mutation

func HasMetadataMutation ¶ added in v0.14.6

func HasMetadataMutation(gvk schema.GroupVersionKind, bodies []*apirules.NamespaceRuleBodyNamespace) bool

HasMetadataMutation reports whether any rule can default or manage metadata for gvk. Evaluate rendered rules, since templates can supply these fields.

func MetadataRules ¶

func MetadataRules(compiler ruleengine.ConditionCompiler) handlers.TypedHandlerWithTenantWithRuleset[*unstructured.Unstructured]

func MutateMetadata ¶

func MutateMetadata(
	obj metav1.Object,
	gvk schema.GroupVersionKind,
	bodies []*apirules.NamespaceRuleBodyNamespace,
) bool

func MutateMetadataConditional ¶ added in v0.15.0

func MutateMetadataConditional(ctx context.Context, obj metav1.Object, gvk schema.GroupVersionKind, bodies []*apirules.NamespaceRuleBodyNamespace, conditions *ruleengine.ConditionEvaluator) (bool, error)

MutateMetadataConditional applies the enclosing enforcement gate before any metadata defaults or managed values. Pure validation rules are not evaluated here.

func MutatePodPlacement ¶ added in v0.15.0

func MutatePodPlacement(ctx context.Context, pod *corev1.Pod, bodies []*apirules.NamespaceRuleBodyNamespace, conditions *ruleengine.ConditionEvaluator) (bool, error)

MutatePodPlacement applies ordered, audience-filtered placement and security mutations. It never changes rule/cache-owned values. Call only for main-resource Pod CREATE.

func MutatePodResources ¶ added in v0.14.0

func MutatePodResources(
	pod *corev1.Pod,
	bodies []*apirules.NamespaceRuleBodyNamespace,
) (bool, error)

func MutateWorkloadResources ¶ added in v0.14.0

func MutateWorkloadResources(
	ctx context.Context,
	obj *unstructured.Unstructured,
	gvk schema.GroupVersionKind,
	bodies []*apirules.NamespaceRuleBodyNamespace,
	conditions *ruleengine.ConditionEvaluator,
) (bool, error)

func Register ¶

func Register(cfg configuration.Configuration, compiler ruleengine.ConditionCompiler) handlers.Webhook