Skip to content

K
k3s
Commit dac3c2e1 authored by cheftako's avatar cheftako Committed by Walter Fender
Browse files
Options

Admission request/response handling

AdmissionResponse allows mutating webhook to send apiserver a json patch to mutate the object. This reflects the imperative nature of AdmissionReview. It adds AdmissionRequest and AdmissionResponse in place of status/spec. The AdmissionResponse the allows the mutating webhook to send back a json path with the mutated version of the requested object. Fixed the integration test to clean up properly. Switched test image to 1.8v5 to reflect API changes. Make sure to cache test framework client for cleaup test code. Switched to pointer for patch type. Factored in @liggitt's feedback. Factored in @lavalamp's feedback.
parent 3ec7487c
Hide whitespace changes
Inline Side-by-side
Showing with 951 additions and 588 deletions
pkg/apis/admission/BUILD
View file @ dac3c2e1
......@@ -19,6 +19,7 @@ go_library(
"//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
],
)
......
pkg/apis/admission/types.go
View file @ dac3c2e1
......@@ -19,38 +19,34 @@ package admission
import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
"k8s.io/kubernetes/pkg/apis/authentication"
)
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// AdmissionReview describes an admission request.
// AdmissionReview describes an admission review request/response.
type AdmissionReview struct {
metav1.TypeMeta
// Spec describes the attributes for the admission request.
// Since this admission controller is non-mutating the webhook should avoid setting this in its response to avoid the
// cost of deserializing it.
Spec AdmissionReviewSpec
// Status is filled in by the webhook and indicates whether the admission request should be permitted.
Status AdmissionReviewStatus
// Request describes the attributes for the admission request.
// +optional
Request *AdmissionRequest
// Response describes the attributes for the admission response.
// +optional
Response *AdmissionResponse
}
// AdmissionReviewSpec describes the admission.Attributes for the admission request.
type AdmissionReviewSpec struct {
// AdmissionRequest describes the admission.Attributes for the admission request.
type AdmissionRequest struct {
// UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
UID types.UID
// Kind is the type of object being manipulated. For example: Pod
Kind metav1.GroupVersionKind
// Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
// rely on the server to generate the name. If that is the case, this method will return the empty string.
Name string
// Namespace is the namespace associated with the request (if any).
Namespace string
// Object is the object from the incoming request prior to default values being applied
Object runtime.Object
// OldObject is the existing object. Only populated for UPDATE requests.
OldObject runtime.Object
// Operation is the operation being performed
Operation Operation
// Resource is the name of the resource being requested. This is not the kind. For example: pods
Resource metav1.GroupVersionResource
// SubResource is the name of the subresource being requested. This is a different resource, scoped to the parent
......@@ -58,21 +54,54 @@ type AdmissionReviewSpec struct {
// /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod" (because status operates on
// pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource
// "binding", and kind "Binding".
// +optional
SubResource string
// Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
// rely on the server to generate the name. If that is the case, this method will return the empty string.
// +optional
Name string
// Namespace is the namespace associated with the request (if any).
// +optional
Namespace string
// Operation is the operation being performed
Operation Operation
// UserInfo is information about the requesting user
UserInfo authentication.UserInfo
// Object is the object from the incoming request prior to default values being applied
// +optional
Object runtime.Object
// OldObject is the existing object. Only populated for UPDATE requests.
// +optional
OldObject runtime.Object
}
// AdmissionReviewStatus describes the status of the admission request.
type AdmissionReviewStatus struct {
// AdmissionResponse describes an admission response.
type AdmissionResponse struct {
// UID is an identifier for the individual request/response.
// This should be copied over from the corresponding AdmissionRequest.
UID types.UID
// Allowed indicates whether or not the admission request was permitted.
Allowed bool
// Result contains extra details into why an admission request was denied.
// This field IS NOT consulted in any way if "Allowed" is "true".
// +optional
Result *metav1.Status
// Patch contains the actual patch. Currently we only support a response in the form of JSONPatch, RFC 6902.
// +optional
Patch []byte
// PatchType indicates the form the Patch will take. Currently we only support "JSONPatch".
// +optional
PatchType *PatchType
}
// PatchType is the type of patch being used to represent the mutated object
type PatchType string
// PatchType constants.
const (
PatchTypeJSONPatch PatchType = "JSONPatch"
)
// Operation is the type of resource operation being checked for admission control
type Operation string
......
pkg/apis/admission/v1alpha1/BUILD
View file @ dac3c2e1
......@@ -21,6 +21,7 @@ go_library(
"//vendor/k8s.io/apimachinery/pkg/conversion:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
],
)
......
pkg/apis/admission/v1alpha1/zz_generated.conversion.go
View file @ dac3c2e1
......@@ -25,6 +25,7 @@ import (
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
conversion "k8s.io/apimachinery/pkg/conversion"
runtime "k8s.io/apimachinery/pkg/runtime"
types "k8s.io/apimachinery/pkg/types"
admission "k8s.io/kubernetes/pkg/apis/admission"
unsafe "unsafe"
)
......@@ -37,113 +38,129 @@ func init() {
// Public to allow building arbitrary schemes.
func RegisterConversions(scheme *runtime.Scheme) error {
return scheme.AddGeneratedConversionFuncs(
Convert_v1alpha1_AdmissionRequest_To_admission_AdmissionRequest,
Convert_admission_AdmissionRequest_To_v1alpha1_AdmissionRequest,
Convert_v1alpha1_AdmissionResponse_To_admission_AdmissionResponse,
Convert_admission_AdmissionResponse_To_v1alpha1_AdmissionResponse,
Convert_v1alpha1_AdmissionReview_To_admission_AdmissionReview,
Convert_admission_AdmissionReview_To_v1alpha1_AdmissionReview,
Convert_v1alpha1_AdmissionReviewSpec_To_admission_AdmissionReviewSpec,
Convert_admission_AdmissionReviewSpec_To_v1alpha1_AdmissionReviewSpec,
Convert_v1alpha1_AdmissionReviewStatus_To_admission_AdmissionReviewStatus,
Convert_admission_AdmissionReviewStatus_To_v1alpha1_AdmissionReviewStatus,
)
}
func autoConvert_v1alpha1_AdmissionReview_To_admission_AdmissionReview(in *v1alpha1.AdmissionReview, out *admission.AdmissionReview, s conversion.Scope) error {
if err := Convert_v1alpha1_AdmissionReviewSpec_To_admission_AdmissionReviewSpec(&in.Spec, &out.Spec, s); err != nil {
return err
}
if err := Convert_v1alpha1_AdmissionReviewStatus_To_admission_AdmissionReviewStatus(&in.Status, &out.Status, s); err != nil {
func autoConvert_v1alpha1_AdmissionRequest_To_admission_AdmissionRequest(in *v1alpha1.AdmissionRequest, out *admission.AdmissionRequest, s conversion.Scope) error {
out.UID = types.UID(in.UID)
out.Kind = in.Kind
out.Resource = in.Resource
out.SubResource = in.SubResource
out.Name = in.Name
out.Namespace = in.Namespace
out.Operation = admission.Operation(in.Operation)
// TODO: Inefficient conversion - can we improve it?
if err := s.Convert(&in.UserInfo, &out.UserInfo, 0); err != nil {
return err
}
return nil
}
// Convert_v1alpha1_AdmissionReview_To_admission_AdmissionReview is an autogenerated conversion function.
func Convert_v1alpha1_AdmissionReview_To_admission_AdmissionReview(in *v1alpha1.AdmissionReview, out *admission.AdmissionReview, s conversion.Scope) error {
return autoConvert_v1alpha1_AdmissionReview_To_admission_AdmissionReview(in, out, s)
}
func autoConvert_admission_AdmissionReview_To_v1alpha1_AdmissionReview(in *admission.AdmissionReview, out *v1alpha1.AdmissionReview, s conversion.Scope) error {
if err := Convert_admission_AdmissionReviewSpec_To_v1alpha1_AdmissionReviewSpec(&in.Spec, &out.Spec, s); err != nil {
if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Object, &out.Object, s); err != nil {
return err
}
if err := Convert_admission_AdmissionReviewStatus_To_v1alpha1_AdmissionReviewStatus(&in.Status, &out.Status, s); err != nil {
if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.OldObject, &out.OldObject, s); err != nil {
return err
}
return nil
}
// Convert_admission_AdmissionReview_To_v1alpha1_AdmissionReview is an autogenerated conversion function.
func Convert_admission_AdmissionReview_To_v1alpha1_AdmissionReview(in *admission.AdmissionReview, out *v1alpha1.AdmissionReview, s conversion.Scope) error {
return autoConvert_admission_AdmissionReview_To_v1alpha1_AdmissionReview(in, out, s)
// Convert_v1alpha1_AdmissionRequest_To_admission_AdmissionRequest is an autogenerated conversion function.
func Convert_v1alpha1_AdmissionRequest_To_admission_AdmissionRequest(in *v1alpha1.AdmissionRequest, out *admission.AdmissionRequest, s conversion.Scope) error {
return autoConvert_v1alpha1_AdmissionRequest_To_admission_AdmissionRequest(in, out, s)
}
func autoConvert_v1alpha1_AdmissionReviewSpec_To_admission_AdmissionReviewSpec(in *v1alpha1.AdmissionReviewSpec, out *admission.AdmissionReviewSpec, s conversion.Scope) error {
func autoConvert_admission_AdmissionRequest_To_v1alpha1_AdmissionRequest(in *admission.AdmissionRequest, out *v1alpha1.AdmissionRequest, s conversion.Scope) error {
out.UID = types.UID(in.UID)
out.Kind = in.Kind
if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Object, &out.Object, s); err != nil {
return err
}
if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.OldObject, &out.OldObject, s); err != nil {
return err
}
out.Operation = admission.Operation(in.Operation)
out.Name = in.Name
out.Namespace = in.Namespace
out.Resource = in.Resource
out.SubResource = in.SubResource
out.Name = in.Name
out.Namespace = in.Namespace
out.Operation = v1alpha1.Operation(in.Operation)
// TODO: Inefficient conversion - can we improve it?
if err := s.Convert(&in.UserInfo, &out.UserInfo, 0); err != nil {
return err
}
return nil
}
// Convert_v1alpha1_AdmissionReviewSpec_To_admission_AdmissionReviewSpec is an autogenerated conversion function.
func Convert_v1alpha1_AdmissionReviewSpec_To_admission_AdmissionReviewSpec(in *v1alpha1.AdmissionReviewSpec, out *admission.AdmissionReviewSpec, s conversion.Scope) error {
return autoConvert_v1alpha1_AdmissionReviewSpec_To_admission_AdmissionReviewSpec(in, out, s)
}
func autoConvert_admission_AdmissionReviewSpec_To_v1alpha1_AdmissionReviewSpec(in *admission.AdmissionReviewSpec, out *v1alpha1.AdmissionReviewSpec, s conversion.Scope) error {
out.Kind = in.Kind
out.Name = in.Name
out.Namespace = in.Namespace
if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.Object, &out.Object, s); err != nil {
return err
}
if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.OldObject, &out.OldObject, s); err != nil {
return err
}
out.Operation = v1alpha1.Operation(in.Operation)
out.Resource = in.Resource
out.SubResource = in.SubResource
// TODO: Inefficient conversion - can we improve it?
if err := s.Convert(&in.UserInfo, &out.UserInfo, 0); err != nil {
return err
}
return nil
}
// Convert_admission_AdmissionReviewSpec_To_v1alpha1_AdmissionReviewSpec is an autogenerated conversion function.
func Convert_admission_AdmissionReviewSpec_To_v1alpha1_AdmissionReviewSpec(in *admission.AdmissionReviewSpec, out *v1alpha1.AdmissionReviewSpec, s conversion.Scope) error {
return autoConvert_admission_AdmissionReviewSpec_To_v1alpha1_AdmissionReviewSpec(in, out, s)
// Convert_admission_AdmissionRequest_To_v1alpha1_AdmissionRequest is an autogenerated conversion function.
