Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 1 | /* |
| 2 | Copyright 2017 The Kubernetes Authors. |
| 3 | |
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | you may not use this file except in compliance with the License. |
| 6 | You may obtain a copy of the License at |
| 7 | |
| 8 | http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | |
| 10 | Unless required by applicable law or agreed to in writing, software |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | See the License for the specific language governing permissions and |
| 14 | limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | package v1beta1 |
| 18 | |
| 19 | import ( |
| 20 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 21 | ) |
| 22 | |
| 23 | // Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended |
| 24 | // to make sure that all the tuple expansions are valid. |
| 25 | type Rule struct { |
| 26 | // APIGroups is the API groups the resources belong to. '*' is all groups. |
| 27 | // If '*' is present, the length of the slice must be one. |
| 28 | // Required. |
| 29 | APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,1,rep,name=apiGroups"` |
| 30 | |
| 31 | // APIVersions is the API versions the resources belong to. '*' is all versions. |
| 32 | // If '*' is present, the length of the slice must be one. |
| 33 | // Required. |
| 34 | APIVersions []string `json:"apiVersions,omitempty" protobuf:"bytes,2,rep,name=apiVersions"` |
| 35 | |
| 36 | // Resources is a list of resources this rule applies to. |
| 37 | // |
| 38 | // For example: |
| 39 | // 'pods' means pods. |
| 40 | // 'pods/log' means the log subresource of pods. |
| 41 | // '*' means all resources, but not subresources. |
| 42 | // 'pods/*' means all subresources of pods. |
| 43 | // '*/scale' means all scale subresources. |
| 44 | // '*/*' means all resources and their subresources. |
| 45 | // |
| 46 | // If wildcard is present, the validation rule will ensure resources do not |
| 47 | // overlap with each other. |
| 48 | // |
| 49 | // Depending on the enclosing object, subresources might not be allowed. |
| 50 | // Required. |
| 51 | Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"` |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 52 | |
| 53 | // scope specifies the scope of this rule. |
| 54 | // Valid values are "Cluster", "Namespaced", and "*" |
| 55 | // "Cluster" means that only cluster-scoped resources will match this rule. |
| 56 | // Namespace API objects are cluster-scoped. |
| 57 | // "Namespaced" means that only namespaced resources will match this rule. |
| 58 | // "*" means that there are no scope restrictions. |
| 59 | // Subresources match the scope of their parent resource. |
| 60 | // Default is "*". |
| 61 | // |
| 62 | // +optional |
| 63 | Scope *ScopeType `json:"scope,omitempty" protobuf:"bytes,4,rep,name=scope"` |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 64 | } |
| 65 | |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 66 | type ScopeType string |
| 67 | |
| 68 | const ( |
| 69 | // ClusterScope means that scope is limited to cluster-scoped objects. |
| 70 | // Namespace objects are cluster-scoped. |
| 71 | ClusterScope ScopeType = "Cluster" |
| 72 | // NamespacedScope means that scope is limited to namespaced objects. |
| 73 | NamespacedScope ScopeType = "Namespaced" |
| 74 | // AllScopes means that all scopes are included. |
| 75 | AllScopes ScopeType = "*" |
| 76 | ) |
| 77 | |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 78 | type FailurePolicyType string |
| 79 | |
| 80 | const ( |
| 81 | // Ignore means that an error calling the webhook is ignored. |
| 82 | Ignore FailurePolicyType = "Ignore" |
| 83 | // Fail means that an error calling the webhook causes the admission to fail. |
| 84 | Fail FailurePolicyType = "Fail" |
| 85 | ) |
| 86 | |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 87 | // MatchPolicyType specifies the type of match policy |
| 88 | type MatchPolicyType string |
| 89 | |
| 90 | const ( |
| 91 | // Exact means requests should only be sent to the webhook if they exactly match a given rule |
| 92 | Exact MatchPolicyType = "Exact" |
| 93 | // Equivalent means requests should be sent to the webhook if they modify a resource listed in rules via another API group or version. |
| 94 | Equivalent MatchPolicyType = "Equivalent" |
| 95 | ) |
| 96 | |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 97 | type SideEffectClass string |
| 98 | |
| 99 | const ( |
| 100 | // SideEffectClassUnknown means that no information is known about the side effects of calling the webhook. |
| 101 | // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail. |
| 102 | SideEffectClassUnknown SideEffectClass = "Unknown" |
| 103 | // SideEffectClassNone means that calling the webhook will have no side effects. |
