From 6c7c1cea6fd34980c89032fbfc21b8654e7738ab Mon Sep 17 00:00:00 2001 From: Mike Spreitzer Date: Thu, 7 Oct 2021 14:29:51 -0700 Subject: [PATCH] Update comment on ResourcePolicyRule Track the long-ago addition of the ClusterScope field. --- staging/src/k8s.io/api/flowcontrol/v1alpha1/types.go | 6 ++++-- staging/src/k8s.io/api/flowcontrol/v1beta1/types.go | 6 ++++-- staging/src/k8s.io/api/flowcontrol/v1beta2/types.go | 6 ++++-- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/staging/src/k8s.io/api/flowcontrol/v1alpha1/types.go b/staging/src/k8s.io/api/flowcontrol/v1alpha1/types.go index afcc6fa34e6..99b609494b9 100644 --- a/staging/src/k8s.io/api/flowcontrol/v1alpha1/types.go +++ b/staging/src/k8s.io/api/flowcontrol/v1alpha1/types.go @@ -241,8 +241,10 @@ type ServiceAccountSubject struct { // ResourcePolicyRule matches a resource request if and only if: (a) // at least one member of verbs matches the request, (b) at least one // member of apiGroups matches the request, (c) at least one member of -// resources matches the request, and (d) least one member of -// namespaces matches the request. +// resources matches the request, and (d) either (d1) the request does +// not specify a namespace (i.e., `Namespace==""`) and clusterScope is +// true or (d2) the request specifies a namespace and least one member +// of namespaces matches the request's namespace. type ResourcePolicyRule struct { // `verbs` is a list of matching verbs and may not be empty. // "*" matches all verbs and, if present, must be the only entry. diff --git a/staging/src/k8s.io/api/flowcontrol/v1beta1/types.go b/staging/src/k8s.io/api/flowcontrol/v1beta1/types.go index c38021d6976..767a32e7f51 100644 --- a/staging/src/k8s.io/api/flowcontrol/v1beta1/types.go +++ b/staging/src/k8s.io/api/flowcontrol/v1beta1/types.go @@ -279,8 +279,10 @@ type ServiceAccountSubject struct { // ResourcePolicyRule matches a resource request if and only if: (a) // at least one member of verbs matches the request, (b) at least one // member of apiGroups matches the request, (c) at least one member of -// resources matches the request, and (d) least one member of -// namespaces matches the request. +// resources matches the request, and (d) either (d1) the request does +// not specify a namespace (i.e., `Namespace==""`) and clusterScope is +// true or (d2) the request specifies a namespace and least one member +// of namespaces matches the request's namespace. type ResourcePolicyRule struct { // `verbs` is a list of matching verbs and may not be empty. // "*" matches all verbs and, if present, must be the only entry. diff --git a/staging/src/k8s.io/api/flowcontrol/v1beta2/types.go b/staging/src/k8s.io/api/flowcontrol/v1beta2/types.go index 166d38b76bf..408681e998c 100644 --- a/staging/src/k8s.io/api/flowcontrol/v1beta2/types.go +++ b/staging/src/k8s.io/api/flowcontrol/v1beta2/types.go @@ -279,8 +279,10 @@ type ServiceAccountSubject struct { // ResourcePolicyRule matches a resource request if and only if: (a) // at least one member of verbs matches the request, (b) at least one // member of apiGroups matches the request, (c) at least one member of -// resources matches the request, and (d) least one member of -// namespaces matches the request. +// resources matches the request, and (d) either (d1) the request does +// not specify a namespace (i.e., `Namespace==""`) and clusterScope is +// true or (d2) the request specifies a namespace and least one member +// of namespaces matches the request's namespace. type ResourcePolicyRule struct { // `verbs` is a list of matching verbs and may not be empty. // "*" matches all verbs and, if present, must be the only entry.