func Convert_admission_AdmissionRequest_To_v1alpha1_AdmissionRequest(in *admission.AdmissionRequest, out *v1alpha1.AdmissionRequest, s conversion.Scope) error {
return autoConvert_admission_AdmissionRequest_To_v1alpha1_AdmissionRequest(in, out, s)
}
func autoConvert_v1alpha1_AdmissionReviewStatus_To_admission_AdmissionReviewStatus(in *v1alpha1.AdmissionReviewStatus, out *admission.AdmissionReviewStatus, s conversion.Scope) error {
func autoConvert_v1alpha1_AdmissionResponse_To_admission_AdmissionResponse(in *v1alpha1.AdmissionResponse, out *admission.AdmissionResponse, s conversion.Scope) error {
out.UID = types.UID(in.UID)
out.Allowed = in.Allowed
out.Result = (*v1.Status)(unsafe.Pointer(in.Result))
out.Patch = *(*[]byte)(unsafe.Pointer(&in.Patch))
out.PatchType = (*admission.PatchType)(unsafe.Pointer(in.PatchType))
return nil
}
// Convert_v1alpha1_AdmissionReviewStatus_To_admission_AdmissionReviewStatus is an autogenerated conversion function.
func Convert_v1alpha1_AdmissionReviewStatus_To_admission_AdmissionReviewStatus(in *v1alpha1.AdmissionReviewStatus, out *admission.AdmissionReviewStatus, s conversion.Scope) error {
return autoConvert_v1alpha1_AdmissionReviewStatus_To_admission_AdmissionReviewStatus(in, out, s)
// Convert_v1alpha1_AdmissionResponse_To_admission_AdmissionResponse is an autogenerated conversion function.
func Convert_v1alpha1_AdmissionResponse_To_admission_AdmissionResponse(in *v1alpha1.AdmissionResponse, out *admission.AdmissionResponse, s conversion.Scope) error {
return autoConvert_v1alpha1_AdmissionResponse_To_admission_AdmissionResponse(in, out, s)
}
func autoConvert_admission_AdmissionReviewStatus_To_v1alpha1_AdmissionReviewStatus(in *admission.AdmissionReviewStatus, out *v1alpha1.AdmissionReviewStatus, s conversion.Scope) error {
func autoConvert_admission_AdmissionResponse_To_v1alpha1_AdmissionResponse(in *admission.AdmissionResponse, out *v1alpha1.AdmissionResponse, s conversion.Scope) error {
out.UID = types.UID(in.UID)
out.Allowed = in.Allowed
out.Result = (*v1.Status)(unsafe.Pointer(in.Result))
out.Patch = *(*[]byte)(unsafe.Pointer(&in.Patch))
out.PatchType = (*v1alpha1.PatchType)(unsafe.Pointer(in.PatchType))
return nil
}
// Convert_admission_AdmissionResponse_To_v1alpha1_AdmissionResponse is an autogenerated conversion function.
func Convert_admission_AdmissionResponse_To_v1alpha1_AdmissionResponse(in *admission.AdmissionResponse, out *v1alpha1.AdmissionResponse, s conversion.Scope) error {
return autoConvert_admission_AdmissionResponse_To_v1alpha1_AdmissionResponse(in, out, s)
}
func autoConvert_v1alpha1_AdmissionReview_To_admission_AdmissionReview(in *v1alpha1.AdmissionReview, out *admission.AdmissionReview, s conversion.Scope) error {
if in.Request != nil {
in, out := &in.Request, &out.Request
*out = new(admission.AdmissionRequest)
if err := Convert_v1alpha1_AdmissionRequest_To_admission_AdmissionRequest(*in, *out, s); err != nil {
return err
}
} else {
out.Request = nil
}
out.Response = (*admission.AdmissionResponse)(unsafe.Pointer(in.Response))
return nil
}
// Convert_v1alpha1_AdmissionReview_To_admission_AdmissionReview is an autogenerated conversion function.
func Convert_v1alpha1_AdmissionReview_To_admission_AdmissionReview(in *v1alpha1.AdmissionReview, out *admission.AdmissionReview, s conversion.Scope) error {
return autoConvert_v1alpha1_AdmissionReview_To_admission_AdmissionReview(in, out, s)
}
func autoConvert_admission_AdmissionReview_To_v1alpha1_AdmissionReview(in *admission.AdmissionReview, out *v1alpha1.AdmissionReview, s conversion.Scope) error {
if in.Request != nil {
in, out := &in.Request, &out.Request
*out = new(v1alpha1.AdmissionRequest)
if err := Convert_admission_AdmissionRequest_To_v1alpha1_AdmissionRequest(*in, *out, s); err != nil {
return err
}
} else {
out.Request = nil
}
out.Response = (*v1alpha1.AdmissionResponse)(unsafe.Pointer(in.Response))
return nil
}
// Convert_admission_AdmissionReviewStatus_To_v1alpha1_AdmissionReviewStatus is an autogenerated conversion function.
func Convert_admission_AdmissionReviewStatus_To_v1alpha1_AdmissionReviewStatus(in *admission.AdmissionReviewStatus, out *v1alpha1.AdmissionReviewStatus, s conversion.Scope) error {
return autoConvert_admission_AdmissionReviewStatus_To_v1alpha1_AdmissionReviewStatus(in, out, s)
// Convert_admission_AdmissionReview_To_v1alpha1_AdmissionReview is an autogenerated conversion function.
func Convert_admission_AdmissionReview_To_v1alpha1_AdmissionReview(in *admission.AdmissionReview, out *v1alpha1.AdmissionReview, s conversion.Scope) error {
return autoConvert_admission_AdmissionReview_To_v1alpha1_AdmissionReview(in, out, s)
}
pkg/apis/admission/zz_generated.deepcopy.go
View file @ dac3c2e1
......@@ -26,37 +26,11 @@ import (
)
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *AdmissionReview) DeepCopyInto(out *AdmissionReview) {
*out = *in
out.TypeMeta = in.TypeMeta
in.Spec.DeepCopyInto(&out.Spec)
in.Status.DeepCopyInto(&out.Status)
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReview.
func (in *AdmissionReview) DeepCopy() *AdmissionReview {
if in == nil {
return nil
}
out := new(AdmissionReview)
in.DeepCopyInto(out)
return out
}
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
func (in *AdmissionReview) DeepCopyObject() runtime.Object {
if c := in.DeepCopy(); c != nil {
return c
} else {
return nil
}
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *AdmissionReviewSpec) DeepCopyInto(out *AdmissionReviewSpec) {
func (in *AdmissionRequest) DeepCopyInto(out *AdmissionRequest) {
*out = *in
out.Kind = in.Kind
out.Resource = in.Resource
in.UserInfo.DeepCopyInto(&out.UserInfo)
if in.Object == nil {
out.Object = nil
} else {
......@@ -67,23 +41,21 @@ func (in *AdmissionReviewSpec) DeepCopyInto(out *AdmissionReviewSpec) {
} else {
out.OldObject = in.OldObject.DeepCopyObject()
}
out.Resource = in.Resource
in.UserInfo.DeepCopyInto(&out.UserInfo)
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReviewSpec.
func (in *AdmissionReviewSpec) DeepCopy() *AdmissionReviewSpec {
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionRequest.
func (in *AdmissionRequest) DeepCopy() *AdmissionRequest {
if in == nil {
return nil
}
out := new(AdmissionReviewSpec)
out := new(AdmissionRequest)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *AdmissionReviewStatus) DeepCopyInto(out *AdmissionReviewStatus) {
func (in *AdmissionResponse) DeepCopyInto(out *AdmissionResponse) {
*out = *in
if in.Result != nil {
in, out := &in.Result, &out.Result
......@@ -94,15 +66,73 @@ func (in *AdmissionReviewStatus) DeepCopyInto(out *AdmissionReviewStatus) {
(*in).DeepCopyInto(*out)
}
}
if in.Patch != nil {
in, out := &in.Patch, &out.Patch
*out = make([]byte, len(*in))
copy(*out, *in)
}
if in.PatchType != nil {
in, out := &in.PatchType, &out.PatchType
if *in == nil {
*out = nil
} else {
*out = new(PatchType)
**out = **in
}
}
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionResponse.
func (in *AdmissionResponse) DeepCopy() *AdmissionResponse {
if in == nil {
return nil
}
out := new(AdmissionResponse)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *AdmissionReview) DeepCopyInto(out *AdmissionReview) {
*out = *in
out.TypeMeta = in.TypeMeta
if in.Request != nil {
in, out := &in.Request, &out.Request
if *in == nil {
*out = nil
} else {
*out = new(AdmissionRequest)
(*in).DeepCopyInto(*out)
}
}
if in.Response != nil {
in, out := &in.Response, &out.Response
if *in == nil {
*out = nil
} else {
*out = new(AdmissionResponse)
(*in).DeepCopyInto(*out)
}
}
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReviewStatus.
func (in *AdmissionReviewStatus) DeepCopy() *AdmissionReviewStatus {
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReview.
func (in *AdmissionReview) DeepCopy() *AdmissionReview {
if in == nil {
return nil
}
out := new(AdmissionReviewStatus)
out := new(AdmissionReview)
in.DeepCopyInto(out)
return out
}
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
func (in *AdmissionReview) DeepCopyObject() runtime.Object {
if c := in.DeepCopy(); c != nil {
return c
} else {
return nil
}
}
staging/src/k8s.io/api/admission/v1alpha1/BUILD
View file @ dac3c2e1
......@@ -18,6 +18,7 @@ go_library(
"//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
],
)
......
staging/src/k8s.io/api/admission/v1alpha1/generated.pb.go
View file @ dac3c2e1
......@@ -25,9 +25,9 @@ limitations under the License.
k8s.io/kubernetes/vendor/k8s.io/api/admission/v1alpha1/generated.proto
It has these top-level messages:
AdmissionRequest
AdmissionResponse
AdmissionReview
AdmissionReviewSpec
AdmissionReviewStatus
*/
package v1alpha1
......@@ -37,6 +37,8 @@ import math "math"
import k8s_io_apimachinery_pkg_apis_meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
import k8s_io_apimachinery_pkg_types "k8s.io/apimachinery/pkg/types"
import strings "strings"
import reflect "reflect"
......@@ -53,24 +55,24 @@ var _ = math.Inf
// proto package needs to be updated.
