k8s_openapi/v1_33/api/admissionregistration/v1alpha1/
mutating_admission_policy_spec.rs

1// Generated from definition io.k8s.api.admissionregistration.v1alpha1.MutatingAdmissionPolicySpec
2
3/// MutatingAdmissionPolicySpec is the specification of the desired behavior of the admission policy.
4#[derive(Clone, Debug, Default, PartialEq)]
5pub struct MutatingAdmissionPolicySpec {
6    /// failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.
7    ///
8    /// A policy is invalid if paramKind refers to a non-existent Kind. A binding is invalid if paramRef.name refers to a non-existent resource.
9    ///
10    /// failurePolicy does not define how validations that evaluate to false are handled.
11    ///
12    /// Allowed values are Ignore or Fail. Defaults to Fail.
13    pub failure_policy: Option<std::string::String>,
14
15    /// matchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the matchConstraints. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.
16    ///
17    /// If a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.
18    ///
19    /// The exact matching logic is (in order):
20    ///   1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
21    ///   2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
22    ///   3. If any matchCondition evaluates to an error (but none are FALSE):
23    ///      - If failurePolicy=Fail, reject the request
24    ///      - If failurePolicy=Ignore, the policy is skipped
25    pub match_conditions: Option<std::vec::Vec<crate::api::admissionregistration::v1alpha1::MatchCondition>>,
26
27    /// matchConstraints specifies what resources this policy is designed to validate. The MutatingAdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API MutatingAdmissionPolicy cannot match MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding. The CREATE, UPDATE and CONNECT operations are allowed.  The DELETE operation may not be matched. '*' matches CREATE, UPDATE and CONNECT. Required.
28    pub match_constraints: Option<crate::api::admissionregistration::v1alpha1::MatchResources>,
29
30    /// mutations contain operations to perform on matching objects. mutations may not be empty; a minimum of one mutation is required. mutations are evaluated in order, and are reinvoked according to the reinvocationPolicy. The mutations of a policy are invoked for each binding of this policy and reinvocation of mutations occurs on a per binding basis.
31    pub mutations: Option<std::vec::Vec<crate::api::admissionregistration::v1alpha1::Mutation>>,
32
33    /// paramKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If paramKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in MutatingAdmissionPolicyBinding, the params variable will be null.
34    pub param_kind: Option<crate::api::admissionregistration::v1alpha1::ParamKind>,
35
36    /// reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding as part of a single admission evaluation. Allowed values are "Never" and "IfNeeded".
37    ///
38    /// Never: These mutations will not be called more than once per binding in a single admission evaluation.
39    ///
40    /// IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies.  Mutations are only reinvoked when mutations change the object after this mutation is invoked. Required.
41    pub reinvocation_policy: Option<std::string::String>,
42
43    /// variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except matchConditions because matchConditions are evaluated before the rest of the policy.
44    ///
45    /// The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, variables must be sorted by the order of first appearance and acyclic.
