mirror of
https://github.com/ceph/ceph-csi.git
synced 2024-10-19 05:39:51 +00:00
1b23d78113
Updated kubernetes packages to latest release. resizefs package has been included into k8s.io/mount-utils package. updated code to use the same. Updates: #1968 Signed-off-by: Rakshith R <rar@redhat.com>
556 lines
26 KiB
Go
556 lines
26 KiB
Go
/*
|
|
Copyright 2019 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package v1
|
|
|
|
import (
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
)
|
|
|
|
// Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended
|
|
// to make sure that all the tuple expansions are valid.
|
|
type Rule struct {
|
|
// APIGroups is the API groups the resources belong to. '*' is all groups.
|
|
// If '*' is present, the length of the slice must be one.
|
|
// Required.
|
|
APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,1,rep,name=apiGroups"`
|
|
|
|
// APIVersions is the API versions the resources belong to. '*' is all versions.
|
|
// If '*' is present, the length of the slice must be one.
|
|
// Required.
|
|
APIVersions []string `json:"apiVersions,omitempty" protobuf:"bytes,2,rep,name=apiVersions"`
|
|
|
|
// Resources is a list of resources this rule applies to.
|
|
//
|
|
// For example:
|
|
// 'pods' means pods.
|
|
// 'pods/log' means the log subresource of pods.
|
|
// '*' means all resources, but not subresources.
|
|
// 'pods/*' means all subresources of pods.
|
|
// '*/scale' means all scale subresources.
|
|
// '*/*' means all resources and their subresources.
|
|
//
|
|
// If wildcard is present, the validation rule will ensure resources do not
|
|
// overlap with each other.
|
|
//
|
|
// Depending on the enclosing object, subresources might not be allowed.
|
|
// Required.
|
|
Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"`
|
|
|
|
// scope specifies the scope of this rule.
|
|
// Valid values are "Cluster", "Namespaced", and "*"
|
|
// "Cluster" means that only cluster-scoped resources will match this rule.
|
|
// Namespace API objects are cluster-scoped.
|
|
// "Namespaced" means that only namespaced resources will match this rule.
|
|
// "*" means that there are no scope restrictions.
|
|
// Subresources match the scope of their parent resource.
|
|
// Default is "*".
|
|
//
|
|
// +optional
|
|
Scope *ScopeType `json:"scope,omitempty" protobuf:"bytes,4,rep,name=scope"`
|
|
}
|
|
|
|
// ScopeType specifies a scope for a Rule.
|
|
type ScopeType string
|
|
|
|
const (
|
|
// ClusterScope means that scope is limited to cluster-scoped objects.
|
|
// Namespace objects are cluster-scoped.
|
|
ClusterScope ScopeType = "Cluster"
|
|
// NamespacedScope means that scope is limited to namespaced objects.
|
|
NamespacedScope ScopeType = "Namespaced"
|
|
// AllScopes means that all scopes are included.
|
|
AllScopes ScopeType = "*"
|
|
)
|
|
|
|
// FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled.
|
|
type FailurePolicyType string
|
|
|
|
const (
|
|
// Ignore means that an error calling the webhook is ignored.
|
|
Ignore FailurePolicyType = "Ignore"
|
|
// Fail means that an error calling the webhook causes the admission to fail.
|
|
Fail FailurePolicyType = "Fail"
|
|
)
|
|
|
|
// MatchPolicyType specifies the type of match policy.
|
|
type MatchPolicyType string
|
|
|
|
const (
|
|
// Exact means requests should only be sent to the webhook if they exactly match a given rule.
|
|
Exact MatchPolicyType = "Exact"
|
|
// Equivalent means requests should be sent to the webhook if they modify a resource listed in rules via another API group or version.
|
|
Equivalent MatchPolicyType = "Equivalent"
|
|
)
|
|
|
|
// SideEffectClass specifies the types of side effects a webhook may have.
|
|
type SideEffectClass string
|
|
|
|
const (
|
|
// SideEffectClassUnknown means that no information is known about the side effects of calling the webhook.
|
|
// If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail.
|
|
SideEffectClassUnknown SideEffectClass = "Unknown"
|
|
// SideEffectClassNone means that calling the webhook will have no side effects.
|
|
SideEffectClassNone SideEffectClass = "None"
|
|
// SideEffectClassSome means that calling the webhook will possibly have side effects.