const _ = proto.GoGoProtoPackageIsVersion2 // please upgrade the proto package
func (m *AdmissionReview) Reset() { *m = AdmissionReview{} }
func (*AdmissionReview) ProtoMessage() {}
func (*AdmissionReview) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{0} }
func (m *AdmissionRequest) Reset() { *m = AdmissionRequest{} }
func (*AdmissionRequest) ProtoMessage() {}
func (*AdmissionRequest) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{0} }
func (m *AdmissionReviewSpec) Reset() { *m = AdmissionReviewSpec{} }
func (*AdmissionReviewSpec) ProtoMessage() {}
func (*AdmissionReviewSpec) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{1} }
func (m *AdmissionResponse) Reset() { *m = AdmissionResponse{} }
func (*AdmissionResponse) ProtoMessage() {}
func (*AdmissionResponse) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{1} }
func (m *AdmissionReviewStatus) Reset() { *m = AdmissionReviewStatus{} }
func (*AdmissionReviewStatus) ProtoMessage() {}
func (*AdmissionReviewStatus) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{2} }
func (m *AdmissionReview) Reset() { *m = AdmissionReview{} }
func (*AdmissionReview) ProtoMessage() {}
func (*AdmissionReview) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{2} }
func init() {
proto.RegisterType((*AdmissionRequest)(nil), "k8s.io.api.admission.v1alpha1.AdmissionRequest")
proto.RegisterType((*AdmissionResponse)(nil), "k8s.io.api.admission.v1alpha1.AdmissionResponse")
proto.RegisterType((*AdmissionReview)(nil), "k8s.io.api.admission.v1alpha1.AdmissionReview")
proto.RegisterType((*AdmissionReviewSpec)(nil), "k8s.io.api.admission.v1alpha1.AdmissionReviewSpec")
proto.RegisterType((*AdmissionReviewStatus)(nil), "k8s.io.api.admission.v1alpha1.AdmissionReviewStatus")
}
func (m *AdmissionReview) Marshal() (dAtA []byte, err error) {
func (m *AdmissionRequest) Marshal() (dAtA []byte, err error) {
size := m.Size()
dAtA = make([]byte, size)
n, err := m.MarshalTo(dAtA)
......@@ -80,73 +82,35 @@ func (m *AdmissionReview) Marshal() (dAtA []byte, err error) {
return dAtA[:n], nil
}
func (m *AdmissionReview) MarshalTo(dAtA []byte) (int, error) {
func (m *AdmissionRequest) MarshalTo(dAtA []byte) (int, error) {
var i int
_ = i
var l int
_ = l
dAtA[i] = 0xa
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.Spec.Size()))
n1, err := m.Spec.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n1
i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
i += copy(dAtA[i:], m.UID)
dAtA[i] = 0x12
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.Status.Size()))
n2, err := m.Status.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n2
return i, nil
}
func (m *AdmissionReviewSpec) Marshal() (dAtA []byte, err error) {
size := m.Size()
dAtA = make([]byte, size)
n, err := m.MarshalTo(dAtA)
if err != nil {
return nil, err
}
return dAtA[:n], nil
}
func (m *AdmissionReviewSpec) MarshalTo(dAtA []byte) (int, error) {
var i int
_ = i
var l int
_ = l
dAtA[i] = 0xa
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.Kind.Size()))
n3, err := m.Kind.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n3
dAtA[i] = 0x12
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.Object.Size()))
n4, err := m.Object.MarshalTo(dAtA[i:])
n1, err := m.Kind.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n4
i += n1
dAtA[i] = 0x1a
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.OldObject.Size()))
n5, err := m.OldObject.MarshalTo(dAtA[i:])
i = encodeVarintGenerated(dAtA, i, uint64(m.Resource.Size()))
n2, err := m.Resource.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n5
i += n2
dAtA[i] = 0x22
i++
i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operation)))
i += copy(dAtA[i:], m.Operation)
i = encodeVarintGenerated(dAtA, i, uint64(len(m.SubResource)))
i += copy(dAtA[i:], m.SubResource)
dAtA[i] = 0x2a
i++
i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
......@@ -157,28 +121,36 @@ func (m *AdmissionReviewSpec) MarshalTo(dAtA []byte) (int, error) {
i += copy(dAtA[i:], m.Namespace)
dAtA[i] = 0x3a
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.Resource.Size()))
n6, err := m.Resource.MarshalTo(dAtA[i:])
i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operation)))
i += copy(dAtA[i:], m.Operation)
dAtA[i] = 0x42
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.UserInfo.Size()))
n3, err := m.UserInfo.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n6
dAtA[i] = 0x42
i++
i = encodeVarintGenerated(dAtA, i, uint64(len(m.SubResource)))
i += copy(dAtA[i:], m.SubResource)
i += n3
dAtA[i] = 0x4a
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.UserInfo.Size()))
n7, err := m.UserInfo.MarshalTo(dAtA[i:])
i = encodeVarintGenerated(dAtA, i, uint64(m.Object.Size()))
n4, err := m.Object.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n4
dAtA[i] = 0x52
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.OldObject.Size()))
n5, err := m.OldObject.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n7
i += n5
return i, nil
}
func (m *AdmissionReviewStatus) Marshal() (dAtA []byte, err error) {
func (m *AdmissionResponse) Marshal() (dAtA []byte, err error) {
size := m.Size()
dAtA = make([]byte, size)
n, err := m.MarshalTo(dAtA)
......@@ -188,12 +160,16 @@ func (m *AdmissionReviewStatus) Marshal() (dAtA []byte, err error) {
return dAtA[:n], nil
}
func (m *AdmissionReviewStatus) MarshalTo(dAtA []byte) (int, error) {
func (m *AdmissionResponse) MarshalTo(dAtA []byte) (int, error) {
var i int
_ = i
var l int
_ = l
dAtA[i] = 0x8
dAtA[i] = 0xa
i++
i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
i += copy(dAtA[i:], m.UID)
dAtA[i] = 0x10
i++
if m.Allowed {
dAtA[i] = 1
......@@ -202,10 +178,60 @@ func (m *AdmissionReviewStatus) MarshalTo(dAtA []byte) (int, error) {
}
i++
if m.Result != nil {
dAtA[i] = 0x12
dAtA[i] = 0x1a
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.Result.Size()))
n8, err := m.Result.MarshalTo(dAtA[i:])
n6, err := m.Result.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n6
}
if m.Patch != nil {
dAtA[i] = 0x22
i++
i = encodeVarintGenerated(dAtA, i, uint64(len(m.Patch)))
i += copy(dAtA[i:], m.Patch)
}
if m.PatchType != nil {
dAtA[i] = 0x2a
i++
i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PatchType)))
i += copy(dAtA[i:], *m.PatchType)
}
return i, nil
}
func (m *AdmissionReview) Marshal() (dAtA []byte, err error) {
size := m.Size()
dAtA = make([]byte, size)
n, err := m.MarshalTo(dAtA)
if err != nil {
return nil, err
}
return dAtA[:n], nil
}
func (m *AdmissionReview) MarshalTo(dAtA []byte) (int, error) {
var i int
_ = i
var l int
_ = l
if m.Request != nil {
dAtA[i] = 0xa
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.Request.Size()))
n7, err := m.Request.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
i += n7
}
if m.Response != nil {
dAtA[i] = 0x12
i++
i = encodeVarintGenerated(dAtA, i, uint64(m.Response.Size()))
n8, err := m.Response.MarshalTo(dAtA[i:])
if err != nil {
return 0, err
}
......@@ -241,48 +267,64 @@ func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
dAtA[offset] = uint8(v)
return offset + 1
}
func (m *AdmissionReview) Size() (n int) {
func (m *AdmissionRequest) Size() (n int) {
var l int
_ = l
l = m.Spec.Size()
l = len(m.UID)
n += 1 + l + sovGenerated(uint64(l))
l = m.Status.Size()
n += 1 + l + sovGenerated(uint64(l))
return n
}
func (m *AdmissionReviewSpec) Size() (n int) {
var l int
_ = l
l = m.Kind.Size()
n += 1 + l + sovGenerated(uint64(l))
l = m.Object.Size()
n += 1 + l + sovGenerated(uint64(l))
l = m.OldObject.Size()
l = m.Resource.Size()
n += 1 + l + sovGenerated(uint64(l))
l = len(m.Operation)
l = len(m.SubResource)
n += 1 + l + sovGenerated(uint64(l))
l = len(m.Name)
n += 1 + l + sovGenerated(uint64(l))
l = len(m.Namespace)
n += 1 + l + sovGenerated(uint64(l))
l = m.Resource.Size()
n += 1 + l + sovGenerated(uint64(l))
l = len(m.SubResource)
l = len(m.Operation)
n += 1 + l + sovGenerated(uint64(l))
l = m.UserInfo.Size()
n += 1 + l + sovGenerated(uint64(l))
l = m.Object.Size()
n += 1 + l + sovGenerated(uint64(l))
l = m.OldObject.Size()
n += 1 + l + sovGenerated(uint64(l))
return n
}
func (m *AdmissionReviewStatus) Size() (n int) {
func (m *AdmissionResponse) Size() (n int) {
var l int
_ = l
l = len(m.UID)
n += 1 + l + sovGenerated(uint64(l))
n += 2
if m.Result != nil {
l = m.Result.Size()
n += 1 + l + sovGenerated(uint64(l))
}
if m.Patch != nil {
l = len(m.Patch)
n += 1 + l + sovGenerated(uint64(l))
}
if m.PatchType != nil {
l = len(*m.PatchType)
n += 1 + l + sovGenerated(uint64(l))
}
return n
}
func (m *AdmissionReview) Size() (n int) {
var l int
_ = l
if m.Request != nil {
l = m.Request.Size()
n += 1 + l + sovGenerated(uint64(l))
}
if m.Response != nil {
l = m.Response.Size()
n += 1 + l + sovGenerated(uint64(l))
}
return n
}
......@@ -299,42 +341,46 @@ func sovGenerated(x uint64) (n int) {
func sozGenerated(x uint64) (n int) {
return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
}
func (this *AdmissionReview) String() string {
func (this *AdmissionRequest) String() string {
if this == nil {
return "nil"
}
s := strings.Join([]string{`&AdmissionReview{`,
`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "AdmissionReviewSpec", "AdmissionReviewSpec", 1), `&`, ``, 1) + `,`,
`Status:` + strings.Replace(strings.Replace(this.Status.String(), "AdmissionReviewStatus", "AdmissionReviewStatus", 1), `&`, ``, 1) + `,`,
s := strings.Join([]string{`&AdmissionRequest{`,
`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
`Kind:` + strings.Replace(strings.Replace(this.Kind.String(), "GroupVersionKind", "k8s_io_apimachinery_pkg_apis_meta_v1.GroupVersionKind", 1), `&`, ``, 1) + `,`,
`Resource:` + strings.Replace(strings.Replace(this.Resource.String(), "GroupVersionResource", "k8s_io_apimachinery_pkg_apis_meta_v1.GroupVersionResource", 1), `&`, ``, 1) + `,`,
`SubResource:` + fmt.Sprintf("%v", this.SubResource) + `,`,
`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
`Namespace:` + fmt.Sprintf("%v", this.Namespace) + `,`,
`Operation:` + fmt.Sprintf("%v", this.Operation) + `,`,
`UserInfo:` + strings.Replace(strings.Replace(this.UserInfo.String(), "UserInfo", "k8s_io_api_authentication_v1.UserInfo", 1), `&`, ``, 1) + `,`,
`Object:` + strings.Replace(strings.Replace(this.Object.String(), "RawExtension", "k8s_io_apimachinery_pkg_runtime.RawExtension", 1), `&`, ``, 1) + `,`,
`OldObject:` + strings.Replace(strings.Replace(this.OldObject.String(), "RawExtension", "k8s_io_apimachinery_pkg_runtime.RawExtension", 1), `&`, ``, 1) + `,`,
`}`,
}, "")
return s
}
func (this *AdmissionReviewSpec) String() string {
func (this *AdmissionResponse) String() string {
if this == nil {
return "nil"
}
s := strings.Join([]string{`&AdmissionReviewSpec{`,
`Kind:` + strings.Replace(strings.Replace(this.Kind.String(), "GroupVersionKind", "k8s_io_apimachinery_pkg_apis_meta_v1.GroupVersionKind", 1), `&`, ``, 1) + `,`,
`Object:` + strings.Replace(strings.Replace(this.Object.String(), "RawExtension", "k8s_io_apimachinery_pkg_runtime.RawExtension", 1), `&`, ``, 1) + `,`,
`OldObject:` + strings.Replace(strings.Replace(this.OldObject.String(), "RawExtension", "k8s_io_apimachinery_pkg_runtime.RawExtension", 1), `&`, ``, 1) + `,`,
`Operation:` + fmt.Sprintf("%v", this.Operation) + `,`,
`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
`Namespace:` + fmt.Sprintf("%v", this.Namespace) + `,`,
`Resource:` + strings.Replace(strings.Replace(this.Resource.String(), "GroupVersionResource", "k8s_io_apimachinery_pkg_apis_meta_v1.GroupVersionResource", 1), `&`, ``, 1) + `,`,