46    pub variables: Option<std::vec::Vec<crate::api::admissionregistration::v1alpha1::Variable>>,
47}
48
49impl crate::DeepMerge for MutatingAdmissionPolicySpec {
50    fn merge_from(&mut self, other: Self) {
51        crate::DeepMerge::merge_from(&mut self.failure_policy, other.failure_policy);
52        crate::merge_strategies::list::map(
53            &mut self.match_conditions,
54            other.match_conditions,
55            &[|lhs, rhs| lhs.name == rhs.name],
56            |current_item, other_item| {
57                crate::DeepMerge::merge_from(current_item, other_item);
58            },
59        );
60        crate::DeepMerge::merge_from(&mut self.match_constraints, other.match_constraints);
61        crate::merge_strategies::list::atomic(&mut self.mutations, other.mutations);
62        crate::DeepMerge::merge_from(&mut self.param_kind, other.param_kind);
63        crate::DeepMerge::merge_from(&mut self.reinvocation_policy, other.reinvocation_policy);
64        crate::merge_strategies::list::atomic(&mut self.variables, other.variables);
65    }
66}
67
68impl<'de> crate::serde::Deserialize<'de> for MutatingAdmissionPolicySpec {
69    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error> where D: crate::serde::Deserializer<'de> {
70        #[allow(non_camel_case_types)]
71        enum Field {
72            Key_failure_policy,
73            Key_match_conditions,
74            Key_match_constraints,
75            Key_mutations,
76            Key_param_kind,
77            Key_reinvocation_policy,
78            Key_variables,
79            Other,
80        }
81
82        impl<'de> crate::serde::Deserialize<'de> for Field {
83            fn deserialize<D>(deserializer: D) -> Result<Self, D::Error> where D: crate::serde::Deserializer<'de> {
84                struct Visitor;
85
86                impl crate::serde::de::Visitor<'_> for Visitor {
87                    type Value = Field;
88
89                    fn expecting(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
90                        f.write_str("field identifier")
91                    }
92
93                    fn visit_str<E>(self, v: &str) -> Result<Self::Value, E> where E: crate::serde::de::Error {
94                        Ok(match v {
95                            "failurePolicy" => Field::Key_failure_policy,
96                            "matchConditions" => Field::Key_match_conditions,
97                            "matchConstraints" => Field::Key_match_constraints,
98                            "mutations" => Field::Key_mutations,
99                            "paramKind" => Field::Key_param_kind,
100                            "reinvocationPolicy" => Field::Key_reinvocation_policy,
101                            "variables" => Field::Key_variables,
102                            _ => Field::Other,
103                        })
104                    }
105                }
106
107                deserializer.deserialize_identifier(Visitor)
108            }
109        }
110
111        struct Visitor;
112
113        impl<'de> crate::serde::de::Visitor<'de> for Visitor {
114            type Value = MutatingAdmissionPolicySpec;
115
116            fn expecting(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
117                f.write_str("MutatingAdmissionPolicySpec")
118            }
119
120            fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error> where A: crate::serde::de::MapAccess<'de> {
121                let mut value_failure_policy: Option<std::string::String> = None;
122                let mut value_match_conditions: Option<std::vec::Vec<crate::api::admissionregistration::v1alpha1::MatchCondition>> = None;
123                let mut value_match_constraints: Option<crate::api::admissionregistration::v1alpha1::MatchResources> = None;
124                let mut value_mutations: Option<std::vec::Vec<crate::api::admissionregistration::v1alpha1::Mutation>> = None;
125                let mut value_param_kind: Option<crate::api::admissionregistration::v1alpha1::ParamKind> = None;
126                let mut value_reinvocation_policy: Option<std::string::String> = None;
127                let mut value_variables: Option<std::vec::Vec<crate::api::admissionregistration::v1alpha1::Variable>> = None;
128
129                while let Some(key) = crate::serde::de::MapAccess::next_key::<Field>(&mut map)? {
130                    match key {
131                        Field::Key_failure_policy => value_failure_policy = crate::serde::de::MapAccess::next_value(&mut map)?,
132                        Field::Key_match_conditions => value_match_conditions = crate::serde::de::MapAccess::next_value(&mut map)?,
133                        Field::Key_match_constraints => value_match_constraints = crate::serde::de::MapAccess::next_value(&mut map)?,
134                        Field::Key_mutations => value_mutations = crate::serde::de::MapAccess::next_value(&mut map)?,
135                        Field::Key_param_kind => value_param_kind = crate::serde::de::MapAccess::next_value(&mut map)?,
136                        Field::Key_reinvocation_policy => value_reinvocation_policy = crate::serde::de::MapAccess::next_value(&mut map)?,
137                        Field::Key_variables => value_variables = crate::serde::de::MapAccess::next_value(&mut map)?,
138                        Field::Other => { let _: crate::serde::de::IgnoredAny = crate::serde::de::MapAccess::next_value(&mut map)?; },
139                    }
140                }
141
142                Ok(MutatingAdmissionPolicySpec {
143                    failure_policy: value_failure_policy,
144                    match_conditions: value_match_conditions,
145                    match_constraints: value_match_constraints,
146                    mutations: value_mutations,
147                    param_kind: value_param_kind,
