mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-14 11:57:48 +00:00
feat: release v1.11.5 (#10211)
Signed-off-by: ShutingZhao <shuting@nirmata.com>
This commit is contained in:
shuting
GitHub
parent
dd5a495961
commit
c708a20600
24 changed files with 49450 additions and 63485 deletions
8
Makefile
8
Makefile
|
|
@ -36,7 +36,7 @@ TOOLS_DIR := $(PWD)/.tools
|
|||
KIND := $(TOOLS_DIR)/kind
|
||||
KIND_VERSION := v0.20.0
|
||||
CONTROLLER_GEN := $(TOOLS_DIR)/controller-gen
|
||||
CONTROLLER_GEN_VERSION := v0.12.0
|
||||
CONTROLLER_GEN_VERSION := v0.15.0
|
||||
CLIENT_GEN := $(TOOLS_DIR)/client-gen
|
||||
LISTER_GEN := $(TOOLS_DIR)/lister-gen
|
||||
INFORMER_GEN := $(TOOLS_DIR)/informer-gen
|
||||
|
|
@ -488,17 +488,17 @@ codegen-client-all: codegen-register codegen-defaulters codegen-applyconfigurati
|
|||
.PHONY: codegen-crds-kyverno
|
||||
codegen-crds-kyverno: $(CONTROLLER_GEN) ## Generate kyverno CRDs
|
||||
@echo Generate kyverno crds... >&2
|
||||
@$(CONTROLLER_GEN) crd paths=./api/kyverno/... crd:crdVersions=v1 output:dir=$(CRDS_PATH)
|
||||
@$(CONTROLLER_GEN) crd paths=./api/kyverno/... output:dir=$(CRDS_PATH)
|
||||
|
||||
.PHONY: codegen-crds-report
|
||||
codegen-crds-report: $(CONTROLLER_GEN) ## Generate policy reports CRDs
|
||||
@echo Generate policy reports crds... >&2
|
||||
@$(CONTROLLER_GEN) crd paths=./api/policyreport/... crd:crdVersions=v1 output:dir=$(CRDS_PATH)
|
||||
@$(CONTROLLER_GEN) crd paths=./api/policyreport/... output:dir=$(CRDS_PATH)
|
||||
|
||||
.PHONY: codegen-crds-cli
|
||||
codegen-crds-cli: $(CONTROLLER_GEN) ## Generate CLI CRDs
|
||||
@echo Generate cli crds... >&2
|
||||
@$(CONTROLLER_GEN) crd paths=./cmd/cli/kubectl-kyverno/apis/... crd:crdVersions=v1 output:dir=${PWD}/cmd/cli/kubectl-kyverno/config/crds
|
||||
@$(CONTROLLER_GEN) crd paths=./cmd/cli/kubectl-kyverno/apis/... output:dir=${PWD}/cmd/cli/kubectl-kyverno/config/crds
|
||||
|
||||
.PHONY: codegen-crds-all
|
||||
codegen-crds-all: codegen-crds-kyverno codegen-crds-report codegen-cli-crds ## Generate all CRDs
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
apiVersion: v2
|
||||
type: application
|
||||
name: kyverno-policies
|
||||
version: 3.1.4
|
||||
appVersion: v1.11.4
|
||||
version: 3.1.5
|
||||
appVersion: v1.11.5
|
||||
icon: https://github.com/kyverno/kyverno/raw/main/img/logo.png
|
||||
description: Kubernetes Pod Security Standards implemented as Kyverno policies
|
||||
keywords:
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
Kubernetes Pod Security Standards implemented as Kyverno policies
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
## About
|
||||
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
apiVersion: v2
|
||||
type: application
|
||||
name: kyverno
|
||||
version: 3.1.4
|
||||
appVersion: v1.11.4
|
||||
version: 3.1.5
|
||||
appVersion: v1.11.5
|
||||
icon: https://github.com/kyverno/kyverno/raw/main/img/logo.png
|
||||
description: Kubernetes Native Policy Management
|
||||
keywords:
|
||||
|
|
@ -36,5 +36,5 @@ dependencies:
|
|||
version: "0.0.0"
|
||||
condition: grafana.enabled
|
||||
- name: crds
|
||||
version: "3.1.4"
|
||||
version: "3.1.5"
|
||||
condition: crds.install
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
Kubernetes Native Policy Management
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
## About
|
||||
|
||||
|
|
@ -784,7 +784,7 @@ Kubernetes: `>=1.25.0-0`
|
|||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| | crds | 3.1.4 |
|
||||
| | crds | 3.1.5 |
|
||||
| | grafana | 0.0.0 |
|
||||
|
||||
## Maintainers
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
apiVersion: v2
|
||||
name: crds
|
||||
version: 3.1.4
|
||||
version: 3.1.5
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# crds
|
||||
|
||||
|
||||
|
||||
|
||||
## Values
|
||||
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
|
|||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.12.0
|
||||
controller-gen.kubebuilder.io/version: v0.15.0
|
||||
name: admissionreports.kyverno.io
|
||||
spec:
|
||||
group: kyverno.io
|
||||
|
|
@ -53,14 +53,19 @@ spec:
|
|||
description: AdmissionReport is the Schema for the AdmissionReports API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
|
|
@ -74,25 +79,33 @@ spec:
|
|||
description: API version of the referent.
|
||||
type: string
|
||||
blockOwnerDeletion:
|
||||
description: If true, AND if the owner has the "foregroundDeletion"
|
||||
finalizer, then the owner cannot be deleted from the key-value
|
||||
store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||
for how the garbage collector interacts with this field and
|
||||
enforces the foreground deletion. Defaults to false. To set
|
||||
this field, a user needs "delete" permission of the owner, otherwise
|
||||
422 (Unprocessable Entity) will be returned.
