Matteo Scandolo | a428586 | 2020-12-01 18:10:10 -0800 | [diff] [blame^] | 1 | /* |
| 2 | Copyright The Kubernetes Authors. |
| 3 | |
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | you may not use this file except in compliance with the License. |
| 6 | You may obtain a copy of the License at |
| 7 | |
| 8 | http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | |
| 10 | Unless required by applicable law or agreed to in writing, software |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | See the License for the specific language governing permissions and |
| 14 | limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | |
| 18 | // This file was autogenerated by go-to-protobuf. Do not edit it manually! |
| 19 | |
| 20 | syntax = 'proto2'; |
| 21 | |
| 22 | package k8s.io.api.flowcontrol.v1alpha1; |
| 23 | |
| 24 | import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto"; |
| 25 | import "k8s.io/apimachinery/pkg/runtime/generated.proto"; |
| 26 | import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto"; |
| 27 | |
| 28 | // Package-wide variables from generator "generated". |
| 29 | option go_package = "v1alpha1"; |
| 30 | |
| 31 | // FlowDistinguisherMethod specifies the method of a flow distinguisher. |
| 32 | message FlowDistinguisherMethod { |
| 33 | // `type` is the type of flow distinguisher method |
| 34 | // The supported types are "ByUser" and "ByNamespace". |
| 35 | // Required. |
| 36 | optional string type = 1; |
| 37 | } |
| 38 | |
| 39 | // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with |
| 40 | // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher". |
| 41 | message FlowSchema { |
| 42 | // `metadata` is the standard object's metadata. |
| 43 | // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata |
| 44 | // +optional |
| 45 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; |
| 46 | |
| 47 | // `spec` is the specification of the desired behavior of a FlowSchema. |
| 48 | // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |
| 49 | // +optional |
| 50 | optional FlowSchemaSpec spec = 2; |
| 51 | |
| 52 | // `status` is the current status of a FlowSchema. |
| 53 | // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |
| 54 | // +optional |
| 55 | optional FlowSchemaStatus status = 3; |
| 56 | } |
| 57 | |
| 58 | // FlowSchemaCondition describes conditions for a FlowSchema. |
| 59 | message FlowSchemaCondition { |
| 60 | // `type` is the type of the condition. |
| 61 | // Required. |
| 62 | optional string type = 1; |
| 63 | |
| 64 | // `status` is the status of the condition. |
| 65 | // Can be True, False, Unknown. |
| 66 | // Required. |
| 67 | optional string status = 2; |
| 68 | |
| 69 | // `lastTransitionTime` is the last time the condition transitioned from one status to another. |
| 70 | optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3; |
| 71 | |
| 72 | // `reason` is a unique, one-word, CamelCase reason for the condition's last transition. |
| 73 | optional string reason = 4; |
| 74 | |
| 75 | // `message` is a human-readable message indicating details about last transition. |
| 76 | optional string message = 5; |
| 77 | } |
| 78 | |
| 79 | // FlowSchemaList is a list of FlowSchema objects. |
| 80 | message FlowSchemaList { |
| 81 | // `metadata` is the standard list metadata. |
| 82 | // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata |
| 83 | // +optional |
| 84 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1; |
| 85 | |
| 86 | // `items` is a list of FlowSchemas. |
| 87 | repeated FlowSchema items = 2; |
| 88 | } |
| 89 | |
| 90 | // FlowSchemaSpec describes how the FlowSchema's specification looks like. |
| 91 | message FlowSchemaSpec { |
| 92 | // `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot |
| 93 | // be resolved, the FlowSchema will be ignored and marked as invalid in its status. |
| 94 | // Required. |
| 95 | optional PriorityLevelConfigurationReference priorityLevelConfiguration = 1; |
| 96 | |
| 97 | // `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen |
| 98 | // FlowSchema is among those with the numerically lowest (which we take to be logically highest) |
| 99 | // MatchingPrecedence. Each MatchingPrecedence value must be ranged in [1,10000]. |
| 100 | // Note that if the precedence is not specified, it will be set to 1000 as default. |
| 101 | // +optional |
| 102 | optional int32 matchingPrecedence = 2; |
| 103 | |
| 104 | // `distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema. |
| 105 | // `nil` specifies that the distinguisher is disabled and thus will always be the empty string. |
| 106 | // +optional |
| 107 | optional FlowDistinguisherMethod distinguisherMethod = 3; |
| 108 | |
| 109 | // `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if |
| 110 | // at least one member of rules matches the request. |
| 111 | // if it is an empty slice, there will be no requests matching the FlowSchema. |
| 112 | // +listType=atomic |
| 113 | // +optional |
| 114 | repeated PolicyRulesWithSubjects rules = 4; |
| 115 | } |
| 116 | |
| 117 | // FlowSchemaStatus represents the current state of a FlowSchema. |
| 118 | message FlowSchemaStatus { |
| 119 | // `conditions` is a list of the current states of FlowSchema. |
| 120 | // +listType=map |
| 121 | // +listMapKey=type |
| 122 | // +optional |
| 123 | repeated FlowSchemaCondition conditions = 1; |
| 124 | } |
| 125 | |
| 126 | // GroupSubject holds detailed information for group-kind subject. |
| 127 | message GroupSubject { |
| 128 | // name is the user group that matches, or "*" to match all user groups. |
| 129 | // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some |
| 130 | // well-known group names. |
| 131 | // Required. |
| 132 | optional string name = 1; |
| 133 | } |
| 134 | |
| 135 | // LimitResponse defines how to handle requests that can not be executed right now. |
| 136 | // +union |
| 137 | message LimitResponse { |
| 138 | // `type` is "Queue" or "Reject". |
| 139 | // "Queue" means that requests that can not be executed upon arrival |
| 140 | // are held in a queue until they can be executed or a queuing limit |
| 141 | // is reached. |
| 142 | // "Reject" means that requests that can not be executed upon arrival |
| 143 | // are rejected. |
| 144 | // Required. |
| 145 | // +unionDiscriminator |
| 146 | optional string type = 1; |
| 147 | |
| 148 | // `queuing` holds the configuration parameters for queuing. |
| 149 | // This field may be non-empty only if `type` is `"Queue"`. |
| 150 | // +optional |
| 151 | optional QueuingConfiguration queuing = 2; |
| 152 | } |
| 153 | |
| 154 | // LimitedPriorityLevelConfiguration specifies how to handle requests that are subject to limits. |
| 155 | // It addresses two issues: |
| 156 | // * How are requests for this priority level limited? |
| 157 | // * What should be done with requests that exceed the limit? |
| 158 | message LimitedPriorityLevelConfiguration { |
| 159 | // `assuredConcurrencyShares` (ACS) configures the execution |
| 160 | // limit, which is a limit on the number of requests of this |
| 161 | // priority level that may be exeucting at a given time. ACS must |
| 162 | // be a positive number. The server's concurrency limit (SCL) is |
| 163 | // divided among the concurrency-controlled priority levels in |
| 164 | // proportion to their assured concurrency shares. This produces |
| 165 | // the assured concurrency value (ACV) --- the number of requests |
| 166 | // that may be executing at a time --- for each such priority |
| 167 | // level: |
| 168 | // |
| 169 | // ACV(l) = ceil( SCL * ACS(l) / ( sum[priority levels k] ACS(k) ) ) |
| 170 | // |
| 171 | // bigger numbers of ACS mean more reserved concurrent requests (at the |
| 172 | // expense of every other PL). |
| 173 | // This field has a default value of 30. |
| 174 | // +optional |
| 175 | optional int32 assuredConcurrencyShares = 1; |
| 176 | |
| 177 | // `limitResponse` indicates what to do with requests that can not be executed right now |
| 178 | optional LimitResponse limitResponse = 2; |
| 179 | } |
| 180 | |