148                    reinvocation_policy: value_reinvocation_policy,
149                    variables: value_variables,
150                })
151            }
152        }
153
154        deserializer.deserialize_struct(
155            "MutatingAdmissionPolicySpec",
156            &[
157                "failurePolicy",
158                "matchConditions",
159                "matchConstraints",
160                "mutations",
161                "paramKind",
162                "reinvocationPolicy",
163                "variables",
164            ],
165            Visitor,
166        )
167    }
168}
169
170impl crate::serde::Serialize for MutatingAdmissionPolicySpec {
171    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error> where S: crate::serde::Serializer {
172        let mut state = serializer.serialize_struct(
173            "MutatingAdmissionPolicySpec",
174            self.failure_policy.as_ref().map_or(0, |_| 1) +
175            self.match_conditions.as_ref().map_or(0, |_| 1) +
176            self.match_constraints.as_ref().map_or(0, |_| 1) +
177            self.mutations.as_ref().map_or(0, |_| 1) +
178            self.param_kind.as_ref().map_or(0, |_| 1) +
179            self.reinvocation_policy.as_ref().map_or(0, |_| 1) +
180            self.variables.as_ref().map_or(0, |_| 1),
181        )?;
182        if let Some(value) = &self.failure_policy {
183            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "failurePolicy", value)?;
184        }
185        if let Some(value) = &self.match_conditions {
186            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "matchConditions", value)?;
187        }
188        if let Some(value) = &self.match_constraints {
189            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "matchConstraints", value)?;
190        }
191        if let Some(value) = &self.mutations {
192            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "mutations", value)?;
193        }
194        if let Some(value) = &self.param_kind {
195            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "paramKind", value)?;
196        }
197        if let Some(value) = &self.reinvocation_policy {
198            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "reinvocationPolicy", value)?;
199        }
200        if let Some(value) = &self.variables {
201            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "variables", value)?;
202        }
203        crate::serde::ser::SerializeStruct::end(state)
204    }
205}
206
207#[cfg(feature = "schemars")]
208impl crate::schemars::JsonSchema for MutatingAdmissionPolicySpec {
209    fn schema_name() -> std::string::String {
210        "io.k8s.api.admissionregistration.v1alpha1.MutatingAdmissionPolicySpec".into()
211    }
212
213    fn json_schema(__gen: &mut crate::schemars::gen::SchemaGenerator) -> crate::schemars::schema::Schema {
214        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
215            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
216                description: Some("MutatingAdmissionPolicySpec is the specification of the desired behavior of the admission policy.".into()),
217                ..Default::default()
218            })),
219            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::Object))),
220            object: Some(std::boxed::Box::new(crate::schemars::schema::ObjectValidation {
221                properties: [
222                    (
223                        "failurePolicy".into(),
224                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
225                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
226                                description: Some("failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.\n\nA policy is invalid if paramKind refers to a non-existent Kind. A binding is invalid if paramRef.name refers to a non-existent resource.\n\nfailurePolicy does not define how validations that evaluate to false are handled.\n\nAllowed values are Ignore or Fail. Defaults to Fail.".into()),
227                                ..Default::default()
228                            })),
229                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::String))),
230                            ..Default::default()
231                        }),
232                    ),
233                    (
234                        "matchConditions".into(),
235                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
236                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
237                                description: Some("matchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the matchConstraints. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nIf a parameter object is provided, it can be accessed via the `params` handle in the same manner as validation expressions.\n\nThe exact matching logic is (in order):\n  1. If ANY matchCondition evaluates to FALSE, the policy is skipped.\n  2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.\n  3. If any matchCondition evaluates to an error (but none are FALSE):\n     - If failurePolicy=Fail, reject the request\n     - If failurePolicy=Ignore, the policy is skipped".into()),
238                                ..Default::default()
239                            })),
240                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::Array))),
241                            array: Some(std::boxed::Box::new(crate::schemars::schema::ArrayValidation {
242                                items: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(__gen.subschema_for::<crate::api::admissionregistration::v1alpha1::MatchCondition>()))),
243                                ..Default::default()
244                            })),