|
||||
description: |-
|
||||
If true, AND if the owner has the "foregroundDeletion" finalizer, then
|
||||
the owner cannot be deleted from the key-value store until this
|
||||
reference is removed.
|
||||
See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||
for how the garbage collector interacts with this field and enforces the foreground deletion.
|
||||
Defaults to false.
|
||||
To set this field, a user needs "delete" permission of the owner,
|
||||
otherwise 422 (Unprocessable Entity) will be returned.
|
||||
type: boolean
|
||||
controller:
|
||||
description: If true, this reference points to the managing controller.
|
||||
type: boolean
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
|
||||
type: string
|
||||
required:
|
||||
- apiVersion
|
||||
|
|
@ -124,35 +137,35 @@ spec:
|
|||
the policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: SubjectSelector is an optional label selector for
|
||||
checked Kubernetes resources. For example, a policy result
|
||||
may apply to all pods that match a label. Either a Subject
|
||||
or a SubjectSelector can be specified. If neither are provided,
|
||||
the result is assumed to be for the policy report scope.
|
||||
description: |-
|
||||
SubjectSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a SubjectSelector can be specified.
|
||||
If neither are provided, the result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector
|
||||
that contains values, a key, and an operator that relates
|
||||
the key and values.
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship
|
||||
to a set of values. Valid operators are In, NotIn,
|
||||
Exists and DoesNotExist.
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values.
|
||||
If the operator is In or NotIn, the values array
|
||||
must be non-empty. If the operator is Exists or
|
||||
DoesNotExist, the values array must be empty. This
|
||||
array is replaced during a strategic merge patch.
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
|
|
@ -164,11 +177,10 @@ spec:
|
|||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs.
|
||||
A single {key,value} in the matchLabels map is equivalent
|
||||
to an element of matchExpressions, whose key field is
|
||||
"key", the operator is "In", and the values array contains
|
||||
only "value". The requirements are ANDed.
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -176,66 +188,63 @@ spec:
|
|||
description: Subjects is an optional reference to the checked
|
||||
Kubernetes resources
|
||||
items:
|
||||
description: "ObjectReference contains enough information
|
||||
to let you inspect or modify the referred object. --- New
|
||||
uses of this type are discouraged because of difficulty
|
||||
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||
\ It includes many fields which are not generally honored.
|
||||
\ For instance, ResourceVersion and FieldPath are both very
|
||||
rarely valid in actual usage. 2. Invalid usage help. It
|
||||
is impossible to add specific help for individual usage.
|
||||
\ In most embedded usages, there are particular restrictions
|
||||
like, \"must refer only to types A and B\" or \"UID not
|
||||
honored\" or \"name must be restricted\". Those cannot be
|
||||
well described when embedded. 3. Inconsistent validation.
|
||||
\ Because the usages are different, the validation rules
|
||||
are different by usage, which makes it hard for users to
|
||||
predict what will happen. 4. The fields are both imprecise
|
||||
and overly precise. Kind is not a precise mapping to a
|
||||
URL. This can produce ambiguity during interpretation and
|
||||
require a REST mapping. In most cases, the dependency is
|
||||
on the group,resource tuple and the version of the actual
|
||||
struct is irrelevant. 5. We cannot easily change it. Because
|
||||
this type is embedded in many locations, updates to this
|
||||
type will affect numerous schemas. Don't make new APIs
|
||||
embed an underspecified API type they do not control. \n
|
||||
Instead of using this type, create a locally provided and
|
||||
used type that is well-focused on your reference. For example,
|
||||
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||
."
|
||||
description: |-
|
||||
ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
---
|
||||
New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
|
||||
1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
|
||||
2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular
|
||||
restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
|
||||
Those cannot be well described when embedded.
|
||||
3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
|
||||
4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||
during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple
|
||||
and the version of the actual struct is irrelevant.
|
||||
5. We cannot easily change it. Because this type is embedded in many locations, updates to this type
|
||||
will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control.
|
||||
|
||||
|
||||
Instead of using this type, create a locally provided and used type that is well-focused on your reference.
|
||||
For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead
|
||||
of an entire object, this string should contain a valid
|
||||
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container
|
||||
within a pod, this would take on a value like: "spec.containers{name}"
|
||||
(where "name" refers to the name of the container that
|
||||
triggered the event) or if no container name is specified
|
||||
"spec.containers[2]" (container with index 2 in this
|
||||
pod). This syntax is chosen only to have some well-defined
|
||||
way of referencing a part of an object. TODO: this design
|
||||
is not final and this field is subject to change in
|
||||
the future.'
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change in the future.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: 'Specific resourceVersion to which this reference
|
||||
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -274,17 +283,18 @@ spec:
|
|||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: Non-negative fractions of a second at nanosecond
|
||||
resolution. Negative second values with fractions must
|
||||
still have non-negative nanos values that count forward
|
||||
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||
field may be limited in precision depending on context.
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||
to 9999-12-31T23:59:59Z inclusive.
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
|
|||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.12.0
|
||||
controller-gen.kubebuilder.io/version: v0.15.0
|
||||
name: backgroundscanreports.kyverno.io
|
||||
spec:
|
||||
group: kyverno.io
|
||||
|
|
@ -57,14 +57,19 @@ spec:
|
|||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
|
|
@ -93,35 +98,35 @@ spec:
|
|||
the policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: SubjectSelector is an optional label selector for
|
||||
checked Kubernetes resources. For example, a policy result
|
||||
may apply to all pods that match a label. Either a Subject
|
||||
or a SubjectSelector can be specified. If neither are provided,
|
||||
the result is assumed to be for the policy report scope.
|
||||
description: |-
|
||||
SubjectSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a SubjectSelector can be specified.
|
||||
If neither are provided, the result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector
|
||||
that contains values, a key, and an operator that relates
|
||||
the key and values.