| 104 | SideEffectClassNone SideEffectClass = "None" |
| 105 | // SideEffectClassSome means that calling the webhook will possibly have side effects. |
| 106 | // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail. |
| 107 | SideEffectClassSome SideEffectClass = "Some" |
| 108 | // SideEffectClassNoneOnDryRun means that calling the webhook will possibly have side effects, but if the |
| 109 | // request being reviewed has the dry-run attribute, the side effects will be suppressed. |
| 110 | SideEffectClassNoneOnDryRun SideEffectClass = "NoneOnDryRun" |
| 111 | ) |
| 112 | |
| 113 | // +genclient |
| 114 | // +genclient:nonNamespaced |
| 115 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 116 | |
| 117 | // ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it. |
| 118 | type ValidatingWebhookConfiguration struct { |
| 119 | metav1.TypeMeta `json:",inline"` |
| 120 | // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. |
| 121 | // +optional |
| 122 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 123 | // Webhooks is a list of webhooks and the affected resources and operations. |
| 124 | // +optional |
| 125 | // +patchMergeKey=name |
| 126 | // +patchStrategy=merge |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 127 | Webhooks []ValidatingWebhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"` |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 128 | } |
| 129 | |
| 130 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 131 | |
| 132 | // ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration. |
| 133 | type ValidatingWebhookConfigurationList struct { |
| 134 | metav1.TypeMeta `json:",inline"` |
| 135 | // Standard list metadata. |
| 136 | // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds |
| 137 | // +optional |
| 138 | metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 139 | // List of ValidatingWebhookConfiguration. |
| 140 | Items []ValidatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` |
| 141 | } |
| 142 | |
| 143 | // +genclient |
| 144 | // +genclient:nonNamespaced |
| 145 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 146 | |
| 147 | // MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object. |
| 148 | type MutatingWebhookConfiguration struct { |
| 149 | metav1.TypeMeta `json:",inline"` |
| 150 | // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. |
| 151 | // +optional |
| 152 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 153 | // Webhooks is a list of webhooks and the affected resources and operations. |
| 154 | // +optional |
| 155 | // +patchMergeKey=name |
| 156 | // +patchStrategy=merge |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 157 | Webhooks []MutatingWebhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"` |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 158 | } |
| 159 | |
| 160 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 161 | |
| 162 | // MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration. |
| 163 | type MutatingWebhookConfigurationList struct { |
| 164 | metav1.TypeMeta `json:",inline"` |
| 165 | // Standard list metadata. |
| 166 | // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds |
| 167 | // +optional |
| 168 | metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 169 | // List of MutatingWebhookConfiguration. |
| 170 | Items []MutatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` |
| 171 | } |
| 172 | |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 173 | // ValidatingWebhook describes an admission webhook and the resources and operations it applies to. |
| 174 | type ValidatingWebhook struct { |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 175 | // The name of the admission webhook. |
| 176 | // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where |
| 177 | // "imagepolicy" is the name of the webhook, and kubernetes.io is the name |
| 178 | // of the organization. |
| 179 | // Required. |
| 180 | Name string `json:"name" protobuf:"bytes,1,opt,name=name"` |
| 181 | |
| 182 | // ClientConfig defines how to communicate with the hook. |
| 183 | // Required |
| 184 | ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"` |
| 185 | |
| 186 | // Rules describes what operations on what resources/subresources the webhook cares about. |
| 187 | // The webhook cares about an operation if it matches _any_ Rule. |
| 188 | // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks |
| 189 | // from putting the cluster in a state which cannot be recovered from without completely |
| 190 | // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called |
| 191 | // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects. |
| 192 | Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"` |
| 193 | |
