Import of https://github.com/ciena/voltctl at commit 40d61fbf3f910ed4017cf67c9c79e8e1f82a33a5
Change-Id: I8464c59e60d76cb8612891db3303878975b5416c
diff --git a/vendor/k8s.io/api/admissionregistration/v1beta1/types.go b/vendor/k8s.io/api/admissionregistration/v1beta1/types.go
new file mode 100644
index 0000000..6b8c5a2
--- /dev/null
+++ b/vendor/k8s.io/api/admissionregistration/v1beta1/types.go
@@ -0,0 +1,557 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended
+// to make sure that all the tuple expansions are valid.
+type Rule struct {
+ // APIGroups is the API groups the resources belong to. '*' is all groups.
+ // If '*' is present, the length of the slice must be one.
+ // Required.
+ APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,1,rep,name=apiGroups"`
+
+ // APIVersions is the API versions the resources belong to. '*' is all versions.
+ // If '*' is present, the length of the slice must be one.
+ // Required.
+ APIVersions []string `json:"apiVersions,omitempty" protobuf:"bytes,2,rep,name=apiVersions"`
+
+ // Resources is a list of resources this rule applies to.
+ //
+ // For example:
+ // 'pods' means pods.
+ // 'pods/log' means the log subresource of pods.
+ // '*' means all resources, but not subresources.
+ // 'pods/*' means all subresources of pods.
+ // '*/scale' means all scale subresources.
+ // '*/*' means all resources and their subresources.
+ //
+ // If wildcard is present, the validation rule will ensure resources do not
+ // overlap with each other.
+ //
+ // Depending on the enclosing object, subresources might not be allowed.
+ // Required.
+ Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"`
+
+ // scope specifies the scope of this rule.
+ // Valid values are "Cluster", "Namespaced", and "*"
+ // "Cluster" means that only cluster-scoped resources will match this rule.
+ // Namespace API objects are cluster-scoped.
+ // "Namespaced" means that only namespaced resources will match this rule.
+ // "*" means that there are no scope restrictions.
+ // Subresources match the scope of their parent resource.
+ // Default is "*".
+ //
+ // +optional
+ Scope *ScopeType `json:"scope,omitempty" protobuf:"bytes,4,rep,name=scope"`
+}
+
+type ScopeType string
+
+const (
+ // ClusterScope means that scope is limited to cluster-scoped objects.
+ // Namespace objects are cluster-scoped.
+ ClusterScope ScopeType = "Cluster"
+ // NamespacedScope means that scope is limited to namespaced objects.
+ NamespacedScope ScopeType = "Namespaced"
+ // AllScopes means that all scopes are included.
+ AllScopes ScopeType = "*"
+)
+
+type FailurePolicyType string
+
+const (
+ // Ignore means that an error calling the webhook is ignored.
+ Ignore FailurePolicyType = "Ignore"
+ // Fail means that an error calling the webhook causes the admission to fail.
+ Fail FailurePolicyType = "Fail"
+)
+
+// MatchPolicyType specifies the type of match policy
+type MatchPolicyType string
+
+const (
+ // Exact means requests should only be sent to the webhook if they exactly match a given rule
+ Exact MatchPolicyType = "Exact"
+ // Equivalent means requests should be sent to the webhook if they modify a resource listed in rules via another API group or version.
+ Equivalent MatchPolicyType = "Equivalent"
+)
+
+type SideEffectClass string
+
+const (
+ // SideEffectClassUnknown means that no information is known about the side effects of calling the webhook.
+ // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail.
+ SideEffectClassUnknown SideEffectClass = "Unknown"
+ // SideEffectClassNone means that calling the webhook will have no side effects.
+ SideEffectClassNone SideEffectClass = "None"
+ // SideEffectClassSome means that calling the webhook will possibly have side effects.
+ // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail.
+ SideEffectClassSome SideEffectClass = "Some"
+ // SideEffectClassNoneOnDryRun means that calling the webhook will possibly have side effects, but if the
+ // request being reviewed has the dry-run attribute, the side effects will be suppressed.
+ SideEffectClassNoneOnDryRun SideEffectClass = "NoneOnDryRun"
+)
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
+type ValidatingWebhookConfiguration struct {
+ metav1.TypeMeta `json:",inline"`
+ // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata.
+ // +optional
+ metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+ // Webhooks is a list of webhooks and the affected resources and operations.
+ // +optional
+ // +patchMergeKey=name
+ // +patchStrategy=merge
+ Webhooks []ValidatingWebhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
+type ValidatingWebhookConfigurationList struct {
+ metav1.TypeMeta `json:",inline"`
+ // Standard list metadata.
+ // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
+ // +optional
+ metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+ // List of ValidatingWebhookConfiguration.
