Matthias Andreas Benkard | 832a54e | 2019-01-29 09:27:38 +0100 | [diff] [blame] | 1 | /* |
| 2 | Copyright 2017 The Kubernetes Authors. |
| 3 | |
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | you may not use this file except in compliance with the License. |
| 6 | You may obtain a copy of the License at |
| 7 | |
| 8 | http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | |
| 10 | Unless required by applicable law or agreed to in writing, software |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | See the License for the specific language governing permissions and |
| 14 | limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | package v1beta1 |
| 18 | |
| 19 | import ( |
| 20 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 21 | ) |
| 22 | |
| 23 | // Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended |
| 24 | // to make sure that all the tuple expansions are valid. |
| 25 | type Rule struct { |
| 26 | // APIGroups is the API groups the resources belong to. '*' is all groups. |
| 27 | // If '*' is present, the length of the slice must be one. |
| 28 | // Required. |
| 29 | APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,1,rep,name=apiGroups"` |
| 30 | |
| 31 | // APIVersions is the API versions the resources belong to. '*' is all versions. |
| 32 | // If '*' is present, the length of the slice must be one. |
| 33 | // Required. |
| 34 | APIVersions []string `json:"apiVersions,omitempty" protobuf:"bytes,2,rep,name=apiVersions"` |
| 35 | |
| 36 | // Resources is a list of resources this rule applies to. |
| 37 | // |
| 38 | // For example: |
| 39 | // 'pods' means pods. |
| 40 | // 'pods/log' means the log subresource of pods. |
| 41 | // '*' means all resources, but not subresources. |
| 42 | // 'pods/*' means all subresources of pods. |
| 43 | // '*/scale' means all scale subresources. |
| 44 | // '*/*' means all resources and their subresources. |
| 45 | // |
| 46 | // If wildcard is present, the validation rule will ensure resources do not |
| 47 | // overlap with each other. |
| 48 | // |
| 49 | // Depending on the enclosing object, subresources might not be allowed. |
| 50 | // Required. |
| 51 | Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"` |
| 52 | } |
| 53 | |
| 54 | type FailurePolicyType string |
| 55 | |
| 56 | const ( |
| 57 | // Ignore means that an error calling the webhook is ignored. |
| 58 | Ignore FailurePolicyType = "Ignore" |
| 59 | // Fail means that an error calling the webhook causes the admission to fail. |
| 60 | Fail FailurePolicyType = "Fail" |
| 61 | ) |
| 62 | |
| 63 | // +genclient |
| 64 | // +genclient:nonNamespaced |
| 65 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 66 | |
| 67 | // ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it. |
| 68 | type ValidatingWebhookConfiguration struct { |
| 69 | metav1.TypeMeta `json:",inline"` |
| 70 | // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. |
| 71 | // +optional |
| 72 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 73 | // Webhooks is a list of webhooks and the affected resources and operations. |
| 74 | // +optional |
| 75 | // +patchMergeKey=name |
| 76 | // +patchStrategy=merge |
| 77 | Webhooks []Webhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"` |
| 78 | } |
| 79 | |
| 80 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 81 | |
| 82 | // ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration. |
| 83 | type ValidatingWebhookConfigurationList struct { |
| 84 | metav1.TypeMeta `json:",inline"` |
| 85 | // Standard list metadata. |
| 86 | // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds |
| 87 | // +optional |
| 88 | metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 89 | // List of ValidatingWebhookConfiguration. |
| 90 | Items []ValidatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` |
| 91 | } |
| 92 | |
| 93 | // +genclient |
| 94 | // +genclient:nonNamespaced |
| 95 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 96 | |
| 97 | // MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object. |
| 98 | type MutatingWebhookConfiguration struct { |
| 99 | metav1.TypeMeta `json:",inline"` |
| 100 | // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata. |
| 101 | // +optional |
| 102 | metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 103 | // Webhooks is a list of webhooks and the affected resources and operations. |
| 104 | // +optional |
| 105 | // +patchMergeKey=name |
| 106 | // +patchStrategy=merge |
| 107 | Webhooks []Webhook `json:"webhooks,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,2,rep,name=Webhooks"` |
| 108 | } |
| 109 | |
| 110 | // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 111 | |
| 112 | // MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration. |
| 113 | type MutatingWebhookConfigurationList struct { |
| 114 | metav1.TypeMeta `json:",inline"` |
| 115 | // Standard list metadata. |
| 116 | // More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds |
| 117 | // +optional |
| 118 | metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` |
| 119 | // List of MutatingWebhookConfiguration. |
| 120 | Items []MutatingWebhookConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` |
| 121 | } |
| 122 | |
| 123 | // Webhook describes an admission webhook and the resources and operations it applies to. |
| 124 | type Webhook struct { |
| 125 | // The name of the admission webhook. |
| 126 | // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where |
| 127 | // "imagepolicy" is the name of the webhook, and kubernetes.io is the name |
| 128 | // of the organization. |
| 129 | // Required. |
| 130 | Name string `json:"name" protobuf:"bytes,1,opt,name=name"` |
| 131 | |
| 132 | // ClientConfig defines how to communicate with the hook. |
| 133 | // Required |
| 134 | ClientConfig WebhookClientConfig `json:"clientConfig" protobuf:"bytes,2,opt,name=clientConfig"` |
| 135 | |
| 136 | // Rules describes what operations on what resources/subresources the webhook cares about. |
| 137 | // The webhook cares about an operation if it matches _any_ Rule. |
| 138 | // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks |
| 139 | // from putting the cluster in a state which cannot be recovered from without completely |
| 140 | // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called |
| 141 | // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects. |
| 142 | Rules []RuleWithOperations `json:"rules,omitempty" protobuf:"bytes,3,rep,name=rules"` |
| 143 | |
| 144 | // FailurePolicy defines how unrecognized errors from the admission endpoint are handled - |
| 145 | // allowed values are Ignore or Fail. Defaults to Ignore. |
| 146 | // +optional |
| 147 | FailurePolicy *FailurePolicyType `json:"failurePolicy,omitempty" protobuf:"bytes,4,opt,name=failurePolicy,casttype=FailurePolicyType"` |
| 148 | |
| 149 | // NamespaceSelector decides whether to run the webhook on an object based |
| 150 | // on whether the namespace for that object matches the selector. If the |
| 151 | // object itself is a namespace, the matching is performed on |
| 152 | // object.metadata.labels. If the object is another cluster scoped resource, |
| 153 | // it never skips the webhook. |
| 154 | // |
| 155 | // For example, to run the webhook on any objects whose namespace is not |
| 156 | // associated with "runlevel" of "0" or "1"; you will set the selector as |
| 157 | // follows: |
| 158 | // "namespaceSelector": { |
| 159 | // "matchExpressions": [ |
| 160 | // { |
| 161 | // "key": "runlevel", |
| 162 | // "operator": "NotIn", |
| 163 | // "values": [ |
| 164 | // "0", |
| 165 | // "1" |
| 166 | // ] |
| 167 | // } |
| 168 | // ] |
| 169 | // } |
| 170 | // |
| 171 | // If instead you want to only run the webhook on any objects whose |
| 172 | // namespace is associated with the "environment" of "prod" or "staging"; |
| 173 | // you will set the selector as follows: |
| 174 | // "namespaceSelector": { |
| 175 | // "matchExpressions": [ |
| 176 | // { |
| 177 | // "key": "environment", |
| 178 | // "operator": "In", |
| 179 | // "values": [ |
| 180 | // "prod", |
| 181 | // "staging" |
| 182 | // ] |
| 183 | // } |
| 184 | // ] |
| 185 | // } |
| 186 | // |
| 187 | // See |
| 188 | // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ |
| 189 | // for more examples of label selectors. |
| 190 | // |
| 191 | // Default to the empty LabelSelector, which matches everything. |
| 192 | // +optional |
| 193 | NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,5,opt,name=namespaceSelector"` |
