package v1

type ApplyConfigurationApplyConfiguration struct {
	// expression will be evaluated by CEL to create an apply configuration.
	// ref: https://github.com/google/cel-spec
	//
	// Apply configurations are declared in CEL using object initialization. For example, this CEL expression
	// returns an apply configuration to set a single field:
	//
	// Object{
	// spec: Object.spec{
	// serviceAccountName: "example"
	// }
	// }
	//
	// Apply configurations may not modify atomic structs, maps or arrays due to the risk of accidental deletion of
	// values not included in the apply configuration.
	//
	// CEL expressions have access to the object types needed to create apply configurations:
	//
	// - 'Object' - CEL type of the resource object.
	// - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec')
	// - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')
	//
	// CEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:
	//
	// - 'object' - The object from the incoming request. The value is null for DELETE requests.
	// - 'oldObject' - The existing object. The value is null for CREATE requests.
	// - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
	// - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
	// - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.
	// - 'variables' - Map of composited variables, from its name to its lazily evaluated value.
	// For example, a variable named 'foo' can be accessed as 'variables.foo'.
	// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
	// See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
	// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
	// request resource.
	//
	// The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the
	// object. No other metadata properties are accessible.
	//
	// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
	// Required.
	Expression *string `json:"expression,omitempty"`
}

ApplyConfigurationApplyConfiguration represents a declarative configuration of the ApplyConfiguration type for use with apply.

ApplyConfiguration defines the desired configuration values of an object.

func ApplyConfiguration ¶

func ApplyConfiguration() *ApplyConfigurationApplyConfiguration

ApplyConfigurationApplyConfiguration constructs a declarative configuration of the ApplyConfiguration type for use with apply.

func (*ApplyConfigurationApplyConfiguration) WithExpression ¶

func (b *ApplyConfigurationApplyConfiguration) WithExpression(value string) *ApplyConfigurationApplyConfiguration

WithExpression sets the Expression field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Expression field is set to the value of the last call.

type AuditAnnotationApplyConfiguration ¶

type AuditAnnotationApplyConfiguration struct {
	// key specifies the audit annotation key. The audit annotation keys of
	// a ValidatingAdmissionPolicy must be unique. The key must be a qualified
	// name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
	//
	// The key is combined with the resource name of the
	// ValidatingAdmissionPolicy to construct an audit annotation key:
	// "{ValidatingAdmissionPolicy name}/{key}".
	//
	// If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy
	// and the same audit annotation key, the annotation key will be identical.
	// In this case, the first annotation written with the key will be included
	// in the audit event and all subsequent annotations with the same key
	// will be discarded.
	//
	// Required.
	Key *string `json:"key,omitempty"`
	// valueExpression represents the expression which is evaluated by CEL to
	// produce an audit annotation value. The expression must evaluate to either
	// a string or null value. If the expression evaluates to a string, the
	// audit annotation is included with the string value. If the expression
	// evaluates to null or empty string the audit annotation will be omitted.
	// The valueExpression may be no longer than 5kb in length.
	// If the result of the valueExpression is more than 10kb in length, it
	// will be truncated to 10kb.
	//
	// If multiple ValidatingAdmissionPolicyBinding resources match an
	// API request, then the valueExpression will be evaluated for
	// each binding. All unique values produced by the valueExpressions
	// will be joined together in a comma-separated list.
	//
	// Required.
	ValueExpression *string `json:"valueExpression,omitempty"`
}

AuditAnnotationApplyConfiguration represents a declarative configuration of the AuditAnnotation type for use with apply.

AuditAnnotation describes how to produce an audit annotation for an API request.

func AuditAnnotation ¶

func AuditAnnotation() *AuditAnnotationApplyConfiguration

AuditAnnotationApplyConfiguration constructs a declarative configuration of the AuditAnnotation type for use with apply.

func (*AuditAnnotationApplyConfiguration) WithKey ¶

func (b *AuditAnnotationApplyConfiguration) WithKey(value string) *AuditAnnotationApplyConfiguration

WithKey sets the Key field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Key field is set to the value of the last call.

func (*AuditAnnotationApplyConfiguration) WithValueExpression ¶

func (b *AuditAnnotationApplyConfiguration) WithValueExpression(value string) *AuditAnnotationApplyConfiguration

WithValueExpression sets the ValueExpression field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ValueExpression field is set to the value of the last call.

type ExpressionWarningApplyConfiguration ¶

type ExpressionWarningApplyConfiguration struct {
	// fieldRef is the path to the field that refers to the expression.
	// For example, the reference to the expression of the first item of
	// validations is "spec.validations[0].expression"
	FieldRef *string `json:"fieldRef,omitempty"`
	// warning contains the content of type checking information in a human-readable form.
	// Each line of the warning contains the type that the expression is checked
	// against, followed by the type check error from the compiler.
	Warning *string `json:"warning,omitempty"`
}

ExpressionWarningApplyConfiguration represents a declarative configuration of the ExpressionWarning type for use with apply.

ExpressionWarning is a warning information that targets a specific expression.

func ExpressionWarning ¶

func ExpressionWarning() *ExpressionWarningApplyConfiguration

ExpressionWarningApplyConfiguration constructs a declarative configuration of the ExpressionWarning type for use with apply.

func (*ExpressionWarningApplyConfiguration) WithFieldRef ¶

func (b *ExpressionWarningApplyConfiguration) WithFieldRef(value string) *ExpressionWarningApplyConfiguration

WithFieldRef sets the FieldRef field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the FieldRef field is set to the value of the last call.

func (*ExpressionWarningApplyConfiguration) WithWarning ¶

func (b *ExpressionWarningApplyConfiguration) WithWarning(value string) *ExpressionWarningApplyConfiguration

WithWarning sets the Warning field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Warning field is set to the value of the last call.

type JSONPatchApplyConfiguration ¶

type JSONPatchApplyConfiguration struct {
	// expression will be evaluated by CEL to create a [JSON patch](https://jsonpatch.com/).
	// ref: https://github.com/google/cel-spec
	//
	// expression must return an array of JSONPatch values.
	//
	// For example, this CEL expression returns a JSON patch to conditionally modify a value:
	//
	// [
	// JSONPatch{op: "test", path: "/spec/example", value: "Red"},
	// JSONPatch{op: "replace", path: "/spec/example", value: "Green"}
	// ]
	//
	// To define an object for the patch value, use Object types. For example:
	//
	// [
	// JSONPatch{
	// op: "add",
	// path: "/spec/selector",
	// value: Object.spec.selector{matchLabels: {"environment": "test"}}
	// }
	// ]
	//
	// To use strings containing '/' and '~' as JSONPatch path keys, use "jsonpatch.escapeKey". For example:
	//
	// [
	// JSONPatch{
	// op: "add",
	// path: "/metadata/labels/" + jsonpatch.escapeKey("example.com/environment"),
	// value: "test"
	// },
	// ]
	//
	// CEL expressions have access to the types needed to create JSON patches and objects:
	//
	// - 'JSONPatch' - CEL type of JSON Patch operations. JSONPatch has the fields 'op', 'from', 'path' and 'value'.
	// See [JSON patch](https://jsonpatch.com/) for more details. The 'value' field may be set to any of: string,
	// integer, array, map or object.  If set, the 'path' and 'from' fields must be set to a
	// [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) string, where the 'jsonpatch.escapeKey()' CEL
	// function may be used to escape path keys containing '/' and '~'.
	// - 'Object' - CEL type of the resource object.
	// - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec')
	// - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')
	//
	// CEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:
	//
	// - 'object' - The object from the incoming request. The value is null for DELETE requests.
	// - 'oldObject' - The existing object. The value is null for CREATE requests.
	// - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
	// - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
	// - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.
	// - 'variables' - Map of composited variables, from its name to its lazily evaluated value.
	// For example, a variable named 'foo' can be accessed as 'variables.foo'.
	// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
	// See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
	// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
	// request resource.
	//
	// CEL expressions have access to [Kubernetes CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)
	// as well as:
	//
	// - 'jsonpatch.escapeKey' - Performs JSONPatch key escaping. '~' and  '/' are escaped as '~0' and `~1' respectively).
	//
	// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
	// Required.
	Expression *string `json:"expression,omitempty"`
}

JSONPatchApplyConfiguration represents a declarative configuration of the JSONPatch type for use with apply.

JSONPatch defines a JSON Patch.

func JSONPatch ¶

func JSONPatch() *JSONPatchApplyConfiguration

JSONPatchApplyConfiguration constructs a declarative configuration of the JSONPatch type for use with apply.

func (*JSONPatchApplyConfiguration) WithExpression ¶

func (b *JSONPatchApplyConfiguration) WithExpression(value string) *JSONPatchApplyConfiguration

type MatchConditionApplyConfiguration ¶

type MatchConditionApplyConfiguration struct {
	// name is an identifier for this match condition, used for strategic merging of MatchConditions,
	// as well as providing an identifier for logging purposes. A good name should be descriptive of
	// the associated expression.
	// Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
	// must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or
	// '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
	// optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
	//
	// Required.
	Name *string `json:"name,omitempty"`
	// expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
	// CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
	//
	// 'object' - The object from the incoming request. The value is null for DELETE requests.
	// 'oldObject' - The existing object. The value is null for CREATE requests.
	// 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
	// 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
	// See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
	// 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
	// request resource.
	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
	//
	// Required.
	Expression *string `json:"expression,omitempty"`
}

MatchConditionApplyConfiguration represents a declarative configuration of the MatchCondition type for use with apply.

MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.

func MatchCondition ¶

func MatchCondition() *MatchConditionApplyConfiguration

MatchConditionApplyConfiguration constructs a declarative configuration of the MatchCondition type for use with apply.

func (*MatchConditionApplyConfiguration) WithExpression ¶

func (b *MatchConditionApplyConfiguration) WithExpression(value string) *MatchConditionApplyConfiguration

func (*MatchConditionApplyConfiguration) WithName ¶

func (b *MatchConditionApplyConfiguration) WithName(value string) *MatchConditionApplyConfiguration

WithName sets the Name field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Name field is set to the value of the last call.

type MatchResourcesApplyConfiguration ¶

type MatchResourcesApplyConfiguration struct {
	// namespaceSelector decides whether to run the admission control policy on an object based
	// on whether the namespace for that object matches the selector. If the
	// object itself is a namespace, the matching is performed on
	// object.metadata.labels. If the object is another cluster scoped resource,
	// it never skips the policy.
	//
	// For example, to run the webhook on any objects whose namespace is not
	// associated with "runlevel" of "0" or "1";  you will set the selector as
	// follows:
	// "namespaceSelector": {
	// "matchExpressions": [
	// {
	// "key": "runlevel",
	// "operator": "NotIn",
	// "values": [
	// "0",
	// "1"
	// ]
	// }
	// ]
	// }
	//
	// If instead you want to only run the policy on any objects whose
	// namespace is associated with the "environment" of "prod" or "staging";
	// you will set the selector as follows:
	// "namespaceSelector": {
	// "matchExpressions": [
	// {
	// "key": "environment",
	// "operator": "In",
	// "values": [
	// "prod",
	// "staging"
	// ]
	// }
	// ]
	// }
	//
	// See
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
	// for more examples of label selectors.
	//
	// Default to the empty LabelSelector, which matches everything.
	NamespaceSelector *metav1.LabelSelectorApplyConfiguration `json:"namespaceSelector,omitempty"`
	// objectSelector decides whether to run the validation based on if the
	// object has matching labels. objectSelector is evaluated against both
	// the oldObject and newObject that would be sent to the cel validation, and
	// is considered to match if either object matches the selector. A null
	// object (oldObject in the case of create, or newObject in the case of
	// delete) or an object that cannot have labels (like a
	// DeploymentRollback or a PodProxyOptions object) is not considered to
	// match.
	// Use the object selector only if the webhook is opt-in, because end
	// users may skip the admission webhook by setting the labels.
	// Default to the empty LabelSelector, which matches everything.
	ObjectSelector *metav1.LabelSelectorApplyConfiguration `json:"objectSelector,omitempty"`
	// resourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
	// The policy cares about an operation if it matches _any_ Rule.
	ResourceRules []NamedRuleWithOperationsApplyConfiguration `json:"resourceRules,omitempty"`
	// excludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
	// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
	ExcludeResourceRules []NamedRuleWithOperationsApplyConfiguration `json:"excludeResourceRules,omitempty"`
	// matchPolicy defines how the "MatchResources" list is used to match incoming requests.
	// Allowed values are "Exact" or "Equivalent".
	//
	// - Exact: match a request only if it exactly matches a specified rule.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
	//
	// - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
	//
	// Defaults to "Equivalent"
	MatchPolicy *admissionregistrationv1.MatchPolicyType `json:"matchPolicy,omitempty"`
}

MatchResourcesApplyConfiguration represents a declarative configuration of the MatchResources type for use with apply.

MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)

func MatchResources ¶

func MatchResources() *MatchResourcesApplyConfiguration

MatchResourcesApplyConfiguration constructs a declarative configuration of the MatchResources type for use with apply.

func (*MatchResourcesApplyConfiguration) WithExcludeResourceRules ¶

func (b *MatchResourcesApplyConfiguration) WithExcludeResourceRules(values ...*NamedRuleWithOperationsApplyConfiguration) *MatchResourcesApplyConfiguration

WithExcludeResourceRules adds the given value to the ExcludeResourceRules field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the ExcludeResourceRules field.

func (*MatchResourcesApplyConfiguration) WithMatchPolicy ¶

func (b *MatchResourcesApplyConfiguration) WithMatchPolicy(value admissionregistrationv1.MatchPolicyType) *MatchResourcesApplyConfiguration

WithMatchPolicy sets the MatchPolicy field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the MatchPolicy field is set to the value of the last call.

func (*MatchResourcesApplyConfiguration) WithNamespaceSelector ¶

func (b *MatchResourcesApplyConfiguration) WithNamespaceSelector(value *metav1.LabelSelectorApplyConfiguration) *MatchResourcesApplyConfiguration

WithNamespaceSelector sets the NamespaceSelector field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the NamespaceSelector field is set to the value of the last call.

func (*MatchResourcesApplyConfiguration) WithObjectSelector ¶

func (b *MatchResourcesApplyConfiguration) WithObjectSelector(value *metav1.LabelSelectorApplyConfiguration) *MatchResourcesApplyConfiguration

WithObjectSelector sets the ObjectSelector field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ObjectSelector field is set to the value of the last call.

func (*MatchResourcesApplyConfiguration) WithResourceRules ¶

func (b *MatchResourcesApplyConfiguration) WithResourceRules(values ...*NamedRuleWithOperationsApplyConfiguration) *MatchResourcesApplyConfiguration

WithResourceRules adds the given value to the ResourceRules field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the ResourceRules field.

type MutatingAdmissionPolicyApplyConfiguration ¶

type MutatingAdmissionPolicyApplyConfiguration struct {
	metav1.TypeMetaApplyConfiguration `json:",inline"`
	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
	// spec defines the desired behavior of the MutatingAdmissionPolicy.
	Spec *MutatingAdmissionPolicySpecApplyConfiguration `json:"spec,omitempty"`
}

MutatingAdmissionPolicyApplyConfiguration represents a declarative configuration of the MutatingAdmissionPolicy type for use with apply.

MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.

func ExtractMutatingAdmissionPolicy ¶

func ExtractMutatingAdmissionPolicy(mutatingAdmissionPolicy *admissionregistrationv1.MutatingAdmissionPolicy, fieldManager string) (*MutatingAdmissionPolicyApplyConfiguration, error)

ExtractMutatingAdmissionPolicy extracts the applied configuration owned by fieldManager from mutatingAdmissionPolicy. If no managedFields are found in mutatingAdmissionPolicy for fieldManager, a MutatingAdmissionPolicyApplyConfiguration is returned with only the Name, Namespace (if applicable), APIVersion and Kind populated. It is possible that no managed fields were found for because other field managers have taken ownership of all the fields previously owned by fieldManager, or because the fieldManager never owned fields any fields. mutatingAdmissionPolicy must be a unmodified MutatingAdmissionPolicy API object that was retrieved from the Kubernetes API. ExtractMutatingAdmissionPolicy provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func ExtractMutatingAdmissionPolicyFrom ¶

func ExtractMutatingAdmissionPolicyFrom(mutatingAdmissionPolicy *admissionregistrationv1.MutatingAdmissionPolicy, fieldManager string, subresource string) (*MutatingAdmissionPolicyApplyConfiguration, error)

ExtractMutatingAdmissionPolicyFrom extracts the applied configuration owned by fieldManager from mutatingAdmissionPolicy for the specified subresource. Pass an empty string for subresource to extract the main resource. Common subresources include "status", "scale", etc. mutatingAdmissionPolicy must be a unmodified MutatingAdmissionPolicy API object that was retrieved from the Kubernetes API. ExtractMutatingAdmissionPolicyFrom provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func MutatingAdmissionPolicy ¶

func MutatingAdmissionPolicy(name string) *MutatingAdmissionPolicyApplyConfiguration

MutatingAdmissionPolicy constructs a declarative configuration of the MutatingAdmissionPolicy type for use with apply.

func (*MutatingAdmissionPolicyApplyConfiguration) GetAPIVersion ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) GetAPIVersion() *string

GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.

func (*MutatingAdmissionPolicyApplyConfiguration) GetKind ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) GetKind() *string

GetKind retrieves the value of the Kind field in the declarative configuration.

func (*MutatingAdmissionPolicyApplyConfiguration) GetName ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) GetName() *string

GetName retrieves the value of the Name field in the declarative configuration.

func (*MutatingAdmissionPolicyApplyConfiguration) GetNamespace ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) GetNamespace() *string

GetNamespace retrieves the value of the Namespace field in the declarative configuration.

func (MutatingAdmissionPolicyApplyConfiguration) IsApplyConfiguration ¶

func (b MutatingAdmissionPolicyApplyConfiguration) IsApplyConfiguration()

func (*MutatingAdmissionPolicyApplyConfiguration) WithAPIVersion ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithAPIVersion(value string) *MutatingAdmissionPolicyApplyConfiguration

WithAPIVersion sets the APIVersion field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the APIVersion field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithAnnotations ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithAnnotations(entries map[string]string) *MutatingAdmissionPolicyApplyConfiguration

WithAnnotations puts the entries into the Annotations field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, the entries provided by each call will be put on the Annotations field, overwriting an existing map entries in Annotations field with the same key.

func (*MutatingAdmissionPolicyApplyConfiguration) WithCreationTimestamp ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *MutatingAdmissionPolicyApplyConfiguration

WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the CreationTimestamp field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithDeletionGracePeriodSeconds ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *MutatingAdmissionPolicyApplyConfiguration

WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithDeletionTimestamp ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *MutatingAdmissionPolicyApplyConfiguration

WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the DeletionTimestamp field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithFinalizers ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithFinalizers(values ...string) *MutatingAdmissionPolicyApplyConfiguration

WithFinalizers adds the given value to the Finalizers field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the Finalizers field.

func (*MutatingAdmissionPolicyApplyConfiguration) WithGenerateName ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithGenerateName(value string) *MutatingAdmissionPolicyApplyConfiguration

WithGenerateName sets the GenerateName field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the GenerateName field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithGeneration ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithGeneration(value int64) *MutatingAdmissionPolicyApplyConfiguration

WithGeneration sets the Generation field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Generation field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithKind ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithKind(value string) *MutatingAdmissionPolicyApplyConfiguration

WithKind sets the Kind field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Kind field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithLabels ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithLabels(entries map[string]string) *MutatingAdmissionPolicyApplyConfiguration

WithLabels puts the entries into the Labels field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, the entries provided by each call will be put on the Labels field, overwriting an existing map entries in Labels field with the same key.

func (*MutatingAdmissionPolicyApplyConfiguration) WithName ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithName(value string) *MutatingAdmissionPolicyApplyConfiguration

func (*MutatingAdmissionPolicyApplyConfiguration) WithNamespace ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithNamespace(value string) *MutatingAdmissionPolicyApplyConfiguration

WithNamespace sets the Namespace field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Namespace field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithOwnerReferences ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *MutatingAdmissionPolicyApplyConfiguration

WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the OwnerReferences field.

func (*MutatingAdmissionPolicyApplyConfiguration) WithResourceVersion ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithResourceVersion(value string) *MutatingAdmissionPolicyApplyConfiguration

WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ResourceVersion field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithSpec ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithSpec(value *MutatingAdmissionPolicySpecApplyConfiguration) *MutatingAdmissionPolicyApplyConfiguration

WithSpec sets the Spec field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Spec field is set to the value of the last call.

func (*MutatingAdmissionPolicyApplyConfiguration) WithUID ¶

func (b *MutatingAdmissionPolicyApplyConfiguration) WithUID(value types.UID) *MutatingAdmissionPolicyApplyConfiguration

WithUID sets the UID field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the UID field is set to the value of the last call.

type MutatingAdmissionPolicyBindingApplyConfiguration ¶

type MutatingAdmissionPolicyBindingApplyConfiguration struct {
	metav1.TypeMetaApplyConfiguration `json:",inline"`
	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
	// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
	Spec *MutatingAdmissionPolicyBindingSpecApplyConfiguration `json:"spec,omitempty"`
}

MutatingAdmissionPolicyBindingApplyConfiguration represents a declarative configuration of the MutatingAdmissionPolicyBinding type for use with apply.

MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.

For a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding. Each evaluation is constrained by a [runtime cost budget](https://kubernetes.io/docs/reference/using-api/cel/#runtime-cost-budget).

Adding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.

func ExtractMutatingAdmissionPolicyBinding ¶

func ExtractMutatingAdmissionPolicyBinding(mutatingAdmissionPolicyBinding *admissionregistrationv1.MutatingAdmissionPolicyBinding, fieldManager string) (*MutatingAdmissionPolicyBindingApplyConfiguration, error)

ExtractMutatingAdmissionPolicyBinding extracts the applied configuration owned by fieldManager from mutatingAdmissionPolicyBinding. If no managedFields are found in mutatingAdmissionPolicyBinding for fieldManager, a MutatingAdmissionPolicyBindingApplyConfiguration is returned with only the Name, Namespace (if applicable), APIVersion and Kind populated. It is possible that no managed fields were found for because other field managers have taken ownership of all the fields previously owned by fieldManager, or because the fieldManager never owned fields any fields. mutatingAdmissionPolicyBinding must be a unmodified MutatingAdmissionPolicyBinding API object that was retrieved from the Kubernetes API. ExtractMutatingAdmissionPolicyBinding provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func ExtractMutatingAdmissionPolicyBindingFrom ¶

func ExtractMutatingAdmissionPolicyBindingFrom(mutatingAdmissionPolicyBinding *admissionregistrationv1.MutatingAdmissionPolicyBinding, fieldManager string, subresource string) (*MutatingAdmissionPolicyBindingApplyConfiguration, error)

ExtractMutatingAdmissionPolicyBindingFrom extracts the applied configuration owned by fieldManager from mutatingAdmissionPolicyBinding for the specified subresource. Pass an empty string for subresource to extract the main resource. Common subresources include "status", "scale", etc. mutatingAdmissionPolicyBinding must be a unmodified MutatingAdmissionPolicyBinding API object that was retrieved from the Kubernetes API. ExtractMutatingAdmissionPolicyBindingFrom provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func MutatingAdmissionPolicyBinding ¶

func MutatingAdmissionPolicyBinding(name string) *MutatingAdmissionPolicyBindingApplyConfiguration

MutatingAdmissionPolicyBinding constructs a declarative configuration of the MutatingAdmissionPolicyBinding type for use with apply.

func (*MutatingAdmissionPolicyBindingApplyConfiguration) GetAPIVersion ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) GetAPIVersion() *string

GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.

func (*MutatingAdmissionPolicyBindingApplyConfiguration) GetKind ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) GetKind() *string

GetKind retrieves the value of the Kind field in the declarative configuration.

func (*MutatingAdmissionPolicyBindingApplyConfiguration) GetName ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) GetName() *string

GetName retrieves the value of the Name field in the declarative configuration.

func (*MutatingAdmissionPolicyBindingApplyConfiguration) GetNamespace ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) GetNamespace() *string

GetNamespace retrieves the value of the Namespace field in the declarative configuration.

func (MutatingAdmissionPolicyBindingApplyConfiguration) IsApplyConfiguration ¶

func (b MutatingAdmissionPolicyBindingApplyConfiguration) IsApplyConfiguration()

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithAPIVersion ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithAPIVersion(value string) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithAnnotations ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithAnnotations(entries map[string]string) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithCreationTimestamp ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithDeletionGracePeriodSeconds ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithDeletionTimestamp ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithFinalizers ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithFinalizers(values ...string) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithGenerateName ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithGenerateName(value string) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithGeneration ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithGeneration(value int64) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithKind ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithKind(value string) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithLabels ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithLabels(entries map[string]string) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithName ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithName(value string) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithNamespace ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithNamespace(value string) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithOwnerReferences ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithResourceVersion ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithResourceVersion(value string) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithSpec ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithSpec(value *MutatingAdmissionPolicyBindingSpecApplyConfiguration) *MutatingAdmissionPolicyBindingApplyConfiguration

func (*MutatingAdmissionPolicyBindingApplyConfiguration) WithUID ¶

func (b *MutatingAdmissionPolicyBindingApplyConfiguration) WithUID(value types.UID) *MutatingAdmissionPolicyBindingApplyConfiguration

type MutatingAdmissionPolicyBindingSpecApplyConfiguration ¶

type MutatingAdmissionPolicyBindingSpecApplyConfiguration struct {
	// policyName references a MutatingAdmissionPolicy name which the MutatingAdmissionPolicyBinding binds to.
	// If the referenced resource does not exist, this binding is considered invalid and will be ignored
	// Required.
	PolicyName *string `json:"policyName,omitempty"`
	// paramRef specifies the parameter resource used to configure the admission control policy.
	// It should point to a resource of the type specified in spec.ParamKind of the bound MutatingAdmissionPolicy.
	// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the MutatingAdmissionPolicy applied.
	// If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
	ParamRef *ParamRefApplyConfiguration `json:"paramRef,omitempty"`
	// matchResources limits what resources match this binding and may be mutated by it.
	// Note that if matchResources matches a resource, the resource must also match a policy's matchConstraints and
	// matchConditions before the resource may be mutated.
	// When matchResources is unset, it does not constrain resource matching, and only the policy's matchConstraints
	// and matchConditions must match for the resource to be mutated.
	// Additionally, matchResources.resourceRules are optional and do not constraint matching when unset.
	// Note that this is differs from MutatingAdmissionPolicy matchConstraints, where resourceRules are required.
	// The CREATE, UPDATE and CONNECT operations are allowed.  The DELETE operation may not be matched.
	// '*' matches CREATE, UPDATE and CONNECT.
	MatchResources *MatchResourcesApplyConfiguration `json:"matchResources,omitempty"`
}

MutatingAdmissionPolicyBindingSpecApplyConfiguration represents a declarative configuration of the MutatingAdmissionPolicyBindingSpec type for use with apply.

