From 151599d47a9b866a7d7b8dffc5714557817bbcf2 Mon Sep 17 00:00:00 2001 From: Rita Zhang Date: Mon, 4 Nov 2024 16:26:42 -0800 Subject: [PATCH] Add webhookmatchcondition doc comment Signed-off-by: Rita Zhang Co-authored-by: Jordan Liggitt --- staging/src/k8s.io/apiserver/pkg/apis/apiserver/types.go | 7 +++++++ .../src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go | 7 +++++++ .../k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go | 7 +++++++ .../k8s.io/apiserver/pkg/apis/apiserver/v1beta1/types.go | 7 +++++++ 4 files changed, 28 insertions(+) diff --git a/staging/src/k8s.io/apiserver/pkg/apis/apiserver/types.go b/staging/src/k8s.io/apiserver/pkg/apis/apiserver/types.go index af70fe24460..a610ebc1a6c 100644 --- a/staging/src/k8s.io/apiserver/pkg/apis/apiserver/types.go +++ b/staging/src/k8s.io/apiserver/pkg/apis/apiserver/types.go @@ -401,6 +401,13 @@ type WebhookMatchCondition struct { // If version specified by subjectAccessReviewVersion in the request variable is v1beta1, // the contents would be converted to the v1 version before evaluating the CEL expression. // + // - 'resourceAttributes' describes information for a resource access request and is unset for non-resource requests. e.g. has(request.resourceAttributes) && request.resourceAttributes.namespace == 'default' + // - 'nonResourceAttributes' describes information for a non-resource access request and is unset for resource requests. e.g. has(request.nonResourceAttributes) && request.nonResourceAttributes.path == '/healthz'. + // - 'user' is the user to test for. e.g. request.user == 'alice' + // - 'groups' is the groups to test for. e.g. ('group1' in request.groups) + // - 'extra' corresponds to the user.Info.GetExtra() method from the authenticator. + // - 'uid' is the information about the requesting user. e.g. request.uid == '1' + // // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ Expression string } diff --git a/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go b/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go index e72109364f7..18328c5582c 100644 --- a/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go +++ b/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go @@ -164,6 +164,13 @@ type WebhookMatchCondition struct { // If version specified by subjectAccessReviewVersion in the request variable is v1beta1, // the contents would be converted to the v1 version before evaluating the CEL expression. // + // - 'resourceAttributes' describes information for a resource access request and is unset for non-resource requests. e.g. has(request.resourceAttributes) && request.resourceAttributes.namespace == 'default' + // - 'nonResourceAttributes' describes information for a non-resource access request and is unset for resource requests. e.g. has(request.nonResourceAttributes) && request.nonResourceAttributes.path == '/healthz'. + // - 'user' is the user to test for. e.g. request.user == 'alice' + // - 'groups' is the groups to test for. e.g. ('group1' in request.groups) + // - 'extra' corresponds to the user.Info.GetExtra() method from the authenticator. + // - 'uid' is the information about the requesting user. e.g. request.uid == '1' + // // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ Expression string `json:"expression"` } diff --git a/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go b/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go index 214ef4e4fca..dee2c115a15 100644 --- a/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go +++ b/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go @@ -615,6 +615,13 @@ type WebhookMatchCondition struct { // If version specified by subjectAccessReviewVersion in the request variable is v1beta1, // the contents would be converted to the v1 version before evaluating the CEL expression. // + // - 'resourceAttributes' describes information for a resource access request and is unset for non-resource requests. e.g. has(request.resourceAttributes) && request.resourceAttributes.namespace == 'default' + // - 'nonResourceAttributes' describes information for a non-resource access request and is unset for resource requests. e.g. has(request.nonResourceAttributes) && request.nonResourceAttributes.path == '/healthz'. + // - 'user' is the user to test for. e.g. request.user == 'alice' + // - 'groups' is the groups to test for. e.g. ('group1' in request.groups) + // - 'extra' corresponds to the user.Info.GetExtra() method from the authenticator. + // - 'uid' is the information about the requesting user. e.g. request.uid == '1' + // // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ Expression string `json:"expression"` } diff --git a/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1beta1/types.go b/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1beta1/types.go index 570f3c4682b..a0e13593b3b 100644 --- a/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1beta1/types.go +++ b/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1beta1/types.go @@ -586,6 +586,13 @@ type WebhookMatchCondition struct { // If version specified by subjectAccessReviewVersion in the request variable is v1beta1, // the contents would be converted to the v1 version before evaluating the CEL expression. // + // - 'resourceAttributes' describes information for a resource access request and is unset for non-resource requests. e.g. has(request.resourceAttributes) && request.resourceAttributes.namespace == 'default' + // - 'nonResourceAttributes' describes information for a non-resource access request and is unset for resource requests. e.g. has(request.nonResourceAttributes) && request.nonResourceAttributes.path == '/healthz'. + // - 'user' is the user to test for. e.g. request.user == 'alice' + // - 'groups' is the groups to test for. e.g. ('group1' in request.groups) + // - 'extra' corresponds to the user.Info.GetExtra() method from the authenticator. + // - 'uid' is the information about the requesting user. e.g. request.uid == '1' + // // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ Expression string `json:"expression"` }