From 00b59fa843fdc1a4c7c0743d063243a0dbc8464c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 3 May 2024 14:48:45 +0200 Subject: [PATCH] feat(deps): bump sigs.k8s.io/controller-runtime from 0.17.3 to 0.18.0 (#1061) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(deps): update kubernetes components to 1.30 Signed-off-by: Oliver Bähler * ci(deps): update kubernetes components to 1.30 Signed-off-by: Oliver Bähler * chore(makefile): update binaries and improve building Signed-off-by: Oliver Bähler * feat(deps): remove multierror dependency Signed-off-by: Oliver Bähler * chore(ci): use go.mod as go version Signed-off-by: Oliver Bähler --------- Signed-off-by: Oliver Bähler Co-authored-by: Oliver Bähler --- .github/workflows/diff.yml | 2 +- .github/workflows/e2e.yml | 7 +- .github/workflows/gosec.yml | 10 +- .github/workflows/helm-test.yml | 2 - .github/workflows/lint.yml | 2 +- Makefile | 13 +- api/v1beta1/zz_generated.deepcopy.go | 1 - api/v1beta2/zz_generated.deepcopy.go | 1 - ...sule.clastix.io_capsuleconfigurations.yaml | 53 +- ...sule.clastix.io_globaltenantresources.yaml | 161 +- .../capsule.clastix.io_tenantresources.yaml | 138 +- .../crd/bases/capsule.clastix.io_tenants.yaml | 1463 ++++++++--------- config/install.yaml | 1160 ++++++++++--- config/webhook/manifests.yaml | 56 +- controllers/rbac/manager.go | 6 +- controllers/resources/global.go | 18 +- controllers/resources/namespaced.go | 17 +- controllers/resources/processor.go | 42 +- docs/content/general/crds-apis.md | 933 ++++++++--- go.mod | 69 +- go.sum | 163 +- pkg/api/zz_generated.deepcopy.go | 1 - pkg/webhook/defaults/handler.go | 8 +- pkg/webhook/defaults/ingress.go | 2 +- pkg/webhook/defaults/pods.go | 2 +- pkg/webhook/defaults/storage.go | 2 +- pkg/webhook/handler.go | 6 +- pkg/webhook/ingress/utils.go | 2 +- pkg/webhook/ingress/validate_class.go | 8 +- pkg/webhook/ingress/validate_collision.go | 8 +- pkg/webhook/ingress/validate_hostnames.go | 8 +- pkg/webhook/ingress/validate_wildcard.go | 8 +- pkg/webhook/namespace/freezed.go | 6 +- pkg/webhook/namespace/patch.go | 6 +- pkg/webhook/namespace/prefix.go | 6 +- pkg/webhook/namespace/quota.go | 6 +- pkg/webhook/namespace/user_metadata.go | 6 +- pkg/webhook/networkpolicy/validating.go | 8 +- pkg/webhook/node/user_metadata.go | 6 +- pkg/webhook/ownerreference/patching.go | 8 +- pkg/webhook/pod/containerregistry.go | 8 +- pkg/webhook/pod/imagepullpolicy.go | 6 +- pkg/webhook/pod/priorityclass.go | 6 +- pkg/webhook/pod/runtimeclass.go | 8 +- pkg/webhook/pvc/pv.go | 6 +- pkg/webhook/pvc/validating.go | 6 +- pkg/webhook/router.go | 2 +- pkg/webhook/service/validating.go | 8 +- pkg/webhook/tenant/containerregistry_regex.go | 8 +- pkg/webhook/tenant/cordoning.go | 6 +- pkg/webhook/tenant/custom_resource_quota.go | 6 +- .../tenant/forbidden_annotations_regex.go | 8 +- pkg/webhook/tenant/freezed_emitter.go | 6 +- pkg/webhook/tenant/hostname_regex.go | 8 +- pkg/webhook/tenant/ingressclass_regex.go | 8 +- pkg/webhook/tenant/metadata.go | 6 +- pkg/webhook/tenant/name.go | 6 +- pkg/webhook/tenant/protected.go | 6 +- pkg/webhook/tenant/rolebindings_regex.go | 8 +- pkg/webhook/tenant/serviceaccount_format.go | 8 +- pkg/webhook/tenant/storageclass_regex.go | 8 +- pkg/webhook/tenantresource/objects.go | 6 +- pkg/webhook/utils/in_capsule_groups.go | 6 +- 63 files changed, 2849 insertions(+), 1729 deletions(-) diff --git a/.github/workflows/diff.yml b/.github/workflows/diff.yml index 6b1f8ee8..66fd15ad 100644 --- a/.github/workflows/diff.yml +++ b/.github/workflows/diff.yml @@ -21,7 +21,7 @@ jobs: fetch-depth: 0 - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 with: - go-version: '1.21' + go-version-file: 'go.mod' - run: make installer - name: Checking if YAML installer file is not aligned run: if [[ $(git diff | wc -l) -gt 0 ]]; then echo ">>> Untracked generated files have not been committed" && git --no-pager diff && exit 1; fi diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 93398781..41e0d760 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -45,12 +45,7 @@ jobs: fetch-depth: 0 - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 with: - go-version: '1.21' - - run: make manifests - - name: Checking if manifests are disaligned - run: test -z "$(git diff 2> /dev/null)" - - name: Checking if manifests generated untracked files - run: test -z "$(git ls-files --others --exclude-standard 2> /dev/null)" + go-version-file: 'go.mod' - uses: engineerd/setup-kind@aa272fe2a7309878ffc2a81c56cfe3ef108ae7d0 # v0.5.0 with: skipClusterCreation: true diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml index 841e1305..75b06b20 100644 --- a/.github/workflows/gosec.yml +++ b/.github/workflows/gosec.yml @@ -18,7 +18,15 @@ jobs: steps: - name: Checkout Source uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 + - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 + with: + go-version-file: 'go.mod' - name: Run Gosec Security Scanner uses: securego/gosec@26e57d6b340778c2983cd61775bc7e8bb41d002a # v2.19.0 with: - args: ./... + args: '-no-fail -fmt sarif -out gosec.sarif ./...' + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@c4fb451437765abf5018c6fbf22cce1a7da1e5cc + with: + sarif_file: gosec.sarif + diff --git a/.github/workflows/helm-test.yml b/.github/workflows/helm-test.yml index d1b49766..c7f5100d 100644 --- a/.github/workflows/helm-test.yml +++ b/.github/workflows/helm-test.yml @@ -17,8 +17,6 @@ jobs: with: fetch-depth: 0 - uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v3 - with: - version: v3.14.2 - name: Linting Chart run: helm lint ./charts/capsule - name: Setup Chart Linting diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 68672053..804e8710 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -19,7 +19,7 @@ jobs: - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 with: - go-version: '1.21' + go-version-file: 'go.mod' - name: Run golangci-lint uses: golangci/golangci-lint-action@9d1e0624a798bb64f6c3cea93db47765312263dc # v5.1.0 with: diff --git a/Makefile b/Makefile index 4e5b769c..1fb58222 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,8 @@ # Version GIT_HEAD_COMMIT ?= $(shell git rev-parse --short HEAD) VERSION ?= $(or $(shell git describe --abbrev=0 --tags --match "v*" 2>/dev/null),$(GIT_HEAD_COMMIT)) +GOOS ?= $(shell go env GOOS) +GOARCH ?= $(shell go env GOARCH) # Defaults REGISTRY ?= ghcr.io @@ -181,6 +183,7 @@ dev-setup: # -- Docker #################### +KO_PLATFORM ?= linux/$(GOARCH) KOCACHE ?= /tmp/ko-cache KO_REGISTRY := ko.local KO_TAGS ?= "latest" @@ -200,9 +203,9 @@ LD_FLAGS := "-X main.Version=$(VERSION) \ .PHONY: ko-build-capsule ko-build-capsule: ko - @echo Building Capsule $(KO_TAGS) >&2 + @echo Building Capsule $(KO_TAGS) for $(KO_PLATFORM) >&2 @LD_FLAGS=$(LD_FLAGS) KOCACHE=$(KOCACHE) KO_DOCKER_REPO=$(CAPSULE_IMG) \ - $(KO) build ./ --bare --tags=$(KO_TAGS) --push=false --local + $(KO) build ./ --bare --tags=$(KO_TAGS) --push=false --local --platform=$(KO_PLATFORM) .PHONY: ko-build-all ko-build-all: ko-build-capsule @@ -230,7 +233,7 @@ ko-publish-all: ko-publish-capsule #################### CONTROLLER_GEN := $(shell pwd)/bin/controller-gen -CONTROLLER_GEN_VERSION := v0.10.0 +CONTROLLER_GEN_VERSION := v0.15.0 controller-gen: ## Download controller-gen locally if necessary. $(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_GEN_VERSION)) @@ -240,7 +243,7 @@ apidocs-gen: ## Download crdoc locally if necessary. $(call go-install-tool,$(APIDOCS_GEN),fybrik.io/crdoc@$(APIDOCS_GEN_VERSION)) GINKGO := $(shell pwd)/bin/ginkgo -GINGKO_VERSION := v2.15.0 +GINGKO_VERSION := v2.17.2 ginkgo: ## Download ginkgo locally if necessary. $(call go-install-tool,$(GINKGO),github.com/onsi/ginkgo/v2/ginkgo@$(GINGKO_VERSION)) @@ -352,5 +355,5 @@ e2e-destroy: SPELL_CHECKER = npx spellchecker-cli docs-lint: - cd docs/content && $(SPELL_CHECKER) -f "*.md" "*/*.md" -d dictionary.txt + cd docs/content && $(SPELL_CHECKER) -f "*.md" "*/*.md" "!general/crds-apis.md" -d dictionary.txt diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go index c11f0a4a..72c9b30d 100644 --- a/api/v1beta1/zz_generated.deepcopy.go +++ b/api/v1beta1/zz_generated.deepcopy.go @@ -1,5 +1,4 @@ //go:build !ignore_autogenerated -// +build !ignore_autogenerated // Copyright 2020-2023 Project Capsule Authors. // SPDX-License-Identifier: Apache-2.0 diff --git a/api/v1beta2/zz_generated.deepcopy.go b/api/v1beta2/zz_generated.deepcopy.go index 119085f4..b64cd872 100644 --- a/api/v1beta2/zz_generated.deepcopy.go +++ b/api/v1beta2/zz_generated.deepcopy.go @@ -1,5 +1,4 @@ //go:build !ignore_autogenerated -// +build !ignore_autogenerated // Copyright 2020-2023 Project Capsule Authors. // SPDX-License-Identifier: Apache-2.0 diff --git a/config/crd/bases/capsule.clastix.io_capsuleconfigurations.yaml b/config/crd/bases/capsule.clastix.io_capsuleconfigurations.yaml index 9855a63a..c95f5c4d 100644 --- a/config/crd/bases/capsule.clastix.io_capsuleconfigurations.yaml +++ b/config/crd/bases/capsule.clastix.io_capsuleconfigurations.yaml @@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null + controller-gen.kubebuilder.io/version: v0.15.0 name: capsuleconfigurations.capsule.clastix.io spec: group: capsule.clastix.io @@ -22,14 +21,19 @@ spec: API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -38,23 +42,20 @@ spec: properties: enableTLSReconciler: default: true - description: Toggles the TLS reconciler, the controller that is able - to generate CA and certificates for the webhooks when not using - an already provided CA and certificate, or when these are managed - externally with Vault, or cert-manager. + description: |- + Toggles the TLS reconciler, the controller that is able to generate CA and certificates for the webhooks + when not using an already provided CA and certificate, or when these are managed externally with Vault, or cert-manager. type: boolean forceTenantPrefix: default: false - description: Enforces the Tenant owner, during Namespace creation, - to name it using the selected Tenant name as prefix, separated by - a dash. This is useful to avoid Namespace name collision in a public - CaaS environment. + description: |- + Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, + separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment. type: boolean nodeMetadata: - description: Allows to set the forbidden metadata for the worker nodes - that could be patched by a Tenant. This applies only if the Tenant - has an active NodeSelector, and the Owner have right to patch their - nodes. + description: |- + Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant. + This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes. properties: forbiddenAnnotations: description: Define the annotations that a Tenant Owner cannot @@ -87,15 +88,15 @@ spec: TLSSecretName: capsule-tls mutatingWebhookConfigurationName: capsule-mutating-webhook-configuration validatingWebhookConfigurationName: capsule-validating-webhook-configuration - description: Allows to set different name rather than the canonical - one for the Capsule configuration objects, such as webhook secret - or configurations. + description: |- + Allows to set different name rather than the canonical one for the Capsule configuration objects, + such as webhook secret or configurations. properties: TLSSecretName: default: capsule-tls - description: Defines the Secret name used for the webhook server. - Must be in the same Namespace where the Capsule Deployment is - deployed. + description: |- + Defines the Secret name used for the webhook server. + Must be in the same Namespace where the Capsule Deployment is deployed. type: string mutatingWebhookConfigurationName: default: capsule-mutating-webhook-configuration diff --git a/config/crd/bases/capsule.clastix.io_globaltenantresources.yaml b/config/crd/bases/capsule.clastix.io_globaltenantresources.yaml index c6b3869a..8ae724fa 100644 --- a/config/crd/bases/capsule.clastix.io_globaltenantresources.yaml +++ b/config/crd/bases/capsule.clastix.io_globaltenantresources.yaml @@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null + controller-gen.kubebuilder.io/version: v0.15.0 name: globaltenantresources.capsule.clastix.io spec: group: capsule.clastix.io @@ -22,14 +21,19 @@ spec: to a specific subset of Tenant resources. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -38,10 +42,9 @@ spec: properties: pruningOnDelete: default: true - description: When the replicated resource manifest is deleted, all - the objects replicated so far will be automatically deleted. Disable - this to keep replicated resources although the deletion of the replication - manifest. + description: |- + When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. + Disable this to keep replicated resources although the deletion of the replication manifest. type: boolean resources: description: Defines the rules to select targeting Namespace, along @@ -49,9 +52,9 @@ spec: items: properties: additionalMetadata: - description: Besides the Capsule metadata required by TenantResource - controller, defines additional metadata that must be added - to the replicated resources. + description: |- + Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be + added to the replicated resources. properties: annotations: additionalProperties: @@ -63,49 +66,50 @@ spec: type: object type: object namespaceSelector: - description: Defines the Namespace selector to select the Tenant - Namespaces on which the resources must be propagated. In case - of nil value, all the Tenant Namespaces are targeted. + description: |- + Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. + In case of nil value, all the Tenant Namespaces are targeted. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, - Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. - If the operator is In or NotIn, the values array - must be non-empty. If the operator is Exists or - DoesNotExist, the values array must be empty. This - array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field is - "key", the operator is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -118,10 +122,14 @@ spec: description: API version of the referent. type: string kind: - description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string namespace: - description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string selector: description: Label selector used to select the given resources @@ -131,8 +139,8 @@ spec: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: @@ -140,33 +148,33 @@ spec: applies to. type: string operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, - NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. - If the operator is In or NotIn, the values - array must be non-empty. If the operator is - Exists or DoesNotExist, the values array must - be empty. This array is replaced during a - strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field - is "key", the operator is "In", and the values array - contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -187,9 +195,9 @@ spec: type: array resyncPeriod: default: 60s - description: Define the period of time upon a second reconciliation - must be invoked. Keep in mind that any change to the manifests will - trigger a new reconciliation. + description: |- + Define the period of time upon a second reconciliation must be invoked. + Keep in mind that any change to the manifests will trigger a new reconciliation. type: string tenantSelector: description: Defines the Tenant selector used target the tenants on @@ -199,41 +207,42 @@ spec: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the key - and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to - a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a strategic + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -253,13 +262,19 @@ spec: description: API version of the referent. type: string kind: - description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string namespace: - description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string required: - kind diff --git a/config/crd/bases/capsule.clastix.io_tenantresources.yaml b/config/crd/bases/capsule.clastix.io_tenantresources.yaml index bd2a3681..4e48c0ef 100644 --- a/config/crd/bases/capsule.clastix.io_tenantresources.yaml +++ b/config/crd/bases/capsule.clastix.io_tenantresources.yaml @@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null + controller-gen.kubebuilder.io/version: v0.15.0 name: tenantresources.capsule.clastix.io spec: group: capsule.clastix.io @@ -18,20 +17,25 @@ spec: - name: v1beta2 schema: openAPIV3Schema: - description: TenantResource allows a Tenant Owner, if enabled with proper - RBAC, to propagate resources in its Namespace. The object must be deployed - in a Tenant Namespace, and cannot reference object living in non-Tenant - namespaces. For such cases, the GlobalTenantResource must be used. + description: |- + TenantResource allows a Tenant Owner, if enabled with proper RBAC, to propagate resources in its Namespace. + The object must be deployed in a Tenant Namespace, and cannot reference object living in non-Tenant namespaces. + For such cases, the GlobalTenantResource must be used. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -40,10 +44,9 @@ spec: properties: pruningOnDelete: default: true - description: When the replicated resource manifest is deleted, all - the objects replicated so far will be automatically deleted. Disable - this to keep replicated resources although the deletion of the replication - manifest. + description: |- + When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. + Disable this to keep replicated resources although the deletion of the replication manifest. type: boolean resources: description: Defines the rules to select targeting Namespace, along @@ -51,9 +54,9 @@ spec: items: properties: additionalMetadata: - description: Besides the Capsule metadata required by TenantResource - controller, defines additional metadata that must be added - to the replicated resources. + description: |- + Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be + added to the replicated resources. properties: annotations: additionalProperties: @@ -65,49 +68,50 @@ spec: type: object type: object namespaceSelector: - description: Defines the Namespace selector to select the Tenant - Namespaces on which the resources must be propagated. In case - of nil value, all the Tenant Namespaces are targeted. + description: |- + Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. + In case of nil value, all the Tenant Namespaces are targeted. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, - Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. - If the operator is In or NotIn, the values array - must be non-empty. If the operator is Exists or - DoesNotExist, the values array must be empty. This - array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field is - "key", the operator is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -120,10 +124,14 @@ spec: description: API version of the referent. type: string kind: - description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string namespace: - description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string selector: description: Label selector used to select the given resources @@ -133,8 +141,8 @@ spec: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: @@ -142,33 +150,33 @@ spec: applies to. type: string operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, - NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. - If the operator is In or NotIn, the values - array must be non-empty. If the operator is - Exists or DoesNotExist, the values array must - be empty. This array is replaced during a - strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field - is "key", the operator is "In", and the values array - contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -189,9 +197,9 @@ spec: type: array resyncPeriod: default: 60s - description: Define the period of time upon a second reconciliation - must be invoked. Keep in mind that any change to the manifests will - trigger a new reconciliation. + description: |- + Define the period of time upon a second reconciliation must be invoked. + Keep in mind that any change to the manifests will trigger a new reconciliation. type: string required: - resources @@ -208,13 +216,19 @@ spec: description: API version of the referent. type: string kind: - description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string namespace: - description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string required: - kind diff --git a/config/crd/bases/capsule.clastix.io_tenants.yaml b/config/crd/bases/capsule.clastix.io_tenants.yaml index 50ad93ab..c073502f 100644 --- a/config/crd/bases/capsule.clastix.io_tenants.yaml +++ b/config/crd/bases/capsule.clastix.io_tenants.yaml @@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null + controller-gen.kubebuilder.io/version: v0.15.0 name: tenants.capsule.clastix.io spec: group: capsule.clastix.io @@ -44,14 +43,19 @@ spec: description: Tenant is the Schema for the tenants API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -69,31 +73,28 @@ spec: subjects: description: kubebuilder:validation:Minimum=1 items: - description: Subject contains a reference to the object or - user identities a role binding applies to. This can either - hold a direct API object reference, or a value for non-objects - such as user and group names. + description: |- + Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, + or a value for non-objects such as user and group names. properties: apiGroup: - description: APIGroup holds the API group of the referenced - subject. Defaults to "" for ServiceAccount subjects. - Defaults to "rbac.authorization.k8s.io" for User and - Group subjects. + description: |- + APIGroup holds the API group of the referenced subject. + Defaults to "" for ServiceAccount subjects. + Defaults to "rbac.authorization.k8s.io" for User and Group subjects. type: string kind: - description: Kind of object being referenced. Values defined - by this API group are "User", "Group", and "ServiceAccount". - If the Authorizer does not recognized the kind value, - the Authorizer should report an error. + description: |- + Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". + If the Authorizer does not recognized the kind value, the Authorizer should report an error. type: string name: description: Name of the object being referenced. type: string namespace: - description: Namespace of the referenced object. If the - object kind is non-namespace, such as "User" or "Group", - and this value is not empty the Authorizer should report - an error. + description: |- + Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty + the Authorizer should report an error. type: string required: - kind @@ -161,15 +162,20 @@ spec: type: object hostnameCollisionScope: default: Disabled - description: "Defines the scope of hostname collision check performed - when Tenant Owners create Ingress with allowed hostnames. \n - - Cluster: disallow the creation of an Ingress if the pair hostname - and path is already used across the Namespaces managed by Capsule. - \n - Tenant: disallow the creation of an Ingress if the pair - hostname and path is already used across the Namespaces of the - Tenant. \n - Namespace: disallow the creation of an Ingress - if the pair hostname and path is already used in the Ingress - Namespace. \n Optional." + description: |- + Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. + + + - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. + + + - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. + + + - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. + + + Optional. enum: - Cluster - Tenant @@ -256,6 +262,7 @@ spec: - type type: object type: array + x-kubernetes-list-type: atomic required: - limits type: object @@ -300,464 +307,421 @@ spec: a NetworkPolicy properties: egress: - description: egress is a list of egress rules to be applied - to the selected pods. Outgoing traffic is allowed if there - are no NetworkPolicies selecting the pod (and cluster - policy otherwise allows the traffic), OR if the traffic - matches at least one egress rule across all of the NetworkPolicy - objects whose podSelector matches the pod. If this field - is empty then this NetworkPolicy limits all outgoing traffic - (and serves solely to ensure that the pods it selects - are isolated by default). This field is beta-level in - 1.8 + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 items: - description: NetworkPolicyEgressRule describes a particular - set of traffic that is allowed out of pods matched by - a NetworkPolicySpec's podSelector. The traffic must - match both ports and to. This type is beta-level in - 1.8 + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 properties: ports: - description: ports is a list of destination ports - for outgoing traffic. Each item in this list is - combined using a logical OR. If this field is empty - or missing, this rule matches all ports (traffic - not restricted by port). If this field is present - and contains at least one item, then this rule allows - traffic only if the traffic matches at least one - port in the list. + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. items: description: NetworkPolicyPort describes a port to allow traffic on properties: endPort: - description: endPort indicates that the range - of ports from port to endPort if set, inclusive, - should be allowed by the policy. This field - cannot be defined if the port field is not - defined or if the port field is defined as - a named (string) port. The endPort must be - equal or greater than port. + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. format: int32 type: integer port: anyOf: - type: integer - type: string - description: port represents the port on the - given protocol. This can either be a numerical - or named port on a pod. If this field is not - provided, this matches all port names and - numbers. If present, only traffic on the specified - protocol AND port will be matched. + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. x-kubernetes-int-or-string: true protocol: default: TCP - description: protocol represents the protocol - (TCP, UDP, or SCTP) which traffic must match. + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP. type: string type: object type: array + x-kubernetes-list-type: atomic to: - description: to is a list of destinations for outgoing - traffic of pods selected for this rule. Items in - this list are combined using a logical OR operation. - If this field is empty or missing, this rule matches - all destinations (traffic not restricted by destination). - If this field is present and contains at least one - item, this rule allows traffic only if the traffic - matches at least one item in the to list. + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. items: - description: NetworkPolicyPeer describes a peer - to allow traffic to/from. Only certain combinations - of fields are allowed + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed properties: ipBlock: - description: ipBlock defines policy on a particular - IPBlock. If this field is set then neither - of the other fields can be. + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. properties: cidr: - description: cidr is a string representing - the IPBlock Valid examples are "192.168.1.0/24" - or "2001:db8::/64" + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" type: string except: - description: except is a slice of CIDRs - that should not be included within an - IPBlock Valid examples are "192.168.1.0/24" - or "2001:db8::/64" Except values will - be rejected if they are outside the cidr - range + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range items: type: string type: array + x-kubernetes-list-type: atomic required: - cidr type: object namespaceSelector: - description: "namespaceSelector selects namespaces - using cluster-scoped labels. This field follows - standard label selector semantics; if present - but empty, it selects all namespaces. \n If - podSelector is also set, then the NetworkPolicyPeer - as a whole selects the pods matching podSelector - in the namespaces selected by namespaceSelector. - Otherwise it selects all pods in the namespaces - selected by namespaceSelector." + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic podSelector: - description: "podSelector is a label selector - which selects pods. This field follows standard - label selector semantics; if present but empty, - it selects all pods. \n If namespaceSelector - is also set, then the NetworkPolicyPeer as - a whole selects the pods matching podSelector - in the Namespaces selected by NamespaceSelector. - Otherwise it selects the pods matching podSelector - in the policy's own namespace." + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object type: array + x-kubernetes-list-type: atomic type: object type: array + x-kubernetes-list-type: atomic ingress: - description: ingress is a list of ingress rules to be applied - to the selected pods. Traffic is allowed to a pod if there - are no NetworkPolicies selecting the pod (and cluster - policy otherwise allows the traffic), OR if the traffic - source is the pod's local node, OR if the traffic matches - at least one ingress rule across all of the NetworkPolicy - objects whose podSelector matches the pod. If this field - is empty then this NetworkPolicy does not allow any traffic - (and serves solely to ensure that the pods it selects - are isolated by default) + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) items: - description: NetworkPolicyIngressRule describes a particular - set of traffic that is allowed to the pods matched by - a NetworkPolicySpec's podSelector. The traffic must - match both ports and from. + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. properties: from: - description: from is a list of sources which should - be able to access the pods selected for this rule. - Items in this list are combined using a logical - OR operation. If this field is empty or missing, - this rule matches all sources (traffic not restricted - by source). If this field is present and contains - at least one item, this rule allows traffic only - if the traffic matches at least one item in the - from list. + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. items: - description: NetworkPolicyPeer describes a peer - to allow traffic to/from. Only certain combinations - of fields are allowed + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed properties: ipBlock: - description: ipBlock defines policy on a particular - IPBlock. If this field is set then neither - of the other fields can be. + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. properties: cidr: - description: cidr is a string representing - the IPBlock Valid examples are "192.168.1.0/24" - or "2001:db8::/64" + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" type: string except: - description: except is a slice of CIDRs - that should not be included within an - IPBlock Valid examples are "192.168.1.0/24" - or "2001:db8::/64" Except values will - be rejected if they are outside the cidr - range + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range items: type: string type: array + x-kubernetes-list-type: atomic required: - cidr type: object namespaceSelector: - description: "namespaceSelector selects namespaces - using cluster-scoped labels. This field follows - standard label selector semantics; if present - but empty, it selects all namespaces. \n If - podSelector is also set, then the NetworkPolicyPeer - as a whole selects the pods matching podSelector - in the namespaces selected by namespaceSelector. - Otherwise it selects all pods in the namespaces - selected by namespaceSelector." + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic podSelector: - description: "podSelector is a label selector - which selects pods. This field follows standard - label selector semantics; if present but empty, - it selects all pods. \n If namespaceSelector - is also set, then the NetworkPolicyPeer as - a whole selects the pods matching podSelector - in the Namespaces selected by NamespaceSelector. - Otherwise it selects the pods matching podSelector - in the policy's own namespace." + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object type: array + x-kubernetes-list-type: atomic ports: - description: ports is a list of ports which should - be made accessible on the pods selected for this - rule. Each item in this list is combined using a - logical OR. If this field is empty or missing, this - rule matches all ports (traffic not restricted by - port). If this field is present and contains at - least one item, then this rule allows traffic only - if the traffic matches at least one port in the - list. + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. items: description: NetworkPolicyPort describes a port to allow traffic on properties: endPort: - description: endPort indicates that the range - of ports from port to endPort if set, inclusive, - should be allowed by the policy. This field - cannot be defined if the port field is not - defined or if the port field is defined as - a named (string) port. The endPort must be - equal or greater than port. + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. format: int32 type: integer port: anyOf: - type: integer - type: string - description: port represents the port on the - given protocol. This can either be a numerical - or named port on a pod. If this field is not - provided, this matches all port names and - numbers. If present, only traffic on the specified - protocol AND port will be matched. + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. x-kubernetes-int-or-string: true protocol: default: TCP - description: protocol represents the protocol - (TCP, UDP, or SCTP) which traffic must match. + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP. type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: array + x-kubernetes-list-type: atomic podSelector: - description: podSelector selects the pods to which this - NetworkPolicy object applies. The array of ingress rules - is applied to any pods selected by this field. Multiple - network policies can select the same set of pods. In this - case, the ingress rules for each are combined additively. - This field is NOT optional and follows standard label - selector semantics. An empty podSelector matches all pods - in this namespace. + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of ingress rules is applied to any pods selected by this field. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is NOT optional and follows standard label selector semantics. + An empty podSelector matches all pods in this namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: @@ -765,56 +729,55 @@ spec: applies to. type: string operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, - NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. - If the operator is In or NotIn, the values array - must be non-empty. If the operator is Exists - or DoesNotExist, the values array must be empty. - This array is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field - is "key", the operator is "In", and the values array - contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic policyTypes: - description: policyTypes is a list of rule types that the - NetworkPolicy relates to. Valid options are ["Ingress"], - ["Egress"], or ["Ingress", "Egress"]. If this field is - not specified, it will default based on the existence - of ingress or egress rules; policies that contain an egress - section are assumed to affect egress, and all policies - (whether or not they contain an ingress section) are assumed - to affect ingress. If you want to write an egress-only - policy, you must explicitly specify policyTypes [ "Egress" - ]. Likewise, if you want to write a policy that specifies - that no egress is allowed, you must specify a policyTypes - value that include "Egress" (since such a policy would - not include an egress section and would otherwise default - to just [ "Ingress" ]). This field is beta-level in 1.8 + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 items: - description: PolicyType string describes the NetworkPolicy - type This type is beta-level in 1.8 + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 type: string type: array + x-kubernetes-list-type: atomic required: - podSelector type: object @@ -905,59 +868,61 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'hard is the set of desired hard limits for - each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/' + description: |- + hard is the set of desired hard limits for each named resource. + More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/ type: object scopeSelector: - description: scopeSelector is also a collection of filters - like scopes that must match each object tracked by a quota - but expressed using ScopeSelectorOperator in combination - with possible values. For a resource to match, both scopes - AND scopeSelector (if specified in spec), must be matched. + description: |- + scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota + but expressed using ScopeSelectorOperator in combination with possible values. + For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. properties: matchExpressions: description: A list of scope selector requirements by scope of the resources. items: - description: A scoped-resource selector requirement - is a selector that contains values, a scope name, - and an operator that relates the scope name and - values. + description: |- + A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator + that relates the scope name and values. properties: operator: - description: Represents a scope's relationship - to a set of values. Valid operators are In, - NotIn, Exists, DoesNotExist. + description: |- + Represents a scope's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. type: string scopeName: description: The name of the scope that the selector applies to. type: string values: - description: An array of string values. If the - operator is In or NotIn, the values array must - be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is - replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. + This array is replaced during a strategic merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - operator - scopeName type: object type: array + x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic scopes: - description: A collection of filters that must match each - object tracked by a quota. If not specified, the quota - matches all objects. + description: |- + A collection of filters that must match each object tracked by a quota. + If not specified, the quota matches all objects. items: description: A ResourceQuotaScope defines a filter that must match each object tracked by a quota type: string type: array + x-kubernetes-list-type: atomic type: object type: array scope: @@ -1113,14 +1078,19 @@ spec: description: Tenant is the Schema for the tenants API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -1138,31 +1108,28 @@ spec: subjects: description: kubebuilder:validation:Minimum=1 items: - description: Subject contains a reference to the object or - user identities a role binding applies to. This can either - hold a direct API object reference, or a value for non-objects - such as user and group names. + description: |- + Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, + or a value for non-objects such as user and group names. properties: apiGroup: - description: APIGroup holds the API group of the referenced - subject. Defaults to "" for ServiceAccount subjects. - Defaults to "rbac.authorization.k8s.io" for User and - Group subjects. + description: |- + APIGroup holds the API group of the referenced subject. + Defaults to "" for ServiceAccount subjects. + Defaults to "rbac.authorization.k8s.io" for User and Group subjects. type: string kind: - description: Kind of object being referenced. Values defined - by this API group are "User", "Group", and "ServiceAccount". - If the Authorizer does not recognized the kind value, - the Authorizer should report an error. + description: |- + Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". + If the Authorizer does not recognized the kind value, the Authorizer should report an error. type: string name: description: Name of the object being referenced. type: string namespace: - description: Namespace of the referenced object. If the - object kind is non-namespace, such as "User" or "Group", - and this value is not empty the Authorizer should report - an error. + description: |- + Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty + the Authorizer should report an error. type: string required: - kind @@ -1212,11 +1179,11 @@ spec: in a Tenant to have a hostname wildcard. type: boolean allowedClasses: - description: Specifies the allowed IngressClasses assigned to - the Tenant. Capsule assures that all Ingress resources created - in the Tenant can use only one of the allowed IngressClasses. - A default value can be specified, and all the Ingress resources - created will inherit the declared class. Optional. + description: |- + Specifies the allowed IngressClasses assigned to the Tenant. + Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. + A default value can be specified, and all the Ingress resources created will inherit the declared class. + Optional. properties: allowed: items: @@ -1230,41 +1197,42 @@ spec: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, NotIn, - Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If - the operator is In or NotIn, the values array must - be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced - during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A - single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field is "key", - the operator is "In", and the values array contains only - "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -1283,15 +1251,20 @@ spec: type: object hostnameCollisionScope: default: Disabled - description: "Defines the scope of hostname collision check performed - when Tenant Owners create Ingress with allowed hostnames. \n - - Cluster: disallow the creation of an Ingress if the pair hostname - and path is already used across the Namespaces managed by Capsule. - \n - Tenant: disallow the creation of an Ingress if the pair - hostname and path is already used across the Namespaces of the - Tenant. \n - Namespace: disallow the creation of an Ingress - if the pair hostname and path is already used in the Ingress - Namespace. \n Optional." + description: |- + Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. + + + - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. + + + - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. + + + - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. + + + Optional. enum: - Cluster - Tenant @@ -1378,6 +1351,7 @@ spec: - type type: object type: array + x-kubernetes-list-type: atomic required: - limits type: object @@ -1444,464 +1418,421 @@ spec: a NetworkPolicy properties: egress: - description: egress is a list of egress rules to be applied - to the selected pods. Outgoing traffic is allowed if there - are no NetworkPolicies selecting the pod (and cluster - policy otherwise allows the traffic), OR if the traffic - matches at least one egress rule across all of the NetworkPolicy - objects whose podSelector matches the pod. If this field - is empty then this NetworkPolicy limits all outgoing traffic - (and serves solely to ensure that the pods it selects - are isolated by default). This field is beta-level in - 1.8 + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 items: - description: NetworkPolicyEgressRule describes a particular - set of traffic that is allowed out of pods matched by - a NetworkPolicySpec's podSelector. The traffic must - match both ports and to. This type is beta-level in - 1.8 + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 properties: ports: - description: ports is a list of destination ports - for outgoing traffic. Each item in this list is - combined using a logical OR. If this field is empty - or missing, this rule matches all ports (traffic - not restricted by port). If this field is present - and contains at least one item, then this rule allows - traffic only if the traffic matches at least one - port in the list. + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. items: description: NetworkPolicyPort describes a port to allow traffic on properties: endPort: - description: endPort indicates that the range - of ports from port to endPort if set, inclusive, - should be allowed by the policy. This field - cannot be defined if the port field is not - defined or if the port field is defined as - a named (string) port. The endPort must be - equal or greater than port. + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. format: int32 type: integer port: anyOf: - type: integer - type: string - description: port represents the port on the - given protocol. This can either be a numerical - or named port on a pod. If this field is not - provided, this matches all port names and - numbers. If present, only traffic on the specified - protocol AND port will be matched. + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. x-kubernetes-int-or-string: true protocol: default: TCP - description: protocol represents the protocol - (TCP, UDP, or SCTP) which traffic must match. + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP. type: string type: object type: array + x-kubernetes-list-type: atomic to: - description: to is a list of destinations for outgoing - traffic of pods selected for this rule. Items in - this list are combined using a logical OR operation. - If this field is empty or missing, this rule matches - all destinations (traffic not restricted by destination). - If this field is present and contains at least one - item, this rule allows traffic only if the traffic - matches at least one item in the to list. + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. items: - description: NetworkPolicyPeer describes a peer - to allow traffic to/from. Only certain combinations - of fields are allowed + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed properties: ipBlock: - description: ipBlock defines policy on a particular - IPBlock. If this field is set then neither - of the other fields can be. + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. properties: cidr: - description: cidr is a string representing - the IPBlock Valid examples are "192.168.1.0/24" - or "2001:db8::/64" + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" type: string except: - description: except is a slice of CIDRs - that should not be included within an - IPBlock Valid examples are "192.168.1.0/24" - or "2001:db8::/64" Except values will - be rejected if they are outside the cidr - range + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range items: type: string type: array + x-kubernetes-list-type: atomic required: - cidr type: object namespaceSelector: - description: "namespaceSelector selects namespaces - using cluster-scoped labels. This field follows - standard label selector semantics; if present - but empty, it selects all namespaces. \n If - podSelector is also set, then the NetworkPolicyPeer - as a whole selects the pods matching podSelector - in the namespaces selected by namespaceSelector. - Otherwise it selects all pods in the namespaces - selected by namespaceSelector." + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic podSelector: - description: "podSelector is a label selector - which selects pods. This field follows standard - label selector semantics; if present but empty, - it selects all pods. \n If namespaceSelector - is also set, then the NetworkPolicyPeer as - a whole selects the pods matching podSelector - in the Namespaces selected by NamespaceSelector. - Otherwise it selects the pods matching podSelector - in the policy's own namespace." + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object type: array + x-kubernetes-list-type: atomic type: object type: array + x-kubernetes-list-type: atomic ingress: - description: ingress is a list of ingress rules to be applied - to the selected pods. Traffic is allowed to a pod if there - are no NetworkPolicies selecting the pod (and cluster - policy otherwise allows the traffic), OR if the traffic - source is the pod's local node, OR if the traffic matches - at least one ingress rule across all of the NetworkPolicy - objects whose podSelector matches the pod. If this field - is empty then this NetworkPolicy does not allow any traffic - (and serves solely to ensure that the pods it selects - are isolated by default) + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) items: - description: NetworkPolicyIngressRule describes a particular - set of traffic that is allowed to the pods matched by - a NetworkPolicySpec's podSelector. The traffic must - match both ports and from. + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. properties: from: - description: from is a list of sources which should - be able to access the pods selected for this rule. - Items in this list are combined using a logical - OR operation. If this field is empty or missing, - this rule matches all sources (traffic not restricted - by source). If this field is present and contains - at least one item, this rule allows traffic only - if the traffic matches at least one item in the - from list. + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. items: - description: NetworkPolicyPeer describes a peer - to allow traffic to/from. Only certain combinations - of fields are allowed + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed properties: ipBlock: - description: ipBlock defines policy on a particular - IPBlock. If this field is set then neither - of the other fields can be. + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. properties: cidr: - description: cidr is a string representing - the IPBlock Valid examples are "192.168.1.0/24" - or "2001:db8::/64" + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" type: string except: - description: except is a slice of CIDRs - that should not be included within an - IPBlock Valid examples are "192.168.1.0/24" - or "2001:db8::/64" Except values will - be rejected if they are outside the cidr - range + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range items: type: string type: array + x-kubernetes-list-type: atomic required: - cidr type: object namespaceSelector: - description: "namespaceSelector selects namespaces - using cluster-scoped labels. This field follows - standard label selector semantics; if present - but empty, it selects all namespaces. \n If - podSelector is also set, then the NetworkPolicyPeer - as a whole selects the pods matching podSelector - in the namespaces selected by namespaceSelector. - Otherwise it selects all pods in the namespaces - selected by namespaceSelector." + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic podSelector: - description: "podSelector is a label selector - which selects pods. This field follows standard - label selector semantics; if present but empty, - it selects all pods. \n If namespaceSelector - is also set, then the NetworkPolicyPeer as - a whole selects the pods matching podSelector - in the Namespaces selected by NamespaceSelector. - Otherwise it selects the pods matching podSelector - in the policy's own namespace." + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object type: array + x-kubernetes-list-type: atomic ports: - description: ports is a list of ports which should - be made accessible on the pods selected for this - rule. Each item in this list is combined using a - logical OR. If this field is empty or missing, this - rule matches all ports (traffic not restricted by - port). If this field is present and contains at - least one item, then this rule allows traffic only - if the traffic matches at least one port in the - list. + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. items: description: NetworkPolicyPort describes a port to allow traffic on properties: endPort: - description: endPort indicates that the range - of ports from port to endPort if set, inclusive, - should be allowed by the policy. This field - cannot be defined if the port field is not - defined or if the port field is defined as - a named (string) port. The endPort must be - equal or greater than port. + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. format: int32 type: integer port: anyOf: - type: integer - type: string - description: port represents the port on the - given protocol. This can either be a numerical - or named port on a pod. If this field is not - provided, this matches all port names and - numbers. If present, only traffic on the specified - protocol AND port will be matched. + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. x-kubernetes-int-or-string: true protocol: default: TCP - description: protocol represents the protocol - (TCP, UDP, or SCTP) which traffic must match. + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP. type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: array + x-kubernetes-list-type: atomic podSelector: - description: podSelector selects the pods to which this - NetworkPolicy object applies. The array of ingress rules - is applied to any pods selected by this field. Multiple - network policies can select the same set of pods. In this - case, the ingress rules for each are combined additively. - This field is NOT optional and follows standard label - selector semantics. An empty podSelector matches all pods - in this namespace. + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of ingress rules is applied to any pods selected by this field. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is NOT optional and follows standard label selector semantics. + An empty podSelector matches all pods in this namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: @@ -1909,56 +1840,55 @@ spec: applies to. type: string operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, - NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. - If the operator is In or NotIn, the values array - must be non-empty. If the operator is Exists - or DoesNotExist, the values array must be empty. - This array is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field - is "key", the operator is "In", and the values array - contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic policyTypes: - description: policyTypes is a list of rule types that the - NetworkPolicy relates to. Valid options are ["Ingress"], - ["Egress"], or ["Ingress", "Egress"]. If this field is - not specified, it will default based on the existence - of ingress or egress rules; policies that contain an egress - section are assumed to affect egress, and all policies - (whether or not they contain an ingress section) are assumed - to affect ingress. If you want to write an egress-only - policy, you must explicitly specify policyTypes [ "Egress" - ]. Likewise, if you want to write a policy that specifies - that no egress is allowed, you must specify a policyTypes - value that include "Egress" (since such a policy would - not include an egress section and would otherwise default - to just [ "Ingress" ]). This field is beta-level in 1.8 + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 items: - description: PolicyType string describes the NetworkPolicy - type This type is beta-level in 1.8 + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 type: string type: array + x-kubernetes-list-type: atomic required: - podSelector type: object @@ -2048,15 +1978,16 @@ spec: type: object preventDeletion: default: false - description: Prevent accidental deletion of the Tenant. When enabled, - the deletion request will be declined. + description: |- + Prevent accidental deletion of the Tenant. + When enabled, the deletion request will be declined. type: boolean priorityClasses: - description: Specifies the allowed priorityClasses assigned to the - Tenant. Capsule assures that all Pods resources created in the Tenant - can use only one of the allowed PriorityClasses. A default value - can be specified, and all the Pod resources created will inherit - the declared class. Optional. + description: |- + Specifies the allowed priorityClasses assigned to the Tenant. + Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. + A default value can be specified, and all the Pod resources created will inherit the declared class. + Optional. properties: allowed: items: @@ -2070,41 +2001,42 @@ spec: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the key - and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to - a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a strategic + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -2128,59 +2060,61 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'hard is the set of desired hard limits for - each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/' + description: |- + hard is the set of desired hard limits for each named resource. + More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/ type: object scopeSelector: - description: scopeSelector is also a collection of filters - like scopes that must match each object tracked by a quota - but expressed using ScopeSelectorOperator in combination - with possible values. For a resource to match, both scopes - AND scopeSelector (if specified in spec), must be matched. + description: |- + scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota + but expressed using ScopeSelectorOperator in combination with possible values. + For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. properties: matchExpressions: description: A list of scope selector requirements by scope of the resources. items: - description: A scoped-resource selector requirement - is a selector that contains values, a scope name, - and an operator that relates the scope name and - values. + description: |- + A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator + that relates the scope name and values. properties: operator: - description: Represents a scope's relationship - to a set of values. Valid operators are In, - NotIn, Exists, DoesNotExist. + description: |- + Represents a scope's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. type: string scopeName: description: The name of the scope that the selector applies to. type: string values: - description: An array of string values. If the - operator is In or NotIn, the values array must - be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is - replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. + This array is replaced during a strategic merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - operator - scopeName type: object type: array + x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic scopes: - description: A collection of filters that must match each - object tracked by a quota. If not specified, the quota - matches all objects. + description: |- + A collection of filters that must match each object tracked by a quota. + If not specified, the quota matches all objects. items: description: A ResourceQuotaScope defines a filter that must match each object tracked by a quota type: string type: array + x-kubernetes-list-type: atomic type: object type: array scope: @@ -2194,9 +2128,10 @@ spec: type: string type: object runtimeClasses: - description: Specifies the allowed RuntimeClasses assigned to the - Tenant. Capsule assures that all Pods resources created in the Tenant - can use only one of the allowed RuntimeClasses. Optional. + description: |- + Specifies the allowed RuntimeClasses assigned to the Tenant. + Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. + Optional. properties: allowed: items: @@ -2208,41 +2143,42 @@ spec: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the key - and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to - a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a strategic + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -2319,11 +2255,11 @@ spec: type: object type: object storageClasses: - description: Specifies the allowed StorageClasses assigned to the - Tenant. Capsule assures that all PersistentVolumeClaim resources - created in the Tenant can use only one of the allowed StorageClasses. - A default value can be specified, and all the PersistentVolumeClaim - resources created will inherit the declared class. Optional. + description: |- + Specifies the allowed StorageClasses assigned to the Tenant. + Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. + A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. + Optional. properties: allowed: items: @@ -2337,41 +2273,42 @@ spec: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the key - and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to - a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a strategic + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic diff --git a/config/install.yaml b/config/install.yaml index 61071439..5125ac56 100644 --- a/config/install.yaml +++ b/config/install.yaml @@ -9,7 +9,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: capsuleconfigurations.capsule.clastix.io spec: conversion: @@ -37,10 +37,19 @@ spec: description: CapsuleConfiguration is the Schema for the Capsule configuration API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -49,14 +58,20 @@ spec: properties: enableTLSReconciler: default: true - description: Toggles the TLS reconciler, the controller that is able to generate CA and certificates for the webhooks when not using an already provided CA and certificate, or when these are managed externally with Vault, or cert-manager. + description: |- + Toggles the TLS reconciler, the controller that is able to generate CA and certificates for the webhooks + when not using an already provided CA and certificate, or when these are managed externally with Vault, or cert-manager. type: boolean forceTenantPrefix: default: false - description: Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment. + description: |- + Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, + separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment. type: boolean nodeMetadata: - description: Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant. This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes. + description: |- + Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant. + This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes. properties: forbiddenAnnotations: description: Define the annotations that a Tenant Owner cannot set for their nodes. @@ -87,11 +102,15 @@ spec: TLSSecretName: capsule-tls mutatingWebhookConfigurationName: capsule-mutating-webhook-configuration validatingWebhookConfigurationName: capsule-validating-webhook-configuration - description: Allows to set different name rather than the canonical one for the Capsule configuration objects, such as webhook secret or configurations. + description: |- + Allows to set different name rather than the canonical one for the Capsule configuration objects, + such as webhook secret or configurations. properties: TLSSecretName: default: capsule-tls - description: Defines the Secret name used for the webhook server. Must be in the same Namespace where the Capsule Deployment is deployed. + description: |- + Defines the Secret name used for the webhook server. + Must be in the same Namespace where the Capsule Deployment is deployed. type: string mutatingWebhookConfigurationName: default: capsule-mutating-webhook-configuration @@ -127,8 +146,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null + controller-gen.kubebuilder.io/version: v0.15.0 name: globaltenantresources.capsule.clastix.io spec: group: capsule.clastix.io @@ -145,10 +163,19 @@ spec: description: GlobalTenantResource allows to propagate resource replications to a specific subset of Tenant resources. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -157,14 +184,18 @@ spec: properties: pruningOnDelete: default: true - description: When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. Disable this to keep replicated resources although the deletion of the replication manifest. + description: |- + When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. + Disable this to keep replicated resources although the deletion of the replication manifest. type: boolean resources: description: Defines the rules to select targeting Namespace, along with the objects that must be replicated. items: properties: additionalMetadata: - description: Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources. + description: |- + Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be + added to the replicated resources. properties: annotations: additionalProperties: @@ -176,33 +207,48 @@ spec: type: object type: object namespaceSelector: - description: Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted. + description: |- + Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. + In case of nil value, all the Tenant Namespaces are targeted. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -214,10 +260,14 @@ spec: description: API version of the referent. type: string kind: - description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string namespace: - description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string selector: description: Label selector used to select the given resources in the given Namespace. @@ -225,28 +275,41 @@ spec: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -267,7 +330,9 @@ spec: type: array resyncPeriod: default: 60s - description: Define the period of time upon a second reconciliation must be invoked. Keep in mind that any change to the manifests will trigger a new reconciliation. + description: |- + Define the period of time upon a second reconciliation must be invoked. + Keep in mind that any change to the manifests will trigger a new reconciliation. type: string tenantSelector: description: Defines the Tenant selector used target the tenants on which resources must be propagated. @@ -275,28 +340,41 @@ spec: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -315,13 +393,19 @@ spec: description: API version of the referent. type: string kind: - description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string namespace: - description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string required: - kind @@ -348,8 +432,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null + controller-gen.kubebuilder.io/version: v0.15.0 name: tenantresources.capsule.clastix.io spec: group: capsule.clastix.io @@ -363,13 +446,25 @@ spec: - name: v1beta2 schema: openAPIV3Schema: - description: TenantResource allows a Tenant Owner, if enabled with proper RBAC, to propagate resources in its Namespace. The object must be deployed in a Tenant Namespace, and cannot reference object living in non-Tenant namespaces. For such cases, the GlobalTenantResource must be used. + description: |- + TenantResource allows a Tenant Owner, if enabled with proper RBAC, to propagate resources in its Namespace. + The object must be deployed in a Tenant Namespace, and cannot reference object living in non-Tenant namespaces. + For such cases, the GlobalTenantResource must be used. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -378,14 +473,18 @@ spec: properties: pruningOnDelete: default: true - description: When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. Disable this to keep replicated resources although the deletion of the replication manifest. + description: |- + When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. + Disable this to keep replicated resources although the deletion of the replication manifest. type: boolean resources: description: Defines the rules to select targeting Namespace, along with the objects that must be replicated. items: properties: additionalMetadata: - description: Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources. + description: |- + Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be + added to the replicated resources. properties: annotations: additionalProperties: @@ -397,33 +496,48 @@ spec: type: object type: object namespaceSelector: - description: Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted. + description: |- + Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. + In case of nil value, all the Tenant Namespaces are targeted. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -435,10 +549,14 @@ spec: description: API version of the referent. type: string kind: - description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string namespace: - description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string selector: description: Label selector used to select the given resources in the given Namespace. @@ -446,28 +564,41 @@ spec: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -488,7 +619,9 @@ spec: type: array resyncPeriod: default: 60s - description: Define the period of time upon a second reconciliation must be invoked. Keep in mind that any change to the manifests will trigger a new reconciliation. + description: |- + Define the period of time upon a second reconciliation must be invoked. + Keep in mind that any change to the manifests will trigger a new reconciliation. type: string required: - resources @@ -505,13 +638,19 @@ spec: description: API version of the referent. type: string kind: - description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string namespace: - description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ type: string required: - kind @@ -532,7 +671,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.15.0 name: tenants.capsule.clastix.io spec: conversion: @@ -583,10 +722,19 @@ spec: description: Tenant is the Schema for the tenants API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -602,19 +750,28 @@ spec: subjects: description: kubebuilder:validation:Minimum=1 items: - description: Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names. + description: |- + Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, + or a value for non-objects such as user and group names. properties: apiGroup: - description: APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects. + description: |- + APIGroup holds the API group of the referenced subject. + Defaults to "" for ServiceAccount subjects. + Defaults to "rbac.authorization.k8s.io" for User and Group subjects. type: string kind: - description: Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error. + description: |- + Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". + If the Authorizer does not recognized the kind value, the Authorizer should report an error. type: string name: description: Name of the object being referenced. type: string namespace: - description: Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error. + description: |- + Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty + the Authorizer should report an error. type: string required: - kind @@ -671,7 +828,20 @@ spec: type: object hostnameCollisionScope: default: Disabled - description: "Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. \n - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. \n - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. \n - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. \n Optional." + description: |- + Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. + + + - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. + + + - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. + + + - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. + + + Optional. enum: - Cluster - Tenant @@ -743,6 +913,7 @@ spec: - type type: object type: array + x-kubernetes-list-type: atomic required: - limits type: object @@ -777,264 +948,461 @@ spec: description: NetworkPolicySpec provides the specification of a NetworkPolicy properties: egress: - description: egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8 + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 items: - description: NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8 + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 properties: ports: - description: ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list. + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. items: description: NetworkPolicyPort describes a port to allow traffic on properties: endPort: - description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. format: int32 type: integer port: anyOf: - type: integer - type: string - description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched. + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. x-kubernetes-int-or-string: true protocol: default: TCP - description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP. + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. type: string type: object type: array + x-kubernetes-list-type: atomic to: - description: to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list. + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. items: - description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed properties: ipBlock: - description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be. + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. properties: cidr: - description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" type: string except: - description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range items: type: string type: array + x-kubernetes-list-type: atomic required: - cidr type: object namespaceSelector: - description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector." + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic podSelector: - description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace." + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object type: array + x-kubernetes-list-type: atomic type: object type: array + x-kubernetes-list-type: atomic ingress: - description: ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default) + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) items: - description: NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. properties: from: - description: from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list. + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. items: - description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed properties: ipBlock: - description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be. + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. properties: cidr: - description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" type: string except: - description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range items: type: string type: array + x-kubernetes-list-type: atomic required: - cidr type: object namespaceSelector: - description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector." + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic podSelector: - description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace." + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object type: array + x-kubernetes-list-type: atomic ports: - description: ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list. + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. items: description: NetworkPolicyPort describes a port to allow traffic on properties: endPort: - description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. format: int32 type: integer port: anyOf: - type: integer - type: string - description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched. + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. x-kubernetes-int-or-string: true protocol: default: TCP - description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP. + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: array + x-kubernetes-list-type: atomic podSelector: - description: podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace. + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of ingress rules is applied to any pods selected by this field. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is NOT optional and follows standard label selector semantics. + An empty podSelector matches all pods in this namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic policyTypes: - description: policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8 + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 items: - description: PolicyType string describes the NetworkPolicy type This type is beta-level in 1.8 + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 type: string type: array + x-kubernetes-list-type: atomic required: - podSelector type: object @@ -1112,40 +1480,58 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/' + description: |- + hard is the set of desired hard limits for each named resource. + More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/ type: object scopeSelector: - description: scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. + description: |- + scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota + but expressed using ScopeSelectorOperator in combination with possible values. + For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. properties: matchExpressions: description: A list of scope selector requirements by scope of the resources. items: - description: A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values. + description: |- + A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator + that relates the scope name and values. properties: operator: - description: Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. + description: |- + Represents a scope's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. type: string scopeName: description: The name of the scope that the selector applies to. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. + This array is replaced during a strategic merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - operator - scopeName type: object type: array + x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic scopes: - description: A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects. + description: |- + A collection of filters that must match each object tracked by a quota. + If not specified, the quota matches all objects. items: description: A ResourceQuotaScope defines a filter that must match each object tracked by a quota type: string type: array + x-kubernetes-list-type: atomic type: object type: array scope: @@ -1286,10 +1672,19 @@ spec: description: Tenant is the Schema for the tenants API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -1305,19 +1700,28 @@ spec: subjects: description: kubebuilder:validation:Minimum=1 items: - description: Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names. + description: |- + Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, + or a value for non-objects such as user and group names. properties: apiGroup: - description: APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects. + description: |- + APIGroup holds the API group of the referenced subject. + Defaults to "" for ServiceAccount subjects. + Defaults to "rbac.authorization.k8s.io" for User and Group subjects. type: string kind: - description: Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error. + description: |- + Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". + If the Authorizer does not recognized the kind value, the Authorizer should report an error. type: string name: description: Name of the object being referenced. type: string namespace: - description: Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error. + description: |- + Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty + the Authorizer should report an error. type: string required: - kind @@ -1360,7 +1764,11 @@ spec: description: Toggles the ability for Ingress resources created in a Tenant to have a hostname wildcard. type: boolean allowedClasses: - description: Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. A default value can be specified, and all the Ingress resources created will inherit the declared class. Optional. + description: |- + Specifies the allowed IngressClasses assigned to the Tenant. + Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. + A default value can be specified, and all the Ingress resources created will inherit the declared class. + Optional. properties: allowed: items: @@ -1373,28 +1781,41 @@ spec: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -1410,7 +1831,20 @@ spec: type: object hostnameCollisionScope: default: Disabled - description: "Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. \n - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. \n - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. \n - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. \n Optional." + description: |- + Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. + + + - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. + + + - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. + + + - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. + + + Optional. enum: - Cluster - Tenant @@ -1482,6 +1916,7 @@ spec: - type type: object type: array + x-kubernetes-list-type: atomic required: - limits type: object @@ -1536,264 +1971,461 @@ spec: description: NetworkPolicySpec provides the specification of a NetworkPolicy properties: egress: - description: egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8 + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 items: - description: NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8 + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 properties: ports: - description: ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list. + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. items: description: NetworkPolicyPort describes a port to allow traffic on properties: endPort: - description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. format: int32 type: integer port: anyOf: - type: integer - type: string - description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched. + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. x-kubernetes-int-or-string: true protocol: default: TCP - description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP. + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. type: string type: object type: array + x-kubernetes-list-type: atomic to: - description: to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list. + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. items: - description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed properties: ipBlock: - description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be. + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. properties: cidr: - description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" type: string except: - description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range items: type: string type: array + x-kubernetes-list-type: atomic required: - cidr type: object namespaceSelector: - description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector." + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic podSelector: - description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace." + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object type: array + x-kubernetes-list-type: atomic type: object type: array + x-kubernetes-list-type: atomic ingress: - description: ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default) + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) items: - description: NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. properties: from: - description: from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list. + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. items: - description: NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed properties: ipBlock: - description: ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be. + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. properties: cidr: - description: cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" type: string except: - description: except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range items: type: string type: array + x-kubernetes-list-type: atomic required: - cidr type: object namespaceSelector: - description: "namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. \n If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector." + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic podSelector: - description: "podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. \n If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace." + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic type: object type: array + x-kubernetes-list-type: atomic ports: - description: ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list. + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. items: description: NetworkPolicyPort describes a port to allow traffic on properties: endPort: - description: endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. format: int32 type: integer port: anyOf: - type: integer - type: string - description: port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched. + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. x-kubernetes-int-or-string: true protocol: default: TCP - description: protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP. + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. type: string type: object type: array + x-kubernetes-list-type: atomic type: object type: array + x-kubernetes-list-type: atomic podSelector: - description: podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace. + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of ingress rules is applied to any pods selected by this field. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is NOT optional and follows standard label selector semantics. + An empty podSelector matches all pods in this namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic policyTypes: - description: policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8 + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 items: - description: PolicyType string describes the NetworkPolicy type This type is beta-level in 1.8 + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 type: string type: array + x-kubernetes-list-type: atomic required: - podSelector type: object @@ -1875,10 +2507,16 @@ spec: type: object preventDeletion: default: false - description: Prevent accidental deletion of the Tenant. When enabled, the deletion request will be declined. + description: |- + Prevent accidental deletion of the Tenant. + When enabled, the deletion request will be declined. type: boolean priorityClasses: - description: Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. A default value can be specified, and all the Pod resources created will inherit the declared class. Optional. + description: |- + Specifies the allowed priorityClasses assigned to the Tenant. + Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. + A default value can be specified, and all the Pod resources created will inherit the declared class. + Optional. properties: allowed: items: @@ -1891,28 +2529,41 @@ spec: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -1930,40 +2581,58 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/' + description: |- + hard is the set of desired hard limits for each named resource. + More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/ type: object scopeSelector: - description: scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. + description: |- + scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota + but expressed using ScopeSelectorOperator in combination with possible values. + For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. properties: matchExpressions: description: A list of scope selector requirements by scope of the resources. items: - description: A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values. + description: |- + A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator + that relates the scope name and values. properties: operator: - description: Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. + description: |- + Represents a scope's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. type: string scopeName: description: The name of the scope that the selector applies to. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. + This array is replaced during a strategic merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - operator - scopeName type: object type: array + x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic scopes: - description: A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects. + description: |- + A collection of filters that must match each object tracked by a quota. + If not specified, the quota matches all objects. items: description: A ResourceQuotaScope defines a filter that must match each object tracked by a quota type: string type: array + x-kubernetes-list-type: atomic type: object type: array scope: @@ -1975,7 +2644,10 @@ spec: type: string type: object runtimeClasses: - description: Specifies the allowed RuntimeClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. Optional. + description: |- + Specifies the allowed RuntimeClasses assigned to the Tenant. + Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. + Optional. properties: allowed: items: @@ -1986,28 +2658,41 @@ spec: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -2075,7 +2760,11 @@ spec: type: object type: object storageClasses: - description: Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. Optional. + description: |- + Specifies the allowed StorageClasses assigned to the Tenant. + Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. + A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. + Optional. properties: allowed: items: @@ -2088,28 +2777,41 @@ spec: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -2267,7 +2969,6 @@ spec: apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: - creationTimestamp: null name: capsule-mutating-webhook-configuration webhooks: - admissionReviewVersions: @@ -2278,20 +2979,22 @@ webhooks: namespace: capsule-system path: /defaults failurePolicy: Fail - name: pod.defaults.capsule.clastix.io + name: ingress.defaults.capsule.clastix.io namespaceSelector: matchExpressions: - key: capsule.clastix.io/tenant operator: Exists rules: - apiGroups: - - "" + - networking.k8s.io apiVersions: + - v1beta1 - v1 operations: - CREATE + - UPDATE resources: - - pods + - ingresses scope: Namespaced sideEffects: None - admissionReviewVersions: @@ -2300,9 +3003,9 @@ webhooks: service: name: capsule-webhook-service namespace: capsule-system - path: /defaults + path: /namespace-owner-reference failurePolicy: Fail - name: storage.defaults.capsule.clastix.io + name: owner.namespace.capsule.clastix.io namespaceSelector: matchExpressions: - key: capsule.clastix.io/tenant @@ -2314,8 +3017,9 @@ webhooks: - v1 operations: - CREATE + - UPDATE resources: - - persistentvolumeclaims + - namespaces scope: Namespaced sideEffects: None - admissionReviewVersions: @@ -2326,22 +3030,20 @@ webhooks: namespace: capsule-system path: /defaults failurePolicy: Fail - name: ingress.defaults.capsule.clastix.io + name: pod.defaults.capsule.clastix.io namespaceSelector: matchExpressions: - key: capsule.clastix.io/tenant operator: Exists rules: - apiGroups: - - networking.k8s.io + - "" apiVersions: - - v1beta1 - v1 operations: - CREATE - - UPDATE resources: - - ingresses + - pods scope: Namespaced sideEffects: None - admissionReviewVersions: @@ -2350,9 +3052,9 @@ webhooks: service: name: capsule-webhook-service namespace: capsule-system - path: /namespace-owner-reference + path: /defaults failurePolicy: Fail - name: owner.namespace.capsule.clastix.io + name: storage.defaults.capsule.clastix.io rules: - apiGroups: - "" @@ -2360,15 +3062,13 @@ webhooks: - v1 operations: - CREATE - - UPDATE resources: - - namespaces + - persistentvolumeclaims sideEffects: None --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: - creationTimestamp: null name: capsule-validating-webhook-configuration webhooks: - admissionReviewVersions: @@ -2548,23 +3248,23 @@ webhooks: service: name: capsule-webhook-service namespace: capsule-system - path: /services + path: /tenantresource-objects failurePolicy: Fail - name: services.capsule.clastix.io + name: resource-objects.tenant.capsule.clastix.io namespaceSelector: matchExpressions: - key: capsule.clastix.io/tenant operator: Exists rules: - apiGroups: - - "" + - '*' apiVersions: - - v1 + - '*' operations: - - CREATE - UPDATE + - DELETE resources: - - services + - '*' scope: Namespaced sideEffects: None - admissionReviewVersions: @@ -2573,9 +3273,9 @@ webhooks: service: name: capsule-webhook-service namespace: capsule-system - path: /tenantresource-objects + path: /services failurePolicy: Fail - name: resource-objects.tenant.capsule.clastix.io + name: services.capsule.clastix.io namespaceSelector: matchExpressions: - key: capsule.clastix.io/tenant @@ -2586,14 +3286,14 @@ webhooks: operator: Exists rules: - apiGroups: - - '*' + - "" apiVersions: - - '*' + - v1 operations: + - CREATE - UPDATE - - DELETE resources: - - '*' + - services scope: Namespaced sideEffects: None - admissionReviewVersions: diff --git a/config/webhook/manifests.yaml b/config/webhook/manifests.yaml index 294c5fc2..02d011d2 100644 --- a/config/webhook/manifests.yaml +++ b/config/webhook/manifests.yaml @@ -2,7 +2,6 @@ apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: - creationTimestamp: null name: mutating-webhook-configuration webhooks: - admissionReviewVersions: @@ -13,16 +12,18 @@ webhooks: namespace: system path: /defaults failurePolicy: Fail - name: pod.defaults.capsule.clastix.io + name: ingress.defaults.capsule.clastix.io rules: - apiGroups: - - "" + - networking.k8s.io apiVersions: + - v1beta1 - v1 operations: - CREATE + - UPDATE resources: - - pods + - ingresses sideEffects: None - admissionReviewVersions: - v1 @@ -30,9 +31,9 @@ webhooks: service: name: webhook-service namespace: system - path: /defaults + path: /namespace-owner-reference failurePolicy: Fail - name: storage.defaults.capsule.clastix.io + name: owner.namespace.capsule.clastix.io rules: - apiGroups: - "" @@ -40,8 +41,9 @@ webhooks: - v1 operations: - CREATE + - UPDATE resources: - - persistentvolumeclaims + - namespaces sideEffects: None - admissionReviewVersions: - v1 @@ -51,18 +53,16 @@ webhooks: namespace: system path: /defaults failurePolicy: Fail - name: ingress.defaults.capsule.clastix.io + name: pod.defaults.capsule.clastix.io rules: - apiGroups: - - networking.k8s.io + - "" apiVersions: - - v1beta1 - v1 operations: - CREATE - - UPDATE resources: - - ingresses + - pods sideEffects: None - admissionReviewVersions: - v1 @@ -70,9 +70,9 @@ webhooks: service: name: webhook-service namespace: system - path: /namespace-owner-reference + path: /defaults failurePolicy: Fail - name: owner.namespace.capsule.clastix.io + name: storage.defaults.capsule.clastix.io rules: - apiGroups: - "" @@ -80,15 +80,13 @@ webhooks: - v1 operations: - CREATE - - UPDATE resources: - - namespaces + - persistentvolumeclaims sideEffects: None --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: - creationTimestamp: null name: validating-webhook-configuration webhooks: - admissionReviewVersions: @@ -239,19 +237,19 @@ webhooks: service: name: webhook-service namespace: system - path: /services + path: /tenantresource-objects failurePolicy: Fail - name: services.capsule.clastix.io + name: resource-objects.tenant.capsule.clastix.io rules: - apiGroups: - - "" + - '*' apiVersions: - - v1 + - '*' operations: - - CREATE - UPDATE + - DELETE resources: - - services + - '*' sideEffects: None - admissionReviewVersions: - v1 @@ -259,19 +257,19 @@ webhooks: service: name: webhook-service namespace: system - path: /tenantresource-objects + path: /services failurePolicy: Fail - name: resource-objects.tenant.capsule.clastix.io + name: services.capsule.clastix.io rules: - apiGroups: - - '*' + - "" apiVersions: - - '*' + - v1 operations: + - CREATE - UPDATE - - DELETE resources: - - '*' + - services sideEffects: None - admissionReviewVersions: - v1 diff --git a/controllers/rbac/manager.go b/controllers/rbac/manager.go index ce431915..7c2e2c5e 100644 --- a/controllers/rbac/manager.go +++ b/controllers/rbac/manager.go @@ -5,10 +5,10 @@ package rbac import ( "context" + "errors" "fmt" "github.com/go-logr/logr" - "github.com/hashicorp/go-multierror" rbacv1 "k8s.io/api/rbac/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -39,7 +39,7 @@ func (r *Manager) SetupWithManager(ctx context.Context, mgr ctrl.Manager, config For(&rbacv1.ClusterRole{}, namesPredicate). Complete(r) if crErr != nil { - err = multierror.Append(err, crErr) + err = errors.Join(err, crErr) } crbErr := ctrl.NewControllerManagedBy(mgr). @@ -56,7 +56,7 @@ func (r *Manager) SetupWithManager(ctx context.Context, mgr ctrl.Manager, config Complete(r) if crbErr != nil { - err = multierror.Append(err, crbErr) + err = errors.Join(err, crbErr) } return diff --git a/controllers/resources/global.go b/controllers/resources/global.go index 4e8fa7d3..73778211 100644 --- a/controllers/resources/global.go +++ b/controllers/resources/global.go @@ -5,9 +5,9 @@ package resources import ( "context" + "errors" - "github.com/hashicorp/go-multierror" - "github.com/pkg/errors" + gherrors "github.com/pkg/errors" apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/labels" @@ -75,14 +75,15 @@ func (r *Global) SetupWithManager(mgr ctrl.Manager) error { Complete(r) } -//nolint:dupl func (r *Global) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) { + var err error + log := ctrllog.FromContext(ctx) log.Info("start processing") // Retrieving the GlobalTenantResource tntResource := &capsulev1beta2.GlobalTenantResource{} - if err := r.client.Get(ctx, request.NamespacedName, tntResource); err != nil { + if err = r.client.Get(ctx, request.NamespacedName, tntResource); err != nil { if apierrors.IsNotFound(err) { log.Info("Request object not found, could have been deleted after reconcile request") @@ -94,13 +95,13 @@ func (r *Global) Reconcile(ctx context.Context, request reconcile.Request) (reco patchHelper, err := patch.NewHelper(tntResource, r.client) if err != nil { - return reconcile.Result{}, errors.Wrap(err, "failed to init patch helper") + return reconcile.Result{}, gherrors.Wrap(err, "failed to init patch helper") } defer func() { if e := patchHelper.Patch(ctx, tntResource); e != nil { if err == nil { - err = errors.Wrap(e, "failed to patch GlobalTenantResource") + err = gherrors.Wrap(e, "failed to patch GlobalTenantResource") } } }() @@ -143,7 +144,6 @@ func (r *Global) reconcileNormal(ctx context.Context, tntResource *capsulev1beta // upon replication and pruning, this will be updated in the status of the resource. tntSet := sets.NewString() - err = new(multierror.Error) // A TenantResource is made of several Resource sections, each one with specific options: // the Status can be updated only in case of no errors across all of them to guarantee a valid and coherent status. processedItems := sets.NewString() @@ -163,14 +163,14 @@ func (r *Global) reconcileNormal(ctx context.Context, tntResource *capsulev1beta if sectionErr != nil { // Upon a process error storing the last error occurred and continuing to iterate, // avoid to block the whole processing. - err = multierror.Append(err, sectionErr) + err = errors.Join(err, sectionErr) } else { processedItems.Insert(items...) } } } - if err.(*multierror.Error).ErrorOrNil() != nil { //nolint:errorlint,forcetypeassert + if err != nil { log.Error(err, "unable to replicate the requested resources") return reconcile.Result{}, err diff --git a/controllers/resources/namespaced.go b/controllers/resources/namespaced.go index 60eadcbd..96d32649 100644 --- a/controllers/resources/namespaced.go +++ b/controllers/resources/namespaced.go @@ -5,9 +5,9 @@ package resources import ( "context" + "errors" - "github.com/hashicorp/go-multierror" - "github.com/pkg/errors" + gherrors "github.com/pkg/errors" apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/fields" "k8s.io/apimachinery/pkg/util/sets" @@ -37,7 +37,6 @@ func (r *Namespaced) SetupWithManager(mgr ctrl.Manager) error { Complete(r) } -//nolint:dupl func (r *Namespaced) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) { log := ctrllog.FromContext(ctx) @@ -56,13 +55,13 @@ func (r *Namespaced) Reconcile(ctx context.Context, request reconcile.Request) ( patchHelper, err := patch.NewHelper(tntResource, r.client) if err != nil { - return reconcile.Result{}, errors.Wrap(err, "failed to init patch helper") + return reconcile.Result{}, gherrors.Wrap(err, "failed to init patch helper") } defer func() { if e := patchHelper.Patch(ctx, tntResource); e != nil { if err == nil { - err = errors.Wrap(e, "failed to patch TenantResource") + err = gherrors.Wrap(e, "failed to patch TenantResource") } } }() @@ -103,7 +102,6 @@ func (r *Namespaced) reconcileNormal(ctx context.Context, tntResource *capsulev1 return reconcile.Result{}, nil } - err := new(multierror.Error) // A TenantResource is made of several Resource sections, each one with specific options: // the Status can be updated only in case of no errors across all of them to guarantee a valid and coherent status. processedItems := sets.NewString() @@ -115,18 +113,21 @@ func (r *Namespaced) reconcileNormal(ctx context.Context, tntResource *capsulev1 return reconcile.Result{}, labelErr } + // new empty error + var err error + for index, resource := range tntResource.Spec.Resources { items, sectionErr := r.processor.HandleSection(ctx, tl.Items[0], false, tenantLabel, index, resource) if sectionErr != nil { // Upon a process error storing the last error occurred and continuing to iterate, // avoid to block the whole processing. - err = multierror.Append(err, sectionErr) + err = errors.Join(err, sectionErr) } else { processedItems.Insert(items...) } } - if err.ErrorOrNil() != nil { + if err != nil { log.Error(err, "unable to replicate the requested resources") return reconcile.Result{}, err diff --git a/controllers/resources/processor.go b/controllers/resources/processor.go index 8efb75d6..e5fdcc1b 100644 --- a/controllers/resources/processor.go +++ b/controllers/resources/processor.go @@ -5,9 +5,10 @@ package resources import ( "context" + "errors" "fmt" + "sync" - "github.com/hashicorp/go-multierror" "github.com/valyala/fasttemplate" corev1 "k8s.io/api/core/v1" apierr "k8s.io/apimachinery/pkg/api/errors" @@ -131,7 +132,7 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant tntNamespaces := sets.NewString(tnt.Status.Namespaces...) - syncErr := new(multierror.Error) + var syncErr error codecFactory := serializer.NewCodecFactory(r.client.Scheme()) @@ -153,7 +154,7 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant if selectorErr != nil { log.Error(selectorErr, "cannot create Selector for namespacedItem", keysAndValues...) - syncErr = multierror.Append(syncErr, selectorErr) + syncErr = errors.Join(syncErr, selectorErr) continue } @@ -164,12 +165,15 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant if clientErr := r.client.List(ctx, &objs, client.InNamespace(item.Namespace), client.MatchingLabelsSelector{Selector: itemSelector}); clientErr != nil { log.Error(clientErr, "cannot retrieve object for namespacedItem", keysAndValues...) - syncErr = multierror.Append(syncErr, clientErr) + syncErr = errors.Join(syncErr, clientErr) continue } - multiErr := new(multierror.Group) + var wg sync.WaitGroup + + errorsChan := make(chan error, len(objs.Items)) + // Iterating over all the retrieved objects from the resource spec to get replicated in all the selected Namespaces: // in case of error during the create or update function, this will be appended to the list of errors. for _, o := range objs.Items { @@ -177,14 +181,19 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant obj.SetNamespace(ns.Name) obj.SetOwnerReferences(nil) - multiErr.Go(func() error { + wg.Add(1) + + go func(obj unstructured.Unstructured) { + defer wg.Done() + kv := keysAndValues kv = append(kv, "resource", fmt.Sprintf("%s/%s", obj.GetNamespace(), obj.GetNamespace())) if opErr := r.createOrUpdate(ctx, &obj, objLabels, objAnnotations); opErr != nil { log.Error(opErr, "unable to sync namespacedItems", kv...) + errorsChan <- opErr - return opErr + return } log.Info("resource has been replicated", kv...) @@ -196,13 +205,16 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant replicatedItem.APIVersion = obj.GetAPIVersion() processed.Insert(replicatedItem.String()) - - return nil - }) + }(obj) } - if objsErr := multiErr.Wait(); objsErr != nil { - syncErr = multierror.Append(syncErr, objsErr) + wg.Wait() + close(errorsChan) + + for err := range errorsChan { + if err != nil { + syncErr = errors.Join(syncErr, err) + } } } @@ -221,7 +233,7 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant if _, _, decodeErr := codecFactory.UniversalDeserializer().Decode([]byte(tmplString), nil, &obj); decodeErr != nil { log.Error(decodeErr, "unable to deserialize rawItem", keysAndValues...) - syncErr = multierror.Append(syncErr, decodeErr) + syncErr = errors.Join(syncErr, decodeErr) continue } @@ -232,7 +244,7 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant log.Info("unable to sync rawItem", keysAndValues...) // In case of error processing an item in one of any selected Namespaces, storing it to report it lately // to the upper call to ensure a partial sync that will be fixed by a subsequent reconciliation. - syncErr = multierror.Append(syncErr, rawErr) + syncErr = errors.Join(syncErr, rawErr) } else { log.Info("resource has been replicated", keysAndValues...) @@ -247,7 +259,7 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant } } - return processed.List(), syncErr.ErrorOrNil() + return processed.List(), syncErr } // createOrUpdate replicates the provided unstructured object to all the provided Namespaces: diff --git a/docs/content/general/crds-apis.md b/docs/content/general/crds-apis.md index c395223d..e75d1ad9 100644 --- a/docs/content/general/crds-apis.md +++ b/docs/content/general/crds-apis.md @@ -102,7 +102,8 @@ CapsuleConfigurationSpec defines the Capsule configuration. enableTLSReconciler boolean - Toggles the TLS reconciler, the controller that is able to generate CA and certificates for the webhooks when not using an already provided CA and certificate, or when these are managed externally with Vault, or cert-manager.
+ Toggles the TLS reconciler, the controller that is able to generate CA and certificates for the webhooks +when not using an already provided CA and certificate, or when these are managed externally with Vault, or cert-manager.

