Struct k8s_openapi::api::authorization::v1::LabelSelectorAttributes
source · pub struct LabelSelectorAttributes {
pub raw_selector: Option<String>,
pub requirements: Option<Vec<LabelSelectorRequirement>>,
}
Expand description
LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
Fields§
§raw_selector: Option<String>
rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver’s *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.
requirements: Option<Vec<LabelSelectorRequirement>>
requirements is the parsed interpretation of a label selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.
Trait Implementations§
source§impl Clone for LabelSelectorAttributes
impl Clone for LabelSelectorAttributes
source§fn clone(&self) -> LabelSelectorAttributes
fn clone(&self) -> LabelSelectorAttributes
1.0.0 · source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source
. Read moresource§impl Debug for LabelSelectorAttributes
impl Debug for LabelSelectorAttributes
source§impl DeepMerge for LabelSelectorAttributes
impl DeepMerge for LabelSelectorAttributes
source§fn merge_from(&mut self, other: Self)
fn merge_from(&mut self, other: Self)
other
into self
.source§impl Default for LabelSelectorAttributes
impl Default for LabelSelectorAttributes
source§fn default() -> LabelSelectorAttributes
fn default() -> LabelSelectorAttributes
source§impl<'de> Deserialize<'de> for LabelSelectorAttributes
impl<'de> Deserialize<'de> for LabelSelectorAttributes
source§fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>where
D: Deserializer<'de>,
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>where
D: Deserializer<'de>,
source§impl PartialEq for LabelSelectorAttributes
impl PartialEq for LabelSelectorAttributes
source§impl Serialize for LabelSelectorAttributes
impl Serialize for LabelSelectorAttributes
impl StructuralPartialEq for LabelSelectorAttributes
Auto Trait Implementations§
impl Freeze for LabelSelectorAttributes
impl RefUnwindSafe for LabelSelectorAttributes
impl Send for LabelSelectorAttributes
impl Sync for LabelSelectorAttributes
impl Unpin for LabelSelectorAttributes
impl UnwindSafe for LabelSelectorAttributes
Blanket Implementations§
source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
source§unsafe fn clone_to_uninit(&self, dst: *mut T)
unsafe fn clone_to_uninit(&self, dst: *mut T)
clone_to_uninit
)