added repo
This commit is contained in:
Your Name
@@ -0,0 +1,13 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno-api.chartVersion" -}}
|
||||
{{- .Chart.Version | replace "+" "_" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno-api.labels" -}}
|
||||
{{- tpl (toYaml .Values.labels) . -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno-api.annotations" -}}
|
||||
{{- tpl (toYaml .Values.annotations) . -}}
|
||||
{{- end -}}
|
||||
+1679
File diff suppressed because it is too large
Load Diff
+1868
File diff suppressed because it is too large
Load Diff
+6905
File diff suppressed because it is too large
Load Diff
+6581
File diff suppressed because it is too large
Load Diff
+1126
File diff suppressed because it is too large
Load Diff
+1256
File diff suppressed because it is too large
Load Diff
+4610
File diff suppressed because it is too large
Load Diff
+4394
File diff suppressed because it is too large
Load Diff
+3146
File diff suppressed because it is too large
Load Diff
+358
@@ -0,0 +1,358 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno-api.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "kyverno-api.annotations" . | nindent 4 }}
|
||||
name: policyexceptions.policies.kyverno.io
|
||||
spec:
|
||||
group: policies.kyverno.io
|
||||
names:
|
||||
kind: PolicyException
|
||||
listKind: PolicyExceptionList
|
||||
plural: policyexceptions
|
||||
singular: policyexception
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: PolicyException declares resources to be excluded from specified
|
||||
policies.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec declares policy exception behaviors.
|
||||
properties:
|
||||
allowedValues:
|
||||
description: |-
|
||||
AllowedValues specifies values that can be used in CEL expressions to bypass policy checks.
|
||||
These values can be referenced in CEL expressions via `exceptions.allowedValues`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
images:
|
||||
description: |-
|
||||
Images specifies container images to be excluded from policy evaluation.
|
||||
These excluded images can be referenced in CEL expressions via `exceptions.allowedImages`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matchConditions:
|
||||
description: MatchConditions is a list of CEL expressions that must
|
||||
be met for a resource to be excluded.
|
||||
items:
|
||||
description: MatchCondition represents a condition which must by
|
||||
fulfilled for a request to be sent to a webhook.
|
||||
properties:
|
||||
expression:
|
||||
description: |-
|
||||
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
|
||||
'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
||||
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
request resource.
|
||||
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
||||
|
||||
Required.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
the associated expression.
|
||||
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
||||
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
||||
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
||||
|
||||
Required.
|
||||
type: string
|
||||
required:
|
||||
- expression
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
policyRefs:
|
||||
description: PolicyRefs identifies the policies to which the exception
|
||||
is applied.
|
||||
items:
|
||||
properties:
|
||||
kind:
|
||||
description: Kind is the kind of the policy
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the policy
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
reportResult:
|
||||
default: skip
|
||||
description: |-
|
||||
ReportResult indicates whether the policy exception should be reported in the policy report
|
||||
as a skip result or pass result. Defaults to "skip".
|
||||
enum:
|
||||
- skip
|
||||
- pass
|
||||
type: string
|
||||
required:
|
||||
- policyRefs
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
- deprecated: true
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: PolicyException declares resources to be excluded from specified
|
||||
policies.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec declares policy exception behaviors.
|
||||
properties:
|
||||
allowedValues:
|
||||
description: |-
|
||||
AllowedValues specifies values that can be used in CEL expressions to bypass policy checks.
|
||||
These values can be referenced in CEL expressions via `exceptions.allowedValues`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
images:
|
||||
description: |-
|
||||
Images specifies container images to be excluded from policy evaluation.
|
||||
These excluded images can be referenced in CEL expressions via `exceptions.allowedImages`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matchConditions:
|
||||
description: MatchConditions is a list of CEL expressions that must
|
||||
be met for a resource to be excluded.
|
||||
items:
|
||||
description: MatchCondition represents a condition which must by
|
||||
fulfilled for a request to be sent to a webhook.
|
||||
properties:
|
||||
expression:
|
||||
description: |-
|
||||
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
|
||||
'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
||||
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
request resource.
|
||||
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
||||
|
||||
Required.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
the associated expression.
|
||||
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
||||
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
||||
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
||||
|
||||
Required.
|
||||
type: string
|
||||
required:
|
||||
- expression
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
policyRefs:
|
||||
description: PolicyRefs identifies the policies to which the exception
|
||||
is applied.
|
||||
items:
|
||||
properties:
|
||||
kind:
|
||||
description: Kind is the kind of the policy
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the policy
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
reportResult:
|
||||
default: skip
|
||||
description: |-
|
||||
ReportResult indicates whether the policy exception should be reported in the policy report
|
||||
as a skip result or pass result. Defaults to "skip".
|
||||
enum:
|
||||
- skip
|
||||
- pass
|
||||
type: string
|
||||
required:
|
||||
- policyRefs
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: PolicyException declares resources to be excluded from specified
|
||||
policies.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec declares policy exception behaviors.
|
||||
properties:
|
||||
allowedValues:
|
||||
description: |-
|
||||
AllowedValues specifies values that can be used in CEL expressions to bypass policy checks.
|
||||
These values can be referenced in CEL expressions via `exceptions.allowedValues`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
images:
|
||||
description: |-
|
||||
Images specifies container images to be excluded from policy evaluation.
|
||||
These excluded images can be referenced in CEL expressions via `exceptions.allowedImages`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matchConditions:
|
||||
description: MatchConditions is a list of CEL expressions that must
|
||||
be met for a resource to be excluded.
|
||||
items:
|
||||
description: MatchCondition represents a condition which must by
|
||||
fulfilled for a request to be sent to a webhook.
|
||||
properties:
|
||||
expression:
|
||||
description: |-
|
||||
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
|
||||
'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
||||
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
request resource.
|
||||
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
||||
|
||||
Required.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
the associated expression.
|
||||
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
||||
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
||||
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
||||
|
||||
Required.
|
||||
type: string
|
||||
required:
|
||||
- expression
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
policyRefs:
|
||||
description: PolicyRefs identifies the policies to which the exception
|
||||
is applied.
|
||||
items:
|
||||
properties:
|
||||
kind:
|
||||
description: Kind is the kind of the policy
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the policy
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
reportResult:
|
||||
default: skip
|
||||
description: |-
|
||||
ReportResult indicates whether the policy exception should be reported in the policy report
|
||||
as a skip result or pass result. Defaults to "skip".
|
||||
enum:
|
||||
- skip
|
||||
- pass
|
||||
type: string
|
||||
required:
|
||||
- policyRefs
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
+4709
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user