Default: true
@@ -111,7 +112,8 @@ CapsuleConfigurationSpec defines the Capsule configuration. forceTenantPrefix boolean - Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment.
+ Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, +separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment.

Default: false
@@ -120,14 +122,16 @@ CapsuleConfigurationSpec defines the Capsule configuration. nodeMetadata object - Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant. This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes.
+ Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant. +This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes.
false overrides object - Allows to set different name rather than the canonical one for the Capsule configuration objects, such as webhook secret or configurations.
+ Allows to set different name rather than the canonical one for the Capsule configuration objects, +such as webhook secret or configurations.

Default: map[TLSSecretName:capsule-tls mutatingWebhookConfigurationName:capsule-mutating-webhook-configuration validatingWebhookConfigurationName:capsule-validating-webhook-configuration]
@@ -156,7 +160,8 @@ CapsuleConfigurationSpec defines the Capsule configuration. -Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant. This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes. +Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant. +This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes. @@ -255,7 +260,8 @@ Define the labels that a Tenant Owner cannot set for their nodes. -Allows to set different name rather than the canonical one for the Capsule configuration objects, such as webhook secret or configurations. +Allows to set different name rather than the canonical one for the Capsule configuration objects, +such as webhook secret or configurations.
@@ -270,7 +276,8 @@ Allows to set different name rather than the canonical one for the Capsule confi @@ -375,7 +382,8 @@ GlobalTenantResourceSpec defines the desired state of GlobalTenantResource. @@ -384,7 +392,8 @@ GlobalTenantResourceSpec defines the desired state of GlobalTenantResource. @@ -419,14 +428,16 @@ GlobalTenantResourceSpec defines the desired state of GlobalTenantResource. @@ -451,7 +462,8 @@ GlobalTenantResourceSpec defines the desired state of GlobalTenantResource. -Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources. +Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be +added to the replicated resources.
TLSSecretName string - Defines the Secret name used for the webhook server. Must be in the same Namespace where the Capsule Deployment is deployed.
+ Defines the Secret name used for the webhook server. +Must be in the same Namespace where the Capsule Deployment is deployed.

Default: capsule-tls
resyncPeriod string - Define the period of time upon a second reconciliation must be invoked. Keep in mind that any change to the manifests will trigger a new reconciliation.
+ Define the period of time upon a second reconciliation must be invoked. +Keep in mind that any change to the manifests will trigger a new reconciliation.

Default: 60s
pruningOnDelete boolean - When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. Disable this to keep replicated resources although the deletion of the replication manifest.
+ When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. +Disable this to keep replicated resources although the deletion of the replication manifest.

Default: true
additionalMetadata object - Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources.
+ Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be +added to the replicated resources.
 false
namespaceSelector object - Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted.
+ Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. +In case of nil value, all the Tenant Namespaces are targeted.
 false
@@ -484,7 +496,8 @@ Besides the Capsule metadata required by TenantResource controller, defines addi -Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted. +Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. +In case of nil value, all the Tenant Namespaces are targeted.
@@ -506,7 +519,9 @@ Defines the Namespace selector to select the Tenant Namespaces on which the reso @@ -517,7 +532,8 @@ Defines the Namespace selector to select the Tenant Namespaces on which the reso -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -539,14 +555,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -572,14 +592,16 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -626,7 +648,9 @@ Label selector used to select the given resources in the given Namespace. @@ -637,7 +661,8 @@ Label selector used to select the given resources in the given Namespace. -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
kind string - Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ Kind of the referent. +More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 true
namespace string - Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+ Namespace of the referent. +More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
 true
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -659,14 +684,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -699,7 +728,9 @@ Defines the Tenant selector used target the tenants on which resources must be p @@ -710,7 +741,8 @@ Defines the Tenant selector used target the tenants on which resources must be p -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -732,14 +764,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -798,21 +834,24 @@ GlobalTenantResourceStatus defines the observed state of GlobalTenantResource. @@ -832,7 +871,9 @@ GlobalTenantResourceStatus defines the observed state of GlobalTenantResource. -TenantResource allows a Tenant Owner, if enabled with proper RBAC, to propagate resources in its Namespace. The object must be deployed in a Tenant Namespace, and cannot reference object living in non-Tenant namespaces. For such cases, the GlobalTenantResource must be used. +TenantResource allows a Tenant Owner, if enabled with proper RBAC, to propagate resources in its Namespace. +The object must be deployed in a Tenant Namespace, and cannot reference object living in non-Tenant namespaces. +For such cases, the GlobalTenantResource must be used.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
kind string - Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ Kind of the referent. +More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 true
name string - Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ Name of the referent. +More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 true
namespace string - Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+ Namespace of the referent. +More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
 true
@@ -904,7 +945,8 @@ TenantResourceSpec defines the desired state of TenantResource. @@ -913,7 +955,8 @@ TenantResourceSpec defines the desired state of TenantResource. @@ -941,14 +984,16 @@ TenantResourceSpec defines the desired state of TenantResource. @@ -973,7 +1018,8 @@ TenantResourceSpec defines the desired state of TenantResource. -Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources. +Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be +added to the replicated resources.
resyncPeriod string - Define the period of time upon a second reconciliation must be invoked. Keep in mind that any change to the manifests will trigger a new reconciliation.
+ Define the period of time upon a second reconciliation must be invoked. +Keep in mind that any change to the manifests will trigger a new reconciliation.

Default: 60s
pruningOnDelete boolean - When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. Disable this to keep replicated resources although the deletion of the replication manifest.
+ When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted. +Disable this to keep replicated resources although the deletion of the replication manifest.

Default: true
additionalMetadata object - Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be added to the replicated resources.
+ Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be +added to the replicated resources.
 false
namespaceSelector object - Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted.
+ Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. +In case of nil value, all the Tenant Namespaces are targeted.
 false
@@ -1006,7 +1052,8 @@ Besides the Capsule metadata required by TenantResource controller, defines addi -Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. In case of nil value, all the Tenant Namespaces are targeted. +Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated. +In case of nil value, all the Tenant Namespaces are targeted.
@@ -1028,7 +1075,9 @@ Defines the Namespace selector to select the Tenant Namespaces on which the reso @@ -1039,7 +1088,8 @@ Defines the Namespace selector to select the Tenant Namespaces on which the reso -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -1061,14 +1111,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -1094,14 +1148,16 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -1148,7 +1204,9 @@ Label selector used to select the given resources in the given Namespace. @@ -1159,7 +1217,8 @@ Label selector used to select the given resources in the given Namespace. -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
kind string - Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ Kind of the referent. +More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 true
namespace string - Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+ Namespace of the referent. +More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
 true
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -1181,14 +1240,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -1240,21 +1303,24 @@ TenantResourceStatus defines the observed state of TenantResource. @@ -1418,7 +1484,8 @@ TenantSpec defines the desired state of Tenant. @@ -1427,7 +1494,10 @@ TenantSpec defines the desired state of Tenant. @@ -1441,7 +1511,9 @@ TenantSpec defines the desired state of Tenant. @@ -1455,7 +1527,10 @@ TenantSpec defines the desired state of Tenant. @@ -1585,7 +1660,8 @@ TenantSpec defines the desired state of Tenant. -Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names. +Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, +or a value for non-objects such as user and group names.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
kind string - Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ Kind of the referent. +More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 true
name string - Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ Name of the referent. +More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 true
namespace string - Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+ Namespace of the referent. +More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
 true
preventDeletion boolean - Prevent accidental deletion of the Tenant. When enabled, the deletion request will be declined.
+ Prevent accidental deletion of the Tenant. +When enabled, the deletion request will be declined.