| 194 | // FailurePolicy defines how unrecognized errors from the admission endpoint are handled - |
| 195 | // allowed values are Ignore or Fail. Defaults to Ignore. |
| 196 | // +optional |
| 197 | FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"` |
| 198 | |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 199 | // matchPolicy defines how the "rules" list is used to match incoming requests. |
| 200 | // Allowed values are "Exact" or "Equivalent". |
| 201 | // |
| 202 | // - Exact: match a request only if it exactly matches a specified rule. |
| 203 | // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, |
| 204 | // but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, |
| 205 | // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook. |
| 206 | // |
| 207 | // - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. |
| 208 | // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, |
| 209 | // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, |
| 210 | // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook. |
| 211 | // |
| 212 | // Defaults to "Exact" |
| 213 | // +optional |
| 214 | MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"` |
| 215 | |
| 216 | // NamespaceSelector decides whether to run the webhook on an object based |
| 217 | // on whether the namespace for that object matches the selector. If the |
| 218 | // object itself is a namespace, the matching is performed on |
| 219 | // object.metadata.labels. If the object is another cluster scoped resource, |
| 220 | // it never skips the webhook. |
| 221 | // |
| 222 | // For example, to run the webhook on any objects whose namespace is not |
| 223 | // associated with "runlevel" of "0" or "1"; you will set the selector as |
| 224 | // follows: |
| 225 | // "namespaceSelector": { |
| 226 | // "matchExpressions": [ |
| 227 | // { |
| 228 | // "key": "runlevel", |
| 229 | // "operator": "NotIn", |
| 230 | // "values": [ |
| 231 | // "0", |
| 232 | // "1" |
| 233 | // ] |
| 234 | // } |
| 235 | // ] |
| 236 | // } |
| 237 | // |
| 238 | // If instead you want to only run the webhook on any objects whose |
| 239 | // namespace is associated with the "environment" of "prod" or "staging"; |
| 240 | // you will set the selector as follows: |
| 241 | // "namespaceSelector": { |
| 242 | // "matchExpressions": [ |
| 243 | // { |
| 244 | // "key": "environment", |
| 245 | // "operator": "In", |
| 246 | // "values": [ |
| 247 | // "prod", |
| 248 | // "staging" |
| 249 | // ] |
| 250 | // } |
| 251 | // ] |
| 252 | // } |
| 253 | // |
| 254 | // See |
| 255 | // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels |
| 256 | // for more examples of label selectors. |
| 257 | // |
| 258 | // Default to the empty LabelSelector, which matches everything. |
| 259 | // +optional |
| 260 | NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"` |
| 261 | |
| 262 | // ObjectSelector decides whether to run the webhook based on if the |
| 263 | // object has matching labels. objectSelector is evaluated against both |
| 264 | // the oldObject and newObject that would be sent to the webhook, and |
| 265 | // is considered to match if either object matches the selector. A null |
| 266 | // object (oldObject in the case of create, or newObject in the case of |
| 267 | // delete) or an object that cannot have labels (like a |
| 268 | // DeploymentRollback or a PodProxyOptions object) is not considered to |
| 269 | // match. |
| 270 | // Use the object selector only if the webhook is opt-in, because end |
| 271 | // users may skip the admission webhook by setting the labels. |
| 272 | // Default to the empty LabelSelector, which matches everything. |
| 273 | // +optional |
| 274 | ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,10,opt,name=objectSelector"` |
| 275 | |
| 276 | // SideEffects states whether this webhookk has side effects. |
| 277 | // Acceptable values are: Unknown, None, Some, NoneOnDryRun |
| 278 | // Webhooks with side effects MUST implement a reconciliation system, since a request may be |
| 279 | // rejected by a future step in the admission change and the side effects therefore need to be undone. |
| 280 | // Requests with the dryRun attribute will be auto-rejected if they match a webhook with |
| 281 | // sideEffects == Unknown or Some. Defaults to Unknown. |
| 282 | // +optional |
| 283 | SideEffects *SideEffectClass `json:"sideEffects,omitempty" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"` |
| 284 | |
| 285 | // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, |
| 286 | // the webhook call will be ignored or the API call will fail based on the |
| 287 | // failure policy. |
| 288 | // The timeout value must be between 1 and 30 seconds. |
| 289 | // Default to 30 seconds. |
| 290 | // +optional |
| 291 | TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"` |
