1package v1
2
3import "cue.dev/x/k8s.io/apimachinery/pkg/apis/meta/v1"
4
5// ApplyConfiguration defines the desired configuration values of
6// an object.
7#ApplyConfiguration: {
8 // expression will be evaluated by CEL to create an apply
9 // configuration. ref: https://github.com/google/cel-spec
10 //
11 // Apply configurations are declared in CEL using object
12 // initialization. For example, this CEL expression returns an
13 // apply configuration to set a single field:
14 //
15 // Object{
16 // spec: Object.spec{
17 // serviceAccountName: "example"
18 // }
19 // }
20 //
21 // Apply configurations may not modify atomic structs, maps or
22 // arrays due to the risk of accidental deletion of values not
23 // included in the apply configuration.
24 //
25 // CEL expressions have access to the object types needed to
26 // create apply configurations:
27 //
28 // - 'Object' - CEL type of the resource object. -
29 // 'Object.<fieldName>' - CEL type of object field (such as
30 // 'Object.spec') -
31 // 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type
32 // of nested field (such as 'Object.spec.containers')
33 //
34 // CEL expressions have access to the contents of the API request,
35 // organized into CEL variables as well as some other useful
36 // variables:
37 //
38 // - 'object' - The object from the incoming request. The value is
39 // null for DELETE requests. - 'oldObject' - The existing object.
40 // The value is null for CREATE requests. - 'request' -
41 // Attributes of the API
42 // request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
43 // - 'params' - Parameter resource referred to by the policy
44 // binding being evaluated. Only populated if the policy has a
45 // ParamKind. - 'namespaceObject' - The namespace object that the
46 // incoming object belongs to. The value is null for
47 // cluster-scoped resources. - 'variables' - Map of composited
48 // variables, from its name to its lazily evaluated value.
49 // For example, a variable named 'foo' can be accessed as
50 // 'variables.foo'.
51 // - 'authorizer' - A CEL Authorizer. May be used to perform
52 // authorization checks for the principal (user or service
53 // account) of the request.
54 // See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
55 // - 'authorizer.requestResource' - A CEL ResourceCheck
56 // constructed from the 'authorizer' and configured with the
57 // request resource.
58 //
59 // The `apiVersion`, `kind`, `metadata.name` and
60 // `metadata.generateName` are always accessible from the root of
61 // the object. No other metadata properties are accessible.
62 //
63 // Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*`
64 // are accessible. Required.
65 "expression"?: string
66}
67
68// AuditAnnotation describes how to produce an audit annotation
69// for an API request.
70#AuditAnnotation: {
71 // key specifies the audit annotation key. The audit annotation
72 // keys of a ValidatingAdmissionPolicy must be unique. The key
73 // must be a qualified name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more
74 // than 63 bytes in length.
75 //
76 // The key is combined with the resource name of the
77 // ValidatingAdmissionPolicy to construct an audit annotation
78 // key: "{ValidatingAdmissionPolicy name}/{key}".
79 //
80 // If an admission webhook uses the same resource name as this
81 // ValidatingAdmissionPolicy and the same audit annotation key,
82 // the annotation key will be identical. In this case, the first
83 // annotation written with the key will be included in the audit
84 // event and all subsequent annotations with the same key will be
85 // discarded.
86 //
87 // Required.
88 "key"!: string
89
90 // valueExpression represents the expression which is evaluated by
91 // CEL to produce an audit annotation value. The expression must
92 // evaluate to either a string or null value. If the expression
93 // evaluates to a string, the audit annotation is included with
94 // the string value. If the expression evaluates to null or empty
95 // string the audit annotation will be omitted. The
96 // valueExpression may be no longer than 5kb in length. If the
97 // result of the valueExpression is more than 10kb in length, it
98 // will be truncated to 10kb.
99 //
100 // If multiple ValidatingAdmissionPolicyBinding resources match an
101 // API request, then the valueExpression will be evaluated for
102 // each binding. All unique values produced by the
103 // valueExpressions will be joined together in a comma-separated
104 // list.
105 //
106 // Required.
107 "valueExpression"!: string
108}
109
110// ExpressionWarning is a warning information that targets a
111// specific expression.
112#ExpressionWarning: {
113 // fieldRef is the path to the field that refers to the
114 // expression. For example, the reference to the expression of
115 // the first item of validations is
116 // "spec.validations[0].expression"
117 "fieldRef"!: string
118
119 // warning contains the content of type checking information in a
120 // human-readable form. Each line of the warning contains the
121 // type that the expression is checked against, followed by the
122 // type check error from the compiler.
123 "warning"!: string
124}
125
126// JSONPatch defines a JSON Patch.
127#JSONPatch: {
128 // expression will be evaluated by CEL to create a [JSON
129 // patch](https://jsonpatch.com/). ref:
130 // https://github.com/google/cel-spec
131 //
132 // expression must return an array of JSONPatch values.
133 //
134 // For example, this CEL expression returns a JSON patch to
135 // conditionally modify a value:
136 //
137 // [
138 // JSONPatch{op: "test", path: "/spec/example", value: "Red"},
139 // JSONPatch{op: "replace", path: "/spec/example", value: "Green"}
140 // ]
141 //
142 // To define an object for the patch value, use Object types. For
143 // example:
144 //
145 // [
146 // JSONPatch{
147 // op: "add",
148 // path: "/spec/selector",
149 // value: Object.spec.selector{matchLabels: {"environment":
150 // "test"}}
151 // }
152 // ]
153 //
154 // To use strings containing '/' and '~' as JSONPatch path keys,
155 // use "jsonpatch.escapeKey". For example:
156 //
157 // [
158 // JSONPatch{
159 // op: "add",
160 // path: "/metadata/labels/" +
161 // jsonpatch.escapeKey("example.com/environment"),
162 // value: "test"
163 // },
164 // ]
165 //
166 // CEL expressions have access to the types needed to create JSON
167 // patches and objects:
168 //
169 // - 'JSONPatch' - CEL type of JSON Patch operations. JSONPatch
170 // has the fields 'op', 'from', 'path' and 'value'.
171 // See [JSON patch](https://jsonpatch.com/) for more details. The
172 // 'value' field may be set to any of: string,
173 // integer, array, map or object. If set, the 'path' and 'from'
174 // fields must be set to a
175 // [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/)
176 // string, where the 'jsonpatch.escapeKey()' CEL
177 // function may be used to escape path keys containing '/' and
178 // '~'.
179 // - 'Object' - CEL type of the resource object. -
180 // 'Object.<fieldName>' - CEL type of object field (such as
181 // 'Object.spec') -
182 // 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type
183 // of nested field (such as 'Object.spec.containers')
184 //
185 // CEL expressions have access to the contents of the API request,
186 // organized into CEL variables as well as some other useful
187 // variables:
188 //
189 // - 'object' - The object from the incoming request. The value is
190 // null for DELETE requests. - 'oldObject' - The existing object.
191 // The value is null for CREATE requests. - 'request' -
192 // Attributes of the API
193 // request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
194 // - 'params' - Parameter resource referred to by the policy
195 // binding being evaluated. Only populated if the policy has a
196 // ParamKind. - 'namespaceObject' - The namespace object that the
197 // incoming object belongs to. The value is null for
198 // cluster-scoped resources. - 'variables' - Map of composited
199 // variables, from its name to its lazily evaluated value.
200 // For example, a variable named 'foo' can be accessed as
201 // 'variables.foo'.
202 // - 'authorizer' - A CEL Authorizer. May be used to perform
203 // authorization checks for the principal (user or service
204 // account) of the request.
205 // See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
206 // - 'authorizer.requestResource' - A CEL ResourceCheck
207 // constructed from the 'authorizer' and configured with the
208 // request resource.
209 //
210 // CEL expressions have access to [Kubernetes CEL function
211 // libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)
212 // as well as:
213 //
214 // - 'jsonpatch.escapeKey' - Performs JSONPatch key escaping. '~'
215 // and '/' are escaped as '~0' and `~1' respectively).
216 //
217 // Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*`
218 // are accessible. Required.
219 "expression"?: string
220}
221
222// MatchCondition represents a condition which must by fulfilled
223// for a request to be sent to a webhook.
224#MatchCondition: {
225 // expression represents the expression which will be evaluated by
226 // CEL. Must evaluate to bool. CEL expressions have access to the
227 // contents of the AdmissionRequest and Authorizer, organized
228 // into CEL variables:
229 //
230 // 'object' - The object from the incoming request. The value is
231 // null for DELETE requests. 'oldObject' - The existing object.
232 // The value is null for CREATE requests. 'request' - Attributes
233 // of the admission
234 // request(/pkg/apis/admission/types.go#AdmissionRequest).
235 // 'authorizer' - A CEL Authorizer. May be used to perform
236 // authorization checks for the principal (user or service
237 // account) of the request.
