657 lines
19 KiB
Markdown
657 lines
19 KiB
Markdown
---
|
|
title: kube-apiserver Configuration (v1)
|
|
content_type: tool-reference
|
|
package: apiserver.config.k8s.io/v1
|
|
auto_generated: true
|
|
---
|
|
<p>Package v1 is the v1 version of the API.</p>
|
|
|
|
|
|
## Resource Types
|
|
|
|
|
|
- [AdmissionConfiguration](#apiserver-config-k8s-io-v1-AdmissionConfiguration)
|
|
- [AuthorizationConfiguration](#apiserver-config-k8s-io-v1-AuthorizationConfiguration)
|
|
- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration)
|
|
|
|
|
|
## `AdmissionConfiguration` {#apiserver-config-k8s-io-v1-AdmissionConfiguration}
|
|
|
|
|
|
|
|
<p>AdmissionConfiguration provides versioned configuration for admission controllers.</p>
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr>
|
|
<tr><td><code>kind</code><br/>string</td><td><code>AdmissionConfiguration</code></td></tr>
|
|
|
|
|
|
<tr><td><code>plugins</code><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-AdmissionPluginConfiguration"><code>[]AdmissionPluginConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>Plugins allows specifying a configuration per admission control plugin.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `AuthorizationConfiguration` {#apiserver-config-k8s-io-v1-AuthorizationConfiguration}
|
|
|
|
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr>
|
|
<tr><td><code>kind</code><br/>string</td><td><code>AuthorizationConfiguration</code></td></tr>
|
|
|
|
|
|
<tr><td><code>authorizers</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-AuthorizerConfiguration"><code>[]AuthorizerConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>Authorizers is an ordered list of authorizers to
|
|
authorize requests against.
|
|
This is similar to the --authorization-modes kube-apiserver flag
|
|
Must be at least one.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `EncryptionConfiguration` {#apiserver-config-k8s-io-v1-EncryptionConfiguration}
|
|
|
|
|
|
|
|
<p>EncryptionConfiguration stores the complete configuration for encryption providers.
|
|
It also allows the use of wildcards to specify the resources that should be encrypted.
|
|
Use '<em>.<!-- raw HTML omitted -->' to encrypt all resources within a group or '</em>.<em>' to encrypt all resources.
|
|
'</em>.' can be used to encrypt all resource in the core group. '<em>.</em>' will encrypt all
|
|
resources, even custom resources that are added after API server start.
|
|
Use of wildcards that overlap within the same resource list or across multiple
|
|
entries are not allowed since part of the configuration would be ineffective.
|
|
Resource lists are processed in order, with earlier lists taking precedence.</p>
|
|
<p>Example:</p>
|
|
<pre><code>kind: EncryptionConfiguration
|
|
apiVersion: apiserver.config.k8s.io/v1
|
|
resources:
|
|
- resources:
|
|
- events
|
|
providers:
|
|
- identity: {} # do not encrypt events even though *.* is specified below
|
|
- resources:
|
|
- secrets
|
|
- configmaps
|
|
- pandas.awesome.bears.example
|
|
providers:
|
|
- aescbc:
|
|
keys:
|
|
- name: key1
|
|
secret: c2VjcmV0IGlzIHNlY3VyZQ==
|
|
- resources:
|
|
- '*.apps'
|
|
providers:
|
|
- aescbc:
|
|
keys:
|
|
- name: key2
|
|
secret: c2VjcmV0IGlzIHNlY3VyZSwgb3IgaXMgaXQ/Cg==
|
|
- resources:
|
|
- '*.*'
|
|
providers:
|
|
- aescbc:
|
|
keys:
|
|
- name: key3
|
|
secret: c2VjcmV0IGlzIHNlY3VyZSwgSSB0aGluaw==
|
|
</code></pre>
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr>
|
|
<tr><td><code>kind</code><br/>string</td><td><code>EncryptionConfiguration</code></td></tr>
|
|
|
|
|
|
<tr><td><code>resources</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-ResourceConfiguration"><code>[]ResourceConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>resources is a list containing resources, and their corresponding encryption providers.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `AESConfiguration` {#apiserver-config-k8s-io-v1-AESConfiguration}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
|
|
|
|
|
|
<p>AESConfiguration contains the API configuration for an AES transformer.</p>
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>keys</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-Key"><code>[]Key</code></a>
|
|
</td>
|
|
<td>
|
|
<p>keys is a list of keys to be used for creating the AES transformer.