MutatingAdmissionPolicyBindingSpec defines the specification of the MutatingAdmissionPolicyBinding.

func MutatingAdmissionPolicyBindingSpec ¶

func MutatingAdmissionPolicyBindingSpec() *MutatingAdmissionPolicyBindingSpecApplyConfiguration

MutatingAdmissionPolicyBindingSpecApplyConfiguration constructs a declarative configuration of the MutatingAdmissionPolicyBindingSpec type for use with apply.

func (*MutatingAdmissionPolicyBindingSpecApplyConfiguration) WithMatchResources ¶

func (b *MutatingAdmissionPolicyBindingSpecApplyConfiguration) WithMatchResources(value *MatchResourcesApplyConfiguration) *MutatingAdmissionPolicyBindingSpecApplyConfiguration

WithMatchResources sets the MatchResources field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the MatchResources field is set to the value of the last call.

func (*MutatingAdmissionPolicyBindingSpecApplyConfiguration) WithParamRef ¶

func (b *MutatingAdmissionPolicyBindingSpecApplyConfiguration) WithParamRef(value *ParamRefApplyConfiguration) *MutatingAdmissionPolicyBindingSpecApplyConfiguration

WithParamRef sets the ParamRef field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ParamRef field is set to the value of the last call.

func (*MutatingAdmissionPolicyBindingSpecApplyConfiguration) WithPolicyName ¶

func (b *MutatingAdmissionPolicyBindingSpecApplyConfiguration) WithPolicyName(value string) *MutatingAdmissionPolicyBindingSpecApplyConfiguration

WithPolicyName sets the PolicyName field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the PolicyName field is set to the value of the last call.

type MutatingAdmissionPolicySpecApplyConfiguration ¶

type MutatingAdmissionPolicySpecApplyConfiguration struct {
	// paramKind specifies the kind of resources used to parameterize this policy.
	// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
	// If paramKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
	// If paramKind is specified but paramRef is unset in MutatingAdmissionPolicyBinding, the params variable will be null.
	ParamKind *ParamKindApplyConfiguration `json:"paramKind,omitempty"`
	// matchConstraints specifies what resources this policy is designed to validate.
	// The MutatingAdmissionPolicy cares about a request if it matches _all_ Constraints.
	// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
	// MutatingAdmissionPolicy cannot match MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding.
	// The CREATE, UPDATE and CONNECT operations are allowed.  The DELETE operation may not be matched.
	// '*' matches CREATE, UPDATE and CONNECT.
	// Required.
	MatchConstraints *MatchResourcesApplyConfiguration `json:"matchConstraints,omitempty"`
	// variables contain definitions of variables that can be used in composition of other expressions.
	// Each variable is defined as a named CEL expression.
	// The variables defined here will be available under `variables` in other expressions of the policy
	// except matchConditions because matchConditions are evaluated before the rest of the policy.
	//
	// The expression of a variable can refer to other variables defined earlier in the list but not those after.
	// Thus, variables must be sorted by the order of first appearance and acyclic.
	Variables []VariableApplyConfiguration `json:"variables,omitempty"`
	// mutations contain operations to perform on matching objects.
	// mutations may not be empty; a minimum of one mutation is required.
	// mutations are evaluated in order, and are reinvoked according to
	// the reinvocationPolicy.
	// The mutations of a policy are invoked for each binding of this policy
	// and reinvocation of mutations occurs on a per binding basis.
	Mutations []MutationApplyConfiguration `json:"mutations,omitempty"`
	// failurePolicy defines how to handle failures for the admission policy. Failures can
	// occur from CEL expression parse errors, type check errors, runtime errors and invalid
	// or mis-configured policy definitions or bindings.
	//
	// A policy is invalid if paramKind refers to a non-existent Kind.
	// A binding is invalid if paramRef.name refers to a non-existent resource.
	//
	// failurePolicy does not define how validations that evaluate to false are handled.
	//
	// Allowed values are Ignore or Fail. Defaults to Fail.
	FailurePolicy *admissionregistrationv1.FailurePolicyType `json:"failurePolicy,omitempty"`
	// matchConditions is a list of conditions that must be met for a request to be validated.
	// Match conditions filter requests that have already been matched by the matchConstraints.
	// An empty list of matchConditions matches all requests.
	// There are a maximum of 64 match conditions allowed.
	//
	// If a parameter object is provided, it can be accessed via the `params` handle in the same
	// manner as validation expressions.
	//
	// The exact matching logic is (in order):
	// 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
	// 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
	// 3. If any matchCondition evaluates to an error (but none are FALSE):
	// - If failurePolicy=Fail, reject the request
	// - If failurePolicy=Ignore, the policy is skipped
	MatchConditions []MatchConditionApplyConfiguration `json:"matchConditions,omitempty"`
	// reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding
	// as part of a single admission evaluation.
	// Allowed values are "Never" and "IfNeeded".
	//
	// Never: These mutations will not be called more than once per binding in a single admission evaluation.
	//
	// IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of
	// order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies.  Mutations are only
	// reinvoked when mutations change the object after this mutation is invoked.
	// Required.
	ReinvocationPolicy *admissionregistrationv1.ReinvocationPolicyType `json:"reinvocationPolicy,omitempty"`
}

MutatingAdmissionPolicySpecApplyConfiguration represents a declarative configuration of the MutatingAdmissionPolicySpec type for use with apply.

MutatingAdmissionPolicySpec defines the desired behavior of the admission policy.

func MutatingAdmissionPolicySpec ¶

func MutatingAdmissionPolicySpec() *MutatingAdmissionPolicySpecApplyConfiguration

MutatingAdmissionPolicySpecApplyConfiguration constructs a declarative configuration of the MutatingAdmissionPolicySpec type for use with apply.

func (*MutatingAdmissionPolicySpecApplyConfiguration) WithFailurePolicy ¶

func (b *MutatingAdmissionPolicySpecApplyConfiguration) WithFailurePolicy(value admissionregistrationv1.FailurePolicyType) *MutatingAdmissionPolicySpecApplyConfiguration

WithFailurePolicy sets the FailurePolicy field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the FailurePolicy field is set to the value of the last call.

func (*MutatingAdmissionPolicySpecApplyConfiguration) WithMatchConditions ¶

func (b *MutatingAdmissionPolicySpecApplyConfiguration) WithMatchConditions(values ...*MatchConditionApplyConfiguration) *MutatingAdmissionPolicySpecApplyConfiguration

WithMatchConditions adds the given value to the MatchConditions field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the MatchConditions field.

func (*MutatingAdmissionPolicySpecApplyConfiguration) WithMatchConstraints ¶

func (b *MutatingAdmissionPolicySpecApplyConfiguration) WithMatchConstraints(value *MatchResourcesApplyConfiguration) *MutatingAdmissionPolicySpecApplyConfiguration

WithMatchConstraints sets the MatchConstraints field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the MatchConstraints field is set to the value of the last call.

func (*MutatingAdmissionPolicySpecApplyConfiguration) WithMutations ¶

func (b *MutatingAdmissionPolicySpecApplyConfiguration) WithMutations(values ...*MutationApplyConfiguration) *MutatingAdmissionPolicySpecApplyConfiguration

WithMutations adds the given value to the Mutations field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the Mutations field.

func (*MutatingAdmissionPolicySpecApplyConfiguration) WithParamKind ¶

func (b *MutatingAdmissionPolicySpecApplyConfiguration) WithParamKind(value *ParamKindApplyConfiguration) *MutatingAdmissionPolicySpecApplyConfiguration

WithParamKind sets the ParamKind field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ParamKind field is set to the value of the last call.

func (*MutatingAdmissionPolicySpecApplyConfiguration) WithReinvocationPolicy ¶

func (b *MutatingAdmissionPolicySpecApplyConfiguration) WithReinvocationPolicy(value admissionregistrationv1.ReinvocationPolicyType) *MutatingAdmissionPolicySpecApplyConfiguration

WithReinvocationPolicy sets the ReinvocationPolicy field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ReinvocationPolicy field is set to the value of the last call.

func (*MutatingAdmissionPolicySpecApplyConfiguration) WithVariables ¶

func (b *MutatingAdmissionPolicySpecApplyConfiguration) WithVariables(values ...*VariableApplyConfiguration) *MutatingAdmissionPolicySpecApplyConfiguration

WithVariables adds the given value to the Variables field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the Variables field.

type MutatingWebhookApplyConfiguration ¶

type MutatingWebhookApplyConfiguration struct {
	// name is the name of the admission webhook.
	// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
	// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
	// of the organization.
	// Required.
	Name *string `json:"name,omitempty"`
	// clientConfig defines how to communicate with the hook.
	// Required
	ClientConfig *WebhookClientConfigApplyConfiguration `json:"clientConfig,omitempty"`
	// rules describes what operations on what resources/subresources the webhook cares about.
	// The webhook cares about an operation if it matches _any_ Rule.
	// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
	// from putting the cluster in a state which cannot be recovered from without completely
	// disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
	// on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
	Rules []RuleWithOperationsApplyConfiguration `json:"rules,omitempty"`
	// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
	// allowed values are Ignore or Fail. Defaults to Fail.
	FailurePolicy *admissionregistrationv1.FailurePolicyType `json:"failurePolicy,omitempty"`
	// matchPolicy defines how the "rules" list is used to match incoming requests.
	// Allowed values are "Exact" or "Equivalent".
	//
	// - Exact: match a request only if it exactly matches a specified rule.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
	//
	// - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
	//
	// Defaults to "Equivalent"
	MatchPolicy *admissionregistrationv1.MatchPolicyType `json:"matchPolicy,omitempty"`
	// namespaceSelector decides whether to run the webhook on an object based
	// on whether the namespace for that object matches the selector. If the
	// object itself is a namespace, the matching is performed on
	// object.metadata.labels. If the object is another cluster scoped resource,
	// it never skips the webhook.
	//
	// For example, to run the webhook on any objects whose namespace is not
	// associated with "runlevel" of "0" or "1";  you will set the selector as
	// follows:
	// "namespaceSelector": {
	// "matchExpressions": [
	// {
	// "key": "runlevel",
	// "operator": "NotIn",
	// "values": [
	// "0",
	// "1"
	// ]
	// }
	// ]
	// }
	//
	// If instead you want to only run the webhook on any objects whose
	// namespace is associated with the "environment" of "prod" or "staging";
	// you will set the selector as follows:
	// "namespaceSelector": {
	// "matchExpressions": [
	// {
	// "key": "environment",
	// "operator": "In",
	// "values": [
	// "prod",
	// "staging"
	// ]
	// }
	// ]
	// }
	//
	// See
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
	// for more examples of label selectors.
	//
	// Default to the empty LabelSelector, which matches everything.
	NamespaceSelector *metav1.LabelSelectorApplyConfiguration `json:"namespaceSelector,omitempty"`
	// objectSelector decides whether to run the webhook based on if the
	// object has matching labels. objectSelector is evaluated against both
	// the oldObject and newObject that would be sent to the webhook, and
	// is considered to match if either object matches the selector. A null
	// object (oldObject in the case of create, or newObject in the case of
	// delete) or an object that cannot have labels (like a
	// DeploymentRollback or a PodProxyOptions object) is not considered to
	// match.
	// Use the object selector only if the webhook is opt-in, because end
	// users may skip the admission webhook by setting the labels.
	// Default to the empty LabelSelector, which matches everything.
	ObjectSelector *metav1.LabelSelectorApplyConfiguration `json:"objectSelector,omitempty"`
	// sideEffects states whether this webhook has side effects.
	// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
	// Webhooks with side effects MUST implement a reconciliation system, since a request may be
	// rejected by a future step in the admission chain and the side effects therefore need to be undone.
	// Requests with the dryRun attribute will be auto-rejected if they match a webhook with
	// sideEffects == Unknown or Some.
	SideEffects *admissionregistrationv1.SideEffectClass `json:"sideEffects,omitempty"`
	// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
	// the webhook call will be ignored or the API call will fail based on the
	// failure policy.
	// The timeout value must be between 1 and 30 seconds.
	// Default to 10 seconds.
	TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty"`
	// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
	// versions the Webhook expects. API server will try to use first version in
	// the list which it supports. If none of the versions specified in this list
	// supported by API server, validation will fail for this object.
	// If a persisted webhook configuration specifies allowed versions and does not
	// include any versions known to the API Server, calls to the webhook will fail
	// and be subject to the failure policy.
	AdmissionReviewVersions []string `json:"admissionReviewVersions,omitempty"`
	// reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.
	// Allowed values are "Never" and "IfNeeded".
	//
	// Never: the webhook will not be called more than once in a single admission evaluation.
	//
	// IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation
	// if the object being admitted is modified by other admission plugins after the initial webhook call.
	// Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted.
	// Note:
	// * the number of additional invocations is not guaranteed to be exactly one.
	// * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.
	// * webhooks that use this option may be reordered to minimize the number of additional invocations.
	// * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.
	//
	// Defaults to "Never".
	ReinvocationPolicy *admissionregistrationv1.ReinvocationPolicyType `json:"reinvocationPolicy,omitempty"`
	// matchConditions is a list of conditions that must be met for a request to be sent to this
	// webhook. Match conditions filter requests that have already been matched by the rules,
	// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
	// There are a maximum of 64 match conditions allowed.
	//
	// The exact matching logic is (in order):
	// 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.
	// 2. If ALL matchConditions evaluate to TRUE, the webhook is called.
	// 3. If any matchCondition evaluates to an error (but none are FALSE):
	// - If failurePolicy=Fail, reject the request
	// - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
	MatchConditions []MatchConditionApplyConfiguration `json:"matchConditions,omitempty"`
}

MutatingWebhookApplyConfiguration represents a declarative configuration of the MutatingWebhook type for use with apply.