|
|
// If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail.
|
|
SideEffectClassSome SideEffectClass = "Some"
|
|
// SideEffectClassNoneOnDryRun means that calling the webhook will possibly have side effects, but if the
|
|
// request being reviewed has the dry-run attribute, the side effects will be suppressed.
|
|
SideEffectClassNoneOnDryRun SideEffectClass = "NoneOnDryRun"
|
|
)
|
|
|
|
// +genclient
|
|
// +genclient:nonNamespaced
|
|
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
|
|
|
// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
|
|
type ValidatingWebhookConfiguration struct {
|
|
metav1.TypeMeta `json:",inline"`
|
|
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
|
// +optional
|
|
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
|
// Webhooks is a list of webhooks and the affected resources and operations.
|
|
// +optional
|
|
// +patchMergeKey=name
|
|
// +patchStrategy=merge
|
|
Webhooks []ValidatingWebhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"`
|
|
}
|
|
|
|
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
|
|
|
// ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
|
|
type ValidatingWebhookConfigurationList struct {
|
|
metav1.TypeMeta `json:",inline"`
|
|
// Standard list metadata.
|
|
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
// +optional
|
|
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
|
// List of ValidatingWebhookConfiguration.
|
|
Items []ValidatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"`
|
|
}
|
|
|
|
// +genclient
|
|
// +genclient:nonNamespaced
|
|
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
|
|
|
// MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
|
|
type MutatingWebhookConfiguration struct {
|
|
metav1.TypeMeta `json:",inline"`
|
|
// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
|
|
// +optional
|
|
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
|
// Webhooks is a list of webhooks and the affected resources and operations.
|
|
// +optional
|
|
// +patchMergeKey=name
|
|
// +patchStrategy=merge
|
|
Webhooks []MutatingWebhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"`
|
|
}
|
|
|
|
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
|
|
|
// MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
|
|
type MutatingWebhookConfigurationList struct {
|
|
metav1.TypeMeta `json:",inline"`
|
|
// Standard list metadata.
|
|
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
// +optional
|
|
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
|
// List of MutatingWebhookConfiguration.
|
|
Items []MutatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"`
|
|
}
|
|
|
|
// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
|
|
type ValidatingWebhook struct {
|
|
// The name of the admission webhook.
|
|
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
|
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
|
// of the organization.
|
|
// Required.
|
|
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
|
|
|
|
// ClientConfig defines how to communicate with the hook.
|
|
// Required
|
|
ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`
|
|
|
|
// Rules describes what operations on what resources/subresources the webhook cares about.
|
|
// The webhook cares about an operation if it matches _any_ Rule.
|
|
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
|
// from putting the cluster in a state which cannot be recovered from without completely
|
|
// disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
|
|
// on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
|
|
Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
|
|
|
|
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
|
// allowed values are Ignore or Fail. Defaults to Fail.
|
|
// +optional
|
|
FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`
|
|
|
|
// matchPolicy defines how the "rules" list is used to match incoming requests.
|
|
// Allowed values are "Exact" or "Equivalent".
|
|
//
|
|
// - Exact: match a request only if it exactly matches a specified rule.
|
|
// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
|
|
// but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
|
|
// a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
|
|
//
|
|
// - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
|
|
// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
|
|
// and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
|
|
// a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
|
|
//
|
|
// Defaults to "Equivalent"
|
|
// +optional
|
|
MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`
|
|
|
|
// NamespaceSelector decides whether to run the webhook on an object based
|
|
// on whether the namespace for that object matches the selector. If the
|
|
// object itself is a namespace, the matching is performed on
|
|
// object.metadata.labels. If the object is another cluster scoped resource,
|
|
// it never skips the webhook.
|
|
//
|
|
// For example, to run the webhook on any objects whose namespace is not
|
|
// associated with "runlevel" of "0" or "1"; you will set the selector as
|
|
// follows:
|
|
// "namespaceSelector": {
|
|
// "matchExpressions": [
|
|
// {
|
|
// "key": "runlevel",
|
|
// "operator": "NotIn",
|
|
// "values": [
|
|
// "0",
|
|
// "1"
|
|
// ]
|
|
// }
|
|
// ]
|
|
// }
|
|
//
|
|
// If instead you want to only run the webhook on any objects whose
|
|
// namespace is associated with the "environment" of "prod" or "staging";
|
|
// you will set the selector as follows:
|
|
// "namespaceSelector": {
|
|
// "matchExpressions": [
|
|
// {
|
|
// "key": "environment",
|
|
// "operator": "In",
|
|
// "values": [
|
|
// "prod",
|
|
// "staging"
|
|
// ]
|
|
// }
|
|
// ]
|
|
// }
|
|
//
|
|
// See
|
|
// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
|
|
// for more examples of label selectors.