| 292 | |
| 293 | // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` |
| 294 | // versions the Webhook expects. API server will try to use first version in |
| 295 | // the list which it supports. If none of the versions specified in this list |
| 296 | // supported by API server, validation will fail for this object. |
| 297 | // If a persisted webhook configuration specifies allowed versions and does not |
| 298 | // include any versions known to the API Server, calls to the webhook will fail |
| 299 | // and be subject to the failure policy. |
| 300 | // Default to `['v1beta1']`. |
| 301 | // +optional |
| 302 | AdmissionReviewVersions []string `json:"admissionReviewVersions,omitempty" protobuf:"bytes,8,rep,name=admissionReviewVersions"` |
| 303 | } |
| 304 | |
| 305 | // MutatingWebhook describes an admission webhook and the resources and operations it applies to. |
| 306 | type MutatingWebhook struct { |
| 307 | // The name of the admission webhook. |
| 308 | // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where |
| 309 | // "imagepolicy" is the name of the webhook, and kubernetes.io is the name |
| 310 | // of the organization. |
| 311 | // Required. |
| 312 | Name string `json:"name" protobuf:"bytes,1,opt,name=name"` |
| 313 | |
| 314 | // ClientConfig defines how to communicate with the hook. |
| 315 | // Required |
| 316 | ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"` |
| 317 | |
| 318 | // Rules describes what operations on what resources/subresources the webhook cares about. |
| 319 | // The webhook cares about an operation if it matches _any_ Rule. |
| 320 | // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks |
| 321 | // from putting the cluster in a state which cannot be recovered from without completely |
| 322 | // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called |
| 323 | // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects. |
| 324 | Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"` |
| 325 | |
| 326 | // FailurePolicy defines how unrecognized errors from the admission endpoint are handled - |
| 327 | // allowed values are Ignore or Fail. Defaults to Ignore. |
| 328 | // +optional |
| 329 | FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"` |
| 330 | |
| 331 | // matchPolicy defines how the "rules" list is used to match incoming requests. |
| 332 | // Allowed values are "Exact" or "Equivalent". |
| 333 | // |
| 334 | // - Exact: match a request only if it exactly matches a specified rule. |
| 335 | // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, |
| 336 | // but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, |
| 337 | // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook. |
| 338 | // |
| 339 | // - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. |
| 340 | // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, |
| 341 | // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, |
| 342 | // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook. |
| 343 | // |
| 344 | // Defaults to "Exact" |
| 345 | // +optional |
| 346 | MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"` |
| 347 | |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 348 | // NamespaceSelector decides whether to run the webhook on an object based |
| 349 | // on whether the namespace for that object matches the selector. If the |
| 350 | // object itself is a namespace, the matching is performed on |
| 351 | // object.metadata.labels. If the object is another cluster scoped resource, |
| 352 | // it never skips the webhook. |
| 353 | // |
| 354 | // For example, to run the webhook on any objects whose namespace is not |
| 355 | // associated with "runlevel" of "0" or "1"; you will set the selector as |
| 356 | // follows: |
| 357 | // "namespaceSelector": { |
| 358 | // "matchExpressions": [ |
| 359 | // { |
| 360 | // "key": "runlevel", |
| 361 | // "operator": "NotIn", |
| 362 | // "values": [ |
| 363 | // "0", |
| 364 | // "1" |
| 365 | // ] |
| 366 | // } |
| 367 | // ] |
| 368 | // } |
| 369 | // |
| 370 | // If instead you want to only run the webhook on any objects whose |
| 371 | // namespace is associated with the "environment" of "prod" or "staging"; |
| 372 | // you will set the selector as follows: |
| 373 | // "namespaceSelector": { |
| 374 | // "matchExpressions": [ |
| 375 | // { |
| 376 | // "key": "environment", |
| 377 | // "operator": "In", |
| 378 | // "values": [ |
| 379 | // "prod", |
| 380 | // "staging" |
| 381 | // ] |
| 382 | // } |
| 383 | // ] |
| 384 | // } |
| 385 | // |
| 386 | // See |
| 387 | // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ |
| 388 | // for more examples of label selectors. |
| 389 | // |
| 390 | // Default to the empty LabelSelector, which matches everything. |
| 391 | // +optional |