238 // See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
239 // 'authorizer.requestResource' - A CEL ResourceCheck constructed
240 // from the 'authorizer' and configured with the
241 // request resource.
242 // Documentation on CEL:
243 // https://kubernetes.io/docs/reference/using-api/cel/
244 //
245 // Required.
246 "expression"!: string
247
248 // name is an identifier for this match condition, used for
249 // strategic merging of MatchConditions, as well as providing an
250 // identifier for logging purposes. A good name should be
251 // descriptive of the associated expression. Name must be a
252 // qualified name consisting of alphanumeric characters, '-', '_'
253 // or '.', and must start and end with an alphanumeric character
254 // (e.g. 'MyName', or 'my.name', or '123-abc', regex used for
255 // validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with
256 // an optional DNS subdomain prefix and '/' (e.g.
257 // 'example.com/MyName')
258 //
259 // Required.
260 "name"!: string
261}
262
263// MatchResources decides whether to run the admission control
264// policy on an object based on whether it meets the match
265// criteria. The exclude rules take precedence over include rules
266// (if a resource matches both, it is excluded)
267#MatchResources: {
268 // excludeResourceRules describes what operations on what
269 // resources/subresources the ValidatingAdmissionPolicy should
270 // not care about. The exclude rules take precedence over include
271 // rules (if a resource matches both, it is excluded)
272 "excludeResourceRules"?: [...#NamedRuleWithOperations]
273
274 // matchPolicy defines how the "MatchResources" list is used to
275 // match incoming requests. Allowed values are "Exact" or
276 // "Equivalent".
277 //
278 // - Exact: match a request only if it exactly matches a specified
279 // rule. For example, if deployments can be modified via apps/v1,
280 // apps/v1beta1, and extensions/v1beta1, but "rules" only
281 // included `apiGroups:["apps"], apiVersions:["v1"], resources:
282 // ["deployments"]`, a request to apps/v1beta1 or
283 // extensions/v1beta1 would not be sent to the
284 // ValidatingAdmissionPolicy.
285 //
286 // - Equivalent: match a request if modifies a resource listed in
287 // rules, even via another API group or version. For example, if
288 // deployments can be modified via apps/v1, apps/v1beta1, and
289 // extensions/v1beta1, and "rules" only included
290 // `apiGroups:["apps"], apiVersions:["v1"], resources:
291 // ["deployments"]`, a request to apps/v1beta1 or
292 // extensions/v1beta1 would be converted to apps/v1 and sent to
293 // the ValidatingAdmissionPolicy.
294 //
295 // Defaults to "Equivalent"
296 "matchPolicy"?: string
297
298 // namespaceSelector decides whether to run the admission control
299 // policy on an object based on whether the namespace for that
300 // object matches the selector. If the object itself is a
301 // namespace, the matching is performed on
302 // object.metadata.labels. If the object is another cluster
303 // scoped resource, it never skips the policy.
304 //
305 // For example, to run the webhook on any objects whose namespace
306 // is not associated with "runlevel" of "0" or "1"; you will set
307 // the selector as follows: "namespaceSelector": {
308 // "matchExpressions": [
309 // {
310 // "key": "runlevel",
311 // "operator": "NotIn",
312 // "values": [
313 // "0",
314 // "1"
315 // ]
316 // }
317 // ]
318 // }
319 //
320 // If instead you want to only run the policy on any objects whose
321 // namespace is associated with the "environment" of "prod" or
322 // "staging"; you will set the selector as follows:
323 // "namespaceSelector": {
324 // "matchExpressions": [
325 // {
326 // "key": "environment",
327 // "operator": "In",
328 // "values": [
329 // "prod",
330 // "staging"
331 // ]
332 // }
333 // ]
334 // }
335 //
336 // See
337 // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
338 // for more examples of label selectors.
339 //
340 // Default to the empty LabelSelector, which matches everything.
341 "namespaceSelector"?: v1.#LabelSelector
342
343 // objectSelector decides whether to run the validation based on
344 // if the object has matching labels. objectSelector is evaluated
345 // against both the oldObject and newObject that would be sent to
346 // the cel validation, and is considered to match if either
347 // object matches the selector. A null object (oldObject in the
348 // case of create, or newObject in the case of delete) or an
349 // object that cannot have labels (like a DeploymentRollback or a
350 // PodProxyOptions object) is not considered to match. Use the
351 // object selector only if the webhook is opt-in, because end
352 // users may skip the admission webhook by setting the labels.
353 // Default to the empty LabelSelector, which matches everything.
354 "objectSelector"?: v1.#LabelSelector
355
356 // resourceRules describes what operations on what
357 // resources/subresources the ValidatingAdmissionPolicy matches.
358 // The policy cares about an operation if it matches _any_ Rule.
359 "resourceRules"?: [...#NamedRuleWithOperations]
360}
361
362// MutatingAdmissionPolicy describes the definition of an
363// admission mutation policy that mutates the object coming into
364// admission chain.
365#MutatingAdmissionPolicy: {
366 // APIVersion defines the versioned schema of this representation
367 // of an object. Servers should convert recognized schemas to the
368 // latest internal value, and may reject unrecognized values.
369 // More info:
370 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
371 "apiVersion": "admissionregistration.k8s.io/v1"
372
373 // Kind is a string value representing the REST resource this
374 // object represents. Servers may infer this from the endpoint
375 // the client submits requests to. Cannot be updated. In
376 // CamelCase. More info:
377 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
378 "kind": "MutatingAdmissionPolicy"
379
380 // metadata is the standard object metadata; More info:
381 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
382 "metadata"?: v1.#ObjectMeta
383
384 // spec defines the desired behavior of the
385 // MutatingAdmissionPolicy.
386 "spec"?: #MutatingAdmissionPolicySpec
387}
388
389// MutatingAdmissionPolicyBinding binds the
390// MutatingAdmissionPolicy with parametrized resources.
391// MutatingAdmissionPolicyBinding and the optional parameter
392// resource together define how cluster administrators configure
393// policies for clusters.
394//
395// For a given admission request, each binding will cause its
396// policy to be evaluated N times, where N is 1 for
397// policies/bindings that don't use params, otherwise N is the
398// number of parameters selected by the binding. Each evaluation
399// is constrained by a [runtime cost
400// budget](https://kubernetes.io/docs/reference/using-api/cel/#runtime-cost-budget).
401//
402// Adding/removing policies, bindings, or params can not affect
403// whether a given (policy, binding, param) combination is within
404// its own CEL budget.
405#MutatingAdmissionPolicyBinding: {
406 // APIVersion defines the versioned schema of this representation
407 // of an object. Servers should convert recognized schemas to the
408 // latest internal value, and may reject unrecognized values.
409 // More info:
410 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
411 "apiVersion": "admissionregistration.k8s.io/v1"
412
413 // Kind is a string value representing the REST resource this
414 // object represents. Servers may infer this from the endpoint
415 // the client submits requests to. Cannot be updated. In
416 // CamelCase. More info:
417 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
418 "kind": "MutatingAdmissionPolicyBinding"
419
420 // metadata is the standard object metadata; More info:
421 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
422 "metadata"?: v1.#ObjectMeta
423
424 // spec defines the desired behavior of the
425 // MutatingAdmissionPolicyBinding.
426 "spec"?: #MutatingAdmissionPolicyBindingSpec
427}
428
429// MutatingAdmissionPolicyBindingList is a list of
430// MutatingAdmissionPolicyBinding.
431#MutatingAdmissionPolicyBindingList: {
432 // APIVersion defines the versioned schema of this representation
433 // of an object. Servers should convert recognized schemas to the
434 // latest internal value, and may reject unrecognized values.
435 // More info:
436 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
437 "apiVersion": "admissionregistration.k8s.io/v1"
438
439 // List of PolicyBinding.
440 "items"!: [...#MutatingAdmissionPolicyBinding]
441
442 // Kind is a string value representing the REST resource this
443 // object represents. Servers may infer this from the endpoint
444 // the client submits requests to. Cannot be updated. In
445 // CamelCase. More info:
446 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
447 "kind": "MutatingAdmissionPolicyBindingList"
448
449 // metadata is the standard list metadata. More info:
450 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
451 "metadata"?: v1.#ListMeta
452}
453
454// MutatingAdmissionPolicyBindingSpec defines the specification of
455// the MutatingAdmissionPolicyBinding.
456#MutatingAdmissionPolicyBindingSpec: {
457 // matchResources limits what resources match this binding and may
458 // be mutated by it. Note that if matchResources matches a
459 // resource, the resource must also match a policy's
460 // matchConstraints and matchConditions before the resource may
461 // be mutated. When matchResources is unset, it does not
462 // constrain resource matching, and only the policy's
463 // matchConstraints and matchConditions must match for the
464 // resource to be mutated. Additionally,
465 // matchResources.resourceRules are optional and do not
466 // constraint matching when unset. Note that this is differs from
467 // MutatingAdmissionPolicy matchConstraints, where resourceRules
468 // are required. The CREATE, UPDATE and CONNECT operations are
469 // allowed. The DELETE operation may not be matched. '*' matches
470 // CREATE, UPDATE and CONNECT.