`SubResource:` + fmt.Sprintf("%v", this.SubResource) + `,`,
`UserInfo:` + strings.Replace(strings.Replace(this.UserInfo.String(), "UserInfo", "k8s_io_api_authentication_v1.UserInfo", 1), `&`, ``, 1) + `,`,
s := strings.Join([]string{`&AdmissionResponse{`,
`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
`Allowed:` + fmt.Sprintf("%v", this.Allowed) + `,`,
`Result:` + strings.Replace(fmt.Sprintf("%v", this.Result), "Status", "k8s_io_apimachinery_pkg_apis_meta_v1.Status", 1) + `,`,
`Patch:` + valueToStringGenerated(this.Patch) + `,`,
`PatchType:` + valueToStringGenerated(this.PatchType) + `,`,
`}`,
}, "")
return s
}
func (this *AdmissionReviewStatus) String() string {
func (this *AdmissionReview) String() string {
if this == nil {
return "nil"
}
s := strings.Join([]string{`&AdmissionReviewStatus{`,
`Allowed:` + fmt.Sprintf("%v", this.Allowed) + `,`,
`Result:` + strings.Replace(fmt.Sprintf("%v", this.Result), "Status", "k8s_io_apimachinery_pkg_apis_meta_v1.Status", 1) + `,`,
s := strings.Join([]string{`&AdmissionReview{`,
`Request:` + strings.Replace(fmt.Sprintf("%v", this.Request), "AdmissionRequest", "AdmissionRequest", 1) + `,`,
`Response:` + strings.Replace(fmt.Sprintf("%v", this.Response), "AdmissionResponse", "AdmissionResponse", 1) + `,`,
`}`,
}, "")
return s
......@@ -347,7 +393,7 @@ func valueToStringGenerated(v interface{}) string {
pv := reflect.Indirect(rv).Interface()
return fmt.Sprintf("*%v", pv)
}
func (m *AdmissionReview) Unmarshal(dAtA []byte) error {
func (m *AdmissionRequest) Unmarshal(dAtA []byte) error {
l := len(dAtA)
iNdEx := 0
for iNdEx < l {
......@@ -370,17 +416,17 @@ func (m *AdmissionReview) Unmarshal(dAtA []byte) error {
fieldNum := int32(wire >> 3)
wireType := int(wire & 0x7)
if wireType == 4 {
return fmt.Errorf("proto: AdmissionReview: wiretype end group for non-group")
return fmt.Errorf("proto: AdmissionRequest: wiretype end group for non-group")
}
if fieldNum <= 0 {
return fmt.Errorf("proto: AdmissionReview: illegal tag %d (wire type %d)", fieldNum, wire)
return fmt.Errorf("proto: AdmissionRequest: illegal tag %d (wire type %d)", fieldNum, wire)
}
switch fieldNum {
case 1:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
}
var msglen int
var stringLen uint64
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
......@@ -390,25 +436,24 @@ func (m *AdmissionReview) Unmarshal(dAtA []byte) error {
}
b := dAtA[iNdEx]
iNdEx++
msglen |= (int(b) & 0x7F) << shift
stringLen |= (uint64(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
if msglen < 0 {
intStringLen := int(stringLen)
if intStringLen < 0 {
return ErrInvalidLengthGenerated
}
postIndex := iNdEx + msglen
postIndex := iNdEx + intStringLen
if postIndex > l {
return io.ErrUnexpectedEOF
}
if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
iNdEx = postIndex
case 2:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
}
var msglen int
for shift := uint(0); ; shift += 7 {
......@@ -432,63 +477,13 @@ func (m *AdmissionReview) Unmarshal(dAtA []byte) error {
if postIndex > l {
return io.ErrUnexpectedEOF
}
if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
if err := m.Kind.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
iNdEx = postIndex
default:
iNdEx = preIndex
skippy, err := skipGenerated(dAtA[iNdEx:])
if err != nil {
return err
}
if skippy < 0 {
return ErrInvalidLengthGenerated
}
if (iNdEx + skippy) > l {
return io.ErrUnexpectedEOF
}
iNdEx += skippy
}
}
if iNdEx > l {
return io.ErrUnexpectedEOF
}
return nil
}
func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
l := len(dAtA)
iNdEx := 0
for iNdEx < l {
preIndex := iNdEx
var wire uint64
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
}
if iNdEx >= l {
return io.ErrUnexpectedEOF
}
b := dAtA[iNdEx]
iNdEx++
wire |= (uint64(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
fieldNum := int32(wire >> 3)
wireType := int(wire & 0x7)
if wireType == 4 {
return fmt.Errorf("proto: AdmissionReviewSpec: wiretype end group for non-group")
}
if fieldNum <= 0 {
return fmt.Errorf("proto: AdmissionReviewSpec: illegal tag %d (wire type %d)", fieldNum, wire)
}
switch fieldNum {
case 1:
case 3:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
}
var msglen int
for shift := uint(0); ; shift += 7 {
......@@ -512,15 +507,15 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
if postIndex > l {
return io.ErrUnexpectedEOF
}
if err := m.Kind.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
if err := m.Resource.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
iNdEx = postIndex
case 2:
case 4:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Object", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field SubResource", wireType)
}
var msglen int
var stringLen uint64
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
......@@ -530,27 +525,26 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
}
b := dAtA[iNdEx]
iNdEx++
msglen |= (int(b) & 0x7F) << shift
stringLen |= (uint64(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
if msglen < 0 {
intStringLen := int(stringLen)
if intStringLen < 0 {
return ErrInvalidLengthGenerated
}
postIndex := iNdEx + msglen
postIndex := iNdEx + intStringLen
if postIndex > l {
return io.ErrUnexpectedEOF
}
if err := m.Object.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
m.SubResource = string(dAtA[iNdEx:postIndex])
iNdEx = postIndex
case 3:
case 5:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field OldObject", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
}
var msglen int
var stringLen uint64
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
......@@ -560,25 +554,24 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
}
b := dAtA[iNdEx]
iNdEx++
msglen |= (int(b) & 0x7F) << shift
stringLen |= (uint64(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
if msglen < 0 {
intStringLen := int(stringLen)
if intStringLen < 0 {
return ErrInvalidLengthGenerated
}
postIndex := iNdEx + msglen
postIndex := iNdEx + intStringLen
if postIndex > l {
return io.ErrUnexpectedEOF
}
if err := m.OldObject.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
m.Name = string(dAtA[iNdEx:postIndex])
iNdEx = postIndex
case 4:
case 6:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Operation", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
}
var stringLen uint64
for shift := uint(0); ; shift += 7 {
......@@ -603,11 +596,11 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
if postIndex > l {
return io.ErrUnexpectedEOF
}
m.Operation = Operation(dAtA[iNdEx:postIndex])
m.Namespace = string(dAtA[iNdEx:postIndex])
iNdEx = postIndex
case 5:
case 7:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field Operation", wireType)
}
var stringLen uint64
for shift := uint(0); ; shift += 7 {
......@@ -632,13 +625,13 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
if postIndex > l {
return io.ErrUnexpectedEOF
}
m.Name = string(dAtA[iNdEx:postIndex])
m.Operation = Operation(dAtA[iNdEx:postIndex])
iNdEx = postIndex
case 6:
case 8:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field UserInfo", wireType)
}
var stringLen uint64
var msglen int
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
......@@ -648,24 +641,25 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
}
b := dAtA[iNdEx]
iNdEx++
stringLen |= (uint64(b) & 0x7F) << shift
msglen |= (int(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
intStringLen := int(stringLen)
if intStringLen < 0 {
if msglen < 0 {
return ErrInvalidLengthGenerated
}
postIndex := iNdEx + intStringLen
postIndex := iNdEx + msglen
if postIndex > l {
return io.ErrUnexpectedEOF
}
m.Namespace = string(dAtA[iNdEx:postIndex])
if err := m.UserInfo.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
iNdEx = postIndex
case 7:
case 9:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field Object", wireType)
}
var msglen int
for shift := uint(0); ; shift += 7 {
......@@ -689,13 +683,93 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
if postIndex > l {
return io.ErrUnexpectedEOF
}
if err := m.Resource.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
if err := m.Object.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
iNdEx = postIndex
case 8:
case 10:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field SubResource", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field OldObject", wireType)
}
var msglen int
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
}
if iNdEx >= l {
return io.ErrUnexpectedEOF
}
b := dAtA[iNdEx]
iNdEx++
msglen |= (int(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
if msglen < 0 {
return ErrInvalidLengthGenerated
}
postIndex := iNdEx + msglen
if postIndex > l {
return io.ErrUnexpectedEOF
}
if err := m.OldObject.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
iNdEx = postIndex
default:
iNdEx = preIndex
skippy, err := skipGenerated(dAtA[iNdEx:])
if err != nil {
return err
}
if skippy < 0 {
return ErrInvalidLengthGenerated
}
if (iNdEx + skippy) > l {
return io.ErrUnexpectedEOF
}
iNdEx += skippy
}
}
if iNdEx > l {
return io.ErrUnexpectedEOF
}
return nil
}
func (m *AdmissionResponse) Unmarshal(dAtA []byte) error {
l := len(dAtA)
iNdEx := 0
for iNdEx < l {
preIndex := iNdEx
var wire uint64
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
}
if iNdEx >= l {
return io.ErrUnexpectedEOF
}
b := dAtA[iNdEx]
iNdEx++
wire |= (uint64(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
fieldNum := int32(wire >> 3)
wireType := int(wire & 0x7)
if wireType == 4 {
return fmt.Errorf("proto: AdmissionResponse: wiretype end group for non-group")
}
if fieldNum <= 0 {
return fmt.Errorf("proto: AdmissionResponse: illegal tag %d (wire type %d)", fieldNum, wire)
}
switch fieldNum {
case 1:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
}
var stringLen uint64
for shift := uint(0); ; shift += 7 {
......@@ -720,11 +794,31 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
if postIndex > l {
return io.ErrUnexpectedEOF
}
m.SubResource = string(dAtA[iNdEx:postIndex])
m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
iNdEx = postIndex
case 9:
case 2:
if wireType != 0 {
return fmt.Errorf("proto: wrong wireType = %d for field Allowed", wireType)
}
var v int
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
}
if iNdEx >= l {
return io.ErrUnexpectedEOF
}
b := dAtA[iNdEx]
iNdEx++
v |= (int(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
m.Allowed = bool(v != 0)
case 3:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field UserInfo", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field Result", wireType)
}
var msglen int
for shift := uint(0); ; shift += 7 {
......@@ -748,10 +842,74 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
if postIndex > l {
return io.ErrUnexpectedEOF
}
if err := m.UserInfo.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
if m.Result == nil {
m.Result = &k8s_io_apimachinery_pkg_apis_meta_v1.Status{}
}
if err := m.Result.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
iNdEx = postIndex
case 4:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Patch", wireType)
}
var byteLen int
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
}
if iNdEx >= l {
return io.ErrUnexpectedEOF
}
b := dAtA[iNdEx]
iNdEx++
byteLen |= (int(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
if byteLen < 0 {
return ErrInvalidLengthGenerated
}
postIndex := iNdEx + byteLen
if postIndex > l {
return io.ErrUnexpectedEOF
}
m.Patch = append(m.Patch[:0], dAtA[iNdEx:postIndex]...)