| 181 | // NonResourcePolicyRule is a predicate that matches non-resource requests according to their verb and the |
| 182 | // target non-resource URL. A NonResourcePolicyRule matches a request if and only if both (a) at least one member |
| 183 | // of verbs matches the request and (b) at least one member of nonResourceURLs matches the request. |
| 184 | message NonResourcePolicyRule { |
| 185 | // `verbs` is a list of matching verbs and may not be empty. |
| 186 | // "*" matches all verbs. If it is present, it must be the only entry. |
| 187 | // +listType=set |
| 188 | // Required. |
| 189 | repeated string verbs = 1; |
| 190 | |
| 191 | // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty. |
| 192 | // For example: |
| 193 | // - "/healthz" is legal |
| 194 | // - "/hea*" is illegal |
| 195 | // - "/hea" is legal but matches nothing |
| 196 | // - "/hea/*" also matches nothing |
| 197 | // - "/healthz/*" matches all per-component health checks. |
| 198 | // "*" matches all non-resource urls. if it is present, it must be the only entry. |
| 199 | // +listType=set |
| 200 | // Required. |
| 201 | repeated string nonResourceURLs = 6; |
| 202 | } |
| 203 | |
| 204 | // PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject |
| 205 | // making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches |
| 206 | // a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member |
| 207 | // of resourceRules or nonResourceRules matches the request. |
| 208 | message PolicyRulesWithSubjects { |
| 209 | // subjects is the list of normal user, serviceaccount, or group that this rule cares about. |
| 210 | // There must be at least one member in this slice. |
| 211 | // A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request. |
| 212 | // +listType=atomic |
| 213 | // Required. |
| 214 | repeated Subject subjects = 1; |
| 215 | |
| 216 | // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the |
| 217 | // target resource. |
| 218 | // At least one of `resourceRules` and `nonResourceRules` has to be non-empty. |
| 219 | // +listType=atomic |
| 220 | // +optional |
| 221 | repeated ResourcePolicyRule resourceRules = 2; |
| 222 | |
| 223 | // `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb |
| 224 | // and the target non-resource URL. |
| 225 | // +listType=atomic |
| 226 | // +optional |
| 227 | repeated NonResourcePolicyRule nonResourceRules = 3; |
| 228 | } |
| 229 | |
| 230 | // PriorityLevelConfiguration represents the configuration of a priority level. |
| 231 | message PriorityLevelConfiguration { |
| 232 | // `metadata` is the standard object's metadata. |
| 233 | // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata |
| 234 | // +optional |
| 235 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; |
| 236 | |
| 237 | // `spec` is the specification of the desired behavior of a "request-priority". |
| 238 | // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |
| 239 | // +optional |
| 240 | optional PriorityLevelConfigurationSpec spec = 2; |
| 241 | |
| 242 | // `status` is the current status of a "request-priority". |
| 243 | // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |
| 244 | // +optional |
| 245 | optional PriorityLevelConfigurationStatus status = 3; |
| 246 | } |
| 247 | |
| 248 | // PriorityLevelConfigurationCondition defines the condition of priority level. |
| 249 | message PriorityLevelConfigurationCondition { |
| 250 | // `type` is the type of the condition. |
| 251 | // Required. |
| 252 | optional string type = 1; |
| 253 | |
| 254 | // `status` is the status of the condition. |
| 255 | // Can be True, False, Unknown. |
| 256 | // Required. |
| 257 | optional string status = 2; |
| 258 | |
| 259 | // `lastTransitionTime` is the last time the condition transitioned from one status to another. |
| 260 | optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3; |
| 261 | |
| 262 | // `reason` is a unique, one-word, CamelCase reason for the condition's last transition. |
| 263 | optional string reason = 4; |
| 264 | |