471 "matchResources"?: #MatchResources
472
473 // paramRef specifies the parameter resource used to configure the
474 // admission control policy. It should point to a resource of the
475 // type specified in spec.ParamKind of the bound
476 // MutatingAdmissionPolicy. If the policy specifies a ParamKind
477 // and the resource referred to by ParamRef does not exist, this
478 // binding is considered mis-configured and the FailurePolicy of
479 // the MutatingAdmissionPolicy applied. If the policy does not
480 // specify a ParamKind then this field is ignored, and the rules
481 // are evaluated without a param.
482 "paramRef"?: #ParamRef
483
484 // policyName references a MutatingAdmissionPolicy name which the
485 // MutatingAdmissionPolicyBinding binds to. If the referenced
486 // resource does not exist, this binding is considered invalid
487 // and will be ignored Required.
488 "policyName"?: string
489}
490
491// MutatingAdmissionPolicyList is a list of
492// MutatingAdmissionPolicy.
493#MutatingAdmissionPolicyList: {
494 // APIVersion defines the versioned schema of this representation
495 // of an object. Servers should convert recognized schemas to the
496 // latest internal value, and may reject unrecognized values.
497 // More info:
498 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
499 "apiVersion": "admissionregistration.k8s.io/v1"
500
501 // List of ValidatingAdmissionPolicy.
502 "items"!: [...#MutatingAdmissionPolicy]
503
504 // Kind is a string value representing the REST resource this
505 // object represents. Servers may infer this from the endpoint
506 // the client submits requests to. Cannot be updated. In
507 // CamelCase. More info:
508 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
509 "kind": "MutatingAdmissionPolicyList"
510
511 // metadata is the standard list metadata. More info:
512 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
513 "metadata"?: v1.#ListMeta
514}
515
516// MutatingAdmissionPolicySpec defines the desired behavior of the
517// admission policy.
518#MutatingAdmissionPolicySpec: {
519 // failurePolicy defines how to handle failures for the admission
520 // policy. Failures can occur from CEL expression parse errors,
521 // type check errors, runtime errors and invalid or
522 // mis-configured policy definitions or bindings.
523 //
524 // A policy is invalid if paramKind refers to a non-existent Kind.
525 // A binding is invalid if paramRef.name refers to a non-existent
526 // resource.
527 //
528 // failurePolicy does not define how validations that evaluate to
529 // false are handled.
530 //
531 // Allowed values are Ignore or Fail. Defaults to Fail.
532 "failurePolicy"?: string
533
534 // matchConditions is a list of conditions that must be met for a
535 // request to be validated. Match conditions filter requests that
536 // have already been matched by the matchConstraints. An empty
537 // list of matchConditions matches all requests. There are a
538 // maximum of 64 match conditions allowed.
539 //
540 // If a parameter object is provided, it can be accessed via the
541 // `params` handle in the same manner as validation expressions.
542 //
543 // The exact matching logic is (in order):
544 // 1. If ANY matchCondition evaluates to FALSE, the policy is
545 // skipped.
546 // 2. If ALL matchConditions evaluate to TRUE, the policy is
547 // evaluated.
548 // 3. If any matchCondition evaluates to an error (but none are
549 // FALSE):
550 // - If failurePolicy=Fail, reject the request
551 // - If failurePolicy=Ignore, the policy is skipped
552 "matchConditions"?: [...#MatchCondition]
553
554 // matchConstraints specifies what resources this policy is
555 // designed to validate. The MutatingAdmissionPolicy cares about
556 // a request if it matches _all_ Constraints. However, in order
557 // to prevent clusters from being put into an unstable state that
558 // cannot be recovered from via the API MutatingAdmissionPolicy
559 // cannot match MutatingAdmissionPolicy and
560 // MutatingAdmissionPolicyBinding. The CREATE, UPDATE and CONNECT
561 // operations are allowed. The DELETE operation may not be
562 // matched. '*' matches CREATE, UPDATE and CONNECT. Required.
563 "matchConstraints"?: #MatchResources
564
565 // mutations contain operations to perform on matching objects.
566 // mutations may not be empty; a minimum of one mutation is
567 // required. mutations are evaluated in order, and are reinvoked
568 // according to the reinvocationPolicy. The mutations of a policy
569 // are invoked for each binding of this policy and reinvocation
570 // of mutations occurs on a per binding basis.
571 "mutations"?: [...#Mutation]
572
573 // paramKind specifies the kind of resources used to parameterize
574 // this policy. If absent, there are no parameters for this
575 // policy and the param CEL variable will not be provided to
576 // validation expressions. If paramKind refers to a non-existent
577 // kind, this policy definition is mis-configured and the
578 // FailurePolicy is applied. If paramKind is specified but
579 // paramRef is unset in MutatingAdmissionPolicyBinding, the
580 // params variable will be null.
581 "paramKind"?: #ParamKind
582
583 // reinvocationPolicy indicates whether mutations may be called
584 // multiple times per MutatingAdmissionPolicyBinding as part of a
585 // single admission evaluation. Allowed values are "Never" and
586 // "IfNeeded".
587 //
588 // Never: These mutations will not be called more than once per
589 // binding in a single admission evaluation.
590 //
591 // IfNeeded: These mutations may be invoked more than once per
592 // binding for a single admission request and there is no
593 // guarantee of order with respect to other admission plugins,
594 // admission webhooks, bindings of this policy and admission
595 // policies. Mutations are only reinvoked when mutations change
596 // the object after this mutation is invoked. Required.
597 "reinvocationPolicy"?: string
598
599 // variables contain definitions of variables that can be used in
600 // composition of other expressions. Each variable is defined as
601 // a named CEL expression. The variables defined here will be
602 // available under `variables` in other expressions of the policy
603 // except matchConditions because matchConditions are evaluated
604 // before the rest of the policy.
605 //
606 // The expression of a variable can refer to other variables
607 // defined earlier in the list but not those after. Thus,
608 // variables must be sorted by the order of first appearance and
609 // acyclic.
610 "variables"?: [...#Variable]
611}
612
613// MutatingWebhook describes an admission webhook and the
614// resources and operations it applies to.
615#MutatingWebhook: {
616 // admissionReviewVersions is an ordered list of preferred
617 // `AdmissionReview` versions the Webhook expects. API server
618 // will try to use first version in the list which it supports.
619 // If none of the versions specified in this list supported by
620 // API server, validation will fail for this object. If a
621 // persisted webhook configuration specifies allowed versions and
622 // does not include any versions known to the API Server, calls
623 // to the webhook will fail and be subject to the failure policy.
624 "admissionReviewVersions"!: [...string]
625
626 // clientConfig defines how to communicate with the hook. Required
627 "clientConfig"!: #WebhookClientConfig
628
629 // failurePolicy defines how unrecognized errors from the
630 // admission endpoint are handled - allowed values are Ignore or
631 // Fail. Defaults to Fail.
632 "failurePolicy"?: string
633
634 // matchConditions is a list of conditions that must be met for a
635 // request to be sent to this webhook. Match conditions filter
636 // requests that have already been matched by the rules,
637 // namespaceSelector, and objectSelector. An empty list of
638 // matchConditions matches all requests. There are a maximum of
639 // 64 match conditions allowed.
640 //
641 // The exact matching logic is (in order):
642 // 1. If ANY matchCondition evaluates to FALSE, the webhook is
643 // skipped.
644 // 2. If ALL matchConditions evaluate to TRUE, the webhook is
645 // called.
646 // 3. If any matchCondition evaluates to an error (but none are
647 // FALSE):
648 // - If failurePolicy=Fail, reject the request
649 // - If failurePolicy=Ignore, the error is ignored and the webhook
650 // is skipped
651 "matchConditions"?: [...#MatchCondition]
652
653 // matchPolicy defines how the "rules" list is used to match
654 // incoming requests. Allowed values are "Exact" or "Equivalent".
655 //
656 // - Exact: match a request only if it exactly matches a specified
657 // rule. For example, if deployments can be modified via apps/v1,
658 // apps/v1beta1, and extensions/v1beta1, but "rules" only
659 // included `apiGroups:["apps"], apiVersions:["v1"], resources:
660 // ["deployments"]`, a request to apps/v1beta1 or
661 // extensions/v1beta1 would not be sent to the webhook.
662 //
663 // - Equivalent: match a request if modifies a resource listed in
664 // rules, even via another API group or version. For example, if
665 // deployments can be modified via apps/v1, apps/v1beta1, and
666 // extensions/v1beta1, and "rules" only included
667 // `apiGroups:["apps"], apiVersions:["v1"], resources:
668 // ["deployments"]`, a request to apps/v1beta1 or
669 // extensions/v1beta1 would be converted to apps/v1 and sent to
670 // the webhook.
