k8s_openapi/v1_33/api/admissionregistration/v1/
validating_admission_policy_spec.rs

Help
1// Generated from definition io.k8s.api.admissionregistration.v1.ValidatingAdmissionPolicySpec
2
3/// ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
4#[derive(Clone, Debug, Default, PartialEq)]
5pub struct ValidatingAdmissionPolicySpec {
6    /// auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.
7    pub audit_annotations: Option<std::vec::Vec<crate::api::admissionregistration::v1::AuditAnnotation>>,
8
9    /// failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.
10    ///
11    /// A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.
12    ///
13    /// failurePolicy does not define how validations that evaluate to false are handled.
14    ///
15    /// When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.
16    ///
17    /// Allowed values are Ignore or Fail. Defaults to Fail.
18    pub failure_policy: Option<std::string::String>,
19
20    /// MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.
21    ///
22    /// If a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.
23    ///
24    /// The exact matching logic is (in order):
25    ///   1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
26    ///   2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
27    ///   3. If any matchCondition evaluates to an error (but none are FALSE):
28    ///      - If failurePolicy=Fail, reject the request
29    ///      - If failurePolicy=Ignore, the policy is skipped
30    pub match_conditions: Option<std::vec::Vec<crate::api::admissionregistration::v1::MatchCondition>>,
31
32    /// MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
33    pub match_constraints: Option<crate::api::admissionregistration::v1::MatchResources>,
34
35    /// ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
36    pub param_kind: Option<crate::api::admissionregistration::v1::ParamKind>,
37
38    /// Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.
39    pub validations: Option<std::vec::Vec<crate::api::admissionregistration::v1::Validation>>,
40
41    /// Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.
42    ///
43    /// The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.
44    pub variables: Option<std::vec::Vec<crate::api::admissionregistration::v1::Variable>>,
45}
46
47impl crate::DeepMerge for ValidatingAdmissionPolicySpec {
48    fn merge_from(&mut self, other: Self) {
49        crate::merge_strategies::list::atomic(&mut self.audit_annotations, other.audit_annotations);
50        crate::DeepMerge::merge_from(&mut self.failure_policy, other.failure_policy);
51        crate::merge_strategies::list::map(
52            &mut self.match_conditions,
53            other.match_conditions,
54            &[|lhs, rhs| lhs.name == rhs.name],
55            |current_item, other_item| {
56                crate::DeepMerge::merge_from(current_item, other_item);
57            },
58        );
59        crate::DeepMerge::merge_from(&mut self.match_constraints, other.match_constraints);
60        crate::DeepMerge::merge_from(&mut self.param_kind, other.param_kind);
61        crate::merge_strategies::list::atomic(&mut self.validations, other.validations);
62        crate::merge_strategies::list::map(
63            &mut self.variables,
64            other.variables,
65            &[|lhs, rhs| lhs.name == rhs.name],
66            |current_item, other_item| {
67                crate::DeepMerge::merge_from(current_item, other_item);
68            },
69        );
70    }
71}
72
73impl<'de> crate::serde::Deserialize<'de> for ValidatingAdmissionPolicySpec {
74    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error> where D: crate::serde::Deserializer<'de> {
75        #[allow(non_camel_case_types)]
76        enum Field {
77            Key_audit_annotations,
78            Key_failure_policy,
79            Key_match_conditions,
80            Key_match_constraints,
81            Key_param_kind,
82            Key_validations,
83            Key_variables,
84            Other,
85        }
86
87        impl<'de> crate::serde::Deserialize<'de> for Field {
88            fn deserialize<D>(deserializer: D) -> Result<Self, D::Error> where D: crate::serde::Deserializer<'de> {
89                struct Visitor;
90
91                impl crate::serde::de::Visitor<'_> for Visitor {
92                    type Value = Field;
93
94                    fn expecting(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
95                        f.write_str("field identifier")
96                    }
97
98                    fn visit_str<E>(self, v: &str) -> Result<Self::Value, E> where E: crate::serde::de::Error {
99                        Ok(match v {
100                            "auditAnnotations" => Field::Key_audit_annotations,
101                            "failurePolicy" => Field::Key_failure_policy,
102                            "matchConditions" => Field::Key_match_conditions,
103                            "matchConstraints" => Field::Key_match_constraints,
104                            "paramKind" => Field::Key_param_kind,
105                            "validations" => Field::Key_validations,
106                            "variables" => Field::Key_variables,
107                            _ => Field::Other,
108                        })
109                    }
110                }
111
112                deserializer.deserialize_identifier(Visitor)
113            }
114        }
115
116        struct Visitor;
117
118        impl<'de> crate::serde::de::Visitor<'de> for Visitor {
119            type Value = ValidatingAdmissionPolicySpec;
120
121            fn expecting(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
122                f.write_str("ValidatingAdmissionPolicySpec")
123            }
124
125            fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error> where A: crate::serde::de::MapAccess<'de> {
126                let mut value_audit_annotations: Option<std::vec::Vec<crate::api::admissionregistration::v1::AuditAnnotation>> = None;
127                let mut value_failure_policy: Option<std::string::String> = None;
128                let mut value_match_conditions: Option<std::vec::Vec<crate::api::admissionregistration::v1::MatchCondition>> = None;