| 265 | // `message` is a human-readable message indicating details about last transition. |
| 266 | optional string message = 5; |
| 267 | } |
| 268 | |
| 269 | // PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects. |
| 270 | message PriorityLevelConfigurationList { |
| 271 | // `metadata` is the standard object's metadata. |
| 272 | // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata |
| 273 | // +optional |
| 274 | optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1; |
| 275 | |
| 276 | // `items` is a list of request-priorities. |
| 277 | repeated PriorityLevelConfiguration items = 2; |
| 278 | } |
| 279 | |
| 280 | // PriorityLevelConfigurationReference contains information that points to the "request-priority" being used. |
| 281 | message PriorityLevelConfigurationReference { |
| 282 | // `name` is the name of the priority level configuration being referenced |
| 283 | // Required. |
| 284 | optional string name = 1; |
| 285 | } |
| 286 | |
| 287 | // PriorityLevelConfigurationSpec specifies the configuration of a priority level. |
| 288 | // +union |
| 289 | message PriorityLevelConfigurationSpec { |
| 290 | // `type` indicates whether this priority level is subject to |
| 291 | // limitation on request execution. A value of `"Exempt"` means |
| 292 | // that requests of this priority level are not subject to a limit |
| 293 | // (and thus are never queued) and do not detract from the |
| 294 | // capacity made available to other priority levels. A value of |
| 295 | // `"Limited"` means that (a) requests of this priority level |
| 296 | // _are_ subject to limits and (b) some of the server's limited |
| 297 | // capacity is made available exclusively to this priority level. |
| 298 | // Required. |
| 299 | // +unionDiscriminator |
| 300 | optional string type = 1; |
| 301 | |
| 302 | // `limited` specifies how requests are handled for a Limited priority level. |
| 303 | // This field must be non-empty if and only if `type` is `"Limited"`. |
| 304 | // +optional |
| 305 | optional LimitedPriorityLevelConfiguration limited = 2; |
| 306 | } |
| 307 | |
| 308 | // PriorityLevelConfigurationStatus represents the current state of a "request-priority". |
| 309 | message PriorityLevelConfigurationStatus { |
| 310 | // `conditions` is the current state of "request-priority". |
| 311 | // +listType=map |
| 312 | // +listMapKey=type |
| 313 | // +optional |
| 314 | repeated PriorityLevelConfigurationCondition conditions = 1; |
| 315 | } |
| 316 | |
| 317 | // QueuingConfiguration holds the configuration parameters for queuing |
| 318 | message QueuingConfiguration { |
| 319 | // `queues` is the number of queues for this priority level. The |
| 320 | // queues exist independently at each apiserver. The value must be |
| 321 | // positive. Setting it to 1 effectively precludes |
| 322 | // shufflesharding and thus makes the distinguisher method of |
| 323 | // associated flow schemas irrelevant. This field has a default |
| 324 | // value of 64. |
| 325 | // +optional |
| 326 | optional int32 queues = 1; |
| 327 | |
| 328 | // `handSize` is a small positive number that configures the |
| 329 | // shuffle sharding of requests into queues. When enqueuing a request |
| 330 | // at this priority level the request's flow identifier (a string |
| 331 | // pair) is hashed and the hash value is used to shuffle the list |
| 332 | // of queues and deal a hand of the size specified here. The |
| 333 | // request is put into one of the shortest queues in that hand. |
| 334 | // `handSize` must be no larger than `queues`, and should be |
| 335 | // significantly smaller (so that a few heavy flows do not |
| 336 | // saturate most of the queues). See the user-facing |
| 337 | // documentation for more extensive guidance on setting this |
| 338 | // field. This field has a default value of 8. |
| 339 | // +optional |
| 340 | optional int32 handSize = 2; |
| 341 | |
| 342 | // `queueLengthLimit` is the maximum number of requests allowed to |
| 343 | // be waiting in a given queue of this priority level at a time; |