245                            ..Default::default()
246                        }),
247                    ),
248                    (
249                        "matchConstraints".into(),
250                        {
251                            let mut schema_obj = __gen.subschema_for::<crate::api::admissionregistration::v1alpha1::MatchResources>().into_object();
252                            schema_obj.metadata = Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
253                                description: Some("matchConstraints specifies what resources this policy is designed to validate. The MutatingAdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API MutatingAdmissionPolicy cannot match MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding. The CREATE, UPDATE and CONNECT operations are allowed.  The DELETE operation may not be matched. '*' matches CREATE, UPDATE and CONNECT. Required.".into()),
254                                ..Default::default()
255                            }));
256                            crate::schemars::schema::Schema::Object(schema_obj)
257                        },
258                    ),
259                    (
260                        "mutations".into(),
261                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
262                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
263                                description: Some("mutations contain operations to perform on matching objects. mutations may not be empty; a minimum of one mutation is required. mutations are evaluated in order, and are reinvoked according to the reinvocationPolicy. The mutations of a policy are invoked for each binding of this policy and reinvocation of mutations occurs on a per binding basis.".into()),
264                                ..Default::default()
265                            })),
266                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::Array))),
267                            array: Some(std::boxed::Box::new(crate::schemars::schema::ArrayValidation {
268                                items: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(__gen.subschema_for::<crate::api::admissionregistration::v1alpha1::Mutation>()))),
269                                ..Default::default()
270                            })),
271                            ..Default::default()
272                        }),
273                    ),
274                    (
275                        "paramKind".into(),
276                        {
277                            let mut schema_obj = __gen.subschema_for::<crate::api::admissionregistration::v1alpha1::ParamKind>().into_object();
278                            schema_obj.metadata = Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
279                                description: Some("paramKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If paramKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in MutatingAdmissionPolicyBinding, the params variable will be null.".into()),
280                                ..Default::default()
281                            }));
282                            crate::schemars::schema::Schema::Object(schema_obj)
283                        },
284                    ),
285                    (
286                        "reinvocationPolicy".into(),
287                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
288                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
289                                description: Some("reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding as part of a single admission evaluation. Allowed values are \"Never\" and \"IfNeeded\".\n\nNever: These mutations will not be called more than once per binding in a single admission evaluation.\n\nIfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies.  Mutations are only reinvoked when mutations change the object after this mutation is invoked. Required.".into()),
290                                ..Default::default()
291                            })),
292                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::String))),
293                            ..Default::default()
294                        }),
295                    ),
296                    (
297                        "variables".into(),
298                        crate::schemars::schema::Schema::Object(crate::schemars::schema::SchemaObject {
299                            metadata: Some(std::boxed::Box::new(crate::schemars::schema::Metadata {
300                                description: Some("variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under `variables` in other expressions of the policy except matchConditions because matchConditions are evaluated before the rest of the policy.\n\nThe expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, variables must be sorted by the order of first appearance and acyclic.".into()),
301                                ..Default::default()
302                            })),
303                            instance_type: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(crate::schemars::schema::InstanceType::Array))),
304                            array: Some(std::boxed::Box::new(crate::schemars::schema::ArrayValidation {
305                                items: Some(crate::schemars::schema::SingleOrVec::Single(std::boxed::Box::new(__gen.subschema_for::<crate::api::admissionregistration::v1alpha1::Variable>()))),
306                                ..Default::default()
307                            })),
308                            ..Default::default()
309                        }),
310                    ),
311                ].into(),
312                ..Default::default()
313            })),
314            ..Default::default()
315        })
316    }
317}