+ Items []ValidatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
+type MutatingWebhookConfiguration struct {
+ metav1.TypeMeta `json:",inline"`
+ // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata.
+ // +optional
+ metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+ // Webhooks is a list of webhooks and the affected resources and operations.
+ // +optional
+ // +patchMergeKey=name
+ // +patchStrategy=merge
+ Webhooks []MutatingWebhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
+type MutatingWebhookConfigurationList struct {
+ metav1.TypeMeta `json:",inline"`
+ // Standard list metadata.
+ // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
+ // +optional
+ metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+ // List of MutatingWebhookConfiguration.
+ Items []MutatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
+type ValidatingWebhook struct {
+ // The name of the admission webhook.
+ // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
+ // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
+ // of the organization.
+ // Required.
+ Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+ // ClientConfig defines how to communicate with the hook.
+ // Required
+ ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`
+
+ // Rules describes what operations on what resources/subresources the webhook cares about.
+ // The webhook cares about an operation if it matches _any_ Rule.
+ // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
+ // from putting the cluster in a state which cannot be recovered from without completely
+ // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
+ // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
+ Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
+
+ // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
+ // allowed values are Ignore or Fail. Defaults to Ignore.
+ // +optional
+ FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`
+
+ // matchPolicy defines how the "rules" list is used to match incoming requests.
+ // Allowed values are "Exact" or "Equivalent".
+ //
+ // - Exact: match a request only if it exactly matches a specified rule.
+ // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
+ // but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
+ // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
+ //
+ // - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
+ // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
+ // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
+ // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
+ //
+ // Defaults to "Exact"
+ // +optional
+ MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`
+
+ // NamespaceSelector decides whether to run the webhook on an object based
+ // on whether the namespace for that object matches the selector. If the
+ // object itself is a namespace, the matching is performed on
+ // object.metadata.labels. If the object is another cluster scoped resource,
+ // it never skips the webhook.
+ //
+ // For example, to run the webhook on any objects whose namespace is not
+ // associated with "runlevel" of "0" or "1"; you will set the selector as
+ // follows:
+ // "namespaceSelector": {
+ // "matchExpressions": [
+ // {
+ // "key": "runlevel",
+ // "operator": "NotIn",
+ // "values": [
+ // "0",
+ // "1"
+ // ]
+ // }
+ // ]
+ // }
+ //
+ // If instead you want to only run the webhook on any objects whose
+ // namespace is associated with the "environment" of "prod" or "staging";
+ // you will set the selector as follows:
+ // "namespaceSelector": {
+ // "matchExpressions": [
+ // {
+ // "key": "environment",
+ // "operator": "In",
+ // "values": [
+ // "prod",
+ // "staging"
+ // ]
+ // }
+ // ]
+ // }
+ //
+ // See
+ // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+ // for more examples of label selectors.
+ //
+ // Default to the empty LabelSelector, which matches everything.
+ // +optional
+ NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`
+
+ // ObjectSelector decides whether to run the webhook based on if the
+ // object has matching labels. objectSelector is evaluated against both
+ // the oldObject and newObject that would be sent to the webhook, and
+ // is considered to match if either object matches the selector. A null
+ // object (oldObject in the case of create, or newObject in the case of
+ // delete) or an object that cannot have labels (like a
+ // DeploymentRollback or a PodProxyOptions object) is not considered to
+ // match.
+ // Use the object selector only if the webhook is opt-in, because end
+ // users may skip the admission webhook by setting the labels.
+ // Default to the empty LabelSelector, which matches everything.
+ // +optional
+ ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,10,opt,name=objectSelector"`
+
+ // SideEffects states whether this webhookk has side effects.
+ // Acceptable values are: Unknown, None, Some, NoneOnDryRun
+ // Webhooks with side effects MUST implement a reconciliation system, since a request may be
+ // rejected by a future step in the admission change and the side effects therefore need to be undone.
+ // Requests with the dryRun attribute will be auto-rejected if they match a webhook with
+ // sideEffects == Unknown or Some. Defaults to Unknown.
+ // +optional
+ SideEffects *SideEffectClass `json:"sideEffects,omitempty" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`
+
+ // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
+ // the webhook call will be ignored or the API call will fail based on the
+ // failure policy.
+ // The timeout value must be between 1 and 30 seconds.
+ // Default to 30 seconds.
+ // +optional
+ TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`
+
+ // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
+ // versions the Webhook expects. API server will try to use first version in
+ // the list which it supports. If none of the versions specified in this list
+ // supported by API server, validation will fail for this object.
+ // If a persisted webhook configuration specifies allowed versions and does not
+ // include any versions known to the API Server, calls to the webhook will fail
+ // and be subject to the failure policy.