| 344 | // excess requests are rejected. This value must be positive. If |
| 345 | // not specified, it will be defaulted to 50. |
| 346 | // +optional |
| 347 | optional int32 queueLengthLimit = 3; |
| 348 | } |
| 349 | |
| 350 | // ResourcePolicyRule is a predicate that matches some resource |
| 351 | // requests, testing the request's verb and the target resource. A |
| 352 | // ResourcePolicyRule matches a resource request if and only if: (a) |
| 353 | // at least one member of verbs matches the request, (b) at least one |
| 354 | // member of apiGroups matches the request, (c) at least one member of |
| 355 | // resources matches the request, and (d) least one member of |
| 356 | // namespaces matches the request. |
| 357 | message ResourcePolicyRule { |
| 358 | // `verbs` is a list of matching verbs and may not be empty. |
| 359 | // "*" matches all verbs and, if present, must be the only entry. |
| 360 | // +listType=set |
| 361 | // Required. |
| 362 | repeated string verbs = 1; |
| 363 | |
| 364 | // `apiGroups` is a list of matching API groups and may not be empty. |
| 365 | // "*" matches all API groups and, if present, must be the only entry. |
| 366 | // +listType=set |
| 367 | // Required. |
| 368 | repeated string apiGroups = 2; |
| 369 | |
| 370 | // `resources` is a list of matching resources (i.e., lowercase |
| 371 | // and plural) with, if desired, subresource. For example, [ |
| 372 | // "services", "nodes/status" ]. This list may not be empty. |
| 373 | // "*" matches all resources and, if present, must be the only entry. |
| 374 | // Required. |
| 375 | // +listType=set |
| 376 | repeated string resources = 3; |
| 377 | |
| 378 | // `clusterScope` indicates whether to match requests that do not |
| 379 | // specify a namespace (which happens either because the resource |
| 380 | // is not namespaced or the request targets all namespaces). |
| 381 | // If this field is omitted or false then the `namespaces` field |
| 382 | // must contain a non-empty list. |
| 383 | // +optional |
| 384 | optional bool clusterScope = 4; |
| 385 | |
| 386 | // `namespaces` is a list of target namespaces that restricts |
| 387 | // matches. A request that specifies a target namespace matches |
| 388 | // only if either (a) this list contains that target namespace or |
| 389 | // (b) this list contains "*". Note that "*" matches any |
| 390 | // specified namespace but does not match a request that _does |
| 391 | // not specify_ a namespace (see the `clusterScope` field for |
| 392 | // that). |
| 393 | // This list may be empty, but only if `clusterScope` is true. |
| 394 | // +optional |
| 395 | // +listType=set |
| 396 | repeated string namespaces = 5; |
| 397 | } |
| 398 | |
| 399 | // ServiceAccountSubject holds detailed information for service-account-kind subject. |
| 400 | message ServiceAccountSubject { |
| 401 | // `namespace` is the namespace of matching ServiceAccount objects. |
| 402 | // Required. |
| 403 | optional string namespace = 1; |
| 404 | |
| 405 | // `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name. |
| 406 | // Required. |
| 407 | optional string name = 2; |
| 408 | } |
| 409 | |
| 410 | // Subject matches the originator of a request, as identified by the request authentication system. There are three |
| 411 | // ways of matching an originator; by user, group, or service account. |
| 412 | // +union |
| 413 | message Subject { |
| 414 | // Required |
| 415 | // +unionDiscriminator |
| 416 | optional string kind = 1; |
| 417 | |
| 418 | // +optional |
| 419 | optional UserSubject user = 2; |
| 420 | |
| 421 | // +optional |
| 422 | optional GroupSubject group = 3; |
| 423 | |
| 424 | // +optional |
| 425 | optional ServiceAccountSubject serviceAccount = 4; |
| 426 | } |
| 427 | |
| 428 | // UserSubject holds detailed information for user-kind subject. |
| 429 | message UserSubject { |
| 430 | // `name` is the username that matches, or "*" to match all usernames. |
| 431 | // Required. |
| 432 | optional string name = 1; |
| 433 | } |
| 434 | |