| 392 | NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"` |
| 393 | |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 394 | // ObjectSelector decides whether to run the webhook based on if the |
| 395 | // object has matching labels. objectSelector is evaluated against both |
| 396 | // the oldObject and newObject that would be sent to the webhook, and |
| 397 | // is considered to match if either object matches the selector. A null |
| 398 | // object (oldObject in the case of create, or newObject in the case of |
| 399 | // delete) or an object that cannot have labels (like a |
| 400 | // DeploymentRollback or a PodProxyOptions object) is not considered to |
| 401 | // match. |
| 402 | // Use the object selector only if the webhook is opt-in, because end |
| 403 | // users may skip the admission webhook by setting the labels. |
| 404 | // Default to the empty LabelSelector, which matches everything. |
| 405 | // +optional |
| 406 | ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,11,opt,name=objectSelector"` |
| 407 | |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 408 | // SideEffects states whether this webhookk has side effects. |
| 409 | // Acceptable values are: Unknown, None, Some, NoneOnDryRun |
| 410 | // Webhooks with side effects MUST implement a reconciliation system, since a request may be |
| 411 | // rejected by a future step in the admission change and the side effects therefore need to be undone. |
| 412 | // Requests with the dryRun attribute will be auto-rejected if they match a webhook with |
| 413 | // sideEffects == Unknown or Some. Defaults to Unknown. |
| 414 | // +optional |
| 415 | SideEffects *SideEffectClass `json:"sideEffects,omitempty" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"` |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 416 | |
| 417 | // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, |
| 418 | // the webhook call will be ignored or the API call will fail based on the |
| 419 | // failure policy. |
| 420 | // The timeout value must be between 1 and 30 seconds. |
| 421 | // Default to 30 seconds. |
| 422 | // +optional |
| 423 | TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"` |
| 424 | |
| 425 | // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` |
| 426 | // versions the Webhook expects. API server will try to use first version in |
| 427 | // the list which it supports. If none of the versions specified in this list |
| 428 | // supported by API server, validation will fail for this object. |
| 429 | // If a persisted webhook configuration specifies allowed versions and does not |
| 430 | // include any versions known to the API Server, calls to the webhook will fail |
| 431 | // and be subject to the failure policy. |
| 432 | // Default to `['v1beta1']`. |
| 433 | // +optional |
| 434 | AdmissionReviewVersions []string `json:"admissionReviewVersions,omitempty" protobuf:"bytes,8,rep,name=admissionReviewVersions"` |
| 435 | |
| 436 | // reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation. |
| 437 | // Allowed values are "Never" and "IfNeeded". |
| 438 | // |
| 439 | // Never: the webhook will not be called more than once in a single admission evaluation. |
| 440 | // |
| 441 | // IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation |
| 442 | // if the object being admitted is modified by other admission plugins after the initial webhook call. |
| 443 | // Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted. |
| 444 | // Note: |
| 445 | // * the number of additional invocations is not guaranteed to be exactly one. |
| 446 | // * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again. |
| 447 | // * webhooks that use this option may be reordered to minimize the number of additional invocations. |
| 448 | // * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead. |
| 449 | // |
| 450 | // Defaults to "Never". |
| 451 | // +optional |
| 452 | ReinvocationPolicy *ReinvocationPolicyType `json:"reinvocationPolicy,omitempty" protobuf:"bytes,10,opt,name=reinvocationPolicy,casttype=ReinvocationPolicyType"` |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 453 | } |
| 454 | |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 455 | // ReinvocationPolicyType specifies what type of policy the admission hook uses. |
| 456 | type ReinvocationPolicyType string |
| 457 | |
| 458 | const ( |
| 459 | // NeverReinvocationPolicy indicates that the webhook must not be called more than once in a |
| 460 | // single admission evaluation. |
| 461 | NeverReinvocationPolicy ReinvocationPolicyType = "Never" |
| 462 | // IfNeededReinvocationPolicy indicates that the webhook may be called at least one |
| 463 | // additional time as part of the admission evaluation if the object being admitted is |
