {
|
||||
in, out := &in.Pods, &out.Pods
|
||||
*out = new(PodsMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Resource != nil {
|
||||
in, out := &in.Resource, &out.Resource
|
||||
*out = new(ResourceMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.ContainerResource != nil {
|
||||
in, out := &in.ContainerResource, &out.ContainerResource
|
||||
*out = new(ContainerResourceMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.External != nil {
|
||||
in, out := &in.External, &out.External
|
||||
*out = new(ExternalMetricStatus)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricStatus.
|
||||
func (in *MetricStatus) DeepCopy() *MetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MetricTarget) DeepCopyInto(out *MetricTarget) {
|
||||
*out = *in
|
||||
if in.Value != nil {
|
||||
in, out := &in.Value, &out.Value
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
if in.AverageValue != nil {
|
||||
in, out := &in.AverageValue, &out.AverageValue
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
if in.AverageUtilization != nil {
|
||||
in, out := &in.AverageUtilization, &out.AverageUtilization
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricTarget.
|
||||
func (in *MetricTarget) DeepCopy() *MetricTarget {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MetricTarget)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *MetricValueStatus) DeepCopyInto(out *MetricValueStatus) {
|
||||
*out = *in
|
||||
if in.Value != nil {
|
||||
in, out := &in.Value, &out.Value
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
if in.AverageValue != nil {
|
||||
in, out := &in.AverageValue, &out.AverageValue
|
||||
x := (*in).DeepCopy()
|
||||
*out = &x
|
||||
}
|
||||
if in.AverageUtilization != nil {
|
||||
in, out := &in.AverageUtilization, &out.AverageUtilization
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetricValueStatus.
|
||||
func (in *MetricValueStatus) DeepCopy() *MetricValueStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(MetricValueStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ObjectMetricSource) DeepCopyInto(out *ObjectMetricSource) {
|
||||
*out = *in
|
||||
out.DescribedObject = in.DescribedObject
|
||||
in.Target.DeepCopyInto(&out.Target)
|
||||
in.Metric.DeepCopyInto(&out.Metric)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectMetricSource.
|
||||
func (in *ObjectMetricSource) DeepCopy() *ObjectMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ObjectMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ObjectMetricStatus) DeepCopyInto(out *ObjectMetricStatus) {
|
||||
*out = *in
|
||||
in.Metric.DeepCopyInto(&out.Metric)
|
||||
in.Current.DeepCopyInto(&out.Current)
|
||||
out.DescribedObject = in.DescribedObject
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectMetricStatus.
|
||||
func (in *ObjectMetricStatus) DeepCopy() *ObjectMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ObjectMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *PodsMetricSource) DeepCopyInto(out *PodsMetricSource) {
|
||||
*out = *in
|
||||
in.Metric.DeepCopyInto(&out.Metric)
|
||||
in.Target.DeepCopyInto(&out.Target)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodsMetricSource.
|
||||
func (in *PodsMetricSource) DeepCopy() *PodsMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(PodsMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *PodsMetricStatus) DeepCopyInto(out *PodsMetricStatus) {
|
||||
*out = *in
|
||||
in.Metric.DeepCopyInto(&out.Metric)
|
||||
in.Current.DeepCopyInto(&out.Current)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodsMetricStatus.
|
||||
func (in *PodsMetricStatus) DeepCopy() *PodsMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(PodsMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ResourceMetricSource) DeepCopyInto(out *ResourceMetricSource) {
|
||||
*out = *in
|
||||
in.Target.DeepCopyInto(&out.Target)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceMetricSource.
|
||||
func (in *ResourceMetricSource) DeepCopy() *ResourceMetricSource {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ResourceMetricSource)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ResourceMetricStatus) DeepCopyInto(out *ResourceMetricStatus) {
|
||||
*out = *in
|
||||
in.Current.DeepCopyInto(&out.Current)
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceMetricStatus.
|
||||
func (in *ResourceMetricStatus) DeepCopy() *ResourceMetricStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ResourceMetricStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
-142
@@ -1,142 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by openapi-gen. DO NOT EDIT.
|
||||
|
||||
package v2beta2
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ContainerResourceMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.ContainerResourceMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ContainerResourceMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.ContainerResourceMetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in CrossVersionObjectReference) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.CrossVersionObjectReference"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ExternalMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.ExternalMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ExternalMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.ExternalMetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HPAScalingPolicy) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.HPAScalingPolicy"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HPAScalingRules) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.HPAScalingRules"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscaler) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.HorizontalPodAutoscaler"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscalerBehavior) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.HorizontalPodAutoscalerBehavior"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscalerCondition) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.HorizontalPodAutoscalerCondition"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscalerList) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.HorizontalPodAutoscalerList"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscalerSpec) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.HorizontalPodAutoscalerSpec"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in HorizontalPodAutoscalerStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.HorizontalPodAutoscalerStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MetricIdentifier) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.MetricIdentifier"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MetricSpec) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.MetricSpec"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.MetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MetricTarget) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.MetricTarget"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in MetricValueStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.MetricValueStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ObjectMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.ObjectMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ObjectMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.ObjectMetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in PodsMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.PodsMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in PodsMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.PodsMetricStatus"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ResourceMetricSource) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.ResourceMetricSource"
|
||||
}
|
||||
|
||||
// OpenAPIModelName returns the OpenAPI model name for this type.
|
||||
func (in ResourceMetricStatus) OpenAPIModelName() string {
|
||||
return "io.k8s.api.autoscaling.v2beta2.ResourceMetricStatus"
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user