whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prepare for v1.21 + indentation + local common definitions

Browse Source
This commit is contained in:
Philippe Martin
2021-02-07 16:11:02 +01:00
parent eb5a204dc9
commit f7943d8048
73 changed files with 5316 additions and 5126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1.md
+45 -45
View File
@@ -50,48 +50,48 @@ ValidatingWebhookConfiguration describes the configuration of and admission webh
<a name="WebhookClientConfig"></a>
*WebhookClientConfig contains the information to make a TLS connection with the webhook*
- **webhooks.clientConfig.caBundle** ([]byte)
- **webhooks.clientConfig.caBundle** ([]byte)
`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. If unspecified, system trust roots on the apiserver are used.
`caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. If unspecified, system trust roots on the apiserver are used.
- **webhooks.clientConfig.service** (ServiceReference)
- **webhooks.clientConfig.service** (ServiceReference)
`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.
If the webhook is running within the cluster, then you should use `service`.
`service` is a reference to the service for this webhook. Either `service` or `url` must be specified.
If the webhook is running within the cluster, then you should use `service`.
<a name="ServiceReference"></a>
*ServiceReference holds a reference to Service.legacy.k8s.io*
<a name="ServiceReference"></a>
*ServiceReference holds a reference to Service.legacy.k8s.io*
- **webhooks.clientConfig.service.name** (string), required
- **webhooks.clientConfig.service.name** (string), required
`name` is the name of the service. Required
`name` is the name of the service. Required
- **webhooks.clientConfig.service.namespace** (string), required
- **webhooks.clientConfig.service.namespace** (string), required
`namespace` is the namespace of the service. Required
`namespace` is the namespace of the service. Required
- **webhooks.clientConfig.service.path** (string)
- **webhooks.clientConfig.service.path** (string)
`path` is an optional URL path which will be sent in any request to this service.
`path` is an optional URL path which will be sent in any request to this service.
- **webhooks.clientConfig.service.port** (int32)
- **webhooks.clientConfig.service.port** (int32)
If specified, the port on the service that hosting webhook. Default to 443 for backward compatibility. `port` should be a valid port number (1-65535, inclusive).
If specified, the port on the service that hosting webhook. Default to 443 for backward compatibility. `port` should be a valid port number (1-65535, inclusive).
- **webhooks.clientConfig.url** (string)
- **webhooks.clientConfig.url** (string)
`url` gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified.
The `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.
Please note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installations are likely to be non-portable or not readily run in a new cluster.
The scheme must be "https"; the URL must begin with "https://".
A path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.
Attempting to use a user or basic auth e.g. "user:password@" is not allowed. Fragments ("#...") and query parameters ("?...") are not allowed, either.
`url` gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified.
The `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address.
Please note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.
The scheme must be "https"; the URL must begin with "https://".
A path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.
Attempting to use a user or basic auth e.g. "user:password@" is not allowed. Fragments ("#...") and query parameters ("?...") are not allowed, either.
- **webhooks.name** (string), required
@@ -99,7 +99,7 @@ ValidatingWebhookConfiguration describes the configuration of and admission webh
- **webhooks.sideEffects** (string), required
SideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission change and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.
SideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.
- **webhooks.failurePolicy** (string)
@@ -160,31 +160,31 @@ ValidatingWebhookConfiguration describes the configuration of and admission webh
<a name="RuleWithOperations"></a>
*RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.*
- **webhooks.rules.apiGroups** ([]string)
- **webhooks.rules.apiGroups** ([]string)
APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required.
APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required.
- **webhooks.rules.apiVersions** ([]string)
- **webhooks.rules.apiVersions** ([]string)
APIVersions is the API versions the resources belong to. '*' is all versions. If '*' is present, the length of the slice must be one. Required.
APIVersions is the API versions the resources belong to. '*' is all versions. If '*' is present, the length of the slice must be one. Required.
- **webhooks.rules.operations** ([]string)
- **webhooks.rules.operations** ([]string)
Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
- **webhooks.rules.resources** ([]string)
- **webhooks.rules.resources** ([]string)
Resources is a list of resources this rule applies to.
For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '*' means all resources, but not subresources. 'pods/*' means all subresources of pods. '*/scale' means all scale subresources. '*/*' means all resources and their subresources.
If wildcard is present, the validation rule will ensure resources do not overlap with each other.
Depending on the enclosing object, subresources might not be allowed. Required.
Resources is a list of resources this rule applies to.
For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '*' means all resources, but not subresources. 'pods/*' means all subresources of pods. '*/scale' means all scale subresources. '*/*' means all resources and their subresources.
If wildcard is present, the validation rule will ensure resources do not overlap with each other.
Depending on the enclosing object, subresources might not be allowed. Required.
- **webhooks.rules.scope** (string)
- **webhooks.rules.scope** (string)
scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "*" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "*" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "*" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "*" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
- **webhooks.timeoutSeconds** (int32)