671 //
672 // Defaults to "Equivalent"
673 "matchPolicy"?: string
674
675 // name is the name of the admission webhook. Name should be fully
676 // qualified, e.g., imagepolicy.kubernetes.io, where
677 // "imagepolicy" is the name of the webhook, and kubernetes.io is
678 // the name of the organization. Required.
679 "name"!: string
680
681 // namespaceSelector decides whether to run the webhook on an
682 // object based on whether the namespace for that object matches
683 // the selector. If the object itself is a namespace, the
684 // matching is performed on object.metadata.labels. If the object
685 // is another cluster scoped resource, it never skips the
686 // webhook.
687 //
688 // For example, to run the webhook on any objects whose namespace
689 // is not associated with "runlevel" of "0" or "1"; you will set
690 // the selector as follows: "namespaceSelector": {
691 // "matchExpressions": [
692 // {
693 // "key": "runlevel",
694 // "operator": "NotIn",
695 // "values": [
696 // "0",
697 // "1"
698 // ]
699 // }
700 // ]
701 // }
702 //
703 // If instead you want to only run the webhook on any objects
704 // whose namespace is associated with the "environment" of "prod"
705 // or "staging"; you will set the selector as follows:
706 // "namespaceSelector": {
707 // "matchExpressions": [
708 // {
709 // "key": "environment",
710 // "operator": "In",
711 // "values": [
712 // "prod",
713 // "staging"
714 // ]
715 // }
716 // ]
717 // }
718 //
719 // See
720 // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
721 // for more examples of label selectors.
722 //
723 // Default to the empty LabelSelector, which matches everything.
724 "namespaceSelector"?: v1.#LabelSelector
725
726 // objectSelector decides whether to run the webhook based on if
727 // the object has matching labels. objectSelector is evaluated
728 // against both the oldObject and newObject that would be sent to
729 // the webhook, and is considered to match if either object
730 // matches the selector. A null object (oldObject in the case of
731 // create, or newObject in the case of delete) or an object that
732 // cannot have labels (like a DeploymentRollback or a
733 // PodProxyOptions object) is not considered to match. Use the
734 // object selector only if the webhook is opt-in, because end
735 // users may skip the admission webhook by setting the labels.
736 // Default to the empty LabelSelector, which matches everything.
737 "objectSelector"?: v1.#LabelSelector
738
739 // reinvocationPolicy indicates whether this webhook should be
740 // called multiple times as part of a single admission
741 // evaluation. Allowed values are "Never" and "IfNeeded".
742 //
743 // Never: the webhook will not be called more than once in a
744 // single admission evaluation.
745 //
746 // IfNeeded: the webhook will be called at least one additional
747 // time as part of the admission evaluation if the object being
748 // admitted is modified by other admission plugins after the
749 // initial webhook call. Webhooks that specify this option *must*
750 // be idempotent, able to process objects they previously
751 // admitted. Note: * the number of additional invocations is not
752 // guaranteed to be exactly one. * if additional invocations
753 // result in further modifications to the object, webhooks are
754 // not guaranteed to be invoked again. * webhooks that use this
755 // option may be reordered to minimize the number of additional
756 // invocations. * to validate an object after all mutations are
757 // guaranteed complete, use a validating admission webhook
758 // instead.
759 //
760 // Defaults to "Never".
761 "reinvocationPolicy"?: string
762
763 // rules describes what operations on what resources/subresources
764 // the webhook cares about. The webhook cares about an operation
765 // if it matches _any_ Rule. However, in order to prevent
766 // ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from
767 // putting the cluster in a state which cannot be recovered from
768 // without completely disabling the plugin,
769 // ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are
770 // never called on admission requests for
771 // ValidatingWebhookConfiguration and
772 // MutatingWebhookConfiguration objects.
773 "rules"?: [...#RuleWithOperations]
774
775 // sideEffects states whether this webhook has side effects.
776 // Acceptable values are: None, NoneOnDryRun (webhooks created
777 // via v1beta1 may also specify Some or Unknown). Webhooks with
778 // side effects MUST implement a reconciliation system, since a
779 // request may be rejected by a future step in the admission
780 // chain and the side effects therefore need to be undone.
781 // Requests with the dryRun attribute will be auto-rejected if
782 // they match a webhook with sideEffects == Unknown or Some.
783 "sideEffects"!: string
784
785 // timeoutSeconds specifies the timeout for this webhook. After
786 // the timeout passes, the webhook call will be ignored or the
787 // API call will fail based on the failure policy. The timeout
788 // value must be between 1 and 30 seconds. Default to 10 seconds.
789 "timeoutSeconds"?: int32 & int
790}
791
792// MutatingWebhookConfiguration describes the configuration of and
793// admission webhook that accept or reject and may change the
794// object.
795#MutatingWebhookConfiguration: {
796 // APIVersion defines the versioned schema of this representation
797 // of an object. Servers should convert recognized schemas to the
798 // latest internal value, and may reject unrecognized values.
799 // More info:
800 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
801 "apiVersion": "admissionregistration.k8s.io/v1"
802
803 // Kind is a string value representing the REST resource this
804 // object represents. Servers may infer this from the endpoint
805 // the client submits requests to. Cannot be updated. In
806 // CamelCase. More info:
807 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
808 "kind": "MutatingWebhookConfiguration"
809
810 // metadata is the standard object metadata; More info:
811 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
812 "metadata"?: v1.#ObjectMeta
813
814 // webhooks is a list of webhooks and the affected resources and
815 // operations.
816 "webhooks"?: [...#MutatingWebhook]
817}
818
819// MutatingWebhookConfigurationList is a list of
820// MutatingWebhookConfiguration.
821#MutatingWebhookConfigurationList: {
822 // APIVersion defines the versioned schema of this representation
823 // of an object. Servers should convert recognized schemas to the
824 // latest internal value, and may reject unrecognized values.
825 // More info:
826 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
827 "apiVersion": "admissionregistration.k8s.io/v1"
828
829 // List of MutatingWebhookConfiguration.
830 "items"!: [...#MutatingWebhookConfiguration]
831
832 // Kind is a string value representing the REST resource this
833 // object represents. Servers may infer this from the endpoint
834 // the client submits requests to. Cannot be updated. In
835 // CamelCase. More info:
836 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
837 "kind": "MutatingWebhookConfigurationList"
838
839 // metadata is the standard list metadata. More info:
840 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
841 "metadata"?: v1.#ListMeta
842}
843
844// Mutation specifies the CEL expression which is used to apply
845// the Mutation.
846#Mutation: {
847 // applyConfiguration defines the desired configuration values of
848 // an object. The configuration is applied to the admission
849 // object using [structured merge
850 // diff](https://github.com/kubernetes-sigs/structured-merge-diff).
851 // A CEL expression is used to create apply configuration.
852 "applyConfiguration"?: #ApplyConfiguration
853
854 // jsonPatch defines a [JSON patch](https://jsonpatch.com/)
855 // operation to perform a mutation to the object. A CEL
856 // expression is used to create the JSON patch.
857 "jsonPatch"?: #JSONPatch
858
859 // patchType indicates the patch strategy used. Allowed values are
860 // "ApplyConfiguration" and "JSONPatch". Required.
861 "patchType"!: string
862}
863
864// NamedRuleWithOperations is a tuple of Operations and Resources
865// with ResourceNames.
866#NamedRuleWithOperations: {
867 // apiGroups is the API groups the resources belong to. '*' is all
868 // groups. If '*' is present, the length of the slice must be
869 // one. Required.
870 "apiGroups"?: [...string]
871
872 // apiVersions is the API versions the resources belong to. '*' is
873 // all versions. If '*' is present, the length of the slice must
874 // be one. Required.
875 "apiVersions"?: [...string]
876
877 // operations is the operations the admission hook cares about -
878 // CREATE, UPDATE, DELETE, CONNECT or * for all of those
879 // operations and any future admission operations that are added.
880 // If '*' is present, the length of the slice must be one.
881 // Required.
882 "operations"?: [...string]
883
884 // resourceNames is an optional white list of names that the rule
885 // applies to. An empty set means that everything is allowed.
886 "resourceNames"?: [...string]
887
888 // resources is a list of resources this rule applies to.
889 //
890 // For example: 'pods' means pods. 'pods/log' means the log
891 // subresource of pods. '*' means all resources, but not
892 // subresources. 'pods/*' means all subresources of pods.
893 // '*/scale' means all scale subresources. '*/*' means all
894 // resources and their subresources.
895 //
896 // If wildcard is present, the validation rule will ensure
897 // resources do not overlap with each other.
898 //
899 // Depending on the enclosing object, subresources might not be
900 // allowed. Required.