+ // Default to `['v1beta1']`.
+ // +optional
+ AdmissionReviewVersions []string `json:"admissionReviewVersions,omitempty" protobuf:"bytes,8,rep,name=admissionReviewVersions"`
+}
+
+// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
+type MutatingWebhook struct {
+ // The name of the admission webhook.
+ // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
+ // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
+ // of the organization.
+ // Required.
+ Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+ // ClientConfig defines how to communicate with the hook.
+ // Required
+ ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`
+
+ // Rules describes what operations on what resources/subresources the webhook cares about.
+ // The webhook cares about an operation if it matches _any_ Rule.
+ // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
+ // from putting the cluster in a state which cannot be recovered from without completely
+ // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
+ // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
+ Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
+
+ // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
+ // allowed values are Ignore or Fail. Defaults to Ignore.
+ // +optional
+ FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`
+
+ // matchPolicy defines how the "rules" list is used to match incoming requests.
+ // Allowed values are "Exact" or "Equivalent".
+ //
+ // - Exact: match a request only if it exactly matches a specified rule.
+ // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
+ // but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
+ // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
+ //
+ // - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
+ // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
+ // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
+ // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
+ //
+ // Defaults to "Exact"
+ // +optional
+ MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`
+
+ // NamespaceSelector decides whether to run the webhook on an object based
+ // on whether the namespace for that object matches the selector. If the
+ // object itself is a namespace, the matching is performed on
+ // object.metadata.labels. If the object is another cluster scoped resource,
+ // it never skips the webhook.
+ //
+ // For example, to run the webhook on any objects whose namespace is not
+ // associated with "runlevel" of "0" or "1"; you will set the selector as
+ // follows:
+ // "namespaceSelector": {
+ // "matchExpressions": [
+ // {
+ // "key": "runlevel",
+ // "operator": "NotIn",
+ // "values": [
+ // "0",
+ // "1"
+ // ]
+ // }
+ // ]
+ // }
+ //
+ // If instead you want to only run the webhook on any objects whose
+ // namespace is associated with the "environment" of "prod" or "staging";
+ // you will set the selector as follows:
+ // "namespaceSelector": {
+ // "matchExpressions": [
+ // {
+ // "key": "environment",
+ // "operator": "In",
+ // "values": [
+ // "prod",
+ // "staging"
+ // ]
+ // }
+ // ]
+ // }
+ //
+ // See
+ // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+ // for more examples of label selectors.
+ //
+ // Default to the empty LabelSelector, which matches everything.
+ // +optional
+ NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`
+
+ // ObjectSelector decides whether to run the webhook based on if the
+ // object has matching labels. objectSelector is evaluated against both
+ // the oldObject and newObject that would be sent to the webhook, and
+ // is considered to match if either object matches the selector. A null
+ // object (oldObject in the case of create, or newObject in the case of
+ // delete) or an object that cannot have labels (like a
+ // DeploymentRollback or a PodProxyOptions object) is not considered to
+ // match.
+ // Use the object selector only if the webhook is opt-in, because end
+ // users may skip the admission webhook by setting the labels.
+ // Default to the empty LabelSelector, which matches everything.
+ // +optional
+ ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,11,opt,name=objectSelector"`
+
+ // SideEffects states whether this webhookk has side effects.
+ // Acceptable values are: Unknown, None, Some, NoneOnDryRun
+ // Webhooks with side effects MUST implement a reconciliation system, since a request may be
+ // rejected by a future step in the admission change and the side effects therefore need to be undone.
+ // Requests with the dryRun attribute will be auto-rejected if they match a webhook with
+ // sideEffects == Unknown or Some. Defaults to Unknown.
+ // +optional
+ SideEffects *SideEffectClass `json:"sideEffects,omitempty" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`
+
+ // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
+ // the webhook call will be ignored or the API call will fail based on the
+ // failure policy.
+ // The timeout value must be between 1 and 30 seconds.
+ // Default to 30 seconds.
+ // +optional
+ TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`
+
+ // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
+ // versions the Webhook expects. API server will try to use first version in
+ // the list which it supports. If none of the versions specified in this list
+ // supported by API server, validation will fail for this object.
+ // If a persisted webhook configuration specifies allowed versions and does not
+ // include any versions known to the API Server, calls to the webhook will fail
+ // and be subject to the failure policy.
+ // Default to `['v1beta1']`.
+ // +optional
+ AdmissionReviewVersions []string `json:"admissionReviewVersions,omitempty" protobuf:"bytes,8,rep,name=admissionReviewVersions"`
+
+ // reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.
+ // Allowed values are "Never" and "IfNeeded".
+ //
+ // Never: the webhook will not be called more than once in a single admission evaluation.