Default: false
priorityClasses object - Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. A default value can be specified, and all the Pod resources created will inherit the declared class. Optional.
+ Specifies the allowed priorityClasses assigned to the Tenant. +Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. +A default value can be specified, and all the Pod resources created will inherit the declared class. +Optional.
 false
runtimeClasses object - Specifies the allowed RuntimeClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. Optional.
+ Specifies the allowed RuntimeClasses assigned to the Tenant. +Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. +Optional.
 false
storageClasses object - Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. Optional.
+ Specifies the allowed StorageClasses assigned to the Tenant. +Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. +A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. +Optional.
 false
@@ -1600,7 +1676,8 @@ Subject contains a reference to the object or user identities a role binding app @@ -1614,14 +1691,17 @@ Subject contains a reference to the object or user identities a role binding app @@ -1687,7 +1767,10 @@ Specifies options for the Ingress resources, such as allowed hostnames and Ingre @@ -1701,11 +1784,19 @@ Specifies options for the Ingress resources, such as allowed hostnames and Ingre
kind string - Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+ Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". +If the Authorizer does not recognized the kind value, the Authorizer should report an error.
 true
apiGroup string - APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
+ APIGroup holds the API group of the referenced subject. +Defaults to "" for ServiceAccount subjects. +Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
 false
namespace string - Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.
+ Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty +the Authorizer should report an error.
 false
allowedClasses object - Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. A default value can be specified, and all the Ingress resources created will inherit the declared class. Optional.
+ Specifies the allowed IngressClasses assigned to the Tenant. +Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. +A default value can be specified, and all the Ingress resources created will inherit the declared class. +Optional.
 false
hostnameCollisionScope enum - Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. - - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. - - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. - - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. - Optional.
+ Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. + + +- Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. + + +- Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. + + +- Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. + + +Optional.

Enum: Cluster, Tenant, Namespace, Disabled
Default: Disabled
@@ -1719,7 +1810,10 @@ Specifies options for the Ingress resources, such as allowed hostnames and Ingre -Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. A default value can be specified, and all the Ingress resources created will inherit the declared class. Optional. +Specifies the allowed IngressClasses assigned to the Tenant. +Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses. +A default value can be specified, and all the Ingress resources created will inherit the declared class. +Optional. @@ -1762,7 +1856,9 @@ Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures tha @@ -1773,7 +1869,8 @@ Specifies the allowed IngressClasses assigned to the Tenant. Capsule assures tha -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -1795,14 +1892,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -2149,28 +2250,54 @@ NetworkPolicySpec provides the specification of a NetworkPolicy @@ -2181,7 +2308,12 @@ NetworkPolicySpec provides the specification of a NetworkPolicy -podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace. +podSelector selects the pods to which this NetworkPolicy object applies. +The array of ingress rules is applied to any pods selected by this field. +Multiple network policies can select the same set of pods. In this case, +the ingress rules for each are combined additively. +This field is NOT optional and follows standard label selector semantics. +An empty podSelector matches all pods in this namespace.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
podSelector object - podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
+ podSelector selects the pods to which this NetworkPolicy object applies. +The array of ingress rules is applied to any pods selected by this field. +Multiple network policies can select the same set of pods. In this case, +the ingress rules for each are combined additively. +This field is NOT optional and follows standard label selector semantics. +An empty podSelector matches all pods in this namespace.
 true
egress []object - egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
+ egress is a list of egress rules to be applied to the selected pods. Outgoing traffic +is allowed if there are no NetworkPolicies selecting the pod (and cluster policy +otherwise allows the traffic), OR if the traffic matches at least one egress rule +across all of the NetworkPolicy objects whose podSelector matches the pod. If +this field is empty then this NetworkPolicy limits all outgoing traffic (and serves +solely to ensure that the pods it selects are isolated by default). +This field is beta-level in 1.8
 false
ingress []object - ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
+ ingress is a list of ingress rules to be applied to the selected pods. +Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod +(and cluster policy otherwise allows the traffic), OR if the traffic source is +the pod's local node, OR if the traffic matches at least one ingress rule +across all of the NetworkPolicy objects whose podSelector matches the pod. If +this field is empty then this NetworkPolicy does not allow any traffic (and serves +solely to ensure that the pods it selects are isolated by default)
 false
policyTypes []string - policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
+ policyTypes is a list of rule types that the NetworkPolicy relates to. +Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. +If this field is not specified, it will default based on the existence of ingress or egress rules; +policies that contain an egress section are assumed to affect egress, and all policies +(whether or not they contain an ingress section) are assumed to affect ingress. +If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. +Likewise, if you want to write a policy that specifies that no egress is allowed, +you must specify a policyTypes value that include "Egress" (since such a policy would not include +an egress section and would otherwise default to just [ "Ingress" ]). +This field is beta-level in 1.8
 false
@@ -2203,7 +2335,9 @@ podSelector selects the pods to which this NetworkPolicy object applies. The arr @@ -2214,7 +2348,8 @@ podSelector selects the pods to which this NetworkPolicy object applies. The arr -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -2236,14 +2371,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -2254,7 +2393,9 @@ A label selector requirement is a selector that contains values, a key, and an o -NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8 +NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods +matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. +This type is beta-level in 1.8
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -2269,14 +2410,22 @@ NetworkPolicyEgressRule describes a particular set of traffic that is allowed ou @@ -2302,7 +2451,10 @@ NetworkPolicyPort describes a port to allow traffic on @@ -2311,14 +2463,18 @@ NetworkPolicyPort describes a port to allow traffic on @@ -2331,7 +2487,8 @@ NetworkPolicyPort describes a port to allow traffic on -NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed +NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of +fields are allowed
ports []object - ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+ ports is a list of destination ports for outgoing traffic. +Each item in this list is combined using a logical OR. If this field is +empty or missing, this rule matches all ports (traffic not restricted by port). +If this field is present and contains at least one item, then this rule allows +traffic only if the traffic matches at least one port in the list.
 false
to []object - to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
+ to is a list of destinations for outgoing traffic of pods selected for this rule. +Items in this list are combined using a logical OR operation. If this field is +empty or missing, this rule matches all destinations (traffic not restricted by +destination). If this field is present and contains at least one item, this rule +allows traffic only if the traffic matches at least one item in the to list.
 false
endPort integer - endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
+ endPort indicates that the range of ports from port to endPort if set, inclusive, +should be allowed by the policy. This field cannot be defined if the port field +is not defined or if the port field is defined as a named (string) port. +The endPort must be equal or greater than port.

Format: int32
port int or string - port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+ port represents the port on the given protocol. This can either be a numerical or named +port on a pod. If this field is not provided, this matches all port names and +numbers. +If present, only traffic on the specified protocol AND port will be matched.
 false
protocol string - protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+ protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. +If not specified, this field defaults to TCP.

Default: TCP
@@ -2346,23 +2503,34 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin @@ -2373,7 +2541,8 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin -ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be. +ipBlock defines policy on a particular IPBlock. If this field is set then +neither of the other fields can be.
ipBlock object - ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ ipBlock defines policy on a particular IPBlock. If this field is set then +neither of the other fields can be.
 false
namespaceSelector object - namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. - If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
+ namespaceSelector selects namespaces using cluster-scoped labels. This field follows +standard label selector semantics; if present but empty, it selects all namespaces. + + +If podSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the namespaces selected by namespaceSelector. +Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 false
podSelector object - podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. - If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
+ podSelector is a label selector which selects pods. This field follows standard label +selector semantics; if present but empty, it selects all pods. + + +If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the Namespaces selected by NamespaceSelector. +Otherwise it selects the pods matching podSelector in the policy's own namespace.
 false
@@ -2388,14 +2557,17 @@ ipBlock defines policy on a particular IPBlock. If this field is set then neithe @@ -2406,8 +2578,13 @@ ipBlock defines policy on a particular IPBlock. If this field is set then neithe -namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. - If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector. +namespaceSelector selects namespaces using cluster-scoped labels. This field follows +standard label selector semantics; if present but empty, it selects all namespaces. + + +If podSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the namespaces selected by namespaceSelector. +Otherwise it selects all pods in the namespaces selected by namespaceSelector.
cidr string - cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
+ cidr is a string representing the IPBlock +Valid examples are "192.168.1.0/24" or "2001:db8::/64"
 true
except []string - except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
+ except is a slice of CIDRs that should not be included within an IPBlock +Valid examples are "192.168.1.0/24" or "2001:db8::/64" +Except values will be rejected if they are outside the cidr range
 false
@@ -2429,7 +2606,9 @@ namespaceSelector selects namespaces using cluster-scoped labels. This field fol @@ -2440,7 +2619,8 @@ namespaceSelector selects namespaces using cluster-scoped labels. This field fol -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -2462,14 +2642,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -2480,8 +2664,13 @@ A label selector requirement is a selector that contains values, a key, and an o -podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. - If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace. +podSelector is a label selector which selects pods. This field follows standard label +selector semantics; if present but empty, it selects all pods. + + +If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the Namespaces selected by NamespaceSelector. +Otherwise it selects the pods matching podSelector in the policy's own namespace.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -2503,7 +2692,9 @@ podSelector is a label selector which selects pods. This field follows standard @@ -2514,7 +2705,8 @@ podSelector is a label selector which selects pods. This field follows standard -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -2536,14 +2728,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -2554,7 +2750,8 @@ A label selector requirement is a selector that contains values, a key, and an o -NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. +NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods +matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -2569,14 +2766,22 @@ NetworkPolicyIngressRule describes a particular set of traffic that is allowed t @@ -2587,7 +2792,8 @@ NetworkPolicyIngressRule describes a particular set of traffic that is allowed t -NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed +NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of +fields are allowed
from []object - from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
+ from is a list of sources which should be able to access the pods selected for this rule. +Items in this list are combined using a logical OR operation. If this field is +empty or missing, this rule matches all sources (traffic not restricted by +source). If this field is present and contains at least one item, this rule +allows traffic only if the traffic matches at least one item in the from list.
 false
ports []object - ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+ ports is a list of ports which should be made accessible on the pods selected for +this rule. Each item in this list is combined using a logical OR. If this field is +empty or missing, this rule matches all ports (traffic not restricted by port). +If this field is present and contains at least one item, then this rule allows +traffic only if the traffic matches at least one port in the list.
 false
@@ -2602,23 +2808,34 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin @@ -2629,7 +2846,8 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin -ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be. +ipBlock defines policy on a particular IPBlock. If this field is set then +neither of the other fields can be.
ipBlock object - ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ ipBlock defines policy on a particular IPBlock. If this field is set then +neither of the other fields can be.
 false
namespaceSelector object - namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. - If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
+ namespaceSelector selects namespaces using cluster-scoped labels. This field follows +standard label selector semantics; if present but empty, it selects all namespaces. + + +If podSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the namespaces selected by namespaceSelector. +Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 false
podSelector object - podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. - If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
+ podSelector is a label selector which selects pods. This field follows standard label +selector semantics; if present but empty, it selects all pods. + + +If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the Namespaces selected by NamespaceSelector. +Otherwise it selects the pods matching podSelector in the policy's own namespace.
 false
@@ -2644,14 +2862,17 @@ ipBlock defines policy on a particular IPBlock. If this field is set then neithe @@ -2662,8 +2883,13 @@ ipBlock defines policy on a particular IPBlock. If this field is set then neithe -namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. - If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector. +namespaceSelector selects namespaces using cluster-scoped labels. This field follows +standard label selector semantics; if present but empty, it selects all namespaces. + + +If podSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the namespaces selected by namespaceSelector. +Otherwise it selects all pods in the namespaces selected by namespaceSelector.
cidr string - cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
+ cidr is a string representing the IPBlock +Valid examples are "192.168.1.0/24" or "2001:db8::/64"
 true
except []string - except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
+ except is a slice of CIDRs that should not be included within an IPBlock +Valid examples are "192.168.1.0/24" or "2001:db8::/64" +Except values will be rejected if they are outside the cidr range
 false
@@ -2685,7 +2911,9 @@ namespaceSelector selects namespaces using cluster-scoped labels. This field fol @@ -2696,7 +2924,8 @@ namespaceSelector selects namespaces using cluster-scoped labels. This field fol -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -2718,14 +2947,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -2736,8 +2969,13 @@ A label selector requirement is a selector that contains values, a key, and an o -podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. - If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace. +podSelector is a label selector which selects pods. This field follows standard label +selector semantics; if present but empty, it selects all pods. + + +If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the Namespaces selected by NamespaceSelector. +Otherwise it selects the pods matching podSelector in the policy's own namespace.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -2759,7 +2997,9 @@ podSelector is a label selector which selects pods. This field follows standard @@ -2770,7 +3010,8 @@ podSelector is a label selector which selects pods. This field follows standard -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -2792,14 +3033,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -2825,7 +3070,10 @@ NetworkPolicyPort describes a port to allow traffic on @@ -2834,14 +3082,18 @@ NetworkPolicyPort describes a port to allow traffic on @@ -2913,7 +3165,10 @@ Specifies additional labels and annotations the Capsule operator places on any P -Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. A default value can be specified, and all the Pod resources created will inherit the declared class. Optional. +Specifies the allowed priorityClasses assigned to the Tenant. +Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses. +A default value can be specified, and all the Pod resources created will inherit the declared class. +Optional.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
endPort integer - endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
+ endPort indicates that the range of ports from port to endPort if set, inclusive, +should be allowed by the policy. This field cannot be defined if the port field +is not defined or if the port field is defined as a named (string) port. +The endPort must be equal or greater than port.

Format: int32
port int or string - port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+ port represents the port on the given protocol. This can either be a numerical or named +port on a pod. If this field is not provided, this matches all port names and +numbers. +If present, only traffic on the specified protocol AND port will be matched.
 false
protocol string - protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+ protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. +If not specified, this field defaults to TCP.

Default: TCP
@@ -2956,7 +3211,9 @@ Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures th @@ -2967,7 +3224,8 @@ Specifies the allowed priorityClasses assigned to the Tenant. Capsule assures th -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -2989,14 +3247,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -3058,21 +3320,25 @@ ResourceQuotaSpec defines the desired hard limits to enforce for Quota. @@ -3083,7 +3349,9 @@ ResourceQuotaSpec defines the desired hard limits to enforce for Quota. -scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. +scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota +but expressed using ScopeSelectorOperator in combination with possible values. +For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
hard map[string]int or string - hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
+ hard is the set of desired hard limits for each named resource. +More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
 false
scopeSelector object - scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
+ scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota +but expressed using ScopeSelectorOperator in combination with possible values. +For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
 false
scopes []string - A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.
+ A collection of filters that must match each object tracked by a quota. +If not specified, the quota matches all objects.
 false
@@ -3109,7 +3377,8 @@ scopeSelector is also a collection of filters like scopes that must match each o -A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values. +A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator +that relates the scope name and values.
@@ -3124,7 +3393,8 @@ A scoped-resource selector requirement is a selector that contains values, a sco @@ -3138,7 +3408,10 @@ A scoped-resource selector requirement is a selector that contains values, a sco @@ -3149,7 +3422,9 @@ A scoped-resource selector requirement is a selector that contains values, a sco -Specifies the allowed RuntimeClasses assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. Optional. +Specifies the allowed RuntimeClasses assigned to the Tenant. +Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses. +Optional.
operator string - Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.
+ Represents a scope's relationship to a set of values. +Valid operators are In, NotIn, Exists, DoesNotExist.
 true
values []string - An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ An array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. +This array is replaced during a strategic merge patch.
 false
@@ -3185,7 +3460,9 @@ Specifies the allowed RuntimeClasses assigned to the Tenant. Capsule assures tha @@ -3196,7 +3473,8 @@ Specifies the allowed RuntimeClasses assigned to the Tenant. Capsule assures tha -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -3218,14 +3496,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -3461,7 +3743,10 @@ Define the labels that a Tenant Owner cannot set for their Service resources. -Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. Optional. +Specifies the allowed StorageClasses assigned to the Tenant. +Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses. +A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class. +Optional.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -3504,7 +3789,9 @@ Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures tha @@ -3515,7 +3802,8 @@ Specifies the allowed StorageClasses assigned to the Tenant. Capsule assures tha -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -3537,14 +3825,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -3879,7 +4171,8 @@ TenantSpec defines the desired state of Tenant. -Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names. +Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, +or a value for non-objects such as user and group names.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -3894,7 +4187,8 @@ Subject contains a reference to the object or user identities a role binding app @@ -3908,14 +4202,17 @@ Subject contains a reference to the object or user identities a role binding app @@ -3988,11 +4285,19 @@ Specifies options for the Ingress resources, such as allowed hostnames and Ingre @@ -4327,7 +4658,12 @@ NetworkPolicySpec provides the specification of a NetworkPolicy -podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace. +podSelector selects the pods to which this NetworkPolicy object applies. +The array of ingress rules is applied to any pods selected by this field. +Multiple network policies can select the same set of pods. In this case, +the ingress rules for each are combined additively. +This field is NOT optional and follows standard label selector semantics. +An empty podSelector matches all pods in this namespace.
kind string - Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+ Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". +If the Authorizer does not recognized the kind value, the Authorizer should report an error.
 true
apiGroup string - APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
+ APIGroup holds the API group of the referenced subject. +Defaults to "" for ServiceAccount subjects. +Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
 false
namespace string - Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.
+ Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty +the Authorizer should report an error.
 false
hostnameCollisionScope enum - Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. - - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. - - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. - - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. - Optional.
+ Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames. + + +- Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule. + + +- Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant. + + +- Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace. + + +Optional.

Enum: Cluster, Tenant, Namespace, Disabled
Default: Disabled
@@ -4295,28 +4600,54 @@ NetworkPolicySpec provides the specification of a NetworkPolicy 		podSelector object - podSelector selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
+ podSelector selects the pods to which this NetworkPolicy object applies. +The array of ingress rules is applied to any pods selected by this field. +Multiple network policies can select the same set of pods. In this case, +the ingress rules for each are combined additively. +This field is NOT optional and follows standard label selector semantics. +An empty podSelector matches all pods in this namespace.
 true
egress []object - egress is a list of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
+ egress is a list of egress rules to be applied to the selected pods. Outgoing traffic +is allowed if there are no NetworkPolicies selecting the pod (and cluster policy +otherwise allows the traffic), OR if the traffic matches at least one egress rule +across all of the NetworkPolicy objects whose podSelector matches the pod. If +this field is empty then this NetworkPolicy limits all outgoing traffic (and serves +solely to ensure that the pods it selects are isolated by default). +This field is beta-level in 1.8
 false
ingress []object - ingress is a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
+ ingress is a list of ingress rules to be applied to the selected pods. +Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod +(and cluster policy otherwise allows the traffic), OR if the traffic source is +the pod's local node, OR if the traffic matches at least one ingress rule +across all of the NetworkPolicy objects whose podSelector matches the pod. If +this field is empty then this NetworkPolicy does not allow any traffic (and serves +solely to ensure that the pods it selects are isolated by default)
 false
policyTypes []string - policyTypes is a list of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of ingress or egress rules; policies that contain an egress section are assumed to affect egress, and all policies (whether or not they contain an ingress section) are assumed to affect ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
+ policyTypes is a list of rule types that the NetworkPolicy relates to. +Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. +If this field is not specified, it will default based on the existence of ingress or egress rules; +policies that contain an egress section are assumed to affect egress, and all policies +(whether or not they contain an ingress section) are assumed to affect ingress. +If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. +Likewise, if you want to write a policy that specifies that no egress is allowed, +you must specify a policyTypes value that include "Egress" (since such a policy would not include +an egress section and would otherwise default to just [ "Ingress" ]). +This field is beta-level in 1.8
 false
@@ -4349,7 +4685,9 @@ podSelector selects the pods to which this NetworkPolicy object applies. The arr @@ -4360,7 +4698,8 @@ podSelector selects the pods to which this NetworkPolicy object applies. The arr -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -4382,14 +4721,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -4400,7 +4743,9 @@ A label selector requirement is a selector that contains values, a key, and an o -NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8 +NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods +matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. +This type is beta-level in 1.8
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -4415,14 +4760,22 @@ NetworkPolicyEgressRule describes a particular set of traffic that is allowed ou @@ -4448,7 +4801,10 @@ NetworkPolicyPort describes a port to allow traffic on @@ -4457,14 +4813,18 @@ NetworkPolicyPort describes a port to allow traffic on @@ -4477,7 +4837,8 @@ NetworkPolicyPort describes a port to allow traffic on -NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed +NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of +fields are allowed
ports []object - ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+ ports is a list of destination ports for outgoing traffic. +Each item in this list is combined using a logical OR. If this field is +empty or missing, this rule matches all ports (traffic not restricted by port). +If this field is present and contains at least one item, then this rule allows +traffic only if the traffic matches at least one port in the list.
 false
to []object - to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
+ to is a list of destinations for outgoing traffic of pods selected for this rule. +Items in this list are combined using a logical OR operation. If this field is +empty or missing, this rule matches all destinations (traffic not restricted by +destination). If this field is present and contains at least one item, this rule +allows traffic only if the traffic matches at least one item in the to list.
 false
endPort integer - endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
+ endPort indicates that the range of ports from port to endPort if set, inclusive, +should be allowed by the policy. This field cannot be defined if the port field +is not defined or if the port field is defined as a named (string) port. +The endPort must be equal or greater than port.

Format: int32
port int or string - port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+ port represents the port on the given protocol. This can either be a numerical or named +port on a pod. If this field is not provided, this matches all port names and +numbers. +If present, only traffic on the specified protocol AND port will be matched.
 false
protocol string - protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+ protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. +If not specified, this field defaults to TCP.

Default: TCP
@@ -4492,23 +4853,34 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin @@ -4519,7 +4891,8 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin -ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be. +ipBlock defines policy on a particular IPBlock. If this field is set then +neither of the other fields can be.
ipBlock object - ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ ipBlock defines policy on a particular IPBlock. If this field is set then +neither of the other fields can be.
 false
namespaceSelector object - namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. - If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
+ namespaceSelector selects namespaces using cluster-scoped labels. This field follows +standard label selector semantics; if present but empty, it selects all namespaces. + + +If podSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the namespaces selected by namespaceSelector. +Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 false
podSelector object - podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. - If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
+ podSelector is a label selector which selects pods. This field follows standard label +selector semantics; if present but empty, it selects all pods. + + +If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the Namespaces selected by NamespaceSelector. +Otherwise it selects the pods matching podSelector in the policy's own namespace.
 false
@@ -4534,14 +4907,17 @@ ipBlock defines policy on a particular IPBlock. If this field is set then neithe @@ -4552,8 +4928,13 @@ ipBlock defines policy on a particular IPBlock. If this field is set then neithe -namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. - If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector. +namespaceSelector selects namespaces using cluster-scoped labels. This field follows +standard label selector semantics; if present but empty, it selects all namespaces. + + +If podSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the namespaces selected by namespaceSelector. +Otherwise it selects all pods in the namespaces selected by namespaceSelector.
cidr string - cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
+ cidr is a string representing the IPBlock +Valid examples are "192.168.1.0/24" or "2001:db8::/64"
 true
except []string - except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
+ except is a slice of CIDRs that should not be included within an IPBlock +Valid examples are "192.168.1.0/24" or "2001:db8::/64" +Except values will be rejected if they are outside the cidr range
 false
@@ -4575,7 +4956,9 @@ namespaceSelector selects namespaces using cluster-scoped labels. This field fol @@ -4586,7 +4969,8 @@ namespaceSelector selects namespaces using cluster-scoped labels. This field fol -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -4608,14 +4992,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -4626,8 +5014,13 @@ A label selector requirement is a selector that contains values, a key, and an o -podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. - If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace. +podSelector is a label selector which selects pods. This field follows standard label +selector semantics; if present but empty, it selects all pods. + + +If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the Namespaces selected by NamespaceSelector. +Otherwise it selects the pods matching podSelector in the policy's own namespace.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -4649,7 +5042,9 @@ podSelector is a label selector which selects pods. This field follows standard @@ -4660,7 +5055,8 @@ podSelector is a label selector which selects pods. This field follows standard -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -4682,14 +5078,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -4700,7 +5100,8 @@ A label selector requirement is a selector that contains values, a key, and an o -NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. +NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods +matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -4715,14 +5116,22 @@ NetworkPolicyIngressRule describes a particular set of traffic that is allowed t @@ -4733,7 +5142,8 @@ NetworkPolicyIngressRule describes a particular set of traffic that is allowed t -NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed +NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of +fields are allowed
from []object - from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
+ from is a list of sources which should be able to access the pods selected for this rule. +Items in this list are combined using a logical OR operation. If this field is +empty or missing, this rule matches all sources (traffic not restricted by +source). If this field is present and contains at least one item, this rule +allows traffic only if the traffic matches at least one item in the from list.
 false
ports []object - ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
+ ports is a list of ports which should be made accessible on the pods selected for +this rule. Each item in this list is combined using a logical OR. If this field is +empty or missing, this rule matches all ports (traffic not restricted by port). +If this field is present and contains at least one item, then this rule allows +traffic only if the traffic matches at least one port in the list.
 false
@@ -4748,23 +5158,34 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin @@ -4775,7 +5196,8 @@ NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combin -ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be. +ipBlock defines policy on a particular IPBlock. If this field is set then +neither of the other fields can be.
ipBlock object - ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
+ ipBlock defines policy on a particular IPBlock. If this field is set then +neither of the other fields can be.
 false
namespaceSelector object - namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. - If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.
+ namespaceSelector selects namespaces using cluster-scoped labels. This field follows +standard label selector semantics; if present but empty, it selects all namespaces. + + +If podSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the namespaces selected by namespaceSelector. +Otherwise it selects all pods in the namespaces selected by namespaceSelector.
 false
podSelector object - podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. - If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.
+ podSelector is a label selector which selects pods. This field follows standard label +selector semantics; if present but empty, it selects all pods. + + +If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the Namespaces selected by NamespaceSelector. +Otherwise it selects the pods matching podSelector in the policy's own namespace.
 false
@@ -4790,14 +5212,17 @@ ipBlock defines policy on a particular IPBlock. If this field is set then neithe @@ -4808,8 +5233,13 @@ ipBlock defines policy on a particular IPBlock. If this field is set then neithe -namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. - If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector. +namespaceSelector selects namespaces using cluster-scoped labels. This field follows +standard label selector semantics; if present but empty, it selects all namespaces. + + +If podSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the namespaces selected by namespaceSelector. +Otherwise it selects all pods in the namespaces selected by namespaceSelector.
cidr string - cidr is a string representing the IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64"
+ cidr is a string representing the IPBlock +Valid examples are "192.168.1.0/24" or "2001:db8::/64"
 true
except []string - except is a slice of CIDRs that should not be included within an IPBlock Valid examples are "192.168.1.0/24" or "2001:db8::/64" Except values will be rejected if they are outside the cidr range
+ except is a slice of CIDRs that should not be included within an IPBlock +Valid examples are "192.168.1.0/24" or "2001:db8::/64" +Except values will be rejected if they are outside the cidr range
 false
@@ -4831,7 +5261,9 @@ namespaceSelector selects namespaces using cluster-scoped labels. This field fol @@ -4842,7 +5274,8 @@ namespaceSelector selects namespaces using cluster-scoped labels. This field fol -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -4864,14 +5297,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -4882,8 +5319,13 @@ A label selector requirement is a selector that contains values, a key, and an o -podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods. - If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace. +podSelector is a label selector which selects pods. This field follows standard label +selector semantics; if present but empty, it selects all pods. + + +If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects +the pods matching podSelector in the Namespaces selected by NamespaceSelector. +Otherwise it selects the pods matching podSelector in the policy's own namespace.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
@@ -4905,7 +5347,9 @@ podSelector is a label selector which selects pods. This field follows standard @@ -4916,7 +5360,8 @@ podSelector is a label selector which selects pods. This field follows standard -A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. +A label selector requirement is a selector that contains values, a key, and an operator that +relates the key and values.
matchLabels map[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels +map is equivalent to an element of matchExpressions, whose key field is "key", the +operator is "In", and the values array contains only "value". The requirements are ANDed.
 false
@@ -4938,14 +5383,18 @@ A label selector requirement is a selector that contains values, a key, and an o @@ -4971,7 +5420,10 @@ NetworkPolicyPort describes a port to allow traffic on @@ -4980,14 +5432,18 @@ NetworkPolicyPort describes a port to allow traffic on @@ -5084,21 +5540,25 @@ ResourceQuotaSpec defines the desired hard limits to enforce for Quota. @@ -5109,7 +5569,9 @@ ResourceQuotaSpec defines the desired hard limits to enforce for Quota. -scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched. +scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota +but expressed using ScopeSelectorOperator in combination with possible values. +For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
operator string - operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+ operator represents a key's relationship to a set of values. +Valid operators are In, NotIn, Exists and DoesNotExist.
 true
values []string - values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ values is an array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. This array is replaced during a strategic +merge patch.
 false
endPort integer - endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.
+ endPort indicates that the range of ports from port to endPort if set, inclusive, +should be allowed by the policy. This field cannot be defined if the port field +is not defined or if the port field is defined as a named (string) port. +The endPort must be equal or greater than port.

Format: int32
port int or string - port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
+ port represents the port on the given protocol. This can either be a numerical or named +port on a pod. If this field is not provided, this matches all port names and +numbers. +If present, only traffic on the specified protocol AND port will be matched.
 false
protocol string - protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
+ protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. +If not specified, this field defaults to TCP.