|
|
//
|
|
// Default to the empty LabelSelector, which matches everything.
|
|
// +optional
|
|
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`
|
|
|
|
// ObjectSelector decides whether to run the webhook based on if the
|
|
// object has matching labels. objectSelector is evaluated against both
|
|
// the oldObject and newObject that would be sent to the webhook, and
|
|
// is considered to match if either object matches the selector. A null
|
|
// object (oldObject in the case of create, or newObject in the case of
|
|
// delete) or an object that cannot have labels (like a
|
|
// DeploymentRollback or a PodProxyOptions object) is not considered to
|
|
// match.
|
|
// Use the object selector only if the webhook is opt-in, because end
|
|
// users may skip the admission webhook by setting the labels.
|
|
// Default to the empty LabelSelector, which matches everything.
|
|
// +optional
|
|
ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,10,opt,name=objectSelector"`
|
|
|
|
// SideEffects states whether this webhook has side effects.
|
|
// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
|
|
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
|
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
|
// Requests with the dryRun attribute will be auto-rejected if they match a webhook with
|
|
// sideEffects == Unknown or Some.
|
|
SideEffects *SideEffectClass `json:"sideEffects" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`
|
|
|
|
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
|
// the webhook call will be ignored or the API call will fail based on the
|
|
// failure policy.
|
|
// The timeout value must be between 1 and 30 seconds.
|
|
// Default to 10 seconds.
|
|
// +optional
|
|
TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`
|
|
|
|
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
|
// versions the Webhook expects. API server will try to use first version in
|
|
// the list which it supports. If none of the versions specified in this list
|
|
// supported by API server, validation will fail for this object.
|
|
// If a persisted webhook configuration specifies allowed versions and does not
|
|
// include any versions known to the API Server, calls to the webhook will fail
|
|
// and be subject to the failure policy.
|
|
AdmissionReviewVersions []string `json:"admissionReviewVersions" protobuf:"bytes,8,rep,name=admissionReviewVersions"`
|
|
}
|
|
|
|
// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
|
|
type MutatingWebhook struct {
|
|
// The name of the admission webhook.
|
|
// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
|
|
// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
|
|
// of the organization.
|
|
// Required.
|
|
Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
|
|
|
|
// ClientConfig defines how to communicate with the hook.
|
|
// Required
|
|
ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"`
|
|
|
|
// Rules describes what operations on what resources/subresources the webhook cares about.
|
|
// The webhook cares about an operation if it matches _any_ Rule.
|
|
// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
|
|
// from putting the cluster in a state which cannot be recovered from without completely
|
|
// disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
|
|
// on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
|
|
Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"`
|
|
|
|
// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
|
|
// allowed values are Ignore or Fail. Defaults to Fail.
|
|
// +optional
|
|
FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"`
|
|
|
|
// matchPolicy defines how the "rules" list is used to match incoming requests.
|
|
// Allowed values are "Exact" or "Equivalent".
|
|
//
|
|
// - Exact: match a request only if it exactly matches a specified rule.
|
|
// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
|
|
// but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
|
|
// a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
|
|
//
|
|
// - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
|
|
// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
|
|
// and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
|
|
// a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
|
|
//
|
|
// Defaults to "Equivalent"
|
|
// +optional
|
|
MatchPolicy *MatchPolicyType `json:"matchPolicy,omitempty" protobuf:"bytes,9,opt,name=matchPolicy,casttype=MatchPolicyType"`
|
|
|
|
// NamespaceSelector decides whether to run the webhook on an object based
|
|
// on whether the namespace for that object matches the selector. If the
|
|
// object itself is a namespace, the matching is performed on
|
|
// object.metadata.labels. If the object is another cluster scoped resource,
|
|
// it never skips the webhook.