if m.Patch == nil {
m.Patch = []byte{}
}
iNdEx = postIndex
case 5:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field PatchType", wireType)
}
var stringLen uint64
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
}
if iNdEx >= l {
return io.ErrUnexpectedEOF
}
b := dAtA[iNdEx]
iNdEx++
stringLen |= (uint64(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
intStringLen := int(stringLen)
if intStringLen < 0 {
return ErrInvalidLengthGenerated
}
postIndex := iNdEx + intStringLen
if postIndex > l {
return io.ErrUnexpectedEOF
}
s := PatchType(dAtA[iNdEx:postIndex])
m.PatchType = &s
iNdEx = postIndex
default:
iNdEx = preIndex
skippy, err := skipGenerated(dAtA[iNdEx:])
......@@ -773,7 +931,7 @@ func (m *AdmissionReviewSpec) Unmarshal(dAtA []byte) error {
}
return nil
}
func (m *AdmissionReviewStatus) Unmarshal(dAtA []byte) error {
func (m *AdmissionReview) Unmarshal(dAtA []byte) error {
l := len(dAtA)
iNdEx := 0
for iNdEx < l {
......@@ -796,17 +954,17 @@ func (m *AdmissionReviewStatus) Unmarshal(dAtA []byte) error {
fieldNum := int32(wire >> 3)
wireType := int(wire & 0x7)
if wireType == 4 {
return fmt.Errorf("proto: AdmissionReviewStatus: wiretype end group for non-group")
return fmt.Errorf("proto: AdmissionReview: wiretype end group for non-group")
}
if fieldNum <= 0 {
return fmt.Errorf("proto: AdmissionReviewStatus: illegal tag %d (wire type %d)", fieldNum, wire)
return fmt.Errorf("proto: AdmissionReview: illegal tag %d (wire type %d)", fieldNum, wire)
}
switch fieldNum {
case 1:
if wireType != 0 {
return fmt.Errorf("proto: wrong wireType = %d for field Allowed", wireType)
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Request", wireType)
}
var v int
var msglen int
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowGenerated
......@@ -816,15 +974,28 @@ func (m *AdmissionReviewStatus) Unmarshal(dAtA []byte) error {
}
b := dAtA[iNdEx]
iNdEx++
v |= (int(b) & 0x7F) << shift
msglen |= (int(b) & 0x7F) << shift
if b < 0x80 {
break
}
}
m.Allowed = bool(v != 0)
if msglen < 0 {
return ErrInvalidLengthGenerated
}
postIndex := iNdEx + msglen
if postIndex > l {
return io.ErrUnexpectedEOF
}
if m.Request == nil {
m.Request = &AdmissionRequest{}
}
if err := m.Request.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
iNdEx = postIndex
case 2:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Result", wireType)
return fmt.Errorf("proto: wrong wireType = %d for field Response", wireType)
}
var msglen int
for shift := uint(0); ; shift += 7 {
......@@ -848,10 +1019,10 @@ func (m *AdmissionReviewStatus) Unmarshal(dAtA []byte) error {
if postIndex > l {
return io.ErrUnexpectedEOF
}
if m.Result == nil {
m.Result = &k8s_io_apimachinery_pkg_apis_meta_v1.Status{}
if m.Response == nil {
m.Response = &AdmissionResponse{}
}
if err := m.Result.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
if err := m.Response.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
return err
}
iNdEx = postIndex
......@@ -986,46 +1157,52 @@ func init() {
}
var fileDescriptorGenerated = []byte{
// 645 bytes of a gzipped FileDescriptorProto
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x94, 0xcf, 0x4f, 0x13, 0x41,
0x14, 0xc7, 0xbb, 0x5a, 0x4a, 0x3b, 0x18, 0xd1, 0x21, 0x26, 0x1b, 0x12, 0x17, 0xc2, 0xc1, 0x60,
0x02, 0xb3, 0x01, 0x91, 0x18, 0xe3, 0x85, 0x26, 0x6a, 0x8c, 0x09, 0x98, 0x01, 0x8c, 0x31, 0xc6,
0x64, 0xba, 0x7d, 0xb4, 0x63, 0xbb, 0x33, 0x9b, 0x9d, 0xd9, 0xa2, 0x37, 0xff, 0x04, 0x0f, 0xfe,
0x1d, 0xfe, 0x17, 0x26, 0x1c, 0x39, 0x72, 0x22, 0x52, 0xff, 0x0b, 0x4f, 0x66, 0x67, 0x67, 0x77,
0x4b, 0xa1, 0x2a, 0x9e, 0xda, 0xf7, 0xe3, 0xfb, 0x99, 0xf7, 0xde, 0xbc, 0x59, 0xf4, 0xac, 0xf7,
0x48, 0x11, 0x2e, 0xfd, 0x5e, 0xd2, 0x82, 0x58, 0x80, 0x06, 0xe5, 0x0f, 0x40, 0xb4, 0x65, 0xec,
0xdb, 0x00, 0x8b, 0xb8, 0xcf, 0xda, 0x21, 0x57, 0x8a, 0x4b, 0xe1, 0x0f, 0xd6, 0x58, 0x3f, 0xea,
0xb2, 0x35, 0xbf, 0x03, 0x02, 0x62, 0xa6, 0xa1, 0x4d, 0xa2, 0x58, 0x6a, 0x89, 0xef, 0x66, 0xe9,
0x84, 0x45, 0x9c, 0x14, 0xe9, 0x24, 0x4f, 0x9f, 0x5f, 0xed, 0x70, 0xdd, 0x4d, 0x5a, 0x24, 0x90,
0xa1, 0xdf, 0x91, 0x1d, 0xe9, 0x1b, 0x55, 0x2b, 0x39, 0x30, 0x96, 0x31, 0xcc, 0xbf, 0x8c, 0x36,
0xbf, 0x32, 0x7a, 0x78, 0xa2, 0xbb, 0x20, 0x34, 0x0f, 0x98, 0xce, 0x2a, 0x18, 0x3f, 0x7b, 0x7e,
0xa3, 0xcc, 0x0e, 0x59, 0xd0, 0xe5, 0x02, 0xe2, 0x4f, 0x7e, 0xd4, 0xeb, 0xa4, 0x0e, 0xe5, 0x87,
0xa0, 0xd9, 0x65, 0x2a, 0x7f, 0x92, 0x2a, 0x4e, 0x84, 0xe6, 0x21, 0x5c, 0x10, 0x6c, 0xfe, 0x4d,
0xa0, 0x82, 0x2e, 0x84, 0xec, 0x82, 0xee, 0xc1, 0x24, 0x5d, 0xa2, 0x79, 0xdf, 0xe7, 0x42, 0x2b,
0x1d, 0x8f, 0x8b, 0x96, 0xbe, 0x3b, 0x68, 0x76, 0x2b, 0x9f, 0x23, 0x85, 0x01, 0x87, 0x43, 0xbc,
0x87, 0xaa, 0x2a, 0x82, 0xc0, 0x75, 0x16, 0x9d, 0xe5, 0x99, 0xf5, 0x75, 0xf2, 0xc7, 0x91, 0x93,
0x31, 0xf5, 0x6e, 0x04, 0x41, 0xf3, 0xc6, 0xd1, 0xe9, 0x42, 0x65, 0x78, 0xba, 0x50, 0x4d, 0x2d,
0x6a, 0x68, 0xf8, 0x1d, 0xaa, 0x29, 0xcd, 0x74, 0xa2, 0xdc, 0x6b, 0x86, 0xbb, 0x71, 0x45, 0xae,
0xd1, 0x36, 0x6f, 0x5a, 0x72, 0x2d, 0xb3, 0xa9, 0x65, 0x2e, 0x7d, 0x9b, 0x42, 0x73, 0x97, 0x54,
0x82, 0xdf, 0xa0, 0x6a, 0x8f, 0x8b, 0xb6, 0xed, 0x65, 0x73, 0xe4, 0xcc, 0x62, 0x46, 0x24, 0xea,
0x75, 0x52, 0x87, 0x22, 0xe9, 0x15, 0x92, 0xc1, 0x1a, 0x79, 0x1e, 0xcb, 0x24, 0x7a, 0x0d, 0x71,
0xca, 0x7a, 0xc9, 0x45, 0xbb, 0xec, 0x27, 0xb5, 0xa8, 0x21, 0xe2, 0x7d, 0x54, 0x93, 0xad, 0x0f,
0x10, 0x68, 0xdb, 0xcf, 0xea, 0x44, 0xb6, 0xbd, 0x37, 0x42, 0xd9, 0xe1, 0xd3, 0x8f, 0x1a, 0x44,
0x8a, 0x2d, 0x1b, 0xd9, 0x31, 0x10, 0x6a, 0x61, 0xf8, 0x3d, 0x6a, 0xc8, 0x7e, 0x3b, 0x73, 0xba,
0xd7, 0xff, 0x87, 0x7c, 0xdb, 0x92, 0x1b, 0x3b, 0x39, 0x87, 0x96, 0x48, 0xfc, 0x04, 0x35, 0x64,
0x94, 0xae, 0x00, 0x97, 0xc2, 0xad, 0x2e, 0x3a, 0xcb, 0x8d, 0xa6, 0x57, 0x08, 0xf2, 0xc0, 0xaf,
0x51, 0x83, 0x96, 0x02, 0xbc, 0x88, 0xaa, 0x82, 0x85, 0xe0, 0x4e, 0x19, 0x61, 0x31, 0x96, 0x6d,
0x16, 0x02, 0x35, 0x11, 0xec, 0xa3, 0x46, 0xfa, 0xab, 0x22, 0x16, 0x80, 0x5b, 0x33, 0x69, 0x45,
0x41, 0xdb, 0x79, 0x80, 0x96, 0x39, 0xb8, 0x8b, 0xea, 0x31, 0x28, 0x99, 0xc4, 0x01, 0xb8, 0xd3,
0xa6, 0xdf, 0xc7, 0x57, 0xbf, 0x25, 0x6a, 0x09, 0xcd, 0x5b, 0xf6, 0xac, 0x7a, 0xee, 0xa1, 0x05,
0x1d, 0x3f, 0x44, 0x33, 0x2a, 0x69, 0xe5, 0x01, 0xb7, 0x6e, 0x8a, 0x9b, 0xb3, 0x82, 0x99, 0xdd,
0x32, 0x44, 0x47, 0xf3, 0xf0, 0x1e, 0xaa, 0x27, 0x0a, 0xe2, 0x17, 0xe2, 0x40, 0xba, 0x0d, 0x53,
0xe0, 0xbd, 0x73, 0xab, 0x7b, 0xee, 0xbb, 0x91, 0x16, 0xb6, 0x6f, 0xb3, 0xcb, 0x62, 0x72, 0x0f,
0x2d, 0x48, 0x4b, 0x5f, 0x1d, 0x74, 0xe7, 0xd2, 0x15, 0xc7, 0xf7, 0xd1, 0x34, 0xeb, 0xf7, 0xe5,
0x21, 0x64, 0x5b, 0x5b, 0x6f, 0xce, 0x5a, 0xcc, 0xf4, 0x56, 0xe6, 0xa6, 0x79, 0x1c, 0xbf, 0x1a,
0x7b, 0x53, 0x2b, 0xff, 0x36, 0x39, 0xfb, 0x96, 0x50, 0xba, 0x7e, 0x14, 0x54, 0xd2, 0xd7, 0xf9,
0x3b, 0x6a, 0x92, 0xa3, 0x33, 0xaf, 0x72, 0x7c, 0xe6, 0x55, 0x4e, 0xce, 0xbc, 0xca, 0xe7, 0xa1,
0xe7, 0x1c, 0x0d, 0x3d, 0xe7, 0x78, 0xe8, 0x39, 0x27, 0x43, 0xcf, 0xf9, 0x31, 0xf4, 0x9c, 0x2f,
0x3f, 0xbd, 0xca, 0xdb, 0x7a, 0xfe, 0x4a, 0x7f, 0x07, 0x00, 0x00, 0xff, 0xff, 0xa0, 0x57, 0xa7,
0x50, 0xd8, 0x05, 0x00, 0x00,
// 742 bytes of a gzipped FileDescriptorProto
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x54, 0x4f, 0x4f, 0xdb, 0x48,
0x14, 0x8f, 0x21, 0xff, 0x3c, 0x41, 0x0b, 0xcc, 0x5e, 0xac, 0x48, 0xeb, 0xb0, 0x1c, 0x56, 0xac,
0x04, 0x63, 0x60, 0x77, 0x11, 0x5a, 0xf5, 0x82, 0x45, 0x5b, 0xa1, 0x4a, 0x80, 0x06, 0x82, 0x2a,
0x0e, 0x95, 0x26, 0xce, 0x90, 0x4c, 0x13, 0x7b, 0x5c, 0xcf, 0x38, 0x94, 0x5b, 0x3f, 0x42, 0xbf,
0x49, 0x3f, 0x45, 0x25, 0x8e, 0x1c, 0x39, 0x45, 0x25, 0xfd, 0x00, 0xbd, 0x73, 0xaa, 0x3c, 0x1e,
0xc7, 0x29, 0x34, 0x2d, 0xad, 0x7a, 0x8a, 0xdf, 0x7b, 0xbf, 0xdf, 0xef, 0x4d, 0x7e, 0xef, 0xcd,
0x80, 0x27, 0xbd, 0x6d, 0x81, 0x18, 0x77, 0x7a, 0x71, 0x8b, 0x46, 0x01, 0x95, 0x54, 0x38, 0x03,
0x1a, 0xb4, 0x79, 0xe4, 0xe8, 0x02, 0x09, 0x99, 0x43, 0xda, 0x3e, 0x13, 0x82, 0xf1, 0xc0, 0x19,
0x6c, 0x90, 0x7e, 0xd8, 0x25, 0x1b, 0x4e, 0x87, 0x06, 0x34, 0x22, 0x92, 0xb6, 0x51, 0x18, 0x71,
0xc9, 0xe1, 0x1f, 0x29, 0x1c, 0x91, 0x90, 0xa1, 0x31, 0x1c, 0x65, 0xf0, 0xfa, 0x5a, 0x87, 0xc9,
0x6e, 0xdc, 0x42, 0x1e, 0xf7, 0x9d, 0x0e, 0xef, 0x70, 0x47, 0xb1, 0x5a, 0xf1, 0x99, 0x8a, 0x54,
0xa0, 0xbe, 0x52, 0xb5, 0xfa, 0xea, 0x64, 0xf3, 0x58, 0x76, 0x69, 0x20, 0x99, 0x47, 0x64, 0x7a,
0x82, 0xbb, 0xbd, 0xeb, 0xff, 0xe6, 0x68, 0x9f, 0x78, 0x5d, 0x16, 0xd0, 0xe8, 0xc2, 0x09, 0x7b,
0x9d, 0x24, 0x21, 0x1c, 0x9f, 0x4a, 0xf2, 0x35, 0x96, 0x33, 0x8d, 0x15, 0xc5, 0x81, 0x64, 0x3e,
0xbd, 0x47, 0xd8, 0xfa, 0x1e, 0x41, 0x78, 0x5d, 0xea, 0x93, 0x7b, 0xbc, 0x7f, 0xa6, 0xf1, 0x62,
0xc9, 0xfa, 0x0e, 0x0b, 0xa4, 0x90, 0xd1, 0x5d, 0xd2, 0xf2, 0xa7, 0x12, 0x58, 0xd8, 0xc9, 0x7c,
0xc4, 0xf4, 0x55, 0x4c, 0x85, 0x84, 0x2e, 0x98, 0x8d, 0x59, 0xdb, 0x32, 0x96, 0x8c, 0x15, 0xd3,
0x5d, 0xbf, 0x1c, 0x36, 0x0a, 0xa3, 0x61, 0x63, 0xb6, 0xb9, 0xb7, 0x7b, 0x3b, 0x6c, 0xfc, 0x39,
0xad, 0x8b, 0xbc, 0x08, 0xa9, 0x40, 0xcd, 0xbd, 0x5d, 0x9c, 0x90, 0xe1, 0x73, 0x50, 0xec, 0xb1,
0xa0, 0x6d, 0xcd, 0x2c, 0x19, 0x2b, 0xb5, 0xcd, 0x2d, 0x94, 0xcf, 0x6d, 0x4c, 0x43, 0x61, 0xaf,
0x93, 0x24, 0x04, 0x4a, 0xbc, 0x43, 0x83, 0x0d, 0xf4, 0x34, 0xe2, 0x71, 0x78, 0x42, 0xa3, 0xe4,
0x30, 0xcf, 0x58, 0xd0, 0x76, 0xe7, 0x74, 0xf3, 0x62, 0x12, 0x61, 0xa5, 0x08, 0xbb, 0xa0, 0x1a,
0x51, 0xc1, 0xe3, 0xc8, 0xa3, 0xd6, 0xac, 0x52, 0xff, 0xff, 0xc7, 0xd5, 0xb1, 0x56, 0x70, 0x17,
0x74, 0x87, 0x6a, 0x96, 0xc1, 0x63, 0x75, 0xf8, 0x1f, 0xa8, 0x89, 0xb8, 0x95, 0x15, 0xac, 0xa2,
0xf2, 0xe3, 0x77, 0x4d, 0xa8, 0x1d, 0xe5, 0x25, 0x3c, 0x89, 0x83, 0x4b, 0xa0, 0x18, 0x10, 0x9f,
0x5a, 0x25, 0x85, 0x1f, 0xff, 0x85, 0x7d, 0xe2, 0x53, 0xac, 0x2a, 0xd0, 0x01, 0x66, 0xf2, 0x2b,
0x42, 0xe2, 0x51, 0xab, 0xac, 0x60, 0x8b, 0x1a, 0x66, 0xee, 0x67, 0x05, 0x9c, 0x63, 0xe0, 0x23,