901 "resources"?: [...string]
902
903 // scope specifies the scope of this rule. Valid values are
904 // "Cluster", "Namespaced", and "*" "Cluster" means that only
905 // cluster-scoped resources will match this rule. Namespace API
906 // objects are cluster-scoped. "Namespaced" means that only
907 // namespaced resources will match this rule. "*" means that
908 // there are no scope restrictions. Subresources match the scope
909 // of their parent resource. Default is "*".
910 "scope"?: string
911}
912
913// ParamKind is a tuple of Group Kind and Version.
914#ParamKind: {
915 // apiVersion is the API group version the resources belong to. In
916 // format of "group/version". Required.
917 "apiVersion"?: string
918
919 // kind is the API kind the resources belong to. Required.
920 "kind"?: string
921}
922
923// ParamRef describes how to locate the params to be used as input
924// to expressions of rules applied by a policy binding.
925#ParamRef: {
926 // name is the name of the resource being referenced.
927 //
928 // One of `name` or `selector` must be set, but `name` and
929 // `selector` are mutually exclusive properties. If one is set,
930 // the other must be unset.
931 //
932 // A single parameter used for all admission requests can be
933 // configured by setting the `name` field, leaving `selector`
934 // blank, and setting namespace if `paramKind` is
935 // namespace-scoped.
936 "name"?: string
937
938 // namespace is the namespace of the referenced resource. Allows
939 // limiting the search for params to a specific namespace.
940 // Applies to both `name` and `selector` fields.
941 //
942 // A per-namespace parameter may be used by specifying a
943 // namespace-scoped `paramKind` in the policy and leaving this
944 // field empty.
945 //
946 // - If `paramKind` is cluster-scoped, this field MUST be unset.
947 // Setting this field results in a configuration error.
948 //
949 // - If `paramKind` is namespace-scoped, the namespace of the
950 // object being evaluated for admission will be used when this
951 // field is left unset. Take care that if this is left empty the
952 // binding must not match any cluster-scoped resources, which
953 // will result in an error.
954 "namespace"?: string
955
956 // parameterNotFoundAction controls the behavior of the binding
957 // when the resource exists, and name or selector is valid, but
958 // there are no parameters matched by the binding. If the value
959 // is set to `Allow`, then no matched parameters will be treated
960 // as successful validation by the binding. If set to `Deny`,
961 // then no matched parameters will be subject to the
962 // `failurePolicy` of the policy.
963 //
964 // Allowed values are `Allow` or `Deny`
965 //
966 // Required
967 "parameterNotFoundAction"?: string
968
969 // selector can be used to match multiple param objects based on
970 // their labels. Supply selector: {} to match all resources of
971 // the ParamKind.
972 //
973 // If multiple params are found, they are all evaluated with the
974 // policy expressions and the results are ANDed together.
975 //
976 // One of `name` or `selector` must be set, but `name` and
977 // `selector` are mutually exclusive properties. If one is set,
978 // the other must be unset.
979 "selector"?: v1.#LabelSelector
980}
981
982// RuleWithOperations is a tuple of Operations and Resources. It
983// is recommended to make sure that all the tuple expansions are
984// valid.
985#RuleWithOperations: {
986 // apiGroups is the API groups the resources belong to. '*' is all
987 // groups. If '*' is present, the length of the slice must be
988 // one. Required.
989 "apiGroups"?: [...string]
990
991 // apiVersions is the API versions the resources belong to. '*' is
992 // all versions. If '*' is present, the length of the slice must
993 // be one. Required.
994 "apiVersions"?: [...string]
995
996 // operations is the operations the admission hook cares about -
997 // CREATE, UPDATE, DELETE, CONNECT or * for all of those
998 // operations and any future admission operations that are added.
999 // If '*' is present, the length of the slice must be one.
1000 // Required.
1001 "operations"?: [...string]
1002
1003 // resources is a list of resources this rule applies to.
1004 //
1005 // For example: 'pods' means pods. 'pods/log' means the log
1006 // subresource of pods. '*' means all resources, but not
1007 // subresources. 'pods/*' means all subresources of pods.
1008 // '*/scale' means all scale subresources. '*/*' means all
1009 // resources and their subresources.
1010 //
1011 // If wildcard is present, the validation rule will ensure
1012 // resources do not overlap with each other.
1013 //
1014 // Depending on the enclosing object, subresources might not be
1015 // allowed. Required.
1016 "resources"?: [...string]
1017
1018 // scope specifies the scope of this rule. Valid values are
1019 // "Cluster", "Namespaced", and "*" "Cluster" means that only
1020 // cluster-scoped resources will match this rule. Namespace API
1021 // objects are cluster-scoped. "Namespaced" means that only
1022 // namespaced resources will match this rule. "*" means that
1023 // there are no scope restrictions. Subresources match the scope
1024 // of their parent resource. Default is "*".
1025 "scope"?: string
1026}
1027
1028// ServiceReference holds a reference to Service.legacy.k8s.io
1029#ServiceReference: {
1030 // name is the name of the service. Required
1031 "name"!: string
1032
1033 // namespace is the namespace of the service. Required
1034 "namespace"!: string
1035
1036 // path is an optional URL path which will be sent in any request
1037 // to this service.
1038 "path"?: string
1039
1040 // port is the port on the service that hosts the webhook. Default
1041 // to 443 for backward compatibility. `port` should be a valid
1042 // port number (1-65535, inclusive).
1043 "port"?: int32 & int
1044}
1045
1046// TypeChecking contains results of type checking the expressions
1047// in the ValidatingAdmissionPolicy
1048#TypeChecking: {
1049 // expressionWarnings contains the type checking warnings for each
1050 // expression.
1051 "expressionWarnings"?: [...#ExpressionWarning]
1052}
1053
1054// ValidatingAdmissionPolicy describes the definition of an
1055// admission validation policy that accepts or rejects an object
1056// without changing it.
1057#ValidatingAdmissionPolicy: {
1058 // APIVersion defines the versioned schema of this representation
1059 // of an object. Servers should convert recognized schemas to the
1060 // latest internal value, and may reject unrecognized values.
1061 // More info:
1062 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
1063 "apiVersion": "admissionregistration.k8s.io/v1"
1064
1065 // Kind is a string value representing the REST resource this
1066 // object represents. Servers may infer this from the endpoint
1067 // the client submits requests to. Cannot be updated. In
1068 // CamelCase. More info:
1069 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1070 "kind": "ValidatingAdmissionPolicy"
1071
1072 // metadata is the standard object metadata; More info:
1073 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
1074 "metadata"?: v1.#ObjectMeta
1075
1076 // spec defines the desired behavior of the
1077 // ValidatingAdmissionPolicy.
1078 "spec"?: #ValidatingAdmissionPolicySpec
1079
1080 // status represents the current status of the
1081 // ValidatingAdmissionPolicy, including warnings that are useful
1082 // to determine if the policy behaves in the expected way.
1083 // Populated by the system. Read-only.
1084 "status"?: #ValidatingAdmissionPolicyStatus
1085}
1086
1087// ValidatingAdmissionPolicyBinding binds the
1088// ValidatingAdmissionPolicy with paramerized resources.
1089// ValidatingAdmissionPolicyBinding and parameter CRDs together
1090// define how cluster administrators configure policies for
1091// clusters.
1092//
1093// For a given admission request, each binding will cause its
1094// policy to be evaluated N times, where N is 1 for
1095// policies/bindings that don't use params, otherwise N is the
1096// number of parameters selected by the binding.
1097//
1098// The CEL expressions of a policy must have a computed CEL cost
1099// below the maximum CEL budget. Each evaluation of the policy is
1100// given an independent CEL cost budget. Adding/removing
1101// policies, bindings, or params can not affect whether a given
1102// (policy, binding, param) combination is within its own CEL
1103// budget.
1104#ValidatingAdmissionPolicyBinding: {
1105 // APIVersion defines the versioned schema of this representation
1106 // of an object. Servers should convert recognized schemas to the
1107 // latest internal value, and may reject unrecognized values.
1108 // More info:
1109 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
1110 "apiVersion": "admissionregistration.k8s.io/v1"
1111
1112 // Kind is a string value representing the REST resource this
1113 // object represents. Servers may infer this from the endpoint
1114 // the client submits requests to. Cannot be updated. In
1115 // CamelCase. More info:
1116 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1117 "kind": "ValidatingAdmissionPolicyBinding"
1118
1119 // metadata is the standard object metadata; More info:
1120 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
1121 "metadata"?: v1.#ObjectMeta
1122
1123 // spec defines the desired behavior of the
1124 // ValidatingAdmissionPolicyBinding.
1125 "spec"!: #ValidatingAdmissionPolicyBindingSpec
1126}
1127
1128// ValidatingAdmissionPolicyBindingList is a list of
1129// ValidatingAdmissionPolicyBinding.
1130#ValidatingAdmissionPolicyBindingList: {
1131 // APIVersion defines the versioned schema of this representation
1132 // of an object. Servers should convert recognized schemas to the
1133 // latest internal value, and may reject unrecognized values.