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship
|
||||
to a set of values. Valid operators are In, NotIn,
|
||||
Exists and DoesNotExist.
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values.
|
||||
If the operator is In or NotIn, the values array
|
||||
must be non-empty. If the operator is Exists or
|
||||
DoesNotExist, the values array must be empty. This
|
||||
array is replaced during a strategic merge patch.
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
|
|
@ -133,11 +138,10 @@ spec:
|
|||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs.
|
||||
A single {key,value} in the matchLabels map is equivalent
|
||||
to an element of matchExpressions, whose key field is
|
||||
"key", the operator is "In", and the values array contains
|
||||
only "value". The requirements are ANDed.
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -145,66 +149,63 @@ spec:
|
|||
description: Subjects is an optional reference to the checked
|
||||
Kubernetes resources
|
||||
items:
|
||||
description: "ObjectReference contains enough information
|
||||
to let you inspect or modify the referred object. --- New
|
||||
uses of this type are discouraged because of difficulty
|
||||
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||
\ It includes many fields which are not generally honored.
|
||||
\ For instance, ResourceVersion and FieldPath are both very
|
||||
rarely valid in actual usage. 2. Invalid usage help. It
|
||||
is impossible to add specific help for individual usage.
|
||||
\ In most embedded usages, there are particular restrictions
|
||||
like, \"must refer only to types A and B\" or \"UID not
|
||||
honored\" or \"name must be restricted\". Those cannot be
|
||||
well described when embedded. 3. Inconsistent validation.
|
||||
\ Because the usages are different, the validation rules
|
||||
are different by usage, which makes it hard for users to
|
||||
predict what will happen. 4. The fields are both imprecise
|
||||
and overly precise. Kind is not a precise mapping to a
|
||||
URL. This can produce ambiguity during interpretation and
|
||||
require a REST mapping. In most cases, the dependency is
|
||||
on the group,resource tuple and the version of the actual
|
||||
struct is irrelevant. 5. We cannot easily change it. Because
|
||||
this type is embedded in many locations, updates to this
|
||||
type will affect numerous schemas. Don't make new APIs
|
||||
embed an underspecified API type they do not control. \n
|
||||
Instead of using this type, create a locally provided and
|
||||
used type that is well-focused on your reference. For example,
|
||||
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||
."
|
||||
description: |-
|
||||
ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
---
|
||||
New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
|
||||
1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
|
||||
2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular
|
||||
restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
|
||||
Those cannot be well described when embedded.
|
||||
3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
|
||||
4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||
during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple
|
||||
and the version of the actual struct is irrelevant.
|
||||
5. We cannot easily change it. Because this type is embedded in many locations, updates to this type
|
||||
will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control.
|
||||
|
||||
|
||||
Instead of using this type, create a locally provided and used type that is well-focused on your reference.
|
||||
For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead
|
||||
of an entire object, this string should contain a valid
|
||||
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container
|
||||
within a pod, this would take on a value like: "spec.containers{name}"
|
||||
(where "name" refers to the name of the container that
|
||||
triggered the event) or if no container name is specified
|
||||
"spec.containers[2]" (container with index 2 in this
|
||||
pod). This syntax is chosen only to have some well-defined
|
||||
way of referencing a part of an object. TODO: this design
|
||||
is not final and this field is subject to change in
|
||||
the future.'
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change in the future.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: 'Specific resourceVersion to which this reference
|
||||
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -243,17 +244,18 @@ spec:
|
|||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: Non-negative fractions of a second at nanosecond
|
||||
resolution. Negative second values with fractions must
|
||||
still have non-negative nanos values that count forward
|
||||
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||
field may be limited in precision depending on context.
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||
to 9999-12-31T23:59:59Z inclusive.
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
|
|||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.12.0
|
||||
controller-gen.kubebuilder.io/version: v0.15.0
|
||||
name: clusteradmissionreports.kyverno.io
|
||||
spec:
|
||||
group: kyverno.io
|
||||
|
|
@ -54,14 +54,19 @@ spec:
|
|||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
|
|
@ -75,25 +80,33 @@ spec:
|
|||
description: API version of the referent.
|
||||
type: string
|
||||
blockOwnerDeletion:
|
||||
description: If true, AND if the owner has the "foregroundDeletion"
|
||||
finalizer, then the owner cannot be deleted from the key-value
|
||||
store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||
for how the garbage collector interacts with this field and
|
||||
enforces the foreground deletion. Defaults to false. To set
|
||||
this field, a user needs "delete" permission of the owner, otherwise
|
||||
422 (Unprocessable Entity) will be returned.
|
||||
description: |-
|
||||
If true, AND if the owner has the "foregroundDeletion" finalizer, then
|
||||
the owner cannot be deleted from the key-value store until this
|
||||
reference is removed.
|
||||
See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||
for how the garbage collector interacts with this field and enforces the foreground deletion.
|
||||
Defaults to false.
|
||||
To set this field, a user needs "delete" permission of the owner,
|
||||
otherwise 422 (Unprocessable Entity) will be returned.
|
||||
type: boolean
|
||||
controller:
|
||||
description: If true, this reference points to the managing controller.
|
||||
type: boolean
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
|
||||
type: string
|
||||
required:
|
||||
- apiVersion
|
||||
|
|
@ -125,35 +138,35 @@ spec:
|
|||
the policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: SubjectSelector is an optional label selector for
|
||||
checked Kubernetes resources. For example, a policy result
|
||||
may apply to all pods that match a label. Either a Subject
|
||||
or a SubjectSelector can be specified. If neither are provided,
|
||||
the result is assumed to be for the policy report scope.
|
||||
description: |-
|
||||
SubjectSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a SubjectSelector can be specified.
|
||||
If neither are provided, the result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector
|
||||
that contains values, a key, and an operator that relates
|
||||
the key and values.