0x60, 0xf2, 0x30, 0x19, 0x1c, 0xe3, 0x81, 0x55, 0x51, 0x04, 0x3b, 0x23, 0x1c, 0x64, 0x85, 0xdb,
0xc9, 0x00, 0xe7, 0x04, 0x78, 0x0c, 0xaa, 0xb1, 0xa0, 0xd1, 0x5e, 0x70, 0xc6, 0xad, 0xaa, 0x72,
0xec, 0x2f, 0x34, 0x79, 0x8f, 0xbe, 0xd8, 0xfc, 0xc4, 0xa9, 0xa6, 0x46, 0xe7, 0xee, 0x64, 0x19,
0x3c, 0x56, 0x82, 0x4d, 0x50, 0xe6, 0xad, 0x97, 0xd4, 0x93, 0x96, 0xa9, 0x34, 0xd7, 0xa6, 0x4e,
0x41, 0x2f, 0x2e, 0xc2, 0xe4, 0xfc, 0xf1, 0x6b, 0x49, 0x83, 0x64, 0x00, 0xee, 0x6f, 0x5a, 0xba,
0x7c, 0xa0, 0x44, 0xb0, 0x16, 0x83, 0x2f, 0x80, 0xc9, 0xfb, 0xed, 0x34, 0x69, 0x81, 0x9f, 0x51,
0x1e, 0x5b, 0x79, 0x90, 0xe9, 0xe0, 0x5c, 0x72, 0xf9, 0xdd, 0x0c, 0x58, 0x9c, 0xd8, 0x78, 0x11,
0xf2, 0x40, 0xd0, 0x5f, 0xb2, 0xf2, 0x7f, 0x83, 0x0a, 0xe9, 0xf7, 0xf9, 0x39, 0x4d, 0xb7, 0xbe,
0xea, 0xce, 0x6b, 0x9d, 0xca, 0x4e, 0x9a, 0xc6, 0x59, 0x1d, 0x1e, 0x82, 0xb2, 0x90, 0x44, 0xc6,
0x42, 0x6f, 0xf0, 0xea, 0xc3, 0x36, 0xf8, 0x48, 0x71, 0x5c, 0x90, 0xd8, 0x86, 0xa9, 0x88, 0xfb,
0x12, 0x6b, 0x1d, 0xd8, 0x00, 0xa5, 0x90, 0x48, 0xaf, 0xab, 0xb6, 0x74, 0xce, 0x35, 0x47, 0xc3,
0x46, 0xe9, 0x30, 0x49, 0xe0, 0x34, 0x0f, 0xb7, 0x81, 0xa9, 0x3e, 0x8e, 0x2f, 0xc2, 0x6c, 0x35,
0xeb, 0x89, 0x49, 0x87, 0x59, 0xf2, 0x76, 0x32, 0xc0, 0x39, 0x78, 0xf9, 0xbd, 0x01, 0xe6, 0x27,
0x1c, 0x1b, 0x30, 0x7a, 0x0e, 0x4f, 0x40, 0x25, 0x4a, 0x5f, 0x0b, 0xe5, 0x59, 0x6d, 0xd3, 0x41,
0xdf, 0x7c, 0x99, 0xd1, 0xdd, 0x47, 0xc6, 0xad, 0x25, 0xc6, 0xe8, 0x00, 0x67, 0x62, 0xf0, 0x54,
0x5d, 0x6e, 0x35, 0x13, 0xfd, 0x74, 0xac, 0x3f, 0x5c, 0x38, 0xe5, 0xb9, 0x73, 0xfa, 0x3a, 0xab,
0x08, 0x8f, 0xf5, 0x5c, 0x74, 0x79, 0x63, 0x17, 0xae, 0x6e, 0xec, 0xc2, 0xf5, 0x8d, 0x5d, 0x78,
0x33, 0xb2, 0x8d, 0xcb, 0x91, 0x6d, 0x5c, 0x8d, 0x6c, 0xe3, 0x7a, 0x64, 0x1b, 0x1f, 0x46, 0xb6,
0xf1, 0xf6, 0xa3, 0x5d, 0x38, 0xad, 0x66, 0xca, 0x9f, 0x03, 0x00, 0x00, 0xff, 0xff, 0x90, 0xe5,
0xf8, 0x2e, 0xb4, 0x06, 0x00, 0x00,
}
staging/src/k8s.io/api/admission/v1alpha1/generated.proto
View file @ dac3c2e1
......@@ -30,33 +30,27 @@ import "k8s.io/apimachinery/pkg/util/intstr/generated.proto";
// Package-wide variables from generator "generated".
option go_package = "v1alpha1";
// AdmissionReview describes an admission request.
message AdmissionReview {
// Spec describes the attributes for the admission request.
// Since this admission controller is non-mutating the webhook should avoid setting this in its response to avoid the
// cost of deserializing it.
// +optional
optional AdmissionReviewSpec spec = 1;
// Status is filled in by the webhook and indicates whether the admission request should be permitted.
// +optional
optional AdmissionReviewStatus status = 2;
}
// AdmissionRequest describes the admission.Attributes for the admission request.
message AdmissionRequest {
// UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
optional string uid = 1;
// AdmissionReviewSpec describes the admission.Attributes for the admission request.
message AdmissionReviewSpec {
// Kind is the type of object being manipulated. For example: Pod
optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 1;
optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;
// Object is the object from the incoming request prior to default values being applied
optional k8s.io.apimachinery.pkg.runtime.RawExtension object = 2;
// Resource is the name of the resource being requested. This is not the kind. For example: pods
optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;
// OldObject is the existing object. Only populated for UPDATE requests.
// SubResource is the name of the subresource being requested. This is a different resource, scoped to the parent
// resource, but it may have a different kind. For instance, /pods has the resource "pods" and the kind "Pod", while
// /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod" (because status operates on
// pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource
// "binding", and kind "Binding".
// +optional
optional k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 3;
// Operation is the operation being performed
optional string operation = 4;
optional string subResource = 4;
// Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
// rely on the server to generate the name. If that is the case, this method will return the empty string.
......@@ -67,29 +61,52 @@ message AdmissionReviewSpec {
// +optional
optional string namespace = 6;
// Resource is the name of the resource being requested. This is not the kind. For example: pods
optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 7;
// Operation is the operation being performed
optional string operation = 7;
// SubResource is the name of the subresource being requested. This is a different resource, scoped to the parent
// resource, but it may have a different kind. For instance, /pods has the resource "pods" and the kind "Pod", while
// /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod" (because status operates on
// pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource
// "binding", and kind "Binding".
// UserInfo is information about the requesting user
optional k8s.io.api.authentication.v1.UserInfo userInfo = 8;
// Object is the object from the incoming request prior to default values being applied
// +optional
optional string subResource = 8;
optional k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;
// UserInfo is information about the requesting user
optional k8s.io.api.authentication.v1.UserInfo userInfo = 9;
// OldObject is the existing object. Only populated for UPDATE requests.
// +optional
optional k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;
}
// AdmissionReviewStatus describes the status of the admission request.
message AdmissionReviewStatus {
// AdmissionResponse describes an admission response.
message AdmissionResponse {
// UID is an identifier for the individual request/response.
// This should be copied over from the corresponding AdmissionRequest.
optional string uid = 1;
// Allowed indicates whether or not the admission request was permitted.
optional bool allowed = 1;
optional bool allowed = 2;
// Result contains extra details into why an admission request was denied.
// This field IS NOT consulted in any way if "Allowed" is "true".
// +optional
optional k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 2;
optional k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;
// The patch body. Currently we only support "JSONPatch" which implements RFC 6902.
// +optional
optional bytes patch = 4;
// The type of Patch. Currently we only allow "JSONPatch".
// +optional
optional string patchType = 5;
}
// AdmissionReview describes an admission review request/response.
message AdmissionReview {
// Request describes the attributes for the admission request.
// +optional
optional AdmissionRequest request = 1;
// Response describes the attributes for the admission response.
// +optional
optional AdmissionResponse response = 2;
}
staging/src/k8s.io/api/admission/v1alpha1/types.go
View file @ dac3c2e1
......@@ -20,34 +20,40 @@ import (
authenticationv1 "k8s.io/api/authentication/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
)
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// AdmissionReview describes an admission request.
// AdmissionReview describes an admission review request/response.
type AdmissionReview struct {
metav1.TypeMeta `json:",inline"`
// Spec describes the attributes for the admission request.
// Since this admission controller is non-mutating the webhook should avoid setting this in its response to avoid the
// cost of deserializing it.
// Request describes the attributes for the admission request.
// +optional
Spec AdmissionReviewSpec `json:"spec,omitempty" protobuf:"bytes,1,opt,name=spec"`
// Status is filled in by the webhook and indicates whether the admission request should be permitted.
Request *AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`
// Response describes the attributes for the admission response.
// +optional
Status AdmissionReviewStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
Response *AdmissionResponse `json:"response,omitempty" protobuf:"bytes,2,opt,name=response"`
}
// AdmissionReviewSpec describes the admission.Attributes for the admission request.
type AdmissionReviewSpec struct {
// AdmissionRequest describes the admission.Attributes for the admission request.
type AdmissionRequest struct {
// UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
// otherwise identical (parallel requests, requests when earlier requests did not modify etc)
// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
// Kind is the type of object being manipulated. For example: Pod
Kind metav1.GroupVersionKind `json:"kind,omitempty" protobuf:"bytes,1,opt,name=kind"`
// Object is the object from the incoming request prior to default values being applied
Object runtime.RawExtension `json:"object,omitempty" protobuf:"bytes,2,opt,name=object"`
// OldObject is the existing object. Only populated for UPDATE requests.
Kind metav1.GroupVersionKind `json:"kind" protobuf:"bytes,2,opt,name=kind"`
// Resource is the name of the resource being requested. This is not the kind. For example: pods
Resource metav1.GroupVersionResource `json:"resource" protobuf:"bytes,3,opt,name=resource"`
// SubResource is the name of the subresource being requested. This is a different resource, scoped to the parent
// resource, but it may have a different kind. For instance, /pods has the resource "pods" and the kind "Pod", while
// /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod" (because status operates on
// pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource
// "binding", and kind "Binding".