129                let mut value_match_constraints: Option<crate::api::admissionregistration::v1::MatchResources> = None;
130                let mut value_param_kind: Option<crate::api::admissionregistration::v1::ParamKind> = None;
131                let mut value_validations: Option<std::vec::Vec<crate::api::admissionregistration::v1::Validation>> = None;
132                let mut value_variables: Option<std::vec::Vec<crate::api::admissionregistration::v1::Variable>> = None;
133
134                while let Some(key) = crate::serde::de::MapAccess::next_key::<Field>(&mut map)? {
135                    match key {
136                        Field::Key_audit_annotations => value_audit_annotations = crate::serde::de::MapAccess::next_value(&mut map)?,
137                        Field::Key_failure_policy => value_failure_policy = crate::serde::de::MapAccess::next_value(&mut map)?,
138                        Field::Key_match_conditions => value_match_conditions = crate::serde::de::MapAccess::next_value(&mut map)?,
139                        Field::Key_match_constraints => value_match_constraints = crate::serde::de::MapAccess::next_value(&mut map)?,
140                        Field::Key_param_kind => value_param_kind = crate::serde::de::MapAccess::next_value(&mut map)?,
141                        Field::Key_validations => value_validations = crate::serde::de::MapAccess::next_value(&mut map)?,
142                        Field::Key_variables => value_variables = crate::serde::de::MapAccess::next_value(&mut map)?,
143                        Field::Other => { let _: crate::serde::de::IgnoredAny = crate::serde::de::MapAccess::next_value(&mut map)?; },
144                    }
145                }
146
147                Ok(ValidatingAdmissionPolicySpec {
148                    audit_annotations: value_audit_annotations,
149                    failure_policy: value_failure_policy,
150                    match_conditions: value_match_conditions,
151                    match_constraints: value_match_constraints,
152                    param_kind: value_param_kind,
153                    validations: value_validations,
154                    variables: value_variables,
155                })
156            }
157        }
158
159        deserializer.deserialize_struct(
160            "ValidatingAdmissionPolicySpec",
161            &[
162                "auditAnnotations",
163                "failurePolicy",
164                "matchConditions",
165                "matchConstraints",
166                "paramKind",
167                "validations",
168                "variables",
169            ],
170            Visitor,
171        )
172    }
173}
174
175impl crate::serde::Serialize for ValidatingAdmissionPolicySpec {
176    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error> where S: crate::serde::Serializer {
177        let mut state = serializer.serialize_struct(
178            "ValidatingAdmissionPolicySpec",
179            self.audit_annotations.as_ref().map_or(0, |_| 1) +
180            self.failure_policy.as_ref().map_or(0, |_| 1) +
181            self.match_conditions.as_ref().map_or(0, |_| 1) +
182            self.match_constraints.as_ref().map_or(0, |_| 1) +
183            self.param_kind.as_ref().map_or(0, |_| 1) +
184            self.validations.as_ref().map_or(0, |_| 1) +
185            self.variables.as_ref().map_or(0, |_| 1),
186        )?;
187        if let Some(value) = &self.audit_annotations {
188            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "auditAnnotations", value)?;
189        }
190        if let Some(value) = &self.failure_policy {
191            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "failurePolicy", value)?;
192        }
193        if let Some(value) = &self.match_conditions {
194            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "matchConditions", value)?;
195        }
196        if let Some(value) = &self.match_constraints {
197            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "matchConstraints", value)?;
198        }
199        if let Some(value) = &self.param_kind {
200            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "paramKind", value)?;
201        }
202        if let Some(value) = &self.validations {
203            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "validations", value)?;
204        }
205        if let Some(value) = &self.variables {
206            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "variables", value)?;
207        }
208        crate::serde::ser::SerializeStruct::end(state)
209    }
210}
211
212#[cfg(feature = "schemars")]
213impl crate::schemars::JsonSchema for ValidatingAdmissionPolicySpec {
214    fn schema_name() -> std::string::String {
215        "io.k8s.api.admissionregistration.v1.ValidatingAdmissionPolicySpec".into()
216    }
217
218    fn json_schema(__gen: &mut crate::schemars::gen::SchemaGenerator) -> crate::schemars::schema::Schema {
219        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
220            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
221                description: Some("ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.".into()),
222                ..Default::default()
223            })),
224            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::Object))),
225            object: Some(std::boxed::Box::new(crate::schemars::schema::ObjectValidation {
226                properties: [
227                    (
228                        "auditAnnotations".into(),
229                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
230                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
231                                description: Some("auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.".into()),
232                                ..Default::default()
233                            })),
234                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::Array))),
235                            array: Some(std::boxed::Box::new(crate::schemars::schema::ArrayValidation {
236                                items: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(__gen.subschema_for::<crate::api::admissionregistration::v1::AuditAnnotation>()))),