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship
|
||||
to a set of values. Valid operators are In, NotIn,
|
||||
Exists and DoesNotExist.
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values.
|
||||
If the operator is In or NotIn, the values array
|
||||
must be non-empty. If the operator is Exists or
|
||||
DoesNotExist, the values array must be empty. This
|
||||
array is replaced during a strategic merge patch.
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
|
|
@ -165,11 +178,10 @@ spec:
|
|||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs.
|
||||
A single {key,value} in the matchLabels map is equivalent
|
||||
to an element of matchExpressions, whose key field is
|
||||
"key", the operator is "In", and the values array contains
|
||||
only "value". The requirements are ANDed.
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -177,66 +189,63 @@ spec:
|
|||
description: Subjects is an optional reference to the checked
|
||||
Kubernetes resources
|
||||
items:
|
||||
description: "ObjectReference contains enough information
|
||||
to let you inspect or modify the referred object. --- New
|
||||
uses of this type are discouraged because of difficulty
|
||||
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||
\ It includes many fields which are not generally honored.
|
||||
\ For instance, ResourceVersion and FieldPath are both very
|
||||
rarely valid in actual usage. 2. Invalid usage help. It
|
||||
is impossible to add specific help for individual usage.
|
||||
\ In most embedded usages, there are particular restrictions
|
||||
like, \"must refer only to types A and B\" or \"UID not
|
||||
honored\" or \"name must be restricted\". Those cannot be
|
||||
well described when embedded. 3. Inconsistent validation.
|
||||
\ Because the usages are different, the validation rules
|
||||
are different by usage, which makes it hard for users to
|
||||
predict what will happen. 4. The fields are both imprecise
|
||||
and overly precise. Kind is not a precise mapping to a
|
||||
URL. This can produce ambiguity during interpretation and
|
||||
require a REST mapping. In most cases, the dependency is
|
||||
on the group,resource tuple and the version of the actual
|
||||
struct is irrelevant. 5. We cannot easily change it. Because
|
||||
this type is embedded in many locations, updates to this
|
||||
type will affect numerous schemas. Don't make new APIs
|
||||
embed an underspecified API type they do not control. \n
|
||||
Instead of using this type, create a locally provided and
|
||||
used type that is well-focused on your reference. For example,
|
||||
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||
."
|
||||
description: |-
|
||||
ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
---
|
||||
New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
|
||||
1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
|
||||
2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular
|
||||
restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
|
||||
Those cannot be well described when embedded.
|
||||
3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
|
||||
4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||
during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple
|
||||
and the version of the actual struct is irrelevant.
|
||||
5. We cannot easily change it. Because this type is embedded in many locations, updates to this type
|
||||
will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control.
|
||||
|
||||
|
||||
Instead of using this type, create a locally provided and used type that is well-focused on your reference.
|
||||
For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead
|
||||
of an entire object, this string should contain a valid
|
||||
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container
|
||||
within a pod, this would take on a value like: "spec.containers{name}"
|
||||
(where "name" refers to the name of the container that
|
||||
triggered the event) or if no container name is specified
|
||||
"spec.containers[2]" (container with index 2 in this
|
||||
pod). This syntax is chosen only to have some well-defined
|
||||
way of referencing a part of an object. TODO: this design
|
||||
is not final and this field is subject to change in
|
||||
the future.'
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change in the future.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: 'Specific resourceVersion to which this reference
|
||||
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -275,17 +284,18 @@ spec:
|
|||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: Non-negative fractions of a second at nanosecond
|
||||
resolution. Negative second values with fractions must
|
||||
still have non-negative nanos values that count forward
|
||||
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||
field may be limited in precision depending on context.
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||
to 9999-12-31T23:59:59Z inclusive.
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
|
|||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.12.0
|
||||
controller-gen.kubebuilder.io/version: v0.15.0
|
||||
name: clusterbackgroundscanreports.kyverno.io
|
||||
spec:
|
||||
group: kyverno.io
|
||||
|
|
@ -57,14 +57,19 @@ spec:
|
|||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
|
|
@ -93,35 +98,35 @@ spec:
|
|||
the policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: SubjectSelector is an optional label selector for
|
||||
checked Kubernetes resources. For example, a policy result
|
||||
may apply to all pods that match a label. Either a Subject
|
||||
or a SubjectSelector can be specified. If neither are provided,
|
||||
the result is assumed to be for the policy report scope.
|
||||
description: |-
|
||||
SubjectSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a SubjectSelector can be specified.
|
||||
If neither are provided, the result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector
|
||||
that contains values, a key, and an operator that relates
|
||||
the key and values.
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship
|
||||
to a set of values. Valid operators are In, NotIn,
|
||||
Exists and DoesNotExist.
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values.
|
||||
If the operator is In or NotIn, the values array
|
||||
must be non-empty. If the operator is Exists or
|
||||
DoesNotExist, the values array must be empty. This
|
||||
array is replaced during a strategic merge patch.
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
|
|
@ -133,11 +138,10 @@ spec:
|
|||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs.
|
||||
A single {key,value} in the matchLabels map is equivalent
|
||||
to an element of matchExpressions, whose key field is
|
||||
"key", the operator is "In", and the values array contains
|
||||
only "value". The requirements are ANDed.