MutatingWebhook describes an admission webhook and the resources and operations it applies to.

func MutatingWebhook ¶

func MutatingWebhook() *MutatingWebhookApplyConfiguration

MutatingWebhookApplyConfiguration constructs a declarative configuration of the MutatingWebhook type for use with apply.

func (*MutatingWebhookApplyConfiguration) WithAdmissionReviewVersions ¶

func (b *MutatingWebhookApplyConfiguration) WithAdmissionReviewVersions(values ...string) *MutatingWebhookApplyConfiguration

WithAdmissionReviewVersions adds the given value to the AdmissionReviewVersions field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the AdmissionReviewVersions field.

func (*MutatingWebhookApplyConfiguration) WithClientConfig ¶

func (b *MutatingWebhookApplyConfiguration) WithClientConfig(value *WebhookClientConfigApplyConfiguration) *MutatingWebhookApplyConfiguration

WithClientConfig sets the ClientConfig field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ClientConfig field is set to the value of the last call.

func (*MutatingWebhookApplyConfiguration) WithFailurePolicy ¶

func (b *MutatingWebhookApplyConfiguration) WithFailurePolicy(value admissionregistrationv1.FailurePolicyType) *MutatingWebhookApplyConfiguration

func (*MutatingWebhookApplyConfiguration) WithMatchConditions ¶

func (b *MutatingWebhookApplyConfiguration) WithMatchConditions(values ...*MatchConditionApplyConfiguration) *MutatingWebhookApplyConfiguration

func (*MutatingWebhookApplyConfiguration) WithMatchPolicy ¶

func (b *MutatingWebhookApplyConfiguration) WithMatchPolicy(value admissionregistrationv1.MatchPolicyType) *MutatingWebhookApplyConfiguration

func (*MutatingWebhookApplyConfiguration) WithName ¶

func (b *MutatingWebhookApplyConfiguration) WithName(value string) *MutatingWebhookApplyConfiguration

func (*MutatingWebhookApplyConfiguration) WithNamespaceSelector ¶

func (b *MutatingWebhookApplyConfiguration) WithNamespaceSelector(value *metav1.LabelSelectorApplyConfiguration) *MutatingWebhookApplyConfiguration

func (*MutatingWebhookApplyConfiguration) WithObjectSelector ¶

func (b *MutatingWebhookApplyConfiguration) WithObjectSelector(value *metav1.LabelSelectorApplyConfiguration) *MutatingWebhookApplyConfiguration

func (*MutatingWebhookApplyConfiguration) WithReinvocationPolicy ¶

func (b *MutatingWebhookApplyConfiguration) WithReinvocationPolicy(value admissionregistrationv1.ReinvocationPolicyType) *MutatingWebhookApplyConfiguration

func (*MutatingWebhookApplyConfiguration) WithRules ¶

func (b *MutatingWebhookApplyConfiguration) WithRules(values ...*RuleWithOperationsApplyConfiguration) *MutatingWebhookApplyConfiguration

WithRules adds the given value to the Rules field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the Rules field.

func (*MutatingWebhookApplyConfiguration) WithSideEffects ¶

func (b *MutatingWebhookApplyConfiguration) WithSideEffects(value admissionregistrationv1.SideEffectClass) *MutatingWebhookApplyConfiguration

WithSideEffects sets the SideEffects field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the SideEffects field is set to the value of the last call.

func (*MutatingWebhookApplyConfiguration) WithTimeoutSeconds ¶

func (b *MutatingWebhookApplyConfiguration) WithTimeoutSeconds(value int32) *MutatingWebhookApplyConfiguration

WithTimeoutSeconds sets the TimeoutSeconds field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the TimeoutSeconds field is set to the value of the last call.

type MutatingWebhookConfigurationApplyConfiguration ¶

type MutatingWebhookConfigurationApplyConfiguration struct {
	metav1.TypeMetaApplyConfiguration `json:",inline"`
	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
	// webhooks is a list of webhooks and the affected resources and operations.
	Webhooks []MutatingWebhookApplyConfiguration `json:"webhooks,omitempty"`
}

MutatingWebhookConfigurationApplyConfiguration represents a declarative configuration of the MutatingWebhookConfiguration type for use with apply.

MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.

func ExtractMutatingWebhookConfiguration ¶

func ExtractMutatingWebhookConfiguration(mutatingWebhookConfiguration *admissionregistrationv1.MutatingWebhookConfiguration, fieldManager string) (*MutatingWebhookConfigurationApplyConfiguration, error)

ExtractMutatingWebhookConfiguration extracts the applied configuration owned by fieldManager from mutatingWebhookConfiguration. If no managedFields are found in mutatingWebhookConfiguration for fieldManager, a MutatingWebhookConfigurationApplyConfiguration is returned with only the Name, Namespace (if applicable), APIVersion and Kind populated. It is possible that no managed fields were found for because other field managers have taken ownership of all the fields previously owned by fieldManager, or because the fieldManager never owned fields any fields. mutatingWebhookConfiguration must be a unmodified MutatingWebhookConfiguration API object that was retrieved from the Kubernetes API. ExtractMutatingWebhookConfiguration provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func ExtractMutatingWebhookConfigurationFrom ¶

func ExtractMutatingWebhookConfigurationFrom(mutatingWebhookConfiguration *admissionregistrationv1.MutatingWebhookConfiguration, fieldManager string, subresource string) (*MutatingWebhookConfigurationApplyConfiguration, error)

ExtractMutatingWebhookConfigurationFrom extracts the applied configuration owned by fieldManager from mutatingWebhookConfiguration for the specified subresource. Pass an empty string for subresource to extract the main resource. Common subresources include "status", "scale", etc. mutatingWebhookConfiguration must be a unmodified MutatingWebhookConfiguration API object that was retrieved from the Kubernetes API. ExtractMutatingWebhookConfigurationFrom provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func MutatingWebhookConfiguration ¶

func MutatingWebhookConfiguration(name string) *MutatingWebhookConfigurationApplyConfiguration

MutatingWebhookConfiguration constructs a declarative configuration of the MutatingWebhookConfiguration type for use with apply.

func (*MutatingWebhookConfigurationApplyConfiguration) GetAPIVersion ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) GetAPIVersion() *string

GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.

func (*MutatingWebhookConfigurationApplyConfiguration) GetKind ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) GetKind() *string

GetKind retrieves the value of the Kind field in the declarative configuration.

func (*MutatingWebhookConfigurationApplyConfiguration) GetName ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) GetName() *string

GetName retrieves the value of the Name field in the declarative configuration.

func (*MutatingWebhookConfigurationApplyConfiguration) GetNamespace ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) GetNamespace() *string

GetNamespace retrieves the value of the Namespace field in the declarative configuration.

func (MutatingWebhookConfigurationApplyConfiguration) IsApplyConfiguration ¶

func (b MutatingWebhookConfigurationApplyConfiguration) IsApplyConfiguration()

func (*MutatingWebhookConfigurationApplyConfiguration) WithAPIVersion ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithAPIVersion(value string) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithAnnotations ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithAnnotations(entries map[string]string) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithCreationTimestamp ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithDeletionGracePeriodSeconds ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithDeletionTimestamp ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithFinalizers ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithFinalizers(values ...string) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithGenerateName ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithGenerateName(value string) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithGeneration ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithGeneration(value int64) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithKind ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithKind(value string) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithLabels ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithLabels(entries map[string]string) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithName ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithName(value string) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithNamespace ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithNamespace(value string) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithOwnerReferences ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithResourceVersion ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithResourceVersion(value string) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithUID ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithUID(value types.UID) *MutatingWebhookConfigurationApplyConfiguration

func (*MutatingWebhookConfigurationApplyConfiguration) WithWebhooks ¶

func (b *MutatingWebhookConfigurationApplyConfiguration) WithWebhooks(values ...*MutatingWebhookApplyConfiguration) *MutatingWebhookConfigurationApplyConfiguration

WithWebhooks adds the given value to the Webhooks field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the Webhooks field.

type MutationApplyConfiguration ¶

type MutationApplyConfiguration struct {
	// patchType indicates the patch strategy used.
	// Allowed values are "ApplyConfiguration" and "JSONPatch".
	// Required.
	PatchType *admissionregistrationv1.PatchType `json:"patchType,omitempty"`
	// applyConfiguration defines the desired configuration values of an object.
	// The configuration is applied to the admission object using
	// [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff).
	// A CEL expression is used to create apply configuration.
	ApplyConfiguration *ApplyConfigurationApplyConfiguration `json:"applyConfiguration,omitempty"`
	// jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object.
	// A CEL expression is used to create the JSON patch.
	JSONPatch *JSONPatchApplyConfiguration `json:"jsonPatch,omitempty"`
}

MutationApplyConfiguration represents a declarative configuration of the Mutation type for use with apply.

Mutation specifies the CEL expression which is used to apply the Mutation.

func Mutation ¶

func Mutation() *MutationApplyConfiguration

MutationApplyConfiguration constructs a declarative configuration of the Mutation type for use with apply.

func (*MutationApplyConfiguration) WithApplyConfiguration ¶

func (b *MutationApplyConfiguration) WithApplyConfiguration(value *ApplyConfigurationApplyConfiguration) *MutationApplyConfiguration

WithApplyConfiguration sets the ApplyConfiguration field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ApplyConfiguration field is set to the value of the last call.

func (*MutationApplyConfiguration) WithJSONPatch ¶

func (b *MutationApplyConfiguration) WithJSONPatch(value *JSONPatchApplyConfiguration) *MutationApplyConfiguration

WithJSONPatch sets the JSONPatch field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the JSONPatch field is set to the value of the last call.

func (*MutationApplyConfiguration) WithPatchType ¶

func (b *MutationApplyConfiguration) WithPatchType(value admissionregistrationv1.PatchType) *MutationApplyConfiguration

WithPatchType sets the PatchType field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the PatchType field is set to the value of the last call.

type NamedRuleWithOperationsApplyConfiguration ¶

type NamedRuleWithOperationsApplyConfiguration struct {
	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
	ResourceNames []string `json:"resourceNames,omitempty"`
	// RuleWithOperations is a tuple of Operations and Resources.
	RuleWithOperationsApplyConfiguration `json:",inline"`
}

NamedRuleWithOperationsApplyConfiguration represents a declarative configuration of the NamedRuleWithOperations type for use with apply.

NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.

func NamedRuleWithOperations ¶

func NamedRuleWithOperations() *NamedRuleWithOperationsApplyConfiguration

NamedRuleWithOperationsApplyConfiguration constructs a declarative configuration of the NamedRuleWithOperations type for use with apply.

func (*NamedRuleWithOperationsApplyConfiguration) WithAPIGroups ¶

func (b *NamedRuleWithOperationsApplyConfiguration) WithAPIGroups(values ...string) *NamedRuleWithOperationsApplyConfiguration

WithAPIGroups adds the given value to the APIGroups field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the APIGroups field.

func (*NamedRuleWithOperationsApplyConfiguration) WithAPIVersions ¶

func (b *NamedRuleWithOperationsApplyConfiguration) WithAPIVersions(values ...string) *NamedRuleWithOperationsApplyConfiguration

WithAPIVersions adds the given value to the APIVersions field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the APIVersions field.

func (*NamedRuleWithOperationsApplyConfiguration) WithOperations ¶

func (b *NamedRuleWithOperationsApplyConfiguration) WithOperations(values ...admissionregistrationv1.OperationType) *NamedRuleWithOperationsApplyConfiguration

WithOperations adds the given value to the Operations field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the Operations field.

func (*NamedRuleWithOperationsApplyConfiguration) WithResourceNames ¶

func (b *NamedRuleWithOperationsApplyConfiguration) WithResourceNames(values ...string) *NamedRuleWithOperationsApplyConfiguration

WithResourceNames adds the given value to the ResourceNames field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the ResourceNames field.

func (*NamedRuleWithOperationsApplyConfiguration) WithResources ¶

func (b *NamedRuleWithOperationsApplyConfiguration) WithResources(values ...string) *NamedRuleWithOperationsApplyConfiguration

WithResources adds the given value to the Resources field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the Resources field.

func (*NamedRuleWithOperationsApplyConfiguration) WithScope ¶

func (b *NamedRuleWithOperationsApplyConfiguration) WithScope(value admissionregistrationv1.ScopeType) *NamedRuleWithOperationsApplyConfiguration

WithScope sets the Scope field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Scope field is set to the value of the last call.

type ParamKindApplyConfiguration ¶

type ParamKindApplyConfiguration struct {
	// apiVersion is the API group version the resources belong to.
	// In format of "group/version".
	// Required.
	APIVersion *string `json:"apiVersion,omitempty"`
	// kind is the API kind the resources belong to.
	// Required.
	Kind *string `json:"kind,omitempty"`
}

ParamKindApplyConfiguration represents a declarative configuration of the ParamKind type for use with apply.