1134 // More info:
1135 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
1136 "apiVersion": "admissionregistration.k8s.io/v1"
1137
1138 // List of PolicyBinding.
1139 "items"!: [...#ValidatingAdmissionPolicyBinding]
1140
1141 // Kind is a string value representing the REST resource this
1142 // object represents. Servers may infer this from the endpoint
1143 // the client submits requests to. Cannot be updated. In
1144 // CamelCase. More info:
1145 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1146 "kind": "ValidatingAdmissionPolicyBindingList"
1147
1148 // metadata is the standard list metadata. More info:
1149 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1150 "metadata"?: v1.#ListMeta
1151}
1152
1153// ValidatingAdmissionPolicyBindingSpec is the specification of
1154// the ValidatingAdmissionPolicyBinding.
1155#ValidatingAdmissionPolicyBindingSpec: {
1156 // matchResources declares what resources match this binding and
1157 // will be validated by it. Note that this is intersected with
1158 // the policy's matchConstraints, so only requests that are
1159 // matched by the policy can be selected by this. If this is
1160 // unset, all resources matched by the policy are validated by
1161 // this binding When resourceRules is unset, it does not
1162 // constrain resource matching. If a resource is matched by the
1163 // other fields of this object, it will be validated. Note that
1164 // this is differs from ValidatingAdmissionPolicy
1165 // matchConstraints, where resourceRules are required.
1166 "matchResources"?: #MatchResources
1167
1168 // paramRef specifies the parameter resource used to configure the
1169 // admission control policy. It should point to a resource of the
1170 // type specified in ParamKind of the bound
1171 // ValidatingAdmissionPolicy. If the policy specifies a ParamKind
1172 // and the resource referred to by ParamRef does not exist, this
1173 // binding is considered mis-configured and the FailurePolicy of
1174 // the ValidatingAdmissionPolicy applied. If the policy does not
1175 // specify a ParamKind then this field is ignored, and the rules
1176 // are evaluated without a param.
1177 "paramRef"?: #ParamRef
1178
1179 // policyName references a ValidatingAdmissionPolicy name which
1180 // the ValidatingAdmissionPolicyBinding binds to. If the
1181 // referenced resource does not exist, this binding is considered
1182 // invalid and will be ignored Required.
1183 "policyName"!: string
1184
1185 // validationActions declares how Validations of the referenced
1186 // ValidatingAdmissionPolicy are enforced. If a validation
1187 // evaluates to false it is always enforced according to these
1188 // actions.
1189 //
1190 // Failures defined by the ValidatingAdmissionPolicy's
1191 // FailurePolicy are enforced according to these actions only if
1192 // the FailurePolicy is set to Fail, otherwise the failures are
1193 // ignored. This includes compilation errors, runtime errors and
1194 // misconfigurations of the policy.
1195 //
1196 // validationActions is declared as a set of action values. Order
1197 // does not matter. validationActions may not contain duplicates
1198 // of the same action.
1199 //
1200 // The supported actions values are:
1201 //
1202 // "Deny" specifies that a validation failure results in a denied
1203 // request.
1204 //
1205 // "Warn" specifies that a validation failure is reported to the
1206 // request client in HTTP Warning headers, with a warning code of
1207 // 299. Warnings can be sent both for allowed or denied admission
1208 // responses.
1209 //
1210 // "Audit" specifies that a validation failure is included in the
1211 // published audit event for the request. The audit event will
1212 // contain a
1213 // `validation.policy.admission.k8s.io/validation_failure` audit
1214 // annotation with a value containing the details of the
1215 // validation failures, formatted as a JSON list of objects, each
1216 // with the following fields: - message: The validation failure
1217 // message string - policy: The resource name of the
1218 // ValidatingAdmissionPolicy - binding: The resource name of the
1219 // ValidatingAdmissionPolicyBinding - expressionIndex: The index
1220 // of the failed validations in the ValidatingAdmissionPolicy -
1221 // validationActions: The enforcement actions enacted for the
1222 // validation failure Example audit annotation:
1223 // `"validation.policy.admission.k8s.io/validation_failure":
1224 // "[{\"message\": \"Invalid value\", {\"policy\":
1225 // \"policy.example.com\", {\"binding\":
1226 // \"policybinding.example.com\", {\"expressionIndex\": \"1\",
1227 // {\"validationActions\": [\"Audit\"]}]"`
1228 //
1229 // Clients should expect to handle additional values by ignoring
1230 // any values not recognized.
1231 //
1232 // "Deny" and "Warn" may not be used together since this
1233 // combination needlessly duplicates the validation failure both
1234 // in the API response body and the HTTP warning headers.
1235 //
1236 // Required.
1237 "validationActions"!: [...string]
1238}
1239
1240// ValidatingAdmissionPolicyList is a list of
1241// ValidatingAdmissionPolicy.
1242#ValidatingAdmissionPolicyList: {
1243 // APIVersion defines the versioned schema of this representation
1244 // of an object. Servers should convert recognized schemas to the
1245 // latest internal value, and may reject unrecognized values.
1246 // More info:
1247 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
1248 "apiVersion": "admissionregistration.k8s.io/v1"
1249
1250 // List of ValidatingAdmissionPolicy.
1251 "items"!: [...#ValidatingAdmissionPolicy]
1252
1253 // Kind is a string value representing the REST resource this
1254 // object represents. Servers may infer this from the endpoint
1255 // the client submits requests to. Cannot be updated. In
1256 // CamelCase. More info:
1257 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1258 "kind": "ValidatingAdmissionPolicyList"
1259
1260 // metadata is the standard list metadata. More info:
1261 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1262 "metadata"?: v1.#ListMeta
1263}
1264
1265// ValidatingAdmissionPolicySpec is the specification of the
1266// desired behavior of the AdmissionPolicy.
1267#ValidatingAdmissionPolicySpec: {
1268 // auditAnnotations contains CEL expressions which are used to
1269 // produce audit annotations for the audit event of the API
1270 // request. validations and auditAnnotations may not both be
1271 // empty; a least one of validations or auditAnnotations is
1272 // required.
1273 "auditAnnotations"?: [...#AuditAnnotation]
1274
1275 // failurePolicy defines how to handle failures for the admission
1276 // policy. Failures can occur from CEL expression parse errors,
1277 // type check errors, runtime errors and invalid or
1278 // mis-configured policy definitions or bindings.
1279 //
1280 // A policy is invalid if spec.paramKind refers to a non-existent
1281 // Kind. A binding is invalid if spec.paramRef.name refers to a
1282 // non-existent resource.
1283 //
1284 // failurePolicy does not define how validations that evaluate to
1285 // false are handled.
1286 //
1287 // When failurePolicy is set to Fail,
1288 // ValidatingAdmissionPolicyBinding validationActions define how
1289 // failures are enforced.
1290 //
1291 // Allowed values are Ignore or Fail. Defaults to Fail.
1292 "failurePolicy"?: string
1293
1294 // matchConditions is a list of conditions that must be met for a
1295 // request to be validated. Match conditions filter requests that
1296 // have already been matched by the rules, namespaceSelector, and
1297 // objectSelector. An empty list of matchConditions matches all
1298 // requests. There are a maximum of 64 match conditions allowed.
1299 //
1300 // If a parameter object is provided, it can be accessed via the
1301 // `params` handle in the same manner as validation expressions.
1302 //
1303 // The exact matching logic is (in order):
1304 // 1. If ANY matchCondition evaluates to FALSE, the policy is
1305 // skipped.
1306 // 2. If ALL matchConditions evaluate to TRUE, the policy is
1307 // evaluated.
1308 // 3. If any matchCondition evaluates to an error (but none are
1309 // FALSE):
1310 // - If failurePolicy=Fail, reject the request
1311 // - If failurePolicy=Ignore, the policy is skipped
1312 "matchConditions"?: [...#MatchCondition]
1313
1314 // matchConstraints specifies what resources this policy is
1315 // designed to validate. The AdmissionPolicy cares about a
1316 // request if it matches _all_ Constraints. However, in order to
1317 // prevent clusters from being put into an unstable state that
1318 // cannot be recovered from via the API ValidatingAdmissionPolicy
1319 // cannot match ValidatingAdmissionPolicy and
1320 // ValidatingAdmissionPolicyBinding. Required.
1321 "matchConstraints"?: #MatchResources
1322
1323 // paramKind specifies the kind of resources used to parameterize
1324 // this policy. If absent, there are no parameters for this
1325 // policy and the param CEL variable will not be provided to
1326 // validation expressions. If ParamKind refers to a non-existent
1327 // kind, this policy definition is mis-configured and the
1328 // FailurePolicy is applied. If paramKind is specified but
1329 // paramRef is unset in ValidatingAdmissionPolicyBinding, the
1330 // params variable will be null.
