mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-14 11:57:48 +00:00
fix(codegen): missing crd version (#10852)
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
This commit is contained in:
Khaled Emara
GitHub
parent
5203809b73
commit
95bf469fd5
4 changed files with 1159 additions and 1 deletions
2
Makefile
2
Makefile
|
|
@ -501,7 +501,7 @@ codegen-client-all: codegen-client-wrappers
|
|||
codegen-crds-kyverno: ## Generate kyverno CRDs
|
||||
@echo Generate kyverno crds... >&2
|
||||
@rm -rf $(CRDS_PATH)/kyverno && mkdir -p $(CRDS_PATH)/kyverno
|
||||
@go run ./hack/controller-gen -- paths=./api/kyverno/v1/... paths=./api/kyverno/v2/... paths=./api/kyverno/v2alpha1/... paths=./api/kyverno/v2beta1/... crd:crdVersions=v1,ignoreUnexportedFields=true,generateEmbeddedObjectMeta=false output:dir=$(CRDS_PATH)/kyverno
|
||||
@go run ./hack/controller-gen -- paths=./api/kyverno/v1/... paths=./api/kyverno/v1beta1/... paths=./api/kyverno/v2/... paths=./api/kyverno/v2alpha1/... paths=./api/kyverno/v2beta1/... crd:crdVersions=v1,ignoreUnexportedFields=true,generateEmbeddedObjectMeta=false output:dir=$(CRDS_PATH)/kyverno
|
||||
|
||||
.PHONY: codegen-crds-policyreport
|
||||
codegen-crds-policyreport: ## Generate policy reports CRDs
|
||||
|
|
|
|||
|
|
@ -24,6 +24,392 @@ spec:
|
|||
singular: updaterequest
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.policy
|
||||
name: Policy
|
||||
type: string
|
||||
- jsonPath: .spec.rule
|
||||
name: Rule
|
||||
type: string
|
||||
- jsonPath: .spec.requestType
|
||||
name: RuleType
|
||||
type: string
|
||||
- jsonPath: .spec.resource.kind
|
||||
name: ResourceKind
|
||||
type: string
|
||||
- jsonPath: .spec.resource.name
|
||||
name: ResourceName
|
||||
type: string
|
||||
- jsonPath: .spec.resource.namespace
|
||||
name: ResourceNamespace
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
deprecated: true
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: UpdateRequest is a request to process mutate and generate rules
|
||||
in background.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ResourceSpec is the information to identify the trigger resource.
|
||||
properties:
|
||||
context:
|
||||
description: Context ...
|
||||
properties:
|
||||
admissionRequestInfo:
|
||||
description: AdmissionRequestInfoObject stores the admission request
|
||||
and operation details
|
||||
properties:
|
||||
admissionRequest:
|
||||
description: AdmissionRequest describes the admission.Attributes
|
||||
for the admission request.
|
||||
properties:
|
||||
dryRun:
|
||||
description: |-
|
||||
DryRun indicates that modifications will definitely not be persisted for this request.
|
||||
Defaults to false.
|
||||
type: boolean
|
||||
kind:
|
||||
description: Kind is the fully-qualified type of object
|
||||
being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace is the namespace associated with
|
||||
the request (if any).
|
||||
type: string
|
||||
object:
|
||||
description: Object is the object from the incoming request.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
oldObject:
|
||||
description: OldObject is the existing object. Only populated
|
||||
for DELETE and UPDATE requests.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
operation:
|
||||
description: |-
|
||||
Operation is the operation being performed. This may be different than the operation
|
||||
requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
type: string
|
||||
options:
|
||||
description: |-
|
||||
Options is the operation option structure of the operation being performed.
|
||||
e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
different than the options the caller provided. e.g. for a patch request the performed
|
||||
Operation might be a CREATE, in which case the Options will a
|
||||
`meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
requestKind:
|
||||
description: |-
|
||||
RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
requestResource:
|
||||
description: |-
|
||||
RequestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
requestSubResource:
|
||||
description: |-
|
||||
RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
type: string
|
||||
resource:
|
||||
description: Resource is the fully-qualified resource
|
||||
being requested (for example, v1.pods)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
subResource:
|
||||
description: SubResource is the subresource being requested,
|
||||
if any (for example, "status" or "scale")
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
type: string
|
||||
userInfo:
|
||||
description: UserInfo is information about the requesting
|
||||
user
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by
|
||||
the authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part
|
||||
of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this
|
||||
user among all active users.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- kind
|
||||
- operation
|
||||
- resource
|
||||
- uid
|
||||
- userInfo
|
||||
type: object
|
||||
operation:
|
||||
description: Operation is the type of resource operation being
|
||||
checked for admission control
|
||||
type: string
|
||||
type: object
|
||||
userInfo:
|
||||
description: RequestInfo contains permission info carried in an
|
||||
admission request.
