k8s.api.admissionregistration.v1beta1.MatchResources1.1.1

Overview
Properties
Methods
Classes
Type Aliases

module k8s.api.admissionregistration.v1beta1.MatchResources extends k8s.K8sObject

MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria.

Module URI:: package://pkg.pkl-lang.org/pkl-k8s/k8s@1.1.1#/api/admissionregistration/v1beta1/MatchResources.pkl
Pkl version:: 0.25.0 or higher
Source code:: MatchResources.pkl
Known subtypes:
Known usages:
All versions:

Properties(show inherited)

link

hidden

output: ModuleOutput (pkl.base)Source

The output of this module.

Defaults to all module properties rendered as either Pcf or the format specified on the command line.
link
matchPolicy: String?Source

matchPolicy defines how the "MatchResources" list is used to match incoming requests.
Allowed values are "Exact" or "Equivalent".
- Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
- Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
Defaults to "Equivalent"
link

resourceRules: Listing<NamedRuleWithOperations>?Source

ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.

The policy cares about an operation if it matches any Rule.
link

excludeResourceRules: Listing<NamedRuleWithOperations>?Source

ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.

The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
link

namespaceSelector: LabelSelector?Source

NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector.

If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.

For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": "0", "1" } ] }

If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": "prod", "staging" } ] }

See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

Default to the empty LabelSelector, which matches everything.
link

objectSelector: LabelSelector?Source

ObjectSelector decides whether to run the validation based on if the object has matching labels.

objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.

Methods(show inherited)

link

function

getClass(): Class (pkl.base)Source

Returns the class of this.
link

function

toString(): String (pkl.base)Source

Returns a string representation of this.

This method is used to convert the values of string interpolation expressions to strings.
link

function

ifNonNull<Result>(transform: (NonNull) -> Result): Result? (pkl.base)Source

Returns this |> transform if this is non-null, and null otherwise.

This method is the complement of the ?? operator and the equivalent of an Option type's map and flatMap methods.
link

function

hasProperty(name: String): Boolean (pkl.base)Source

Tells if this object has a property with the given name.
link

function

getProperty(name: String): unknown (pkl.base)Source

Returns the value of the property with the given name.

Throws if a property with this name does not exist.
link

function

getPropertyOrNull(name: String): unknown? (pkl.base)Source

Returns the value of the property with the given name.

Returns null if a property with this name does not exist.
link

function

toDynamic(): Dynamic (pkl.base)Source

Converts this object to a Dynamic object.
link

function

toMap(): Map<String, unknown> (pkl.base)Source

Converts this object to a Map.
link

function
relativePathTo(other: Module): List<String> (pkl.base)Source

Returns the relative, descendent directory path between this module and other.
Throws if no such path exists.

For example, if module mod1 has path /dir1/mod1.pkl, and module mod2 has path /dir1/dir2/dir3/mod2.pkl, then mod1.relativePathTo(mod2) will return List("dir2", "dir3").

A common use case is to compute the directory path between a template located at the root of a hierarchy (say rootModule.pkl) and the currently evaluated module (accessible via the module keyword):
```
import "rootModule.pkl" // self-import
path = rootModule.relativePathTo(module)
```
link

function

hasUniquePortNames(l: Listing): Boolean (k8s.K8sObject)

Tells if every port in l has a unique name. null names are ignored.
link

function

hasNonNullPortNames(l: Listing): Boolean (k8s.K8sObject)

Tells if every port in l has a non-null name, unless l has just a single port.
link

function

exactlyOneSet(a: Any, b: Any, c: Any): unknown (k8s.K8sObject)

Tells if exactly one of the three arguments is non-null.
link

function

onlyAllowedIf(str: String?, cond: Boolean): unknown (k8s.K8sObject)

Tells if str is only set when cond holds.

Classes(show inherited)

link

class

K8sVersion extends Annotation (k8s.K8sObject)

Indicates Kubernetes version information for the annotated member.
link

class

NamedRuleWithOperations Source

NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.

Type Aliases(show inherited)

link

typealias
Quantity = DataSize|Int|Float|String(matches(Regex(#"[+-]?(\d+(.\d*)?|\.\d+)([eE][+-]?(\d+(.\d*)?|\.\d+)|m|k|Ki|Mi?|Gi?|Ti?|Pi?|Ei?)?"#))) (k8s.K8sObject)

A fixed-point representation of a number.
Examples:
```
12
12e6
12.34
"12Mi" (12 * 2^20)
"12M"  (12 * 10^6)
12.mb (a [DataSize])
```
link

typealias

Time = String (k8s.K8sObject)

An RFC 3339 date and time value.

Example: "2016-04-21T08:47:53Z"
link

typealias

MicroTime = String (k8s.K8sObject)

A version of Time with microsecond level precision.
link

typealias

PortNumber = Int(isBetween(1, 65535)) (k8s.K8sObject)

A port number.
link

typealias

PortName = String(length <= 15, matches(Regex("[a-z0-9]+(-[a-z0-9]+)*")), contains(Regex("[a-z]"))) (k8s.K8sObject)

A port name conforming to RFC 6335 IANA service name syntax.

Contrary to the RFC, Kubernetes does not allow uppercase letters.
link

typealias

Rfc1035Label = String(length <= 63, matches(Regex("[a-z]([-a-z0-9]*[a-z0-9])?"))) (k8s.K8sObject)

An RFC 1035 DNS label.

Contrary to the RFC, Kubernetes does not allow uppercase letters.
link

typealias

Rfc1123Label = String(length <= 63, matches(Regex("[a-z0-9]([-a-z0-9]*[a-z0-9])?"))) (k8s.K8sObject)

An RFC 1123 DNS label.

Contrary to the RFC, Kubernetes does not allow uppercase letters.
link

typealias

Rfc1123Hostname = String(length <= 253, matches(Regex("[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*"))) (k8s.K8sObject)

An RFC 1123 hostname.

Contrary to the RFC, Kubernetes does not allow uppercase letters.
link

typealias

ApiRequestVerb = "get"|"list"|"watch"|"create"|"update"|"patch"|"delete"|"deletecollection"|"*"|"use"|"bind"|"escalate"|"impersonate"|String (k8s.K8sObject)

API verbs like get, list, create, update, patch, watch, delete, and deletecollection are used for resource requests.

To determine the request verb for a resource API endpoint, see Determine the request verb. CRDs may use verbs outside of the predefined set.
link

typealias

HttpRequestVerb = "get"|"post"|"put"|"delete"|"patch"|"head"|"*" (k8s.K8sObject)

Lowercased HTTP methods like get, post, put, and delete are used for non-resource requests.
link

typealias
FieldsV1 = String (k8s.K8sObject)

FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
Each key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats:
- 'f:', where is the name of a field in a struct, or key in a map
- 'v:', where is the exact json formatted value of a list item
- 'i:', where is position of a item in a list
- 'k:', where is a map of a list item's key fields to their unique values
If a key maps to an empty Fields value, the field that key represents is part of the set. The exact format is defined in sigs.k8s.io/structured-merge-diff.
link

typealias

RawExtension = Dynamic (k8s.K8sObject)

RawExtension is used to hold extensions in external versions.