Documentation
¶
Index ¶
- type ActionType
- type ImagePullPolicySpec
- type NamespaceRuleBodyNamespace
- type NamespaceRuleBodyTenant
- type NamespaceRuleEnforceBody
- func (in *NamespaceRuleEnforceBody) DeepCopy() *NamespaceRuleEnforceBody
- func (in *NamespaceRuleEnforceBody) DeepCopyInto(out *NamespaceRuleEnforceBody)
- func (e NamespaceRuleEnforceBody) GetWorkloadTargets(target WorkloadValidationTarget) bool
- func (e NamespaceRuleEnforceBody) WorkloadTargetsAny(targets ...WorkloadValidationTarget) bool
- type NamespaceRuleEnforceWorkloadsBody
- type NamespaceRulePermissionBody
- type NamespaceRulePromotionRule
- type OCIRegistry
- type RuleDecision
- type WorkloadValidationTarget
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ActionType ¶
type ActionType string
+kubebuilder:validation:Enum=allow;deny;audit
const ( ActionTypeAllow ActionType = "allow" ActionTypeDeny ActionType = "deny" ActionTypeAudit ActionType = "audit" )
func (ActionType) OrDefault ¶
func (a ActionType) OrDefault() ActionType
type ImagePullPolicySpec ¶
type ImagePullPolicySpec string
+kubebuilder:validation:Enum=Always;Never;IfNotPresent
func (ImagePullPolicySpec) String ¶
func (i ImagePullPolicySpec) String() string
type NamespaceRuleBodyNamespace ¶
type NamespaceRuleBodyNamespace struct {
// Enforcement for given rule
//+optional
Enforce *NamespaceRuleEnforceBody `json:"enforce,omitzero"`
}
For future implementation where users might manage RuleStatus CRs themselves +kubebuilder:object:generate=true
func (*NamespaceRuleBodyNamespace) DeepCopy ¶
func (in *NamespaceRuleBodyNamespace) DeepCopy() *NamespaceRuleBodyNamespace
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespaceRuleBodyNamespace.
func (*NamespaceRuleBodyNamespace) DeepCopyInto ¶
func (in *NamespaceRuleBodyNamespace) DeepCopyInto(out *NamespaceRuleBodyNamespace)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NamespaceRuleBodyTenant ¶
type NamespaceRuleBodyTenant struct {
*NamespaceRuleBodyNamespace `json:",inline"`
// Select namespaces which are going to be targeted with this rule
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
// Permissions for given rule
//+optional
Permissions NamespaceRulePermissionBody `json:"permissions,omitempty"`
}
Rules Distributed via Tenants +kubebuilder:object:generate=true
func (*NamespaceRuleBodyTenant) DeepCopy ¶
func (in *NamespaceRuleBodyTenant) DeepCopy() *NamespaceRuleBodyTenant
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespaceRuleBodyTenant.
func (*NamespaceRuleBodyTenant) DeepCopyInto ¶
func (in *NamespaceRuleBodyTenant) DeepCopyInto(out *NamespaceRuleBodyTenant)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NamespaceRuleEnforceBody ¶
type NamespaceRuleEnforceBody struct {
// Declare the action being performed on the enforcement rule:
// deny: On match, deny admission request
// allow: On match, allowed admission request
// audit: On match, audit (post event) of admission request
//+kubebuilder:default:=deny
Action ActionType `json:"action,omitempty"`
// Enforcement for Workloads (Pods)
Workloads NamespaceRuleEnforceWorkloadsBody `json:"workloads,omitempty"`
}
+kubebuilder:object:generate=true
func (*NamespaceRuleEnforceBody) DeepCopy ¶
func (in *NamespaceRuleEnforceBody) DeepCopy() *NamespaceRuleEnforceBody
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespaceRuleEnforceBody.
func (*NamespaceRuleEnforceBody) DeepCopyInto ¶
func (in *NamespaceRuleEnforceBody) DeepCopyInto(out *NamespaceRuleEnforceBody)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (NamespaceRuleEnforceBody) GetWorkloadTargets ¶
func (e NamespaceRuleEnforceBody) GetWorkloadTargets(target WorkloadValidationTarget) bool
func (NamespaceRuleEnforceBody) WorkloadTargetsAny ¶
func (e NamespaceRuleEnforceBody) WorkloadTargetsAny(targets ...WorkloadValidationTarget) bool
type NamespaceRuleEnforceWorkloadsBody ¶
type NamespaceRuleEnforceWorkloadsBody struct {
// Define the enforcement targets this rule applies to.