+ //
+ // IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation
+ // if the object being admitted is modified by other admission plugins after the initial webhook call.
+ // Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted.
+ // Note:
+ // * the number of additional invocations is not guaranteed to be exactly one.
+ // * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.
+ // * webhooks that use this option may be reordered to minimize the number of additional invocations.
+ // * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.
+ //
+ // Defaults to "Never".
+ // +optional
+ ReinvocationPolicy *ReinvocationPolicyType `json:"reinvocationPolicy,omitempty" protobuf:"bytes,10,opt,name=reinvocationPolicy,casttype=ReinvocationPolicyType"`
+}
+
+// ReinvocationPolicyType specifies what type of policy the admission hook uses.
+type ReinvocationPolicyType string
+
+const (
+ // NeverReinvocationPolicy indicates that the webhook must not be called more than once in a
+ // single admission evaluation.
+ NeverReinvocationPolicy ReinvocationPolicyType = "Never"
+ // IfNeededReinvocationPolicy indicates that the webhook may be called at least one
+ // additional time as part of the admission evaluation if the object being admitted is
+ // modified by other admission plugins after the initial webhook call.
+ IfNeededReinvocationPolicy ReinvocationPolicyType = "IfNeeded"
+)
+
+// RuleWithOperations is a tuple of Operations and Resources. It is recommended to make
+// sure that all the tuple expansions are valid.
+type RuleWithOperations struct {
+ // Operations is the operations the admission hook cares about - CREATE, UPDATE, or *
+ // for all operations.
+ // If '*' is present, the length of the slice must be one.
+ // Required.
+ Operations []OperationType `json:"operations,omitempty" protobuf:"bytes,1,rep,name=operations,casttype=OperationType"`
+ // Rule is embedded, it describes other criteria of the rule, like
+ // APIGroups, APIVersions, Resources, etc.
+ Rule `json:",inline" protobuf:"bytes,2,opt,name=rule"`
+}
+
+type OperationType string
+
+// The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go.
+const (
+ OperationAll OperationType = "*"
+ Create OperationType = "CREATE"
+ Update OperationType = "UPDATE"
+ Delete OperationType = "DELETE"
+ Connect OperationType = "CONNECT"
+)
+
+// WebhookClientConfig contains the information to make a TLS
+// connection with the webhook
+type WebhookClientConfig struct {
+ // `url` gives the location of the webhook, in standard URL form
+ // (`scheme://host:port/path`). Exactly one of `url` or `service`
+ // must be specified.
+ //
+ // The `host` should not refer to a service running in the cluster; use
+ // the `service` field instead. The host might be resolved via external
+ // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
+ // in-cluster DNS as that would be a layering violation). `host` may
+ // also be an IP address.
+ //
+ // Please note that using `localhost` or `127.0.0.1` as a `host` is
+ // risky unless you take great care to run this webhook on all hosts
+ // which run an apiserver which might need to make calls to this
+ // webhook. Such installs are likely to be non-portable, i.e., not easy
+ // to turn up in a new cluster.
+ //
+ // The scheme must be "https"; the URL must begin with "https://".
+ //
+ // A path is optional, and if present may be any string permissible in
+ // a URL. You may use the path to pass an arbitrary string to the
+ // webhook, for example, a cluster identifier.
+ //
+ // Attempting to use a user or basic auth e.g. "user:password@" is not
+ // allowed. Fragments ("#...") and query parameters ("?...") are not
+ // allowed, either.
+ //
+ // +optional
+ URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"`
+
+ // `service` is a reference to the service for this webhook. Either
+ // `service` or `url` must be specified.
+ //
+ // If the webhook is running within the cluster, then you should use `service`.
+ //
+ // +optional
+ Service *ServiceReference `json:"service,omitempty" protobuf:"bytes,1,opt,name=service"`
+
+ // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
+ // If unspecified, system trust roots on the apiserver are used.
+ // +optional
+ CABundle []byte `json:"caBundle,omitempty" protobuf:"bytes,2,opt,name=caBundle"`
+}
+
+// ServiceReference holds a reference to Service.legacy.k8s.io
+type ServiceReference struct {
+ // `namespace` is the namespace of the service.
+ // Required
+ Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
+ // `name` is the name of the service.
+ // Required
+ Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
+
+ // `path` is an optional URL path which will be sent in any request to
+ // this service.
+ // +optional
+ Path *string `json:"path,omitempty" protobuf:"bytes,3,opt,name=path"`
+
+ // If specified, the port on the service that hosting webhook.
+ // Default to 443 for backward compatibility.
+ // `port` should be a valid port number (1-65535, inclusive).
+ // +optional
+ Port *int32 `json:"port,omitempty" protobuf:"varint,4,opt,name=port"`
+}