Module admissionregistration/v1beta1

@pulumi/kubernetes > admissionregistration > v1beta1

Index

types/input.ts types/output.ts

function isMutatingWebhookConfiguration

isMutatingWebhookConfiguration(o: any): boolean

function isMutatingWebhookConfigurationList

isMutatingWebhookConfigurationList(o: any): boolean

function isValidatingWebhookConfiguration

isValidatingWebhookConfiguration(o: any): boolean

function isValidatingWebhookConfigurationList

isValidatingWebhookConfigurationList(o: any): boolean

interface MutatingWebhookConfiguration

MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.

property apiVersion

apiVersion: string;

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources

property kind

kind: string;

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds

property metadata

metadata: ObjectMeta;

Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata.

property webhooks

webhooks: Webhook[];

Webhooks is a list of webhooks and the affected resources and operations.

interface MutatingWebhookConfigurationList

MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.

property apiVersion

apiVersion: string;

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources

property items

items: MutatingWebhookConfiguration[];

List of MutatingWebhookConfiguration.

property kind

kind: string;

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds

property metadata

metadata: ListMeta;

Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds

interface RuleWithOperations

RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.

property apiGroups

apiGroups: string[];

APIGroups is the API groups the resources belong to. ‘’ is all groups. If ‘’ is present, the length of the slice must be one. Required.

property apiVersions

apiVersions: string[];

APIVersions is the API versions the resources belong to. ‘’ is all versions. If ‘’ is present, the length of the slice must be one. Required.

property operations

operations: string[];

Operations is the operations the admission hook cares about - CREATE, UPDATE, or * for all operations. If ‘*’ is present, the length of the slice must be one. Required.

property resources

resources: string[];

Resources is a list of resources this rule applies to.

For example: ‘pods’ means pods. ‘pods/log’ means the log subresource of pods. ‘’ means all resources, but not subresources. ‘pods/’ means all subresources of pods. ‘‍/scale’ means all scale subresources. ‘‍/*’ means all resources and their subresources.

If wildcard is present, the validation rule will ensure resources do not overlap with each other.

Depending on the enclosing object, subresources might not be allowed. Required.

interface ServiceReference

ServiceReference holds a reference to Service.legacy.k8s.io

property name

name: string;

name is the name of the service. Required

property namespace

namespace: string;

namespace is the namespace of the service. Required

property path

path: string;

path is an optional URL path which will be sent in any request to this service.

interface ValidatingWebhookConfiguration

ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.

property apiVersion

apiVersion: string;

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources

property kind

kind: string;

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds

property metadata

metadata: ObjectMeta;

Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata.

property webhooks

webhooks: Webhook[];

Webhooks is a list of webhooks and the affected resources and operations.

interface ValidatingWebhookConfigurationList

ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.

property apiVersion

apiVersion: string;

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources

property items

items: ValidatingWebhookConfiguration[];

List of ValidatingWebhookConfiguration.

property kind

kind: string;

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds

property metadata

metadata: ListMeta;

Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds

interface Webhook

Webhook describes an admission webhook and the resources and operations it applies to.

property clientConfig

clientConfig: WebhookClientConfig;

ClientConfig defines how to communicate with the hook. Required

property failurePolicy

failurePolicy: string;

FailurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Ignore.

property name

name: string;

The name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where “imagepolicy” is the name of the webhook, and kubernetes.io is the name of the organization. Required.

property namespaceSelector

namespaceSelector: LabelSelector;

NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook.

For example, to run the webhook on any objects whose namespace is not associated with “runlevel” of “0” or “1”; you will set the selector as follows: “namespaceSelector”: { “matchExpressions”: [ { “key”: “runlevel”, “operator”: “NotIn”, “values”: [ “0”, “1” ] } ] }

If instead you want to only run the webhook on any objects whose namespace is associated with the “environment” of “prod” or “staging”; you will set the selector as follows: “namespaceSelector”: { “matchExpressions”: [ { “key”: “environment”, “operator”: “In”, “values”: [ “prod”, “staging” ] } ] }

See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

Default to the empty LabelSelector, which matches everything.

property rules

rules: RuleWithOperations[];

Rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches any Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.

property sideEffects

sideEffects: string;

SideEffects states whether this webhookk has side effects. Acceptable values are: Unknown, None, Some, NoneOnDryRun Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission change and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some. Defaults to Unknown.

interface WebhookClientConfig

WebhookClientConfig contains the information to make a TLS connection with the webhook

property caBundle

caBundle: string;

caBundle is a PEM encoded CA bundle which will be used to validate the webhook’s server certificate. If unspecified, system trust roots on the apiserver are used.

property service

service: ServiceReference;

service is a reference to the service for this webhook. Either service or url must be specified.

If the webhook is running within the cluster, then you should use service.

Port 443 will be used if it is open, otherwise it is an error.

property url

url: string;

url gives the location of the webhook, in standard URL form (scheme://host:port/path). Exactly one of url or service must be specified.

The host should not refer to a service running in the cluster; use the service field instead. The host might be resolved via external DNS in some apiservers (e.g., kube-apiserver cannot resolve in-cluster DNS as that would be a layering violation). host may also be an IP address.

Please note that using localhost or 127.0.0.1 as a host is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster.

The scheme must be “https”; the URL must begin with “https://”.

A path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier.

Attempting to use a user or basic auth e.g. “user:password@” is not allowed. Fragments (“#…”) and query parameters (“?…”) are not allowed, either.