|
|
//
|
|
// For example, to run the webhook on any objects whose namespace is not
|
|
// associated with "runlevel" of "0" or "1"; you will set the selector as
|
|
// follows:
|
|
// "namespaceSelector": {
|
|
// "matchExpressions": [
|
|
// {
|
|
// "key": "runlevel",
|
|
// "operator": "NotIn",
|
|
// "values": [
|
|
// "0",
|
|
// "1"
|
|
// ]
|
|
// }
|
|
// ]
|
|
// }
|
|
//
|
|
// If instead you want to only run the webhook on any objects whose
|
|
// namespace is associated with the "environment" of "prod" or "staging";
|
|
// you will set the selector as follows:
|
|
// "namespaceSelector": {
|
|
// "matchExpressions": [
|
|
// {
|
|
// "key": "environment",
|
|
// "operator": "In",
|
|
// "values": [
|
|
// "prod",
|
|
// "staging"
|
|
// ]
|
|
// }
|
|
// ]
|
|
// }
|
|
//
|
|
// See
|
|
// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
|
// for more examples of label selectors.
|
|
//
|
|
// Default to the empty LabelSelector, which matches everything.
|
|
// +optional
|
|
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"`
|
|
|
|
// ObjectSelector decides whether to run the webhook based on if the
|
|
// object has matching labels. objectSelector is evaluated against both
|
|
// the oldObject and newObject that would be sent to the webhook, and
|
|
// is considered to match if either object matches the selector. A null
|
|
// object (oldObject in the case of create, or newObject in the case of
|
|
// delete) or an object that cannot have labels (like a
|
|
// DeploymentRollback or a PodProxyOptions object) is not considered to
|
|
// match.
|
|
// Use the object selector only if the webhook is opt-in, because end
|
|
// users may skip the admission webhook by setting the labels.
|
|
// Default to the empty LabelSelector, which matches everything.
|
|
// +optional
|
|
ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty" protobuf:"bytes,11,opt,name=objectSelector"`
|
|
|
|
// SideEffects states whether this webhook has side effects.
|
|
// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
|
|
// Webhooks with side effects MUST implement a reconciliation system, since a request may be
|
|
// rejected by a future step in the admission chain and the side effects therefore need to be undone.
|
|
// Requests with the dryRun attribute will be auto-rejected if they match a webhook with
|
|
// sideEffects == Unknown or Some.
|
|
SideEffects *SideEffectClass `json:"sideEffects" protobuf:"bytes,6,opt,name=sideEffects,casttype=SideEffectClass"`
|
|
|
|
// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
|
|
// the webhook call will be ignored or the API call will fail based on the
|
|
// failure policy.
|
|
// The timeout value must be between 1 and 30 seconds.
|
|
// Default to 10 seconds.
|
|
// +optional
|
|
TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,7,opt,name=timeoutSeconds"`
|
|
|
|
// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
|
|
// versions the Webhook expects. API server will try to use first version in
|
|
// the list which it supports. If none of the versions specified in this list
|
|
// supported by API server, validation will fail for this object.
|
|
// If a persisted webhook configuration specifies allowed versions and does not
|
|
// include any versions known to the API Server, calls to the webhook will fail
|
|
// and be subject to the failure policy.
|
|
AdmissionReviewVersions []string `json:"admissionReviewVersions" protobuf:"bytes,8,rep,name=admissionReviewVersions"`
|
|
|
|
// reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.
|
|
// Allowed values are "Never" and "IfNeeded".
|
|
//
|
|
// Never: the webhook will not be called more than once in a single admission evaluation.
|
|
//
|
|
// IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation
|
|
// if the object being admitted is modified by other admission plugins after the initial webhook call.
|
|
// Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted.
|
|
// Note:
|
|
// * the number of additional invocations is not guaranteed to be exactly one.
|
|
// * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.
|
|
// * webhooks that use this option may be reordered to minimize the number of additional invocations.
|
|
// * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.
|
|
//
|
|
// Defaults to "Never".
|
|
// +optional
|
|
ReinvocationPolicy *ReinvocationPolicyType `json:"reinvocationPolicy,omitempty" protobuf:"bytes,10,opt,name=reinvocationPolicy,casttype=ReinvocationPolicyType"`
|
|
}
|
|
|
|
// ReinvocationPolicyType specifies what type of policy the admission hook uses.
|
|
type ReinvocationPolicyType string
|
|
|
|
const (
|
|
// NeverReinvocationPolicy indicates that the webhook must not be called more than once in a
|
|
// single admission evaluation.