|
||||
properties:
|
||||
clusterRoles:
|
||||
description: ClusterRoles is a list of possible clusterRoles
|
||||
send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
roles:
|
||||
description: Roles is a list of possible role send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
userInfo:
|
||||
description: UserInfo is the userInfo carried in the admission
|
||||
request.
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by the
|
||||
authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this user
|
||||
among all active users.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
deleteDownstream:
|
||||
description: DeleteDownstream represents whether the downstream needs
|
||||
to be deleted.
|
||||
type: boolean
|
||||
policy:
|
||||
description: Specifies the name of the policy.
|
||||
type: string
|
||||
requestType:
|
||||
description: Type represents request type for background processing
|
||||
enum:
|
||||
- mutate
|
||||
- generate
|
||||
type: string
|
||||
resource:
|
||||
description: ResourceSpec is the information to identify the trigger
|
||||
resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
rule:
|
||||
description: Rule is the associate rule name of the current UR.
|
||||
type: string
|
||||
synchronize:
|
||||
description: |-
|
||||
Synchronize represents the sync behavior of the corresponding rule
|
||||
Optional. Defaults to "false" if not specified.
|
||||
type: boolean
|
||||
required:
|
||||
- context
|
||||
- deleteDownstream
|
||||
- policy
|
||||
- resource
|
||||
- rule
|
||||
type: object
|
||||
status:
|
||||
description: Status contains statistics related to update request.
|
||||
properties:
|
||||
generatedResources:
|
||||
description: |-
|
||||
This will track the resources that are updated by the generate Policy.
|
||||
Will be used during clean up resources.
|
||||
items:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
handler:
|
||||
description: Deprecated
|
||||
type: string
|
||||
message:
|
||||
description: Specifies request status message.
|
||||
type: string
|
||||
retryCount:
|
||||
type: integer
|
||||
state:
|
||||
description: State represents state of the update request.
|
||||
type: string
|
||||
required:
|
||||
- state
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources:
|
||||
status: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.policy
|
||||
name: Policy
|
||||
|
|
|
|||
|
|
@ -18,6 +18,392 @@ spec:
|
|||
singular: updaterequest
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.policy
|
||||
name: Policy
|
||||
type: string
|
||||
- jsonPath: .spec.rule
|
||||
name: Rule
|
||||
type: string
|
||||
- jsonPath: .spec.requestType
|
||||
name: RuleType
|
||||
type: string
|
||||
- jsonPath: .spec.resource.kind
|
||||
name: ResourceKind
|
||||
type: string
|
||||
- jsonPath: .spec.resource.name
|
||||
name: ResourceName
|
||||
type: string
|
||||
- jsonPath: .spec.resource.namespace
|
||||
name: ResourceNamespace
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
deprecated: true
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: UpdateRequest is a request to process mutate and generate rules
|
||||
in background.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ResourceSpec is the information to identify the trigger resource.
|
||||
properties:
|
||||
context:
|
||||
description: Context ...
|
||||
properties:
|
||||
admissionRequestInfo:
|
||||
description: AdmissionRequestInfoObject stores the admission request
|
||||
and operation details
|
||||
properties:
|
||||
admissionRequest:
|
||||
description: AdmissionRequest describes the admission.Attributes
|
||||
for the admission request.
|
||||
properties:
|
||||
dryRun:
|
||||
description: |-
|
||||
DryRun indicates that modifications will definitely not be persisted for this request.
|
||||
Defaults to false.
|
||||
type: boolean
|
||||
kind:
|
||||
description: Kind is the fully-qualified type of object
|
||||
being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace is the namespace associated with
|
||||
the request (if any).
|
||||
type: string
|
||||
object:
|
||||
description: Object is the object from the incoming request.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
oldObject:
|
||||
description: OldObject is the existing object. Only populated
|
||||
for DELETE and UPDATE requests.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
operation:
|
||||
description: |-
|
||||
Operation is the operation being performed. This may be different than the operation
|
||||
requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
type: string
|
||||
options:
|
||||
description: |-
|
||||
Options is the operation option structure of the operation being performed.
