mirror of
https://github.com/kubernetes/client-go.git
synced 2026-02-22 08:03:18 +00:00
253 lines
14 KiB
Go
253 lines
14 KiB
Go
/*
|
|
Copyright The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
// Code generated by applyconfiguration-gen. DO NOT EDIT.
|
|
|
|
package v1
|
|
|
|
import (
|
|
corev1 "k8s.io/api/core/v1"
|
|
)
|
|
|
|
// PodSecurityContextApplyConfiguration represents a declarative configuration of the PodSecurityContext type for use
|
|
// with apply.
|
|
//
|
|
// PodSecurityContext holds pod-level security attributes and common container settings.
|
|
// Some fields are also present in container.securityContext. Field values of
|
|
// container.securityContext take precedence over field values of PodSecurityContext.
|
|
type PodSecurityContextApplyConfiguration struct {
|
|
// The SELinux context to be applied to all containers.
|
|
// If unspecified, the container runtime will allocate a random SELinux context for each
|
|
// container. May also be set in SecurityContext. If set in
|
|
// both SecurityContext and PodSecurityContext, the value specified in SecurityContext
|
|
// takes precedence for that container.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
SELinuxOptions *SELinuxOptionsApplyConfiguration `json:"seLinuxOptions,omitempty"`
|
|
// The Windows specific settings applied to all containers.
|
|
// If unspecified, the options within a container's SecurityContext will be used.
|
|
// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
|
|
// Note that this field cannot be set when spec.os.name is linux.
|
|
WindowsOptions *WindowsSecurityContextOptionsApplyConfiguration `json:"windowsOptions,omitempty"`
|
|
// The UID to run the entrypoint of the container process.
|
|
// Defaults to user specified in image metadata if unspecified.
|
|
// May also be set in SecurityContext. If set in both SecurityContext and
|
|
// PodSecurityContext, the value specified in SecurityContext takes precedence
|
|
// for that container.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
RunAsUser *int64 `json:"runAsUser,omitempty"`
|
|
// The GID to run the entrypoint of the container process.
|
|
// Uses runtime default if unset.
|
|
// May also be set in SecurityContext. If set in both SecurityContext and
|
|
// PodSecurityContext, the value specified in SecurityContext takes precedence
|
|
// for that container.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
RunAsGroup *int64 `json:"runAsGroup,omitempty"`
|
|
// Indicates that the container must run as a non-root user.
|
|
// If true, the Kubelet will validate the image at runtime to ensure that it
|
|
// does not run as UID 0 (root) and fail to start the container if it does.
|
|
// If unset or false, no such validation will be performed.
|
|
// May also be set in SecurityContext. If set in both SecurityContext and
|
|
// PodSecurityContext, the value specified in SecurityContext takes precedence.
|
|
RunAsNonRoot *bool `json:"runAsNonRoot,omitempty"`
|
|
// A list of groups applied to the first process run in each container, in
|
|
// addition to the container's primary GID and fsGroup (if specified). If
|
|
// the SupplementalGroupsPolicy feature is enabled, the
|
|
// supplementalGroupsPolicy field determines whether these are in addition
|
|
// to or instead of any group memberships defined in the container image.
|
|
// If unspecified, no additional groups are added, though group memberships
|
|
// defined in the container image may still be used, depending on the
|
|
// supplementalGroupsPolicy field.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
SupplementalGroups []int64 `json:"supplementalGroups,omitempty"`
|
|
// Defines how supplemental groups of the first container processes are calculated.
|
|
// Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
|
|
// (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
|
|
// and the container runtime must implement support for this feature.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
// TODO: update the default value to "Merge" when spec.os.name is not windows in v1.34
|
|
SupplementalGroupsPolicy *corev1.SupplementalGroupsPolicy `json:"supplementalGroupsPolicy,omitempty"`
|
|
// A special supplemental group that applies to all containers in a pod.
|
|
// Some volume types allow the Kubelet to change the ownership of that volume
|
|
// to be owned by the pod:
|
|
//
|
|
// 1. The owning GID will be the FSGroup
|
|
// 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
|
|
// 3. The permission bits are OR'd with rw-rw----
|
|
//
|
|
// If unset, the Kubelet will not modify the ownership and permissions of any volume.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
FSGroup *int64 `json:"fsGroup,omitempty"`
|
|
// Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
|
|
// sysctls (by the container runtime) might fail to launch.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
Sysctls []SysctlApplyConfiguration `json:"sysctls,omitempty"`
|
|
// fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
|
|
// before being exposed inside Pod. This field will only apply to
|
|
// volume types which support fsGroup based ownership(and permissions).
|
|
// It will have no effect on ephemeral volume types such as: secret, configmaps
|
|
// and emptydir.
|
|
// Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
FSGroupChangePolicy *corev1.PodFSGroupChangePolicy `json:"fsGroupChangePolicy,omitempty"`
|
|
// The seccomp options to use by the containers in this pod.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
SeccompProfile *SeccompProfileApplyConfiguration `json:"seccompProfile,omitempty"`
|
|
// appArmorProfile is the AppArmor options to use by the containers in this pod.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
AppArmorProfile *AppArmorProfileApplyConfiguration `json:"appArmorProfile,omitempty"`
|
|
// seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod.
|
|
// It has no effect on nodes that do not support SELinux or to volumes does not support SELinux.
|
|
// Valid values are "MountOption" and "Recursive".
|
|
//
|
|
// "Recursive" means relabeling of all files on all Pod volumes by the container runtime.
|
|
// This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.
|
|
//
|
|
// "MountOption" mounts all eligible Pod volumes with `-o context` mount option.
|
|
// This requires all Pods that share the same volume to use the same SELinux label.
|
|
// It is not possible to share the same volume among privileged and unprivileged Pods.
|
|
// Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
|
|
// whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
|
|
// CSIDriver instance. Other volumes are always re-labelled recursively.
|
|
// "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
|
|
//
|
|
// If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
|
|
// If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
|
|
// and "Recursive" for all other volumes.
|
|
//
|
|
// This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
|
|
//
|
|
// All Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state.
|
|
// Note that this field cannot be set when spec.os.name is windows.
|
|
SELinuxChangePolicy *corev1.PodSELinuxChangePolicy `json:"seLinuxChangePolicy,omitempty"`
|
|
}
|
|
|
|
// PodSecurityContextApplyConfiguration constructs a declarative configuration of the PodSecurityContext type for use with
|
|
// apply.
|
|
func PodSecurityContext() *PodSecurityContextApplyConfiguration {
|
|
return &PodSecurityContextApplyConfiguration{}
|
|
}
|
|
|
|
// WithSELinuxOptions sets the SELinuxOptions field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the SELinuxOptions field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithSELinuxOptions(value *SELinuxOptionsApplyConfiguration) *PodSecurityContextApplyConfiguration {
|
|
b.SELinuxOptions = value
|
|
return b
|
|
}
|
|
|
|
// WithWindowsOptions sets the WindowsOptions field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the WindowsOptions field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithWindowsOptions(value *WindowsSecurityContextOptionsApplyConfiguration) *PodSecurityContextApplyConfiguration {
|
|
b.WindowsOptions = value
|
|
return b
|
|
}
|
|
|
|
// WithRunAsUser sets the RunAsUser field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the RunAsUser field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithRunAsUser(value int64) *PodSecurityContextApplyConfiguration {
|
|
b.RunAsUser = &value
|
|
return b
|
|
}
|
|
|
|
// WithRunAsGroup sets the RunAsGroup field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the RunAsGroup field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithRunAsGroup(value int64) *PodSecurityContextApplyConfiguration {
|
|
b.RunAsGroup = &value
|
|
return b
|
|
}
|
|
|
|
// WithRunAsNonRoot sets the RunAsNonRoot field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the RunAsNonRoot field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithRunAsNonRoot(value bool) *PodSecurityContextApplyConfiguration {
|
|
b.RunAsNonRoot = &value
|
|
return b
|
|
}
|
|
|
|
// WithSupplementalGroups adds the given value to the SupplementalGroups field in the declarative configuration
|
|
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
|
|
// If called multiple times, values provided by each call will be appended to the SupplementalGroups field.
|
|
func (b *PodSecurityContextApplyConfiguration) WithSupplementalGroups(values ...int64) *PodSecurityContextApplyConfiguration {
|
|
for i := range values {
|
|
b.SupplementalGroups = append(b.SupplementalGroups, values[i])
|
|
}
|
|
return b
|
|
}
|
|
|
|
// WithSupplementalGroupsPolicy sets the SupplementalGroupsPolicy field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the SupplementalGroupsPolicy field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithSupplementalGroupsPolicy(value corev1.SupplementalGroupsPolicy) *PodSecurityContextApplyConfiguration {
|
|
b.SupplementalGroupsPolicy = &value
|
|
return b
|
|
}
|
|
|
|
// WithFSGroup sets the FSGroup field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the FSGroup field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithFSGroup(value int64) *PodSecurityContextApplyConfiguration {
|
|
b.FSGroup = &value
|
|
return b
|
|
}
|
|
|
|
// WithSysctls adds the given value to the Sysctls field in the declarative configuration
|
|
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
|
|
// If called multiple times, values provided by each call will be appended to the Sysctls field.
|
|
func (b *PodSecurityContextApplyConfiguration) WithSysctls(values ...*SysctlApplyConfiguration) *PodSecurityContextApplyConfiguration {
|
|
for i := range values {
|
|
if values[i] == nil {
|
|
panic("nil value passed to WithSysctls")
|
|
}
|
|
b.Sysctls = append(b.Sysctls, *values[i])
|
|
}
|
|
return b
|
|
}
|
|
|
|
// WithFSGroupChangePolicy sets the FSGroupChangePolicy field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the FSGroupChangePolicy field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithFSGroupChangePolicy(value corev1.PodFSGroupChangePolicy) *PodSecurityContextApplyConfiguration {
|
|
b.FSGroupChangePolicy = &value
|
|
return b
|
|
}
|
|
|
|
// WithSeccompProfile sets the SeccompProfile field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the SeccompProfile field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithSeccompProfile(value *SeccompProfileApplyConfiguration) *PodSecurityContextApplyConfiguration {
|
|
b.SeccompProfile = value
|
|
return b
|
|
}
|
|
|
|
// WithAppArmorProfile sets the AppArmorProfile field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the AppArmorProfile field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithAppArmorProfile(value *AppArmorProfileApplyConfiguration) *PodSecurityContextApplyConfiguration {
|
|
b.AppArmorProfile = value
|
|
return b
|
|
}
|
|
|
|
// WithSELinuxChangePolicy sets the SELinuxChangePolicy field in the declarative configuration to the given value
|
|
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
|
|
// If called multiple times, the SELinuxChangePolicy field is set to the value of the last call.
|
|
func (b *PodSecurityContextApplyConfiguration) WithSELinuxChangePolicy(value corev1.PodSELinuxChangePolicy) *PodSecurityContextApplyConfiguration {
|
|
b.SELinuxChangePolicy = &value
|
|
return b
|
|
}
|