|
|
Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `AdmissionPluginConfiguration` {#apiserver-config-k8s-io-v1-AdmissionPluginConfiguration}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [AdmissionConfiguration](#apiserver-config-k8s-io-v1-AdmissionConfiguration)
|
|
|
|
|
|
<p>AdmissionPluginConfiguration provides the configuration for a single plug-in.</p>
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>name</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>Name is the name of the admission controller.
|
|
It must match the registered admission plugin name.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>path</code><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>Path is the path to a configuration file that contains the plugin's
|
|
configuration</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>configuration</code><br/>
|
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/runtime#Unknown"><code>k8s.io/apimachinery/pkg/runtime.Unknown</code></a>
|
|
</td>
|
|
<td>
|
|
<p>Configuration is an embedded configuration object to be used as the plugin's
|
|
configuration. If present, it will be used instead of the path to the configuration file.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `AuthorizerConfiguration` {#apiserver-config-k8s-io-v1-AuthorizerConfiguration}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [AuthorizationConfiguration](#apiserver-config-k8s-io-v1-AuthorizationConfiguration)
|
|
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>type</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>Type refers to the type of the authorizer
|
|
"Webhook" is supported in the generic API server
|
|
Other API servers may support additional authorizer
|
|
types like Node, RBAC, ABAC, etc.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>name</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>Name used to describe the webhook
|
|
This is explicitly used in monitoring machinery for metrics
|
|
Note: Names must be DNS1123 labels like <code>myauthorizername</code> or
|
|
subdomains like <code>myauthorizer.example.domain</code>
|
|
Required, with no default</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>webhook</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-WebhookConfiguration"><code>WebhookConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>Webhook defines the configuration for a Webhook authorizer
|
|
Must be defined when Type=Webhook
|
|
Must not be defined when Type!=Webhook</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `IdentityConfiguration` {#apiserver-config-k8s-io-v1-IdentityConfiguration}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
|
|
|
|
|
|
<p>IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.</p>
|
|
|
|
|
|
|
|
|
|
## `KMSConfiguration` {#apiserver-config-k8s-io-v1-KMSConfiguration}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
|
|
|
|
|
|
<p>KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.</p>
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>apiVersion</code><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>apiVersion of KeyManagementService</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>name</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>name is the name of the KMS plugin to be used.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>cachesize</code><br/>
|
|
<code>int32</code>
|
|
</td>
|
|
<td>
|
|
<p>cachesize is the maximum number of secrets which are cached in memory. The default value is 1000.
|
|
Set to a negative value to disable caching. This field is only allowed for KMS v1 providers.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>endpoint</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>timeout</code><br/>
|
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `Key` {#apiserver-config-k8s-io-v1-Key}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [AESConfiguration](#apiserver-config-k8s-io-v1-AESConfiguration)
|
|
|
|
- [SecretboxConfiguration](#apiserver-config-k8s-io-v1-SecretboxConfiguration)
|
|
|
|
|
|
<p>Key contains name and secret of the provided key for a transformer.</p>
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>name</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>name is the name of the key to be used while storing data to disk.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>secret</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>secret is the actual key, encoded in base64.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `ProviderConfiguration` {#apiserver-config-k8s-io-v1-ProviderConfiguration}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [ResourceConfiguration](#apiserver-config-k8s-io-v1-ResourceConfiguration)
|
|
|
|
|
|
<p>ProviderConfiguration stores the provided configuration for an encryption provider.</p>
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>aesgcm</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-AESConfiguration"><code>AESConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>aesgcm is the configuration for the AES-GCM transformer.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>aescbc</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-AESConfiguration"><code>AESConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>aescbc is the configuration for the AES-CBC transformer.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>secretbox</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-SecretboxConfiguration"><code>SecretboxConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>secretbox is the configuration for the Secretbox based transformer.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>identity</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-IdentityConfiguration"><code>IdentityConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>identity is the (empty) configuration for the identity transformer.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>kms</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-KMSConfiguration"><code>KMSConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `ResourceConfiguration` {#apiserver-config-k8s-io-v1-ResourceConfiguration}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration)
|
|
|
|
|
|
<p>ResourceConfiguration stores per resource configuration.</p>
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>resources</code> <B>[Required]</B><br/>
|
|
<code>[]string</code>
|
|
</td>
|
|
<td>
|
|
<p>resources is a list of kubernetes resources which have to be encrypted. The resource names are derived from <code>resource</code> or <code>resource.group</code> of the group/version/resource.