ParamKind is a tuple of Group Kind and Version.

func ParamKind ¶

func ParamKind() *ParamKindApplyConfiguration

ParamKindApplyConfiguration constructs a declarative configuration of the ParamKind type for use with apply.

func (*ParamKindApplyConfiguration) WithAPIVersion ¶

func (b *ParamKindApplyConfiguration) WithAPIVersion(value string) *ParamKindApplyConfiguration

func (*ParamKindApplyConfiguration) WithKind ¶

func (b *ParamKindApplyConfiguration) WithKind(value string) *ParamKindApplyConfiguration

type ParamRefApplyConfiguration ¶

type ParamRefApplyConfiguration struct {
	// name is the name of the resource being referenced.
	//
	// One of `name` or `selector` must be set, but `name` and `selector` are
	// mutually exclusive properties. If one is set, the other must be unset.
	//
	// A single parameter used for all admission requests can be configured
	// by setting the `name` field, leaving `selector` blank, and setting namespace
	// if `paramKind` is namespace-scoped.
	Name *string `json:"name,omitempty"`
	// namespace is the namespace of the referenced resource. Allows limiting
	// the search for params to a specific namespace. Applies to both `name` and
	// `selector` fields.
	//
	// A per-namespace parameter may be used by specifying a namespace-scoped
	// `paramKind` in the policy and leaving this field empty.
	//
	// - If `paramKind` is cluster-scoped, this field MUST be unset. Setting this
	// field results in a configuration error.
	//
	// - If `paramKind` is namespace-scoped, the namespace of the object being
	// evaluated for admission will be used when this field is left unset. Take
	// care that if this is left empty the binding must not match any cluster-scoped
	// resources, which will result in an error.
	Namespace *string `json:"namespace,omitempty"`
	// selector can be used to match multiple param objects based on their labels.
	// Supply selector: {} to match all resources of the ParamKind.
	//
	// If multiple params are found, they are all evaluated with the policy expressions
	// and the results are ANDed together.
	//
	// One of `name` or `selector` must be set, but `name` and `selector` are
	// mutually exclusive properties. If one is set, the other must be unset.
	Selector *metav1.LabelSelectorApplyConfiguration `json:"selector,omitempty"`
	// parameterNotFoundAction controls the behavior of the binding when the resource
	// exists, and name or selector is valid, but there are no parameters
	// matched by the binding. If the value is set to `Allow`, then no
	// matched parameters will be treated as successful validation by the binding.
	// If set to `Deny`, then no matched parameters will be subject to the
	// `failurePolicy` of the policy.
	//
	// Allowed values are `Allow` or `Deny`
	//
	// Required
	ParameterNotFoundAction *admissionregistrationv1.ParameterNotFoundActionType `json:"parameterNotFoundAction,omitempty"`
}

ParamRefApplyConfiguration represents a declarative configuration of the ParamRef type for use with apply.

ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.

func ParamRef ¶

func ParamRef() *ParamRefApplyConfiguration

ParamRefApplyConfiguration constructs a declarative configuration of the ParamRef type for use with apply.

func (*ParamRefApplyConfiguration) WithName ¶

func (b *ParamRefApplyConfiguration) WithName(value string) *ParamRefApplyConfiguration

func (*ParamRefApplyConfiguration) WithNamespace ¶

func (b *ParamRefApplyConfiguration) WithNamespace(value string) *ParamRefApplyConfiguration

func (*ParamRefApplyConfiguration) WithParameterNotFoundAction ¶

func (b *ParamRefApplyConfiguration) WithParameterNotFoundAction(value admissionregistrationv1.ParameterNotFoundActionType) *ParamRefApplyConfiguration

WithParameterNotFoundAction sets the ParameterNotFoundAction field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ParameterNotFoundAction field is set to the value of the last call.

func (*ParamRefApplyConfiguration) WithSelector ¶

func (b *ParamRefApplyConfiguration) WithSelector(value *metav1.LabelSelectorApplyConfiguration) *ParamRefApplyConfiguration

WithSelector sets the Selector field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Selector field is set to the value of the last call.

type RuleApplyConfiguration ¶

type RuleApplyConfiguration struct {
	// apiGroups is the API groups the resources belong to. '*' is all groups.
	// If '*' is present, the length of the slice must be one.
	// Required.
	APIGroups []string `json:"apiGroups,omitempty"`
	// apiVersions is the API versions the resources belong to. '*' is all versions.
	// If '*' is present, the length of the slice must be one.
	// Required.
	APIVersions []string `json:"apiVersions,omitempty"`
	// resources is a list of resources this rule applies to.
	//
	// For example:
	// 'pods' means pods.
	// 'pods/log' means the log subresource of pods.
	// '*' means all resources, but not subresources.
	// 'pods/*' means all subresources of pods.
	// '*/scale' means all scale subresources.
	// '*/*' means all resources and their subresources.
	//
	// If wildcard is present, the validation rule will ensure resources do not
	// overlap with each other.
	//
	// Depending on the enclosing object, subresources might not be allowed.
	// Required.
	Resources []string `json:"resources,omitempty"`
	// scope specifies the scope of this rule.
	// Valid values are "Cluster", "Namespaced", and "*"
	// "Cluster" means that only cluster-scoped resources will match this rule.
	// Namespace API objects are cluster-scoped.
	// "Namespaced" means that only namespaced resources will match this rule.
	// "*" means that there are no scope restrictions.
	// Subresources match the scope of their parent resource.
	// Default is "*".
	Scope *admissionregistrationv1.ScopeType `json:"scope,omitempty"`
}

RuleApplyConfiguration represents a declarative configuration of the Rule type for use with apply.

Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended to make sure that all the tuple expansions are valid.

func Rule ¶

func Rule() *RuleApplyConfiguration

RuleApplyConfiguration constructs a declarative configuration of the Rule type for use with apply.

func (*RuleApplyConfiguration) WithAPIGroups ¶

func (b *RuleApplyConfiguration) WithAPIGroups(values ...string) *RuleApplyConfiguration

func (*RuleApplyConfiguration) WithAPIVersions ¶

func (b *RuleApplyConfiguration) WithAPIVersions(values ...string) *RuleApplyConfiguration

func (*RuleApplyConfiguration) WithResources ¶

func (b *RuleApplyConfiguration) WithResources(values ...string) *RuleApplyConfiguration

func (*RuleApplyConfiguration) WithScope ¶

func (b *RuleApplyConfiguration) WithScope(value admissionregistrationv1.ScopeType) *RuleApplyConfiguration

type RuleWithOperationsApplyConfiguration ¶

type RuleWithOperationsApplyConfiguration struct {
	// operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
	// for all of those operations and any future admission operations that are added.
	// If '*' is present, the length of the slice must be one.
	// Required.
	Operations []admissionregistrationv1.OperationType `json:"operations,omitempty"`
	// Rule is embedded, it describes other criteria of the rule, like
	// APIGroups, APIVersions, Resources, etc.
	RuleApplyConfiguration `json:",inline"`
}

RuleWithOperationsApplyConfiguration represents a declarative configuration of the RuleWithOperations type for use with apply.

RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.

func RuleWithOperations ¶

func RuleWithOperations() *RuleWithOperationsApplyConfiguration

RuleWithOperationsApplyConfiguration constructs a declarative configuration of the RuleWithOperations type for use with apply.

func (*RuleWithOperationsApplyConfiguration) WithAPIGroups ¶

func (b *RuleWithOperationsApplyConfiguration) WithAPIGroups(values ...string) *RuleWithOperationsApplyConfiguration

func (*RuleWithOperationsApplyConfiguration) WithAPIVersions ¶

func (b *RuleWithOperationsApplyConfiguration) WithAPIVersions(values ...string) *RuleWithOperationsApplyConfiguration

func (*RuleWithOperationsApplyConfiguration) WithOperations ¶

func (b *RuleWithOperationsApplyConfiguration) WithOperations(values ...admissionregistrationv1.OperationType) *RuleWithOperationsApplyConfiguration

func (*RuleWithOperationsApplyConfiguration) WithResources ¶

func (b *RuleWithOperationsApplyConfiguration) WithResources(values ...string) *RuleWithOperationsApplyConfiguration

func (*RuleWithOperationsApplyConfiguration) WithScope ¶

func (b *RuleWithOperationsApplyConfiguration) WithScope(value admissionregistrationv1.ScopeType) *RuleWithOperationsApplyConfiguration

type ServiceReferenceApplyConfiguration ¶

type ServiceReferenceApplyConfiguration struct {
	// namespace is the namespace of the service.
	// Required
	Namespace *string `json:"namespace,omitempty"`
	// name is the name of the service.
	// Required
	Name *string `json:"name,omitempty"`
	// path is an optional URL path which will be sent in any request to
	// this service.
	Path *string `json:"path,omitempty"`
	// port is the port on the service that hosts the webhook.
	// Default to 443 for backward compatibility.
	// `port` should be a valid port number (1-65535, inclusive).
	Port *int32 `json:"port,omitempty"`
}

ServiceReferenceApplyConfiguration represents a declarative configuration of the ServiceReference type for use with apply.

ServiceReference holds a reference to Service.legacy.k8s.io

func ServiceReference ¶

func ServiceReference() *ServiceReferenceApplyConfiguration

ServiceReferenceApplyConfiguration constructs a declarative configuration of the ServiceReference type for use with apply.

func (*ServiceReferenceApplyConfiguration) WithName ¶

func (b *ServiceReferenceApplyConfiguration) WithName(value string) *ServiceReferenceApplyConfiguration

func (*ServiceReferenceApplyConfiguration) WithNamespace ¶

func (b *ServiceReferenceApplyConfiguration) WithNamespace(value string) *ServiceReferenceApplyConfiguration

func (*ServiceReferenceApplyConfiguration) WithPath ¶

func (b *ServiceReferenceApplyConfiguration) WithPath(value string) *ServiceReferenceApplyConfiguration

WithPath sets the Path field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Path field is set to the value of the last call.

func (*ServiceReferenceApplyConfiguration) WithPort ¶

func (b *ServiceReferenceApplyConfiguration) WithPort(value int32) *ServiceReferenceApplyConfiguration

WithPort sets the Port field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Port field is set to the value of the last call.

type TypeCheckingApplyConfiguration ¶

type TypeCheckingApplyConfiguration struct {
	// expressionWarnings contains the type checking warnings for each expression.
	ExpressionWarnings []ExpressionWarningApplyConfiguration `json:"expressionWarnings,omitempty"`
}

TypeCheckingApplyConfiguration represents a declarative configuration of the TypeChecking type for use with apply.

TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy

func TypeChecking ¶

func TypeChecking() *TypeCheckingApplyConfiguration

TypeCheckingApplyConfiguration constructs a declarative configuration of the TypeChecking type for use with apply.

func (*TypeCheckingApplyConfiguration) WithExpressionWarnings ¶

func (b *TypeCheckingApplyConfiguration) WithExpressionWarnings(values ...*ExpressionWarningApplyConfiguration) *TypeCheckingApplyConfiguration

WithExpressionWarnings adds the given value to the ExpressionWarnings field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the ExpressionWarnings field.

type ValidatingAdmissionPolicyApplyConfiguration ¶

type ValidatingAdmissionPolicyApplyConfiguration struct {
	metav1.TypeMetaApplyConfiguration `json:",inline"`
	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
	// spec defines the desired behavior of the ValidatingAdmissionPolicy.
	Spec *ValidatingAdmissionPolicySpecApplyConfiguration `json:"spec,omitempty"`
	// status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
	// behaves in the expected way.
	// Populated by the system.
	// Read-only.
	Status *ValidatingAdmissionPolicyStatusApplyConfiguration `json:"status,omitempty"`
}

ValidatingAdmissionPolicyApplyConfiguration represents a declarative configuration of the ValidatingAdmissionPolicy type for use with apply.

ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.

func ExtractValidatingAdmissionPolicy ¶

func ExtractValidatingAdmissionPolicy(validatingAdmissionPolicy *admissionregistrationv1.ValidatingAdmissionPolicy, fieldManager string) (*ValidatingAdmissionPolicyApplyConfiguration, error)

ExtractValidatingAdmissionPolicy extracts the applied configuration owned by fieldManager from validatingAdmissionPolicy. If no managedFields are found in validatingAdmissionPolicy for fieldManager, a ValidatingAdmissionPolicyApplyConfiguration is returned with only the Name, Namespace (if applicable), APIVersion and Kind populated. It is possible that no managed fields were found for because other field managers have taken ownership of all the fields previously owned by fieldManager, or because the fieldManager never owned fields any fields. validatingAdmissionPolicy must be a unmodified ValidatingAdmissionPolicy API object that was retrieved from the Kubernetes API. ExtractValidatingAdmissionPolicy provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func ExtractValidatingAdmissionPolicyFrom ¶

func ExtractValidatingAdmissionPolicyFrom(validatingAdmissionPolicy *admissionregistrationv1.ValidatingAdmissionPolicy, fieldManager string, subresource string) (*ValidatingAdmissionPolicyApplyConfiguration, error)

ExtractValidatingAdmissionPolicyFrom extracts the applied configuration owned by fieldManager from validatingAdmissionPolicy for the specified subresource. Pass an empty string for subresource to extract the main resource. Common subresources include "status", "scale", etc. validatingAdmissionPolicy must be a unmodified ValidatingAdmissionPolicy API object that was retrieved from the Kubernetes API. ExtractValidatingAdmissionPolicyFrom provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func ExtractValidatingAdmissionPolicyStatus ¶

func ExtractValidatingAdmissionPolicyStatus(validatingAdmissionPolicy *admissionregistrationv1.ValidatingAdmissionPolicy, fieldManager string) (*ValidatingAdmissionPolicyApplyConfiguration, error)

ExtractValidatingAdmissionPolicyStatus extracts the applied configuration owned by fieldManager from validatingAdmissionPolicy for the status subresource.

func ValidatingAdmissionPolicy ¶

func ValidatingAdmissionPolicy(name string) *ValidatingAdmissionPolicyApplyConfiguration

ValidatingAdmissionPolicy constructs a declarative configuration of the ValidatingAdmissionPolicy type for use with apply.

func (*ValidatingAdmissionPolicyApplyConfiguration) GetAPIVersion ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) GetAPIVersion() *string

GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.

func (*ValidatingAdmissionPolicyApplyConfiguration) GetKind ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) GetKind() *string

GetKind retrieves the value of the Kind field in the declarative configuration.

func (*ValidatingAdmissionPolicyApplyConfiguration) GetName ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) GetName() *string

GetName retrieves the value of the Name field in the declarative configuration.

func (*ValidatingAdmissionPolicyApplyConfiguration) GetNamespace ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) GetNamespace() *string

GetNamespace retrieves the value of the Namespace field in the declarative configuration.

func (ValidatingAdmissionPolicyApplyConfiguration) IsApplyConfiguration ¶

func (b ValidatingAdmissionPolicyApplyConfiguration) IsApplyConfiguration()

func (*ValidatingAdmissionPolicyApplyConfiguration) WithAPIVersion ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithAPIVersion(value string) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithAnnotations ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithAnnotations(entries map[string]string) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithCreationTimestamp ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithDeletionGracePeriodSeconds ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithDeletionTimestamp ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithFinalizers ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithFinalizers(values ...string) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithGenerateName ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithGenerateName(value string) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithGeneration ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithGeneration(value int64) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithKind ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithKind(value string) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithLabels ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithLabels(entries map[string]string) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithName ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithName(value string) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithNamespace ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithNamespace(value string) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithOwnerReferences ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithResourceVersion ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithResourceVersion(value string) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithSpec ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithSpec(value *ValidatingAdmissionPolicySpecApplyConfiguration) *ValidatingAdmissionPolicyApplyConfiguration

func (*ValidatingAdmissionPolicyApplyConfiguration) WithStatus ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithStatus(value *ValidatingAdmissionPolicyStatusApplyConfiguration) *ValidatingAdmissionPolicyApplyConfiguration

WithStatus sets the Status field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Status field is set to the value of the last call.

func (*ValidatingAdmissionPolicyApplyConfiguration) WithUID ¶

func (b *ValidatingAdmissionPolicyApplyConfiguration) WithUID(value types.UID) *ValidatingAdmissionPolicyApplyConfiguration

type ValidatingAdmissionPolicyBindingApplyConfiguration ¶

type ValidatingAdmissionPolicyBindingApplyConfiguration struct {
	metav1.TypeMetaApplyConfiguration `json:",inline"`
	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
	// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
	Spec *ValidatingAdmissionPolicyBindingSpecApplyConfiguration `json:"spec,omitempty"`
}

ValidatingAdmissionPolicyBindingApplyConfiguration represents a declarative configuration of the ValidatingAdmissionPolicyBinding type for use with apply.

ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.

The CEL expressions of a policy must have a computed CEL cost below the maximum CEL budget. Each evaluation of the policy is given an independent CEL cost budget. Adding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.

func ExtractValidatingAdmissionPolicyBinding ¶

func ExtractValidatingAdmissionPolicyBinding(validatingAdmissionPolicyBinding *admissionregistrationv1.ValidatingAdmissionPolicyBinding, fieldManager string) (*ValidatingAdmissionPolicyBindingApplyConfiguration, error)

ExtractValidatingAdmissionPolicyBinding extracts the applied configuration owned by fieldManager from validatingAdmissionPolicyBinding. If no managedFields are found in validatingAdmissionPolicyBinding for fieldManager, a ValidatingAdmissionPolicyBindingApplyConfiguration is returned with only the Name, Namespace (if applicable), APIVersion and Kind populated. It is possible that no managed fields were found for because other field managers have taken ownership of all the fields previously owned by fieldManager, or because the fieldManager never owned fields any fields. validatingAdmissionPolicyBinding must be a unmodified ValidatingAdmissionPolicyBinding API object that was retrieved from the Kubernetes API. ExtractValidatingAdmissionPolicyBinding provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func ExtractValidatingAdmissionPolicyBindingFrom ¶

func ExtractValidatingAdmissionPolicyBindingFrom(validatingAdmissionPolicyBinding *admissionregistrationv1.ValidatingAdmissionPolicyBinding, fieldManager string, subresource string) (*ValidatingAdmissionPolicyBindingApplyConfiguration, error)

ExtractValidatingAdmissionPolicyBindingFrom extracts the applied configuration owned by fieldManager from validatingAdmissionPolicyBinding for the specified subresource. Pass an empty string for subresource to extract the main resource. Common subresources include "status", "scale", etc. validatingAdmissionPolicyBinding must be a unmodified ValidatingAdmissionPolicyBinding API object that was retrieved from the Kubernetes API. ExtractValidatingAdmissionPolicyBindingFrom provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func ValidatingAdmissionPolicyBinding ¶

func ValidatingAdmissionPolicyBinding(name string) *ValidatingAdmissionPolicyBindingApplyConfiguration

ValidatingAdmissionPolicyBinding constructs a declarative configuration of the ValidatingAdmissionPolicyBinding type for use with apply.

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) GetAPIVersion ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) GetAPIVersion() *string

GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) GetKind ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) GetKind() *string

GetKind retrieves the value of the Kind field in the declarative configuration.

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) GetName ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) GetName() *string

GetName retrieves the value of the Name field in the declarative configuration.

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) GetNamespace ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) GetNamespace() *string

GetNamespace retrieves the value of the Namespace field in the declarative configuration.

func (ValidatingAdmissionPolicyBindingApplyConfiguration) IsApplyConfiguration ¶

func (b ValidatingAdmissionPolicyBindingApplyConfiguration) IsApplyConfiguration()

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithAPIVersion ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithAPIVersion(value string) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithAnnotations ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithAnnotations(entries map[string]string) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithCreationTimestamp ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithDeletionGracePeriodSeconds ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithDeletionTimestamp ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithFinalizers ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithFinalizers(values ...string) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithGenerateName ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithGenerateName(value string) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithGeneration ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithGeneration(value int64) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithKind ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithKind(value string) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithLabels ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithLabels(entries map[string]string) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithName ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithName(value string) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithNamespace ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithNamespace(value string) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithOwnerReferences ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithResourceVersion ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithResourceVersion(value string) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithSpec ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithSpec(value *ValidatingAdmissionPolicyBindingSpecApplyConfiguration) *ValidatingAdmissionPolicyBindingApplyConfiguration

func (*ValidatingAdmissionPolicyBindingApplyConfiguration) WithUID ¶

func (b *ValidatingAdmissionPolicyBindingApplyConfiguration) WithUID(value types.UID) *ValidatingAdmissionPolicyBindingApplyConfiguration

type ValidatingAdmissionPolicyBindingSpecApplyConfiguration ¶

type ValidatingAdmissionPolicyBindingSpecApplyConfiguration struct {
	// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
	// If the referenced resource does not exist, this binding is considered invalid and will be ignored
	// Required.
	PolicyName *string `json:"policyName,omitempty"`
	// paramRef specifies the parameter resource used to configure the admission control policy.
	// It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy.
	// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
	// If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
	ParamRef *ParamRefApplyConfiguration `json:"paramRef,omitempty"`
	// matchResources declares what resources match this binding and will be validated by it.
	// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
	// If this is unset, all resources matched by the policy are validated by this binding
	// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
	// Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
	MatchResources *MatchResourcesApplyConfiguration `json:"matchResources,omitempty"`
	// validationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced.
	// If a validation evaluates to false it is always enforced according to these actions.
	//
	// Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according
	// to these actions only if the FailurePolicy is set to Fail, otherwise the failures are
	// ignored. This includes compilation errors, runtime errors and misconfigurations of the policy.
	//
	// validationActions is declared as a set of action values. Order does
	// not matter. validationActions may not contain duplicates of the same action.
	//
	// The supported actions values are:
	//
	// "Deny" specifies that a validation failure results in a denied request.
	//
	// "Warn" specifies that a validation failure is reported to the request client
	// in HTTP Warning headers, with a warning code of 299. Warnings can be sent
	// both for allowed or denied admission responses.
	//
	// "Audit" specifies that a validation failure is included in the published
	// audit event for the request. The audit event will contain a
	// `validation.policy.admission.k8s.io/validation_failure` audit annotation
	// with a value containing the details of the validation failures, formatted as
	// a JSON list of objects, each with the following fields:
	// - message: The validation failure message string
	// - policy: The resource name of the ValidatingAdmissionPolicy
	// - binding: The resource name of the ValidatingAdmissionPolicyBinding
	// - expressionIndex: The index of the failed validations in the ValidatingAdmissionPolicy
	// - validationActions: The enforcement actions enacted for the validation failure
	// Example audit annotation:
	// `"validation.policy.admission.k8s.io/validation_failure": "[{\"message\": \"Invalid value\", {\"policy\": \"policy.example.com\", {\"binding\": \"policybinding.example.com\", {\"expressionIndex\": \"1\", {\"validationActions\": [\"Audit\"]}]"`
	//
	// Clients should expect to handle additional values by ignoring
	// any values not recognized.
	//
	// "Deny" and "Warn" may not be used together since this combination
	// needlessly duplicates the validation failure both in the
	// API response body and the HTTP warning headers.
	//
	// Required.
	ValidationActions []admissionregistrationv1.ValidationAction `json:"validationActions,omitempty"`
}

ValidatingAdmissionPolicyBindingSpecApplyConfiguration represents a declarative configuration of the ValidatingAdmissionPolicyBindingSpec type for use with apply.

ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.

func ValidatingAdmissionPolicyBindingSpec ¶

func ValidatingAdmissionPolicyBindingSpec() *ValidatingAdmissionPolicyBindingSpecApplyConfiguration

ValidatingAdmissionPolicyBindingSpecApplyConfiguration constructs a declarative configuration of the ValidatingAdmissionPolicyBindingSpec type for use with apply.

func (*ValidatingAdmissionPolicyBindingSpecApplyConfiguration) WithMatchResources ¶

func (b *ValidatingAdmissionPolicyBindingSpecApplyConfiguration) WithMatchResources(value *MatchResourcesApplyConfiguration) *ValidatingAdmissionPolicyBindingSpecApplyConfiguration

func (*ValidatingAdmissionPolicyBindingSpecApplyConfiguration) WithParamRef ¶

func (b *ValidatingAdmissionPolicyBindingSpecApplyConfiguration) WithParamRef(value *ParamRefApplyConfiguration) *ValidatingAdmissionPolicyBindingSpecApplyConfiguration

func (*ValidatingAdmissionPolicyBindingSpecApplyConfiguration) WithPolicyName ¶

func (b *ValidatingAdmissionPolicyBindingSpecApplyConfiguration) WithPolicyName(value string) *ValidatingAdmissionPolicyBindingSpecApplyConfiguration

func (*ValidatingAdmissionPolicyBindingSpecApplyConfiguration) WithValidationActions ¶

func (b *ValidatingAdmissionPolicyBindingSpecApplyConfiguration) WithValidationActions(values ...admissionregistrationv1.ValidationAction) *ValidatingAdmissionPolicyBindingSpecApplyConfiguration

WithValidationActions adds the given value to the ValidationActions field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the ValidationActions field.

type ValidatingAdmissionPolicySpecApplyConfiguration ¶

type ValidatingAdmissionPolicySpecApplyConfiguration struct {
	// paramKind specifies the kind of resources used to parameterize this policy.
	// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
	// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
	// If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
	ParamKind *ParamKindApplyConfiguration `json:"paramKind,omitempty"`
	// matchConstraints specifies what resources this policy is designed to validate.
	// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
	// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
	// ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
	// Required.
	MatchConstraints *MatchResourcesApplyConfiguration `json:"matchConstraints,omitempty"`
	// validations contain CEL expressions which is used to apply the validation.
	// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
	// required.
	Validations []ValidationApplyConfiguration `json:"validations,omitempty"`
	// failurePolicy defines how to handle failures for the admission policy. Failures can
	// occur from CEL expression parse errors, type check errors, runtime errors and invalid
	// or mis-configured policy definitions or bindings.
	//
	// A policy is invalid if spec.paramKind refers to a non-existent Kind.
	// A binding is invalid if spec.paramRef.name refers to a non-existent resource.
	//
	// failurePolicy does not define how validations that evaluate to false are handled.
	//
	// When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions
	// define how failures are enforced.
	//
	// Allowed values are Ignore or Fail. Defaults to Fail.
	FailurePolicy *admissionregistrationv1.FailurePolicyType `json:"failurePolicy,omitempty"`
	// auditAnnotations contains CEL expressions which are used to produce audit
	// annotations for the audit event of the API request.
	// validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is
	// required.
	AuditAnnotations []AuditAnnotationApplyConfiguration `json:"auditAnnotations,omitempty"`
	// matchConditions is a list of conditions that must be met for a request to be validated.
	// Match conditions filter requests that have already been matched by the rules,
	// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
	// There are a maximum of 64 match conditions allowed.
	//
	// If a parameter object is provided, it can be accessed via the `params` handle in the same
	// manner as validation expressions.
	//
	// The exact matching logic is (in order):
	// 1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
	// 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
	// 3. If any matchCondition evaluates to an error (but none are FALSE):
	// - If failurePolicy=Fail, reject the request
	// - If failurePolicy=Ignore, the policy is skipped
	MatchConditions []MatchConditionApplyConfiguration `json:"matchConditions,omitempty"`
	// variables contain definitions of variables that can be used in composition of other expressions.
	// Each variable is defined as a named CEL expression.
	// The variables defined here will be available under `variables` in other expressions of the policy
	// except MatchConditions because MatchConditions are evaluated before the rest of the policy.
	//
	// The expression of a variable can refer to other variables defined earlier in the list but not those after.
	// Thus, Variables must be sorted by the order of first appearance and acyclic.
	Variables []VariableApplyConfiguration `json:"variables,omitempty"`
}

ValidatingAdmissionPolicySpecApplyConfiguration represents a declarative configuration of the ValidatingAdmissionPolicySpec type for use with apply.

ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.

func ValidatingAdmissionPolicySpec ¶

func ValidatingAdmissionPolicySpec() *ValidatingAdmissionPolicySpecApplyConfiguration

ValidatingAdmissionPolicySpecApplyConfiguration constructs a declarative configuration of the ValidatingAdmissionPolicySpec type for use with apply.

func (*ValidatingAdmissionPolicySpecApplyConfiguration) WithAuditAnnotations ¶

func (b *ValidatingAdmissionPolicySpecApplyConfiguration) WithAuditAnnotations(values ...*AuditAnnotationApplyConfiguration) *ValidatingAdmissionPolicySpecApplyConfiguration

WithAuditAnnotations adds the given value to the AuditAnnotations field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the AuditAnnotations field.

func (*ValidatingAdmissionPolicySpecApplyConfiguration) WithFailurePolicy ¶

func (b *ValidatingAdmissionPolicySpecApplyConfiguration) WithFailurePolicy(value admissionregistrationv1.FailurePolicyType) *ValidatingAdmissionPolicySpecApplyConfiguration

func (*ValidatingAdmissionPolicySpecApplyConfiguration) WithMatchConditions ¶

func (b *ValidatingAdmissionPolicySpecApplyConfiguration) WithMatchConditions(values ...*MatchConditionApplyConfiguration) *ValidatingAdmissionPolicySpecApplyConfiguration

func (*ValidatingAdmissionPolicySpecApplyConfiguration) WithMatchConstraints ¶

func (b *ValidatingAdmissionPolicySpecApplyConfiguration) WithMatchConstraints(value *MatchResourcesApplyConfiguration) *ValidatingAdmissionPolicySpecApplyConfiguration

func (*ValidatingAdmissionPolicySpecApplyConfiguration) WithParamKind ¶

func (b *ValidatingAdmissionPolicySpecApplyConfiguration) WithParamKind(value *ParamKindApplyConfiguration) *ValidatingAdmissionPolicySpecApplyConfiguration

func (*ValidatingAdmissionPolicySpecApplyConfiguration) WithValidations ¶

func (b *ValidatingAdmissionPolicySpecApplyConfiguration) WithValidations(values ...*ValidationApplyConfiguration) *ValidatingAdmissionPolicySpecApplyConfiguration

WithValidations adds the given value to the Validations field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the Validations field.

func (*ValidatingAdmissionPolicySpecApplyConfiguration) WithVariables ¶

func (b *ValidatingAdmissionPolicySpecApplyConfiguration) WithVariables(values ...*VariableApplyConfiguration) *ValidatingAdmissionPolicySpecApplyConfiguration

type ValidatingAdmissionPolicyStatusApplyConfiguration ¶

type ValidatingAdmissionPolicyStatusApplyConfiguration struct {
	// observedGeneration is the generation observed by the controller.
	ObservedGeneration *int64 `json:"observedGeneration,omitempty"`
	// typeChecking contains the results of type checking for each expression.
	// Presence of this field indicates the completion of the type checking.
	TypeChecking *TypeCheckingApplyConfiguration `json:"typeChecking,omitempty"`
	// conditions represent the latest available observations of a policy's current state.
	Conditions []metav1.ConditionApplyConfiguration `json:"conditions,omitempty"`
}

ValidatingAdmissionPolicyStatusApplyConfiguration represents a declarative configuration of the ValidatingAdmissionPolicyStatus type for use with apply.

ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.

func ValidatingAdmissionPolicyStatus ¶

func ValidatingAdmissionPolicyStatus() *ValidatingAdmissionPolicyStatusApplyConfiguration

ValidatingAdmissionPolicyStatusApplyConfiguration constructs a declarative configuration of the ValidatingAdmissionPolicyStatus type for use with apply.

func (*ValidatingAdmissionPolicyStatusApplyConfiguration) WithConditions ¶

func (b *ValidatingAdmissionPolicyStatusApplyConfiguration) WithConditions(values ...*metav1.ConditionApplyConfiguration) *ValidatingAdmissionPolicyStatusApplyConfiguration

WithConditions adds the given value to the Conditions field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the Conditions field.

func (*ValidatingAdmissionPolicyStatusApplyConfiguration) WithObservedGeneration ¶

func (b *ValidatingAdmissionPolicyStatusApplyConfiguration) WithObservedGeneration(value int64) *ValidatingAdmissionPolicyStatusApplyConfiguration

WithObservedGeneration sets the ObservedGeneration field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the ObservedGeneration field is set to the value of the last call.

func (*ValidatingAdmissionPolicyStatusApplyConfiguration) WithTypeChecking ¶

func (b *ValidatingAdmissionPolicyStatusApplyConfiguration) WithTypeChecking(value *TypeCheckingApplyConfiguration) *ValidatingAdmissionPolicyStatusApplyConfiguration

WithTypeChecking sets the TypeChecking field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the TypeChecking field is set to the value of the last call.

type ValidatingWebhookApplyConfiguration ¶

type ValidatingWebhookApplyConfiguration struct {
	// name is the name of the admission webhook.
	// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
	// "imagepolicy" is the name of the webhook, and kubernetes.io is the name
	// of the organization.
	// Required.
	Name *string `json:"name,omitempty"`
	// clientConfig defines how to communicate with the hook.
	// Required
	ClientConfig *WebhookClientConfigApplyConfiguration `json:"clientConfig,omitempty"`
	// rules describes what operations on what resources/subresources the webhook cares about.
	// The webhook cares about an operation if it matches _any_ Rule.
	// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
	// from putting the cluster in a state which cannot be recovered from without completely
	// disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
	// on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
	Rules []RuleWithOperationsApplyConfiguration `json:"rules,omitempty"`
	// failurePolicy defines how unrecognized errors from the admission endpoint are handled -
	// allowed values are Ignore or Fail. Defaults to Fail.
	FailurePolicy *admissionregistrationv1.FailurePolicyType `json:"failurePolicy,omitempty"`
	// matchPolicy defines how the "rules" list is used to match incoming requests.
	// Allowed values are "Exact" or "Equivalent".
	//
	// - Exact: match a request only if it exactly matches a specified rule.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
	//
	// - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
	// and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
	// a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
	//
	// Defaults to "Equivalent"
	MatchPolicy *admissionregistrationv1.MatchPolicyType `json:"matchPolicy,omitempty"`
	// namespaceSelector decides whether to run the webhook on an object based
	// on whether the namespace for that object matches the selector. If the
	// object itself is a namespace, the matching is performed on
	// object.metadata.labels. If the object is another cluster scoped resource,
	// it never skips the webhook.
	//
	// For example, to run the webhook on any objects whose namespace is not
	// associated with "runlevel" of "0" or "1";  you will set the selector as
	// follows:
	// "namespaceSelector": {
	// "matchExpressions": [
	// {
	// "key": "runlevel",
	// "operator": "NotIn",
	// "values": [
	// "0",
	// "1"
	// ]
	// }
	// ]
	// }
	//
	// If instead you want to only run the webhook on any objects whose
	// namespace is associated with the "environment" of "prod" or "staging";
	// you will set the selector as follows:
	// "namespaceSelector": {
	// "matchExpressions": [
	// {
	// "key": "environment",
	// "operator": "In",
	// "values": [
	// "prod",
	// "staging"
	// ]
	// }
	// ]
	// }
	//
	// See
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
	// for more examples of label selectors.
	//
	// Default to the empty LabelSelector, which matches everything.
	NamespaceSelector *metav1.LabelSelectorApplyConfiguration `json:"namespaceSelector,omitempty"`
	// objectSelector decides whether to run the webhook based on if the
	// object has matching labels. objectSelector is evaluated against both
	// the oldObject and newObject that would be sent to the webhook, and
	// is considered to match if either object matches the selector. A null
	// object (oldObject in the case of create, or newObject in the case of
	// delete) or an object that cannot have labels (like a
	// DeploymentRollback or a PodProxyOptions object) is not considered to
	// match.
	// Use the object selector only if the webhook is opt-in, because end
	// users may skip the admission webhook by setting the labels.
	// Default to the empty LabelSelector, which matches everything.
	ObjectSelector *metav1.LabelSelectorApplyConfiguration `json:"objectSelector,omitempty"`
	// sideEffects states whether this webhook has side effects.
	// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
	// Webhooks with side effects MUST implement a reconciliation system, since a request may be
	// rejected by a future step in the admission chain and the side effects therefore need to be undone.
	// Requests with the dryRun attribute will be auto-rejected if they match a webhook with
	// sideEffects == Unknown or Some.
	SideEffects *admissionregistrationv1.SideEffectClass `json:"sideEffects,omitempty"`
	// timeoutSeconds specifies the timeout for this webhook. After the timeout passes,
	// the webhook call will be ignored or the API call will fail based on the
	// failure policy.
	// The timeout value must be between 1 and 30 seconds.
	// Default to 10 seconds.
	TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty"`
	// admissionReviewVersions is an ordered list of preferred `AdmissionReview`
	// versions the Webhook expects. API server will try to use first version in
	// the list which it supports. If none of the versions specified in this list
	// supported by API server, validation will fail for this object.
	// If a persisted webhook configuration specifies allowed versions and does not
	// include any versions known to the API Server, calls to the webhook will fail
	// and be subject to the failure policy.
	AdmissionReviewVersions []string `json:"admissionReviewVersions,omitempty"`
	// matchConditions is a list of conditions that must be met for a request to be sent to this
	// webhook. Match conditions filter requests that have already been matched by the rules,
	// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
	// There are a maximum of 64 match conditions allowed.
	//
	// The exact matching logic is (in order):
	// 1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.
	// 2. If ALL matchConditions evaluate to TRUE, the webhook is called.
	// 3. If any matchCondition evaluates to an error (but none are FALSE):
	// - If failurePolicy=Fail, reject the request
	// - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
	MatchConditions []MatchConditionApplyConfiguration `json:"matchConditions,omitempty"`
}

ValidatingWebhookApplyConfiguration represents a declarative configuration of the ValidatingWebhook type for use with apply.

ValidatingWebhook describes an admission webhook and the resources and operations it applies to.

func ValidatingWebhook ¶

func ValidatingWebhook() *ValidatingWebhookApplyConfiguration

ValidatingWebhookApplyConfiguration constructs a declarative configuration of the ValidatingWebhook type for use with apply.

func (*ValidatingWebhookApplyConfiguration) WithAdmissionReviewVersions ¶

func (b *ValidatingWebhookApplyConfiguration) WithAdmissionReviewVersions(values ...string) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithClientConfig ¶

func (b *ValidatingWebhookApplyConfiguration) WithClientConfig(value *WebhookClientConfigApplyConfiguration) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithFailurePolicy ¶

func (b *ValidatingWebhookApplyConfiguration) WithFailurePolicy(value admissionregistrationv1.FailurePolicyType) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithMatchConditions ¶

func (b *ValidatingWebhookApplyConfiguration) WithMatchConditions(values ...*MatchConditionApplyConfiguration) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithMatchPolicy ¶

func (b *ValidatingWebhookApplyConfiguration) WithMatchPolicy(value admissionregistrationv1.MatchPolicyType) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithName ¶

func (b *ValidatingWebhookApplyConfiguration) WithName(value string) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithNamespaceSelector ¶

func (b *ValidatingWebhookApplyConfiguration) WithNamespaceSelector(value *metav1.LabelSelectorApplyConfiguration) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithObjectSelector ¶

func (b *ValidatingWebhookApplyConfiguration) WithObjectSelector(value *metav1.LabelSelectorApplyConfiguration) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithRules ¶

func (b *ValidatingWebhookApplyConfiguration) WithRules(values ...*RuleWithOperationsApplyConfiguration) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithSideEffects ¶

func (b *ValidatingWebhookApplyConfiguration) WithSideEffects(value admissionregistrationv1.SideEffectClass) *ValidatingWebhookApplyConfiguration

func (*ValidatingWebhookApplyConfiguration) WithTimeoutSeconds ¶

func (b *ValidatingWebhookApplyConfiguration) WithTimeoutSeconds(value int32) *ValidatingWebhookApplyConfiguration

type ValidatingWebhookConfigurationApplyConfiguration ¶

type ValidatingWebhookConfigurationApplyConfiguration struct {
	metav1.TypeMetaApplyConfiguration `json:",inline"`
	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
	// webhooks is a list of webhooks and the affected resources and operations.
	Webhooks []ValidatingWebhookApplyConfiguration `json:"webhooks,omitempty"`
}

ValidatingWebhookConfigurationApplyConfiguration represents a declarative configuration of the ValidatingWebhookConfiguration type for use with apply.

ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.

func ExtractValidatingWebhookConfiguration ¶

func ExtractValidatingWebhookConfiguration(validatingWebhookConfiguration *admissionregistrationv1.ValidatingWebhookConfiguration, fieldManager string) (*ValidatingWebhookConfigurationApplyConfiguration, error)

ExtractValidatingWebhookConfiguration extracts the applied configuration owned by fieldManager from validatingWebhookConfiguration. If no managedFields are found in validatingWebhookConfiguration for fieldManager, a ValidatingWebhookConfigurationApplyConfiguration is returned with only the Name, Namespace (if applicable), APIVersion and Kind populated. It is possible that no managed fields were found for because other field managers have taken ownership of all the fields previously owned by fieldManager, or because the fieldManager never owned fields any fields. validatingWebhookConfiguration must be a unmodified ValidatingWebhookConfiguration API object that was retrieved from the Kubernetes API. ExtractValidatingWebhookConfiguration provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func ExtractValidatingWebhookConfigurationFrom ¶

func ExtractValidatingWebhookConfigurationFrom(validatingWebhookConfiguration *admissionregistrationv1.ValidatingWebhookConfiguration, fieldManager string, subresource string) (*ValidatingWebhookConfigurationApplyConfiguration, error)

ExtractValidatingWebhookConfigurationFrom extracts the applied configuration owned by fieldManager from validatingWebhookConfiguration for the specified subresource. Pass an empty string for subresource to extract the main resource. Common subresources include "status", "scale", etc. validatingWebhookConfiguration must be a unmodified ValidatingWebhookConfiguration API object that was retrieved from the Kubernetes API. ExtractValidatingWebhookConfigurationFrom provides a way to perform a extract/modify-in-place/apply workflow. Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously applied if another fieldManager has updated or force applied any of the previously applied fields.

func ValidatingWebhookConfiguration ¶

func ValidatingWebhookConfiguration(name string) *ValidatingWebhookConfigurationApplyConfiguration

ValidatingWebhookConfiguration constructs a declarative configuration of the ValidatingWebhookConfiguration type for use with apply.

func (*ValidatingWebhookConfigurationApplyConfiguration) GetAPIVersion ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) GetAPIVersion() *string

GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.

func (*ValidatingWebhookConfigurationApplyConfiguration) GetKind ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) GetKind() *string

GetKind retrieves the value of the Kind field in the declarative configuration.

func (*ValidatingWebhookConfigurationApplyConfiguration) GetName ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) GetName() *string

GetName retrieves the value of the Name field in the declarative configuration.

func (*ValidatingWebhookConfigurationApplyConfiguration) GetNamespace ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) GetNamespace() *string

GetNamespace retrieves the value of the Namespace field in the declarative configuration.

func (ValidatingWebhookConfigurationApplyConfiguration) IsApplyConfiguration ¶

func (b ValidatingWebhookConfigurationApplyConfiguration) IsApplyConfiguration()

func (*ValidatingWebhookConfigurationApplyConfiguration) WithAPIVersion ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithAPIVersion(value string) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithAnnotations ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithAnnotations(entries map[string]string) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithCreationTimestamp ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithDeletionGracePeriodSeconds ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithDeletionTimestamp ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithFinalizers ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithFinalizers(values ...string) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithGenerateName ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithGenerateName(value string) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithGeneration ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithGeneration(value int64) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithKind ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithKind(value string) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithLabels ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithLabels(entries map[string]string) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithName ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithName(value string) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithNamespace ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithNamespace(value string) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithOwnerReferences ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithResourceVersion ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithResourceVersion(value string) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithUID ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithUID(value types.UID) *ValidatingWebhookConfigurationApplyConfiguration

func (*ValidatingWebhookConfigurationApplyConfiguration) WithWebhooks ¶

func (b *ValidatingWebhookConfigurationApplyConfiguration) WithWebhooks(values ...*ValidatingWebhookApplyConfiguration) *ValidatingWebhookConfigurationApplyConfiguration

type ValidationApplyConfiguration ¶

type ValidationApplyConfiguration struct {
	// expression represents the expression which will be evaluated by CEL.
	// ref: https://github.com/google/cel-spec
	// CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:
	//
	// - 'object' - The object from the incoming request. The value is null for DELETE requests.
	// - 'oldObject' - The existing object. The value is null for CREATE requests.
	// - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
	// - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
	// - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.
	// - 'variables' - Map of composited variables, from its name to its lazily evaluated value.
	// For example, a variable named 'foo' can be accessed as 'variables.foo'.
	// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
	// See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
	// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
	// request resource.
	//
	// The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the
	// object. No other metadata properties are accessible.
	//
	// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
	// Accessible property names are escaped according to the following rules when accessed in the expression:
	// - '__' escapes to '__underscores__'
	// - '.' escapes to '__dot__'
	// - '-' escapes to '__dash__'
	// - '/' escapes to '__slash__'
	// - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:
	// "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if",
	// "import", "let", "loop", "package", "namespace", "return".
	// Examples:
	// - Expression accessing a property named "namespace": {"Expression": "object.__namespace__ > 0"}
	// - Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
	// - Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}
	//
	// Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].
	// Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:
	// - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and
	// non-intersecting elements in `Y` are appended, retaining their partial order.
	// - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values
	// are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with
	// non-intersecting keys are appended, retaining their partial order.
	// Required.
	Expression *string `json:"expression,omitempty"`
	// message represents the message displayed when validation fails. The message is required if the Expression contains
	// line breaks. The message must not contain line breaks.
	// If unset, the message is "failed rule: {Rule}".
	// e.g. "must be a URL with the host matching spec.host"
	// If the Expression contains line breaks. Message is required.
	// The message must not contain line breaks.
	// If unset, the message is "failed Expression: {Expression}".
	Message *string `json:"message,omitempty"`
	// reason represents a machine-readable description of why this validation failed.
	// If this is the first validation in the list to fail, this reason, as well as the
	// corresponding HTTP response code, are used in the
	// HTTP response to the client.
	// The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge".
	// If not set, StatusReasonInvalid is used in the response to the client.
	Reason *metav1.StatusReason `json:"reason,omitempty"`
	// messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.
	// Since messageExpression is used as a failure message, it must evaluate to a string.
	// If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails.
	// If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
	// as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string
	// that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and
	// the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged.
	// messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'.
	// Example:
	// "object.x must be less than max ("+string(params.max)+")"
	MessageExpression *string `json:"messageExpression,omitempty"`
}

ValidationApplyConfiguration represents a declarative configuration of the Validation type for use with apply.

Validation specifies the CEL expression which is used to apply the validation.

func Validation ¶

func Validation() *ValidationApplyConfiguration

ValidationApplyConfiguration constructs a declarative configuration of the Validation type for use with apply.

func (*ValidationApplyConfiguration) WithExpression ¶

func (b *ValidationApplyConfiguration) WithExpression(value string) *ValidationApplyConfiguration

func (*ValidationApplyConfiguration) WithMessage ¶

func (b *ValidationApplyConfiguration) WithMessage(value string) *ValidationApplyConfiguration

WithMessage sets the Message field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Message field is set to the value of the last call.

func (*ValidationApplyConfiguration) WithMessageExpression ¶

func (b *ValidationApplyConfiguration) WithMessageExpression(value string) *ValidationApplyConfiguration

WithMessageExpression sets the MessageExpression field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the MessageExpression field is set to the value of the last call.

func (*ValidationApplyConfiguration) WithReason ¶

func (b *ValidationApplyConfiguration) WithReason(value metav1.StatusReason) *ValidationApplyConfiguration

WithReason sets the Reason field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Reason field is set to the value of the last call.

type VariableApplyConfiguration ¶

type VariableApplyConfiguration struct {
	// name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
	// The variable can be accessed in other expressions through `variables`
	// For example, if name is "foo", the variable will be available as `variables.foo`
	Name *string `json:"name,omitempty"`
	// expression is the expression that will be evaluated as the value of the variable.
	// The CEL expression has access to the same identifiers as the CEL expressions in Validation.
	Expression *string `json:"expression,omitempty"`
}

VariableApplyConfiguration represents a declarative configuration of the Variable type for use with apply.

Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.

func Variable ¶

func Variable() *VariableApplyConfiguration

VariableApplyConfiguration constructs a declarative configuration of the Variable type for use with apply.

func (*VariableApplyConfiguration) WithExpression ¶

func (b *VariableApplyConfiguration) WithExpression(value string) *VariableApplyConfiguration

func (*VariableApplyConfiguration) WithName ¶

func (b *VariableApplyConfiguration) WithName(value string) *VariableApplyConfiguration

type WebhookClientConfigApplyConfiguration ¶

type WebhookClientConfigApplyConfiguration struct {
	// url gives the location of the webhook, in standard URL form
	// (`scheme://host:port/path`). Exactly one of `url` or `service`
	// must be specified.
	//
	// The `host` should not refer to a service running in the cluster; use
	// the `service` field instead. The host might be resolved via external
	// DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
	// in-cluster DNS as that would be a layering violation). `host` may
	// also be an IP address.
	//
	// Please note that using `localhost` or `127.0.0.1` as a `host` is
	// risky unless you take great care to run this webhook on all hosts
	// which run an apiserver which might need to make calls to this
	// webhook. Such installs are likely to be non-portable, i.e., not easy
	// to turn up in a new cluster.
	//
	// The scheme must be "https"; the URL must begin with "https://".
	//
	// A path is optional, and if present may be any string permissible in
	// a URL. You may use the path to pass an arbitrary string to the
	// webhook, for example, a cluster identifier.
	//
	// Attempting to use a user or basic auth e.g. "user:password@" is not
	// allowed. Fragments ("#...") and query parameters ("?...") are not
	// allowed, either.
	URL *string `json:"url,omitempty"`
	// service is a reference to the service for this webhook. Either
	// `service` or `url` must be specified.
	//
	// If the webhook is running within the cluster, then you should use `service`.
	Service *ServiceReferenceApplyConfiguration `json:"service,omitempty"`
	// caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
	// If unspecified, system trust roots on the apiserver are used.
	CABundle []byte `json:"caBundle,omitempty"`
}

WebhookClientConfigApplyConfiguration represents a declarative configuration of the WebhookClientConfig type for use with apply.

WebhookClientConfig contains the information to make a TLS connection with the webhook

func WebhookClientConfig ¶

func WebhookClientConfig() *WebhookClientConfigApplyConfiguration

WebhookClientConfigApplyConfiguration constructs a declarative configuration of the WebhookClientConfig type for use with apply.

func (*WebhookClientConfigApplyConfiguration) WithCABundle ¶

func (b *WebhookClientConfigApplyConfiguration) WithCABundle(values ...byte) *WebhookClientConfigApplyConfiguration

WithCABundle adds the given value to the CABundle field in the declarative configuration and returns the receiver, so that objects can be build by chaining "With" function invocations. If called multiple times, values provided by each call will be appended to the CABundle field.

func (*WebhookClientConfigApplyConfiguration) WithService ¶

func (b *WebhookClientConfigApplyConfiguration) WithService(value *ServiceReferenceApplyConfiguration) *WebhookClientConfigApplyConfiguration

WithService sets the Service field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the Service field is set to the value of the last call.

func (*WebhookClientConfigApplyConfiguration) WithURL ¶

func (b *WebhookClientConfigApplyConfiguration) WithURL(value string) *WebhookClientConfigApplyConfiguration

WithURL sets the URL field in the declarative configuration to the given value and returns the receiver, so that objects can be built by chaining "With" function invocations. If called multiple times, the URL field is set to the value of the last call.

Source Files ¶

applyconfiguration.go auditannotation.go expressionwarning.go jsonpatch.go matchcondition.go matchresources.go mutatingadmissionpolicy.go mutatingadmissionpolicybinding.go mutatingadmissionpolicybindingspec.go mutatingadmissionpolicyspec.go mutatingwebhook.go mutatingwebhookconfiguration.go mutation.go namedrulewithoperations.go paramkind.go paramref.go rule.go rulewithoperations.go servicereference.go typechecking.go validatingadmissionpolicy.go validatingadmissionpolicybinding.go validatingadmissionpolicybindingspec.go validatingadmissionpolicyspec.go validatingadmissionpolicystatus.go validatingwebhook.go validatingwebhookconfiguration.go validation.go variable.go webhookclientconfig.go

Version: v0.36.0 (latest)
Published: Apr 22, 2026
Platform: linux/amd64
Imports: 6 packages
Last checked: 2 minutes ago –

Tools for package owners.

?	: This menu
/	: Search site
f	: Jump to identifier
g then g	: Go to top of page
g then b	: Go to end of page
G	: Go to end of page
g then i	: Go to index
g then e	: Go to examples