Default: TCP
hard map[string]int or string - hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
+ hard is the set of desired hard limits for each named resource. +More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
 false
scopeSelector object - scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
+ scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota +but expressed using ScopeSelectorOperator in combination with possible values. +For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
 false
scopes []string - A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.
+ A collection of filters that must match each object tracked by a quota. +If not specified, the quota matches all objects.
 false
@@ -5135,7 +5597,8 @@ scopeSelector is also a collection of filters like scopes that must match each o -A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values. +A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator +that relates the scope name and values.
@@ -5150,7 +5613,8 @@ A scoped-resource selector requirement is a selector that contains values, a sco @@ -5164,7 +5628,10 @@ A scoped-resource selector requirement is a selector that contains values, a sco diff --git a/go.mod b/go.mod index b2b91828..d3e29836 100644 --- a/go.mod +++ b/go.mod @@ -1,12 +1,13 @@ module github.com/projectcapsule/capsule -go 1.21 +go 1.22.0 + +toolchain go1.22.2 require ( github.com/go-logr/logr v1.4.1 - github.com/hashicorp/go-multierror v1.1.1 - github.com/onsi/ginkgo/v2 v2.17.1 - github.com/onsi/gomega v1.32.0 + github.com/onsi/ginkgo/v2 v2.17.2 + github.com/onsi/gomega v1.33.1 github.com/pkg/errors v0.9.1 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.9.0 @@ -14,28 +15,28 @@ require ( go.uber.org/automaxprocs v1.5.3 go.uber.org/zap v1.27.0 golang.org/x/sync v0.7.0 - k8s.io/api v0.29.3 - k8s.io/apiextensions-apiserver v0.29.3 - k8s.io/apimachinery v0.29.3 - k8s.io/client-go v0.29.3 - k8s.io/utils v0.0.0-20240102154912-e7106e64919e + k8s.io/api v0.30.0 + k8s.io/apiextensions-apiserver v0.30.0 + k8s.io/apimachinery v0.30.0 + k8s.io/client-go v0.30.0 + k8s.io/utils v0.0.0-20240423183400-0849a56e8f22 sigs.k8s.io/cluster-api v1.7.1 - sigs.k8s.io/controller-runtime v0.17.3 + sigs.k8s.io/controller-runtime v0.18.1 ) require ( github.com/beorn7/perks v1.0.1 // indirect github.com/blang/semver/v4 v4.0.0 // indirect - github.com/cespare/xxhash/v2 v2.2.0 // indirect + github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect - github.com/emicklei/go-restful/v3 v3.11.0 // indirect + github.com/emicklei/go-restful/v3 v3.12.0 // indirect github.com/evanphx/json-patch/v5 v5.9.0 // indirect github.com/fsnotify/fsnotify v1.7.0 // indirect github.com/go-logr/zapr v1.3.0 // indirect - github.com/go-openapi/jsonpointer v0.19.6 // indirect - github.com/go-openapi/jsonreference v0.20.2 // indirect - github.com/go-openapi/swag v0.22.3 // indirect - github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect + github.com/go-openapi/jsonpointer v0.21.0 // indirect + github.com/go-openapi/jsonreference v0.21.0 // indirect + github.com/go-openapi/swag v0.23.0 // indirect + github.com/go-task/slim-sprig/v3 v3.0.0 // indirect github.com/gobuffalo/flect v1.0.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect @@ -43,41 +44,37 @@ require ( github.com/google/gnostic-models v0.6.8 // indirect github.com/google/go-cmp v0.6.0 // indirect github.com/google/gofuzz v1.2.0 // indirect - github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect - github.com/google/uuid v1.4.0 // indirect - github.com/hashicorp/errwrap v1.0.0 // indirect - github.com/imdario/mergo v0.3.13 // indirect + github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 // indirect + github.com/google/uuid v1.6.0 // indirect + github.com/imdario/mergo v0.3.16 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/mailru/easyjson v0.7.7 // indirect - github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.2 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect - github.com/prometheus/client_golang v1.18.0 // indirect - github.com/prometheus/client_model v0.5.0 // indirect - github.com/prometheus/common v0.45.0 // indirect - github.com/prometheus/procfs v0.12.0 // indirect + github.com/prometheus/client_golang v1.19.0 // indirect + github.com/prometheus/client_model v0.6.1 // indirect + github.com/prometheus/common v0.53.0 // indirect + github.com/prometheus/procfs v0.14.0 // indirect github.com/valyala/bytebufferpool v1.0.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect - golang.org/x/net v0.23.0 // indirect - golang.org/x/oauth2 v0.18.0 // indirect - golang.org/x/sys v0.18.0 // indirect - golang.org/x/term v0.18.0 // indirect + golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f // indirect + golang.org/x/net v0.24.0 // indirect + golang.org/x/oauth2 v0.19.0 // indirect + golang.org/x/sys v0.19.0 // indirect + golang.org/x/term v0.19.0 // indirect golang.org/x/text v0.14.0 // indirect golang.org/x/time v0.5.0 // indirect - golang.org/x/tools v0.17.0 // indirect + golang.org/x/tools v0.20.0 // indirect gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect - google.golang.org/appengine v1.6.7 // indirect - google.golang.org/protobuf v1.33.0 // indirect + google.golang.org/protobuf v1.34.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - k8s.io/component-base v0.29.3 // indirect - k8s.io/klog/v2 v2.110.1 // indirect - k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect + k8s.io/klog/v2 v2.120.1 // indirect + k8s.io/kube-openapi v0.0.0-20240430033511-f0e62f92d13f // indirect sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect sigs.k8s.io/yaml v1.4.0 // indirect diff --git a/go.sum b/go.sum index d845df48..cc2ac043 100644 --- a/go.sum +++ b/go.sum @@ -14,54 +14,48 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= -github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44= -github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= -github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= -github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/coredns/caddy v1.1.0 h1:ezvsPrT/tA/7pYDBZxu0cT0VmWk75AfIaf6GSYCNMf0= github.com/coredns/caddy v1.1.0/go.mod h1:A6ntJQlAWuQfFlsd9hvigKbo2WS0VUs2l1e2F+BawD4= github.com/coredns/corefile-migration v1.0.21 h1:W/DCETrHDiFo0Wj03EyMkaQ9fwsmSgqTCQDHpceaSsE= github.com/coredns/corefile-migration v1.0.21/go.mod h1:XnhgULOEouimnzgn0t4WPuFDN2/PJQcTxdWKC5eXNGE= -github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0= github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g= -github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= +github.com/emicklei/go-restful/v3 v3.12.0 h1:y2DdzBAURM29NFF94q6RaY4vjIH1rtwDapwQtU84iWk= +github.com/emicklei/go-restful/v3 v3.12.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI= github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg= github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ= github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA= github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM= -github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ= github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg= -github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= -github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= -github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE= -github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= -github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g= -github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= -github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI= -github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls= +github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ= +github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY= +github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ= +github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4= +github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE= +github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ= +github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= +github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= github.com/gobuffalo/flect v1.0.2 h1:eqjPGSo2WmjgY2XlpGwo2NXgL3RucAKo4k4qQMNA5sA= github.com/gobuffalo/flect v1.0.2/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE= github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= -github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= -github.com/google/cel-go v0.17.7 h1:6ebJFzu1xO2n7TLtN+UBqShGBhlD85bhvglh5DpcfqQ= -github.com/google/cel-go v0.17.7/go.mod h1:HXZKzB0LXqer5lHHgfWAnlYwJaQBDKMjxjulNQzhwhY= +github.com/google/cel-go v0.17.8 h1:j9m730pMZt1Fc4oKhCLUHfjj6527LuhYcYw0Rl8gqto= +github.com/google/cel-go v0.17.8/go.mod h1:HXZKzB0LXqer5lHHgfWAnlYwJaQBDKMjxjulNQzhwhY= github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= @@ -70,36 +64,26 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec= -github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= -github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4= -github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA= -github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= -github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= -github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= +github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 h1:k7nVchz72niMH6YLQNvHSdIE7iqsQxK1P41mySCvssg= +github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4= github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= -github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= -github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk= -github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg= +github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4= +github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= -github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= -github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= -github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg= -github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k= github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw= github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s= github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ= @@ -111,10 +95,10 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/onsi/ginkgo/v2 v2.17.1 h1:V++EzdbhI4ZV4ev0UTIj0PzhzOcReJFyJaLjtSF55M8= -github.com/onsi/ginkgo/v2 v2.17.1/go.mod h1:llBI3WDLL9Z6taip6f33H76YcWtJv+7R3HigUjbIBOs= -github.com/onsi/gomega v1.32.0 h1:JRYU78fJ1LPxlckP6Txi/EYqJvjtMrDC04/MM5XRHPk= -github.com/onsi/gomega v1.32.0/go.mod h1:a4x4gW6Pz2yK1MAmvluYme5lvYTn61afQ2ETw/8n4Lg= +github.com/onsi/ginkgo/v2 v2.17.2 h1:7eMhcy3GimbsA3hEnVKdw/PQM9XN9krpKVXsZdph0/g= +github.com/onsi/ginkgo/v2 v2.17.2/go.mod h1:nP2DPOQoNsQmsVyv5rDA8JkXQoCs6goXIvr/PRJ1eCc= +github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk= +github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= @@ -123,16 +107,16 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g= github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U= -github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk= -github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA= -github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw= -github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI= -github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM= -github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY= -github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo= -github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo= -github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= -github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog= +github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU= +github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k= +github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E= +github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY= +github.com/prometheus/common v0.53.0 h1:U2pL9w9nmJwJDa4qqLQ3ZaePJ6ZTwt7cMD3AG3+aLCE= +github.com/prometheus/common v0.53.0/go.mod h1:BrxBKv3FWBIGXw89Mg1AeBq7FSyRzXWI3l3e7W3RN5U= +github.com/prometheus/procfs v0.14.0 h1:Lw4VdGGoKEZilJsayHf0B+9YgLGREba2C6xr+Fdfq6s= +github.com/prometheus/procfs v0.14.0/go.mod h1:XL+Iwz8k8ZabyZfMFHPiilCniixqQarAy5Mu67pHlNQ= +github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M= +github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA= github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8= github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o= github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0= @@ -145,7 +129,6 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= -github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= @@ -168,21 +151,20 @@ go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA= -golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs= -golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g= -golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k= +golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30= +golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M= +golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f h1:99ci1mjWVBWwJiEKYY6jWa4d2nTQVIEhZIptnrVb1XY= +golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f/go.mod h1:/lliqkxwWAhPjf5oSOIJup2XcqJaw8RGS6k3TGEc7GI= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs= -golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= -golang.org/x/oauth2 v0.18.0 h1:09qnuIAgzdx1XplqJvW6CQqMCtGZykZWcXzPMPUusvI= -golang.org/x/oauth2 v0.18.0/go.mod h1:Wf7knwG0MPoWIMMBgFlEaSUDaKskp0dCfrlJRJXbBi8= +golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w= +golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8= +golang.org/x/oauth2 v0.19.0 h1:9+E/EZBCbTLNrbN35fHv/a/d/mOBatymz1zbtQrXpIg= +golang.org/x/oauth2 v0.19.0/go.mod h1:vYi7skDa1x015PmRRYZ7+s1cWyPgrPiSYRe4rnsexc8= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -190,14 +172,12 @@ golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4= -golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8= -golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58= +golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o= +golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q= +golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= @@ -207,23 +187,21 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc= -golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps= +golang.org/x/tools v0.20.0 h1:hz/CVckiOxybQvFw6h7b/q80NTr9IUQb4s1IIzW7KNY= +golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw= gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY= -google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= -google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ= google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 h1:JpwMPBpFN3uKhdaekDpiNlImDdkUAyiJ6ez/uxGaUSo= google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4= google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f h1:ultW7fxlIvee4HYrtnaRPon9HpEgFk5zYpmfMgtKB5I= google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f/go.mod h1:L9KNLi232K1/xB6f7AlSX692koaRnKaWSR0stBki0Yc= -google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI= -google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= +google.golang.org/protobuf v1.34.0 h1:Qo/qEd2RZPCf2nKuorzksSknv0d3ERwp1vFG38gSmH4= +google.golang.org/protobuf v1.34.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= @@ -233,33 +211,32 @@ gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -k8s.io/api v0.29.3 h1:2ORfZ7+bGC3YJqGpV0KSDDEVf8hdGQ6A03/50vj8pmw= -k8s.io/api v0.29.3/go.mod h1:y2yg2NTyHUUkIoTC+phinTnEa3KFM6RZ3szxt014a80= -k8s.io/apiextensions-apiserver v0.29.3 h1:9HF+EtZaVpFjStakF4yVufnXGPRppWFEQ87qnO91YeI= -k8s.io/apiextensions-apiserver v0.29.3/go.mod h1:po0XiY5scnpJfFizNGo6puNU6Fq6D70UJY2Cb2KwAVc= -k8s.io/apimachinery v0.29.3 h1:2tbx+5L7RNvqJjn7RIuIKu9XTsIZ9Z5wX2G22XAa5EU= -k8s.io/apimachinery v0.29.3/go.mod h1:hx/S4V2PNW4OMg3WizRrHutyB5la0iCUbZym+W0EQIU= -k8s.io/apiserver v0.29.3 h1:xR7ELlJ/BZSr2n4CnD3lfA4gzFivh0wwfNfz9L0WZcE= -k8s.io/apiserver v0.29.3/go.mod h1:hrvXlwfRulbMbBgmWRQlFru2b/JySDpmzvQwwk4GUOs= -k8s.io/client-go v0.29.3 h1:R/zaZbEAxqComZ9FHeQwOh3Y1ZUs7FaHKZdQtIc2WZg= -k8s.io/client-go v0.29.3/go.mod h1:tkDisCvgPfiRpxGnOORfkljmS+UrW+WtXAy2fTvXJB0= +k8s.io/api v0.30.0 h1:siWhRq7cNjy2iHssOB9SCGNCl2spiF1dO3dABqZ8niA= +k8s.io/api v0.30.0/go.mod h1:OPlaYhoHs8EQ1ql0R/TsUgaRPhpKNxIMrKQfWUp8QSE= +k8s.io/apiextensions-apiserver v0.30.0 h1:jcZFKMqnICJfRxTgnC4E+Hpcq8UEhT8B2lhBcQ+6uAs= +k8s.io/apiextensions-apiserver v0.30.0/go.mod h1:N9ogQFGcrbWqAY9p2mUAL5mGxsLqwgtUce127VtRX5Y= +k8s.io/apimachinery v0.30.0 h1:qxVPsyDM5XS96NIh9Oj6LavoVFYff/Pon9cZeDIkHHA= +k8s.io/apimachinery v0.30.0/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc= +k8s.io/apiserver v0.30.0 h1:QCec+U72tMQ+9tR6A0sMBB5Vh6ImCEkoKkTDRABWq6M= +k8s.io/apiserver v0.30.0/go.mod h1:smOIBq8t0MbKZi7O7SyIpjPsiKJ8qa+llcFCluKyqiY= +k8s.io/client-go v0.30.0 h1:sB1AGGlhY/o7KCyCEQ0bPWzYDL0pwOZO4vAtTSh/gJQ= +k8s.io/client-go v0.30.0/go.mod h1:g7li5O5256qe6TYdAMyX/otJqMhIiGgTapdLchhmOaY= k8s.io/cluster-bootstrap v0.29.3 h1:DIMDZSN8gbFMy9CS2mAS2Iqq/fIUG783WN/1lqi5TF8= k8s.io/cluster-bootstrap v0.29.3/go.mod h1:aPAg1VtXx3uRrx5qU2jTzR7p1rf18zLXWS+pGhiqPto= -k8s.io/component-base v0.29.3 h1:Oq9/nddUxlnrCuuR2K/jp6aflVvc0uDvxMzAWxnGzAo= -k8s.io/component-base v0.29.3/go.mod h1:Yuj33XXjuOk2BAaHsIGHhCKZQAgYKhqIxIjIr2UXYio= -k8s.io/klog/v2 v2.110.1 h1:U/Af64HJf7FcwMcXyKm2RPM22WZzyR7OSpYj5tg3cL0= -k8s.io/klog/v2 v2.110.1/go.mod h1:YGtd1984u+GgbuZ7e08/yBuAfKLSO0+uR1Fhi6ExXjo= -k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780= -k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA= -k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ= -k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +k8s.io/component-base v0.30.0 h1:cj6bp38g0ainlfYtaOQuRELh5KSYjhKxM+io7AUIk4o= +k8s.io/component-base v0.30.0/go.mod h1:V9x/0ePFNaKeKYA3bOvIbrNoluTSG+fSJKjLdjOoeXQ= +k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw= +k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= +k8s.io/kube-openapi v0.0.0-20240430033511-f0e62f92d13f h1:0LQagt0gDpKqvIkAMPaRGcXawNMouPECM1+F9BVxEaM= +k8s.io/kube-openapi v0.0.0-20240430033511-f0e62f92d13f/go.mod h1:S9tOR0FxgyusSNR+MboCuiDpVWkAifZvaYI1Q2ubgro= +k8s.io/utils v0.0.0-20240423183400-0849a56e8f22 h1:ao5hUqGhsqdm+bYbjH/pRkCs0unBGe9UyDahzs9zQzQ= +k8s.io/utils v0.0.0-20240423183400-0849a56e8f22/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= sigs.k8s.io/cluster-api v1.7.1 h1:JkMAbAMzBM+WBHxXLTJXTiCisv1PAaHRzld/3qrmLYY= sigs.k8s.io/cluster-api v1.7.1/go.mod h1:V9ZhKLvQtsDODwjXOKgbitjyCmC71yMBwDcMyNNIov0= -sigs.k8s.io/controller-runtime v0.17.3 h1:65QmN7r3FWgTxDMz9fvGnO1kbf2nu+acg9p2R9oYYYk= -sigs.k8s.io/controller-runtime v0.17.3/go.mod h1:N0jpP5Lo7lMTF9aL56Z/B2oWBJjey6StQM0jRbKQXtY= +sigs.k8s.io/controller-runtime v0.18.1 h1:RpWbigmuiylbxOCLy0tGnq1cU1qWPwNIQzoJk+QeJx4= +sigs.k8s.io/controller-runtime v0.18.1/go.mod h1:tuAt1+wbVsXIT8lPtk5RURxqAnq7xkpv2Mhttslg7Hw= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4= diff --git a/pkg/api/zz_generated.deepcopy.go b/pkg/api/zz_generated.deepcopy.go index 41d1c96d..e3ac0fb2 100644 --- a/pkg/api/zz_generated.deepcopy.go +++ b/pkg/api/zz_generated.deepcopy.go @@ -1,5 +1,4 @@ //go:build !ignore_autogenerated -// +build !ignore_autogenerated // Copyright 2020-2023 Project Capsule Authors. // SPDX-License-Identifier: Apache-2.0 diff --git a/pkg/webhook/defaults/handler.go b/pkg/webhook/defaults/handler.go index b0c10384..9cf33933 100644 --- a/pkg/webhook/defaults/handler.go +++ b/pkg/webhook/defaults/handler.go @@ -28,25 +28,25 @@ func Handler(cfg configuration.Configuration, version *version.Version) capsulew } } -func (h *handler) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *handler) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.mutate(ctx, req, client, decoder, recorder) } } -func (h *handler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *handler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *handler) OnUpdate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *handler) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.mutate(ctx, req, client, decoder, recorder) } } -func (h *handler) mutate(ctx context.Context, req admission.Request, c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) *admission.Response { +func (h *handler) mutate(ctx context.Context, req admission.Request, c client.Client, decoder admission.Decoder, recorder record.EventRecorder) *admission.Response { var response *admission.Response switch { diff --git a/pkg/webhook/defaults/ingress.go b/pkg/webhook/defaults/ingress.go index 2edc9d61..9f1c74cc 100644 --- a/pkg/webhook/defaults/ingress.go +++ b/pkg/webhook/defaults/ingress.go @@ -20,7 +20,7 @@ import ( "github.com/projectcapsule/capsule/pkg/webhook/utils" ) -func mutateIngressDefaults(ctx context.Context, req admission.Request, version *version.Version, c client.Client, decoder *admission.Decoder, recorder record.EventRecorder, namespace string) *admission.Response { +func mutateIngressDefaults(ctx context.Context, req admission.Request, version *version.Version, c client.Client, decoder admission.Decoder, recorder record.EventRecorder, namespace string) *admission.Response { ingress, err := capsuleingress.FromRequest(req, decoder) if err != nil { return utils.ErroredResponse(err) diff --git a/pkg/webhook/defaults/pods.go b/pkg/webhook/defaults/pods.go index 5690aa95..bd21f51a 100644 --- a/pkg/webhook/defaults/pods.go +++ b/pkg/webhook/defaults/pods.go @@ -18,7 +18,7 @@ import ( "github.com/projectcapsule/capsule/pkg/webhook/utils" ) -func mutatePodDefaults(ctx context.Context, req admission.Request, c client.Client, decoder *admission.Decoder, recorder record.EventRecorder, namespace string) *admission.Response { +func mutatePodDefaults(ctx context.Context, req admission.Request, c client.Client, decoder admission.Decoder, recorder record.EventRecorder, namespace string) *admission.Response { var err error pod := &corev1.Pod{} diff --git a/pkg/webhook/defaults/storage.go b/pkg/webhook/defaults/storage.go index 9f9b9ebf..e7da3d1f 100644 --- a/pkg/webhook/defaults/storage.go +++ b/pkg/webhook/defaults/storage.go @@ -18,7 +18,7 @@ import ( "github.com/projectcapsule/capsule/pkg/webhook/utils" ) -func mutatePVCDefaults(ctx context.Context, req admission.Request, c client.Client, decoder *admission.Decoder, recorder record.EventRecorder, namespace string) *admission.Response { +func mutatePVCDefaults(ctx context.Context, req admission.Request, c client.Client, decoder admission.Decoder, recorder record.EventRecorder, namespace string) *admission.Response { var err error pvc := &corev1.PersistentVolumeClaim{} diff --git a/pkg/webhook/handler.go b/pkg/webhook/handler.go index a80122f0..689b3682 100644 --- a/pkg/webhook/handler.go +++ b/pkg/webhook/handler.go @@ -14,7 +14,7 @@ import ( type Func func(ctx context.Context, req admission.Request) *admission.Response type Handler interface { - OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) Func - OnDelete(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) Func - OnUpdate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) Func + OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) Func + OnDelete(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) Func + OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) Func } diff --git a/pkg/webhook/ingress/utils.go b/pkg/webhook/ingress/utils.go index 52eb301c..dc475916 100644 --- a/pkg/webhook/ingress/utils.go +++ b/pkg/webhook/ingress/utils.go @@ -32,7 +32,7 @@ func TenantFromIngress(ctx context.Context, c client.Client, ingress Ingress) (* return &tenantList.Items[0], nil } -func FromRequest(req admission.Request, decoder *admission.Decoder) (ingress Ingress, err error) { +func FromRequest(req admission.Request, decoder admission.Decoder) (ingress Ingress, err error) { switch req.Kind.Group { case "networking.k8s.io": if req.Kind.Version == "v1" { diff --git a/pkg/webhook/ingress/validate_class.go b/pkg/webhook/ingress/validate_class.go index 009979ce..84206f43 100644 --- a/pkg/webhook/ingress/validate_class.go +++ b/pkg/webhook/ingress/validate_class.go @@ -32,25 +32,25 @@ func Class(configuration configuration.Configuration, version *version.Version) } } -func (r *class) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *class) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return r.validate(ctx, r.version, client, req, decoder, recorder) } } -func (r *class) OnUpdate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *class) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return r.validate(ctx, r.version, client, req, decoder, recorder) } } -func (r *class) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *class) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *class) validate(ctx context.Context, version *version.Version, client client.Client, req admission.Request, decoder *admission.Decoder, recorder record.EventRecorder) *admission.Response { +func (r *class) validate(ctx context.Context, version *version.Version, client client.Client, req admission.Request, decoder admission.Decoder, recorder record.EventRecorder) *admission.Response { ingress, err := FromRequest(req, decoder) if err != nil { return utils.ErroredResponse(err) diff --git a/pkg/webhook/ingress/validate_collision.go b/pkg/webhook/ingress/validate_collision.go index 7f74d342..897a7a48 100644 --- a/pkg/webhook/ingress/validate_collision.go +++ b/pkg/webhook/ingress/validate_collision.go @@ -34,25 +34,25 @@ func Collision(configuration configuration.Configuration) capsulewebhook.Handler return &collision{configuration: configuration} } -func (r *collision) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *collision) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return r.validate(ctx, client, req, decoder, recorder) } } -func (r *collision) OnUpdate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *collision) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return r.validate(ctx, client, req, decoder, recorder) } } -func (r *collision) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *collision) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *collision) validate(ctx context.Context, client client.Client, req admission.Request, decoder *admission.Decoder, recorder record.EventRecorder) *admission.Response { +func (r *collision) validate(ctx context.Context, client client.Client, req admission.Request, decoder admission.Decoder, recorder record.EventRecorder) *admission.Response { ing, err := FromRequest(req, decoder) if err != nil { return utils.ErroredResponse(err) diff --git a/pkg/webhook/ingress/validate_hostnames.go b/pkg/webhook/ingress/validate_hostnames.go index b79a5da3..5a75bb47 100644 --- a/pkg/webhook/ingress/validate_hostnames.go +++ b/pkg/webhook/ingress/validate_hostnames.go @@ -28,25 +28,25 @@ func Hostnames(configuration configuration.Configuration) capsulewebhook.Handler return &hostnames{configuration: configuration} } -func (r *hostnames) OnCreate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *hostnames) OnCreate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return r.validate(ctx, c, req, decoder, recorder) } } -func (r *hostnames) OnUpdate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *hostnames) OnUpdate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return r.validate(ctx, c, req, decoder, recorder) } } -func (r *hostnames) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *hostnames) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *hostnames) validate(ctx context.Context, client client.Client, req admission.Request, decoder *admission.Decoder, recorder record.EventRecorder) *admission.Response { +func (r *hostnames) validate(ctx context.Context, client client.Client, req admission.Request, decoder admission.Decoder, recorder record.EventRecorder) *admission.Response { ingress, err := FromRequest(req, decoder) if err != nil { return utils.ErroredResponse(err) diff --git a/pkg/webhook/ingress/validate_wildcard.go b/pkg/webhook/ingress/validate_wildcard.go index 205ef0f3..33ed4296 100644 --- a/pkg/webhook/ingress/validate_wildcard.go +++ b/pkg/webhook/ingress/validate_wildcard.go @@ -25,25 +25,25 @@ func Wildcard() capsulewebhook.Handler { return &wildcard{} } -func (h *wildcard) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *wildcard) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.validate(ctx, client, req, recorder, decoder) } } -func (h *wildcard) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *wildcard) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *wildcard) OnUpdate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *wildcard) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.validate(ctx, client, req, recorder, decoder) } } -func (h *wildcard) validate(ctx context.Context, clt client.Client, req admission.Request, recorder record.EventRecorder, decoder *admission.Decoder) *admission.Response { +func (h *wildcard) validate(ctx context.Context, clt client.Client, req admission.Request, recorder record.EventRecorder, decoder admission.Decoder) *admission.Response { tntList := &capsulev1beta2.TenantList{} if err := clt.List(ctx, tntList, client.MatchingFieldsSelector{ diff --git a/pkg/webhook/namespace/freezed.go b/pkg/webhook/namespace/freezed.go index d892056c..1f488a6d 100644 --- a/pkg/webhook/namespace/freezed.go +++ b/pkg/webhook/namespace/freezed.go @@ -27,7 +27,7 @@ func FreezeHandler(configuration configuration.Configuration) capsulewebhook.Han return &freezedHandler{configuration: configuration} } -func (r *freezedHandler) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *freezedHandler) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { ns := &corev1.Namespace{} if err := decoder.Decode(req, ns); err != nil { @@ -58,7 +58,7 @@ func (r *freezedHandler) OnCreate(client client.Client, decoder *admission.Decod } } -func (r *freezedHandler) OnDelete(c client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *freezedHandler) OnDelete(c client.Client, _ admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { tntList := &capsulev1beta2.TenantList{} if err := c.List(ctx, tntList, client.MatchingFieldsSelector{ @@ -85,7 +85,7 @@ func (r *freezedHandler) OnDelete(c client.Client, _ *admission.Decoder, recorde } } -func (r *freezedHandler) OnUpdate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *freezedHandler) OnUpdate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { ns := &corev1.Namespace{} if err := decoder.Decode(req, ns); err != nil { diff --git a/pkg/webhook/namespace/patch.go b/pkg/webhook/namespace/patch.go index f435e87a..2fa3fffb 100644 --- a/pkg/webhook/namespace/patch.go +++ b/pkg/webhook/namespace/patch.go @@ -26,19 +26,19 @@ func PatchHandler() capsulewebhook.Handler { return &patchHandler{} } -func (r *patchHandler) OnCreate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *patchHandler) OnCreate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *patchHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *patchHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *patchHandler) OnUpdate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *patchHandler) OnUpdate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { // Decode Namespace ns := &corev1.Namespace{} diff --git a/pkg/webhook/namespace/prefix.go b/pkg/webhook/namespace/prefix.go index 45aa4123..f4e53111 100644 --- a/pkg/webhook/namespace/prefix.go +++ b/pkg/webhook/namespace/prefix.go @@ -30,7 +30,7 @@ func PrefixHandler(configuration configuration.Configuration) capsulewebhook.Han } } -func (r *prefixHandler) OnCreate(clt client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *prefixHandler) OnCreate(clt client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { ns := &corev1.Namespace{} if err := decoder.Decode(req, ns); err != nil { @@ -72,13 +72,13 @@ func (r *prefixHandler) OnCreate(clt client.Client, decoder *admission.Decoder, } } -func (r *prefixHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *prefixHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *prefixHandler) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *prefixHandler) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/namespace/quota.go b/pkg/webhook/namespace/quota.go index 1200bbda..49b0a1a5 100644 --- a/pkg/webhook/namespace/quota.go +++ b/pkg/webhook/namespace/quota.go @@ -23,7 +23,7 @@ func QuotaHandler() capsulewebhook.Handler { return "aHandler{} } -func (r *quotaHandler) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *quotaHandler) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { ns := &corev1.Namespace{} if err := decoder.Decode(req, ns); err != nil { @@ -62,13 +62,13 @@ func (r *quotaHandler) OnCreate(client client.Client, decoder *admission.Decoder } } -func (r *quotaHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *quotaHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *quotaHandler) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *quotaHandler) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/namespace/user_metadata.go b/pkg/webhook/namespace/user_metadata.go index e60fd02d..b7627bac 100644 --- a/pkg/webhook/namespace/user_metadata.go +++ b/pkg/webhook/namespace/user_metadata.go @@ -25,7 +25,7 @@ func UserMetadataHandler() capsulewebhook.Handler { return &userMetadataHandler{} } -func (r *userMetadataHandler) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *userMetadataHandler) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { ns := &corev1.Namespace{} if err := decoder.Decode(req, ns); err != nil { @@ -69,13 +69,13 @@ func (r *userMetadataHandler) OnCreate(client client.Client, decoder *admission. } } -func (r *userMetadataHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *userMetadataHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *userMetadataHandler) OnUpdate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *userMetadataHandler) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { oldNs := &corev1.Namespace{} if err := decoder.DecodeRaw(req.OldObject, oldNs); err != nil { diff --git a/pkg/webhook/networkpolicy/validating.go b/pkg/webhook/networkpolicy/validating.go index 76e2ae50..7504304e 100644 --- a/pkg/webhook/networkpolicy/validating.go +++ b/pkg/webhook/networkpolicy/validating.go @@ -25,13 +25,13 @@ func Handler() capsulewebhook.Handler { return &handler{} } -func (r *handler) OnCreate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *handler) OnCreate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *handler) generic(ctx context.Context, req admission.Request, client client.Client, _ *admission.Decoder) (*capsulev1beta2.Tenant, error) { +func (r *handler) generic(ctx context.Context, req admission.Request, client client.Client, _ admission.Decoder) (*capsulev1beta2.Tenant, error) { var err error np := &networkingv1.NetworkPolicy{} @@ -54,7 +54,7 @@ func (r *handler) generic(ctx context.Context, req admission.Request, client cli } //nolint:dupl -func (r *handler) OnDelete(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *handler) OnDelete(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { tnt, err := r.generic(ctx, req, client, decoder) if err != nil { @@ -74,7 +74,7 @@ func (r *handler) OnDelete(client client.Client, decoder *admission.Decoder, rec } //nolint:dupl -func (r *handler) OnUpdate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { tnt, err := r.generic(ctx, req, client, decoder) if err != nil { diff --git a/pkg/webhook/node/user_metadata.go b/pkg/webhook/node/user_metadata.go index eb48befe..04e28f53 100644 --- a/pkg/webhook/node/user_metadata.go +++ b/pkg/webhook/node/user_metadata.go @@ -30,13 +30,13 @@ func UserMetadataHandler(configuration configuration.Configuration, ver *version } } -func (r *userMetadataHandler) OnCreate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *userMetadataHandler) OnCreate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *userMetadataHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *userMetadataHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } @@ -78,7 +78,7 @@ func (r *userMetadataHandler) getForbiddenNodeAnnotations(node *corev1.Node) map return forbiddenNodeAnnotations } -func (r *userMetadataHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *userMetadataHandler) OnUpdate(_ client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { nodeWebhookSupported, _ := utils.NodeWebhookSupported(r.version) diff --git a/pkg/webhook/ownerreference/patching.go b/pkg/webhook/ownerreference/patching.go index 451c92c3..60469e71 100644 --- a/pkg/webhook/ownerreference/patching.go +++ b/pkg/webhook/ownerreference/patching.go @@ -36,19 +36,19 @@ func Handler(cfg configuration.Configuration) capsulewebhook.Handler { } } -func (h *handler) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *handler) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.setOwnerRef(ctx, req, client, decoder, recorder) } } -func (h *handler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *handler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *handler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *handler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { oldNs := &corev1.Namespace{} if err := decoder.DecodeRaw(req.OldObject, oldNs); err != nil { @@ -86,7 +86,7 @@ func (h *handler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record } } -func (h *handler) setOwnerRef(ctx context.Context, req admission.Request, client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) *admission.Response { +func (h *handler) setOwnerRef(ctx context.Context, req admission.Request, client client.Client, decoder admission.Decoder, recorder record.EventRecorder) *admission.Response { ns := &corev1.Namespace{} if err := decoder.Decode(req, ns); err != nil { response := admission.Errored(http.StatusBadRequest, err) diff --git a/pkg/webhook/pod/containerregistry.go b/pkg/webhook/pod/containerregistry.go index 1909571b..f8ebf1f8 100644 --- a/pkg/webhook/pod/containerregistry.go +++ b/pkg/webhook/pod/containerregistry.go @@ -23,26 +23,26 @@ func ContainerRegistry() capsulewebhook.Handler { return &containerRegistryHandler{} } -func (h *containerRegistryHandler) OnCreate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *containerRegistryHandler) OnCreate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.validate(ctx, c, decoder, recorder, req) } } -func (h *containerRegistryHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *containerRegistryHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } // ust be validate on update events since updates to pods on spec.containers[*].image and spec.initContainers[*].image are allowed. -func (h *containerRegistryHandler) OnUpdate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *containerRegistryHandler) OnUpdate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.validate(ctx, c, decoder, recorder, req) } } -func (h *containerRegistryHandler) validate(ctx context.Context, c client.Client, decoder *admission.Decoder, recorder record.EventRecorder, req admission.Request) *admission.Response { +func (h *containerRegistryHandler) validate(ctx context.Context, c client.Client, decoder admission.Decoder, recorder record.EventRecorder, req admission.Request) *admission.Response { pod := &corev1.Pod{} if err := decoder.Decode(req, pod); err != nil { return utils.ErroredResponse(err) diff --git a/pkg/webhook/pod/imagepullpolicy.go b/pkg/webhook/pod/imagepullpolicy.go index 1f1c2191..7d7600d6 100644 --- a/pkg/webhook/pod/imagepullpolicy.go +++ b/pkg/webhook/pod/imagepullpolicy.go @@ -23,7 +23,7 @@ func ImagePullPolicy() capsulewebhook.Handler { return &imagePullPolicy{} } -func (r *imagePullPolicy) OnCreate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *imagePullPolicy) OnCreate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { pod := &corev1.Pod{} if err := decoder.Decode(req, pod); err != nil { @@ -65,13 +65,13 @@ func (r *imagePullPolicy) OnCreate(c client.Client, decoder *admission.Decoder, } } -func (r *imagePullPolicy) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *imagePullPolicy) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (r *imagePullPolicy) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *imagePullPolicy) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/pod/priorityclass.go b/pkg/webhook/pod/priorityclass.go index c38628c7..6b306a02 100644 --- a/pkg/webhook/pod/priorityclass.go +++ b/pkg/webhook/pod/priorityclass.go @@ -22,7 +22,7 @@ func PriorityClass() capsulewebhook.Handler { return &priorityClass{} } -func (h *priorityClass) OnCreate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *priorityClass) OnCreate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { pod := &corev1.Pod{} if err := decoder.Decode(req, pod); err != nil { @@ -84,13 +84,13 @@ func (h *priorityClass) OnCreate(c client.Client, decoder *admission.Decoder, re } } -func (h *priorityClass) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *priorityClass) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *priorityClass) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *priorityClass) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/pod/runtimeclass.go b/pkg/webhook/pod/runtimeclass.go index e2603bc1..37b9cab1 100644 --- a/pkg/webhook/pod/runtimeclass.go +++ b/pkg/webhook/pod/runtimeclass.go @@ -37,25 +37,25 @@ func (h *runtimeClass) class(ctx context.Context, c client.Client, name string) return obj, nil } -func (h *runtimeClass) OnCreate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *runtimeClass) OnCreate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.validate(ctx, c, decoder, recorder, req) } } -func (h *runtimeClass) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *runtimeClass) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *runtimeClass) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *runtimeClass) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *runtimeClass) validate(ctx context.Context, c client.Client, decoder *admission.Decoder, recorder record.EventRecorder, req admission.Request) *admission.Response { +func (h *runtimeClass) validate(ctx context.Context, c client.Client, decoder admission.Decoder, recorder record.EventRecorder, req admission.Request) *admission.Response { pod := &corev1.Pod{} if err := decoder.Decode(req, pod); err != nil { return utils.ErroredResponse(err) diff --git a/pkg/webhook/pvc/pv.go b/pkg/webhook/pvc/pv.go index 8973bb67..faad2984 100644 --- a/pkg/webhook/pvc/pv.go +++ b/pkg/webhook/pvc/pv.go @@ -34,7 +34,7 @@ func PersistentVolumeReuse() capsulewebhook.Handler { } } -func (p PV) OnCreate(client client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (p PV) OnCreate(client client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { pvc := corev1.PersistentVolumeClaim{} if err := decoder.Decode(req, &pvc); err != nil { @@ -85,13 +85,13 @@ func (p PV) OnCreate(client client.Client, decoder *admission.Decoder, _ record. } } -func (p PV) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (p PV) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (p PV) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (p PV) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/pvc/validating.go b/pkg/webhook/pvc/validating.go index d94d4a41..ccbb5119 100644 --- a/pkg/webhook/pvc/validating.go +++ b/pkg/webhook/pvc/validating.go @@ -23,7 +23,7 @@ func Validating() capsulewebhook.Handler { return &validating{} } -func (h *validating) OnCreate(c client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *validating) OnCreate(c client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { pvc := &corev1.PersistentVolumeClaim{} if err := decoder.Decode(req, pvc); err != nil { @@ -87,13 +87,13 @@ func (h *validating) OnCreate(c client.Client, decoder *admission.Decoder, recor } } -func (h *validating) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *validating) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *validating) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *validating) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/router.go b/pkg/webhook/router.go index 3e419a4f..b722173b 100644 --- a/pkg/webhook/router.go +++ b/pkg/webhook/router.go @@ -35,7 +35,7 @@ func Register(manager controllerruntime.Manager, webhookList ...Webhook) error { type handlerRouter struct { client client.Client - decoder *admission.Decoder + decoder admission.Decoder recorder record.EventRecorder handlers []Handler diff --git a/pkg/webhook/service/validating.go b/pkg/webhook/service/validating.go index 43c1aa1a..a0aba3db 100644 --- a/pkg/webhook/service/validating.go +++ b/pkg/webhook/service/validating.go @@ -27,7 +27,7 @@ func Handler() capsulewebhook.Handler { return &handler{} } -func (r *handler) handleService(ctx context.Context, clt client.Client, decoder *admission.Decoder, req admission.Request, recorder record.EventRecorder) *admission.Response { +func (r *handler) handleService(ctx context.Context, clt client.Client, decoder admission.Decoder, req admission.Request, recorder record.EventRecorder) *admission.Response { svc := &corev1.Service{} if err := decoder.Decode(req, svc); err != nil { return utils.ErroredResponse(err) @@ -125,19 +125,19 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder return nil } -func (r *handler) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *handler) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return r.handleService(ctx, client, decoder, req, recorder) } } -func (r *handler) OnUpdate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *handler) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return r.handleService(ctx, client, decoder, req, recorder) } } -func (r *handler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *handler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/tenant/containerregistry_regex.go b/pkg/webhook/tenant/containerregistry_regex.go index 86f673f7..e6e09128 100644 --- a/pkg/webhook/tenant/containerregistry_regex.go +++ b/pkg/webhook/tenant/containerregistry_regex.go @@ -23,7 +23,7 @@ func ContainerRegistryRegexHandler() capsulewebhook.Handler { return &containerRegistryRegexHandler{} } -func (h *containerRegistryRegexHandler) validate(decoder *admission.Decoder, req admission.Request) *admission.Response { +func (h *containerRegistryRegexHandler) validate(decoder admission.Decoder, req admission.Request) *admission.Response { tenant := &capsulev1beta2.Tenant{} if err := decoder.Decode(req, tenant); err != nil { return utils.ErroredResponse(err) @@ -40,7 +40,7 @@ func (h *containerRegistryRegexHandler) validate(decoder *admission.Decoder, req return nil } -func (h *containerRegistryRegexHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *containerRegistryRegexHandler) OnCreate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if err := h.validate(decoder, req); err != nil { return err @@ -50,13 +50,13 @@ func (h *containerRegistryRegexHandler) OnCreate(_ client.Client, decoder *admis } } -func (h *containerRegistryRegexHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *containerRegistryRegexHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *containerRegistryRegexHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *containerRegistryRegexHandler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if response := h.validate(decoder, req); response != nil { return response diff --git a/pkg/webhook/tenant/cordoning.go b/pkg/webhook/tenant/cordoning.go index 678af9c7..6172b941 100644 --- a/pkg/webhook/tenant/cordoning.go +++ b/pkg/webhook/tenant/cordoning.go @@ -55,19 +55,19 @@ func (h *cordoningHandler) cordonHandler(ctx context.Context, clt client.Client, return nil } -func (h *cordoningHandler) OnCreate(client client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *cordoningHandler) OnCreate(client client.Client, _ admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.cordonHandler(ctx, client, req, recorder) } } -func (h *cordoningHandler) OnDelete(client client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *cordoningHandler) OnDelete(client client.Client, _ admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.cordonHandler(ctx, client, req, recorder) } } -func (h *cordoningHandler) OnUpdate(client client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *cordoningHandler) OnUpdate(client client.Client, _ admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.cordonHandler(ctx, client, req, recorder) } diff --git a/pkg/webhook/tenant/custom_resource_quota.go b/pkg/webhook/tenant/custom_resource_quota.go index 7ebeb14f..6bc1cfe6 100644 --- a/pkg/webhook/tenant/custom_resource_quota.go +++ b/pkg/webhook/tenant/custom_resource_quota.go @@ -47,7 +47,7 @@ func (r *resourceCounterHandler) getTenantName(ctx context.Context, clt client.C return tntList.Items[0].GetName(), nil } -func (r *resourceCounterHandler) OnCreate(clt client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (r *resourceCounterHandler) OnCreate(clt client.Client, _ admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { var tntName string @@ -101,7 +101,7 @@ func (r *resourceCounterHandler) OnCreate(clt client.Client, _ *admission.Decode } } -func (r *resourceCounterHandler) OnDelete(clt client.Client, _ *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (r *resourceCounterHandler) OnDelete(clt client.Client, _ admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { var tntName string @@ -145,7 +145,7 @@ func (r *resourceCounterHandler) OnDelete(clt client.Client, _ *admission.Decode } } -func (r *resourceCounterHandler) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (r *resourceCounterHandler) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/tenant/forbidden_annotations_regex.go b/pkg/webhook/tenant/forbidden_annotations_regex.go index 2cb88798..67ceae4d 100644 --- a/pkg/webhook/tenant/forbidden_annotations_regex.go +++ b/pkg/webhook/tenant/forbidden_annotations_regex.go @@ -23,7 +23,7 @@ func ForbiddenAnnotationsRegexHandler() capsulewebhook.Handler { return &forbiddenAnnotationsRegexHandler{} } -func (h *forbiddenAnnotationsRegexHandler) validate(decoder *admission.Decoder, req admission.Request) *admission.Response { +func (h *forbiddenAnnotationsRegexHandler) validate(decoder admission.Decoder, req admission.Request) *admission.Response { tenant := &capsulev1beta2.Tenant{} if err := decoder.Decode(req, tenant); err != nil { return utils.ErroredResponse(err) @@ -49,7 +49,7 @@ func (h *forbiddenAnnotationsRegexHandler) validate(decoder *admission.Decoder, return nil } -func (h *forbiddenAnnotationsRegexHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *forbiddenAnnotationsRegexHandler) OnCreate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if err := h.validate(decoder, req); err != nil { return err @@ -59,13 +59,13 @@ func (h *forbiddenAnnotationsRegexHandler) OnCreate(_ client.Client, decoder *ad } } -func (h *forbiddenAnnotationsRegexHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *forbiddenAnnotationsRegexHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *forbiddenAnnotationsRegexHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *forbiddenAnnotationsRegexHandler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if response := h.validate(decoder, req); response != nil { return response diff --git a/pkg/webhook/tenant/freezed_emitter.go b/pkg/webhook/tenant/freezed_emitter.go index 8e5fc476..8f6d06a8 100644 --- a/pkg/webhook/tenant/freezed_emitter.go +++ b/pkg/webhook/tenant/freezed_emitter.go @@ -22,19 +22,19 @@ func FreezedEmitter() capsulewebhook.Handler { return &freezedEmitterHandler{} } -func (h *freezedEmitterHandler) OnCreate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *freezedEmitterHandler) OnCreate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *freezedEmitterHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *freezedEmitterHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *freezedEmitterHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *freezedEmitterHandler) OnUpdate(_ client.Client, decoder admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { oldTnt := &capsulev1beta2.Tenant{} if err := decoder.DecodeRaw(req.OldObject, oldTnt); err != nil { diff --git a/pkg/webhook/tenant/hostname_regex.go b/pkg/webhook/tenant/hostname_regex.go index 1c0587ad..86e1affc 100644 --- a/pkg/webhook/tenant/hostname_regex.go +++ b/pkg/webhook/tenant/hostname_regex.go @@ -23,7 +23,7 @@ func HostnameRegexHandler() capsulewebhook.Handler { return &hostnameRegexHandler{} } -func (h *hostnameRegexHandler) validate(decoder *admission.Decoder, req admission.Request) *admission.Response { +func (h *hostnameRegexHandler) validate(decoder admission.Decoder, req admission.Request) *admission.Response { tenant := &capsulev1beta2.Tenant{} if err := decoder.Decode(req, tenant); err != nil { return utils.ErroredResponse(err) @@ -40,7 +40,7 @@ func (h *hostnameRegexHandler) validate(decoder *admission.Decoder, req admissio return nil } -func (h *hostnameRegexHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *hostnameRegexHandler) OnCreate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if response := h.validate(decoder, req); response != nil { return response @@ -50,13 +50,13 @@ func (h *hostnameRegexHandler) OnCreate(_ client.Client, decoder *admission.Deco } } -func (h *hostnameRegexHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *hostnameRegexHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *hostnameRegexHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *hostnameRegexHandler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if err := h.validate(decoder, req); err != nil { return err diff --git a/pkg/webhook/tenant/ingressclass_regex.go b/pkg/webhook/tenant/ingressclass_regex.go index 4bd4ff21..c56d7d3c 100644 --- a/pkg/webhook/tenant/ingressclass_regex.go +++ b/pkg/webhook/tenant/ingressclass_regex.go @@ -23,7 +23,7 @@ func IngressClassRegexHandler() capsulewebhook.Handler { return &ingressClassRegexHandler{} } -func (h *ingressClassRegexHandler) validate(decoder *admission.Decoder, req admission.Request) *admission.Response { +func (h *ingressClassRegexHandler) validate(decoder admission.Decoder, req admission.Request) *admission.Response { tenant := &capsulev1beta2.Tenant{} if err := decoder.Decode(req, tenant); err != nil { return utils.ErroredResponse(err) @@ -40,7 +40,7 @@ func (h *ingressClassRegexHandler) validate(decoder *admission.Decoder, req admi return nil } -func (h *ingressClassRegexHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *ingressClassRegexHandler) OnCreate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if response := h.validate(decoder, req); response != nil { return response @@ -50,13 +50,13 @@ func (h *ingressClassRegexHandler) OnCreate(_ client.Client, decoder *admission. } } -func (h *ingressClassRegexHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *ingressClassRegexHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *ingressClassRegexHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *ingressClassRegexHandler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if err := h.validate(decoder, req); err != nil { return err diff --git a/pkg/webhook/tenant/metadata.go b/pkg/webhook/tenant/metadata.go index 6d43af3e..6a1fe762 100644 --- a/pkg/webhook/tenant/metadata.go +++ b/pkg/webhook/tenant/metadata.go @@ -23,19 +23,19 @@ func MetaHandler() capsulewebhook.Handler { return &metaHandler{} } -func (h *metaHandler) OnCreate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *metaHandler) OnCreate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *metaHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *metaHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *metaHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *metaHandler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { tenant := &capsulev1beta2.Tenant{} if err := decoder.Decode(req, tenant); err != nil { diff --git a/pkg/webhook/tenant/name.go b/pkg/webhook/tenant/name.go index c35443a9..0bf4b52f 100644 --- a/pkg/webhook/tenant/name.go +++ b/pkg/webhook/tenant/name.go @@ -22,7 +22,7 @@ func NameHandler() capsulewebhook.Handler { return &nameHandler{} } -func (h *nameHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *nameHandler) OnCreate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { tenant := &capsulev1beta2.Tenant{} if err := decoder.Decode(req, tenant); err != nil { @@ -40,13 +40,13 @@ func (h *nameHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ re } } -func (h *nameHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *nameHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *nameHandler) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *nameHandler) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/tenant/protected.go b/pkg/webhook/tenant/protected.go index 95f42d47..7f51cbef 100644 --- a/pkg/webhook/tenant/protected.go +++ b/pkg/webhook/tenant/protected.go @@ -22,13 +22,13 @@ func ProtectedHandler() capsulewebhook.Handler { return &protectedHandler{} } -func (h *protectedHandler) OnCreate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *protectedHandler) OnCreate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *protectedHandler) OnDelete(clt client.Client, _ *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *protectedHandler) OnDelete(clt client.Client, _ admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { tenant := &capsulev1beta2.Tenant{} @@ -46,7 +46,7 @@ func (h *protectedHandler) OnDelete(clt client.Client, _ *admission.Decoder, _ r } } -func (h *protectedHandler) OnUpdate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *protectedHandler) OnUpdate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } diff --git a/pkg/webhook/tenant/rolebindings_regex.go b/pkg/webhook/tenant/rolebindings_regex.go index a9510b8a..b005d639 100644 --- a/pkg/webhook/tenant/rolebindings_regex.go +++ b/pkg/webhook/tenant/rolebindings_regex.go @@ -25,7 +25,7 @@ func RoleBindingRegexHandler() capsulewebhook.Handler { return &rbRegexHandler{} } -func (h *rbRegexHandler) validate(req admission.Request, decoder *admission.Decoder) *admission.Response { +func (h *rbRegexHandler) validate(req admission.Request, decoder admission.Decoder) *admission.Response { tenant := &capsulev1beta2.Tenant{} if err := decoder.Decode(req, tenant); err != nil { return utils.ErroredResponse(err) @@ -49,19 +49,19 @@ func (h *rbRegexHandler) validate(req admission.Request, decoder *admission.Deco return nil } -func (h *rbRegexHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *rbRegexHandler) OnCreate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { return h.validate(req, decoder) } } -func (h *rbRegexHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *rbRegexHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *rbRegexHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *rbRegexHandler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { return h.validate(req, decoder) } diff --git a/pkg/webhook/tenant/serviceaccount_format.go b/pkg/webhook/tenant/serviceaccount_format.go index b5cd5151..a657ae6d 100644 --- a/pkg/webhook/tenant/serviceaccount_format.go +++ b/pkg/webhook/tenant/serviceaccount_format.go @@ -23,7 +23,7 @@ func ServiceAccountNameHandler() capsulewebhook.Handler { return &saNameHandler{} } -func (h *saNameHandler) validateServiceAccountName(req admission.Request, decoder *admission.Decoder) *admission.Response { +func (h *saNameHandler) validateServiceAccountName(req admission.Request, decoder admission.Decoder) *admission.Response { tenant := &capsulev1beta2.Tenant{} if err := decoder.Decode(req, tenant); err != nil { return utils.ErroredResponse(err) @@ -46,19 +46,19 @@ func (h *saNameHandler) validateServiceAccountName(req admission.Request, decode return nil } -func (h *saNameHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *saNameHandler) OnCreate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { return h.validateServiceAccountName(req, decoder) } } -func (h *saNameHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *saNameHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *saNameHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *saNameHandler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { return h.validateServiceAccountName(req, decoder) } diff --git a/pkg/webhook/tenant/storageclass_regex.go b/pkg/webhook/tenant/storageclass_regex.go index 958facfc..d7fd7c49 100644 --- a/pkg/webhook/tenant/storageclass_regex.go +++ b/pkg/webhook/tenant/storageclass_regex.go @@ -23,7 +23,7 @@ func StorageClassRegexHandler() capsulewebhook.Handler { return &storageClassRegexHandler{} } -func (h *storageClassRegexHandler) validate(decoder *admission.Decoder, req admission.Request) *admission.Response { +func (h *storageClassRegexHandler) validate(decoder admission.Decoder, req admission.Request) *admission.Response { tenant := &capsulev1beta2.Tenant{} if err := decoder.Decode(req, tenant); err != nil { return utils.ErroredResponse(err) @@ -40,7 +40,7 @@ func (h *storageClassRegexHandler) validate(decoder *admission.Decoder, req admi return nil } -func (h *storageClassRegexHandler) OnCreate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *storageClassRegexHandler) OnCreate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if err := h.validate(decoder, req); err != nil { return err @@ -50,13 +50,13 @@ func (h *storageClassRegexHandler) OnCreate(_ client.Client, decoder *admission. } } -func (h *storageClassRegexHandler) OnDelete(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *storageClassRegexHandler) OnDelete(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *storageClassRegexHandler) OnUpdate(_ client.Client, decoder *admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { +func (h *storageClassRegexHandler) OnUpdate(_ client.Client, decoder admission.Decoder, _ record.EventRecorder) capsulewebhook.Func { return func(_ context.Context, req admission.Request) *admission.Response { if err := h.validate(decoder, req); err != nil { return err diff --git a/pkg/webhook/tenantresource/objects.go b/pkg/webhook/tenantresource/objects.go index 10f769ef..710a6c59 100644 --- a/pkg/webhook/tenantresource/objects.go +++ b/pkg/webhook/tenantresource/objects.go @@ -70,19 +70,19 @@ func (h *cordoningHandler) handler(ctx context.Context, clt client.Client, req a return nil } -func (h *cordoningHandler) OnCreate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { +func (h *cordoningHandler) OnCreate(client.Client, admission.Decoder, record.EventRecorder) capsulewebhook.Func { return func(context.Context, admission.Request) *admission.Response { return nil } } -func (h *cordoningHandler) OnDelete(client client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *cordoningHandler) OnDelete(client client.Client, _ admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.handler(ctx, client, req, recorder) } } -func (h *cordoningHandler) OnUpdate(client client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { +func (h *cordoningHandler) OnUpdate(client client.Client, _ admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { return h.handler(ctx, client, req, recorder) } diff --git a/pkg/webhook/utils/in_capsule_groups.go b/pkg/webhook/utils/in_capsule_groups.go index 842dbe9c..b1422e9a 100644 --- a/pkg/webhook/utils/in_capsule_groups.go +++ b/pkg/webhook/utils/in_capsule_groups.go @@ -26,7 +26,7 @@ type handler struct { handlers []webhook.Handler } -func (h *handler) OnCreate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) webhook.Func { +func (h *handler) OnCreate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) webhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { if !IsCapsuleUser(ctx, req, client, h.configuration.UserGroups()) { return nil @@ -42,7 +42,7 @@ func (h *handler) OnCreate(client client.Client, decoder *admission.Decoder, rec } } -func (h *handler) OnDelete(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) webhook.Func { +func (h *handler) OnDelete(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) webhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { if !IsCapsuleUser(ctx, req, client, h.configuration.UserGroups()) { return nil @@ -58,7 +58,7 @@ func (h *handler) OnDelete(client client.Client, decoder *admission.Decoder, rec } } -func (h *handler) OnUpdate(client client.Client, decoder *admission.Decoder, recorder record.EventRecorder) webhook.Func { +func (h *handler) OnUpdate(client client.Client, decoder admission.Decoder, recorder record.EventRecorder) webhook.Func { return func(ctx context.Context, req admission.Request) *admission.Response { if !IsCapsuleUser(ctx, req, client, h.configuration.UserGroups()) { return nil
operator string - Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.
+ Represents a scope's relationship to a set of values. +Valid operators are In, NotIn, Exists, DoesNotExist.
 true
values []string - An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
+ An array of string values. If the operator is In or NotIn, +the values array must be non-empty. If the operator is Exists or DoesNotExist, +the values array must be empty. +This array is replaced during a strategic merge patch.
 false