1331 "paramKind"?: #ParamKind
1332
1333 // validations contain CEL expressions which is used to apply the
1334 // validation. Validations and AuditAnnotations may not both be
1335 // empty; a minimum of one Validations or AuditAnnotations is
1336 // required.
1337 "validations"?: [...#Validation]
1338
1339 // variables contain definitions of variables that can be used in
1340 // composition of other expressions. Each variable is defined as
1341 // a named CEL expression. The variables defined here will be
1342 // available under `variables` in other expressions of the policy
1343 // except MatchConditions because MatchConditions are evaluated
1344 // before the rest of the policy.
1345 //
1346 // The expression of a variable can refer to other variables
1347 // defined earlier in the list but not those after. Thus,
1348 // Variables must be sorted by the order of first appearance and
1349 // acyclic.
1350 "variables"?: [...#Variable]
1351}
1352
1353// ValidatingAdmissionPolicyStatus represents the status of an
1354// admission validation policy.
1355#ValidatingAdmissionPolicyStatus: {
1356 // conditions represent the latest available observations of a
1357 // policy's current state.
1358 "conditions"?: [...v1.#Condition]
1359
1360 // observedGeneration is the generation observed by the
1361 // controller.
1362 "observedGeneration"?: int64 & int
1363
1364 // typeChecking contains the results of type checking for each
1365 // expression. Presence of this field indicates the completion of
1366 // the type checking.
1367 "typeChecking"?: #TypeChecking
1368}
1369
1370// ValidatingWebhook describes an admission webhook and the
1371// resources and operations it applies to.
1372#ValidatingWebhook: {
1373 // admissionReviewVersions is an ordered list of preferred
1374 // `AdmissionReview` versions the Webhook expects. API server
1375 // will try to use first version in the list which it supports.
1376 // If none of the versions specified in this list supported by
1377 // API server, validation will fail for this object. If a
1378 // persisted webhook configuration specifies allowed versions and
1379 // does not include any versions known to the API Server, calls
1380 // to the webhook will fail and be subject to the failure policy.
1381 "admissionReviewVersions"!: [...string]
1382
1383 // clientConfig defines how to communicate with the hook. Required
1384 "clientConfig"!: #WebhookClientConfig
1385
1386 // failurePolicy defines how unrecognized errors from the
1387 // admission endpoint are handled - allowed values are Ignore or
1388 // Fail. Defaults to Fail.
1389 "failurePolicy"?: string
1390
1391 // matchConditions is a list of conditions that must be met for a
1392 // request to be sent to this webhook. Match conditions filter
1393 // requests that have already been matched by the rules,
1394 // namespaceSelector, and objectSelector. An empty list of
1395 // matchConditions matches all requests. There are a maximum of
1396 // 64 match conditions allowed.
1397 //
1398 // The exact matching logic is (in order):
1399 // 1. If ANY matchCondition evaluates to FALSE, the webhook is
1400 // skipped.
1401 // 2. If ALL matchConditions evaluate to TRUE, the webhook is
1402 // called.
1403 // 3. If any matchCondition evaluates to an error (but none are
1404 // FALSE):
1405 // - If failurePolicy=Fail, reject the request
1406 // - If failurePolicy=Ignore, the error is ignored and the webhook
1407 // is skipped
1408 "matchConditions"?: [...#MatchCondition]
1409
1410 // matchPolicy defines how the "rules" list is used to match
1411 // incoming requests. Allowed values are "Exact" or "Equivalent".
1412 //
1413 // - Exact: match a request only if it exactly matches a specified
1414 // rule. For example, if deployments can be modified via apps/v1,
1415 // apps/v1beta1, and extensions/v1beta1, but "rules" only
1416 // included `apiGroups:["apps"], apiVersions:["v1"], resources:
1417 // ["deployments"]`, a request to apps/v1beta1 or
1418 // extensions/v1beta1 would not be sent to the webhook.
1419 //
1420 // - Equivalent: match a request if modifies a resource listed in
1421 // rules, even via another API group or version. For example, if
1422 // deployments can be modified via apps/v1, apps/v1beta1, and
1423 // extensions/v1beta1, and "rules" only included
1424 // `apiGroups:["apps"], apiVersions:["v1"], resources:
1425 // ["deployments"]`, a request to apps/v1beta1 or
1426 // extensions/v1beta1 would be converted to apps/v1 and sent to
1427 // the webhook.
1428 //
1429 // Defaults to "Equivalent"
1430 "matchPolicy"?: string
1431
1432 // name is the name of the admission webhook. Name should be fully
1433 // qualified, e.g., imagepolicy.kubernetes.io, where
1434 // "imagepolicy" is the name of the webhook, and kubernetes.io is
1435 // the name of the organization. Required.
1436 "name"!: string
1437
1438 // namespaceSelector decides whether to run the webhook on an
1439 // object based on whether the namespace for that object matches
1440 // the selector. If the object itself is a namespace, the
1441 // matching is performed on object.metadata.labels. If the object
1442 // is another cluster scoped resource, it never skips the
1443 // webhook.
1444 //
1445 // For example, to run the webhook on any objects whose namespace
1446 // is not associated with "runlevel" of "0" or "1"; you will set
1447 // the selector as follows: "namespaceSelector": {
1448 // "matchExpressions": [
1449 // {
1450 // "key": "runlevel",
1451 // "operator": "NotIn",
1452 // "values": [
1453 // "0",
1454 // "1"
1455 // ]
1456 // }
1457 // ]
1458 // }
1459 //
1460 // If instead you want to only run the webhook on any objects
1461 // whose namespace is associated with the "environment" of "prod"
1462 // or "staging"; you will set the selector as follows:
1463 // "namespaceSelector": {
1464 // "matchExpressions": [
1465 // {
1466 // "key": "environment",
1467 // "operator": "In",
1468 // "values": [
1469 // "prod",
1470 // "staging"
1471 // ]
1472 // }
1473 // ]
1474 // }
1475 //
1476 // See
1477 // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
1478 // for more examples of label selectors.
1479 //
1480 // Default to the empty LabelSelector, which matches everything.
1481 "namespaceSelector"?: v1.#LabelSelector
1482
1483 // objectSelector decides whether to run the webhook based on if
1484 // the object has matching labels. objectSelector is evaluated
1485 // against both the oldObject and newObject that would be sent to
1486 // the webhook, and is considered to match if either object
1487 // matches the selector. A null object (oldObject in the case of
1488 // create, or newObject in the case of delete) or an object that
1489 // cannot have labels (like a DeploymentRollback or a
1490 // PodProxyOptions object) is not considered to match. Use the
1491 // object selector only if the webhook is opt-in, because end
1492 // users may skip the admission webhook by setting the labels.
1493 // Default to the empty LabelSelector, which matches everything.
1494 "objectSelector"?: v1.#LabelSelector
1495
1496 // rules describes what operations on what resources/subresources
1497 // the webhook cares about. The webhook cares about an operation
1498 // if it matches _any_ Rule. However, in order to prevent
1499 // ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from
1500 // putting the cluster in a state which cannot be recovered from
1501 // without completely disabling the plugin,
1502 // ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are
1503 // never called on admission requests for
1504 // ValidatingWebhookConfiguration and
1505 // MutatingWebhookConfiguration objects.
1506 "rules"?: [...#RuleWithOperations]
1507
1508 // sideEffects states whether this webhook has side effects.
1509 // Acceptable values are: None, NoneOnDryRun (webhooks created
1510 // via v1beta1 may also specify Some or Unknown). Webhooks with
1511 // side effects MUST implement a reconciliation system, since a
1512 // request may be rejected by a future step in the admission
1513 // chain and the side effects therefore need to be undone.
1514 // Requests with the dryRun attribute will be auto-rejected if
1515 // they match a webhook with sideEffects == Unknown or Some.
1516 "sideEffects"!: string
1517
1518 // timeoutSeconds specifies the timeout for this webhook. After
1519 // the timeout passes, the webhook call will be ignored or the
1520 // API call will fail based on the failure policy. The timeout
1521 // value must be between 1 and 30 seconds. Default to 10 seconds.
1522 "timeoutSeconds"?: int32 & int
1523}
1524
1525// ValidatingWebhookConfiguration describes the configuration of
1526// and admission webhook that accept or reject and object without
1527// changing it.
1528#ValidatingWebhookConfiguration: {
1529 // APIVersion defines the versioned schema of this representation
1530 // of an object. Servers should convert recognized schemas to the
1531 // latest internal value, and may reject unrecognized values.
1532 // More info:
1533 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
1534 "apiVersion": "admissionregistration.k8s.io/v1"
1535
1536 // Kind is a string value representing the REST resource this
1537 // object represents. Servers may infer this from the endpoint
1538 // the client submits requests to. Cannot be updated. In
1539 // CamelCase. More info:
1540 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1541 "kind": "ValidatingWebhookConfiguration"
1542
1543 // metadata is the standard object metadata; More info:
1544 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
1545 "metadata"?: v1.#ObjectMeta
1546
1547 // webhooks is a list of webhooks and the affected resources and
1548 // operations.