| 194 | } |
| 195 | |
| 196 | // RuleWithOperations is a tuple of Operations and Resources. It is recommended to make |
| 197 | // sure that all the tuple expansions are valid. |
| 198 | type RuleWithOperations struct { |
| 199 | // Operations is the operations the admission hook cares about - CREATE, UPDATE, or * |
| 200 | // for all operations. |
| 201 | // If '*' is present, the length of the slice must be one. |
| 202 | // Required. |
| 203 | Operations []OperationType `json:"operations,omitempty" protobuf:"bytes,1,rep,name=operations,casttype=OperationType"` |
| 204 | // Rule is embedded, it describes other criteria of the rule, like |
| 205 | // APIGroups, APIVersions, Resources, etc. |
| 206 | Rule `json:",inline" protobuf:"bytes,2,opt,name=rule"` |
| 207 | } |
| 208 | |
| 209 | type OperationType string |
| 210 | |
| 211 | // The constants should be kept in sync with those defined in k8s.io/kubernetes/pkg/admission/interface.go. |
| 212 | const ( |
| 213 | OperationAll OperationType = "*" |
| 214 | Create OperationType = "CREATE" |
| 215 | Update OperationType = "UPDATE" |
| 216 | Delete OperationType = "DELETE" |
| 217 | Connect OperationType = "CONNECT" |
| 218 | ) |
| 219 | |
| 220 | // WebhookClientConfig contains the information to make a TLS |
| 221 | // connection with the webhook |
| 222 | type WebhookClientConfig struct { |
| 223 | // `url` gives the location of the webhook, in standard URL form |
| 224 | // (`[scheme://]host:port/path`). Exactly one of `url` or `service` |
| 225 | // must be specified. |
| 226 | // |
| 227 | // The `host` should not refer to a service running in the cluster; use |
| 228 | // the `service` field instead. The host might be resolved via external |
| 229 | // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve |
| 230 | // in-cluster DNS as that would be a layering violation). `host` may |
| 231 | // also be an IP address. |
| 232 | // |
| 233 | // Please note that using `localhost` or `127.0.0.1` as a `host` is |
| 234 | // risky unless you take great care to run this webhook on all hosts |
| 235 | // which run an apiserver which might need to make calls to this |
| 236 | // webhook. Such installs are likely to be non-portable, i.e., not easy |
| 237 | // to turn up in a new cluster. |
| 238 | // |
| 239 | // The scheme must be "https"; the URL must begin with "https://". |
| 240 | // |
| 241 | // A path is optional, and if present may be any string permissible in |
| 242 | // a URL. You may use the path to pass an arbitrary string to the |
| 243 | // webhook, for example, a cluster identifier. |
| 244 | // |
| 245 | // Attempting to use a user or basic auth e.g. "user:password@" is not |
| 246 | // allowed. Fragments ("#...") and query parameters ("?...") are not |
| 247 | // allowed, either. |
| 248 | // |
| 249 | // +optional |
| 250 | URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"` |
| 251 | |
| 252 | // `service` is a reference to the service for this webhook. Either |
| 253 | // `service` or `url` must be specified. |
| 254 | // |
| 255 | // If the webhook is running within the cluster, then you should use `service`. |
| 256 | // |
| 257 | // Port 443 will be used if it is open, otherwise it is an error. |
| 258 | // |
| 259 | // +optional |
| 260 | Service *ServiceReference `json:"service" protobuf:"bytes,1,opt,name=service"` |
| 261 | |
| 262 | // `caBundle` is a PEM encoded CA bundle which will be used to validate |
| 263 | // the webhook's server certificate. |
| 264 | // Required. |
| 265 | CABundle []byte `json:"caBundle" protobuf:"bytes,2,opt,name=caBundle"` |
| 266 | } |
| 267 | |
| 268 | // ServiceReference holds a reference to Service.legacy.k8s.io |
| 269 | type ServiceReference struct { |
| 270 | // `namespace` is the namespace of the service. |
| 271 | // Required |
| 272 | Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"` |
| 273 | // `name` is the name of the service. |
| 274 | // Required |
| 275 | Name string `json:"name" protobuf:"bytes,2,opt,name=name"` |
| 276 | |
| 277 | // `path` is an optional URL path which will be sent in any request to |
| 278 | // this service. |
| 279 | // +optional |
| 280 | Path *string `json:"path,omitempty" protobuf:"bytes,3,opt,name=path"` |
| 281 | } |