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -145,66 +149,63 @@ spec:
|
|||
description: Subjects is an optional reference to the checked
|
||||
Kubernetes resources
|
||||
items:
|
||||
description: "ObjectReference contains enough information
|
||||
to let you inspect or modify the referred object. --- New
|
||||
uses of this type are discouraged because of difficulty
|
||||
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||
\ It includes many fields which are not generally honored.
|
||||
\ For instance, ResourceVersion and FieldPath are both very
|
||||
rarely valid in actual usage. 2. Invalid usage help. It
|
||||
is impossible to add specific help for individual usage.
|
||||
\ In most embedded usages, there are particular restrictions
|
||||
like, \"must refer only to types A and B\" or \"UID not
|
||||
honored\" or \"name must be restricted\". Those cannot be
|
||||
well described when embedded. 3. Inconsistent validation.
|
||||
\ Because the usages are different, the validation rules
|
||||
are different by usage, which makes it hard for users to
|
||||
predict what will happen. 4. The fields are both imprecise
|
||||
and overly precise. Kind is not a precise mapping to a
|
||||
URL. This can produce ambiguity during interpretation and
|
||||
require a REST mapping. In most cases, the dependency is
|
||||
on the group,resource tuple and the version of the actual
|
||||
struct is irrelevant. 5. We cannot easily change it. Because
|
||||
this type is embedded in many locations, updates to this
|
||||
type will affect numerous schemas. Don't make new APIs
|
||||
embed an underspecified API type they do not control. \n
|
||||
Instead of using this type, create a locally provided and
|
||||
used type that is well-focused on your reference. For example,
|
||||
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||
."
|
||||
description: |-
|
||||
ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
---
|
||||
New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
|
||||
1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
|
||||
2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular
|
||||
restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
|
||||
Those cannot be well described when embedded.
|
||||
3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
|
||||
4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||
during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple
|
||||
and the version of the actual struct is irrelevant.
|
||||
5. We cannot easily change it. Because this type is embedded in many locations, updates to this type
|
||||
will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control.
|
||||
|
||||
|
||||
Instead of using this type, create a locally provided and used type that is well-focused on your reference.
|
||||
For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead
|
||||
of an entire object, this string should contain a valid
|
||||
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container
|
||||
within a pod, this would take on a value like: "spec.containers{name}"
|
||||
(where "name" refers to the name of the container that
|
||||
triggered the event) or if no container name is specified
|
||||
"spec.containers[2]" (container with index 2 in this
|
||||
pod). This syntax is chosen only to have some well-defined
|
||||
way of referencing a part of an object. TODO: this design
|
||||
is not final and this field is subject to change in
|
||||
the future.'
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change in the future.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: 'Specific resourceVersion to which this reference
|
||||
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -243,17 +244,18 @@ spec:
|
|||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: Non-negative fractions of a second at nanosecond
|
||||
resolution. Negative second values with fractions must
|
||||
still have non-negative nanos values that count forward
|
||||
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||
field may be limited in precision depending on context.
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||
to 9999-12-31T23:59:59Z inclusive.
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
|
|||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.12.0
|
||||
controller-gen.kubebuilder.io/version: v0.15.0
|
||||
name: updaterequests.kyverno.io
|
||||
spec:
|
||||
group: kyverno.io
|
||||
|
|
@ -47,14 +47,19 @@ spec:
|
|||
in background.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
|
|
@ -73,9 +78,9 @@ spec:
|
|||
for the admission request.
|
||||
properties:
|
||||
dryRun:
|
||||
description: DryRun indicates that modifications will
|
||||
definitely not be persisted for this request. Defaults
|
||||
to false.
|
||||
description: |-
|
||||
DryRun indicates that modifications will definitely not be persisted for this request.
|
||||
Defaults to false.
|
||||
type: boolean
|
||||
kind:
|
||||
description: Kind is the fully-qualified type of object
|
||||
|
|
@ -93,10 +98,9 @@ spec:
|
|||
- version
|
||||
type: object
|
||||
name:
|
||||
description: Name is the name of the object as presented
|
||||
in the request. On a CREATE operation, the client may
|
||||
omit name and rely on the server to generate the name. If
|
||||
that is the case, this field will contain an empty string.
|
||||
description: |-
|
||||
Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace is the namespace associated with
|
||||
|
|
@ -112,38 +116,33 @@ spec:
|
|||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
operation:
|
||||
description: Operation is the operation being performed.
|
||||
This may be different than the operation requested.
|
||||
e.g. a patch can result in either a CREATE or UPDATE
|
||||
Operation.
|
||||
description: |-
|
||||
Operation is the operation being performed. This may be different than the operation
|
||||
requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
type: string
|
||||
options:
|
||||
description: Options is the operation option structure
|
||||
of the operation being performed. e.g. `meta.k8s.io/v1.DeleteOptions`
|
||||
or `meta.k8s.io/v1.CreateOptions`. This may be different
|
||||
than the options the caller provided. e.g. for a patch
|
||||
request the performed Operation might be a CREATE, in
|
||||
which case the Options will a `meta.k8s.io/v1.CreateOptions`
|
||||
even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
description: |-
|
||||
Options is the operation option structure of the operation being performed.
|
||||
e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
different than the options the caller provided. e.g. for a patch request the performed
|
||||
Operation might be a CREATE, in which case the Options will a
|
||||
`meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
requestKind:
|
||||
description: "RequestKind is the fully-qualified type
|
||||
of the original API request (for example, v1.Pod or
|
||||
autoscaling.v1.Scale). If this is specified and differs
|
||||
from the value in \"kind\", an equivalent match and
|
||||
conversion was performed. \n For example, if deployments
|
||||
can be modified via apps/v1 and apps/v1beta1, and a
|
||||
webhook registered a rule of `apiGroups:[\"apps\"],
|
||||
apiVersions:[\"v1\"], resources: [\"deployments\"]`
|
||||
and `matchPolicy: Equivalent`, an API request to apps/v1beta1
|
||||
deployments would be converted and sent to the webhook
|
||||
with `kind: {group:\"apps\", version:\"v1\", kind:\"Deployment\"}`
|
||||
(matching the rule the webhook registered for), and
|
||||
`requestKind: {group:\"apps\", version:\"v1beta1\",
|
||||
kind:\"Deployment\"}` (indicating the kind of the original
|
||||
API request). \n See documentation for the \"matchPolicy\"
|
||||
field in the webhook configuration type for more details."