// +optional
OldObject runtime.RawExtension `json:"oldObject,omitempty" protobuf:"bytes,3,opt,name=oldObject"`
// Operation is the operation being performed
Operation Operation `json:"operation,omitempty" protobuf:"bytes,4,opt,name=operation"`
SubResource string `json:"subResource,omitempty" protobuf:"bytes,4,opt,name=subResource"`
// Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
// rely on the server to generate the name. If that is the case, this method will return the empty string.
// +optional
......@@ -55,29 +61,49 @@ type AdmissionReviewSpec struct {
// Namespace is the namespace associated with the request (if any).
// +optional
Namespace string `json:"namespace,omitempty" protobuf:"bytes,6,opt,name=namespace"`
// Resource is the name of the resource being requested. This is not the kind. For example: pods
Resource metav1.GroupVersionResource `json:"resource,omitempty" protobuf:"bytes,7,opt,name=resource"`
// SubResource is the name of the subresource being requested. This is a different resource, scoped to the parent
// resource, but it may have a different kind. For instance, /pods has the resource "pods" and the kind "Pod", while
// /pods/foo/status has the resource "pods", the sub resource "status", and the kind "Pod" (because status operates on
// pods). The binding resource for a pod though may be /pods/foo/binding, which has resource "pods", subresource
// "binding", and kind "Binding".
// +optional
SubResource string `json:"subResource,omitempty" protobuf:"bytes,8,opt,name=subResource"`
// Operation is the operation being performed
Operation Operation `json:"operation" protobuf:"bytes,7,opt,name=operation"`
// UserInfo is information about the requesting user
UserInfo authenticationv1.UserInfo `json:"userInfo,omitempty" protobuf:"bytes,9,opt,name=userInfo"`
UserInfo authenticationv1.UserInfo `json:"userInfo" protobuf:"bytes,8,opt,name=userInfo"`
// Object is the object from the incoming request prior to default values being applied
// +optional
Object runtime.RawExtension `json:"object,omitempty" protobuf:"bytes,9,opt,name=object"`
// OldObject is the existing object. Only populated for UPDATE requests.
// +optional
OldObject runtime.RawExtension `json:"oldObject,omitempty" protobuf:"bytes,10,opt,name=oldObject"`
}
// AdmissionReviewStatus describes the status of the admission request.
type AdmissionReviewStatus struct {
// AdmissionResponse describes an admission response.
type AdmissionResponse struct {
// UID is an identifier for the individual request/response.
// This should be copied over from the corresponding AdmissionRequest.
UID types.UID `json:"uid" protobuf:"bytes,1,opt,name=uid"`
// Allowed indicates whether or not the admission request was permitted.
Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"`
Allowed bool `json:"allowed" protobuf:"varint,2,opt,name=allowed"`
// Result contains extra details into why an admission request was denied.
// This field IS NOT consulted in any way if "Allowed" is "true".
// +optional
Result *metav1.Status `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
Result *metav1.Status `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
// The patch body. Currently we only support "JSONPatch" which implements RFC 6902.
// +optional
Patch []byte `json:"patch,omitempty" protobuf:"bytes,4,opt,name=patch"`
// The type of Patch. Currently we only allow "JSONPatch".
// +optional
PatchType *PatchType `json:"patchType,omitempty" protobuf:"bytes,5,opt,name=patchType"`
}
// PatchType is the type of patch being used to represent the mutated object
type PatchType string
// PatchType constants.
const (
PatchTypeJSONPatch PatchType = "JSONPatch"
)
// Operation is the type of resource operation being checked for admission control
type Operation string
......
staging/src/k8s.io/api/admission/v1alpha1/types_swagger_doc_generated.go
View file @ dac3c2e1
......@@ -27,41 +27,45 @@ package v1alpha1
// Those methods can be generated by using hack/update-generated-swagger-docs.sh
// AUTO-GENERATED FUNCTIONS START HERE
var map_AdmissionReview = map[string]string{
"": "AdmissionReview describes an admission request.",
"spec": "Spec describes the attributes for the admission request. Since this admission controller is non-mutating the webhook should avoid setting this in its response to avoid the cost of deserializing it.",
"status": "Status is filled in by the webhook and indicates whether the admission request should be permitted.",
}
func (AdmissionReview) SwaggerDoc() map[string]string {
return map_AdmissionReview
}
var map_AdmissionReviewSpec = map[string]string{
"": "AdmissionReviewSpec describes the admission.Attributes for the admission request.",
var map_AdmissionRequest = map[string]string{
"": "AdmissionRequest describes the admission.Attributes for the admission request.",
"uid": "UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.",
"kind": "Kind is the type of object being manipulated. For example: Pod",
"object": "Object is the object from the incoming request prior to default values being applied",
"oldObject": "OldObject is the existing object. Only populated for UPDATE requests.",
"operation": "Operation is the operation being performed",
"name": "Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and rely on the server to generate the name. If that is the case, this method will return the empty string.",
"namespace": "Namespace is the namespace associated with the request (if any).",
"resource": "Resource is the name of the resource being requested. This is not the kind. For example: pods",
"subResource": "SubResource is the name of the subresource being requested. This is a different resource, scoped to the parent resource, but it may have a different kind. For instance, /pods has the resource \"pods\" and the kind \"Pod\", while /pods/foo/status has the resource \"pods\", the sub resource \"status\", and the kind \"Pod\" (because status operates on pods). The binding resource for a pod though may be /pods/foo/binding, which has resource \"pods\", subresource \"binding\", and kind \"Binding\".",
"name": "Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and rely on the server to generate the name. If that is the case, this method will return the empty string.",
"namespace": "Namespace is the namespace associated with the request (if any).",
"operation": "Operation is the operation being performed",
"userInfo": "UserInfo is information about the requesting user",
"object": "Object is the object from the incoming request prior to default values being applied",
"oldObject": "OldObject is the existing object. Only populated for UPDATE requests.",
}
func (AdmissionRequest) SwaggerDoc() map[string]string {
return map_AdmissionRequest
}
var map_AdmissionResponse = map[string]string{
"": "AdmissionResponse describes an admission response.",
"uid": "UID is an identifier for the individual request/response. This should be copied over from the corresponding AdmissionRequest.",
"allowed": "Allowed indicates whether or not the admission request was permitted.",
"status": "Result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\".",
"patch": "The patch body. Currently we only support \"JSONPatch\" which implements RFC 6902.",
"patchType": "The type of Patch. Currently we only allow \"JSONPatch\".",
}
func (AdmissionReviewSpec) SwaggerDoc() map[string]string {
return map_AdmissionReviewSpec
func (AdmissionResponse) SwaggerDoc() map[string]string {
return map_AdmissionResponse
}
var map_AdmissionReviewStatus = map[string]string{
"": "AdmissionReviewStatus describes the status of the admission request.",
"allowed": "Allowed indicates whether or not the admission request was permitted.",
"status": "Result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\".",
var map_AdmissionReview = map[string]string{
"": "AdmissionReview describes an admission review request/response.",
"request": "Request describes the attributes for the admission request.",
"response": "Response describes the attributes for the admission response.",
}
func (AdmissionReviewStatus) SwaggerDoc() map[string]string {
return map_AdmissionReviewStatus
func (AdmissionReview) SwaggerDoc() map[string]string {
return map_AdmissionReview
}
// AUTO-GENERATED FUNCTIONS END HERE
staging/src/k8s.io/api/admission/v1alpha1/zz_generated.deepcopy.go
View file @ dac3c2e1
......@@ -26,75 +26,105 @@ import (
)
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *AdmissionReview) DeepCopyInto(out *AdmissionReview) {
func (in *AdmissionRequest) DeepCopyInto(out *AdmissionRequest) {
*out = *in
out.TypeMeta = in.TypeMeta
in.Spec.DeepCopyInto(&out.Spec)
in.Status.DeepCopyInto(&out.Status)
out.Kind = in.Kind
out.Resource = in.Resource
in.UserInfo.DeepCopyInto(&out.UserInfo)
in.Object.DeepCopyInto(&out.Object)
in.OldObject.DeepCopyInto(&out.OldObject)
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReview.
func (in *AdmissionReview) DeepCopy() *AdmissionReview {
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionRequest.
func (in *AdmissionRequest) DeepCopy() *AdmissionRequest {
if in == nil {
return nil
}
out := new(AdmissionReview)
out := new(AdmissionRequest)
in.DeepCopyInto(out)
return out
}
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
func (in *AdmissionReview) DeepCopyObject() runtime.Object {
if c := in.DeepCopy(); c != nil {
return c
} else {
return nil
}
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *AdmissionReviewSpec) DeepCopyInto(out *AdmissionReviewSpec) {
func (in *AdmissionResponse) DeepCopyInto(out *AdmissionResponse) {
*out = *in
out.Kind = in.Kind
in.Object.DeepCopyInto(&out.Object)
in.OldObject.DeepCopyInto(&out.OldObject)
out.Resource = in.Resource
in.UserInfo.DeepCopyInto(&out.UserInfo)
if in.Result != nil {
in, out := &in.Result, &out.Result
if *in == nil {
*out = nil
} else {
*out = new(v1.Status)
(*in).DeepCopyInto(*out)
}
}
if in.Patch != nil {
in, out := &in.Patch, &out.Patch
*out = make([]byte, len(*in))
copy(*out, *in)
}
if in.PatchType != nil {
in, out := &in.PatchType, &out.PatchType
if *in == nil {
*out = nil
} else {
*out = new(PatchType)
**out = **in
}
}
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReviewSpec.
func (in *AdmissionReviewSpec) DeepCopy() *AdmissionReviewSpec {
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionResponse.
func (in *AdmissionResponse) DeepCopy() *AdmissionResponse {
if in == nil {
return nil
}
out := new(AdmissionReviewSpec)
out := new(AdmissionResponse)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *AdmissionReviewStatus) DeepCopyInto(out *AdmissionReviewStatus) {
func (in *AdmissionReview) DeepCopyInto(out *AdmissionReview) {
*out = *in
if in.Result != nil {
in, out := &in.Result, &out.Result
out.TypeMeta = in.TypeMeta
if in.Request != nil {
in, out := &in.Request, &out.Request
if *in == nil {
*out = nil
} else {
*out = new(v1.Status)
*out = new(AdmissionRequest)
(*in).DeepCopyInto(*out)
}
}
if in.Response != nil {
in, out := &in.Response, &out.Response
if *in == nil {
*out = nil
} else {
*out = new(AdmissionResponse)
(*in).DeepCopyInto(*out)
}
}
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReviewStatus.
func (in *AdmissionReviewStatus) DeepCopy() *AdmissionReviewStatus {
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AdmissionReview.
func (in *AdmissionReview) DeepCopy() *AdmissionReview {
if in == nil {
return nil
}
out := new(AdmissionReviewStatus)
out := new(AdmissionReview)
in.DeepCopyInto(out)
return out
}
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
func (in *AdmissionReview) DeepCopyObject() runtime.Object {
if c := in.DeepCopy(); c != nil {
return c
} else {
return nil
}
}
staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/request/BUILD
View file @ dac3c2e1
......@@ -13,6 +13,7 @@ go_library(
"//vendor/k8s.io/api/authentication/v1:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/util/uuid:go_default_library",
"//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
],
)
......
staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/request/admissionreview.go
View file @ dac3c2e1
......@@ -21,6 +21,7 @@ import (
authenticationv1 "k8s.io/api/authentication/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/util/uuid"
"k8s.io/apiserver/pkg/admission"
)
......@@ -42,28 +43,29 @@ func CreateAdmissionReview(attr admission.Attributes) admissionv1alpha1.Admissio
}
return admissionv1alpha1.AdmissionReview{
Spec: admissionv1alpha1.AdmissionReviewSpec{
Name: attr.GetName(),
Namespace: attr.GetNamespace(),
Request: &admissionv1alpha1.AdmissionRequest{
UID: uuid.NewUUID(),
Kind: metav1.GroupVersionKind{
Group: gvk.Group,
Kind: gvk.Kind,
Version: gvk.Version,
},
Resource: metav1.GroupVersionResource{
Group: gvr.Group,
Resource: gvr.Resource,
Version: gvr.Version,
},
SubResource: attr.GetSubresource(),
Name: attr.GetName(),
Namespace: attr.GetNamespace(),
Operation: admissionv1alpha1.Operation(attr.GetOperation()),
UserInfo: userInfo,
Object: runtime.RawExtension{
Object: attr.GetObject(),
},
OldObject: runtime.RawExtension{
Object: attr.GetOldObject(),
},
Kind: metav1.GroupVersionKind{
Group: gvk.Group,
Kind: gvk.Kind,
Version: gvk.Version,
},
UserInfo: userInfo,
},
}
}
staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/validating/admission.go
View file @ dac3c2e1
......@@ -308,9 +308,11 @@ func (a *GenericAdmissionWebhook) callHook(ctx context.Context, h *v1alpha1.Webh
return &webhookerrors.ErrCallingWebhook{WebhookName: h.Name, Reason: err}
}
if response.Status.Allowed {
if response.Response == nil {
return &webhookerrors.ErrCallingWebhook{WebhookName: h.Name, Reason: fmt.Errorf("Webhook response was absent")}
}
if response.Response.Allowed {
return nil
}
return webhookerrors.ToStatusErr(h.Name, response.Status.Result)
return webhookerrors.ToStatusErr(h.Name, response.Response.Result)
}
staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/validating/admission_test.go
View file @ dac3c2e1
......@@ -360,6 +360,28 @@ func TestAdmit(t *testing.T) {
},
errorContains: "without explanation",
},
"absent response and fail open": {
hookSource: fakeHookSource{
hooks: []registrationv1alpha1.Webhook{{
Name: "nilResponse",
ClientConfig: ccfgURL("nilResponse"),
FailurePolicy: &policyIgnore,
Rules: matchEverythingRules,
}},
},
expectAllow: true,
},
"absent response and fail closed": {
hookSource: fakeHookSource{
hooks: []registrationv1alpha1.Webhook{{
Name: "nilResponse",
ClientConfig: ccfgURL("nilResponse"),
FailurePolicy: &policyFail,
Rules: matchEverythingRules,
}},
},
errorContains: "Webhook response was absent",
},
// No need to test everything with the url case, since only the
// connection is different.