// If empty, each webhook applies its own backwards-compatible default.
// +optional
Targets []WorkloadValidationTarget `json:"targets,omitempty"`
// Define Pod QoS classes matched by this enforcement rule.
// Supported values are Guaranteed, Burstable and BestEffort.
// +optional
QoSClasses []corev1.PodQOSClass `json:"qosClasses,omitempty"`
// Define registries which are allowed to be used within this tenant
// The rules are aggregated, since you can use Regular Expressions the match registry endpoints
Registries []OCIRegistry `json:"registries,omitempty"`
}
+kubebuilder:object:generate=true
func (*NamespaceRuleEnforceWorkloadsBody) DeepCopy ¶
func (in *NamespaceRuleEnforceWorkloadsBody) DeepCopy() *NamespaceRuleEnforceWorkloadsBody
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespaceRuleEnforceWorkloadsBody.
func (*NamespaceRuleEnforceWorkloadsBody) DeepCopyInto ¶
func (in *NamespaceRuleEnforceWorkloadsBody) DeepCopyInto(out *NamespaceRuleEnforceWorkloadsBody)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NamespaceRulePermissionBody ¶
type NamespaceRulePermissionBody struct {
// Define Promotion Rules which distributed additional ClusterRoles across the Tenant
// for promoted ServiceAccounts.
Promotions []*NamespaceRulePromotionRule `json:"promotions,omitempty"`
}
+kubebuilder:object:generate=true
func (*NamespaceRulePermissionBody) DeepCopy ¶
func (in *NamespaceRulePermissionBody) DeepCopy() *NamespaceRulePermissionBody
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespaceRulePermissionBody.
func (*NamespaceRulePermissionBody) DeepCopyInto ¶
func (in *NamespaceRulePermissionBody) DeepCopyInto(out *NamespaceRulePermissionBody)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NamespaceRulePromotionRule ¶
type NamespaceRulePromotionRule struct {
// ClusterRoles granted to the promoted ServiceAccounts across the Tenant
// kubebuilder:validation:Minimum=1
ClusterRoles []string `json:"clusterRoles,omitempty"`
// Match ServiceAccounts which are promoted which are granted these additional ClusterRoles
// across the Tenant
Selector *metav1.LabelSelector `json:"selector,omitempty"`
}
+kubebuilder:object:generate=true
func (*NamespaceRulePromotionRule) DeepCopy ¶
func (in *NamespaceRulePromotionRule) DeepCopy() *NamespaceRulePromotionRule
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespaceRulePromotionRule.
func (*NamespaceRulePromotionRule) DeepCopyInto ¶
func (in *NamespaceRulePromotionRule) DeepCopyInto(out *NamespaceRulePromotionRule)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type OCIRegistry ¶
type OCIRegistry struct {
api.RegExpression `json:",inline"`
// Allowed PullPolicy for the given registry. Supplying no value allows all policies.
// +optional
// +kubebuilder:validation:Items:Enum=Always;Never;IfNotPresent
Policy []corev1.PullPolicy `json:"policy,omitempty"`
}
+kubebuilder:object:generate=true
func (*OCIRegistry) DeepCopy ¶
func (in *OCIRegistry) DeepCopy() *OCIRegistry
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRegistry.
func (*OCIRegistry) DeepCopyInto ¶
func (in *OCIRegistry) DeepCopyInto(out *OCIRegistry)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (OCIRegistry) Expression ¶
func (r OCIRegistry) Expression() api.RegExpression
type RuleDecision ¶
type RuleDecision struct {
Action ActionType
Rule *NamespaceRuleBodyNamespace
}
type WorkloadValidationTarget ¶
type WorkloadValidationTarget string
+kubebuilder:validation:Enum=pod/initcontainers;pod/ephemeralcontainers;pod/containers;pod/volumes
const ( DeprecatedValidateImages WorkloadValidationTarget = "pod/images" ValidateInitContainers WorkloadValidationTarget = "pod/initcontainers" ValidateEphemeralContainers WorkloadValidationTarget = "pod/ephemeralcontainers" ValidateContainers WorkloadValidationTarget = "pod/containers" ValidateVolumes WorkloadValidationTarget = "pod/volumes" )
Source Files