|
|
NeverReinvocationPolicy ReinvocationPolicyType = "Never"
|
|
// IfNeededReinvocationPolicy indicates that the webhook may be called at least one
|
|
// additional time as part of the admission evaluation if the object being admitted is
|
|
// modified by other admission plugins after the initial webhook call.
|
|
IfNeededReinvocationPolicy ReinvocationPolicyType = "IfNeeded"
|
|
)
|
|
|
|
// RuleWithOperations is a tuple of Operations and Resources. It is recommended to make
|
|
// sure that all the tuple expansions are valid.
|
|
type RuleWithOperations struct {
|
|
// Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
|
|
// for all of those operations and any future admission operations that are added.
|
|
// If '*' is present, the length of the slice must be one.
|
|
// Required.
|
|
Operations []OperationType `json:"operations,omitempty" protobuf:"bytes,1,rep,name=operations,casttype=OperationType"`
|
|
// Rule is embedded, it describes other criteria of the rule, like
|
|
// APIGroups, APIVersions, Resources, etc.
|
|
Rule `json:",inline" protobuf:"bytes,2,opt,name=rule"`
|
|
}
|
|
|
|
// OperationType specifies an operation for a request.
|
|
type OperationType string
|
|
|
|
// The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go.
|
|
const (
|
|
OperationAll OperationType = "*"
|
|
Create OperationType = "CREATE"
|
|
Update OperationType = "UPDATE"
|
|
Delete OperationType = "DELETE"
|
|
Connect OperationType = "CONNECT"
|
|
)
|
|
|
|
// WebhookClientConfig contains the information to make a TLS
|
|
// connection with the webhook
|
|
type WebhookClientConfig struct {
|
|
// `url` gives the location of the webhook, in standard URL form
|
|
// (`scheme://host:port/path`). Exactly one of `url` or `service`
|
|
// must be specified.
|
|
//
|
|
// The `host` should not refer to a service running in the cluster; use
|
|
// the `service` field instead. The host might be resolved via external
|
|
// DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
|
|
// in-cluster DNS as that would be a layering violation). `host` may
|
|
// also be an IP address.
|
|
//
|
|
// Please note that using `localhost` or `127.0.0.1` as a `host` is
|
|
// risky unless you take great care to run this webhook on all hosts
|
|
// which run an apiserver which might need to make calls to this
|
|
// webhook. Such installs are likely to be non-portable, i.e., not easy
|
|
// to turn up in a new cluster.
|
|
//
|
|
// The scheme must be "https"; the URL must begin with "https://".
|
|
//
|
|
// A path is optional, and if present may be any string permissible in
|
|
// a URL. You may use the path to pass an arbitrary string to the
|
|
// webhook, for example, a cluster identifier.
|
|
//
|
|
// Attempting to use a user or basic auth e.g. "user:password@" is not
|
|
// allowed. Fragments ("#...") and query parameters ("?...") are not
|
|
// allowed, either.
|
|
//
|
|
// +optional
|
|
URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"`
|
|
|
|
// `service` is a reference to the service for this webhook. Either
|
|
// `service` or `url` must be specified.
|
|
//
|
|
// If the webhook is running within the cluster, then you should use `service`.
|
|
//
|
|
// +optional
|
|
Service *ServiceReference `json:"service,omitempty" protobuf:"bytes,1,opt,name=service"`
|
|
|
|
// `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
|
|
// If unspecified, system trust roots on the apiserver are used.
|
|
// +optional
|
|
CABundle []byte `json:"caBundle,omitempty" protobuf:"bytes,2,opt,name=caBundle"`
|
|
}
|
|
|
|
// ServiceReference holds a reference to Service.legacy.k8s.io
|
|
type ServiceReference struct {
|
|
// `namespace` is the namespace of the service.
|
|
// Required
|
|
Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
|
|
// `name` is the name of the service.
|
|
// Required
|
|
Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
|
|
|
|
// `path` is an optional URL path which will be sent in any request to
|
|
// this service.
|
|
// +optional
|
|
Path *string `json:"path,omitempty" protobuf:"bytes,3,opt,name=path"`
|
|
|
|
// If specified, the port on the service that hosting webhook.
|
|
// Default to 443 for backward compatibility.
|
|
// `port` should be a valid port number (1-65535, inclusive).
|
|
// +optional
|
|
Port *int32 `json:"port,omitempty" protobuf:"varint,4,opt,name=port"`
|
|
}
|