}
......@@ -587,14 +609,14 @@ func webhookHandler(w http.ResponseWriter, r *http.Request) {
case "/disallow":
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(&v1alpha1.AdmissionReview{
Status: v1alpha1.AdmissionReviewStatus{
Response: &v1alpha1.AdmissionResponse{
Allowed: false,
},
})
case "/disallowReason":
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(&v1alpha1.AdmissionReview{
Status: v1alpha1.AdmissionReviewStatus{
Response: &v1alpha1.AdmissionResponse{
Allowed: false,
Result: &metav1.Status{
Message: "you shall not pass",
......@@ -604,10 +626,13 @@ func webhookHandler(w http.ResponseWriter, r *http.Request) {
case "/allow":
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(&v1alpha1.AdmissionReview{
Status: v1alpha1.AdmissionReviewStatus{
Response: &v1alpha1.AdmissionResponse{
Allowed: true,
},
})
case "/nilResposne":
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(&v1alpha1.AdmissionReview{})
default:
http.NotFound(w, r)
}
......
test/e2e/apimachinery/webhook.go
View file @ dac3c2e1
......@@ -71,19 +71,14 @@ var serverWebhookVersion = utilversion.MustParseSemantic("v1.8.0")
var _ = SIGDescribe("AdmissionWebhook", func() {
var context *certContext
var ns string
var c clientset.Interface
f := framework.NewDefaultFramework("webhook")
framework.AddCleanupAction(func() {
// Cleanup actions will be called even when the tests are skipped and leaves namespace unset.
if len(ns) > 0 {
cleanWebhookTest(c, ns)
}
})
var client clientset.Interface
var namespaceName string
BeforeEach(func() {
c = f.ClientSet
ns = f.Namespace.Name
client = f.ClientSet
namespaceName = f.Namespace.Name
// Make sure the relevant provider supports admission webhook
framework.SkipUnlessServerVersionGTE(serverWebhookVersion, f.ClientSet.Discovery())
......@@ -95,14 +90,16 @@ var _ = SIGDescribe("AdmissionWebhook", func() {
}
By("Setting up server cert")
namespaceName := f.Namespace.Name
context = setupServerCert(namespaceName, serviceName)
createAuthReaderRoleBinding(f, namespaceName)
// Note that in 1.9 we will have backwards incompatible change to
// admission webhooks, so the image will be updated to 1.9 sometime in
// the development 1.9 cycle.
deployWebhookAndService(f, "gcr.io/kubernetes-e2e-test-images/k8s-sample-admission-webhook-amd64:1.8v3", context)
deployWebhookAndService(f, "gcr.io/kubernetes-e2e-test-images/k8s-sample-admission-webhook-amd64:1.8v5", context)
})
AfterEach(func() {
cleanWebhookTest(client, namespaceName)
})
It("Should be able to deny pod and configmap creation", func() {
......@@ -573,6 +570,7 @@ func updateConfigMap(c clientset.Interface, ns, name string, update updateConfig
func cleanWebhookTest(client clientset.Interface, namespaceName string) {
_ = client.AdmissionregistrationV1alpha1().ValidatingWebhookConfigurations().Delete(webhookConfigName, nil)
_ = client.AdmissionregistrationV1alpha1().ValidatingWebhookConfigurations().Delete(crdWebhookConfigName, nil)
_ = client.CoreV1().Services(namespaceName).Delete(serviceName, nil)
_ = client.ExtensionsV1beta1().Deployments(namespaceName).Delete(deploymentName, nil)
_ = client.CoreV1().Secrets(namespaceName).Delete(secretName, nil)
......
test/images/webhook/Makefile
View file @ dac3c2e1
......@@ -14,7 +14,7 @@
build:
CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o webhook .
docker build --no-cache -t gcr.io/kubernetes-e2e-test-images/k8s-sample-admission-webhook-amd64:1.8v3 .
docker build --no-cache -t gcr.io/kubernetes-e2e-test-images/k8s-sample-admission-webhook-amd64:1.8v5 .
rm -rf webhook
push:
gcloud docker -- push gcr.io/kubernetes-e2e-test-images/k8s-sample-admission-webhook-amd64:1.8v3
gcloud docker -- push gcr.io/kubernetes-e2e-test-images/k8s-sample-admission-webhook-amd64:1.8v5
test/images/webhook/main.go
View file @ dac3c2e1
......@@ -44,8 +44,8 @@ func (c *Config) addFlags() {
"File containing the default x509 private key matching --tls-cert-file.")
}
func toAdmissionReviewStatus(err error) *v1alpha1.AdmissionReviewStatus {
return &v1alpha1.AdmissionReviewStatus{
func toAdmissionResponse(err error) *v1alpha1.AdmissionResponse {
return &v1alpha1.AdmissionResponse{
Result: &metav1.Status{
Message: err.Error(),
},
......@@ -53,101 +53,101 @@ func toAdmissionReviewStatus(err error) *v1alpha1.AdmissionReviewStatus {
}
// only allow pods to pull images from specific registry.
func admitPods(ar v1alpha1.AdmissionReview) *v1alpha1.AdmissionReviewStatus {
func admitPods(ar v1alpha1.AdmissionReview) *v1alpha1.AdmissionResponse {
glog.V(2).Info("admitting pods")
podResource := metav1.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}
if ar.Spec.Resource != podResource {
if ar.Request.Resource != podResource {
err := fmt.Errorf("expect resource to be %s", podResource)
glog.Error(err)
return toAdmissionReviewStatus(err)
return toAdmissionResponse(err)
}
raw := ar.Spec.Object.Raw
raw := ar.Request.Object.Raw
pod := corev1.Pod{}
deserializer := codecs.UniversalDeserializer()
if _, _, err := deserializer.Decode(raw, nil, &pod); err != nil {
glog.Error(err)
return toAdmissionReviewStatus(err)
return toAdmissionResponse(err)
}
reviewStatus := v1alpha1.AdmissionReviewStatus{}
reviewStatus.Allowed = true
reviewResponse := v1alpha1.AdmissionResponse{}
reviewResponse.Allowed = true
var msg string
for k, v := range pod.Labels {
if k == "webhook-e2e-test" && v == "webhook-disallow" {
reviewStatus.Allowed = false
reviewResponse.Allowed = false
msg = msg + "the pod contains unwanted label; "
}
}
for _, container := range pod.Spec.Containers {
if strings.Contains(container.Name, "webhook-disallow") {
reviewStatus.Allowed = false
reviewResponse.Allowed = false
msg = msg + "the pod contains unwanted container name; "
}
}
if !reviewStatus.Allowed {
reviewStatus.Result = &metav1.Status{Message: strings.TrimSpace(msg)}
if !reviewResponse.Allowed {
reviewResponse.Result = &metav1.Status{Message: strings.TrimSpace(msg)}
}
return &reviewStatus
return &reviewResponse
}
// deny configmaps with specific key-value pair.
func admitConfigMaps(ar v1alpha1.AdmissionReview) *v1alpha1.AdmissionReviewStatus {
func admitConfigMaps(ar v1alpha1.AdmissionReview) *v1alpha1.AdmissionResponse {
glog.V(2).Info("admitting configmaps")
configMapResource := metav1.GroupVersionResource{Group: "", Version: "v1", Resource: "configmaps"}
if ar.Spec.Resource != configMapResource {
if ar.Request.Resource != configMapResource {
glog.Errorf("expect resource to be %s", configMapResource)
return nil
}
raw := ar.Spec.Object.Raw
raw := ar.Request.Object.Raw
configmap := corev1.ConfigMap{}
deserializer := codecs.UniversalDeserializer()
if _, _, err := deserializer.Decode(raw, nil, &configmap); err != nil {
glog.Error(err)
return toAdmissionReviewStatus(err)
return toAdmissionResponse(err)
}
reviewStatus := v1alpha1.AdmissionReviewStatus{}
reviewStatus.Allowed = true
reviewResponse := v1alpha1.AdmissionResponse{}
reviewResponse.Allowed = true
for k, v := range configmap.Data {
if k == "webhook-e2e-test" && v == "webhook-disallow" {
reviewStatus.Allowed = false
reviewStatus.Result = &metav1.Status{
reviewResponse.Allowed = false
reviewResponse.Result = &metav1.Status{
Reason: "the configmap contains unwanted key and value",
}
}
}
return &reviewStatus
return &reviewResponse
}
func admitCRD(ar v1alpha1.AdmissionReview) *v1alpha1.AdmissionReviewStatus {
func admitCRD(ar v1alpha1.AdmissionReview) *v1alpha1.AdmissionResponse {
glog.V(2).Info("admitting crd")
cr := struct {
metav1.ObjectMeta
Data map[string]string
}{}
raw := ar.Spec.Object.Raw
raw := ar.Request.Object.Raw
err := json.Unmarshal(raw, &cr)
if err != nil {
glog.Error(err)
return toAdmissionReviewStatus(err)
return toAdmissionResponse(err)
}
reviewStatus := v1alpha1.AdmissionReviewStatus{}
reviewStatus.Allowed = true
reviewResponse := v1alpha1.AdmissionResponse{}
reviewResponse.Allowed = true
for k, v := range cr.Data {
if k == "webhook-e2e-test" && v == "webhook-disallow" {
reviewStatus.Allowed = false
reviewStatus.Result = &metav1.Status{
reviewResponse.Allowed = false
reviewResponse.Result = &metav1.Status{
Reason: "the custom resource contains unwanted data",
}
}
}
return &reviewStatus
return &reviewResponse
}
type admitFunc func(v1alpha1.AdmissionReview) *v1alpha1.AdmissionReviewStatus
type admitFunc func(v1alpha1.AdmissionReview) *v1alpha1.AdmissionResponse
func serve(w http.ResponseWriter, r *http.Request, admit admitFunc) {
var body []byte
......@@ -164,21 +164,23 @@ func serve(w http.ResponseWriter, r *http.Request, admit admitFunc) {
return
}
var reviewStatus *v1alpha1.AdmissionReviewStatus
var reviewResponse *v1alpha1.AdmissionResponse
ar := v1alpha1.AdmissionReview{}
deserializer := codecs.UniversalDeserializer()
if _, _, err := deserializer.Decode(body, nil, &ar); err != nil {
glog.Error(err)
reviewStatus = toAdmissionReviewStatus(err)
reviewResponse = toAdmissionResponse(err)
} else {
reviewStatus = admit(ar)
reviewResponse = admit(ar)
}
if reviewStatus != nil {
ar.Status = *reviewStatus
response := v1alpha1.AdmissionReview{}
if reviewResponse != nil {
response.Response = reviewResponse
response.Response.UID = ar.Request.UID
}
resp, err := json.Marshal(ar)
resp, err := json.Marshal(response)
if err != nil {
glog.Error(err)
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment