mirror of https://github.com/k3s-io/k3s
124 lines
5.1 KiB
Protocol Buffer
124 lines
5.1 KiB
Protocol Buffer
/*
|
|
Copyright The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
|
|
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
|
|
|
syntax = 'proto2';
|
|
|
|
package k8s.io.api.admission.v1beta1;
|
|
|
|
import "k8s.io/api/authentication/v1/generated.proto";
|
|
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
|
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
|
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
|
|
|
// Package-wide variables from generator "generated".
|
|
option go_package = "v1beta1";
|
|
|
|
// AdmissionRequest describes the admission.Attributes for the admission request.
|
|
message AdmissionRequest {
|
|
// UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
|
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
|
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
|
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
|
optional string uid = 1;
|
|
|
|
// Kind is the type of object being manipulated. For example: Pod
|
|
optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;
|
|
|
|
// Resource is the name of the resource being requested. This is not the kind. For example: pods
|
|
optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;
|
|
|
|
// SubResource is the name of the subresource being requested. This is a different resource, scoped to the parent
|
|
// resource, but it may have a different kind. For instance, /pods has the resource "pods" and the kind "Pod", while
|
|
// /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod" (because status operates on
|
|
// pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource
|
|
// "binding", and kind "Binding".
|
|
// +optional
|
|
optional string subResource = 4;
|
|
|
|
// Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
|
// rely on the server to generate the name. If that is the case, this method will return the empty string.
|
|
// +optional
|
|
optional string name = 5;
|
|
|
|
// Namespace is the namespace associated with the request (if any).
|
|
// +optional
|
|
optional string namespace = 6;
|
|
|
|
// Operation is the operation being performed
|
|
optional string operation = 7;
|
|
|
|
// UserInfo is information about the requesting user
|
|
optional k8s.io.api.authentication.v1.UserInfo userInfo = 8;
|
|
|
|
// Object is the object from the incoming request prior to default values being applied
|
|
// +optional
|
|
optional k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;
|
|
|
|
// OldObject is the existing object. Only populated for UPDATE requests.
|
|
// +optional
|
|
optional k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;
|
|
|
|
// DryRun indicates that modifications will definitely not be persisted for this request.
|
|
// Defaults to false.
|
|
// +optional
|
|
optional bool dryRun = 11;
|
|
}
|
|
|
|
// AdmissionResponse describes an admission response.
|
|
message AdmissionResponse {
|
|
// UID is an identifier for the individual request/response.
|
|
// This should be copied over from the corresponding AdmissionRequest.
|
|
optional string uid = 1;
|
|
|
|
// Allowed indicates whether or not the admission request was permitted.
|
|
optional bool allowed = 2;
|
|
|
|
// Result contains extra details into why an admission request was denied.
|
|
// This field IS NOT consulted in any way if "Allowed" is "true".
|
|
// +optional
|
|
optional k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;
|
|
|
|
// The patch body. Currently we only support "JSONPatch" which implements RFC 6902.
|
|
// +optional
|
|
optional bytes patch = 4;
|
|
|
|
// The type of Patch. Currently we only allow "JSONPatch".
|
|
// +optional
|
|
optional string patchType = 5;
|
|
|
|
// AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
|
|
// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
|
|
// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
|
|
// the admission webhook to add additional context to the audit log for this request.
|
|
// +optional
|
|
map<string, string> auditAnnotations = 6;
|
|
}
|
|
|
|
// AdmissionReview describes an admission review request/response.
|
|
message AdmissionReview {
|
|
// Request describes the attributes for the admission request.
|
|
// +optional
|
|
optional AdmissionRequest request = 1;
|
|
|
|
// Response describes the attributes for the admission response.
|
|
// +optional
|
|
optional AdmissionResponse response = 2;
|
|
}
|
|
|