| 464 | // modified by other admission plugins after the initial webhook call. |
| 465 | IfNeededReinvocationPolicy ReinvocationPolicyType = "IfNeeded" |
| 466 | ) |
| 467 | |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 468 | // RuleWithOperations is a tuple of Operations and Resources. It is recommended to make |
| 469 | // sure that all the tuple expansions are valid. |
| 470 | type RuleWithOperations struct { |
| 471 | // Operations is the operations the admission hook cares about - CREATE, UPDATE, or * |
| 472 | // for all operations. |
| 473 | // If '*' is present, the length of the slice must be one. |
| 474 | // Required. |
| 475 | Operations []OperationType `json:"operations,omitempty" protobuf:"bytes,1,rep,name=operations,casttype=OperationType"` |
| 476 | // Rule is embedded, it describes other criteria of the rule, like |
| 477 | // APIGroups, APIVersions, Resources, etc. |
| 478 | Rule `json:",inline" protobuf:"bytes,2,opt,name=rule"` |
| 479 | } |
| 480 | |
| 481 | type OperationType string |
| 482 | |
| 483 | // The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go. |
| 484 | const ( |
| 485 | OperationAll OperationType = "*" |
| 486 | Create OperationType = "CREATE" |
| 487 | Update OperationType = "UPDATE" |
| 488 | Delete OperationType = "DELETE" |
| 489 | Connect OperationType = "CONNECT" |
| 490 | ) |
| 491 | |
| 492 | // WebhookClientConfig contains the information to make a TLS |
| 493 | // connection with the webhook |
| 494 | type WebhookClientConfig struct { |
| 495 | // `url` gives the location of the webhook, in standard URL form |
| 496 | // (`scheme://host:port/path`). Exactly one of `url` or `service` |
| 497 | // must be specified. |
| 498 | // |
| 499 | // The `host` should not refer to a service running in the cluster; use |
| 500 | // the `service` field instead. The host might be resolved via external |
| 501 | // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve |
| 502 | // in-cluster DNS as that would be a layering violation). `host` may |
| 503 | // also be an IP address. |
| 504 | // |
| 505 | // Please note that using `localhost` or `127.0.0.1` as a `host` is |
| 506 | // risky unless you take great care to run this webhook on all hosts |
| 507 | // which run an apiserver which might need to make calls to this |
| 508 | // webhook. Such installs are likely to be non-portable, i.e., not easy |
| 509 | // to turn up in a new cluster. |
| 510 | // |
| 511 | // The scheme must be "https"; the URL must begin with "https://". |
| 512 | // |
| 513 | // A path is optional, and if present may be any string permissible in |
| 514 | // a URL. You may use the path to pass an arbitrary string to the |
| 515 | // webhook, for example, a cluster identifier. |
| 516 | // |
| 517 | // Attempting to use a user or basic auth e.g. "user:password@" is not |
| 518 | // allowed. Fragments ("#...") and query parameters ("?...") are not |
| 519 | // allowed, either. |
| 520 | // |
| 521 | // +optional |
| 522 | URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"` |
| 523 | |
| 524 | // `service` is a reference to the service for this webhook. Either |
| 525 | // `service` or `url` must be specified. |
| 526 | // |
| 527 | // If the webhook is running within the cluster, then you should use `service`. |
| 528 | // |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 529 | // +optional |
| 530 | Service *ServiceReference `json:"service,omitempty" protobuf:"bytes,1,opt,name=service"` |
| 531 | |
| 532 | // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. |
| 533 | // If unspecified, system trust roots on the apiserver are used. |
| 534 | // +optional |
| 535 | CABundle []byte `json:"caBundle,omitempty" protobuf:"bytes,2,opt,name=caBundle"` |
| 536 | } |
| 537 | |
| 538 | // ServiceReference holds a reference to Service.legacy.k8s.io |
| 539 | type ServiceReference struct { |
| 540 | // `namespace` is the namespace of the service. |
| 541 | // Required |
| 542 | Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"` |
| 543 | // `name` is the name of the service. |
| 544 | // Required |
| 545 | Name string `json:"name" protobuf:"bytes,2,opt,name=name"` |
| 546 | |
| 547 | // `path` is an optional URL path which will be sent in any request to |
| 548 | // this service. |
| 549 | // +optional |
| 550 | Path *string `json:"path,omitempty" protobuf:"bytes,3,opt,name=path"` |
girishk | e7ca43b | 2019-10-10 12:30:03 +0000 | [diff] [blame] | 551 | |
| 552 | // If specified, the port on the service that hosting webhook. |
| 553 | // Default to 443 for backward compatibility. |
| 554 | // `port` should be a valid port number (1-65535, inclusive). |
| 555 | // +optional |
| 556 | Port *int32 `json:"port,omitempty" protobuf:"varint,4,opt,name=port"` |
Scott Baker | e7144bc | 2019-10-01 14:16:47 -0700 | [diff] [blame] | 557 | } |