|
||||
description: |-
|
||||
RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
|
|
@ -157,22 +156,19 @@ spec:
|
|||
- version
|
||||
type: object
|
||||
requestResource:
|
||||
description: "RequestResource is the fully-qualified resource
|
||||
of the original API request (for example, v1.pods).
|
||||
If this is specified and differs from the value in \"resource\",
|
||||
an equivalent match and conversion was performed. \n
|
||||
For example, if deployments can be modified via apps/v1
|
||||
and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources:
|
||||
[\"deployments\"]` and `matchPolicy: Equivalent`, an
|
||||
API request to apps/v1beta1 deployments would be converted
|
||||
and sent to the webhook with `resource: {group:\"apps\",
|
||||
version:\"v1\", resource:\"deployments\"}` (matching
|
||||
the resource the webhook registered for), and `requestResource:
|
||||
{group:\"apps\", version:\"v1beta1\", resource:\"deployments\"}`
|
||||
(indicating the resource of the original API request).
|
||||
\n See documentation for the \"matchPolicy\" field in
|
||||
the webhook configuration type."
|
||||
description: |-
|
||||
RequestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
|
|
@ -186,12 +182,10 @@ spec:
|
|||
- version
|
||||
type: object
|
||||
requestSubResource:
|
||||
description: RequestSubResource is the name of the subresource
|
||||
of the original API request, if any (for example, "status"
|
||||
or "scale") If this is specified and differs from the
|
||||
value in "subResource", an equivalent match and conversion
|
||||
was performed. See documentation for the "matchPolicy"
|
||||
field in the webhook configuration type.
|
||||
description: |-
|
||||
RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
type: string
|
||||
resource:
|
||||
description: Resource is the fully-qualified resource
|
||||
|
|
@ -213,14 +207,11 @@ spec:
|
|||
if any (for example, "status" or "scale")
|
||||
type: string
|
||||
uid:
|
||||
description: UID is an identifier for the individual request/response.
|
||||
It allows us to distinguish instances of requests which
|
||||
are otherwise identical (parallel requests, requests
|
||||
when earlier requests did not modify etc) The UID is
|
||||
meant to track the round trip (request/response) between
|
||||
the KAS and the WebHook, not the user request. It is
|
||||
suitable for correlating log entries between the webhook
|
||||
and apiserver, for either auditing or debugging.
|
||||
description: |-
|
||||
UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
type: string
|
||||
userInfo:
|
||||
description: UserInfo is information about the requesting
|
||||
|
|
@ -243,10 +234,10 @@ spec:
|
|||
type: string
|
||||
type: array
|
||||
uid:
|
||||
description: A unique value that identifies this user
|
||||
across time. If this user is deleted and another
|
||||
user by the same name is added, they will have different
|
||||
UIDs.
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this
|
||||
|
|
@ -302,10 +293,10 @@ spec:
|
|||
type: string
|
||||
type: array
|
||||
uid:
|
||||
description: A unique value that identifies this user
|
||||
across time. If this user is deleted and another user
|
||||
by the same name is added, they will have different
|
||||
UIDs.
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this user
|
||||
|
|
@ -351,8 +342,9 @@ spec:
|
|||
description: Rule is the associate rule name of the current UR.
|
||||
type: string
|
||||
synchronize:
|
||||
description: Synchronize represents the sync behavior of the corresponding
|
||||
rule Optional. Defaults to "false" if not specified.
|
||||
description: |-
|
||||
Synchronize represents the sync behavior of the corresponding rule
|
||||
Optional. Defaults to "false" if not specified.
|
||||
type: boolean
|
||||
required:
|
||||
- context
|
||||
|
|
@ -365,8 +357,9 @@ spec:
|
|||
description: Status contains statistics related to update request.
|
||||
properties:
|
||||
generatedResources:
|
||||
description: This will track the resources that are updated by the
|
||||
generate Policy. Will be used during clean up resources.
|
||||
description: |-
|
||||
This will track the resources that are updated by the generate Policy.
|
||||
Will be used during clean up resources.
|
||||
items:
|
||||
properties:
|
||||
apiVersion:
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
|
|||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.12.0
|
||||
controller-gen.kubebuilder.io/version: v0.15.0
|
||||
name: clusterpolicyreports.wgpolicyk8s.io
|
||||
spec:
|
||||
group: wgpolicyk8s.io
|
||||
|
|
@ -48,14 +48,19 @@ spec:
|
|||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
|
|
@ -82,35 +87,35 @@ spec:
|
|||
policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: SubjectSelector is an optional label selector for checked
|
||||
Kubernetes resources. For example, a policy result may apply to
|
||||
all pods that match a label. Either a Subject or a SubjectSelector
|
||||
can be specified. If neither are provided, the result is assumed
|
||||
to be for the policy report scope.
|
||||
description: |-
|
||||
SubjectSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a SubjectSelector can be specified.
|
||||
If neither are provided, the result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector that
|
||||
contains values, a key, and an operator that relates the
|
||||
key and values.
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship
|
||||
to a set of values. Valid operators are In, NotIn, Exists
|
||||
and DoesNotExist.
