From 3aa49cf1fdec25343738b90327269504ea5f0b6a Mon Sep 17 00:00:00 2001 From: Daniel Smith Date: Sat, 11 Nov 2017 18:00:32 -0800 Subject: [PATCH 1/2] fix docs and validation Kubernetes-commit: e73fd8784484235d5010f4b2bba2251a584c5dd0 --- admissionregistration/v1alpha1/types.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/admissionregistration/v1alpha1/types.go b/admissionregistration/v1alpha1/types.go index 60f579651b..43770b3027 100644 --- a/admissionregistration/v1alpha1/types.go +++ b/admissionregistration/v1alpha1/types.go @@ -288,12 +288,16 @@ type WebhookClientConfig struct { // webhook. Such installs are likely to be non-portable, i.e., not easy // to turn up in a new cluster. // - // If the scheme is present, it must be "https://". + // The scheme must be "https"; the URL must begin with "https://". // // A path is optional, and if present may be any string permissible in // a URL. You may use the path to pass an arbitrary string to the // webhook, for example, a cluster identifier. // + // Attempting to use a user or basic auth e.g. "user:password@" is not + // allowed. Fragments ("#...") and query parameters ("?...") are not + // allowed, either. + // // +optional URL *string `json:"url,omitempty" protobuf:"bytes,3,opt,name=url"` From 97a9693c67e844b4e9d7133e8f6c431e0509ea2d Mon Sep 17 00:00:00 2001 From: Daniel Smith Date: Sat, 11 Nov 2017 18:23:17 -0800 Subject: [PATCH 2/2] generated Kubernetes-commit: a6b8a87b65442ccee253ac97d54cdbef594db0b9 --- admissionregistration/v1alpha1/generated.proto | 6 +++++- .../v1alpha1/types_swagger_doc_generated.go | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/admissionregistration/v1alpha1/generated.proto b/admissionregistration/v1alpha1/generated.proto index f450cb4c02..d4b7aa9ae9 100644 --- a/admissionregistration/v1alpha1/generated.proto +++ b/admissionregistration/v1alpha1/generated.proto @@ -274,12 +274,16 @@ message WebhookClientConfig { // webhook. Such installs are likely to be non-portable, i.e., not easy // to turn up in a new cluster. // - // If the scheme is present, it must be "https://". + // The scheme must be "https"; the URL must begin with "https://". // // A path is optional, and if present may be any string permissible in // a URL. You may use the path to pass an arbitrary string to the // webhook, for example, a cluster identifier. // + // Attempting to use a user or basic auth e.g. "user:password@" is not + // allowed. Fragments ("#...") and query parameters ("?...") are not + // allowed, either. + // // +optional optional string url = 3; diff --git a/admissionregistration/v1alpha1/types_swagger_doc_generated.go b/admissionregistration/v1alpha1/types_swagger_doc_generated.go index b8bafeb0bc..6f8defa996 100644 --- a/admissionregistration/v1alpha1/types_swagger_doc_generated.go +++ b/admissionregistration/v1alpha1/types_swagger_doc_generated.go @@ -143,7 +143,7 @@ func (Webhook) SwaggerDoc() map[string]string { var map_WebhookClientConfig = map[string]string{ "": "WebhookClientConfig contains the information to make a TLS connection with the webhook", - "url": "`url` gives the location of the webhook, in standard URL form (`[scheme://]host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nIf the scheme is present, it must be \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.", + "url": "`url` gives the location of the webhook, in standard URL form (`[scheme://]host:port/path`). Exactly one of `url` or `service` must be specified.\n\nThe `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.\n\nPlease note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.\n\nThe scheme must be \"https\"; the URL must begin with \"https://\".\n\nA path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.\n\nAttempting to use a user or basic auth e.g. \"user:password@\" is not allowed. Fragments (\"#...\") and query parameters (\"?...\") are not allowed, either.", "service": "`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`.\n\nIf there is only one port open for the service, that port will be used. If there are multiple ports open, port 443 will be used if it is open, otherwise it is an error.", "caBundle": "`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. Required.", }