237                                ..Default::default()
238                            })),
239                            ..Default::default()
240                        }),
241                    ),
242                    (
243                        "failurePolicy".into(),
244                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
245                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
246                                description: Some("failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.\n\nA policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.\n\nfailurePolicy does not define how validations that evaluate to false are handled.\n\nWhen failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.\n\nAllowed values are Ignore or Fail. Defaults to Fail.".into()),
247                                ..Default::default()
248                            })),
249                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::String))),
250                            ..Default::default()
251                        }),
252                    ),
253                    (
254                        "matchConditions".into(),
255                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
256                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
257                                description: Some("MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.\n\nThe exact matching logic is (in order):\n  1. If ANY matchCondition evaluates to FALSE, the policy is skipped.\n  2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.\n  3. If any matchCondition evaluates to an error (but none are FALSE):\n     - If failurePolicy=Fail, reject the request\n     - If failurePolicy=Ignore, the policy is skipped".into()),
258                                ..Default::default()
259                            })),
260                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::Array))),
261                            array: Some(std::boxed::Box::new(crate::schemars::schema::ArrayValidation {
262                                items: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(__gen.subschema_for::<crate::api::admissionregistration::v1::MatchCondition>()))),
263                                ..Default::default()
264                            })),
265                            ..Default::default()
266                        }),
267                    ),
268                    (
269                        "matchConstraints".into(),
270                        {
271                            let mut schema_obj = __gen.subschema_for::<crate::api::admissionregistration::v1::MatchResources>().into_object();
272                            schema_obj.metadata = Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
273                                description: Some("MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.".into()),
274                                ..Default::default()
275                            }));
276                            crate::schemars::schema::Schema::Object(schema_obj)
277                        },
278                    ),
279                    (
280                        "paramKind".into(),
281                        {
282                            let mut schema_obj = __gen.subschema_for::<crate::api::admissionregistration::v1::ParamKind>().into_object();
283                            schema_obj.metadata = Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
284                                description: Some("ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.".into()),
285                                ..Default::default()
286                            }));
287                            crate::schemars::schema::Schema::Object(schema_obj)
288                        },
289                    ),
290                    (
291                        "validations".into(),
292                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
293                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
294                                description: Some("Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.".into()),
295                                ..Default::default()
296                            })),
297                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::Array))),
298                            array: Some(std::boxed::Box::new(crate::schemars::schema::ArrayValidation {
299                                items: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(__gen.subschema_for::<crate::api::admissionregistration::v1::Validation>()))),
300                                ..Default::default()
301                            })),
302                            ..Default::default()
303                        }),
304                    ),
305                    (
306                        "variables".into(),
307                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
308                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
309                                description: Some("Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.\n\nThe expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.".into()),
310                                ..Default::default()
311                            })),
312                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::Array))),
313                            array: Some(std::boxed::Box::new(crate::schemars::schema::ArrayValidation {
314                                items: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(__gen.subschema_for::<crate::api::admissionregistration::v1::Variable>()))),
315                                ..Default::default()
316                            })),
317                            ..Default::default()
318                        }),
319                    ),
320                ].into(),
321                ..Default::default()
322            })),
323            ..Default::default()
324        })
325    }
326}
k8s_openapi/v1_33/api/admissionregistration/v1/validating_admission_policy_spec.rs

k8s_openapi/v1_33/api/admissionregistration/v1/
validating_admission_policy_spec.rs
