forked from kyverno/kyverno-envoy-plugin
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
- Loading branch information
1 parent
6ee14ce
commit de44127
Showing
4 changed files
with
151 additions
and
2 deletions.
There are no files selected for viewing
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| {{- if .Values.crds.install }} | ||
| --- | ||
| apiVersion: apiextensions.k8s.io/v1 | ||
| kind: CustomResourceDefinition | ||
| metadata: | ||
| labels: | ||
| {{- include "kyverno-authz-server.labels" . | nindent 4 }} | ||
| {{- with .Values.crds.labels }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| annotations: | ||
| {{- with .Values.crds.annotations }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| controller-gen.kubebuilder.io/version: v0.16.5 | ||
| name: authorizationpolicies.envoy.kyverno.io | ||
| spec: | ||
| group: envoy.kyverno.io | ||
| names: | ||
| kind: AuthorizationPolicy | ||
| listKind: AuthorizationPolicyList | ||
| plural: authorizationpolicies | ||
| singular: authorizationpolicy | ||
| scope: Cluster | ||
| versions: | ||
| - name: v1alpha1 | ||
| schema: | ||
| openAPIV3Schema: | ||
| properties: | ||
| apiVersion: | ||
| description: |- | ||
| APIVersion defines the versioned schema of this representation of an object. | ||
| Servers should convert recognized schemas to the latest internal value, and | ||
| may reject unrecognized values. | ||
| More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | ||
| type: string | ||
| kind: | ||
| description: |- | ||
| Kind is a string value representing the REST resource this object represents. | ||
| Servers may infer this from the endpoint the client submits requests to. | ||
| Cannot be updated. | ||
| In CamelCase. | ||
| More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | ||
| type: string | ||
| metadata: | ||
| type: object | ||
| spec: | ||
| properties: | ||
| authorizations: | ||
| description: Authorizations contain CEL expressions which is used | ||
| to apply the authorization. | ||
| items: | ||
| properties: | ||
| expression: | ||
| description: |- | ||
| Expression represents the expression which will be evaluated by CEL. | ||
| ref: https://github.com/google/cel-spec | ||
| CEL expressions have access to CEL variables as well as some other useful variables: | ||
| - 'object' - The object from the incoming request. (https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto#service-auth-v3-checkrequest) | ||
| CEL expressions are expected to return an envoy CheckResponse (https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto#service-auth-v3-checkresponse). | ||
| type: string | ||
| required: | ||
| - expression | ||
| type: object | ||
| type: array | ||
| x-kubernetes-list-type: atomic | ||
| failurePolicy: | ||
| description: |- | ||
| FailurePolicy defines how to handle failures for the policy. Failures can | ||
| occur from CEL expression parse errors, type check errors, runtime errors and invalid | ||
| or mis-configured policy definitions. | ||
| FailurePolicy does not define how validations that evaluate to false are handled. | ||
| Allowed values are Ignore or Fail. Defaults to Fail. | ||
| type: string | ||
| variables: | ||
| description: |- | ||
| Variables contain definitions of variables that can be used in composition of other expressions. | ||
| Each variable is defined as a named CEL expression. | ||
| The variables defined here will be available under `variables` in other expressions of the policy | ||
| except MatchConditions because MatchConditions are evaluated before the rest of the policy. | ||
| The expression of a variable can refer to other variables defined earlier in the list but not those after. | ||
| Thus, Variables must be sorted by the order of first appearance and acyclic. | ||
| items: | ||
| description: Variable is the definition of a variable that is used | ||
| for composition. A variable is defined as a named expression. | ||
| properties: | ||
| expression: | ||
| description: |- | ||
| Expression is the expression that will be evaluated as the value of the variable. | ||
| The CEL expression has access to the same identifiers as the CEL expressions in Validation. | ||
| type: string | ||
| name: | ||
| description: |- | ||
| Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. | ||
| The variable can be accessed in other expressions through `variables` | ||
| For example, if name is "foo", the variable will be available as `variables.foo` | ||
| type: string | ||
| required: | ||
| - expression | ||
| - name | ||
| type: object | ||
| x-kubernetes-map-type: atomic | ||
| type: array | ||
| x-kubernetes-list-map-keys: | ||
| - name | ||
| x-kubernetes-list-type: map | ||
| type: object | ||
| required: | ||
| - spec | ||
| type: object | ||
| served: true | ||
| storage: true | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters