Class V1alpha1MatchResources
MatchResources decides whether to run the admission control policy on an object
based on whether it meets the match criteria. The exclude rules take precedence
over include rules (if a resource matches both, it is excluded)
Inheritance
V1alpha1MatchResources
Assembly: KubernetesClient.dll
Syntax
public record V1alpha1MatchResources : IEquatable<V1alpha1MatchResources>
Constructors
View Source
V1alpha1MatchResources()
Declaration
public V1alpha1MatchResources()
View Source
V1alpha1MatchResources(V1alpha1MatchResources)
Declaration
protected V1alpha1MatchResources(V1alpha1MatchResources original)
Parameters
Properties
View Source
EqualityContract
Declaration
protected virtual Type EqualityContract { get; }
Property Value
View Source
ExcludeResourceRules
ExcludeResourceRules describes what operations on what resources/subresources
the policy should not care about. The exclude rules take precedence over include
rules (if a resource matches both, it is excluded)
Declaration
[JsonPropertyName("excludeResourceRules")]
public IList<V1alpha1NamedRuleWithOperations> ExcludeResourceRules { get; set; }
Property Value
View Source
MatchPolicy
matchPolicy defines how the "MatchResources" list is used to match incoming
requests. Allowed values are "Exact" or "Equivalent".
Exact: match a request only if it exactly matches a specified rule. For
example, if deployments can be modified via apps/v1, apps/v1beta1, and
extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], the admission policy does not
consider requests to apps/v1beta1 or extensions/v1beta1 API groups.
Equivalent: match a request if modifies a resource listed in rules, even via
another API group or version. For example, if deployments can be modified via
apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included
apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], the
admission policy does consider requests made to apps/v1beta1 or
extensions/v1beta1 API groups. The API server translates the request to a
matched resource API if necessary.
Defaults to "Equivalent"
Declaration
[JsonPropertyName("matchPolicy")]
public string MatchPolicy { get; set; }
Property Value
View Source
NamespaceSelector
NamespaceSelector decides whether to run the admission control policy on an
object based on whether the namespace for that object matches the selector. If
the object itself is a namespace, the matching is performed on
object.metadata.labels. If the object is another cluster scoped resource, it
never skips the policy.
For example, to run the webhook on any objects whose namespace is not associated
with "runlevel" of "0" or "1"; you will set the selector as follows:
"namespaceSelector": {
"matchExpressions": [
{
"key": "runlevel",
"operator": "NotIn",
"values": [
"0",
"1"
]
}
]
}
If instead you want to only run the policy on any objects whose namespace is
associated with the "environment" of "prod" or "staging"; you will set the
selector as follows: "namespaceSelector": {
"matchExpressions": [
{
"key": "environment",
"operator": "In",
"values": [
"prod",
"staging"
]
}
]
}
See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
for more examples of label selectors.
Default to the empty LabelSelector, which matches everything.
Declaration
[JsonPropertyName("namespaceSelector")]
public V1LabelSelector NamespaceSelector { get; set; }
Property Value
View Source
ObjectSelector
ObjectSelector decides whether to run the policy based on if the object has
matching labels. objectSelector is evaluated against both the oldObject and
newObject that would be sent to the policy's expression (CEL), and is considered
to match if either object matches the selector. A null object (oldObject in the
case of create, or newObject in the case of delete) or an object that cannot
have labels (like a DeploymentRollback or a PodProxyOptions object) is not
considered to match. Use the object selector only if the webhook is opt-in,
because end users may skip the admission webhook by setting the labels. Default
to the empty LabelSelector, which matches everything.
Declaration
[JsonPropertyName("objectSelector")]
public V1LabelSelector ObjectSelector { get; set; }
Property Value
View Source
ResourceRules
ResourceRules describes what operations on what resources/subresources the
admission policy matches. The policy cares about an operation if it matches
any Rule.
Declaration
[JsonPropertyName("resourceRules")]
public IList<V1alpha1NamedRuleWithOperations> ResourceRules { get; set; }
Property Value
Methods
View Source
Equals(object?)
Declaration
public override bool Equals(object? obj)
Parameters
| Type |
Name |
Description |
| object |
obj |
|
Returns
Overrides
View Source
Equals(V1alpha1MatchResources?)
Declaration
public virtual bool Equals(V1alpha1MatchResources? other)
Parameters
Returns
View Source
GetHashCode()
Declaration
public override int GetHashCode()
Returns
Overrides
View Source
PrintMembers(StringBuilder)
Declaration
protected virtual bool PrintMembers(StringBuilder builder)
Parameters
Returns
View Source
ToString()
Declaration
public override string ToString()
Returns
Overrides
Operators
View Source
operator ==(V1alpha1MatchResources?, V1alpha1MatchResources?)
Declaration
public static bool operator ==(V1alpha1MatchResources? left, V1alpha1MatchResources? right)
Parameters
Returns
View Source
operator !=(V1alpha1MatchResources?, V1alpha1MatchResources?)
Declaration
public static bool operator !=(V1alpha1MatchResources? left, V1alpha1MatchResources? right)
Parameters
Returns
Implements