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values. If the
|
||||
operator is In or NotIn, the values array must be non-empty.
|
||||
If the operator is Exists or DoesNotExist, the values
|
||||
array must be empty. This array is replaced during a
|
||||
strategic merge patch.
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
|
|
@ -122,11 +127,10 @@ spec:
|
|||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs. A single
|
||||
{key,value} in the matchLabels map is equivalent to an element
|
||||
of matchExpressions, whose key field is "key", the operator
|
||||
is "In", and the values array contains only "value". The requirements
|
||||
are ANDed.
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -134,63 +138,63 @@ spec:
|
|||
description: Subjects is an optional reference to the checked Kubernetes
|
||||
resources
|
||||
items:
|
||||
description: "ObjectReference contains enough information to let
|
||||
you inspect or modify the referred object. --- New uses of this
|
||||
type are discouraged because of difficulty describing its usage
|
||||
when embedded in APIs. 1. Ignored fields. It includes many
|
||||
fields which are not generally honored. For instance, ResourceVersion
|
||||
and FieldPath are both very rarely valid in actual usage. 2.
|
||||
Invalid usage help. It is impossible to add specific help for
|
||||
individual usage. In most embedded usages, there are particular
|
||||
restrictions like, \"must refer only to types A and B\" or \"UID
|
||||
not honored\" or \"name must be restricted\". Those cannot be
|
||||
well described when embedded. 3. Inconsistent validation. Because
|
||||
the usages are different, the validation rules are different
|
||||
by usage, which makes it hard for users to predict what will
|
||||
happen. 4. The fields are both imprecise and overly precise.
|
||||
\ Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||
during interpretation and require a REST mapping. In most cases,
|
||||
the dependency is on the group,resource tuple and the version
|
||||
of the actual struct is irrelevant. 5. We cannot easily change
|
||||
it. Because this type is embedded in many locations, updates
|
||||
to this type will affect numerous schemas. Don't make new APIs
|
||||
embed an underspecified API type they do not control. \n Instead
|
||||
of using this type, create a locally provided and used type
|
||||
that is well-focused on your reference. For example, ServiceReferences
|
||||
for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||
."
|
||||
description: |-
|
||||
ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
---
|
||||
New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
|
||||
1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
|
||||
2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular
|
||||
restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
|
||||
Those cannot be well described when embedded.
|
||||
3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
|
||||
4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||
during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple
|
||||
and the version of the actual struct is irrelevant.
|
||||
5. We cannot easily change it. Because this type is embedded in many locations, updates to this type
|
||||
will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control.
|
||||
|
||||
|
||||
Instead of using this type, create a locally provided and used type that is well-focused on your reference.
|
||||
For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead
|
||||
of an entire object, this string should contain a valid
|
||||
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within
|
||||
a pod, this would take on a value like: "spec.containers{name}"
|
||||
(where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]"
|
||||
(container with index 2 in this pod). This syntax is chosen
|
||||
only to have some well-defined way of referencing a part
|
||||
of an object. TODO: this design is not final and this field
|
||||
is subject to change in the future.'
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change in the future.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: 'Specific resourceVersion to which this reference
|
||||
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -228,15 +232,16 @@ spec:
|
|||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: Non-negative fractions of a second at nanosecond
|
||||
resolution. Negative second values with fractions must still
|
||||
have non-negative nanos values that count forward in time.
|
||||
Must be from 0 to 999,999,999 inclusive. This field may be
|
||||
limited in precision depending on context.
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: Represents seconds of UTC time since Unix epoch
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
|
|
@ -257,61 +262,71 @@ spec:
|
|||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead of an entire
|
||||
object, this string should contain a valid JSON/Go field access
|
||||
statement, such as desiredState.manifest.containers[2]. For example,
|
||||
if the object reference is to a container within a pod, this would
|
||||
take on a value like: "spec.containers{name}" (where "name" refers
|
||||
to the name of the container that triggered the event) or if no
|
||||
container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined
|
||||
way of referencing a part of an object. TODO: this design is not
|
||||
final and this field is subject to change in the future.'
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change in the future.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: 'Specific resourceVersion to which this reference is
|
||||
made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
scopeSelector:
|
||||
description: ScopeSelector is an optional selector for multiple scopes
|
||||
(e.g. Pods). Either one of, or none of, but not both of, Scope or ScopeSelector
|
||||
should be specified.
|
||||
description: |-
|
||||
ScopeSelector is an optional selector for multiple scopes (e.g. Pods).
|
||||
Either one of, or none of, but not both of, Scope or ScopeSelector should be specified.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector that contains
|
||||
values, a key, and an operator that relates the key and values.
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship to a set
|
||||
of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values. If the operator
|
||||
is In or NotIn, the values array must be non-empty. If the
|
||||
operator is Exists or DoesNotExist, the values array must
|
||||
be empty. This array is replaced during a strategic merge
|
||||
patch.
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
|
|
@ -323,10 +338,10 @@ spec:
|
|||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs. A single {key,value}
|
||||
in the matchLabels map is equivalent to an element of matchExpressions,
|
||||
whose key field is "key", the operator is "In", and the values array
|
||||
contains only "value". The requirements are ANDed.
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
|
|||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.12.0
|
||||
controller-gen.kubebuilder.io/version: v0.15.0
|
||||
name: policyreports.wgpolicyk8s.io
|
||||
spec:
|
||||
group: wgpolicyk8s.io
|
||||
|
|
@ -47,14 +47,19 @@ spec:
|
|||
description: PolicyReport is the Schema for the policyreports API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
|
|
@ -81,35 +86,35 @@ spec:
|
|||
policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: SubjectSelector is an optional label selector for checked
|
||||
Kubernetes resources. For example, a policy result may apply to
|
||||
all pods that match a label. Either a Subject or a SubjectSelector
|
||||
can be specified. If neither are provided, the result is assumed
|
||||
to be for the policy report scope.
|
||||
description: |-
|
||||
SubjectSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a SubjectSelector can be specified.
|
||||
If neither are provided, the result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector that
|
||||
contains values, a key, and an operator that relates the
|
||||
key and values.