1549 "webhooks"?: [...#ValidatingWebhook]
1550}
1551
1552// ValidatingWebhookConfigurationList is a list of
1553// ValidatingWebhookConfiguration.
1554#ValidatingWebhookConfigurationList: {
1555 // APIVersion defines the versioned schema of this representation
1556 // of an object. Servers should convert recognized schemas to the
1557 // latest internal value, and may reject unrecognized values.
1558 // More info:
1559 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
1560 "apiVersion": "admissionregistration.k8s.io/v1"
1561
1562 // List of ValidatingWebhookConfiguration.
1563 "items"!: [...#ValidatingWebhookConfiguration]
1564
1565 // Kind is a string value representing the REST resource this
1566 // object represents. Servers may infer this from the endpoint
1567 // the client submits requests to. Cannot be updated. In
1568 // CamelCase. More info:
1569 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1570 "kind": "ValidatingWebhookConfigurationList"
1571
1572 // metadata is the standard list metadata. More info:
1573 // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1574 "metadata"?: v1.#ListMeta
1575}
1576
1577// Validation specifies the CEL expression which is used to apply
1578// the validation.
1579#Validation: {
1580 // expression represents the expression which will be evaluated by
1581 // CEL. ref: https://github.com/google/cel-spec CEL expressions
1582 // have access to the contents of the API request/response,
1583 // organized into CEL variables as well as some other useful
1584 // variables:
1585 //
1586 // - 'object' - The object from the incoming request. The value is
1587 // null for DELETE requests. - 'oldObject' - The existing object.
1588 // The value is null for CREATE requests. - 'request' -
1589 // Attributes of the API
1590 // request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
1591 // - 'params' - Parameter resource referred to by the policy
1592 // binding being evaluated. Only populated if the policy has a
1593 // ParamKind. - 'namespaceObject' - The namespace object that the
1594 // incoming object belongs to. The value is null for
1595 // cluster-scoped resources. - 'variables' - Map of composited
1596 // variables, from its name to its lazily evaluated value.
1597 // For example, a variable named 'foo' can be accessed as
1598 // 'variables.foo'.
1599 // - 'authorizer' - A CEL Authorizer. May be used to perform
1600 // authorization checks for the principal (user or service
1601 // account) of the request.
1602 // See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
1603 // - 'authorizer.requestResource' - A CEL ResourceCheck
1604 // constructed from the 'authorizer' and configured with the
1605 // request resource.
1606 //
1607 // The `apiVersion`, `kind`, `metadata.name` and
1608 // `metadata.generateName` are always accessible from the root of
1609 // the object. No other metadata properties are accessible.
1610 //
1611 // Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*`
1612 // are accessible. Accessible property names are escaped
1613 // according to the following rules when accessed in the
1614 // expression: - '__' escapes to '__underscores__' - '.' escapes
1615 // to '__dot__' - '-' escapes to '__dash__' - '/' escapes to
1616 // '__slash__' - Property names that exactly match a CEL RESERVED
1617 // keyword escape to '__{keyword}__'. The keywords are:
1618 // "true", "false", "null", "in", "as", "break", "const",
1619 // "continue", "else", "for", "function", "if",
1620 // "import", "let", "loop", "package", "namespace", "return".
1621 // Examples:
1622 // - Expression accessing a property named "namespace":
1623 // {"Expression": "object.__namespace__ > 0"}
1624 // - Expression accessing a property named "x-prop":
1625 // {"Expression": "object.x__dash__prop > 0"}
1626 // - Expression accessing a property named "redact__d":
1627 // {"Expression": "object.redact__underscores__d > 0"}
1628 //
1629 // Equality on arrays with list type of 'set' or 'map' ignores
1630 // element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays
1631 // with x-kubernetes-list-type use the semantics of the list
1632 // type:
1633 // - 'set': `X + Y` performs a union where the array positions of
1634 // all elements in `X` are preserved and
1635 // non-intersecting elements in `Y` are appended, retaining their
1636 // partial order.
1637 // - 'map': `X + Y` performs a merge where the array positions of
1638 // all keys in `X` are preserved but the values
1639 // are overwritten by values in `Y` when the key sets of `X` and
1640 // `Y` intersect. Elements in `Y` with
1641 // non-intersecting keys are appended, retaining their partial
1642 // order.
1643 // Required.
1644 "expression"!: string
1645
1646 // message represents the message displayed when validation fails.
1647 // The message is required if the Expression contains line
1648 // breaks. The message must not contain line breaks. If unset,
1649 // the message is "failed rule: {Rule}". e.g. "must be a URL with
1650 // the host matching spec.host" If the Expression contains line
1651 // breaks. Message is required. The message must not contain line
1652 // breaks. If unset, the message is "failed Expression:
1653 // {Expression}".
1654 "message"?: string
1655
1656 // messageExpression declares a CEL expression that evaluates to
1657 // the validation failure message that is returned when this rule
1658 // fails. Since messageExpression is used as a failure message,
1659 // it must evaluate to a string. If both message and
1660 // messageExpression are present on a validation, then
1661 // messageExpression will be used if validation fails. If
1662 // messageExpression results in a runtime error, the runtime
1663 // error is logged, and the validation failure message is
1664 // produced as if the messageExpression field were unset. If
1665 // messageExpression evaluates to an empty string, a string with
1666 // only spaces, or a string that contains line breaks, then the
1667 // validation failure message will also be produced as if the
1668 // messageExpression field were unset, and the fact that
1669 // messageExpression produced an empty string/string with only
1670 // spaces/string with line breaks will be logged.
1671 // messageExpression has access to all the same variables as the
1672 // `expression` except for 'authorizer' and
1673 // 'authorizer.requestResource'. Example: "object.x must be less
1674 // than max ("+string(params.max)+")"
1675 "messageExpression"?: string
1676
1677 // reason represents a machine-readable description of why this
1678 // validation failed. If this is the first validation in the list
1679 // to fail, this reason, as well as the corresponding HTTP
1680 // response code, are used in the HTTP response to the client.
1681 // The currently supported reasons are: "Unauthorized",
1682 // "Forbidden", "Invalid", "RequestEntityTooLarge". If not set,
1683 // StatusReasonInvalid is used in the response to the client.
1684 "reason"?: string
1685}
1686
1687// Variable is the definition of a variable that is used for
1688// composition. A variable is defined as a named expression.
1689#Variable: {
1690 // expression is the expression that will be evaluated as the
1691 // value of the variable. The CEL expression has access to the
1692 // same identifiers as the CEL expressions in Validation.
1693 "expression"!: string
1694
1695 // name is the name of the variable. The name must be a valid CEL
1696 // identifier and unique among all variables. The variable can be
1697 // accessed in other expressions through `variables` For example,
1698 // if name is "foo", the variable will be available as
1699 // `variables.foo`
1700 "name"!: string
1701}
1702
1703// WebhookClientConfig contains the information to make a TLS
1704// connection with the webhook
1705#WebhookClientConfig: {
1706 // caBundle is a PEM encoded CA bundle which will be used to
1707 // validate the webhook's server certificate. If unspecified,
1708 // system trust roots on the apiserver are used.
1709 "caBundle"?: string
1710
1711 // service is a reference to the service for this webhook. Either
1712 // `service` or `url` must be specified.
1713 //
1714 // If the webhook is running within the cluster, then you should
1715 // use `service`.
1716 "service"?: #ServiceReference
1717
1718 // url gives the location of the webhook, in standard URL form
1719 // (`scheme://host:port/path`). Exactly one of `url` or `service`
1720 // must be specified.
1721 //
1722 // The `host` should not refer to a service running in the
1723 // cluster; use the `service` field instead. The host might be
1724 // resolved via external DNS in some apiservers (e.g.,
1725 // `kube-apiserver` cannot resolve in-cluster DNS as that would
1726 // be a layering violation). `host` may also be an IP address.
1727 //
1728 // Please note that using `localhost` or `127.0.0.1` as a `host`
1729 // is risky unless you take great care to run this webhook on all
1730 // hosts which run an apiserver which might need to make calls to
1731 // this webhook. Such installs are likely to be non-portable,
1732 // i.e., not easy to turn up in a new cluster.
1733 //
1734 // The scheme must be "https"; the URL must begin with "https://".
1735 //
1736 // A path is optional, and if present may be any string
1737 // permissible in a URL. You may use the path to pass an
1738 // arbitrary string to the webhook, for example, a cluster
1739 // identifier.
1740 //
1741 // Attempting to use a user or basic auth e.g. "user:password@" is
1742 // not allowed. Fragments ("#...") and query parameters ("?...")
1743 // are not allowed, either.
1744 "url"?: string
1745}