|
|
eg: pandas.awesome.bears.example is a custom resource with 'group': awesome.bears.example, 'resource': pandas.
|
|
Use '<em>.</em>' to encrypt all resources and '<em>.<!-- raw HTML omitted -->' to encrypt all resources in a specific group.
|
|
eg: '</em>.awesome.bears.example' will encrypt all resources in the group 'awesome.bears.example'.
|
|
eg: '*.' will encrypt all resources in the core group (such as pods, configmaps, etc).</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>providers</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-ProviderConfiguration"><code>[]ProviderConfiguration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>providers is a list of transformers to be used for reading and writing the resources to disk.
|
|
eg: aesgcm, aescbc, secretbox, identity, kms.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `SecretboxConfiguration` {#apiserver-config-k8s-io-v1-SecretboxConfiguration}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration)
|
|
|
|
|
|
<p>SecretboxConfiguration contains the API configuration for an Secretbox transformer.</p>
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>keys</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-Key"><code>[]Key</code></a>
|
|
</td>
|
|
<td>
|
|
<p>keys is a list of keys to be used for creating the Secretbox transformer.
|
|
Each key has to be 32 bytes long.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `WebhookConfiguration` {#apiserver-config-k8s-io-v1-WebhookConfiguration}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [AuthorizerConfiguration](#apiserver-config-k8s-io-v1-AuthorizerConfiguration)
|
|
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>authorizedTTL</code> <B>[Required]</B><br/>
|
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>The duration to cache 'authorized' responses from the webhook
|
|
authorizer.
|
|
Same as setting <code>--authorization-webhook-cache-authorized-ttl</code> flag
|
|
Default: 5m0s</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>unauthorizedTTL</code> <B>[Required]</B><br/>
|
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>The duration to cache 'unauthorized' responses from the webhook
|
|
authorizer.
|
|
Same as setting <code>--authorization-webhook-cache-unauthorized-ttl</code> flag
|
|
Default: 30s</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>timeout</code> <B>[Required]</B><br/>
|
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
|
</td>
|
|
<td>
|
|
<p>Timeout for the webhook request
|
|
Maximum allowed value is 30s.
|
|
Required, no default value.</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>subjectAccessReviewVersion</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>The API version of the authorization.k8s.io SubjectAccessReview to
|
|
send to and expect from the webhook.
|
|
Same as setting <code>--authorization-webhook-version</code> flag
|
|
Valid values: v1beta1, v1
|
|
Required, no default value</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>matchConditionSubjectAccessReviewVersion</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>MatchConditionSubjectAccessReviewVersion specifies the SubjectAccessReview
|
|
version the CEL expressions are evaluated against
|
|
Valid values: v1
|
|
Required, no default value</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>failurePolicy</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>Controls the authorization decision when a webhook request fails to
|
|
complete or returns a malformed response or errors evaluating
|
|
matchConditions.
|
|
Valid values:</p>
|
|
<ul>
|
|
<li>NoOpinion: continue to subsequent authorizers to see if one of
|
|
them allows the request</li>
|
|
<li>Deny: reject the request without consulting subsequent authorizers
|
|
Required, with no default.</li>
|
|
</ul>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>connectionInfo</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-WebhookConnectionInfo"><code>WebhookConnectionInfo</code></a>
|
|
</td>
|
|
<td>
|
|
<p>ConnectionInfo defines how we talk to the webhook</p>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>matchConditions</code> <B>[Required]</B><br/>
|
|
<a href="#apiserver-config-k8s-io-v1-WebhookMatchCondition"><code>[]WebhookMatchCondition</code></a>
|
|
</td>
|
|
<td>
|
|
<p>matchConditions is a list of conditions that must be met for a request to be sent to this
|
|
webhook. An empty list of matchConditions matches all requests.
|
|
There are a maximum of 64 match conditions allowed.</p>
|
|
<p>The exact matching logic is (in order):</p>
|
|
<ol>
|
|
<li>If at least one matchCondition evaluates to FALSE, then the webhook is skipped.</li>
|
|
<li>If ALL matchConditions evaluate to TRUE, then the webhook is called.</li>
|
|
<li>If at least one matchCondition evaluates to an error (but none are FALSE):
|
|
<ul>
|
|
<li>If failurePolicy=Deny, then the webhook rejects the request</li>
|
|
<li>If failurePolicy=NoOpinion, then the error is ignored and the webhook is skipped</li>
|
|
</ul>
|
|
</li>
|
|
</ol>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `WebhookConnectionInfo` {#apiserver-config-k8s-io-v1-WebhookConnectionInfo}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [WebhookConfiguration](#apiserver-config-k8s-io-v1-WebhookConfiguration)
|
|
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>type</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>Controls how the webhook should communicate with the server.
|
|
Valid values:</p>
|
|
<ul>
|
|
<li>KubeConfigFile: use the file specified in kubeConfigFile to locate the
|
|
server.</li>
|
|
<li>InClusterConfig: use the in-cluster configuration to call the
|
|
SubjectAccessReview API hosted by kube-apiserver. This mode is not
|
|
allowed for kube-apiserver.</li>
|
|
</ul>
|
|
</td>
|
|
</tr>
|
|
<tr><td><code>kubeConfigFile</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>Path to KubeConfigFile for connection info
|
|
Required, if connectionInfo.Type is KubeConfig</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
## `WebhookMatchCondition` {#apiserver-config-k8s-io-v1-WebhookMatchCondition}
|
|
|
|
|
|
**Appears in:**
|
|
|
|
- [WebhookConfiguration](#apiserver-config-k8s-io-v1-WebhookConfiguration)
|
|
|
|
|
|
|
|
<table class="table">
|
|
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
|
<tbody>
|
|
|
|
|
|
<tr><td><code>expression</code> <B>[Required]</B><br/>
|
|
<code>string</code>
|
|
</td>
|
|
<td>
|
|
<p>expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
|
CEL expressions have access to the contents of the SubjectAccessReview in v1 version.
|
|
If version specified by subjectAccessReviewVersion in the request variable is v1beta1,
|
|
the contents would be converted to the v1 version before evaluating the CEL expression.</p>
|
|
<ul>
|
|
<li>'resourceAttributes' describes information for a resource access request and is unset for non-resource requests. e.g. has(request.resourceAttributes) && request.resourceAttributes.namespace == 'default'</li>
|
|
<li>'nonResourceAttributes' describes information for a non-resource access request and is unset for resource requests. e.g. has(request.nonResourceAttributes) && request.nonResourceAttributes.path == '/healthz'.</li>
|
|
<li>'user' is the user to test for. e.g. request.user == 'alice'</li>
|
|
<li>'groups' is the groups to test for. e.g. ('group1' in request.groups)</li>
|
|
<li>'extra' corresponds to the user.Info.GetExtra() method from the authenticator.</li>
|
|
<li>'uid' is the information about the requesting user. e.g. request.uid == '1'</li>
|
|
</ul>
|
|
<p>Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|