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship
|
||||
to a set of values. Valid operators are In, NotIn, Exists
|
||||
and DoesNotExist.
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values. If the
|
||||
operator is In or NotIn, the values array must be non-empty.
|
||||
If the operator is Exists or DoesNotExist, the values
|
||||
array must be empty. This array is replaced during a
|
||||
strategic merge patch.
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
|
|
@ -121,11 +126,10 @@ spec:
|
|||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs. A single
|
||||
{key,value} in the matchLabels map is equivalent to an element
|
||||
of matchExpressions, whose key field is "key", the operator
|
||||
is "In", and the values array contains only "value". The requirements
|
||||
are ANDed.
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -133,63 +137,63 @@ spec:
|
|||
description: Subjects is an optional reference to the checked Kubernetes
|
||||
resources
|
||||
items:
|
||||
description: "ObjectReference contains enough information to let
|
||||
you inspect or modify the referred object. --- New uses of this
|
||||
type are discouraged because of difficulty describing its usage
|
||||
when embedded in APIs. 1. Ignored fields. It includes many
|
||||
fields which are not generally honored. For instance, ResourceVersion
|
||||
and FieldPath are both very rarely valid in actual usage. 2.
|
||||
Invalid usage help. It is impossible to add specific help for
|
||||
individual usage. In most embedded usages, there are particular
|
||||
restrictions like, \"must refer only to types A and B\" or \"UID
|
||||
not honored\" or \"name must be restricted\". Those cannot be
|
||||
well described when embedded. 3. Inconsistent validation. Because
|
||||
the usages are different, the validation rules are different
|
||||
by usage, which makes it hard for users to predict what will
|
||||
happen. 4. The fields are both imprecise and overly precise.
|
||||
\ Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||
during interpretation and require a REST mapping. In most cases,
|
||||
the dependency is on the group,resource tuple and the version
|
||||
of the actual struct is irrelevant. 5. We cannot easily change
|
||||
it. Because this type is embedded in many locations, updates
|
||||
to this type will affect numerous schemas. Don't make new APIs
|
||||
embed an underspecified API type they do not control. \n Instead
|
||||
of using this type, create a locally provided and used type
|
||||
that is well-focused on your reference. For example, ServiceReferences
|
||||
for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||
."
|
||||
description: |-
|
||||
ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
---
|
||||
New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
|
||||
1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
|
||||
2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular
|
||||
restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
|
||||
Those cannot be well described when embedded.
|
||||
3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
|
||||
4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||
during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple
|
||||
and the version of the actual struct is irrelevant.
|
||||
5. We cannot easily change it. Because this type is embedded in many locations, updates to this type
|
||||
will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control.
|
||||
|
||||
|
||||
Instead of using this type, create a locally provided and used type that is well-focused on your reference.
|
||||
For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead
|
||||
of an entire object, this string should contain a valid
|
||||
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within
|
||||
a pod, this would take on a value like: "spec.containers{name}"
|
||||
(where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]"
|
||||
(container with index 2 in this pod). This syntax is chosen
|
||||
only to have some well-defined way of referencing a part
|
||||
of an object. TODO: this design is not final and this field
|
||||
is subject to change in the future.'
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change in the future.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: 'Specific resourceVersion to which this reference
|
||||
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
@ -227,15 +231,16 @@ spec:
|
|||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: Non-negative fractions of a second at nanosecond
|
||||
resolution. Negative second values with fractions must still
|
||||
have non-negative nanos values that count forward in time.
|
||||
Must be from 0 to 999,999,999 inclusive. This field may be
|
||||
limited in precision depending on context.
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: Represents seconds of UTC time since Unix epoch
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
|
|
@ -256,61 +261,71 @@ spec:
|
|||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead of an entire
|
||||
object, this string should contain a valid JSON/Go field access
|
||||
statement, such as desiredState.manifest.containers[2]. For example,
|
||||
if the object reference is to a container within a pod, this would
|
||||
take on a value like: "spec.containers{name}" (where "name" refers
|
||||
to the name of the container that triggered the event) or if no
|
||||
container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined
|
||||
way of referencing a part of an object. TODO: this design is not
|
||||
final and this field is subject to change in the future.'
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change in the future.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: 'Specific resourceVersion to which this reference is
|
||||
made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
scopeSelector:
|
||||
description: ScopeSelector is an optional selector for multiple scopes
|
||||
(e.g. Pods). Either one of, or none of, but not both of, Scope or ScopeSelector
|
||||
should be specified.
|
||||
description: |-
|
||||
ScopeSelector is an optional selector for multiple scopes (e.g. Pods).
|
||||
Either one of, or none of, but not both of, Scope or ScopeSelector should be specified.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector that contains
|
||||
values, a key, and an operator that relates the key and values.
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship to a set
|
||||
of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values. If the operator
|
||||
is In or NotIn, the values array must be non-empty. If the
|
||||
operator is Exists or DoesNotExist, the values array must
|
||||
be empty. This array is replaced during a strategic merge
|
||||
patch.
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
|
|
@ -322,10 +337,10 @@ spec:
|
|||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs. A single {key,value}
|
||||
in the matchLabels map is equivalent to an element of matchExpressions,
|
||||
whose key field is "key", the operator is "In", and the values array
|
||||
contains only "value". The requirements are ANDed.
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
Loading…
Reference in a new issue