|
||||
e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
different than the options the caller provided. e.g. for a patch request the performed
|
||||
Operation might be a CREATE, in which case the Options will a
|
||||
`meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
requestKind:
|
||||
description: |-
|
||||
RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
requestResource:
|
||||
description: |-
|
||||
RequestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
requestSubResource:
|
||||
description: |-
|
||||
RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
type: string
|
||||
resource:
|
||||
description: Resource is the fully-qualified resource
|
||||
being requested (for example, v1.pods)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
subResource:
|
||||
description: SubResource is the subresource being requested,
|
||||
if any (for example, "status" or "scale")
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
type: string
|
||||
userInfo:
|
||||
description: UserInfo is information about the requesting
|
||||
user
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by
|
||||
the authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part
|
||||
of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this
|
||||
user among all active users.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- kind
|
||||
- operation
|
||||
- resource
|
||||
- uid
|
||||
- userInfo
|
||||
type: object
|
||||
operation:
|
||||
description: Operation is the type of resource operation being
|
||||
checked for admission control
|
||||
type: string
|
||||
type: object
|
||||
userInfo:
|
||||
description: RequestInfo contains permission info carried in an
|
||||
admission request.
|
||||
properties:
|
||||
clusterRoles:
|
||||
description: ClusterRoles is a list of possible clusterRoles
|
||||
send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
roles:
|
||||
description: Roles is a list of possible role send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
userInfo:
|
||||
description: UserInfo is the userInfo carried in the admission
|
||||
request.
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by the
|
||||
authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this user
|
||||
among all active users.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
deleteDownstream:
|
||||
description: DeleteDownstream represents whether the downstream needs
|
||||
to be deleted.
|
||||
type: boolean
|
||||
policy:
|
||||
description: Specifies the name of the policy.
|
||||
type: string
|
||||
requestType:
|
||||
description: Type represents request type for background processing
|
||||
enum:
|
||||
- mutate
|
||||
- generate
|
||||
type: string
|
||||
resource:
|
||||
description: ResourceSpec is the information to identify the trigger
|
||||
resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
rule:
|
||||
description: Rule is the associate rule name of the current UR.
|
||||
type: string
|
||||
synchronize:
|
||||
description: |-
|
||||
Synchronize represents the sync behavior of the corresponding rule
|
||||
Optional. Defaults to "false" if not specified.
|
||||
type: boolean
|
||||
required:
|
||||
- context
|
||||
- deleteDownstream
|
||||
- policy
|
||||
- resource
|
||||
- rule
|
||||
type: object
|
||||
status:
|
||||
description: Status contains statistics related to update request.
|
||||
properties:
|
||||
generatedResources:
|
||||
description: |-
|
||||
This will track the resources that are updated by the generate Policy.
|
||||
Will be used during clean up resources.
|
||||
items:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
handler:
|
||||
description: Deprecated
|
||||
type: string
|
||||
message:
|
||||
description: Specifies request status message.
|
||||
type: string
|
||||
retryCount:
|
||||
type: integer
|
||||
state:
|
||||
description: State represents state of the update request.
|
||||
type: string
|
||||
required:
|
||||
- state
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources:
|
||||
status: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.policy
|
||||
name: Policy
|
||||
|
|
|
|||
|
|
@ -41379,6 +41379,392 @@ spec:
|
|||
singular: updaterequest
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.policy
|
||||
name: Policy
|
||||
type: string
|
||||
- jsonPath: .spec.rule
|
||||
name: Rule
|
||||
type: string
|
||||
- jsonPath: .spec.requestType
|
||||
name: RuleType
|
||||
type: string
|
||||
- jsonPath: .spec.resource.kind
|
||||
name: ResourceKind
|
||||
type: string
|
||||
- jsonPath: .spec.resource.name
|
||||
name: ResourceName
|
||||
type: string
|
||||
- jsonPath: .spec.resource.namespace
|
||||
name: ResourceNamespace
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
deprecated: true
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: UpdateRequest is a request to process mutate and generate rules
|
||||
in background.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ResourceSpec is the information to identify the trigger resource.
|
||||
properties:
|
||||
context:
|
||||
description: Context ...
|
||||
properties:
|
||||
admissionRequestInfo:
|
||||
description: AdmissionRequestInfoObject stores the admission request
|
||||
and operation details
|
||||
properties:
|
||||
admissionRequest:
|
||||
description: AdmissionRequest describes the admission.Attributes
|
||||
for the admission request.
|
||||
properties:
|
||||
dryRun:
|
||||
description: |-
|
||||
DryRun indicates that modifications will definitely not be persisted for this request.
|
||||
Defaults to false.
|
||||
type: boolean
|
||||
kind:
|
||||
description: Kind is the fully-qualified type of object
|
||||
being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace is the namespace associated with
|
||||
the request (if any).
|
||||
type: string
|
||||
object:
|
||||
description: Object is the object from the incoming request.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
oldObject:
|
||||
description: OldObject is the existing object. Only populated
|
||||
for DELETE and UPDATE requests.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
operation:
|
||||
description: |-
|
||||
Operation is the operation being performed. This may be different than the operation
|
||||
requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
type: string
|
||||
options:
|
||||
description: |-
|
||||
Options is the operation option structure of the operation being performed.
|
||||
e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
different than the options the caller provided. e.g. for a patch request the performed
|
||||
Operation might be a CREATE, in which case the Options will a
|
||||
`meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
requestKind:
|
||||
description: |-
|
||||
RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
requestResource:
|
||||
description: |-
|
||||
RequestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
requestSubResource:
|
||||
description: |-
|
||||
RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
type: string
|
||||
resource:
|
||||
description: Resource is the fully-qualified resource
|
||||
being requested (for example, v1.pods)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
subResource:
|
||||
description: SubResource is the subresource being requested,
|
||||
if any (for example, "status" or "scale")
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
type: string
|
||||
userInfo:
|
||||
description: UserInfo is information about the requesting
|
||||
user
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by
|
||||
the authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part
|
||||
of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this
|
||||
user among all active users.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- kind
|
||||
- operation
|
||||
- resource
|
||||
- uid
|
||||
- userInfo
|
||||
type: object
|
||||
operation:
|
||||
description: Operation is the type of resource operation being
|
||||
checked for admission control
|
||||
type: string
|
||||
type: object
|
||||
userInfo:
|
||||
description: RequestInfo contains permission info carried in an
|
||||
admission request.
|
||||
properties:
|
||||
clusterRoles:
|
||||
description: ClusterRoles is a list of possible clusterRoles
|
||||
send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
roles:
|
||||
description: Roles is a list of possible role send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
userInfo:
|
||||
description: UserInfo is the userInfo carried in the admission
|
||||
request.
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by the
|
||||
authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this user
|
||||
among all active users.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
deleteDownstream:
|
||||
description: DeleteDownstream represents whether the downstream needs
|
||||
to be deleted.
|
||||
type: boolean
|
||||
policy:
|
||||
description: Specifies the name of the policy.
|
||||
type: string
|
||||
requestType:
|
||||
description: Type represents request type for background processing
|
||||
enum:
|
||||
- mutate
|
||||
- generate
|
||||
type: string
|
||||
resource:
|
||||
description: ResourceSpec is the information to identify the trigger
|
||||
resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
rule:
|
||||
description: Rule is the associate rule name of the current UR.
|
||||
type: string
|
||||
synchronize:
|
||||
description: |-
|
||||
Synchronize represents the sync behavior of the corresponding rule
|
||||
Optional. Defaults to "false" if not specified.
|
||||
type: boolean
|
||||
required:
|
||||
- context
|
||||
- deleteDownstream
|
||||
- policy
|
||||
- resource
|
||||
- rule
|
||||
type: object
|
||||
status:
|
||||
description: Status contains statistics related to update request.
|
||||
properties:
|
||||
generatedResources:
|
||||
description: |-
|
||||
This will track the resources that are updated by the generate Policy.
|
||||
Will be used during clean up resources.
|
||||
items:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
handler:
|
||||
description: Deprecated
|
||||
type: string
|
||||
message:
|
||||
description: Specifies request status message.
|
||||
type: string
|
||||
retryCount:
|
||||
type: integer
|
||||
state:
|
||||
description: State represents state of the update request.
|
||||
type: string
|
||||
required:
|
||||
- state
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources:
|
||||
status: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.policy
|
||||
name: Policy
|
||||
|
|
|
|||
Loading…
Reference in a new issue