| /* |
| Copyright 2017 The Kubernetes Authors. |
| |
| Licensed under the Apache License, Version 2.0 (the "License"); |
| you may not use this file except in compliance with the License. |
| You may obtain a copy of the License at |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, software |
| distributed under the License is distributed on an "AS IS" BASIS, |
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| See the License for the specific language governing permissions and |
| limitations under the License. |
| */ |
| |
| package v1beta1 |
| |
| import ( |
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| ) |
| |
| // Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended |
| // to make sure that all the tuple expansions are valid. |
| type Rule struct { |
| // APIGroups is the API groups the resources belong to. '*' is all groups. |
| // If '*' is present, the length of the slice must be one. |
| // Required. |
| APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,1,rep,name=apiGroups"` |
| |
| // APIVersions is the API versions the resources belong to. '*' is all versions. |
| // If '*' is present, the length of the slice must be one. |
| // Required. |
| APIVersions []string `json:"apiVersions,omitempty" protobuf:"bytes,2,rep,name=apiVersions"` |
| |
| // Resources is a list of resources this rule applies to. |
| // |
| // For example: |
| // 'pods' means pods. |
| // 'pods/log' means the log subresource of pods. |
| // '*' means all resources, but not subresources. |
| // 'pods/*' means all subresources of pods. |
| // '*/scale' means all scale subresources. |
| // '*/*' means all resources and their subresources. |
| // |
| // If wildcard is present, the validation rule will ensure resources do not |
| // overlap with each other. |
| // |
| // Depending on the enclosing object, subresources might not be allowed. |
| // Required. |
| Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"` |
| } |
| |
| type FailurePolicyType string |
| |
| const ( |
| // Ignore means that an error calling the webhook is ignored. |
| Ignore FailurePolicyType = "Ignore" |
| // Fail means that an error calling the webhook causes the admission to fail. |
| Fail FailurePolicyType = "Fail" |
| ) |
| |
| type SideEffectClass string |
| |
| const ( |
| // SideEffectClassUnknown means that no information is known about the side effects of calling the webhook. |
| // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail. |
| SideEffectClassUnknown SideEffectClass = "Unknown" |
| // SideEffectClassNone means that calling the webhook will have no side effects. |
| SideEffectClassNone SideEffectClass = "None" |
| // SideEffectClassSome means that calling the webhook will possibly have side effects. |
| // If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail. |
| SideEffectClassSome SideEffectClass = "Some" |
| // SideEffectClassNoneOnDryRun means that calling the webhook will possibly have side effects, but if the |
| // request being reviewed has the dry-run attribute, the side effects will be suppressed. |
| SideEffectClassNoneOnDryRun SideEffectClass = "NoneOnDryRun" |
| ) |
| |
| // +genclient |
| // +genclient:nonNamespaced |
| // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| |
| // ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it. |
| type ValidatingWebhookConfiguration struct { |
| metav1.TypeMeta `json:",inline"` |
| // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. |
| // +optional |
| metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| // Webhooks is a list of webhooks and the affected resources and operations. |
| // +optional |
| // +patchMergeKey=name |
| // +patchStrategy=merge |
| Webhooks []Webhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"` |
| } |
| |
| // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| |
| // ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration. |
| type ValidatingWebhookConfigurationList struct { |
| metav1.TypeMeta `json:",inline"` |
| // Standard list metadata. |
| // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds |
| // +optional |
| metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| // List of ValidatingWebhookConfiguration. |
| Items []ValidatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` |
| } |
| |
| // +genclient |
| // +genclient:nonNamespaced |
| // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| |
| // MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object. |
| type MutatingWebhookConfiguration struct { |
| metav1.TypeMeta `json:",inline"` |
| // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. |
| // +optional |
| metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| // Webhooks is a list of webhooks and the affected resources and operations. |
| // +optional |
| // +patchMergeKey=name |
| // +patchStrategy=merge |
| Webhooks []Webhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"` |
| } |
| |
| // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| |
| // MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration. |
| type MutatingWebhookConfigurationList struct { |
| metav1.TypeMeta `json:",inline"` |
| // Standard list metadata. |
| // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds |
| // +optional |
| metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| // List of MutatingWebhookConfiguration. |
| Items []MutatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` |
| } |
| |
| // Webhook describes an admission webhook and the resources and operations it applies to. |
| type Webhook struct { |
| // The name of the admission webhook. |
| // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where |
| // "imagepolicy" is the name of the webhook, and kubernetes.io is the name |
| // of the organization. |
| // Required. |
| Name string `json:"name" protobuf:"bytes,1,opt,name=name"` |
| |
| // ClientConfig defines how to communicate with the hook. |
| // Required |
| ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"` |
| |
| // Rules describes what operations on what resources/subresources the webhook cares about. |
| // The webhook cares about an operation if it matches _any_ Rule. |
| // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks |
| // from putting the cluster in a state which cannot be recovered from without completely |
| // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called |
| // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects. |
| Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"` |
| |
| // FailurePolicy defines how unrecognized errors from the admission endpoint are handled - |
| // allowed values are Ignore or Fail. Defaults to Ignore. |
| // +optional |
| FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"` |
| |
| // NamespaceSelector decides whether to run the webhook on an object based |
| // on whether the namespace for that object matches the selector. If the |
| // object itself is a namespace, the matching is performed on |
| // object.metadata.labels. If the object is another cluster scoped resource, |
| // it never skips the webhook. |
| // |
| // For example, to run the webhook on any objects whose namespace is not |
| // associated with "runlevel" of "0" or "1"; you will set the selector as |
| // follows: |
| // "namespaceSelector": { |
| // "matchExpressions": [ |
| // { |
| // "key": "runlevel", |
| // "operator": "NotIn", |
| // "values": [ |
| // "0", |
| // "1" |
| // ] |
| // } |
| // ] |
| // } |
| // |
| // If instead you want to only run the webhook on any objects whose |
| // namespace is associated with the "environment" of "prod" or "staging"; |
| // you will set the selector as follows: |
| // "namespaceSelector": { |
| // "matchExpressions": [ |
| // { |
| // "key": "environment", |
| // "operator": "In", |
| // "values": [ |
| // "prod", |
| // "staging" |
| // ] |
| // } |
| // ] |
| // } |
| // |
| // See |
| // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ |
| // for more examples of label selectors. |
| // |
| // Default to the empty LabelSelector, which matches everything. |
| // +optional |
| NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"` |
| |
| // SideEffects states whether this webhookk has side effects. |
| // Acceptable values are: Unknown, None, Some, NoneOnDryRun |
| // Webhooks with side effects MUST implement a reconciliation system, since a request may be |
| // rejected by a future step in the admission change and the side effects therefore need to be undone. |
| // Requests with the dryRun attribute will be auto-rejected if they match a webhook with |
| // sideEffects == Unknown or Some. Defaults to Unknown. |
| // +optional |
| SideEffects *SideEffectClass `json:"sideEffects,omitempty" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"` |
| } |
| |
| // RuleWithOperations is a tuple of Operations and Resources. It is recommended to make |
| // sure that all the tuple expansions are valid. |
| type RuleWithOperations struct { |
| // Operations is the operations the admission hook cares about - CREATE, UPDATE, or * |
| // for all operations. |
| // If '*' is present, the length of the slice must be one. |
| // Required. |
| Operations []OperationType `json:"operations,omitempty" protobuf:"bytes,1,rep,name=operations,casttype=OperationType"` |
| // Rule is embedded, it describes other criteria of the rule, like |
| // APIGroups, APIVersions, Resources, etc. |
| Rule `json:",inline" protobuf:"bytes,2,opt,name=rule"` |
| } |
| |
| type OperationType string |
| |
| // The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go. |
| const ( |
| OperationAll OperationType = "*" |
| Create OperationType = "CREATE" |
| Update OperationType = "UPDATE" |
| Delete OperationType = "DELETE" |
| Connect OperationType = "CONNECT" |
| ) |
| |
| // WebhookClientConfig contains the information to make a TLS |
| // connection with the webhook |
| type WebhookClientConfig struct { |
| // `url` gives the location of the webhook, in standard URL form |
| // (`scheme://host:port/path`). Exactly one of `url` or `service` |
| // must be specified. |
| // |
| // The `host` should not refer to a service running in the cluster; use |
| // the `service` field instead. The host might be resolved via external |
| // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve |
| // in-cluster DNS as that would be a layering violation). `host` may |
| // also be an IP address. |
| // |
| // Please note that using `localhost` or `127.0.0.1` as a `host` is |
| // risky unless you take great care to run this webhook on all hosts |
| // which run an apiserver which might need to make calls to this |
| // webhook. Such installs are likely to be non-portable, i.e., not easy |
| // to turn up in a new cluster. |
| // |
| // The scheme must be "https"; the URL must begin with "https://". |
| // |
| // A path is optional, and if present may be any string permissible in |
| // a URL. You may use the path to pass an arbitrary string to the |
| // webhook, for example, a cluster identifier. |
| // |
| // Attempting to use a user or basic auth e.g. "user:password@" is not |
| // allowed. Fragments ("#...") and query parameters ("?...") are not |
| // allowed, either. |
| // |
| // +optional |
| URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"` |
| |
| // `service` is a reference to the service for this webhook. Either |
| // `service` or `url` must be specified. |
| // |
| // If the webhook is running within the cluster, then you should use `service`. |
| // |
| // Port 443 will be used if it is open, otherwise it is an error. |
| // |
| // +optional |
| Service *ServiceReference `json:"service,omitempty" protobuf:"bytes,1,opt,name=service"` |
| |
| // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. |
| // If unspecified, system trust roots on the apiserver are used. |
| // +optional |
| CABundle []byte `json:"caBundle,omitempty" protobuf:"bytes,2,opt,name=caBundle"` |
| } |
| |
| // ServiceReference holds a reference to Service.legacy.k8s.io |
| type ServiceReference struct { |
| // `namespace` is the namespace of the service. |
| // Required |
| Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"` |
| // `name` is the name of the service. |
| // Required |
| Name string `json:"name" protobuf:"bytes,2,opt,name=name"` |
| |
| // `path` is an optional URL path which will be sent in any request to |
| // this service. |
| // +optional |
| Path *string `json:"path,omitempty" protobuf:"bytes,3,opt,name=path"` |
| } |